Training method, device and storage medium for adversarial image detection model

Abstract

The present invention discloses a training method, device and storage medium for an adversarial image detection model, and relates to the field of image processing technology. The training method for the adversarial image detection model includes: initializing the adversarial image detection model using a pre-trained meta-model, wherein the parameters of the meta-model are determined based on a plurality of pre-trained internal network models, each internal network model is pre-trained using one or more adversarial images, and the number of each adversarial image is less than a preset value; obtaining training images including new types of adversarial images, wherein the number of new types of adversarial images is less than a preset value; and training the adversarial image detection model using the training images, so as to identify adversarial images and non-adversarial images using the trained adversarial image detection model. The training method of the present invention can achieve rapid convergence, so that new types of adversarial images can be quickly and accurately identified.

Description

Technical Field

[0001] The present invention relates to the field of image processing technology, and in particular to a training method, device and storage medium for an adversarial image detection model. Background Art

[0002] Adversarial examples are input samples formed by deliberately adding subtle interference to the dataset, which will cause the model to give an incorrect output with high confidence. When subtle interference is added to the image to mislead the model, the formed sample can be called an adversarial image. Human observers will not notice the difference between the original image and the adversarial image, but the model will make completely different predictions for the original image and the adversarial image.

[0003] If adversarial samples are mixed into normal images, it will pose a certain threat to system security. For example, in a face recognition system, by attacking an image with the face of user U1, the generated adversarial image is likely to be recognized by the neural network as user U2, while the human eye still sees user U1, causing certain losses to the attacked user.

[0004] In order to avoid this situation as much as possible, an algorithm model for adversarial sample detection can be integrated into the computer vision system to detect this hidden danger. Related technologies can be trained by using a large number of samples to train deep learning models, long short-term memory networks (LSTM) models, and other models to identify adversarial samples. Summary of the invention

[0005] The inventors have realized that the related art can only detect known types of adversarial images. When new types of adversarial images appear, a large number of new types of adversarial images are needed to retrain the model, so it is difficult to quickly respond to new attacks on images. If only a small number of new types of adversarial images are used to train the model, the recognition accuracy of the model is low.

[0006] A technical problem to be solved by the embodiments of the present invention is: how to quickly and accurately identify new types of adversarial samples.

[0007] According to a first aspect of some embodiments of the present invention, there is provided a method for training an adversarial image detection model, comprising: initializing the adversarial image detection model using a pre-trained meta-model, wherein parameters of the meta-model are determined based on a plurality of pre-trained internal network models, each internal network model is pre-trained using one or more adversarial images, and the number of each adversarial image is less than a preset value; acquiring training images including new types of adversarial images, wherein the number of new types of adversarial images is less than a preset value; and training the adversarial image detection model using the training images, so as to use the trained adversarial image detection model to identify adversarial images and non-adversarial images.

[0008] In some embodiments, the meta-model and the internal network model have the same network structure.

[0009] In some embodiments, the training images further include at least one of non-adversarial images and adversarial images other than new categories.

[0010] In some embodiments, the preset value is no greater than ten.

[0011] In some embodiments, the training method further includes: using the trained adversarial image detection model to identify adversarial images and non-adversarial images.

[0012] In some embodiments, the training method also includes: obtaining multiple task sets, wherein each task set includes a support set and a query set, the support set includes one or more adversarial images, and the number of each adversarial image is less than a preset value; using the parameters of the meta-model to initialize the internal network model corresponding to each task set; using the support set in each task set to pre-train the corresponding internal network model; using each pre-trained internal network model to predict the query set in the corresponding task set; and updating the parameters of the meta-model according to the prediction results of each pre-trained internal network model.

[0013] In some embodiments, the internal network model is used to identify the category of the adversarial image.

[0014] In some embodiments, updating the parameters of the meta-model according to the prediction results of each pre-trained internal network model includes: determining the gradient value corresponding to the parameter of each internal network model according to the prediction results of each pre-trained internal network model; and updating the corresponding parameters of the meta-model by using the sum of the gradient values ​​corresponding to the same parameter of each internal network model.

