关键词: 深度学习, 对抗样本, 输入去噪器, 隐层信息恢复器

Abstract:

Although deep learning has achieved great success in various applications,the deep neural networks (DNNs) are vulnerable to the attack of adversarial samples with imperceptive perturbation information,which makes the robustness and performance of DNNs decrease greatly.To overcome the weakness of the existing denoising algorithms against adversarial samples,which destroys the information on clean samples,leading to reduction in CNN sclassification accuracy,this paper presents a novel enhanced denoising algorithm ID+HIR(Input Denoising andHidden Information Restoring)for adversarial samples.Our ID+HIR is made up of an enhanced input denoising and hidden lossy information restoring based on the theory of convex hull.The algorithm first trains a denoiser on the input layer of the model,with the input of the denoiser being the concatenation of clean and adversarial samples,and the denoiser is expected to remove the adversarial perturbations while avoiding the forgetting of clean samples.Since the denoiser destroys the perturbation information contained in the clean samples,a restorer is trained in the hidden layer of the model,with the input of the restorer being a convex combination of the hidden vectors of the clean and adversarial samples,expecting the restorer to remap the samples located in the incorrect classification space back to the correct classification space,thus training a more robust model.Extensive comparative simulation experiments on several standard datasets show that the denoiser and the recoverer proposed in this paper can effectively improve the robustness of the model,and extensive experiments on benchmark datasets show that our proposed algorithm ID+HIR is superior to the competitive baselines.

Key words: deep learning, adversarial samples, input denoising, hidden information restoring