Adversarial sample defense method based on feature remapping and application

Abstract

The invention discloses an adversarial sample defense method based on feature remapping and application. The method comprises the steps of: constructing a feature remapping model, wherein the featureremapping model comprises a significant feature generation model used for generating significant features, a non-significant feature generation model used for generating non-significant features and ashared discrimination model used for discriminating the authenticity of the significant features and the non-significant features; constructing a detector according to the significant feature generation model and the non-significant feature generation model, wherein the detector is used for detecting an adversarial sample and a benign sample; constructing a re-identifier according to the significant feature generation model, wherein the re-identifier is used for identifying the category of the adversarial sample; when adversarial sample detection is carried out, connecting a detector to the output of the target model, and carrying out adversarial sample detection by utilizing the detector; and during adversarial sample identification, connecting the re-identifier to the output of the target model, and performing adversarial sample identification by using the re-identifier. The dual defense effect of detection and re-identification of the adversarial sample can be realized.

Description

technical field [0001] The present invention relates to the field of defense oriented to deep learning confrontation attack and defense, in particular to a method and application of adversarial sample defense based on feature remapping. Background technique [0002] With the improvement of hardware computing power, the support of big data storage and the improvement of theoretical framework, deep learning technology has been applied to many fields with its powerful feature extraction and fitting capabilities, including computer vision, natural language processing, and bioinformatics. field and so on. At the same time, deep learning technology is gradually moving from the laboratory to industrialization, among which the application of automatic driving is the most prominent. Road sign recognition, license plate recognition, pedestrian recognition, road recognition, obstacle detection, etc. in the automatic driving system all involve computer vision technology, while voice co...

AI Technical Summary

Problems solved by technology

[0009] In order to overcome the shortcomings of the existing defense methods such as road sign recognition, license plate recognition, pedestrian recognition, road recognition, and obstacle detection, the need to obtain the privacy information of the original model, the impact on the recognition of the original benign sample, and the complex structure of the defense model, in order to achieve The double defense effect of detection and re-identification of adversarial samples, the present invention provides a method and application of adversarial sample defense based on feature remapping

Images