[0015] In some embodiments, each task set is generated using the following method: selecting a preset number of categories from an adversarial image dataset including adversarial images of multiple categories; selecting a preset number of adversarial images from each selected category to add to a support set, and selecting multiple adversarial images from each selected category to add to a query set; and using the support set and the query set as the task set.

[0016] In some embodiments, a preset number of adversarial images are selected in each selected category and a preset number of non-adversarial images are selected to be added to the support set, and multiple adversarial images are selected in each selected category and multiple non-adversarial images are selected to be added to the query set.

[0017] According to a second aspect of some embodiments of the present invention, there is provided a training device for an adversarial image detection model, comprising: an initialization module, configured to initialize the adversarial image detection model using a pre-trained meta-model, wherein the parameters of the meta-model are determined based on a plurality of pre-trained internal network models, each of which is pre-trained using one or more adversarial images, and the number of each adversarial image is less than a preset value; a training image acquisition module, configured to acquire training images including new types of adversarial images, wherein the number of new types of adversarial images is less than a preset value; and a training module, configured to train the adversarial image detection model using the training images, so as to use the trained adversarial image detection model to identify adversarial images and non-adversarial images.

[0018] According to a third aspect of some embodiments of the present invention, there is provided a training device for an adversarial image detection model, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any of the aforementioned training methods for the adversarial image detection model based on instructions stored in the memory.

[0019] According to a fourth aspect of some embodiments of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, any of the aforementioned training methods for the adversarial image detection model is implemented.

[0020] Some embodiments of the above invention have the following advantages or beneficial effects: the meta-model can have the prior knowledge obtained by each internal network model based on a small number of samples for learning by determining parameters based on a large number of pre-trained internal network models. Therefore, when new types of adversarial samples appear, the adversarial image detection model initialized by training the meta-model with a small number of samples can achieve rapid convergence, thereby being able to quickly and accurately identify new types of adversarial images.

[0021] Further features and advantages of the present invention will become apparent from the following detailed description of exemplary embodiments of the present invention with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0023] Figure 1 Schematic diagram of a flow chart of a method for training an adversarial image detection model according to some embodiments of the present invention.

[0024] Figure 2 The figure is a flowchart of a task set generation method according to some embodiments of the present invention.

[0025] Figure 3 Schematic diagram of the process of metamodel pre-training method according to some embodiments of the present invention.

[0026] Figure 4 Schematic diagram of a test method according to some embodiments of the present invention.

[0027] Figure 5 Schematic diagram of the structure of a training device for an adversarial image detection model according to some embodiments of the present invention.

[0028] Figure 6 Schematic diagram of the structure of a training device for an adversarial image detection model according to some other embodiments of the present invention.

[0029] Figure 7 Schematic diagram of the structure of a training device for an adversarial image detection model according to some other embodiments of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present invention and its application or use. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] The relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present invention unless specifically stated otherwise.

[0032] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0033] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.

[0034] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0035] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0036] Figure 1 FIG. 1 is a flow chart of a method for training an adversarial image detection model according to some embodiments of the present invention. Figure 1 As shown, the training method of the adversarial image detection model of this embodiment includes steps S102 to S108.

[0037] In step S102, the pre-trained meta-model is used to initialize the adversarial image detection model. For example, the network structure and parameters of the meta-model may be copied to obtain an initial adversarial image detection model.

[0038] The parameters of the meta-model are determined based on a plurality of pre-trained internal network models. The internal network model and the meta-model may be implemented using a neural network model. In some embodiments, the meta-model and the internal network model have the same network structure.

