A method and device for OCR recognition of adversarial sample attacks

Abstract

The present invention discloses a method and device for OCR recognition of adversarial sample attacks, and relates to the field of computer technology. The specific implementation of the method includes: preprocessing real images to generate standard character training data; using the generated standard character training data to train an immune adversarial model; generating immune adversarial samples via the immune adversarial model; using the immune adversarial samples to train an OCR model to strengthen the OCR model; using the strengthened OCR model to recognize adversarial sample attacks. Because this implementation adopts a technical means combining standard character sample training and immune adversarial sample training, it overcomes the technical problem of the OCR recognition model misidentifying adversarial samples, thereby achieving a significant improvement in immunity to adversarial sample attacks and preventing malicious attacks.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for OCR recognition of adversarial sample attacks. Background Art

[0002] Adversarial samples are intentionally added to the input samples with subtle interference that is imperceptible to some people, causing the model to give an erroneous output with high confidence. For example, a correctly classified image can be slightly modified in pixels, so that the image is misclassified as other labels under the deep neural network (DNN). Adversarial samples can be used to create samples that deceive the optical character recognition (OCR) model. After a character is transformed by an adversarial sample, it can be recognized as another character.

[0003] For example Figure 1 In the figure, the leftmost image is an image of a normal character "7" without any processing. After OCR recognition, the probability of being recognized as 7 is 1.0; after being transformed by a certain adversarial sample, the probability of being recognized as the character "3" is 0.865, and after the rightmost character is transformed by another adversarial sample, the probability of being recognized as the character "3" is 0.976.

[0004] Adversarial sample attacks are attacks that use adversarial samples to fool image recognition models and achieve certain specific goals. For example, for online image pornography detection, many websites now have their own automatic image pornography detection models, but by processing pornographic images with adversarial samples, some pornography detection models can successfully identify pornographic images as non-pornographic images, thus successfully bypassing the review mechanism and achieving the purpose of posting certain illegal images online.

[0005] Adversarial sample attacks on banking services are to intentionally modify certain images during OCR recognition of bank cards (credit cards) so that they are intentionally misrecognized, or to modify them into malicious strings to attack the system (such as SQL injection, etc.). Summary of the invention

[0006] In view of this, the embodiments of the present invention provide a method and device for OCR recognition of adversarial sample attacks, which can enhance the OCR recognition model by combining character samples and immune adversarial sample training, thereby achieving the purpose of immune adversarial sample attacks. The OCR recognition model trained by this method can significantly improve the immunity to adversarial sample attacks and prevent malicious attacks.

[0007] To achieve the above objective, according to one aspect of an embodiment of the present invention, a method for OCR identifying adversarial sample attacks is provided.

[0008] According to one aspect of an embodiment of the present invention, a method for OCR identifying adversarial sample attacks includes:

[0009] Preprocess the real images to generate standard character training data;

[0010] Using the generated standard character training data to train the immune adversarial model;

[0011] Generating immune adversarial samples via the immune adversarial model;

[0012] Using the immune adversarial sample to train an OCR model to strengthen the OCR model;

[0013] The enhanced OCR model is used to identify adversarial sample attacks.

[0014] According to an aspect of an embodiment of the present invention, in the method for OCR recognition against sample attacks, the preprocessing of the image to generate standard character training data comprises:

[0015] Slicing the real image;

[0016] Using image processing technology, generating a generated image corresponding to the characters in the real image;

[0017] The real image is combined with the generated image to generate a standard character sample.

[0018] According to an aspect of an embodiment of the present invention, the method for OCR recognition against sample attacks, wherein the real image is a bank card number image.

[0019] According to an aspect of an embodiment of the present invention, in the method for OCR recognition against sample attacks, combining the real image with the generated image to generate a standard character sample comprises:

[0020] Keep the characters in the real image and the generated image consistent.

[0021] According to an aspect of an embodiment of the present invention, a method for OCR identifying adversarial sample attacks is provided, wherein the training immune adversarial model is trained using a GAN model.

[0022] According to an aspect of an embodiment of the present invention, in the method for OCR identifying adversarial sample attacks, the method of using the immune adversarial sample to train an OCR model to strengthen the OCR model includes:

[0023] The immune adversarial sample data is confused with real data, and the OCR model is trained using the confused training data.

