【作者】 胡斌；

【导师】 郭克华；

【作者基本信息】 中南大学 ， 计算机应用技术， 2024， 博士

【摘要】 随着人工智能的飞速发展,深度视觉算法在诸多任务和关键应用中已取得突破性进展。然而,由于其依赖基于封闭世界假设的性能驱动范式,导致在充满不确定性的动态场景下可信鲁棒性不足。特别是在恶意攻击威胁和带噪动态环境下,其性能显著下降,甚至被欺骗。为了应对这些挑战,诸多视觉可信鲁棒策略被提出,旨在提高视觉算法在“有毒带噪动态”环境中的可信度和鲁棒性。然而,在视觉可信鲁棒学习的发展中仍面临一些亟待解决的关键问题。第一,数据安全受限于对后门数据潜在的脆弱性探索不足,导致现有后门防御过度自信,而忽略新型后门威胁。第二,模型安全受限于现有对抗训练难以同时确保模型的高准确性和强鲁棒性,导致在对抗样本威胁下模型的可信安全性降低。第三,特征鲁棒性受制于现有深度视觉算法难以辨别多目标特征之间的噪声和虚假关联,严重削弱了特征的鲁棒泛化能力。第四,可持续学习受困于现有静态学习范式的局限,导致算法在动态类增量场景下适应性不足。针对上述问题,本文从数据安全、模型安全、特征鲁棒性,最终扩展到持续学习构建可信鲁棒研究路径,提升深度视觉算法的可信鲁棒性。本文主要研究内容包括以下四个方面:1.为了探索后门数据潜在的脆弱性以设计更强的后门攻击,本文提出了一种基于高斯强化与对抗蒸馏(ADGR)后门攻击方法。首先,鉴于当前后门攻击在现有防御手段下其攻击成功率显著降低,设计了一种高斯强化机制,通过减少非目标样本的高频信息来增强后门攻击对抗防御的能力。其次,为了提高后门攻击的鲁棒性,提出了一种对抗蒸馏策略。其通过增强后门模型和干净模型之间输出响应的一致性,提高后门防御方法消除模型后门效应的难度。最后,大量实验表明,所提算法不仅获得领先的攻击性能,而且具备优异的后门鲁棒性。其进一步证实后门学习内在机制对于推动防御策略设计发展的重要性,进而有助于增强数据安全。2.为了增强模型在面对恶意构造的对抗样本时的安全防御能力,本文从样本干预的角度提出了基于硬样本干扰校正的增强型对抗防御(MHSI)方法。首先,为了提升干净样本的准确性,提出了一种加权自适应机制(WA),其通过增强模型对干净样本的学习强度,降低硬样本对模型准确性的负面影响。然后,为了在高准确率下提高鲁棒性,本文基于梯度范数和海森矩阵的分析设计了一种动态校准(DC)策略。其通过动态校准硬样本的概率输出,以减少硬样本对鲁棒性的损害。最后,在上述两模块支持下,实验表明所提算法能降低硬样本引起的不稳定性,且能够在不牺牲其准确性的情况下显著提升对抗鲁棒性,从而确保模型的安全性。3.为了提升在真实场景下视觉特征的鲁棒泛化性,本文面向真实多目标视觉任务提出了一种图注意力网络驱动的多标签图像鲁棒表示学习方法(RRL-GAT)。首先,为了减少图像中目标之间的噪声和虚假连接,设计了一种类注意图神经卷积模块(C-GAT)来挖掘类别之间的强关联结构,促进模型在噪声背景下的分类准确性和泛化能力。其次,针对图像中目标之间的动态关联性,构建了一种自适应图注意卷积模块(A-GAT)来捕获图像中细微的动态依赖关系,促进消除多标签图像的表征偏差。基于上述两模块,大量实验结果显示,所提方法的性能明显领先于对比方法。此外,其可视化显示该方法不仅能够捕捉到特定输入图像的语义特征,还具有与人类类似的鲁棒识别性。4.为了在动态场景下提升视觉算法的适应性,本文提出了一种双任务交互式异常行为检测框架,以防止模型在类增量场景下鲁棒适应性退化。首先,为了挖掘行为尺度下的细粒度异常动作,设计了全局行为检测与局部细粒度动作循环对齐相结合的交互式策略。其通过挖掘行为尺度下的异常动作,实现对异常行为的细粒度双重验证。其次,为了提高对新类正常行为的检测准确率,提出了一种主动标签学习策略。其通过不断对新类正常行为样本累积标注和循环聚类转化为新训练样本,以改善模型对新类行为的鲁棒适应能力。最后,实验表明,所提方法在异常行为识别的准确率上超越了对比方法,且显著增强了模型对新类正常样本的鲁棒适应性。图46幅,表28个,参考文献232篇更多还原