[0039] Adversarial images are classified by attack method. For example, adversarial images generated by attacks using the Fast Gradient Sign Method (FGSM), Carlini and Wagner (C&W), and Project Gradient Descent (PGD) methods belong to three different categories. Each internal network model is pre-trained using one or more adversarial images, and the number of each adversarial image is less than a preset value. Thus, each internal network model learns a small number of adversarial images of each category, that is, it learns each attack method based on a small number of samples.

[0040] In step S104, training images including adversarial images of a new type are obtained, wherein the number of adversarial images of the new type is less than a preset value. The new type is different from the type of adversarial images used in the pre-training process.

[0041] In some embodiments, in addition to the new type of adversarial images, the training images also include at least one of non-adversarial images (or clean images) and adversarial images other than the new type. By training the new type of adversarial images together with the known type of adversarial images or non-adversarial images, the accuracy of model prediction can be further improved.

[0042] In some embodiments, the preset value is no greater than 10. For example, the training image may include 5 adversarial images of a new type.

[0043] In step S106, the adversarial image detection model is trained using training images.

[0044] In step S108, the trained adversarial image detection model is used to identify adversarial images and non-adversarial images.

[0045] During the training process, any adversarial image can be marked as a negative sample, while non-adversarial images can be marked as positive samples. Therefore, in the prediction stage, the adversarial image detection model does not need to pay attention to the specific type of adversarial images.

[0046] The meta-model determines parameters based on a large number of pre-trained internal network models, and can have the prior knowledge obtained by each internal network model based on a small number of samples. Therefore, when new types of adversarial samples appear, the adversarial image detection model initialized by training the meta-model with a small number of samples can achieve rapid convergence, thereby being able to quickly and accurately identify new types of adversarial images.

[0047] In the stage of pre-training the meta-model, the pre-training process of each internal network can be regarded as a scenario based on a small number of samples for learning, and a corresponding task set is designed for each scenario as the data for pre-training. Figure 2 An embodiment of the task set generation method of the present invention is described.

[0048] Figure 2 FIG. 1 is a flow chart of a task set generation method according to some embodiments of the present invention. Figure 2 As shown, the task set generation method of this embodiment includes steps S202 to S206.

[0049] In step S202, a preset number of categories are selected from an adversarial image dataset including adversarial images of multiple categories.

[0050] In step S204, a preset number of adversarial images are selected from each selected category to be added to the support set, and multiple adversarial images are selected from each selected category to be added to the query set.

[0051] In some embodiments, a preset number of adversarial images and a preset number of non-adversarial images may be selected in each selected category to be added to the support set, and multiple adversarial images and multiple non-adversarial images may be selected in each selected category to be added to the query set. That is, non-adversarial images may also be regarded as a kind of "category".

[0052] Therefore, the task set can have both positive and negative samples, which can achieve better training results.

[0053] In step S206, the support set and the query set are used as the task set.

[0054] Assume that the adversarial images in the adversarial image dataset belong to categories A to G respectively. Each task set includes two categories of adversarial images, or one category of adversarial images and non-adversarial images. "Category P" is used to represent non-adversarial images. Table 1 is an exemplary composition of a task set.

[0055] Table 1

[0056]

[0057] As required, the number of categories in each task set can be greater than 2, which will not be elaborated here.

[0058] In some embodiments, the images in the task set may also have coarse classification labels and fine classification labels. The coarse classification label is used to indicate whether the image is an adversarial image or a non-adversarial image. The fine classification label of the adversarial image is used to indicate the category of the adversarial image, that is, the attack method used to generate the adversarial image, and the fine classification label of the non-adversarial image is used to indicate the category of the image content, such as cat, dog, tiger, etc. Pre-training can be performed based on the fine classification label, and testing can be performed based on the coarse classification label.

[0059] Through the method of the above embodiment, a variety of task sets including a small number of adversarial images can be generated based on the adversarial image dataset, so that the data used in the pre-training process is close to the usage environment.

[0060] As needed, those skilled in the art may also use other methods to generate a task set.

[0061] Reference below Figure 3 Embodiments of pre-trained meta-models are described.

