Image processing method, device, computer equipment and storage medium

Abstract

The present application relates to an image processing method, device, computer equipment and storage medium. The method includes: obtaining a target image of a target image category and a current adversarial image corresponding to an adversarial image category; performing feature extraction on the target image to obtain a target extracted feature, and obtaining a reference extracted feature based on the target extracted feature; performing feature extraction on the current adversarial image to obtain an adversarial extracted feature; calculating a feature difference value between the adversarial extracted feature and the reference extracted feature, and obtaining a target image loss value based on the feature difference value; obtaining an interference adjustment value based on the target image loss value, and adjusting the pixel value of the current adversarial image based on the interference adjustment value to obtain a target adversarial image corresponding to the target image. This method can improve the adversarial effect of adversarial samples. The image recognition model in the present application can be a neural network model based on artificial intelligence. The present solution is applied to the field of artificial intelligence to improve the reliability of the neural network model.

Description

Technical Field

[0001] The present application relates to the field of image recognition technology, and in particular to an image processing method, apparatus, computer equipment and storage medium. Background Art

[0002] With the development of artificial intelligence technology, adversarial images have been widely used in various fields. Adversarial images refer to images formed by deliberately adding subtle interference to the image, which causes the recognition model to give an incorrect output with high confidence.

[0003] Adversarial images can be applied to model training to improve the model's ability to withstand attacks, and can also be used to encrypt images. For example, in the process of using a neural network model, there are cases where the neural network model is subjected to malicious attacks. The attacker can input offensive images into the neural network model, causing the neural network model to output incorrect results. In order to prevent the neural network model from being maliciously attacked, it is necessary to improve the reliability of the neural network model. For example, adversarial samples can be input into the neural network model for training, thereby improving the ability of the neural network model to identify attack samples and improving the robustness of the neural network model. However, there are currently cases where the adversarial effect of the adversarial samples obtained is relatively poor. Summary of the invention

[0004] Based on this, it is necessary to provide an image processing method, device, computer equipment and storage medium that can improve the adversarial effect of adversarial samples in response to the above technical problems.

[0005] An image processing method, the method comprising: obtaining a target image of a target image category and a current adversarial image corresponding to an adversarial image category; performing feature extraction on the target image to obtain a target extraction feature, and obtaining a reference extraction feature based on the target extraction feature; performing feature extraction on the current adversarial image to obtain an adversarial extraction feature; calculating a feature difference value between the adversarial extraction feature and the reference extraction feature, and obtaining a target image loss value based on the feature difference value; the feature difference value is positively correlated with the target image loss value; obtaining an interference adjustment value based on the target image loss value, and adjusting the pixel value of the current adversarial image based on the interference adjustment value to obtain a target adversarial image corresponding to the target image.

[0006] An image processing device, the device comprising: a current adversarial image acquisition module, used to acquire a target image of a target image category and a current adversarial image corresponding to the adversarial image category; a reference extraction feature acquisition module, used to perform feature extraction on the target image to obtain a target extraction feature, and obtain a reference extraction feature based on the target extraction feature; an adversarial extraction feature acquisition module, used to perform feature extraction on the current adversarial image to obtain an adversarial extraction feature; a target image loss value acquisition module, used to calculate a feature difference value between the adversarial extraction feature and the reference extraction feature, and obtain a target image loss value based on the feature difference value; the feature difference value is positively correlated with the target image loss value; a target adversarial image acquisition module, used to obtain an interference adjustment value based on the target image loss value, and adjust the pixel value of the current adversarial image based on the interference adjustment value to obtain a target adversarial image corresponding to the target image.

[0007] In some embodiments, there are multiple target images, and the reference extraction feature acquisition module includes: a target extraction feature acquisition unit, which is used to extract features from each of the target images to obtain target extraction features corresponding to each of the target images; a current occurrence possibility calculation unit, which is used to obtain the current feature distribution and calculate the current occurrence possibility of each of the target extraction features in the current feature distribution; a target feature distribution acquisition unit, which is used to count the current occurrence possibilities corresponding to each of the target extraction features to obtain the current possibility statistics, adjust the feature distribution parameters corresponding to the current feature distribution so that the current possibility statistics change in a larger direction to obtain the target feature distribution; and a reference extraction feature acquisition unit, which is used to obtain the target representative feature corresponding to the target feature distribution to obtain the reference extraction feature.

[0008] In some embodiments, the current feature distribution includes a first current feature distribution and a second current feature distribution, and the current occurrence possibility includes a first current occurrence possibility corresponding to the first current feature distribution and a second current occurrence possibility corresponding to the second current feature distribution; the target feature distribution obtaining unit is also used to obtain a first current distribution weight corresponding to the first current feature distribution and a second current distribution weight corresponding to the second current feature distribution; based on the first current distribution weight and the first current occurrence possibility, the second current distribution weight and the second current occurrence possibility are weightedly summed to obtain the current occurrence possibility corresponding to the target extraction feature; the current occurrence possibility corresponding to each of the target extraction features is counted to obtain a current possibility statistical value, and the distribution parameters corresponding to the first current feature distribution and the second current feature distribution, the first current distribution weight and the second current distribution weight are adjusted to make the current possibility statistical value change in a larger direction to obtain the first target feature distribution, the second target feature distribution, the first target distribution weight and the second target distribution weight.

