Contrastive semi-supervised adversarial training method for hyperspectral image classification networks
Objective Deep neural networks have demonstrated significant superiority in hyperspectral image classification tasks.However,the emergence of adversarial examples poses a serious threat to their robustness.Research on adversarial training methods provides an effective defense strategy for protecting deep neural networks.However,existing adversarial training methods often require a large number of labeled examples to enhance the robustness of deep neural networks,which increases the difficulty of labeling hyperspectral image examples.In addition,a critical limitation of current adver-sarial training approaches is that they usually do not capture intermediate layer features in the target network and pay less attention to challenging adversarial samples.This oversight can lead to the reduced generalization ability of the defense model.To further enhance the adversarial robustness of hyperspectral image classification networks with limited labeled examples,this paper proposes a contrastive semi-supervised adversarial training method.Method First,the target model is pre-trained using a small number of labeled examples.Second,for a large number of unlabeled examples,the correspond-ing adversarial examples are generated by maximizing the feature difference between clean unlabeled examples and adver-sarial examples on the target model.Adversarial samples generated using intermediate layer features of the network exhibit higher transferability compared with those generated only using output layer features.In contrast,feature-based adversarial sample generation methods do not rely on example labels.Therefore,we generate adversarial examples based on the inter-mediate layer features of the network.Third,the generated adversarial examples are used to enhance the robustness of the target model.The defense capabilities of the target model for the challenging adversarial samples are enhanced by defining the robust upper bound and robust lower bound of the target network based on the pre-trained target model,and a contras-tive adversarial loss is designed on both intermediate feature layer and output layer to optimize the model based on the defined robust upper bound and robust lower bound.The defined contrastive loss function consists of three terms:classifi-cation loss,output contrastive loss,and feature contrastive loss.The classification loss is designed to maintain the classifi-cation accuracy of the target model for clean examples.The output contrastive loss encourages the output layer of the adver-sarial examples to move closer to the pre-defined output layer robust upper bound and away from the pre-defined output layer robust lower bound.The feature contrastive loss pushes the intermediate layer feature of the adversarial example closer to the pre-defined intermediate robust upper bound and away from the pre-defined intermediate robust lower bound.The proposed output contrastive adversarial loss and feature contrastive loss help improve the classification accuracy and generalization ability of the target network against challenging adversarial examples.The training process of adversarial example generation and target network optimization is performed iteratively,and example labels are not required in the training process.By incorporating a limited number of labeled examples in model training,both the output layer and inter-mediate feature layer are used to enhance the defense ability of the target model against known and unknown attack meth-ods.Result We compared the proposed method with five mainstream adversarial training methods,two supervised adver-sarial training methods and three semi-supervised adversarial training methods,on the PaviaU and Indian Pines hyperspec-tral image datasets.Compared with the mainstream adversarial training methods,the proposed method demonstrates signifi-cant superiority in defending against both known and various unknown attacks.Faced with six unknown attacks,compared with the supervised adversarial training methods AT and TRADES,our method showed an average improvement in classifi-cation accuracy of 13.3％and 16％,respectively.Compared with the semi-supervised adversarial training methods SRT,RST,and MART,our method achieved an average improvement in classification accuracy of 5.6％and 4.4％,respec-tively.Compared with the target model without defense method,for example on the Inception_V3,the defense performance of the proposed method in the face of different attacks improved by 34.63％-92.78％.Conclusion The proposed contras-tive semi-supervised adversarial training method can improve the defense performance of hyperspectral image classification networks with limited labeled examples.By maximizing the feature distance between clean examples and adversarial examples on the target model,we can generate highly transferable adversarial examples.To address the limitation of defense generalization ability imposed by the number of labeled examples,we define the concept of robust upper bound and robust lower bound based on the pre-trained target model and design an optimization model according to a contrastive semi-supervised loss function.By extensively leveraging the feature information provided by a few labeled examples and incorpo-rating a large number of unlabeled examples,we can further enhance the generalization ability of the target model.The defense performance of the proposed method is superior to that of the supervised adversarial training methods.
NETL
NSTL
万方数据
