Patent ID: 11921819
Assignee: ZHEJIANG UNIVERSITY OF TECHNOLOGY
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 1:
2. A defense method against adversarial examples based on feature remapping, comprising the following steps:
building a feature remapping model, wherein the feature remapping model is composed of a significant feature generation model and a nonsignificant feature generation model, and a shared discriminant model, wherein the significant feature generation model is used to generate significant features, the nonsignificant feature generation model is used to generate nonsignificant features, and the shared discriminant model is used to discriminate fake or real of generated significant and nonsignificant features; and
combing the significant feature generation model and the nonsignificant feature generation model together to build a detector that is used to detect adversarial examples and benign samples;
building a re-recognizer according to the significant feature generation model, the re-recognizer is used to recognize the type of adversarial examples; and
while detecting adversarial examples, connecting the detector to an output of a target model, then using the detector to detect adversarial examples; and
while recognizing adversarial examples, connecting the re-recognizer to the output of the target model, then using the re-recognizer to recognize adversarial examples,
wherein the approach of building the detector is:
building a training system of the detector, wherein the training system is composed of the target model, a parameter-determined significant feature generation model, a parameter-determined nonsignificant feature generation model, and a detect model; wherein the target model is used to target recognize, input of the model are samples, and the model outputs features of hidden layers; input of the nonsignificant feature generation model are features of hidden layers, and the model outputs nonsignificant features; input of the detection model is cascaded feature of generated significant features and generated nonsignificant features, the model outputs detection results of benign samples or adversarial examples;
building a loss function lossdetect for training the detection model to minimize the loss function lossdetect and to determine model parameters;
wherein the loss function lossdetect is:

lossdetect=−[log(Det(concat(GSF(h(xi)),GNSF(h(xi)))))+log(1−Det(concat(GSF(h(xiadv,j)),GNSF(h(xiadv,j)))))]

wherein in loss function lossdetect, log(·) implies the logarithmic function, Det(·) is the detection model, h(·) represents the output of hidden layers of the target model, xi represents benign samples, xiadv,j indicates the adversarial examples corresponds with xi, GSF(·) represents the significant feature generation model, GNSF(·) represents the nonsignificant feature generation model, and concat(GSF(·), GNSF(·)) represents the cascaded feature.