[0062] Figure 3 FIG. 1 is a flow chart of a metamodel pre-training method according to some embodiments of the present invention. Figure 3 As shown, the metamodel pre-training method of this embodiment includes steps S302 to S310.

[0063] In step S302, a plurality of task sets are obtained, wherein each task set includes a support set and a query set, the support set includes one or more adversarial images, and the number of each adversarial image is less than a preset value.

[0064] In step S304, the internal network model corresponding to each task set is initialized using the parameters of the meta-model.

[0065] In some embodiments, the initial values ​​of the parameters of the meta-model may be determined by a deep learning method.

[0066] In step S306, the support set in each task set is used to pre-train the corresponding internal network model.

[0067] In some embodiments, for each internal network model, the corresponding support set can be used as a batch of data for training. For example, the images in the support set can be input into the internal network model to obtain the prediction results; then, the gradient value of the loss function of the internal network model with respect to the parameters is calculated based on the gap between the prediction results and the label value of the image, and the parameters are updated based on the gradient value.

[0068] In some embodiments, the internal network model is used to identify the category of the adversarial image. That is, the internal network model can be used to predict the fine classification label of the input image. The trained meta-model and the adversarial image detection model can predict the coarse classification label of the image, that is, only predict whether the image is an adversarial image. Thus, the fine-grained prediction results can be used to adjust the model in the training phase, and the coarse-grained prediction results can be given in the use phase, which can further improve the accuracy of the prediction.

[0069] In step S308, each pre-trained internal network model is used to predict the query set in the corresponding task set.

[0070] In step S310, the parameters of the meta-model are updated according to the prediction results of each pre-trained internal network model.

[0071] In some embodiments, the gradient value corresponding to the parameter of each internal network model can be determined according to the prediction result of each pre-trained internal network model; the sum of the gradient values ​​corresponding to the same parameter of each internal network model is used to update the corresponding parameter of the meta-model.

[0072] In some embodiments, the total difference between the prediction result and the label value corresponding to each internal network model can also be determined according to the prediction result of each pre-trained internal network model; the total difference corresponding to each internal network model is summed up; the gradient value of the meta-model loss function with respect to the parameters of the meta-model is determined based on the result of the summation calculation, and the parameters of the meta-model are updated according to the gradient value. That is, the loss of each internal network model is used as the loss of the meta-model, and the parameters of the meta-model are adjusted.

[0073] As required, steps S302 to S310 may be performed multiple times until a preset convergence condition is reached. As required, the trained meta-model may also be tested to determine whether the prediction accuracy meets the preset requirements. Figure 4 An example of the test method of the present invention is described.

[0074] Figure 4 FIG. 1 is a flow chart of a testing method according to some embodiments of the present invention. Figure 4 As shown, the testing method of this embodiment includes steps S402 to S410.

[0075] In step S402, a plurality of task sets for testing are obtained, wherein each task set for testing includes a support set and a query set, the support set includes one or more adversarial images, and the number of each adversarial image is less than a preset value.

[0076] In step S404, the parameters of the pre-trained meta-model are used to initialize the internal network model corresponding to each task set for testing.

[0077] In step S406, the support set in each task set used for testing is used to pre-train the corresponding internal network model.

[0078] In step S408, each pre-trained internal network model is used to predict the query set in the corresponding task set for testing.

[0079] During the testing phase in some embodiments, the internal network model can be used to predict the coarse classification label of the image, that is, to predict whether the image is an adversarial image; alternatively, the internal network model can also output a prediction result based on the fine classification label and convert the fine classification label in the prediction result into a coarse classification label.

[0080] In step S410, the score corresponding to each internal network model is determined based on the difference between the prediction result and the tag value of the query set in the task set used for testing, and the total score is calculated. The prediction accuracy can be determined based on the comparison result of the total score with the preset threshold.