[0009] In some embodiments, the reference extraction feature obtaining unit is also used to determine the first target occurrence possibility of the adversarial extraction feature in the first target feature distribution, and obtain a first weighted possibility based on the first target distribution weight and the first target occurrence possibility; determine the second target occurrence possibility of the adversarial extraction feature in the second target feature distribution, and obtain a second weighted possibility based on the second target distribution weight and the second target occurrence possibility; based on the first weighted possibility and the second weighted possibility, select the feature distribution with the largest possibility from the first target feature distribution and the second target feature distribution as the representative feature distribution; obtain the target representative feature corresponding to the representative feature distribution as the reference extraction feature.

[0010] In some embodiments, the target image loss value obtaining module includes: a first image loss value obtaining unit, used to obtain a first image loss value based on the feature difference value, and the feature difference value is positively correlated with the first image loss value; a first confidence determination unit, used to determine the first confidence of the current adversarial image in the target image category based on the adversarial extraction feature; a second image loss value obtaining unit, used to obtain a second image loss value based on the first confidence; the second image loss value is negatively correlated with the first confidence; a target image loss value obtaining unit, used to obtain a target image loss value based on the first image loss value and the second image loss value.

[0011] In some embodiments, the second image loss value obtaining unit is also used to determine a second confidence of the current adversarial image in the adversarial image category based on the adversarial extraction feature; based on a first confidence difference value between the first confidence and the second confidence, obtain the second image loss value; the second image loss value is negatively correlated with the first confidence difference value.

[0012] In some embodiments, the target image loss value obtaining module includes: a first image loss value obtaining unit, used to obtain a first image loss value based on the feature difference value, and the feature difference value is positively correlated with the first image loss value; a reference confidence determination unit, used to determine the reference confidence of the current adversarial image in each reference image category based on the adversarial extraction feature; a third confidence obtaining unit, used to select the maximum confidence from each reference confidence as the third confidence; a third image loss value obtaining unit, used to obtain a third image loss value based on a second confidence difference value between the first confidence and the third confidence; the third image loss value is negatively correlated with the second confidence difference value; a target image loss value obtaining unit, used to obtain a target image loss value based on the first image loss value and the third image loss value.

[0013] In some embodiments, the target adversarial image obtaining module includes: an updated current adversarial image obtaining unit, which is used to adjust the pixel value of the current adversarial image based on the interference adjustment value when the second confidence difference value is less than the confidence difference threshold, so as to obtain an updated current adversarial image; a target adversarial image obtaining unit, which is used to return to the step of extracting features from the current adversarial image to obtain adversarial extracted features, until the second confidence difference value reaches the confidence difference threshold, and the current adversarial image is used as the target adversarial image corresponding to the target image.

[0014] In some embodiments, the target adversarial image obtaining module includes: an updated current adversarial image obtaining unit, used to adjust the pixel value of the current adversarial image based on the interference adjustment value to obtain an updated current adversarial image; a target adversarial image acquisition unit, used to calculate the current image difference value between the updated current adversarial image and the original adversarial image corresponding to the current adversarial image, when the current image difference value is less than the image difference threshold, return to the step of extracting features from the current adversarial image to obtain adversarial extraction features, until the current image difference value reaches the image difference threshold, and the current adversarial image is used as the target adversarial image corresponding to the target image.

[0015] In some embodiments, the interference adjustment value includes pixel adjustment values ​​corresponding to each pixel point, and the target adversarial image obtaining module includes: a pixel adjustment value obtaining unit, which is used to derive the target image loss value based on the pixel values ​​of each pixel point of the current adversarial image to obtain the pixel adjustment values ​​corresponding to each pixel point in the current adversarial image; a pixel value adjustment unit, which is used to adjust the pixel values ​​of the pixel points in the current adversarial image based on the pixel adjustment values ​​corresponding to each pixel point to obtain the target adversarial image corresponding to the target image.

[0016] In some embodiments, the device also includes: an adversarial confidence obtaining module, used to input the target adversarial image into the image recognition model to be trained corresponding to the target image category, and obtain the adversarial confidence of the target adversarial image corresponding to the target image category; a target model loss value determination module, used to determine the target model loss value based on the adversarial confidence; the target model loss value is positively correlated with the adversarial confidence; a trained image recognition model obtaining module, used to adjust the model parameters of the image recognition model based on the target model loss value to obtain a trained image recognition model.

[0017] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned image processing method when executing the computer program.

[0018] A computer-readable storage medium stores a computer program, which implements the steps of the above-mentioned image processing method when executed by a processor.

[0019] In some embodiments, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in the above-mentioned method embodiments.

[0020] The above-mentioned image processing method, device, computer equipment and storage medium obtain a target image of a target image category and a current adversarial image corresponding to an adversarial image category, perform feature extraction on the target image to obtain a target extracted feature, obtain a reference extracted feature based on the target extracted feature, perform feature extraction on the current adversarial image to obtain an adversarial extracted feature, calculate a feature difference value between the adversarial extracted feature and the reference extracted feature, obtain a target image loss value based on the feature difference value, the feature difference value is positively correlated with the target image loss value, obtain an interference adjustment value based on the target image loss value, adjust the pixel value of the current adversarial image based on the interference adjustment value, and obtain a target adversarial image corresponding to the target image. Since the reference extracted feature is obtained according to the target extracted feature, the reference extracted feature can reflect the feature of the image of the target image category, so that the feature difference value can reflect the difference between the feature of the adversarial extracted feature and the feature of the image of the target image category, and the target image loss value is positively correlated with the feature difference value, so that when the interference adjustment value is adjusted in the direction of reducing the target image loss value, the feature difference value corresponding to the current adversarial image can be adjusted in the direction of decreasing, thereby improving the similarity in features between the target adversarial image and the image of the target image category, and improving the adversarial effect of the adversarial sample. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1A A diagram showing an application environment of an image processing method in some embodiments;