【Abstract】 With the rapid development of deep learning,deep vision algorithms have made breakthroughs in numerous tasks and critical applications.However,its reliance on a performance-driven paradigm based on closed-world assumptions leads to insufficient trustworthy robustness in dynamic scenarios full of uncertainties.Especially under the threat of malicious attacks and noisy dynamic environments,its performance is significantly degraded and even deceived.To address these challenges,several visually trustworthy robust strategies have been proposed to improve the trustworthiness and robustness of algorithms in"toxic noisy dynamic"data environments.However,some key issues remain in trustworthy and robust learning.First,data security is limited by insufficient exploration of the potential vulnerabilities of backdoor data,leading to overconfidence in existing backdoor defenses and ignoring the threat of new backdoor attacks.Second,model security is limited by the difficulty of existing adversarial training to simultaneously ensure high accuracy and strong robustness,resulting in reduced model credibility and security under the threat of adversarial examples.Third,feature robustness is limited by the difficulty of current depth vision algorithms to discriminate noise and spurious correlations between multi-target features,which seriously weakens the robust generalization ability of features.Fourth,sustainable learning is hampered by the limitations of the existing static learning paradigm,resulting in insufficient adaptability of the algorithm in dynamic incremental scenarios.In response to the above problems,this thesis builds a trustworthy and robust research path from data security,model security,and feature robustness,ultimately extending to continuous learning.It forms a process from security defense to dynamic adaptation to improve the trusted robustness of deep vision algorithms.The innovations of this thesis include the following four aspects:1.To explore the potential vulnerabilities of backdoor data for designing stronger backdoor attacks,this thesis proposes a Gaussian reinforcement and adversarial distillation(ADGR)based backdoor attack method.First,since the success rate of the current backdoor attack is significantly reduced under the existing defenses,a Gaussian reinforcement mechanism is designed to enhance the ability of the backdoor attack against defenses by reducing the high-frequency information of non-targeted samples.Then,an adversarial distillation strategy is proposed to improve the stealthiness of backdoor attacks.It improves the difficulty of backdoor defense methods to eliminate the backdoor effect of the model by enhancing the consistency of the output response between the backdoor model and the clean model.Finally,a large number of quantitative experimental results show that the proposed algorithm not only achieves leading attack performance compared with other backdoor attacks but also demonstrates excellent backdoor robustness in the face of multiple backdoor defense challenges.2.To improve the adversarial example security defense against malicious constructs,this thesis proposes an adversarial defense method to mitigate hard sample interference(MHSI)from the perspective of sample intervention.First,to improve the accuracy of clean samples,a weighted adaptive mechanism(WA)is proposed,which reduces the negative impact of hard samples on model accuracy by increasing the learning strength of the model on clean samples.Then,to improve robustness while maintaining high accuracy,this thesis designs a dynamic calibration(DC)strategy based on the analysis of the gradient paradigm and Hessian matrix.It reduces the damage of hard samples on robustness by dynamically calibrating the probabilistic output of hard samples.Finally,the experiments show that the proposed algorithm can reduce the instability caused by hard samples and can significantly improve visual robustness without sacrificing its accuracy.3.To enhance robustness in real multi-target visual tasks,this thesis proposes a graph attention network-driven robust representation learning method(RRL-GAT)for multi-labeled images.First,to reduce the noise and false connections between targets in an image,the class attention graph neural convolution module(C-GAT)is proposed to mine the strong association structure between classes,which promotes the model’s classification accuracy and generalization ability in a noisy background.Second,for the dynamic correlations between targets in images,the adaptive graph attention convolution module(A-GAT)is proposed to capture the subtle dynamic dependencies in images and promote the elimination of multi-label image representation bias.Based on the above two modules,a large number of experimental results show that the proposed method is significantly ahead of the comparison methods.In addition,its visualization results show that the method in this thesis is not only able to capture the semantic relations of specific input images,but also features human recognizability.4.To improve the robust adaptability of the algorithm in dynamic scenarios,this thesis proposes a dual-task interactive anomalous behavior detection framework to prevent the degradation of the model’s robust adaptability in class-incremental scenarios.First,to mine more fine-grained abnormal actions under the behavioral scale,an interactive strategy combining global behavior detection and local fine-grained action loop alignment is designed.It achieves fine-grained dual verification of abnormal behaviors by mining abnormal actions under the behavioral scale.Second,to improve the detection accuracy of new categories of normal behaviors,an active label learning strategy is proposed.It improves the robustness of the model to new categories of behaviors by continuously accumulating labeling and cyclic clustering of new classes of normal behavior samples into new training samples.Finally,the experimental results show that the proposed method outperforms the comparison methods in the accuracy of abnormal behavior recognition and significantly enhances the robustness of the model to new classes of normal samples.更多还原