A defensive distillation model construction method and device

Abstract

The invention relates to a defensive distillation model construction method and device. The method comprises the steps of obtaining original training data in a training set and a real label of the original training data; Performing knowledge distillation on the deep neural network according to the original training data and the real label, migrating knowledge of the deep neural network to the decision tree model, and generating a soft decision tree model; And performing countermeasure training on the soft decision tree model through the original training data to generate a defensive distillation model. The technical scheme of the invention is adopted; the decision tree model has good interpretability; the limitation of a defensive distillation technology on the framework requirement is broken through; the defensive distillation technology can be applied among different model structures, the application range of defensive distillation is expanded, and the scheme performs adversarial training on the soft decision tree model, so that not only is the problem of overfitting of the soft decision tree model prevented, but also the robustness of the model for adversarial samples can be improved.

Description

technical field [0001] The invention relates to the technical field of neural networks, in particular to a method and device for constructing a defensive distillation model. Background technique [0002] Deep learning has become one of the most active computer research fields, and the deep neural network model is favored due to its excellent performance. Deep neural networks have good application performance in many fields, such as face recognition, image classification, object tracking, etc. However, deep neural networks are vulnerable to adversarial examples, which can greatly degrade the performance of the model. Studies have shown that knowledge distillation technology can not only compress the model, but also improve the robustness of the deep learning model. Based on this, someone proposed the concept of defensive distillation to defend against the attack of adversarial samples. [0003] However, the existing defensive distillation techniques require the original mod...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the object of the present invention is to provide a method and device for constructing a defensive distillation model to solve the problem of requiring the original model and the distillation model to have a certain framework structure in the prior art, which limits the scope of application of the defensive distillation, and Adversarial attacks continue to increase, and the problem of low robustness against adversarial samples

Images