[0024] To achieve the above objective, according to one aspect of an embodiment of the present invention, a device for OCR identifying adversarial sample attacks is provided.

[0025] According to one aspect of an embodiment of the present invention, an apparatus for OCR recognition against sample attacks includes:

[0026] An image preprocessing module, used for preprocessing real images to generate standard character training data;

[0027] The immune adversarial sample module is used to:

[0028] Training the immune adversarial model using the generated standard character training data; and

[0029] Generating immune adversarial samples via the immune adversarial model;

[0030] OCR module for:

[0031] Using the immune adversarial sample to train an OCR model to strengthen the OCR model;

[0032] The enhanced OCR model is used to identify adversarial sample attacks.

[0033] According to an apparatus for OCR recognition against sample attacks according to one aspect of an embodiment of the present invention, the image preprocessing module is further used for:

[0034] Slicing the real image;

[0035] Using image processing technology, generating a generated image corresponding to the characters in the real image;

[0036] The real image is combined with the generated image to generate a standard character sample.

[0037] According to an aspect of an embodiment of the present invention, the device for OCR recognition against sample attacks, wherein the real image is a bank card number image.

[0038] According to an aspect of an embodiment of the present invention, in an apparatus for OCR recognition against sample attacks, combining the real image with the generated image to generate a standard character sample comprises:

[0039] Keep the characters in the real image and the generated image consistent.

[0040] According to an aspect of an embodiment of the present invention, in the apparatus for OCR identifying adversarial sample attacks, the immune adversarial sample module is trained using a GAN model.

[0041] According to an apparatus for OCR recognition against sample attacks according to one aspect of an embodiment of the present invention, the OCR module is further used for:

[0042] The immune adversarial sample data is confused with real data, and the OCR model is trained using the confused training data.

[0043] To achieve the above object, according to one aspect of an embodiment of the present invention, an electronic device for OCR recognition of adversarial sample attacks is provided, comprising:

[0044] one or more processors;

[0045] a storage device for storing one or more programs,

[0046] When the one or more programs are executed by the one or more processors, the one or more processors implement any of the methods described above.

[0047] To achieve the above object, according to one aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, characterized in that when the program is executed by a processor, any of the methods described above is implemented.

[0048] An embodiment of the above invention has the following advantages or beneficial effects: because a technical means combining character sample training and immune adversarial sample training is adopted, the technical problem of OCR recognition model misidentifying adversarial samples is overcome, thereby achieving a significant improvement in immunity to adversarial sample attacks and preventing malicious attacks.

[0049] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0051] Figure 1 is a schematic diagram of an adversarial sample attack according to an embodiment of the present invention;

[0052] Figure 2 is a schematic diagram of another adversarial sample attack according to an embodiment of the present invention;

[0053] Figure 3 is a schematic diagram of the main process of the method for OCR identifying adversarial sample attacks according to an embodiment of the present invention;

[0054] Figure 4a-4c is a schematic diagram of a standard character sample according to an embodiment of the present invention;

[0055] Figure 5 is a schematic diagram of a GAN model according to an embodiment of the present invention;

[0056] Figure 6 is a schematic diagram of training data for selecting an OCR model generated according to an embodiment of the present invention;

[0057] Figure 7 is a schematic diagram of the main process of the system for OCR recognition of adversarial sample attacks according to an embodiment of the present invention;

[0058] Figure 8 2 is a schematic diagram of main modules of an apparatus for OCR recognition of adversarial sample attacks according to an embodiment of the present invention;

[0059] Fig. 9 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0060] Fig.10 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0062] Adversarial examples are very different from adversarial learning (GAN). Adversarial examples refer to the intentional addition of subtle interference to the input sample that is imperceptible to some people, causing the model to give an incorrect output with high confidence. For example, a slightly modified pixel of an image that has been correctly classified can be misclassified as other labels under DNN.

[0063] Figure 2 An example of adversarial sample perturbation is shown. Figure 2 In the example, the label of sample x is panda. After adding some interference to x, it is still classified as a panda in the human eye, but the deep model misclassifies it as a gibbon with a confidence level of up to 99.3%.

[0064] Adversarial sample attack is an attack mode that uses adversarial samples to fool image recognition models and achieve certain specific purposes.

