Adversarial sample dynamic generation method, device, electronic device and storage medium

Abstract

The present application relates to a method, device, electronic device and storage medium for dynamically generating adversarial samples. The method includes: acquiring a first face image of a first user in real time; performing target detection and tracking on the first face image, generating a candidate frame for marking the face in the first face image; adjusting the target confrontation pattern projected on the holographic film based on the candidate frame to generate a target disturbance image; acquiring a target confrontation sample, the target confrontation A sample includes the first face image and the target perturbation image. The present application can realize the conversion of the confrontation disturbance image of the digital world displayed in the electronic device into the real physical world by means of holographic imaging, without the need to print out the confrontation disturbance image, which is beneficial to improve the attack success rate of the physical world confrontation sample, and It can realize the corresponding adjustment of the confrontation pattern with the adjustment of the face, and improve the matching degree between the confrontation pattern and the face in the obtained target confrontation sample.

Description

technical field [0001] The present application relates to the technical field of artificial intelligence, and in particular, to a method, device, electronic device and storage medium for dynamic generation of adversarial samples. Background technique [0002] Adversarial example physical world attack studies the problem of how to construct adversarial examples in the real physical world when deploying deep learning models in the real physical world. [0003] At present, the physical world attack methods disclosed in the field of attack and defense of adversarial samples need to print specific forms of physical confrontation disturbance patterns (such as masks, glasses, 3D masks, etc.) when applied in real scenarios to transfer the disturbance patterns from the digital world to the physical world. . [0004] However, because the printer is limited by color, it cannot fully restore the perturbation pattern in the digital world, which will affect the success rate of the attack...

AI Technical Summary

Problems solved by technology

[0004] However, due to the color limitation of the printer, it is impossible to completely restore the perturbation pattern in the digital world, which will affect the success rate of the attack, and the above attack method cannot adjust the perturbation pattern in real time during the attack process, which has poor flexibility.

Images