A Weakened Joint Reinforcement Method to Improve Robustness of Image Recognition Models

doi:10.3969/j.issn.1006-2475.2023.10.011

Abstract

Abstract: How to enhance the robustness of the model against adversarial examples attacks is an important research direction. In this paper， a method to improve the robustness of image recognition models is proposed. The method consists of a weakening operation and a strengthening operation. The weakening operation weakens the pixel values of the native input and destroys the structure of the adversarial perturbation. This process reduces the adversarial perturbation in the image but also loses some spatial semantic information， and this lost semantic information is supplemented by the reinforcement operation. The reinforcement operation consists of a feature extractor and a feature selector. The feature extractor is used to extract suitable image feature maps， and in order to select robust parts from these feature maps， a feature selector is designed to fuse the content of the feature maps and output feature maps with less perturbation and rich spatial semantic information. In this paper， the effectiveness of the method against adversarial examples is confirmed by extensive comparison experiments and the error accumulation phenomenon of adversarial perturbation is revealed.

Key words: Key words: deep learning, neural networks, adversarial example, image recognition

CLC Number:

TP391

LI Shi-da, XIANG Jian-wen. A Weakened Joint Reinforcement Method to Improve Robustness of Image Recognition Models[J]. Computer and Modernization, 2023, 0(10): 70-76.

References ［27］

［1］	HE K M， ZHANG X Y， REN S Q， et al. Deep residual learning for image recognition［C］// Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition. 2016:770-778.
［2］	SIMONYAN K， ZISSERMAN A. Very deep convolutional networks for large-scale image recognition［J］. arXiv preprint arXiv:1409.1556， 2014.
［3］	SZEGEDY C， IOFFE S， VANHOUCKE V， et al. Inception-v4， inception-ResNet and the impact of residual connections on learning［C］// Proceedings of the 31st AAAI Conference on Artificial Intelligence. 2017:4278-4284.
［4］	VASWANI A， SHAZEER N， PARMAR N， et al. Attention is all you need［C］// Proceedings of the 31st International Conference on Neural Information Processing Systems. 2017:6000-6010.
［5］	XIE S N， GIRSHICK R， DOLLAR P， et al. Aggregated residual transformations for deep neural networks［C］// Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition. 2017:5987-5995.
［6］	LONG J， SHELHAMER E， DARRELL T. Fully convolutional networks for semantic segmentation［C］// Proceedings of the 2015 IEEE Conference on Computer Vision and Pattern Recognition. 2015:3431-3440.
［7］	YAN Z W， ZHENG H C， LI Y， et al. Detection-oriented backbone trained from near scratch and local feature refinement for small object detection［J］. Neural Processing Letters， 2021，53（3）:1921-1943.
［8］	BAHDANAU D， CHO K， BENGIO Y. Neural machine translation by jointly learning to align and translate［J］. arXiv preprint arXiv:1409.0473， 2014.
［9］	ZHU Z， HUANG G， DENG J K， et al. WebFace260M: A benchmark unveiling the power of million-scale deep face recognition［C］// Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021:10487-10497.
［10］	MELIS M， DEMONTIS A， BIGGIO B， et al. Is deep learning safe for robot vision? Adversarial examples against the iCub humanoid［C］// Proceedings of the 2017 IEEE International Conference on Computer Vision Workshops. 2017:751-759.
［11］	GOODFELLOW I J， SHLENS J， SZEGEDY C. Explaining and harnessing adversarial examples［J］. arXiv preprint arXiv:1412.6572， 2014.
［12］	VARGAS D V， SU J W. Understanding the one-pixel attack: Propagation maps and locality analysis［J］. arXiv preprint arXiv:1902.02947， 2019.
［13］	GAO J， WANG B L， LIN Z M， et al. DeepCloak: Masking deep neural network models for robustness against adversarial samples［J］. arXiv preprint arXiv:1702.06763， 2017.
［14］	LIAO F Z， LIANG M， DONG Y P， et al. Defense against adversarial attacks using high-level representation guided denoiser［C］// Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2018:1778-1787.
［15］	HANNUN A， CASE C， CASPER J， et al. Deep speech: Scaling up end-to-end speech recognition［J］. arXiv preprint arXiv:1412.5567， 2014.
［16］	MNIH V， KAVUKCUOGLU K， SILVER D， et al. Human-level control through deep reinforcement learning［J］. Nature， 2015，518（7540）:529-533.
［17］	KURAKIN A， GOODFELLOW I J， BENGIO S. Adversarial examples in the physical world［M］// Artificial Intelligence Safety and Security. Chapman and Hall/CRC， 2018:99-112.
［18］	MADRY A， MAKELOV A， SCHMIDT L， et al. Towards deep learning models resistant to adversarial attacks［J］. arXiv preprint arXiv:1706.06083， 2017.
［19］	MOOSAVI-DEZFOOLI S M， FAWZI A， FROSSARD P. DeepFool: A simple and accurate method to fool deep neural networks［C］// Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition. 2016:2574-2582.
［20］	CARLINI N， WAGNER D. Adversarial examples are not easily detected: Bypassing ten detection methods［C］// Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. 2017:3-14.
［21］	胡卫，赵文龙，陈璐，等. 基于Logits向量的JSMA对抗样本攻击改进算法［J］. 信息网络安全， 2022，22（3）:62-69.
［22］	李哲铭，张恒巍，马军强，等. 基于平移随机变换的对抗样本攻击算法研究［J/OL］. 计算机工程:1-12（2022-01-20）［2022-07-23］. https://kns.cnki.net/kcms/detail/31.1289.
	TP.20220119.1505.007.html.
［23］	李帅. 基于图像隐空间的黑盒攻击方法［D］. 北京:北京邮电大学， 2021.
［24］	AGARAP A F. Deep learning using rectified linear units （ReLU）［J］. arXiv preprint arXiv:1803.08375， 2018.
［25］	IOFFE S， SZEGEDY C. Batch normalization: Accelerating deep network training by reducing internal covariate shift［C］// Proceedings of the 32nd International Conference on Machine Learning. 2015:448-456.
［26］	KRIZHEVSKY A. Learning multiple layers of features from tiny images［R］. Technical Report TR-2009， University of Toronto， 2009.
［27］	DENG J， DONG W， SOCHER R， et al. ImageNet: A large-scale hierarchical image database［C］// Proceedings of the 2009 IEEE Conference on Computer Vision and Pattern Recognition. 2009:248-255.

