Image confrontation sample generation method based on key region constraint
Generating image adversarial samples by image segmentation based on proxy model and Schmitt orthogonalization algorithm, the problems of low efficiency and poor results in the prior art are solved, and efficient and hidden image adversarial samples are achieved, which are suitable for a variety of neural networks.
Patent Information
- Application Number
- CN202510172601.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-17
- Publication Date
- 2025-07-08
AI Technical Summary
The image countermeasures generated by the prior art are inefficient and complex, and cannot take into account both concealment and perturbation effects.
Through the proxy model identification based on the target model, the target image category activation map is generated, the target area is segmented, the candidate segmentation area is found, and the Schmitt orthogonalization algorithm is used to add perturbation to the key areas to generate image adversarial samples.
It improves the efficiency of image adversarial sample generation, enhances the concealment and adversariality of the perturbation effect, and can block multiple neural network structures.
Smart Images
Figure CN120279371A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer vision technology, and in particular, to an image adversarial sample generation method based on key region constraints. Background Art
[0002] In the field of computer vision, artificial intelligence technology is widely used in image recognition. Based on neural networks, excellent results have been achieved in identifying effective targets from images such as faces, handwriting, and medical images for tracking, comparison, auxiliary diagnosis, etc. However, on the other hand, for the purpose of information security and privacy protection, in some cases, specific image information needs to be specifically protected. It is necessary to avoid the risk of the target information in the image being recognized by the neural network and ensure that the image does not change at all from the perspective of human vision. Generally, the method of generating image adversarial samples is adopted to prevent the neural network from recognizing the target in the image.
[0003] Usually, it is impossible to know the neural network structure and parameters used by the other party to identify one's own target. Therefore, regarding the other party's neural network as a black box, methods based on transferability, prediction scores, and decision labels can be used to perturb the image. Specifically, the original image is perturbed by any one of the three methods of global perturbation, local perturbation, or single-pixel perturbation to generate image adversarial samples. However, global perturbation is likely to cause a significant decrease in the quality of the generated image adversarial samples compared to the original image, and the difference can be recognized from human vision; local perturbation is likely to cause an obvious difference between the perturbed area and the non-perturbed area in the generated image adversarial samples, which is also easily recognized by human vision; although single-pixel perturbation has the characteristics of small perturbation and high concealment, the larger the image size, the worse the perturbation effect; moreover, in the process of adding perturbation to the image in the existing method of generating image adversarial samples, the added perturbation is regarded as a trainable parameter, and the perturbation is added and updated in the image by a gradient-free optimization method. However, this method of adding and updating perturbation has strong randomness, so a large amount of computation is required to find the optimal direction of adding perturbation. Therefore, the efficiency of generating image adversarial samples is low and the process is complex, and it is impossible to balance concealment and perturbation effect. Summary of the Invention
[0004] In view of the above analysis, the embodiments of the present invention aim to provide an image adversarial sample generation method based on key region constraints to solve the problems of low efficiency and complex process of the image adversarial samples generated by the existing technology, and the inability to balance concealment and perturbation effect.
[0005] The embodiments of the present invention provide an image adversarial sample generation method based on key region constraints, and the method specifically includes:
[0006] Finding an image corresponding to the category as the target image based on the image classification applicable to the target model;
[0007] Input the target image into the surrogate model for recognition to obtain the feature map and fully connected layer weights output at the end of the surrogate model, and then obtain the class activation mapping of the target image based on the feature map and fully connected layer weights output at the end;
[0008] Identify each target region from the target image, and find candidate segmentation regions from each target region based on the class activation mapping;
[0009] Obtain all combinations of candidate segmentation regions, generate a to-be-processed image based on each combination and the target image, and obtain the corresponding masked image after masking the corresponding candidate segmentation region combination in each to-be-processed image;
[0010] Apply the surrogate model to recognize each masked image, find the candidate segmentation regions that cannot be recognized as key regions, and mark the corresponding key regions in the to-be-processed image corresponding to the masked image to obtain the corresponding marked image;
[0011] Add orthogonal perturbations to each key region in each marked image to generate the corresponding image adversarial sample.
[0012] Based on a further improvement of the above method, based on the feature map and fully connected layer weights output at the end of the surrogate model, the class activation mapping of the target image is obtained through the following process, and the process specifically includes:
[0013] Multiply the feature value of each pixel point in the feature map output at the end of the surrogate model by the fully connected layer weights to obtain an updated feature value matrix;
[0014] Enlarge the updated feature value matrix to the same size as the target image through bilinear interpolation to obtain an enlarged feature value matrix;
[0015] Normalize the enlarged feature value matrix to obtain the class activation mapping of the target image.
[0016] Based on a further improvement of the above method, identifying each target region from the target image specifically means segmenting the target image through instance segmentation to obtain each target region and generating a corresponding mask matrix.