[0081] Those skilled in the art should be aware that the above descriptions of "pre-training" and "training" are only intended to illustrate the sequence of the training process of the internal network model and the meta-model and the training process of the adversarial image detection model, that is, the internal network model and the meta-model are trained first, and then the adversarial image detection model is trained based on the training results of the meta-model. The literal names of "pre-training" and "training" do not limit the scheme of the present invention. As needed, those skilled in the art may also refer to the process of determining the initial parameters of the meta-model based on the deep learning method as "pre-training", the process of training the internal network model and the meta-model as "training", and the process of training the adversarial image detection model as "fine-tuning".

[0082] Reference below Figure 5 An embodiment of a training device for an adversarial image detection model of the present invention is described.

[0083] Figure 5 FIG. 1 is a schematic diagram of a structure of a training device for an adversarial image detection model according to some embodiments of the present invention. Figure 5 As shown, the training device 50 of this embodiment includes: an initialization module 510, configured to initialize an adversarial image detection model using a pre-trained meta-model, wherein the parameters of the meta-model are determined based on multiple pre-trained internal network models, each internal network model is pre-trained using one or more adversarial images, and the number of each adversarial image is less than a preset value; a training image acquisition module 520, configured to acquire training images including new types of adversarial images, wherein the number of new types of adversarial images is less than a preset value; a training module 530, configured to train the adversarial image detection model using the training images, so as to use the trained adversarial image detection model to identify adversarial images and non-adversarial images.

[0084] In some embodiments, the meta-model and the internal network model have the same network structure.

[0085] In some embodiments, the training images further include at least one of non-adversarial images and adversarial images other than new categories.

[0086] In some embodiments, the preset value is no greater than ten.

[0087] In some embodiments, the training device 50 further includes a recognition module 540 configured to recognize adversarial images and non-adversarial images using the trained adversarial image detection model.

[0088] In some embodiments, the training device 50 also includes a pre-training module 550, which is configured to obtain multiple task sets, wherein each task set includes a support set and a query set, the support set includes one or more adversarial images, and the number of each adversarial image is less than a preset value; use the parameters of the meta-model to initialize the internal network model corresponding to each task set; use the support set in each task set to pre-train the corresponding internal network model; use each pre-trained internal network model to predict the query set in the corresponding task set; and update the parameters of the meta-model according to the prediction results of each pre-trained internal network model.

[0089] In some embodiments, the internal network model is used to identify the category of the adversarial image.

[0090] In some embodiments, the pre-training module 550 is further configured to determine the gradient value corresponding to the parameters of each internal network model based on the prediction results of each pre-trained internal network model; and update the corresponding parameters of the meta-model using the sum of the gradient values ​​corresponding to the same parameters of each internal network model.

[0091] In some embodiments, the pre-training module 550 is further configured to select a preset number of categories from an adversarial image dataset comprising adversarial images of multiple categories; select a preset number of adversarial images from each selected category to add to a support set, and select multiple adversarial images from each selected category to add to a query set; and use the support set and the query set as a task set.

[0092] In some embodiments, the pre-training module 550 is further configured to select a preset number of adversarial images in each selected category and select a preset number of non-adversarial images to add to the support set, and select multiple adversarial images in each selected category and select multiple non-adversarial images to add to the query set.

[0093] Figure 6 FIG. 1 is a schematic diagram of a structure of a training device for an adversarial image detection model according to some other embodiments of the present invention. Figure 6 As shown, the training device 60 of the adversarial image detection model of this embodiment includes: a memory 610 and a processor 620 coupled to the memory 610, and the processor 620 is configured to execute the training method of the adversarial image detection model in any one of the aforementioned embodiments based on the instructions stored in the memory 610.

[0094] The memory 610 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, and other programs.