[0065] OCR recognition refers to the process of analyzing and identifying image files of text materials to obtain text and layout information. In other words, the text in the image is recognized and returned in the form of text.

[0066] Adversarial sample attacks have the ability to fool image recognition models such as OCR by processing the image with adversarial samples. By utilizing this ability to fool the model, attacks with certain specific purposes can be carried out. The present invention provides a model robustness enhancement model to improve the robustness against adversarial sample attacks, enhance defense capabilities, and reduce the probability of OCR recognition errors of adversarial samples.

[0067] Figure 3 is a method for OCR recognition of adversarial sample attacks according to an embodiment of the present invention, such as Figure 3 As shown, the method for OCR identifying adversarial sample attacks mainly includes steps S301, S302, S303, S304, and S305.

[0068] Step S301: Acquire bank card (credit card) image data.

[0069] First, bank card image data is obtained as standard data. The bank card image data can be obtained in any suitable manner, such as taking a photo of the bank card or reading from a database, etc., which will not be listed here. It should be noted that the embodiment of the present invention is described by taking a bank card (credit card) as an example, but the method of the embodiment of the present invention is not limited to bank cards, but can be used for any other cards, images and other objects related to character recognition.

[0070] Step S302: pre-process the bank card image to generate standard character training data.

[0071] Taking a bank card as an example, in this step, standard characters of the bank card are obtained through preprocessing.

[0072] Because the information that needs to be recognized on bank cards (credit cards) is generally concentrated in the card number, the original image information to be recognized needs to be preprocessed to generate a series of image slice units of uniform size. These units are used as standard character data to generate input data for the immune adversarial sample module.

[0073] In order to generate immune adversarial samples for training by inputting any characters, the following steps are required for preprocessing:

[0074] 1) Slice the character information in the real card information to form an image of a certain size, such as Figure 4a shown.

[0075] 2) Corresponding to the numbers in the real image, use image processing technology to generate characters of the same size as above as standard characters. Figure 4b As shown, the character string is "020".

[0076] 3) Combine the generated image and the cut real image to generate data input for training the immune adversarial sample module, which can be called a standard character sample. Figure 4c As shown, the left side is the generated character image, and the right side is the real character image. The characters in the image must be consistent. It should be noted that Figure 4c The combined images shown are merely examples and do not constitute a limitation to the embodiments.

[0077] Step S303: Use the generated standard character samples to train the immune confrontation model.

[0078] In this step, the standard character sample training data generated in step S302 is used to perform model training.

[0079] In one embodiment, the GAN technology can be used for model training. The trained GAN model can be called an immune adversarial model, which is used to generate immune adversarial samples. In one embodiment, the GAN model can use a pixel2pixel method.

[0080] Specifically, using the generator G (Generator) and the discriminator D (Discriminator):

[0081] (1) The purpose of the generator G is to deceive the discriminator, that is, to hope that the discriminator will treat its forged image as real. The input of the generator is x, and the output is its forged image G(x).

[0082] In one embodiment, the generator uses a U-net, that is, an end-to-end network with a symmetrical structure, such as Figure 5 shown.

[0083] (2) The purpose of the discriminator D is to correctly distinguish between real samples and forged samples.

[0084] In one implementation, in order to better judge the local part of the image, the pixel2pixel discrimination network adopts the PatchGAN structure, that is, the image is divided into multiple patches of fixed size, the authenticity of each patch is judged separately, and finally the average value is taken as the final output of the discrimination module.

[0085] Step S304: Generate immune adversarial samples via the immune adversarial model.

[0086] After training the immune adversarial model based on pixel2pixel, immune adversarial samples can be generated based on the input characters for subsequent training of the OCR recognition model to generate an enhanced OCR recognition model. Figure 6 shown.

[0087] Step S305: Use the immune adversarial sample training to strengthen the OCR model.

[0088] In this step, the robustness of the OCR model is improved by confusing the real data and the generated data for training. Continuing with the above example, the OCR model is trained by confusing the real data and the immune adversarial sample data generated in step S304. The trained and enhanced OCR model is used to identify adversarial sample attacks in practical applications.

[0089] Figure 7 It is a schematic diagram of the main process of the system for OCR recognition of adversarial sample attacks according to an embodiment of the present invention.