[0017] Based on a further improvement of the above method, based on the class activation mapping, the following process is used to find candidate segmentation regions from each target region, and the process specifically includes:
[0018] Calculate the mean value of the product of the mask matrix element value corresponding to the element covered by each target region and the probability value of the corresponding element in the class activation mapping respectively;
[0019] Determine whether the mean value exceeds a preset threshold. If so, use the corresponding target region as a candidate segmentation region; otherwise, exclude the corresponding target region.
[0020] Based on a further improvement of the above method, orthogonal perturbations are added to each key region by performing the following process, which specifically includes:
[0021] S1: Initialize the current perturbation vector and the set of orthogonal vectors of the key region;
[0022] S2: Generate a random vector with the same dimension as the target image, and calculate the orthogonal components of the random vector relative to each orthogonal vector in the set of orthogonal vectors;
[0023] S3: Obtain a new orthogonal vector based on the mask matrix and the orthogonal components, and store the new orthogonal vector in the set of orthogonal vectors;
[0024] S4: Determine whether the number of orthogonal vectors in the set of orthogonal vectors reaches the preset threshold. If so, go to S5;
[0025] Otherwise, return to iteratively execute S2 - S4;
[0026] S5: Perturb the key region of the target image based on each orthogonal vector in the set of orthogonal vectors to obtain multiple perturbed images, and then input the multiple perturbed images into the target model respectively to identify the corresponding target class probabilities for the current round;
[0027] S6: Calculate the difference between the target class probabilities for the current round of each perturbed image and the target class probabilities for the previous round respectively, and find the orthogonal vector corresponding to the target class probability with the largest absolute value of the difference as the optimal orthogonal vector;
[0028] S7: Update the current perturbation vector based on the optimal orthogonal vector to obtain an updated perturbation vector;
[0029] S8: Determine whether the preset iteration condition is satisfied. If so, use the updated perturbation vector as the current perturbation vector, return to iteratively execute S2 - S8; otherwise, generate an image adversarial sample based on the current perturbation vector.
[0030] Based on a further improvement of the above method, the initialization of the set of orthogonal vectors specifically includes:
[0031] Generate a random vector with the same dimension as the key region;
[0032] Obtain an orthogonal vector based on the masking vector and the random vector, and store the orthogonal vector in the set of orthogonal vectors.
[0033] Based on further improvement of the above method, the preset iteration condition is:
[0034] The norm of the sum of each element eigenvalue in the key area and the current perturbation vector is less than the norm of the corresponding updated perturbation vector; moreover, the norm of the updated perturbation vector is greater than the norm of the current perturbation vector.
[0035] Based on further improvement of the above method, the corresponding perturbation vectors are obtained through the following formulas based on the masking vector and the orthogonal vector, and based on the masking vector and the random vector. The formulas are specifically expressed as:
[0036] In the formula,
[0037] is the orthogonal vector;
[0038] M is a mask matrix, the element value of M is 1 when the image element is in the key area, otherwise the element value of M is 0;
[0039] v is an orthogonal vector or a random vector;
[0040] ⊙ represents the Hadamard product operation.
[0041] Based on further improvement of the above method, the orthogonal component of the random vector relative to each orthogonal vector in the orthogonal vector set is calculated through the following formula. The formula is specifically expressed as:
[0042] In the formula,
[0043] v i is the current random vector, i = 1, 2,..., n;
[0044] is the j-th orthogonal vector in the orthogonal vector set, j = 0, 1,... i - 1;
[0045] is the projection coefficient of v i in direction;
[0046] v′ i is the orthogonal component of v i .
[0047] Based on further improvement of the above method, based on the optimal orthogonal vector, the current perturbation vector is updated through the following formula to obtain the updated perturbation vector. The formula is specifically expressed as:
[0048] In the formula,
[0049] r k+1 is the updated perturbation vector
[0050] r k is the current perturbation vector
[0051] k is the iteration round,
[0052] is the optimal orthogonal vector,
[0053] ε is the scaling factor,
[0054] F(x + r k , C x ) is the target class probability of the previous round, where x is the input image, and C x is the target class of the input image,
[0055] is the target class probability of the current round.
[0056] Compared with the prior art, the present invention can at least achieve one of the following beneficial effects:
[0057] 1. Using the surrogate model as a "black box" to simulate the recognition of the target image, and obtaining the target image class activation map based on the end feature map and the fully connected layer weights output by the surrogate model recognition. At the same time, the target image is segmented into multiple target regions through instance segmentation, and the candidate segmentation regions of the target image are obtained based on the target image class activation map. Multiple images to be processed are generated based on the combination of the candidate segmentation regions, and then the corresponding candidate segmentation combinations in each image to be processed are masked to obtain the masked image. The surrogate model is applied to recognize the masked image, and the masked candidate segmentation combination that cannot be recognized is used as the key region, and then the target image is perturbed based on the key region, which is more efficient than the prior art in generating image adversarial samples.
