Attack resisting method and device, equipment and storage medium

Abstract

The embodiment of the invention provides an attack resisting method and device, equipment and a storage medium. The method comprises the following steps: acquiring an initial image, and dividing the initial image into a plurality of panes according to a preset window size; in response to the fact that the pane is covered by the prompt, determining the pane covered by the prompt as a target pane; an initial confrontation sample is optimized based on the target pane, so that disturbance generated by the initial confrontation sample is not higher than a disturbance threshold value, the optimized target confrontation sample is output, and the initial confrontation sample is generated by adding noise to the initial image. And using the target confrontation sample to attack an image segmentation model to obtain an attack result, the image segmentation model comprising an image encoder, a prompt encoder and a mask encoder. The embodiment of the invention aims to improve the generalization ability and success rate of attack resistance.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to an anti-attack method, an anti-attack device, a computer device, and a computer-readable storage medium. Background Art

[0002] With the rapid development of artificial intelligence technology, deep learning models are widely used in tasks such as image segmentation, risk assessment, and fraud detection in the financial field. However, existing image segmentation models, such as Segment Anything Model (SAM), rely on different prompt types (such as point prompts, box prompts) to accurately segment the target area. In adversarial attacks, attackers try to interfere with the normal decision-making of the model by making small perturbations to the input data.

[0003] However, existing adversarial attack methods are usually optimized for only one type of prompt, which leads to poor generalization of the attack. That is, adversarial samples generated for one type of prompt may not be able to effectively attack other types of prompts, thus limiting the success rate of the attack. In financial scenarios, different tasks may use multiple types of prompts, which makes improving the generalization ability of adversarial attacks an urgent problem to be solved. Summary of the invention

[0004] The present application provides an anti-attack method, an anti-attack apparatus, a computer device, and a computer-readable storage medium, aiming to improve the generalization capability and success rate of anti-attack.

[0005] To achieve the above objectives, the present application provides a method for resisting attacks, including:

[0006] Acquire an initial image, and divide the initial image into multiple panes according to a preset window size;

[0007] In response to the pane being covered by the prompt, determining the pane covered by the prompt as a target pane;

[0008] An initial adversarial sample is optimized based on the target pane so that a disturbance generated by the initial adversarial sample is not higher than a disturbance threshold, and an optimized target adversarial sample is output, wherein the initial adversarial sample is generated by adding noise to the initial image.

[0009] The target adversarial sample is used to attack an image segmentation model to obtain an attack result, wherein the image segmentation model includes an image encoder, a hint encoder, and a mask encoder.

[0010] To achieve the above objectives, the present application also provides an anti-attack device, comprising:

[0011] An acquisition module, the acquisition module is used to acquire an initial image and divide the initial image into multiple panes according to a preset window size;

[0012] a determination module, the determination module being used for determining the pane covered by the prompt as a target pane in response to the pane being covered by the prompt;

[0013] An optimization module is used to optimize the initial adversarial sample based on the target pane so that the perturbation generated by the initial adversarial sample is no higher than a perturbation threshold, and output an optimized target adversarial sample, wherein the initial adversarial sample is generated by adding noise to the initial image.

[0014] An attack module, wherein the attack module is used to use the target adversarial sample to attack the image segmentation model to obtain an attack result, wherein the image segmentation model includes an image encoder, a prompt encoder and a mask encoder.

[0015] In addition, to achieve the above-mentioned purpose, the present application also provides a computer device, which includes a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program and implement the steps of any one of the anti-attack methods provided in the embodiments of the present application when executing the computer program.

[0016] In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor implements the steps of any one of the anti-attack methods provided in the embodiments of the present application.