[0022] Figure 1B A diagram showing an application environment of an image processing method in some embodiments;

[0023] Figure 2 is a schematic flow chart of an image processing method in some embodiments;

[0024] Figure 3A is a distribution diagram of samples in feature space in some embodiments;

[0025] Figure 3B A schematic diagram of an interface for triggering an image recognition request and displaying an image recognition result in some implementations;

[0026] Figure 4 A schematic flow chart of steps for obtaining reference extraction features in some embodiments;

[0027] Figure 5 A schematic flow chart of steps for obtaining reference extraction features in some embodiments;

[0028] Figure 6 is a schematic diagram of an adversarial image in some embodiments;

[0029] Figure 7 is a schematic flow chart of an image processing method in some embodiments;

[0030] Figure 8 is a structural block diagram of an image processing device in some embodiments;

[0031] Fig. 9 1 is a diagram of the internal structure of a computer device in some embodiments. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0033] Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0034] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0035] Machine Learning (ML) is a multi-disciplinary subject that involves probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and self-learning.

[0036] With the research and advancement of artificial intelligence technology, artificial intelligence technology has been studied and applied in many fields, such as common smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, unmanned driving, automatic driving, drones, robots, smart medical care, smart customer service, etc. I believe that with the development of technology, artificial intelligence technology will be applied in more fields and play an increasingly important role.

[0037] The solution provided in the embodiments of the present application involves technologies such as artificial neural networks of artificial intelligence, which are specifically described by the following embodiments:

[0038] The image processing method provided in this application can be applied to Figure 1A In the application environment shown, the terminal 102 communicates with the server 104 through a network.

[0039] The terminal 102 can transmit the acquired image to the server 104. For example, the terminal 102 can perform image acquisition and transmit the acquired image to the server 104. The terminal 102 can also communicate with the image acquisition device, receive the image acquired by the image acquisition device, and forward it to the server 104. The server 104 can receive the image sent by the terminal 102, obtain the target image of the target image category and the current adversarial image corresponding to the adversarial image category from the received image, perform feature extraction on the target image to obtain the target extracted feature, obtain the reference extracted feature based on the target extracted feature, perform feature extraction on the current adversarial image to obtain the adversarial extracted feature, calculate the feature difference value between the adversarial extracted feature and the reference extracted feature, obtain the target image loss value based on the feature difference value, the feature difference value is positively correlated with the target image loss value, obtain the interference adjustment value based on the target image loss value, adjust the pixel value of the current adversarial image based on the interference adjustment value, and obtain the target adversarial image corresponding to the target image. The server 104 can use the target adversarial image as an adversarial sample, use the target adversarial image to perform adversarial training on the image recognition model corresponding to the target image category, obtain the trained image recognition model, and use the trained image recognition model to perform image recognition. The image recognition model corresponding to the target image category is used to recognize images of the target image category, and can also recognize images of other categories. It is a trained model. For example, the server 104 can use images of the target image category to train the initial image recognition model until the model converges to obtain a pre-trained image recognition model, that is, the pre-trained image recognition model refers to a model that has been pre-trained using ordinary samples, and needs to be further trained using adversarial samples. The pre-trained image recognition model can be used as the image recognition model corresponding to the target image category, and the pre-trained image recognition model can be adversarially trained using the target adversarial images to improve the recognition ability and robustness of the pre-trained image recognition model to adversarial samples. Among them, the initial image recognition model can be based on a convolutional neural network, and can also be based on a ResNet (Residual Neural Network) network, for example, it can be ResNet50.

[0040] The terminal 102 may be, but is not limited to, various personal computers, laptop computers, smart phones, tablet computers, portable wearable devices, and may also be an image acquisition device. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0041] In some embodiments, Figure 1BAs shown, it is an application scenario diagram of the image processing method provided in some embodiments. A trained image recognition model is deployed in the cloud server 108. The front end A106 can send an image recognition request corresponding to the image to be recognized to the cloud server 108. The cloud server 108 can obtain the image to be recognized according to the image recognition request, and use the image processing method provided in this application to perform image processing on the image to be recognized to obtain an image recognition result. The cloud server 108 can send the image recognition result to the front end B110. The front end B110 can be, for example, a computer or a mobile phone, and the front end A106 can be an image acquisition device. It can be understood that the front end A106 and the front end B110 can be the same device or different devices.

[0042] In some embodiments, Figure 2 As shown, an image processing method is provided, which is applied to Figure 1A Taking the server 104 in the example as an example, the following steps are included:

[0043] S202, obtaining a target image of a target image category and a current adversarial image corresponding to an adversarial image category.

[0044] The image category refers to the category to which the image belongs, which can be obtained based on the image information, for example, based on the objects included in the image. For example, when the image includes a kitten, it can be determined that the image belongs to a cat, and when the image includes a puppy, it can be determined that the image belongs to a dog. The target image category can be any image category, for example, it can be a cat. The adversarial image category is an image category different from the target image category, for example, it can be a dog.

