Page 304 - 《软件学报》2026年第7期

软件学报 ISSN 1000-9825, CODEN RUXUEW E-mail: jos@iscas.ac.cn
2026,37(7):2989−3012 [doi: 10.13328/j.cnki.jos.007548] [CSTR: 32375.14.jos.007548] http://www.jos.org.cn
©中国科学院软件研究所版权所有. Tel: +86-10-62562563

*
PBAT: 基于代理分布的深度学习模型防御加固方法

杨 波 1,2 , 熊 倩 1 , 徐 珞 3

1
(北京林业大学 信息学院, 北京 100083)
2
(国家林业草原林业智能信息处理工程技术研究中心 (北京林业大学), 北京 100083)
3
(中国电子科技集团公司 信息科学研究院, 北京 100040)
通信作者: 杨波, E-mail: yangbo@bjfu.edu.cn

摘 要: 深度学习模型存在一定的安全隐患, 和这些模型关联的应用一旦发生安全事故, 很可能带来难以承受的后
果. 为此, 需要对深度学习模型进行加固. 已有的加固方法包括针对对抗性噪声的对抗性训练方法、对抗噪声净化
方法等. 对抗训练作为其中最常使用的方法具有较好的对抗攻击防御效果. 但是, 对抗训练后的模型容易出现鲁棒
泛化不足的问题, 且会牺牲较多的原始精度. 基于此提出一种基于代理分布的对抗训练 (proxy-distribution-based
adversarial training, PBAT) 方法. 该方法利用概率模型捕获数据样本分布规律, 以生成能够协调原始精度和鲁棒性
能的增强训练样本. 然后通过调整训练过程实现对模型的加固. 利用 ResNet-20 和 GoogLeNet 在 2 个典型的数据
集 CIFAR10 和 MNIST 上开展实验, 并进一步在 Faster R-CNN 模型和 PASCAL VOC 数据集上针对目标检测任务
开展实验. 实验结果表明, PBAT 比其他 4 种典型的方法效果要好.
关键词: 深度学习模型; 模型加固; 模型防御; 对抗网络
中图法分类号: TP183

中文引用格式: 杨波, 熊倩, 徐珞. PBAT: 基于代理分布的深度学习模型防御加固方法. 软件学报, 2026, 37(7): 2989–3012. http://
www.jos.org.cn/1000-9825/7548.htm
英文引用格式: Yang B, Xiong Q, Xu L. PBAT: Defense Reinforcement Method for Deep Learning Models Based on Proxy
Distribution. Ruan Jian Xue Bao/Journal of Software, 2026, 37(7): 2989–3012 (in Chinese). http://www.jos.org.cn/1000-9825/7548.htm

PBAT: Defense Reinforcement Method for Deep Learning Models Based on Proxy Distribution
1
1,2
YANG Bo , XIONG Qian , XU Luo 3
1
(School of Information Science and Technology, Beijing Forestry University, Beijing 100083, China)
2
(Engineering Research Center for Forestry-oriented Intelligent Information Processing of National Forestry and Grassland Administration
(Beijing Forestry University), Beijing 100083, China)
3
(Information Science Academy, China Electronics Technology Group Co., Beijing 100040, China)
Abstract: Deep learning models face some security risks, and security breaches in their applications can lead to severe consequences.
Enhancing the security of deep learning models is therefore necessary. Existing reinforcement methods include adversarial training against
adversarial noise, adversarial noise purification methods, and others. Among them, adversarial training is the most widely used method and
provides effective defense against adversarial attacks. However, models trained with adversarial training often suffer from insufficient
robust generalization and considerable loss of original accuracy. To address these issues, this study proposes a new adversarial training
method called proxy-distribution-based adversarial training (PBAT). The proposed method employs a probabilistic model to capture the
distribution patterns of data samples and generate enhanced training samples that balance original accuracy and robustness. The resilience
of the model is further enhanced through an adjusted training process. Experiments are conducted using ResNet-20 and GoogLeNet on two
benchmark datasets, CIFAR10 and MNIST. Furthermore, experiments are conducted on the Faster R-CNN model and the PASCAL VOC

* 基金项目: 国家重点研发计划 (2023YFD2201805)
收稿时间: 2024-09-06; 修改时间: 2025-04-21, 2025-05-30; 采用时间: 2025-09-03; jos 在线出版时间: 2026-04-29
CNKI 网络首发时间: 2026-04-30