[0090] like Figure 7 The method flow shown starts from the "bank card (credit card) image preprocessing module". In this module, training data is generated, that is, the standard character training data output in step S302, as input data of the immune adversarial sample module. Corresponding to step S303, the immune adversarial sample module is used to train the immune adversarial model using the input standard character samples and generate immune adversarial samples.

[0091] Next, the generated immune adversarial sample data is combined with the real data, and the obfuscated data is used as the input data for training the OCR model. The trained OCR model has enhanced recognition performance and can identify adversarial sample attacks.

[0092] Figure 8 4 is a diagram of the main modules of an apparatus for OCR identifying sample attacks according to an embodiment of the present invention.

[0093] The main modules of the apparatus for OCR identifying sample attacks according to an embodiment of the present invention include:

[0094] An image preprocessing module 801 is used to preprocess a real image to generate standard character training data;

[0095] The immune countermeasure sample module 802 is used to:

[0096] Training the immune adversarial model using the generated standard character training data; and

[0097] Generating immune adversarial samples via the immune adversarial model;

[0098] The OCR module 803 is used to:

[0099] Using the immune adversarial sample to train an OCR model to strengthen the OCR model;

[0100] The enhanced OCR model is used to identify adversarial sample attacks.

[0101] The image preprocessing module 801 is also used for:

[0102] Slicing the real image;

[0103] Using image processing technology, generating a generated image corresponding to the characters in the real image;

[0104] The real image is combined with the generated image to generate a standard character sample.

[0105] Wherein, the real image is a bank card number image.

[0106] The step of combining the real image with the generated image to generate a standard character sample comprises:

[0107] Keep the characters in the real image and the generated image consistent.

[0108] The immune adversarial sample module 802 is trained using a GAN model.

[0109] The OCR module 803 is also used for:

[0110] The immune adversarial sample data is confused with real data, and the OCR model is trained using the confused training data.

[0111] It should be noted that the device embodiments of the present invention can implement any method in the method embodiments, which will not be described in detail here.

[0112] Fig. 9 An exemplary system architecture 900 is shown to which the OCR identification adversarial sample attack method or OCR identification adversarial sample attack apparatus according to an embodiment of the present invention may be applied.

[0113] like Fig. 9 As shown, system architecture 900 may include terminal devices 901, 902, 903, network 904 and server 905. Network 904 is used to provide a medium for communication links between terminal devices 901, 902, 903 and server 905. Network 904 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0114] Users can use terminal devices 901, 902, 903 to interact with server 905 through network 904 to receive or send messages, etc. Various client applications can be installed on terminal devices 901, 902, 903, such as OCR recognition applications, GAN model training applications, etc. (only examples).

[0115] The terminal devices 901 , 902 , and 903 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0116] The server 905 may be a server that provides various services, such as a background management server (only as an example) that provides support for OCR recognition applications browsed by users using the terminal devices 901, 902, and 903. The background management server may analyze and process the received data such as image recognition requests, and feed back the processing results to the terminal device.

[0117] It should be noted that the method for OCR identifying adversarial sample attacks provided in the embodiment of the present invention is generally executed by the server 905 , and accordingly, the device for OCR identifying adversarial sample attacks is generally set in the server 905 .

[0118] It should be understood that Fig. 9 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0119] Reference below Fig.10 , which shows a schematic diagram of the structure of a computer system 1000 of a terminal device suitable for implementing an embodiment of the present invention. Fig.10 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0120] like Fig.10 As shown, the computer system 1000 includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage part 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the system 1000 are also stored. The CPU 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0121] The following components are connected to the I / O interface 1005: an input section 1006 including a keyboard, a mouse, etc.; an output section 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, a modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that a computer program read therefrom is installed into the storage section 1008 as needed.

[0122] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the central processing unit (CPU) 1001, the above-mentioned functions defined in the system of the present invention are executed.

[0123] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0124] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0125] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be arranged in a processor, for example, may be described as: a processor includes an image preprocessing module, an immune adversarial sample module, and an OCR module. The names of these modules do not constitute a limitation on the modules themselves in certain cases, for example, the image preprocessing module may also be described as a "module for preprocessing real image data".