[0058] 2. Based on the target model recognition to verify the scrambling effect of the target image, avoiding the dependence on the gradients, model structure, and model parameters of the intermediate recognition process of the surrogate model when adding perturbations, so that the image adversarial samples generated by adding perturbations are not limited to shielding neural networks with a specific structure, and the image adversarial samples have better transferability.
[0059] 2. Applying Schmidt orthogonalization to orthogonalize the direction of each added perturbation, and applying the mask matrix to detect the boundary of each obtained orthogonal vector, avoiding searching for unnecessary perturbation directions, improving the efficiency of generating image adversarial samples, and simplifying the process of adding perturbations. Therefore, the added perturbations take into account both concealment and perturbation effects.
[0060] In the present invention, the above technical solutions can also be combined with each other to achieve more preferred combined solutions. Other features and advantages of the present invention will be described in the subsequent specification, and some advantages can be made obvious from the specification or understood by implementing the present invention. The objectives and other advantages of the present invention can be achieved and obtained from the content specifically pointed out in the specification and the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0061] The accompanying drawings are only used for the purpose of showing specific embodiments and are not considered to be a limitation of the present invention. Throughout the drawings, the same reference signs denote the same components;
[0062] Figure 1 It is a flowchart of the method according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0063] The preferred embodiments of the present invention will be specifically described below with reference to the accompanying drawings, in which the drawings form a part of the present application and are used together with the embodiments of the present invention to explain the principle of the present invention, rather than to limit the scope of the present invention.
[0064] A specific embodiment of the present invention discloses an image adversarial sample generation method based on key region constraints, as Figure 1 shown.
[0065] The method specifically includes:
[0066] Finding corresponding category images as target images based on the image classification applicable to the target model;
[0067] Inputting the target image into the proxy model for recognition to obtain the feature map output at the end of the proxy model and the weights of the fully connected layer, and then obtaining the target image class activation mapping diagram based on the feature map output at the end and the weights of the fully connected layer;
[0068] Identifying each target region from the target image, and finding candidate segmentation regions from each target region based on the class activation mapping diagram;
[0069] Obtaining all combinations of the candidate segmentation regions, generating a to-be-processed image based on each combination and the target image, and obtaining the corresponding masked image after masking the corresponding candidate segmentation region combination in each to-be-processed image;
[0070] Applying the proxy model to recognize each masked image, finding the candidate segmentation regions that cannot be recognized as key regions, and marking the corresponding key regions in the to-be-processed image corresponding to the masked image to obtain the corresponding marked image;
[0071] Generating corresponding image adversarial samples by adding orthogonal perturbations to each key region in each marked image.
[0072] Step 1: Based on the image classification applicable to the target model, find the corresponding category images as the target images.
[0073] Generally, even if the target model for identifying the target images of one's own side can be accessed, its internal structure and parameters cannot be known, so it can only be regarded as a black box. However, by analyzing the input images and output recognition results of the target model, the applicable scenarios of the target model can be known, making the generation of image adversarial samples more targeted and effective. Therefore, first analyze the application scenarios of the target model. Generally, collect different types of images and input them into the target model, and observe which type of image has the highest recognition effect. Basically, the image categories applicable to the target model can be determined; further, collect the corresponding target category images that the target model is good at recognizing, and then input them into the target model for recognition. Exclude the images that the target model cannot recognize or the recognition effect is not ideal. Based on the remaining images, establish a target image sample set, and save the corresponding initial target recognition probabilities obtained by recognizing each target image in the target image sample set through the target model. The initial target recognition probability obtained for each target image can be regarded as the initial value of the target recognition probability for each pixel point of the target image.
[0074] Step 2: Input the target image into the proxy model to obtain the feature map output at the end of the proxy model and the weights of the fully connected layer, and then obtain the class activation mapping of the target image based on the feature map output at the end and the weights of the fully connected layer.
[0075] Establish a proxy model, use the target image set to establish a training set, and fully train the proxy model to ensure that the proxy model has a significant recognition ability for the target images of the corresponding target categories. In this embodiment, based on the discrimination of the target recognition probability of each pixel point in the target image as the basis for adding perturbations to generate image adversarial samples, compared with the prior art, it avoids the dependence on the recognition feature gradient information of the neural network used for simulation recognition, and is convenient for subsequent generation of image adversarial samples that can shield neural networks with different structures.
[0076] Further, based on the feature map output at the end of the proxy model and the weights of the fully connected layer, the class activation mapping of the target image is obtained through the following process, and the process specifically includes:
[0077] Multiply the feature value of each pixel point in the feature map output at the end of the proxy model by the weights of the fully connected layer to obtain an updated feature value matrix;
[0078] Enlarge the updated feature value matrix to the same size as the target image through bilinear interpolation to obtain an enlarged feature value matrix;
[0079] Normalize the enlarged feature value matrix to obtain the class activation mapping of the target image.