[0017] The present invention discloses an adversarial attack method, an adversarial attack device, a computer device, and a computer-readable storage medium. The method includes obtaining an initial image and dividing the initial image into multiple panes according to a preset window size. Further, in response to the pane being covered by a prompt, the pane covered by the prompt is determined as a target pane, and the initial adversarial sample is optimized based on the target pane so that the disturbance generated by the initial adversarial sample is not higher than the disturbance threshold, and the optimized target adversarial sample is output, wherein the initial adversarial sample is generated by adding noise to the initial image. Thus, the target adversarial sample can be used to attack the image segmentation model to obtain an attack result, wherein the image segmentation model includes an image encoder, a prompt encoder, and a mask encoder. The present invention can effectively control the disturbance range of the adversarial sample by dividing the initial image into multiple panes according to a preset window size and performing local optimization on the basis of the pane, so as to avoid the adversarial sample from being easily identified due to excessive disturbance, thereby improving the success rate of the attack. Further, by using the pane covered by the prompt to determine the target pane, the attack can be carried out in a targeted manner to improve the success rate of the attack. In addition, since the present application attacks the image segmentation model, and the image segmentation model is a multi-module segmentation model including an image encoder, a prompt encoder, and a mask encoder, the proposed adversarial attack method has strong adaptability and can attack different types of image segmentation models, and is suitable for adversarial attack tasks in multiple scenarios, thereby improving the generalization ability of adversarial attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 It is a schematic diagram of a scenario of a method for resisting attacks provided in an embodiment of the present application;

[0020] Figure 2 It is a flowchart of a method for resisting attacks provided in an embodiment of the present application;

[0021] Figure 3 is a schematic block diagram of an anti-attack device provided in an embodiment of the present application;

[0022] Figure 4 It is a schematic block diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0024] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor do they have to be executed in the order described. For example, some operations / steps can also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions. In addition, although the functional modules are divided in the device schematic, in some cases, the module division can be different from that in the device schematic.

[0025] The term "and / or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0026] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0027] like Figure 1 As shown, the anti-attack method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. The application environment includes a terminal device 110 and a server 120, wherein the terminal device 110 can communicate with the server 120 through a network. Specifically, the server 120 can obtain an initial image and divide the initial image into multiple panes according to a preset window size; in response to the pane being covered by a prompt, the pane covered by the prompt is determined as a target pane; based on the target pane, the initial adversarial sample is optimized so that the disturbance generated by the initial adversarial sample is not higher than the disturbance threshold, and the optimized target adversarial sample is output, wherein the initial adversarial sample is generated by adding noise to the initial image. The image segmentation model is attacked by the target adversarial sample to obtain an attack result, wherein the image segmentation model includes an image encoder, a prompt encoder, and a mask encoder, so as to send the attack result to the terminal device 110. Among them, the server 120 can be an independent server, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal device 110 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal and the server may be directly or indirectly connected via wired or wireless communication, and this application does not limit this.

[0028] Please continue reading Figure 2 , Figure 2 FIG. 1 is a flow chart of a method for resisting attacks provided in an embodiment of the present application. Figure 2 As shown, the anti-attack method can be implemented through steps S11 to S14.

[0029] Step S11: Acquire an initial image, and divide the initial image into multiple panes according to a preset window size.

[0030] Among them, the initial image is used to characterize the object of the adversarial attack. For example, the source of the image may be a natural image, a medical image, a satellite image, etc., depending on the specific application scenario, and this application does not limit this.

[0031] The preset window size may be a fixed pixel size (eg, 64×64 pixels, 128×128 pixels, etc.), or may be divided proportionally according to the overall size of the image, which is not limited in the present application.

[0032] For example, in a financial scenario, the initial image may come from a variety of visual representations of financial data, such as stock price charts, market trend heat maps, risk assessment maps of risk control models, etc. Each image may reflect different financial conditions or behaviors, such as trading activities, market fluctuations, performance of financial products, etc.

[0033] For example, after acquiring the initial image, the image can be divided into multiple panes according to a preset window size. Each pane represents a portion of the image, so these panes can be processed or optimized separately. In this way, the local area of ​​the image can be processed independently at the beginning, making the attack more detailed and covert.

[0034] For example, according to a preset window size, the image can be divided into fixed-size panes by rows and columns starting from the upper left corner until the entire image is covered, or the window can slide on the image at a certain step size, generating a new pane each time. It should be understood that the divided panes are multiple small areas of the image, and each pane may contain local features of the image, such as edges, textures, or parts of objects. This division enables subsequent adversarial attacks to be focused on specific panes for optimization and make the attack more targeted.

[0035] The above embodiments lay the foundation for subsequent window optimization, adversarial sample generation and attacks on the model. Through reasonable window division, the prediction results of the model can be effectively influenced while controlling the disturbance.

[0036] Step S12: In response to the pane being covered by the prompt, the pane covered by the prompt is determined as the target pane.

[0037] For example, the target pane is used to represent the pane covered by the prompt in the divided image block. Usually, the target pane is located in some key parts of the image, such as the edge of an object, an important feature point of an object, etc.