[0045] The category of the image can be determined according to the pre-trained image recognition model that needs adversarial training. When the pre-trained image recognition model is a model for identifying adversarial in the image, the category of the image can be determined according to the objects included in the image. The objects in the image can be inanimate objects or animate objects. Inanimate objects can be furniture, such as tables or chairs. Animated objects can be, for example, plants, bacteria, animals, or components of the human body. The components of the human body can be, for example, lungs, hearts, or fundus of the human body. For example, when the pre-trained image recognition model is a model for identifying "cats", the image category of "cats" can be used as the target image category, and the image of "cats" can be used as the target image. When the recognition ability of the pre-trained image recognition model for adversarial samples obtained from "dog" images is to be improved, the adversarial image category can be set to "dog", and the image of "dog" can be used as the current adversarial image, or the image of "dog" can be adjusted to obtain the current adversarial image. For example, when the pre-trained image recognition model is a model for identifying components of the human body, such as a model for identifying lungs, the category of images including "lungs" can be used as the target image category, and the lung image can be obtained to obtain the target image corresponding to the target image category.

[0046] The target image refers to an image belonging to the target image category, that is, the real image category of the target image is the target image category. The current adversarial image can be an original adversarial image that has not been adjusted, or it can be an image obtained by performing one or more interference adjustments on the original adversarial image using the method provided in the embodiment of the present application, and the original adversarial image has not been adjusted and belongs to the adversarial image category. The target image and the original adversarial image can be real images directly captured by the image acquisition device.

[0047] Specifically, the server can obtain an original adversarial image of the adversarial image category, and can use the original adversarial image as the current adversarial image, or perturb the original adversarial image, such as modifying the pixel value of the original adversarial image or superimposing noise on the original adversarial image, and use the perturbed image as the current adversarial image.

[0048] In some embodiments, the terminal can send an adversarial training request to the server, which can carry the model to be adversarially trained and the adversarial image category. The server can obtain an image of the adversarial image category, obtain the current adversarial image based on the image of the adversarial image category, and the server can determine the image category used to identify the model to be adversarially trained as the target image category.

[0049] S204, extracting features from the target image to obtain target extracted features, and obtaining reference extracted features based on the target extracted features.

[0050] The target extraction feature is a feature obtained by extracting features from the target image. The reference extraction feature is a feature obtained based on the target extraction feature. For example, the reference extraction feature can be the target extraction feature. When there are multiple target images, the reference extraction feature can also be a feature obtained by statistical calculation of the target extraction features corresponding to each target image. Statistical calculation includes but is not limited to mean calculation or covariance calculation.

[0051] Specifically, the server may utilize an artificial intelligence-based neural network model to perform feature extraction on the target image to obtain target extraction features. For example, the server may utilize a pre-trained image recognition model to perform feature extraction on the target image to obtain target extraction features.

[0052] In some embodiments, the server may use a pre-trained image recognition model to perform feature extraction on the current adversarial image to obtain adversarial extraction features, and determine reference extraction features based on the adversarial extraction features. The reference extraction features corresponding to different adversarial extraction features may be the same or different. For example, the server may determine the reference extraction features corresponding to the adversarial extraction features based on the differences between the adversarial extraction features and each target extraction feature. For example, the target extraction feature with the smallest difference from the adversarial extraction feature may be used as the reference extraction feature.

[0053] In some embodiments, the server may obtain target extraction features corresponding to multiple target images, perform statistics on each target extraction feature, determine the target feature distribution satisfied by each target extraction feature, and determine the reference extraction feature corresponding to the adversarial extraction feature based on the target feature distribution. For example, the server may use a representative feature corresponding to the target feature distribution as a reference extraction feature, for example, the feature with the highest probability of appearing in the target feature distribution may be used as a reference extraction feature, for example, when the target feature distribution is a Gaussian distribution, the mean of the target feature distribution may be used as a reference extraction feature.

[0054] S206, performing feature extraction on the current adversarial image to obtain adversarial extracted features.

[0055] Specifically, the adversarial extracted features are features obtained by extracting features from the current adversarial image. The manner of extracting features from the current adversarial image may be the same as the manner of extracting features from the target image. For example, the adversarial extracted features and the target extracted features may be the results of the output of the same feature extraction layer of a pre-trained image recognition model. The feature extraction layer is used to extract features and may include at least one of a linear feature extraction layer and a nonlinear feature extraction layer. The nonlinear feature extraction layer may be, for example, an activation layer.

[0056] In some embodiments, the pre-trained image recognition model includes multiple feature extraction layers. The server can input the target image into the pre-trained image recognition model to obtain target extraction features output by at least two feature extraction layers respectively, input the current adversarial image into the pre-trained image recognition model to obtain adversarial extraction features distributedly output by each feature extraction layer, and determine the reference extraction features corresponding to the adversarial extraction features output by the feature extraction layer based on the target extraction features and adversarial extraction features output by the same feature extraction layer.

[0057] In some embodiments, the server may input the target image into a pre-trained image recognition model, obtain the features output by the non-linear extraction layer of the pre-trained image recognition model, obtain the target extraction features corresponding to the target image, input the current adversarial image into the pre-trained image recognition model, obtain the features output by the non-linear extraction layer, and obtain the adversarial extraction features. There may be one or more non-linear extraction layers. Multiple refers to at least two.

[0058] S208, calculating the feature difference value between the adversarial extracted feature and the reference extracted feature, and obtaining the target image loss value based on the feature difference value; the feature difference value is positively correlated with the target image loss value.

[0059] Specifically, the feature difference value refers to the difference between the adversarial extracted feature and the reference extracted feature. The server can calculate the distance between the adversarial extracted feature and the reference extracted feature as the feature difference value, for example, the Euclidean distance between the adversarial extracted feature and the reference extracted feature can be calculated to obtain the feature difference value. The server can also calculate the similarity between the adversarial extracted feature and the reference extracted feature to obtain the feature similarity, and determine the feature difference value based on the feature similarity. The feature difference value is negatively correlated with the feature similarity. For example, the opposite or reciprocal of the feature similarity can be used as the feature difference value.