[0080] Based on the recognition result of the target image by the surrogate model, it is convenient to further obtain the probability of each element and the target category in the target image, which corresponds to the elements of the target image that are closely related to the target category and are easily noticed by the neural network when the target image is recognized by the neural network.
[0081] After the surrogate model recognizes the input target image, it can obtain the target category and target features, which is a speculation based on the principle of neural network image recognition. Among them, based on the principle of neural network image recognition, the target category and target features obtained by the surrogate model's recognition of the input target image are related to the end feature map and the weights of the fully connected layer, and the end feature map and the weights of the fully connected layer do not contain the gradient features of the surrogate model's recognition of the target image. Therefore, based on the end feature map and the fully connected layer output by the surrogate model, where the end feature map specifically refers to the feature map output by the last convolutional layer. Based on the principle of the general neural network model for image recognition in the prior art, the feature map output by the last convolutional layer has its dimension reduced to the maximum extent and the number of channels increased, and includes all the feature information extracted by the neural network from the target image. The weights of the fully connected layer reflect the contribution value to the model's classification decision. The larger the contribution value, the greater the contribution of the corresponding pixel point to the category decision. Therefore, each element feature value in the end feature map and the weights of the fully connected layer are multiplied respectively to obtain an updated feature value matrix, and then the updated feature value matrix is enlarged to the same size as the target image through bilinear interpolation to obtain an enlarged feature value matrix. Then, the enlarged feature value matrix is normalized to obtain the target image class activation mapping.
[0082] Step 3: Recognize each target region from the target image, and find candidate segmentation regions from each target region based on the class activation mapping.
[0083] Further, recognizing each target region from the target image specifically means segmenting the target image through instance segmentation to obtain each target region and generating a corresponding mask matrix.
[0084] Specifically, the step of segmenting the target image through instance segmentation to obtain each target region means applying a second network model to recognize the target image and output an image marking each target region, and generating a corresponding mask matrix. Each of the target regions represents a specific target included in the target image. For example, multiple human faces recognized from an image containing multiple people, or multiple human organs recognized from a medical image, etc. Since the number of targets included in the target image may not be unique, recognizing and dividing each target into different regions from the target image helps to improve the efficiency of generating image adversarial samples. Among them, the second network model preferably adopts the Mask R-CNN network structure. After recognizing the target image, it outputs an image marking each target region and generates a corresponding mask matrix, which means identifying the elements in the image based on the generated mask matrix. Specifically, non-target regions and target regions are identified with different values. Exemplarily, non-target region elements are identified with the value 0, and target region elements are identified with the value 1; the mask matrices corresponding to each target in the target image can be integrated into the same mask matrix through bitwise OR operation. Each of the recognized target regions can be regarded as multiple sub-arrays of the element array of the target image.
[0085] Further, based on the class activation mapping diagram, the candidate segmentation regions are found from each target region through the following process, and the process specifically includes:
[0086] Calculate the mean value of the product of the mask matrix element value corresponding to the element covered by each target region and the probability value of the corresponding element in the class activation mapping diagram respectively;
[0087] Judge whether the mean value exceeds a preset threshold. If so, take the corresponding target region as a candidate segmentation region; otherwise, exclude the corresponding target region.
[0088] For each target region identified based on the second network model, it is only a division of the image region based on each target included in the target image. It is also necessary to further clarify the correlation between each pixel point in each target region and the target category in the target region. Therefore, it is necessary to combine the corresponding element values in the target image class activation map with the elements corresponding to each target region, so that each element in each target region obtains a contribution value to the model classification decision; each target region element also includes the corresponding mask matrix element value at the same time, then calculate the mean value of the product of the mask matrix element value corresponding to the covered element in each target region and the contribution value of the corresponding element in the class activation map to the model classification decision respectively, and then determine whether the mean value exceeds a preset threshold. Preferably, the preset threshold is 0.5. If so, the corresponding target region is used as a candidate segmentation region, otherwise, the corresponding target region is excluded. Compared with the global perturbation, local perturbation, and single-pixel perturbation in the prior art, the range of perturbed elements found is more accurate, and the subsequent perturbation is more targeted, which helps to improve the efficiency of generating image adversarial samples.
[0089] Step 4: Obtain all combinations of candidate segmentation regions, generate a to-be-processed image based on each combination and the target image, and obtain the corresponding masked image after masking the corresponding candidate segmentation region combination in each to-be-processed image.
[0090] Next, it is necessary to find the key regions that can obtain a better shielding effect after adding interference. Generally, if the target image includes multiple target categories, when using different neural networks to identify the target image, based on the recognition purposes of different target categories, the candidate segmentation regions of interest will be different. In particular, when different candidate segmentation region combinations are used, it is possible to cause different results to be obtained by the neural network recognition. Therefore, it is necessary to traverse all possible combinations of the candidate segmentation regions of the target image and evaluate the impact of each combination on adding interference to the target one by one.
