Neural network models are vulnerable to adversarial sample attacks. Aiming at the problem that current defense methods focus on improving the model structure or the model only uses the adversarial training method which leads to a single type of defense and impairs the models classification ability and inefficiency, this paper proposed the method of combining the adversarial training and the feature mixture to train the siamese neural network model(SS-ResNet18). The method mixed the training set sample data by linear interpolation, built a siamese network model using the residual attention module, and inputted PGD antagonistic samples and normal samples into different branches of the network for training. It interchanged the input features in the feature space between neighboring sample parts to enhance the networks immunity to interference, combining the adversarial loss and the classification loss as the overall loss function of the network and smoothing it with labels. Experimented on CIFAR-10 and SVHN datasets, the method shows excellent defense performance under white-box attack, and the success rate of the models defense against antagonistic samples, such as PGD, JSMA, etc., under black-box attack is more than 80%. At the same time, the SS-ResNet18 model time spent is only one-half of the one-half of the subspace antagonistic training method. The experimental results show that the SS-ResNet18 model can defend against a variety of adversarial sample attacks, and is robust and less time-consuming to train compared to existing defense methods.

[2023-09-19] Accepted Paper /doc/2023.07.0318/v1

[2024-03-05] Printed Article /doc/2023.07.0318/v2