Adversarial defense method based on class activation mapping

Abstract

The invention discloses an adversarial defense method based on class activation mapping. The adversarial defense method comprises the following steps: S1, establishing a comparison image set for maximizing a neuron activation value in a prediction model through a gradient rising method; S2, positioning a judgment region based on the class activation mapping graph of the to-be-detected image; S3, calculating the inconsistency between the to-be-detected image judgment area and the same label comparison image judgment area based on a binarization algorithm; s4, judging whether the to-be-detectedimage has disturbance or not, if the inconsistency degree is greater than a threshold value, determining that the to-be-detected image has countermeasure disturbance, and otherwise, determining that the to-be-detected image is a normal image; and S5, removing the countermeasure disturbance in the to-be-detected image. The adversarial defense method is high in universality, can resist different confrontation attacks, is low in data processing cost, and improves the defense efficiency.

Description

technical field [0001] The invention belongs to the field of confrontation defense, and in particular relates to a confrontation defense method based on class activation mapping. Background technique [0002] In recent years, deep learning has made major breakthroughs in machine learning fields such as computer vision, speech recognition, and reinforcement learning, and has extremely high performance in visual fields such as video recognition, image classification, and video capture. But along with these successes, deep neural networks were found to be vulnerable to adversarial perturbations (maliciously crafted and added to mountains of input data), known as adversarial attacks. The vulnerability of deep neural networks to adversarial attacks has raised widespread concerns. According to the research results, even a small, indistinguishable perturbation in human visual perception can easily cause the model to make catastrophic mispredictions. For example, on autonomous dri...

AI Technical Summary

Problems solved by technology

All these methods have some disadvantages: they cannot find a general defense methodology, cannot resist different adversarial attacks, lack diversity

In addition, they introduce a large amount of data processing cost when removing interference, which greatly increases the computational cost of the method and seriously affects the defense efficiency

Images