Patent ID: 11921819
Assignee: ZHEJIANG UNIVERSITY OF TECHNOLOGY
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 2:
3. A defense method against adversarial examples based on feature remapping, comprising the following steps:
building a feature remapping model, wherein the feature remapping model is composed of a significant feature generation model and a nonsignificant feature generation model, and a shared discriminant model, wherein the significant feature generation model is used to generate significant features, the nonsignificant feature generation model is used to generate nonsignificant features, and the shared discriminant model is used to discriminate fake or real of generated significant and nonsignificant features; and
combing the significant feature generation model and the nonsignificant feature generation model together to build a detector that is used to detect adversarial examples and benign samples;
building a re-recognizer according to the significant feature generation model, the re-recognizer is used to recognize the type of adversarial examples; and
while detecting adversarial examples, connecting the detector to an output of a target model, then using the detector to detect adversarial examples; and
while recognizing adversarial examples, connecting the re-recognizer to the output of the target model, then using the re-recognizer to recognize adversarial examples,
wherein the steps of building the re-recognizer comprise:
building a training system of the detector, wherein the training system is composed of the target model, the parameter-determined significant feature generation model, and the re-recognize model, wherein the target model is used to recognize targets, input of the model are samples, and the model outputs features of hidden layers, input of the significant feature generation model are features of hidden layers, and the model outputs significant features, input of the re-recognize model are generated significant features, and the model outputs types of adversarial examples;
building the loss function lossre-recog for training the re-recognition model to minimize the loss function lossre-recog and to determine model parameters;
wherein the loss function lossre-recog is:, l
    ⁢
    o
    ⁢
    s
    ⁢
    
      s
      
        re
        -
        recog
      
    
  
  =
  
    -
    
      
        ∑
        
          i
          =
          1
        
        
          N
          sam
          adv
        
      
      ⁢
      
        
          ∑
          
            k
            =
            0
          
          
            m
            -
            1
          
        
        ⁢
        
          
            y
            i
            
              one
              -
              
                ho
                ⁢
                
                  t
                  ⁡
                  
                    (
                    k
                    )
                  
                
              
            
          
          ⁢
          
            log
            ⁡
            
              (
              
                y
                i
                
                  conf
                  ⁡
                  
                    (
                    k
                    )
                  
                
              
              )
            
          
        
      
    
  

Where in loss function lossre-recog, log(·) implies the logarithmic function, yione-hot(k) represents the value at the k-th position for the adversarial example corresponding to the original benign sample after being encoded by one-hot, k is the original sample classification index, yiconf(k) represents h(xi(adv,j) obtained after the adversarial example input into the target model, then input h(xiadv,j) to a parameter-determined significant feature generation model to obtain GSF(h(xiadv,j)) and input the generated significant feature into the re-recognize model to get the value at the k-th position of the confidence matrix; k is the original sample classification index, m represents the classification number of the original sample; i is the adversarial example classification index, and Nsamadv represents the amount of adversarial examples in the training set.