[0091] Optionally, all combinations of the candidate segmentation regions of the target image are listed by the iterative method or the recursive method. The number of all combinations of the candidate segmentation regions of the target image can be calculated by the following expression:
[0092] In the formula,
[0093] C(n, m) is the number of candidate segmentation region combinations,
[0094] n is the number of all candidate segmentation regions in the target image,
[0095] m is the number of candidate segmentation regions included in the key region combination;
[0096] All combinations of all candidate segmentation regions of the target image are all combinations where the number m of candidate segmentation regions included in the combination ranges from 1 to n.
[0097] Based on each combination of candidate segmentation regions, a to-be-processed image is generated based on the target image, and then the corresponding candidate segmentation region combination in each to-be-processed image is masked to obtain the corresponding masked image.
[0098] Step 5: Apply the proxy model to identify each masked image, find the candidate segmentation regions that cannot be recognized as key regions, and mark the corresponding key regions in the to-be-processed image corresponding to the masked image to obtain the corresponding marked image.
[0099] Apply the proxy model to identify the masked candidate segmentation regions in each masked image. If the masked candidate segmentation region is successfully recognized, it means that the key region has a weak correlation with the target of interest obtained by the proxy model, and even adding perturbations will not affect the proxy model's recognition of the target image. For the masked image where the recognized masked candidate segmentation region is located, there is no need to add perturbations to the recognized masked candidate segmentation region; otherwise, if the masked candidate segmentation region cannot be recognized by the proxy model, it means that the candidate segmentation region has a great impact on the neural network recognition and should be added perturbations when generating image adversarial samples. Each masked image obtained after the third step is further verified by the proxy model to find the candidate segmentation regions in each masked image that are not recognized by the proxy model, and taking the unrecognized candidate segmentation regions as key regions helps to further improve the efficiency and accuracy of generating image adversarial samples.
[0100] So far, the preprocessing of the target image is completed, the key regions that need to add perturbations are clarified, and the marked image of the key regions is obtained. Adding perturbations to the target image based on the key regions avoids relying on the gradient change in the process of the proxy model recognizing the image, which is more in line with the scenario in reality where the neural network used by the other party to recognize the target image of one's own side is a "black box", avoiding the overfitting situation that may occur when adding perturbations to generate image adversarial samples later, and helps the image adversarial samples generated by adding perturbations later to obtain a better shielding effect on various neural networks.
[0101] Step 6: Add orthogonal perturbations to each key region in each marked image to generate the corresponding image adversarial samples.
[0102] In this embodiment, since the internal structure of the neural network used by the other party to identify the target image of the own party is unknown, it does not rely on the internal information such as the gradient change, model structure, and model parameters of the other party's neural network, and only uses the classification probability output at the end. Therefore, for each key region, Schmidt orthogonalization is used to iteratively add perturbations to avoid the complex process and redundant perturbations generated by randomly adding perturbations.
[0103] Specifically, orthogonal perturbations are added to each key region by performing the following process, which specifically includes:
[0104] S1: Initialize the current perturbation vector and the orthogonal vector set of the key region;
[0105] S2: Generate a random vector with the same dimension as the target image, and calculate the orthogonal components of the random vector relative to each orthogonal vector in the orthogonal vector set;
[0106] S3: Obtain a new orthogonal vector based on the mask matrix and the orthogonal components, and store the new orthogonal vector in the orthogonal vector set;
[0107] S4: Determine whether the number of orthogonal vectors in the orthogonal vector set reaches a preset threshold. If so, go to S5,
[0108] Otherwise, return to iteratively execute S2 - S4;
[0109] S5: Perturb the key region of the target image based on each orthogonal vector in the orthogonal vector set to obtain multiple perturbed images, and then input the multiple perturbed images into the target model respectively to obtain the corresponding target class probabilities for the current round;
[0110] S6: Calculate the difference between the target class probabilities for the current round of each perturbed image and the target class probabilities for the previous round respectively, and find the orthogonal vector corresponding to the target class probability with the largest absolute value of the difference as the optimal orthogonal vector;
[0111] S7: Update the current perturbation vector based on the optimal orthogonal vector to obtain an updated perturbation vector;
[0112] S8: Determine whether the preset iteration condition is satisfied. If so, use the updated perturbation vector as the current perturbation vector, return to iteratively execute S2 - S8, otherwise, generate an image adversarial sample based on the current perturbation vector.
[0113] Further, the initialization of the orthogonal vector set specifically includes:
[0114] Generate a random vector with the same dimension as the key region;
[0115] An orthogonal vector is obtained based on the masking vector and the random vector, and the orthogonal vector is stored in the orthogonal vector set.