[0126] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device is used to:

[0127] Preprocess the real images to generate standard character training data;

[0128] Using the generated standard character training data to train the immune adversarial model;

[0129] Generating immune adversarial samples via the immune adversarial model;

[0130] Using the immune adversarial sample to train an OCR model to strengthen the OCR model;

[0131] The enhanced OCR model is used to identify adversarial sample attacks.

[0132] Wherein, the preprocessing of the image to generate standard character training data comprises:

[0133] Slicing the real image;

[0134] Using image processing technology, generating a generated image corresponding to the characters in the real image;

[0135] The real image is combined with the generated image to generate a standard character sample.

[0136] Wherein, the real image is a bank card number image.

[0137] The step of combining the real image with the generated image to generate a standard character sample comprises:

[0138] Keep the characters in the real image and the generated image consistent.

[0139] Wherein, the training immune confrontation model is trained using a GAN model.

[0140] The using the immune adversarial sample to train the OCR model to strengthen the OCR model includes:

[0141] The immune adversarial sample data is confused with real data, and the OCR model is trained using the confused training data.

[0142] It should be noted that the device embodiments of the present invention can implement any method in the method embodiments, which will not be described in detail here.

[0143] According to the technical solution of the embodiment of the present invention, by adopting a technical means that combines character sample training and immune adversarial sample training, the technical problem of OCR recognition model misidentifying adversarial samples is overcome, thereby achieving the technical effect of significantly improving immunity to adversarial sample attacks and preventing malicious attacks.

[0144] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for OCR recognition of adversarial sample attacks, characterized in that: include: Preprocess the real images to generate standard character training data; In the case where the real image is a bank card number image, the character information in the bank card number image is sliced ​​to form an image of a certain size, and corresponding to the numbers in the real image, an image of the same size as the image of the certain size is generated using image processing technology as a standard character; Combining the generated image and the cut real image as the standard character training data; Using the generated standard character training data to train an immune confrontation model; wherein the immune confrontation model is a trained GAN model; the GAN model adopts a pixel2pixel method; Generating immune adversarial samples via the immune adversarial model; Using the immune adversarial sample to train an OCR model to strengthen the OCR model; The enhanced OCR model is used to identify adversarial sample attacks.

2. The method according to claim 1, characterized in that: The preprocessing of the real image to generate standard character training data comprises: Slicing the real image; Using image processing technology, generating a generated image corresponding to the characters in the real image; The real image is combined with the generated image to generate a standard character sample.

3. The method according to claim 2, characterized in that Combining the real image with the generated image to generate a standard character sample comprises: Keep the characters in the real image and the generated image consistent.

4. The method according to claim 1, characterized in that The immune confrontation model is trained using a GAN model.

5. The method according to claim 1, characterized in that The using the immune adversarial sample to train the OCR model to strengthen the OCR model includes: The immune adversarial sample data is confused with real data, and the OCR model is trained using the confused training data.

6. A device for OCR recognition of adversarial sample attacks, characterized in that: include: An image preprocessing module, used for preprocessing real images to generate standard character training data; In the case where the real image is a bank card number image, the character information in the bank card number image is sliced ​​to form an image of a certain size, and corresponding to the numbers in the real image, an image of the same size as the image of the certain size is generated using image processing technology as a standard character; the generated image and the sliced ​​real image are combined as the standard character training data; The immune adversarial sample module is used to: Training the immune adversarial model using the generated standard character training data; and Generate immune adversarial samples via the immune adversarial model; wherein the immune adversarial model is a trained GAN model; the GAN model adopts a pixel2pixel method; OCR module for: Using the immune adversarial sample to train an OCR model to strengthen the OCR model; The enhanced OCR model is used to identify adversarial sample attacks.

7. The device according to claim 6, characterized in that The image preprocessing module is also used for: Slicing the real image; Using image processing technology, generating a generated image corresponding to the characters in the real image; The real image is combined with the generated image to generate a standard character sample.

8. The device according to claim 7, characterized in that Combining the real image with the generated image to generate a standard character sample comprises: Keep the characters in the real image and the generated image consistent.

9. The device according to claim 6, characterized in that The immune adversarial sample module is trained using a GAN model.

10. The device according to claim 6, characterized in that The OCR module is also used to: The immune adversarial sample data is confused with real data, and the OCR model is trained using the confused training data.

11. An electronic device for OCR recognition against sample attacks, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

12. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images