Patent ID: 11921819
Assignee: ZHEJIANG UNIVERSITY OF TECHNOLOGY
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A defense method against adversarial examples based on feature remapping, comprising the following steps:
building a feature remapping model, wherein the feature remapping model is composed of a significant feature generation model and a nonsignificant feature generation model, and a shared discriminant model, wherein the significant feature generation model is used to generate significant features, the nonsignificant feature generation model is used to generate nonsignificant features, and the shared discriminant model is used to discriminate fake or real of generated significant and nonsignificant features; and
combing the significant feature generation model and the nonsignificant feature generation model together to build a detector that is used to detect adversarial examples and benign samples;
building a re-recognizer according to the significant feature generation model, the re-recognizer is used to recognize the type of adversarial examples; and
while detecting adversarial examples, connecting the detector to an output of a target model, then using the detector to detect adversarial examples; and
while recognizing adversarial examples, connecting the re-recognizer to the output of the target model, then using the re-recognizer to recognize adversarial examples,
wherein the steps of building the feature remapping model comprise:
building a training system of the feature remapping mode, wherein the training system is composed of the target model, the significant feature generation model, the nonsignificant feature generation model, and the shared discriminant model, wherein the target model is used to recognize targets, input of the model are samples, and the model outputs features of hidden layers; input of the significant feature generation model are features of hidden layers, and the model outputs significant features; input of the nonsignificant feature generation model are features of hidden layers, and the model outputs nonsignificant features; input of shared discriminant model is generated significant features, generated nonsignificant features, real significant features, and real nonsignificant features, the model outputs recognition results of benign samples or adversarial examples;
building loss function lossD to train the shared discriminant model, training the significant generation model, and training the nonsignificant generation model loss function lossG, using loss functions lossD and lossG to train the shared discriminant model, the significant generation model, and the nonsignificant generation model to determine model parameters;
wherein loss function is lossD=lossDadv,SF+lossDadv,NSF+lossDben,SF+lossDben,NSF, lossDadv,SF is the loss function of the shared discriminant model while training of significant features generate of adversarial examples, lossDadv,NSF is the loss function of the shared discriminant model while training of nonsignificant features generate of adversarial examples, lossDben,SF is the loss function of the shared discriminant model while training of significant features generate of benign samples, lossDben,NSF is the loss function of the shared discriminant model while training of nonsignificant features generate of benign samples;
wherein the loss function lossG=lossGadv,SF+lossGadv,NSF+lossGben,SF+lossGben,NSF, lossGadv,SF is the loss function of the significant feature generation model while training of significant features generation of adversarial examples, lossGadv,NSF is the loss function of the nonsignificant feature generation model while training of nonsignificant features generation of adversarial examples, lossGben,SF is the loss function of the significant features generation model while training of significant features generation of benign samples, lossGben,NSF is the loss function of the nonsignificant feature generation model while training of nonsignificant features generation of benign samples.