[0116] Further, the preset iteration condition is:
[0117] The norm of the sum of the eigenvalue of each element in the key region and the current perturbation vector is less than the norm of the corresponding updated perturbation vector; and, the norm of the updated perturbation vector is greater than the norm of the current perturbation vector.
[0118] Specifically, the process of adding perturbations to each key region includes two nested iterative processes, an outer iteration for updating the perturbation vector and an inner iteration for finding the best direction for each perturbation. Before the iteration starts, first initialize an empty current perturbation vector and an empty orthogonal vector set by executing step S1, and then execute S2 to generate a random vector with the same dimension as the target image, and then generate an orthogonal vector based on the mask matrix and the random vector and store it in the orthogonal vector set. The purpose is to provide a starting point for performing subsequent Schmidt orthogonalization in the orthogonal vector set, which is convenient for subsequent iteration.
[0119] Further, the corresponding perturbation vectors are obtained based on the masking vector and the orthogonal vector, and based on the masking vector and the random vector through the following formula, and the formula is specifically expressed as:
[0120] In the formula,
[0121] is the orthogonal vector;
[0122] M is the mask matrix, and the element value of M is 1 when the image element is in the key region, otherwise the element value of M is 0;
[0123] v is the orthogonal vector or the random vector;
[0124] ⊙ represents the Hadamard product operation.
[0125] In each outer iteration round, the current perturbation vector is updated and perturbations are added. Among them, first start the inner iteration process of generating multiple candidate mutually orthogonal orthogonal vectors based on Schmidt orthogonalization. In each inner iteration round, first execute S3 to generate a random vector with the same dimension as the target image, and calculate the orthogonal components of the random vector relative to each orthogonal vector in the orthogonal vector set. The purpose is to apply the Schmidt orthogonalization algorithm to find the orthogonal components of each orthogonal vector that has been perturbed in the orthogonal vector set for the next possible candidate direction of adding perturbations.
[0126] Further, the orthogonal components of the random vector relative to each orthogonal vector in the orthogonal vector set are calculated through the following formula, and the formula is specifically expressed as:
[0127] In the formula,
[0128] v i is the current random vector, where i = 1, 2,..., n;
[0129] is the j-th orthogonal vector in the set of orthogonal vectors, where j = 0, 1,... i - 1;
[0130] is the i projection coefficient of v in the
[0131] v′ i is the i orthogonal component of v.
[0132] Then execute S4 to obtain a new orthogonal vector based on the mask matrix and the orthogonal component, and store the new orthogonal vector in the set of orthogonal vectors. The purpose is to first constrain each orthogonal component based on the mask matrix, that is, assign values to the elements of each orthogonal component based on the mask matrix to ensure that the perturbation is limited to the key area, then calculate a new orthogonal vector, and store it in the set of orthogonal vectors, so as to obtain a new candidate direction for adding perturbation.
[0133] Furthermore, through S5, it is judged whether the number of orthogonal vectors in the set of orthogonal vectors reaches a preset threshold. If the preset threshold is reached, the current round of nested iteration is terminated and S6 is executed; otherwise, return to S3 to enter the next iteration round. The preset threshold is the product of the number of horizontal elements and the number of vertical elements in the key area. The purpose is to ensure that the key area is searched for an appropriate number of times to find all candidate perturbation vectors as much as possible without causing excessive search and increasing the complexity and redundant computation amount of the algorithm.
[0134] After obtaining all candidate directions for adding perturbation in the current outer iteration round, execute S6. Perturb the key area of the target image based on each orthogonal vector in the set of orthogonal vectors to obtain multiple perturbed images, and then input the multiple perturbed images into the target model for recognition to obtain the corresponding target class probabilities for the current round. Specifically, based on the optimal orthogonal vector of this round and all orthogonal vectors in the orthogonal vector set of the current round, perturbations are added to the key area to generate corresponding scrambled images respectively, and then the target model is applied to recognize each scrambled image and output the corresponding target class probability. The purpose is to use the target model to verify and obtain the corresponding target class probability for the added perturbation effect, and update the perturbation vector in subsequent iterations.
[0135] Next, execute S7 to calculate the difference between the target class probability of each perturbed image in the current round and the target class probability in the previous round, and find the orthogonal vector corresponding to the target class probability with the largest absolute value of the difference as the optimal orthogonal vector. Among them, in the first step, the target image is input into the target model for recognition to obtain the initial target class probability as the difference in the target class probability in the previous round to start the iteration. Then, in each iteration round, the orthogonal vector corresponding to the target class probability with the largest absolute value of the difference can be obtained as the optimal orthogonal vector.
[0136] Then execute S8 to update the current perturbation vector based on the optimal orthogonal vector to obtain the updated perturbation vector.