[0038] For example, the target pane can be determined by algorithms such as gradient sensitivity analysis or feature heat maps. For example, the gradient information of the model can be used to determine which panes are most sensitive to the model's prediction results. By analyzing the model's response to different parts of the image, the most critical panes can be automatically selected for coverage and determined as target panes. Alternatively, visualization techniques such as heat maps can be used to show the model's attention to different areas of the input image, and the panes with higher attention can be covered and determined as target panes.

[0039] The above implementation method, through the prompt coverage mechanism, intelligently selects and determines the target pane of the adversarial attack in the image, so that subsequent attacks can interfere with the normal operation of the image segmentation model more effectively and covertly.

[0040] Step S13: Optimize the initial adversarial sample based on the target pane so that the disturbance generated by the initial adversarial sample is no higher than the disturbance threshold, and output the optimized target adversarial sample.

[0041] Among them, the initial adversarial sample is generated by adding noise to the initial image.

[0042] The perturbation threshold is used to characterize the maximum noise intensity allowed in adversarial attacks and can be set manually.

[0043] For example, the intensity and distribution of the noise can be adjusted so that it can effectively attack the model without exceeding the perturbation threshold. Among them, common optimization methods include: gradient descent method, which adjusts the noise of the adversarial sample by back-propagating the loss of the model, and gradually optimizes the perturbation in the target pane; projection optimization, after each step of optimization, the noise is projected back to the perturbation limit space to ensure that the optimized sample does not exceed the set perturbation threshold range; smoothing, during the optimization process, the noise can be smoothed to avoid generating too obvious artificial noise and improve the concealment of the adversarial sample.

[0044] For example, the goal of the optimization process is to determine the balance point, that is, to destroy the normal operation of the image segmentation model as much as possible while ensuring that the perturbation is below the threshold. Compared with the initial adversarial sample, the optimized adversarial sample has the following characteristics: more efficient attack effect, because the optimization process is concentrated in the target pane, these areas have a greater impact on the model prediction, so the optimized adversarial sample can deceive the model more effectively; the perturbation intensity is controlled, and the perturbation intensity of the optimized adversarial sample is strictly controlled within the set perturbation threshold range, thereby improving concealment and reducing the risk of being detected; visually imperceptible, through the optimization of the perturbation, the final adversarial sample is visually almost indistinguishable from the original image, making the attack more concealed.

[0045] For example, the initial adversarial sample can be analogous to potential attacks or noise on sensitive financial data (such as malicious input data or abnormal trading activities). By optimizing the initial adversarial sample, the impact or potential threat to the financial system is controlled below a certain threshold to ensure that the integrity of the system or data will not be damaged.

[0046] The above implementation method, by performing targeted optimization in the target pane, can not only ensure the effectiveness of the attack, but also greatly improve the concealment of the attack and avoid being discovered due to excessive disturbance.

[0047] Step S14: Use the target adversarial sample to attack the image segmentation model and obtain the attack result.

[0048] Among them, the image segmentation model includes an image encoder, a hint encoder and a mask encoder.

[0049] For example, an optimized target adversarial sample is used to attack an image segmentation model. Specifically, by interfering with the model's input (i.e., the target adversarial sample), the attacker attempts to cause the image segmentation model to produce incorrect prediction results. The core components of an image segmentation model usually include an image encoder, a hint encoder, and a mask encoder, which work together to perform image understanding and segmentation.

[0050] It should be noted that the task of the image segmentation model is to divide the input image into multiple regions or objects. Through segmentation, the model can identify different parts in the image and classify these parts. Common image segmentation tasks include: semantic segmentation, which divides each pixel in the image into a category (for example, sky, trees, roads, etc.); instance segmentation, which not only divides pixels into different categories, but also needs to distinguish different instances of the same object (such as multiple cars); panoramic segmentation, which combines semantic segmentation and instance segmentation to label all pixels.

[0051] The image encoder is the first part of the image segmentation model, which is responsible for converting the input image into a feature representation. In an adversarial attack, the attacker interferes with the feature extraction process of the image encoder through the target adversarial sample, causing the features extracted by the encoder to deviate, thereby destroying the model's correct understanding of the image.

[0052] The role of the hint encoder is to assist the image encoder to better understand the image based on external hint information. In adversarial attacks, the target adversarial sample may lead the hint encoder to generate incorrect hint information, thus affecting the final segmentation result.