[0060] In some embodiments, the server may obtain the target extraction features, adversarial extraction features, and reference extraction features determined according to the target extraction features output by the preset feature extraction layer of the pre-trained image recognition model, calculate the feature difference value between the adversarial extraction features and the reference extraction features, perform a transposition operation on the feature difference value to obtain a transposed difference value, and obtain a layer image loss value based on the feature difference value and the transposed difference value, and the layer image loss value is positively correlated with the transposed difference value. For example, when the reference extraction feature is the mean of the Gaussian distribution corresponding to the target feature distribution, the server may perform a multiplication operation on the transposed difference value and the covariance matrix of the Gaussian distribution to obtain a first operation result, perform a multiplication operation on the first operation result and the feature difference value to obtain a layer image loss value corresponding to the preset feature extraction layer, obtain a target image loss value based on the image loss value, and the target image loss value is positively correlated with the image loss value. For example, there may be multiple preset feature extraction layers, and the server may obtain the layer image loss values ​​corresponding to each preset extraction layer, perform a weighted calculation on each layer image loss value, and obtain the target image loss value.

[0061] Positive correlation means that when other conditions remain unchanged, the two variables change in the same direction. When one variable changes from large to small, the other variable also changes from large to small. It can be understood that the positive correlation here means that the direction of change is consistent, but it does not require that when one variable changes a little, the other variable must also change. For example, when variable a is 10 to 20, variable b can be set to 100, and when variable a is 20 to 30, variable b can be set to 120. In this way, the direction of change of a and b is that when a increases, b also increases. But when a is in the range of 10 to 20, b can be unchanged.

[0062] In some embodiments, the server may obtain the adversarial recognition result of the current adversarial image output by the pre-trained image recognition model, and the adversarial recognition result may include the confidence that the current adversarial image belongs to the target image category. Based on the confidence that the current adversarial image belongs to the target image category, a second image loss value is obtained, and the second image loss value is negatively correlated with the confidence that the current adversarial image belongs to the target image category. The server may obtain the target image loss value based on the first image loss value and the second image loss value. Among them, the confidence is used to indicate the possibility that the image belongs to each image category. The greater the confidence, the greater the possibility. The confidence value range may be 0 to 1.

[0063] Negative correlation means that when other conditions remain unchanged, the two variables change in opposite directions. When one variable changes from large to small, the other variable changes from small to large. It can be understood that the negative correlation here means that the direction of change is opposite, but it does not require that when one variable changes a little, the other variable must also change.

[0064] S210, obtaining an interference adjustment value based on the target image loss value, adjusting the pixel value of the current adversarial image based on the interference adjustment value, and obtaining a target adversarial image corresponding to the target image.

[0065] The interference adjustment value is used to adjust the pixel value of the pixel in the current adversarial image, and may include the interference adjustment values ​​corresponding to each pixel in the current adversarial image, for the pixel in the current adversarial image. The image recognition model corresponding to the target image category refers to a model used to recognize images of the target image category, which is a pre-trained image recognition model that has been trained. Of course, the image recognition model corresponding to the target image category can also recognize images of image categories other than the target image category.

[0066] The target adversarial image is an image obtained by adjusting the pixel values ​​of the current adversarial image. The target adversarial image can be used as an adversarial sample. An adversarial sample is a sample that has undergone an adversarial attack. An adversarial attack refers to adding small perturbations to normal samples to make the model based on the deep neural network (DNN) produce incorrect results. A normal sample refers to normal data that has not undergone an adversarial attack, such as an image collected by an image acquisition device.

[0067] Adversarial training is an important way to enhance the robustness of neural networks. During adversarial training, samples are mixed with some tiny perturbations (small changes, but likely to cause misclassification). The purpose of adversarial training is to make the neural network adapt to such changes, thereby making it robust to adversarial samples.

[0068] Specifically, the server calculates the derivative of the loss value of the target image relative to the current adversarial image to obtain the interference adjustment value corresponding to each pixel in the current adversarial image. Different pixels may have different corresponding interference adjustment values. For a pixel in the current adversarial image, the server may calculate the result of adding the pixel value of the pixel and the corresponding interference adjustment value, or the result of multiplying them, to obtain the adjusted pixel value corresponding to the pixel, and obtain the target adversarial image according to the current adversarial image after adjusting the pixel value. The current adversarial image after adjusting the pixel value may be used as the target adversarial image, or the pixel value of the current adversarial image after adjusting the pixel value may be adjusted until the pixel value adjustment end condition is met, and the current adversarial image that meets the pixel value adjustment end condition is used as the target adversarial image. The pixel value adjustment end condition includes but is not limited to the change in the target image loss value being less than the loss value change threshold, and the difference between the adjusted current adversarial image and the original adversarial image corresponding to the current adversarial image reaching the image difference threshold.

[0069] In some embodiments, after obtaining the target adversarial image, the target adversarial image can be used to perform adversarial training on the image recognition model corresponding to the target image category, so as to use the trained image recognition model for image recognition. For example, the server can use the target adversarial image as a negative sample to perform adversarial training on the image recognition model corresponding to the target image category, that is, perform adversarial training on the pre-trained image recognition model, thereby improving the robustness of the image recognition model to adversarial samples. Specifically, the server can first use normal samples to train the untrained image recognition model to obtain a pre-trained image recognition model, and then combine normal samples and adversarial samples to train the pre-trained image recognition model to obtain a trained image recognition model.