[0137] Furthermore, the current perturbation vector is updated based on the optimal orthogonal vector through the following formula to obtain the updated perturbation vector. The formula is specifically expressed as:
[0138] In the formula,
[0139] r k+1 is the updated perturbation vector
[0140] r k is the current perturbation vector
[0141] k is the iteration round,
[0142] is the optimal orthogonal vector,
[0143] ε is the scaling factor,
[0144] F(x + r k , C x ) is the target class probability in the previous round, where x is the input image, and C x is the target class of the input image,
[0145] is the target class probability in the current round.
[0146] Among them, the scaling factor is used to control the amplitude of the added perturbation to ensure the stability of the generated image adversarial sample after adding the perturbation. It is preferably 0.5 - 0.8; The larger the value of , the greater the possibility that
[0147] is the true gradient change direction of the added perturbation. Then the scaling factor can be increased to increase the amplitude of the updated perturbation vector. Otherwise, the scaling factor is reduced to decrease the amplitude of the updated perturbation vector, making the added perturbation smoother and indistinguishable from the original image in terms of human vision, thus enhancing the perturbation concealment.Then, execute S9 to determine whether to terminate the iteration based on a preset iteration condition, and complete the scrambling of the key region. Among them, the preset iteration condition includes: the norm of the sum of each element eigenvalue of the key region and the current perturbation vector is less than the norm of the corresponding updated perturbation vector; moreover, the modulus of the updated perturbation vector is greater than the modulus of the current perturbation vector, both of which reflect the comparison of the change amount between the current round of scrambling and the next round of scrambling. If the change amount in the next round is greater than that in the current round, it means that the scrambling is not completed yet. Otherwise, it means that even the change brought by the scrambling in the next iteration round does not exceed the change brought by the scrambling in the current iteration round, so there is no need to continue adding perturbations, and the addition of perturbations to the key region ends. In each outer iteration round, among the multiple perturbed images obtained after executing S6, the perturbed image corresponding to the optimal orthogonal vector is the image adversarial sample generated in the current iteration round. In each iteration round, the key region is scrambled again based on the image adversarial sample generated in the previous iteration round. Then, the perturbed image corresponding to the optimal orthogonal vector obtained in the last iteration round S6 is the image adversarial sample generated by perturbing the corresponding key region.
[0148] For each unrecognized key region in each masked image in the image queue, iteratively execute the fifth step. After adding perturbations, the corresponding image adversarial sample is generated.
[0149] A method for generating an image adversarial sample based on key region constraints disclosed in this embodiment finds the corresponding category image as the target image based on the image classification applicable to the target model. Then, based on the feature map output at the end of the recognition by the proxy model and the weights of the fully connected layer, the target image class activation mapping diagram is calculated. The target image is segmented into multiple target regions through instance segmentation, and the candidate segmentation regions are found from the target regions in combination with the target image class activation mapping diagram. The corresponding image to be processed is generated based on the combination of the candidate segmentation regions. After masking the corresponding candidate segmentation region combination in the image to be processed, the masked image is obtained. Then, the proxy model is applied to recognize the masked image and find the unrecognized masked candidate segmentation region as the key region, and the corresponding marked image is obtained. Then, for the key region in each marked image, the Schmidt orthogonalization algorithm is used, and the optimal orthogonal vector and the current round perturbation vector in each iteration round are found through two layers of inner and outer iterations to scramble the key region. Through multiple iterations of scrambling the key region until the preset iteration condition is met, the image adversarial sample is generated. Compared with the prior art, the operation complexity is greatly reduced, and the accuracy of adding perturbations is improved. The generated image adversarial sample not only has a better perturbation effect, but also has a better gradient change, better visual concealment, better shielding effect on the neural network, and can shield the recognition of the majority of neural networks for the perturbed region.
[0150] Those skilled in the art can understand that all or part of the processes of implementing the methods of the above embodiments can be completed by instructing relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. Among them, the computer-readable storage medium is a magnetic disk, an optical disk, a read-only memory or a random access memory, etc.
[0151] As mentioned above, the above are only the preferred specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.
Claims
1. An image adversarial sample generation method based on key region constraints, characterized in that The method specifically includes: Finding corresponding category images as target images based on the image classification applicable to the target model; Inputting the target images into the proxy model for recognition to obtain the feature maps and fully connected layer weights output at the end of the proxy model, and then obtaining the class activation mapping of the target images based on the feature maps and fully connected layer weights output at the end; Identifying each target region from the target images, and finding candidate segmentation regions from each target region based on the class activation mapping; Obtaining all combinations of the candidate segmentation regions, generating a to-be-processed image based on each combination and the target image, and covering the corresponding candidate segmentation region combinations in each to-be-processed image to obtain the corresponding covered image; Applying the proxy model to recognize each covered image, finding the candidate segmentation regions that cannot be recognized as key regions, and marking the corresponding key regions in the to-be-processed image corresponding to the covered image to obtain the corresponding marked image; Adding orthogonal perturbations to each key region in each marked image to generate corresponding image adversarial samples.