[0053] The main function of the mask encoder is to generate the final segmentation mask. The segmentation mask is the core of the model output, which can classify each pixel and indicate which category (or instance) the pixel belongs to. The goal of the adversarial attack is to make the mask encoder output an incorrect segmentation mask, for example, misclassifying a pixel that should belong to "road" as "sky".

[0054] For example, the ultimate goal of adversarial attacks is to make the image segmentation model output wrong results, and the attack results can be manifested in the following ways: inaccurate segmentation, pixels that originally belong to a certain category are misclassified. For example, pixels that should belong to "pedestrians" are classified as "background". Instance misidentification, the model cannot correctly distinguish different instances. For example, the model mistakes two cars for the same car, or segments out non-existent objects; global errors, under more serious attacks, the entire segmentation process may be destroyed, causing the model to output completely wrong segmentation masks. Through these attack results, attackers can evaluate the effectiveness of adversarial samples and further optimize attack strategies.

[0055] For example, in a financial scenario, using target adversarial samples to attack the image segmentation model is equivalent to using optimized attack methods to test the security of different components in the system (such as account security system, anti-fraud model, etc.). Among them, the image segmentation model can be analogous to different modules of the financial system (such as data encoding, privacy protection, and transaction monitoring modules), so these modules are tested to verify their anti-attack capabilities.

[0056] The above implementation method uses the optimized target adversarial sample to attack the image segmentation model. The attack interferes with the model's feature extraction, prompt information and mask generation process, causing the model to output incorrect segmentation results. The adversarial sample can successfully deceive the model by disrupting the workflow of these components, thereby achieving the purpose of the attack.

[0057] The adversarial attack method disclosed in the embodiment of the present application includes obtaining an initial image, and dividing the initial image into multiple panes according to a preset window size. Further, in response to the pane being covered by a prompt, the pane covered by the prompt is determined as a target pane, and the initial adversarial sample is optimized based on the target pane so that the disturbance generated by the initial adversarial sample is not higher than the disturbance threshold, and the optimized target adversarial sample is output, wherein the initial adversarial sample is generated by adding noise to the initial image. Thus, the target adversarial sample can be used to attack the image segmentation model to obtain the attack result, wherein the image segmentation model includes an image encoder, a prompt encoder and a mask encoder. The present application can effectively control the disturbance range of the adversarial sample by dividing the initial image into multiple panes according to a preset window size, and performing local optimization on the basis of the pane, so as to avoid the adversarial sample being easily identified due to excessive disturbance, thereby improving the success rate of the attack. Further, by using the pane covered by the prompt to determine the target pane, the attack can be carried out in a targeted manner to improve the success rate of the attack. In addition, since the present application attacks the image segmentation model, and the image segmentation model is a multi-module segmentation model including an image encoder, a prompt encoder and a mask encoder. Therefore, the proposed adversarial attack method has strong adaptability and can attack different types of image segmentation models. It is suitable for adversarial attack tasks in multiple scenarios and improves the generalization ability of adversarial attacks.

[0058] Optionally, in response to a pane being covered by a prompt, determining the pane covered by the prompt as a target pane includes: obtaining a preset prompt type, wherein the preset prompt type includes at least one of a point prompt, a box prompt, and an area prompt; in response to the pane overlapping with the preset prompt type, determining that the pane is covered by the prompt; and determining the pane covered by the prompt as the target pane.

[0059] For example, for point cue overlap: a pane is considered to overlap with a point cue if the pane contains the cue point, or a portion of the pane intersects with the cue point. For box cue overlap: a pane overlaps with a box cue when a portion or all of the pane overlaps with the border or interior of the box cue. For area cue overlap: a pane is considered to overlap with an area cue if the pane overlaps with a portion of the cue of a larger area (for example, a portion of the pane is within the cue area).

[0060] For example, after confirming that a pane overlaps with a prompt type, the pane covered by the prompt can be determined as a target pane. The target pane represents an image area that requires special processing or attention in the current task. Determination of the target pane enables the model to focus on key areas in the image, thereby performing more detailed optimization or processing in these areas.

[0061] In the above implementation, the preset prompt type (such as point prompt, box prompt or area prompt) is obtained, and the pane and the prompt type are judged whether they overlap, and the pane covered by the prompt is determined. Finally, these panes covered by the prompt are marked as target panes, providing key input for the subsequent image processing or optimization operation.