[0070] In the above-mentioned image processing method, a target image of a target image category and a current adversarial image corresponding to an adversarial image category are obtained, feature extraction is performed on the target image to obtain a target extracted feature, a reference extracted feature is obtained based on the target extracted feature, feature extraction is performed on the current adversarial image to obtain an adversarial extracted feature, a feature difference value between the adversarial extracted feature and the reference extracted feature is calculated, a target image loss value is obtained based on the feature difference value, the feature difference value is positively correlated with the target image loss value, an interference adjustment value is obtained based on the target image loss value, the pixel value of the current adversarial image is adjusted based on the interference adjustment value, and a target adversarial image corresponding to the target image is obtained, so as to use the target adversarial image to perform adversarial training on an image recognition model corresponding to the target image category, so as to use the trained image recognition model to perform image recognition. Since the reference extracted features are obtained based on the target extracted features, the reference extracted features can reflect the features of the target image category, so the feature difference value can reflect the difference between the adversarial extracted features and the features of the target image category, and the target image loss value is positively correlated with the feature difference value, so when the interference adjustment value is adjusted in the direction of reducing the target image loss value, the feature difference value corresponding to the current adversarial image can be adjusted in the direction of decreasing, thereby improving the similarity in features between the target adversarial image and the target image category, and improving the adversarial effect. When the target adversarial image is used to train the model, the robustness and reliability of the model can be improved.

[0071] The image processing method provided in the present application can constrain the features output by the feature extraction layer of the image recognition model, which can be called a hierarchical feature constraint (HFC) method. The adversarial samples generated based on the image processing method provided in this embodiment can be used to train the detection defense model, improve the defense performance of the detection defense model, improve the robustness of the detection defense model, and improve the security of data encryption. The detection defense model is used to detect adversarial samples and improve data security. The adversarial samples generated by the image processing method provided in the present application can be applied to medical data security management and can improve the effectiveness of data security management.

[0072] Figure 3A The distribution of features of adversarial samples generated by the image processing method provided by this application is shown. Figure 3A In the figure, the sample is input into the network model ResNet50, and the features of the 34th, 42nd and 48th layers of the network model ResNet50 are output. Figure 3A It can be seen that the feature distribution of the adversarial samples generated by the image processing method provided by this application is fitted to the feature distribution of the normal samples of the target image category, so that the adversarial samples can be hidden in the feature distribution of the normal samples of the target image category. In the feature space, the distribution of the adversarial samples generated by the BIM (Basic Iterative Method) adversarial attack method is easier to distinguish from the distribution of the normal samples of the target image category.

[0073] Table 1 shows the detection performance of the detection defense method when using traditional adversarial samples and new adversarial samples for adversarial attacks, where traditional adversarial samples refer to adversarial samples generated by traditional adversarial attack methods, and new adversarial samples refer to adversarial samples generated by the image processing method provided in this application. In Table 1, the fundus examination dataset in the classification competition of diabetic retinopathy (DR) on Kaggle includes 3663 high-resolution fundus images. Each image is labeled as one of the five levels of "no DR / mild / moderate / severe / diffuse DR". A binary classification experiment was performed on the fundus examination dataset, and cases with diabetic retinopathy were regarded as the same class. The Kaggle chest X-ray dataset is a dataset for pneumonia classification tasks, which includes 5863 X-ray images labeled "pneumonia" or "normal".

[0074] In Table 1, MIM, BIM, PGD and CW are four traditional adversarial attack methods, among which MIM (Momentum Iterative Method) refers to the gradient-based iterative attack algorithm, BIM (Basic Iterative Method) refers to the iterative FGSM algorithm, FGSM (Fast Gradient Sign Method) refers to the fast gradient descent method, PGD (Projected Gradient Descent) refers to the projected gradient descent algorithm, CW (Carlini and Wagner) is an attack based on optimization, Carlini and Wagner are the names of the authors of CW, C refers to the first letter of Carlini, and W refers to the first letter of Wagner. KD, MAHA, LID, SVM, DNN and BU are six detection and defense methods, among which KD, MAHA and LID are based on the distance measurement method of high-dimensional feature space, and SVM and DNN are based on machine learning methods. KD (Kernel Density) refers to kernel density detection, MAHA (Mahalanois-distance) refers to Mahalanois distance, LID (Local Intrinsic Dimensionality) refers to local intrinsic dimension, SVM (Support Vector Machine) refers to support vector machine, DNN (Deep Neural Network) refers to deep neural network, and BU (Bayesian uncertainty) refers to Bayesian uncertainty estimates.

[0075] Table 1 Detection performance of the detection and defense methods when using traditional adversarial samples and new adversarial samples for adversarial attacks

[0076]

[0077] In Table 1, Adv.Acc is the attack success rate when using new adversarial samples for adversarial attacks. For example, when the detection and defense method is KD, the data set is a fundus data set, and the adversarial attack method is MIM, the attack success rate is 99.5, and when the detection and defense method is KD, the data set is a chest X-ray data set, and the adversarial attack method is MIM, the attack success rate is 98.1.