2. The method for generating an image adversarial sample based on critical region constraint according to claim 1, wherein, Based on the feature maps and fully connected layer weights output at the end of the proxy model, the class activation mapping of the target image is obtained through the following process, and the process specifically includes: Multiplying the feature value of each pixel point in the feature map output at the end of the proxy model by the fully connected layer weights to obtain an updated feature value matrix; Magnifying the updated feature value matrix to the same size as the target image through bilinear interpolation to obtain an enlarged feature value matrix; Normalizing the enlarged feature value matrix to obtain the class activation mapping of the target image.
3. The method for generating an image adversarial sample based on key region constraint according to claim 2, wherein Identifying each target region from the target image specifically refers to segmenting the target image through instance segmentation to obtain each target region and generating a corresponding mask matrix.
4. The method for generating an image adversarial sample based on key region constraints according to claim 3, wherein Based on the class activation mapping, the following process is used to find candidate segmentation regions from each target region, and the process specifically includes: Calculating the mean of the product of the mask matrix element values corresponding to the elements covered by each target region and the probability values of the corresponding elements in the class activation mapping respectively; Judging whether the mean value exceeds a preset threshold. If so, taking the corresponding target region as a candidate segmentation region, otherwise, excluding the corresponding target region.
5. A method for generating image adversarial samples based on critical region constraints according to claim 4, characterized in that, Adding orthogonal perturbations to each key region respectively through the following process, and the process specifically includes: S1: Initializing the current perturbation vector and orthogonal vector set of the key region; S2: Generating a random vector with the same dimension as the target image, and calculating the orthogonal components of the random vector relative to each orthogonal vector in the orthogonal vector set; S3: Obtaining a new orthogonal vector based on the mask matrix and the orthogonal components, and storing the new orthogonal vector in the orthogonal vector set; S4: Judging whether the number of orthogonal vectors in the orthogonal vector set reaches a preset threshold. If so, turning to S5, Otherwise, returning to iteratively execute S2 - S4; S5: Perturbing the key region of the target image based on each orthogonal vector in the orthogonal vector set to obtain multiple perturbed images, and inputting the multiple perturbed images into the target model for recognition respectively to obtain the corresponding target category probabilities in the current round; S6: Calculate the difference between the target class probability of the current round of each perturbed image and the target class probability of the previous round respectively, and find the orthogonal vector corresponding to the target class probability with the largest absolute value of the difference as the optimal orthogonal vector; S7: Update the current perturbation vector based on the optimal orthogonal vector to obtain the updated perturbation vector; S8: Determine whether the preset iteration condition is satisfied. If so, use the updated perturbation vector as the current perturbation vector, and return to iteratively execute S2 - S8. Otherwise, generate an image adversarial sample based on the current perturbation vector.
6. The method for generating an image adversarial sample based on critical region constraint according to claim 5, wherein, The initialization of the orthogonal vector set specifically includes: Generate a random vector with the same dimension as the key region; Obtain an orthogonal vector based on the masking vector and the random vector, and store the orthogonal vector in the orthogonal vector set.
7. A method for generating image adversarial samples based on critical region constraints according to claim 6, characterized in that The preset iteration condition is: The norm of the sum of the eigenvalue of each element in the key region and the current perturbation vector is less than the norm of the corresponding updated perturbation vector; and, the norm of the updated perturbation vector is greater than the norm of the current perturbation vector.
8. A method for generating image adversarial samples based on key region constraints according to claim 7, characterized in that, The corresponding perturbation vectors are obtained based on the masking vector and the orthogonal vector, and based on the masking vector and the random vector through the following formula, and the formula is specifically expressed as: In the formula, are orthogonal vectors; M is a mask matrix, the element value of M is 1 when the image element is in the key region, otherwise the element value of M is 0; v is an orthogonal vector or a random vector; ⊙ represents the Hadamard product operation.
9. A method for generating image adversarial samples based on critical region constraints according to claim 8, characterized in that, Calculate the orthogonal component of the random vector relative to each orthogonal vector in the orthogonal vector set through the following formula, and the formula is specifically expressed as: In the formula, v i is the current random vector, where i = 1, 2,..., n; is the j-th orthogonal vector in the set of orthogonal vectors, where j = 0, 1, ... i-1; is v i in the projection coefficient in the direction of; v’ i is the orthogonal component of v i .
10. A method for generating image adversarial samples based on critical region constraints according to claim 9, characterized in that, Update the current perturbation vector based on the optimal orthogonal vector through the following formula to obtain the updated perturbation vector, and the formula is specifically expressed as: In the formula, r k+1 is the perturbed vector after update r k is the current perturbation vector k is the iteration round, is the optimal orthogonal vector, ε is the scaling factor, F(x+r k , C x ) probability of the target category in the previous round, where x is the input image and C x is the target category of the input image Probability of the target category in the current round.