[0062] Optionally, the initial adversarial sample is optimized based on the target pane so that the disturbance generated by the initial adversarial sample is no higher than the disturbance threshold, including: obtaining a random image different from the initial image, and determining an optimization direction of the initial adversarial sample based on the random image; optimizing the initial adversarial sample based on the target pane and the optimization direction so that the disturbance generated by the initial adversarial sample is no higher than the disturbance threshold.

[0063] For example, a random image different from the initial image can be obtained, and the random image can be generated in the following ways: Random noise, generating a noise image with random pixel values, and these noise values ​​may follow a certain distribution (such as Gaussian distribution or uniform distribution); Existing image library, randomly selecting an image from an existing image library as a reference. Program-generated synthetic image, using an algorithm to randomly generate a synthetic image, such as through computer synthesis or random texture.

[0064] It should be understood that the main role of the random image is to help determine the optimization direction of the adversarial sample, that is, to determine how the perturbation should be adjusted to make the adversarial sample more aggressive within the target pane while satisfying the constraints of the perturbation.

[0065] For example, after obtaining the optimization direction, the optimization can be performed in combination with the information of the target pane. The goal at this time is to perform perturbation optimization only on the determined target pane area without affecting other parts of the image. After completing the above optimization, the output is the optimized target adversarial sample, which can retain the aggressiveness of the initial adversarial sample, but the attack effect in the target pane area is enhanced, and the overall perturbation does not exceed the set perturbation threshold.

[0066] In the above implementation, the optimization direction is determined by random images, and the initial adversarial sample is optimized by combining the information of the target pane, so that the perturbation is concentrated in a specific image area, while ensuring that the perturbation does not exceed the threshold. In this way, the attacker can generate hidden but effective adversarial samples to confuse the deep learning model.

[0067] Optionally, determining the optimization direction of the initial adversarial sample according to the random image includes: extracting features of the random image through a feature extraction operation, and determining the features of the random image as the optimization direction of the initial adversarial sample.

[0068] For example, in adversarial attacks, the optimization direction is used to characterize how to adjust the perturbation to change the performance of the model on the adversarial sample. By mapping the features of the random image to the optimization of the adversarial sample, the adjustment direction of the perturbation can be determined. For example, the extracted features can be used to adjust the pixel perturbation direction of each pane in the adversarial sample, so that the final adversarial sample can confuse the model more effectively.

[0069] For example, if it is detected that the feature representation contains high-frequency texture or edge information, it may mean that these parts have a greater impact on the model's prediction. Therefore, the optimization direction can be to apply stronger perturbations to these high-frequency parts in the adversarial sample. If the feature extraction process obtains features of random noise, these features may be used to guide the adversarial sample to apply perturbations to parts that the model is not sensitive to, thereby improving the concealment of the perturbation.

[0070] For example, after determining the optimization direction, these feature information can be used to adjust the initial adversarial sample. The purpose is to introduce an appropriate amount of perturbation in the target pane so that the model's prediction of the area becomes inaccurate or completely fails. Specifically, the pixel value of the adversarial sample can be adjusted based on the optimization direction so that it conforms to the characteristics of a random image and is confusing.

[0071] The above implementation method uses an optimization method based on random image features to make the generated adversarial samples have specific aggressiveness in the target pane, and because the features of random images are used, the optimization direction has a certain degree of randomness and diversity, which increases the success rate of the adversarial attack.

[0072] Optionally, the initial adversarial sample is optimized based on the target pane so that the disturbance generated by the initial adversarial sample is no higher than the disturbance threshold, including: optimizing the initial adversarial sample based on the target pane through a mean square error loss function so that the disturbance generated by the initial adversarial sample is no higher than the disturbance threshold.

[0073] Among them, the mean square error loss function is a commonly used loss calculation method, which is usually used in regression problems or in adversarial sample generation to evaluate the difference between the predicted value and the true value.

[0074] By optimizing the initial adversarial sample using the mean square error loss function, the amplitude of the perturbation can be effectively controlled, while improving the attack performance of the adversarial sample. This method ensures the effectiveness of the generated adversarial sample in the target pane area while avoiding excessive visible perturbations, thereby improving the success rate and concealment of the adversarial attack.