[0078] In Table 1, AUC and TPR are used to represent the detection performance of the detection and defense method against the attack method. AUC (Area under Curve) refers to the area under the Roc (receiveroperating characteristic) curve, which is between 0.1 and 1. AUC can intuitively reflect the detection performance of the detection and defense method. The larger the AUC, the better the detection performance of the detection and defense method. TPR (true positive rate) refers to the true positive rate, which refers to the proportion of adversarial samples identified by the detection and defense method to all adversarial samples. The larger the TPR, the better the detection performance of the detection and defense method. a (i.e., the value on the left of the "\") in "a\b" represents the detection performance of the detection and defense method when using traditional adversarial samples for adversarial attacks, and b (the value on the right of the "\") represents the detection performance of the detection and defense method when combining new adversarial samples with traditional adversarial samples for adversarial attacks. For a and b in "a\b", the data set used to obtain a is the same as the data set used to obtain b, and the detection and defense method used to obtain a is the same as the detection and defense method used to obtain b. It can be seen from Table 1 that regardless of whether the data set is a fundus data set or a chest X-ray data set, for AUC and TPR, the value on the left of the “\” symbol is greater than the value on the right of the “\” symbol, that is, the detection performance of the detection defense method for traditional adversarial samples is greater than the detection performance of the detection defense method for traditional adversarial samples combined with new adversarial samples. This clearly shows that the detection ability of the detection defense method for the adversarial samples generated by the image processing method of the present application is weak, thereby proving that the adversarial effect of the adversarial samples generated by the image processing method provided by the present application is greater than the attack effect of the adversarial samples generated by the traditional adversarial attack method.

[0079] For example, in the detection performance corresponding to the fundus dataset in Table 1, 98.8 in "98.8 / 72.0" means the AUC corresponding to the detection defense method when the traditional adversarial sample generated by the traditional adversarial attack method MIM attacks the detection defense method KD, and 72.0 in "98.8 / 72.0" means the AUC corresponding to the detection defense method when the traditional adversarial sample generated by the traditional adversarial attack method MIM and the new adversarial sample attack the detection defense method KD, and 98.8 is greater than 72.0. For another example, 96.3 in "96.3 / 10.0" means the TPR corresponding to the detection defense method when the traditional adversarial sample generated by the traditional adversarial attack method MIM attacks the detection defense method KD, and 10.0 means the TPR corresponding to the detection defense method when the traditional adversarial sample generated by the traditional adversarial attack method MIM and the new adversarial sample attack the detection defense method KD, and 96.3 is greater than 10.0. This shows that combining the adversarial samples generated by the traditional adversarial attack method MIM with the adversarial samples generated by the image processing method extracted in this application can reduce the detection performance of the detection defense method KD, thereby proving that the adversarial effect of the adversarial samples generated by the image processing method of this application is greater than the adversarial effect of the adversarial samples generated by the adversarial attack method MIM.

[0080] The adversarial samples generated by the image processing method provided in this application can be used to train the detection and defense method, so that the detection and defense method can correctly identify the adversarial samples, improve the detection and defense method's detection ability for adversarial samples, and improve the robustness of the detection and defense method to adversarial samples.

[0081] The image processing method provided in this embodiment can be applied to the field of medical image analysis, can be used to train detection and defense models in the field of medical image analysis to improve the robustness of the detection and defense models, and can also be used to encrypt medical data. By interfering with images that are inseparable from the human eye, a classifier based on a deep neural network produces erroneous results, thereby achieving the purpose of data encryption.

[0082] The image processing method provided in this embodiment can also be applied to the field of traffic sign recognition. For example, the image recognition model in this application can be a traffic sign classification model. The traffic sign classification model is used to recognize traffic signs. The method provided in this application can be used to generate adversarial samples of the traffic sign classification model, and the adversarial samples can be used to train the traffic sign classification model to improve the robustness of the traffic sign classification model to adversarial samples.

[0083] In some embodiments, the terminal may send an image recognition request to the server, and the image recognition request may carry the image to be recognized. The server may use the trained image recognition model to recognize the image to be recognized, obtain the image recognition result corresponding to the image to be recognized, and return the image recognition result to the terminal. The terminal may display the image recognition result in the interface. Figure 3B As shown, a schematic diagram of the interface for triggering image recognition requests and displaying image recognition results in some implementations is shown. The interface includes an image upload area 302, a judgment result display area 304, and a probability display area 306. "Xx business classifier" is the business name of the image recognition business. When the user needs to recognize an image, he can click the "Upload" button to enter the image upload interface to select an image. When the image selection is completed and the confirmation operation is received, the terminal can trigger the image recognition request for the target image category to be sent to the server. The server obtains the image to be recognized carried in the image recognition request, and inputs the image to be recognized into the trained image recognition model corresponding to the target image category to obtain the probability that the image to be recognized belongs to various image categories, for example, the probability of belonging to "dog" is 0.9766, and the probability of belonging to "cat" is 0.3452. When the probability of "dog" is greater than the preset probability of 0.85, the server can also output the image recognition result of "the picture includes a dog".

[0084] In some embodiments, the target image is multiple, such as Figure 4 As shown, feature extraction is performed on the target image to obtain the target extraction feature, and reference extraction features are obtained based on the target extraction feature, including: S402, feature extraction is performed on each target image to obtain the target extraction features corresponding to each target image; S404, current feature distribution is obtained, and the current occurrence probability of each target extraction feature is calculated in the current feature distribution; S406, current occurrence probability corresponding to each target extraction feature is counted to obtain the current probability statistic value corresponding to each target extraction feature, and feature distribution parameters corresponding to the current feature distribution are adjusted so that the current probability statistic value changes in a larger direction to obtain the target feature distribution; S408, target representative features corresponding to the target feature distribution are obtained as reference extraction features.

[0085] Among them, the current feature distribution can be any feature distribution, for example, it can be a Gaussian distribution. The feature distribution parameters corresponding to the current feature distribution are used to determine the current feature distribution. For example, when the current feature distribution is a Gaussian distribution, the feature distribution parameters may include a mean and a covariance matrix. The current feature distribution includes the probability of feature occurrence, and the probability of feature occurrence can be determined by the current feature distribution. The current occurrence probability refers to the probability of the target extraction feature appearing in the current feature distribution. The probability can be expressed as a probability. The greater the probability, the greater the probability. The probability can be, for example, 0.3.