[1]	WANG Yu-hang, DONG Bao-liang, GONG Chao, SHANG Zhen-zhen, YAO Kang-ning. Dynamic Threat Assessment of Air Swarm Targets Based on Intent Recognition [J]. Computer and Modernization, 2023, 0(12): 100-104.
[2]	GU Ming-xuan, FAN Bing-bing. Feature-level Multimodal Fusion for Depression Recognition [J]. Computer and Modernization, 2023, 0(10): 17-22.
[3]	LI Yan-man, WANG Bi-heng, ZHAO Ling-yan. Safety Helmet Detection Based on Lightweight YOLOv5 [J]. Computer and Modernization, 2023, 0(10): 59-64.
[4]	WANG Xin, XIAO Tao-rui. GAN-based Adversarial Attacks on Face Recognition [J]. Computer and Modernization, 2023, 0(10): 115-120.
[5]	LIU Fu-qi, ZHANG Da, SONG Jian-hua, WANG Hai-dong. Fault Diagnosis of Hydraulic Systems Based on CNN-BiLSTM [J]. Computer and Modernization, 2023, 0(09): 10-19.
[6]	XU Ye-tong, GENG Xin-zhe, ZHAO Wei-qiang, ZHANG Yue, NING Hai-long, LEI Tao. A Remote Sensing Image Change Detection Model Based on CNN-Transformer Hybrid Structure [J]. Computer and Modernization, 2023, 0(07): 79-85.
[7]	NIU Yu-heng, LI Yong-ke, CHEN Yan-hong, JANG Ping-an. Image Segmentation Method of Residual Film on Cotton Field Surface Based on Improved SegFormer Model#br# [J]. Computer and Modernization, 2023, 0(07): 93-98.
[8]	WU Song-lin, ZHANG Guo-wei, LU Qiu-hong, SHI Jian-zhuang, HUANG Wei. Laser SLAM Mapping Method Based on Visual Information [J]. Computer and Modernization, 2023, 0(02): 17-23.
[9]	HUANGFU Xiao-ying, QIAN Hui-min, HUANG Min. A Review of Deep Neural Networks Combined with Attention Mechanism [J]. Computer and Modernization, 2023, 0(02): 40-49.
[10]	ZHANG Xiao, LYU Ji-yu, ZHAO Shuang, WU Yu-lun, WANG Chun-le. SAR Ship Classification Based on Multi-convolutional Neural Network Fusion [J]. Computer and Modernization, 2023, 0(01): 37-42.
[11]	QIAN Xiao-zhao, WANG Peng. Robust Defense Method for Graph Convolutional Neural Network [J]. Computer and Modernization, 2023, 0(01): 74-80.
[12]	SHI Zhi-wei, WU Zhi-feng, ZHANG Zhe. Stock Volatility Prediction of LightGBM-GRU Model under Corrective Learning Strategy [J]. Computer and Modernization, 2023, 0(01): 95-102.
[13]	LI Shi-bao, WANG Jie-wei, CUI Xue-rong, LIU Jian-hang, HUANG Ting-pei. Unrestricted Attack Based on Colorization [J]. Computer and Modernization, 2022, 0(11): 52-59.
[14]	YAO Chun-hua, ZHANG Xue-lei, SONG Xing-yu, ZHANG Ju, CAI Jia-zhi, FENG Ao. A Financial News Sentiment Analysis Method Based on Graph Convolutional Neural Network and Dependency Analysis [J]. Computer and Modernization, 2022, 0(05): 33-39.
[15]	LIU Ya-nan, GUO Nan, ZHAO Yang, YU Kuang-lu, . BOTDA Sensing Information Extraction Based on Artificial Neural Network Using Whale Optimization Algorithm [J]. Computer and Modernization, 2021, 0(12): 19-26.