[0075] Optionally, after optimizing the initial adversarial sample based on the target pane so that the disturbance generated by the initial adversarial sample is no higher than the disturbance threshold, and outputting the optimized target adversarial sample, it also includes: evaluating the target adversarial sample using an evaluation indicator to obtain a target adversarial sample that passes the evaluation, wherein the evaluation indicator includes at least one of an attack success rate and a disturbance intensity; and attacking the image segmentation model using the target adversarial sample, including: attacking the image segmentation model using the target adversarial sample that passes the evaluation.

[0076] For example, the attack success rate refers to the probability that the adversarial sample successfully deceives the target model, which is usually calculated by inputting the adversarial sample into the model and judging whether the output of the model meets expectations (for example, classification error or segmentation error). The higher the attack success rate, the better the effect of the adversarial sample. The perturbation strength refers to the degree of change of the adversarial sample compared to the original image. The L2 norm (Euclidean distance) or L∞ norm (maximum change) is usually used to quantify the perturbation strength. The perturbation strength should be controlled within a certain range to maintain the concealment of the adversarial sample.

[0077] For example, the optimized target adversarial sample can be input into a preset evaluation model or algorithm, and the attack success rate can be calculated. For example, the target adversarial sample can be provided to an image segmentation model, and the output of the model can be observed and compared with the output of the original image, so as to calculate the number of samples that successfully deceive the model and compare it with the total number of samples to obtain the attack success rate. Further, the perturbation intensity can be calculated, for example, by comparing the target adversarial sample with the original image at the pixel level, and using an appropriate norm (such as L2 or L∞) to calculate the perturbation intensity, so as to check whether the calculated perturbation intensity is within a preset threshold. Thus, it can be determined whether the target adversarial sample is qualified based on the above evaluation.

[0078] For example, qualified target adversarial samples are marked as qualified, and unqualified samples need to be re-optimized or replaced. Once the target adversarial sample is evaluated as qualified, it can be used to actually attack the image segmentation model.

[0079] The above implementation method, by using the evaluation index to evaluate the target adversarial sample, can ensure that the generated adversarial sample is not only technically feasible, but also can effectively attack the target image segmentation model in practical applications. This process ensures the success rate of the attack and the concealment of the perturbation, and provides data support for further optimizing the adversarial sample generation process.

[0080] Optionally, using the target adversarial sample to attack the image segmentation model to obtain the attack result includes: according to a preset segmentation task, analyzing the target adversarial sample through the image segmentation model to obtain the attack result.

[0081] For example, before conducting an attack, preset segmentation tasks can be predefined, including the following cases: object detection, identifying and marking specific objects in the image (such as people, cars, etc.). Semantic segmentation, dividing the image into different regions, each region representing a different category (such as background, foreground, etc.). Instance segmentation, identifying each independent object in the image and generating a mask for it. Among them, the preset segmentation task can provide a basis for subsequent attack analysis.

[0082] For example, after the target adversarial sample is input into the model, the image segmentation model will perform analysis according to the preset segmentation task. For example, it includes feature extraction, where the model extracts features from the input adversarial sample, and these features will be used in the subsequent classification and segmentation process. Prediction generation, based on the extracted features, the model performs reasoning and generates segmentation results, etc. Therefore, based on the results of the model analysis, the attack results can be obtained, such as output results, where the model outputs segmentation masks or other structured data to demonstrate the performance of the model when processing adversarial samples. Comparison results, compare the output results of the model on the target adversarial sample with the output results on the original image, and analyze the impact of the adversarial sample on the segmentation effect. Error analysis, record segmentation errors, for example, objects that should have been recognized were not detected, or were mistakenly labeled as other categories.

[0083] For example, by analyzing the attack results, we can summarize the following: the degree of attack success, by comparing the segmentation effect of the model output, we can judge whether the attack effect of the adversarial sample meets expectations. The attack success rate and segmentation error rate can help quantify this effect; the effectiveness of the adversarial sample, evaluate whether the adversarial sample effectively deceives the image segmentation model, especially in specific segmentation tasks. Model robustness analysis, through the attack results, we can further analyze the robustness of the image segmentation model in the face of adversarial samples, and provide a reference for model improvement and defense strategies.

[0084] The above embodiments can use the target adversarial samples to attack the image segmentation model and obtain specific results of the attack effect, which not only helps to understand the impact of adversarial samples on model performance, but also provides important data and insights for future research.

[0085] See also Figure 3 , Figure 3 1 is a schematic block diagram of an anti-attack device provided in an embodiment of the present application. The anti-attack device can be configured in a server to execute the aforementioned anti-attack method.