[0095] Figure 7FIG. 1 is a schematic diagram of a structure of a training device for an adversarial image detection model according to some embodiments of the present invention. Figure 7 As shown, the training device 70 of the adversarial image detection model of this embodiment includes: a memory 710 and a processor 720, and may also include an input and output interface 730, a network interface 740, a storage interface 750, etc. These interfaces 730, 740, 750 and the memory 710 and the processor 720 can be connected, for example, via a bus 760. Among them, the input and output interface 730 provides a connection interface for input and output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 740 provides a connection interface for various networked devices. The storage interface 750 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0096] An embodiment of the present invention also provides a computer-readable storage medium having a computer program stored thereon, characterized in that when the program is executed by a processor, it implements any of the aforementioned training methods for the adversarial image detection model.

[0097] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A training method for an adversarial image detection model, comprising: Obtain multiple task sets, wherein each task set includes a support set and a query set, the support set includes one or more adversarial images, and the number of each adversarial image is less than a preset value; Use the parameters of the meta-model to initialize the internal network model corresponding to each task set; Use the support set in each task set to pre-train the corresponding internal network model; Use each pre-trained internal network model to predict the query set in the corresponding task set; Update the parameters of the meta-model according to the prediction results of each pre-trained internal network model; Initializing an adversarial image detection model using the pre-trained meta-model; Acquire a training image including a new type of adversarial image, wherein the number of the new type of adversarial images is less than a preset value; The training images are used to train an adversarial image detection model, so that the trained adversarial image detection model can be used to identify adversarial images and non-adversarial images.

2. The training method according to claim 1, wherein: The meta-model and the internal network model have the same network structure.

3. The training method according to claim 1, wherein: The training images further include at least one of non-adversarial images and adversarial images other than the new type.

4. The training method according to claim 1, wherein: The preset value is no greater than 10.

5. The training method according to claim 1, further comprising: The trained adversarial image detection model is used to identify adversarial images and non-adversarial images.

6. The training method according to claim 1, wherein: The internal network model is used to identify the category of the adversarial image.

7. The training method according to claim 1, wherein: The updating of the parameters of the meta-model according to the prediction results of each pre-trained internal network model includes: According to the prediction results of each pre-trained internal network model, determine the gradient value corresponding to the parameters of each internal network model; The sum of the gradient values ​​corresponding to the same parameter of each internal network model is used to update the corresponding parameters of the meta-model.

8. The training method according to claim 1, wherein: Each task set is generated using the following method: selecting a preset number of categories from an adversarial image dataset including adversarial images of a plurality of categories; Select a preset number of adversarial images from each selected category to add to the support set, and select multiple adversarial images from each selected category to add to the query set; The support set and query set are used as the task set.

9. The training method according to claim 8, wherein: A preset number of adversarial images and a preset number of non-adversarial images are selected in each selected category to be added to a support set, and multiple adversarial images and multiple non-adversarial images are selected in each selected category to be added to a query set.

10. A training device for an adversarial image detection model, comprising: A pre-training module is configured to obtain a plurality of task sets, wherein each task set includes a support set and a query set, the support set includes one or more adversarial images, and the number of each adversarial image is less than a preset value; the internal network model corresponding to each task set is initialized using the parameters of the meta-model; the support set in each task set is used to pre-train the corresponding internal network model; each pre-trained internal network model is used to predict the query set in the corresponding task set; and the parameters of the meta-model are updated according to the prediction results of each pre-trained internal network model; an initialization module configured to initialize an adversarial image detection model using a pre-trained meta-model, wherein parameters of the meta-model are determined based on a plurality of pre-trained internal network models, each of which is pre-trained using one or more adversarial images, and the number of each adversarial image is less than a preset value; A training image acquisition module, configured to acquire training images including new types of adversarial images, wherein the number of the new types of adversarial images is less than a preset value; The training module is configured to use the training images to train the adversarial image detection model so as to use the trained adversarial image detection model to identify adversarial images and non-adversarial images.

11. A training device for an adversarial image detection model, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the training method of the adversarial image detection model as described in any one of claims 1 to 9 based on instructions stored in the memory.

12. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the training method for the adversarial image detection model described in any one of claims 1 to 9.

Images