Search

Residual Network (ResNet) is a distinguished network structure in deep learning, and its layers can be profound. We theoretically explore the mathematics characteristics of the ResNet, in particular, to pay attention to the gradient information, which is a powerful and straightforward mathematical tool for analysing the properties of ResNet, such as the gradients of the loss function with respect to the input and the weight parameters and the gradient of the entry of the logits with respect to the input. A theorem about the explicit matrix expression of gradients in Resnet is given in this work. A rigorous mathematical and logical derivation of the theorem is obtained in detail by the matrix derivative definition and matrix differentiation. We further provide explicit matrix expressions of some deep learning algorithms in ResNet, including backpropagation, gradient-based adversarial attacks, and gradient-based saliency maps. Furthermore, the reasons why the ResNet network works are analysed. Finally, experimental results are provided to verify the correctness and efficiency of the proposed theorem. [ABSTRACT FROM AUTHOR]

• A novel method that facial expression saliency maps are proposed to generate facial expression adversarial examples. • The OMIM is proposed to help facial expression saliency maps accelerate to generate facial expression adversarial examples. • Our method is superior to other attack methods, such as FGSM, PGD, BIM, CW. The security demands in humanization should be considered as important, because artificial intelligence is developing rapidly in this area. Recent studies have shown the vulnerability of many deep learning models to adversarial examples; however, only a few studies on facial expression adversarial examples have been conducted. Thus, in this paper, we propose a novel method for generating facial expression adversarial examples using facial saliency maps and facial masking maps. Extensive numerical experiments demonstrate the outstanding performance of our method in terms of attack accuracy, structural similarity index measure score, and computational time, compared with other leading methods, such as the fast gradient sign method, projected gradient descent method, and Carlini–Wagner attacks. [ABSTRACT FROM AUTHOR]