[0086] like Figure 3 As shown, the anti-attack device 200 includes: an acquisition module 201, a determination module 202, an optimization module 203 and an accounting voucher generation module 204.

[0087] An acquisition module 201 is used to acquire an initial image and divide the initial image into multiple panes according to a preset window size;

[0088] A determination module 202, configured to determine the pane covered by the prompt as a target pane in response to the pane being covered by the prompt;

[0089] The optimization module 203 is used to use the target adversarial sample to attack the image segmentation model to obtain an attack result, wherein the image segmentation model includes an image encoder, a hint encoder and a mask encoder.

[0090] The attack module 204 is used to reverse the amount of the debit account and the amount of the target credit account to generate an accounting voucher corresponding to the business data to be processed.

[0091] Determination module 202 is also used to obtain a preset prompt type, wherein the preset prompt type includes at least one of a point prompt, a box prompt and an area prompt; in response to the pane overlapping with the preset prompt type, determine that the pane is covered by the prompt; and determine the pane covered by the prompt as the target pane.

[0092] The optimization module 203 is also used to obtain a random image different from the initial image, and determine the optimization direction of the initial adversarial sample based on the random image; optimize the initial adversarial sample based on the target pane and the optimization direction so that the disturbance generated by the initial adversarial sample is no higher than the disturbance threshold.

[0093] The optimization module 203 is further configured to extract features of the random image through a feature extraction operation, and determine the features of the random image as an optimization direction of the initial adversarial sample.

[0094] The optimization module 203 is further used to evaluate the target adversarial sample using an evaluation index to obtain a target adversarial sample that passes the evaluation, wherein the evaluation index includes at least one of an attack success rate and a disturbance intensity.

[0095] The attack module 204 is further configured to use the qualified target adversarial samples to attack the image segmentation model.

[0096] The attack module 204 is further configured to analyze the target adversarial sample through the image segmentation model according to a preset segmentation task to obtain the attack result.

[0097] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0098] The method and apparatus of the present application can be used in many general or special computing system environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer terminal devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices.

[0099] Exemplarily, the above method and apparatus may be implemented in the form of a computer program. The computer program may be implemented in the form of a computer program. Figure 4 Runs on the computer device shown.

[0100] See also Figure 4 , Figure 4 1 is a schematic diagram of a computer device provided in an embodiment of the present application. The computer device may be a server.

[0101] like Figure 4 As shown, the computer device includes a processor, a memory and a network interface connected through a system bus, wherein the memory may include a volatile storage medium, a non-volatile storage medium and an internal memory.

[0102] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any anti-attack method.

[0103] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0104] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any anti-attack method.

[0105] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art can understand that the structure of the computer device is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0106] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0107] Among them, in some embodiments, the processor is used to obtain an initial image and divide the initial image into multiple panes according to a preset window size; in response to the pane being covered by a prompt, the pane covered by the prompt is determined as a target pane; based on the target pane, the initial adversarial sample is optimized so that the disturbance generated by the initial adversarial sample is no higher than a disturbance threshold, and an optimized target adversarial sample is output, wherein the initial adversarial sample is generated by adding noise to the initial image; the image segmentation model is attacked using the target adversarial sample to obtain an attack result, wherein the image segmentation model includes an image encoder, a prompt encoder, and a mask encoder.

[0108] In some embodiments, the processor is also used to obtain a preset prompt type, wherein the preset prompt type includes at least one of a point prompt, a box prompt, and an area prompt; in response to the pane overlapping with the preset prompt type, determine that the pane is covered by the prompt; and determine the pane covered by the prompt as the target pane.

[0109] In some embodiments, the processor is further used to obtain a random image different from the initial image, and determine an optimization direction of the initial adversarial sample based on the random image; and optimize the initial adversarial sample based on the target pane and the optimization direction so that the disturbance generated by the initial adversarial sample is no higher than the disturbance threshold.

[0110] In some embodiments, the processor is further configured to extract features of the random image through a feature extraction operation, and determine the features of the random image as an optimization direction of the initial adversarial sample.

[0111] In some embodiments, the processor is further configured to optimize the initial adversarial sample based on the target pane by using a mean square error loss function so that a disturbance generated by the initial adversarial sample is no higher than the disturbance threshold.

[0112] In some embodiments, the processor is further used to evaluate the target adversarial sample using an evaluation indicator to obtain a target adversarial sample that passes the evaluation, wherein the evaluation indicator includes at least one of an attack success rate and a perturbation intensity; and use the target adversarial sample that passes the evaluation to attack the image segmentation model.

[0113] In some embodiments, the processor is further configured to analyze the target adversarial sample through the image segmentation model according to a preset segmentation task to obtain the attack result.

[0114] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. The computer program includes program instructions, and when the program instructions are executed, any one of the anti-attack methods provided in the embodiments of the present application is implemented.

[0115] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0116] Furthermore, the computer-readable storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application program required for at least one function, and the like.

[0117] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for countering an attack, characterized in that: The method comprises: Acquire an initial image, and divide the initial image into multiple panes according to a preset window size; In response to the pane being covered by the prompt, determining the pane covered by the prompt as a target pane; Optimizing the initial adversarial sample based on the target pane so that the disturbance generated by the initial adversarial sample is not higher than the disturbance threshold, and outputting the optimized target adversarial sample, wherein the initial adversarial sample is generated by adding noise to the initial image; The target adversarial sample is used to attack an image segmentation model to obtain an attack result, wherein the image segmentation model includes an image encoder, a hint encoder, and a mask encoder.

2. The method according to claim 1, characterized in that In response to the pane being covered by the prompt, determining the pane covered by the prompt as a target pane includes: Obtaining a preset prompt type, wherein the preset prompt type includes at least one of a point prompt, a frame prompt, and an area prompt; In response to the pane overlapping the preset prompt type, determining that the pane is covered by the prompt; The pane covered by the prompt is determined as the target pane.

3. The method according to claim 1, characterized in that The optimizing the initial adversarial sample based on the target pane so that the disturbance generated by the initial adversarial sample is not higher than a disturbance threshold comprises: Acquire a random image different from the initial image, and determine an optimization direction of the initial adversarial sample according to the random image; The initial adversarial sample is optimized based on the target pane and the optimization direction so that a disturbance generated by the initial adversarial sample is not higher than the disturbance threshold.

4. The method according to claim 3, characterized in that The step of determining an optimization direction of the initial adversarial sample according to the random image includes: The features of the random image are extracted through a feature extraction operation, and the features of the random image are determined as the optimization direction of the initial adversarial sample.

5. The method according to claim 1, characterized in that The optimizing the initial adversarial sample based on the target pane so that the disturbance generated by the initial adversarial sample is not higher than a disturbance threshold comprises: The initial adversarial sample is optimized based on the target pane by using a mean square error loss function so that the disturbance generated by the initial adversarial sample is not higher than the disturbance threshold.

6. The method according to claim 1, characterized in that After optimizing the initial adversarial sample based on the target pane so that the disturbance generated by the initial adversarial sample is not higher than the disturbance threshold, and outputting the optimized target adversarial sample, the method further includes: Using an evaluation indicator to evaluate the target adversarial sample to obtain a qualified target adversarial sample, wherein the evaluation indicator includes at least one of an attack success rate and a disturbance intensity; The using the target adversarial sample to attack the image segmentation model includes: The image segmentation model is attacked using the qualified target adversarial samples.

7. The method according to claim 1, characterized in that The using the target adversarial sample to attack the image segmentation model to obtain the attack result includes: According to the preset segmentation task, the target adversarial sample is analyzed by the image segmentation model to obtain the attack result.

8. An anti-attack device, characterized in that: The anti-attack device comprises: An acquisition module, the acquisition module is used to acquire an initial image and divide the initial image into multiple panes according to a preset window size; a determination module, the determination module being used for determining the pane covered by the prompt as a target pane in response to the pane being covered by the prompt; an optimization module, the optimization module being used to optimize the initial adversarial sample based on the target pane so that the disturbance generated by the initial adversarial sample is not higher than a disturbance threshold, and output an optimized target adversarial sample, wherein the initial adversarial sample is generated by adding noise to the initial image; An attack module, wherein the attack module is used to use the target adversarial sample to attack the image segmentation model to obtain an attack result, wherein the image segmentation model includes an image encoder, a prompt encoder and a mask encoder.

9. A computer device, characterized in that: include: A memory and a processor; wherein the memory is connected to the processor and is used to store a program; the processor is used to implement the steps of the anti-attack method as described in any one of claims 1 to 7 by running the program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the steps of the anti-attack method according to any one of claims 1 to 7.

Images