[0086] The current possibility statistic is obtained by statistically analyzing the current occurrence probabilities corresponding to each target extraction feature. The current possibility statistic is positively correlated with the target extraction feature. For example, each target extraction feature can be added to obtain the current possibility statistic, or each target extraction feature can be multiplied to obtain the current possibility statistic. The target extraction feature can also be logarithmically calculated to obtain the logarithmic extraction feature corresponding to the target extraction feature. Each logarithmic extraction feature can be statistically calculated to obtain the current possibility statistic. For example, the result of adding each logarithmic extraction feature can be used as the current possibility statistic.

[0087] The target representative feature refers to a representative feature in the target feature distribution, for example, it can be the target center feature of the target feature distribution. The target center feature refers to the feature with the highest probability of appearing in the target feature distribution. The target representative feature can also be a feature in the target feature distribution whose distance from the target center feature is less than the feature distance threshold.

[0088] Specifically, the server can update the feature distribution parameters corresponding to the current feature distribution in a direction that increases the current possibility statistic, obtain the updated feature distribution parameters, and determine whether the update stop condition is met. If not, return to the step of updating the feature distribution parameters corresponding to the current feature distribution in a direction that increases the current possibility statistic, until the update stop condition is met, and use the current feature distribution corresponding to the updated feature distribution parameters as the target feature distribution. The update stop condition includes but is not limited to the difference between two adjacent feature distribution parameters being less than a distribution parameter difference threshold, and the difference between two adjacent current possibility statistics being less than a possibility statistic difference threshold. The distribution parameter difference threshold and the possibility statistic difference threshold can be set as needed, or can be pre-set.

[0089] In some embodiments, the current feature distribution may include multiple current sub-distributions, where multiple refers to at least two. For each target extraction feature, the server may calculate the current sub-occurrence probability of the target extraction feature in each current sub-distribution, perform statistical calculations on each current sub-occurrence probability, such as weighted calculation, to obtain the current occurrence probability corresponding to the target extraction feature, where the current sub-occurrence probability refers to the probability of the target extraction feature appearing in the sub-distribution.

[0090] In some embodiments, a sub-distribution corresponds to a sub-distribution parameter, and the characteristic distribution parameters may include sub-distribution parameters corresponding to each current sub-distribution. The server may continuously update the sub-distribution parameters corresponding to each current sub-distribution in the direction in which the current probability statistic becomes larger until the update stop condition is reached, and use the current sub-distribution corresponding to the updated sub-distribution parameters as the target sub-distribution, and obtain the target characteristic distribution based on each target sub-distribution, for example, superimposing each target sub-distribution to obtain the target characteristic distribution.

[0091] In some embodiments, the server may obtain representative features corresponding to the target sub-distributions, obtain sub-representative features, and determine reference extraction features according to each target sub-distribution. For example, statistical calculations may be performed according to the sub-representative features corresponding to each target sub-distribution, such as weighted calculations, to obtain reference extraction features. Reference extraction features may also be obtained by selecting from each sub-representative feature. For example, the similarity between the adversarial extraction feature and the sub-representative feature may be calculated, and the sub-representative feature with the greatest similarity may be used as the reference extraction feature. The sub-representative feature may be determined as required, such as a feature with the highest probability of appearing in the target sub-distribution.

[0092] In some embodiments, the current feature distribution is a Gaussian mixture distribution, which includes two or more sub-distributions, each of which is a Gaussian distribution, and the multiple sub-distributions refer to at least three. The mixed Gaussian distribution can be obtained by superimposing the sub-distributions in the mixed Gaussian distribution. The mixed Gaussian distribution can be expressed as formula (1). Where x1 represents an image whose real image category is the target image category, represents the features corresponding to the sample x1 output by the first layer of the pre-trained image recognition model based on the deep neural network, θ represents the model parameters of the pre-trained image recognition model, and K represents the number of sub-distributions included in the Gaussian mixture distribution, which can be set as needed, for example, 2. π k Represents the mixing coefficient corresponding to the kth sub-distribution, which can also be called the weight of the kth sub-distribution, 0≤π k ≤1, Represents the probability density function of the kth sub-distribution, that is, the mean is μ k , the covariance matrix is ​​Σ k Gaussian distribution. represents a Gaussian mixture distribution. A Gaussian mixture distribution can also be called a Gaussian mixture model. The mean μ of the sub-distribution is k It can be expressed by formula (2), where N represents the number of samples belonging to the kth sub-distribution, X i represents the i-th sample, μ k represents the mean of the kth sub-distribution, h(X i )=γ ik ·Xi , γ ik Represents X i The posterior probability of belonging to the kth sub-distribution. The covariance matrix of the sub-distribution Σ k It can be expressed by formula (3), where Σ k represents the covariance matrix of the kth subdistribution.

[0093]

[0094]

[0095]

[0096] In some embodiments, the server may obtain an initialized Gaussian mixture distribution as the current feature distribution. The initialized Gaussian mixture distribution refers to the sub-distribution parameters of the initialized sub-distribution. The sub-distribution parameters include the mean, covariance matrix and weight of the sub-distribution, that is, the mean, covariance matrix and weight of each sub-distribution in the Gaussian mixture distribution are set to initial values. The server may calculate the probability of each target extraction feature in the initialized Gaussian mixture distribution as the current occurrence probability of each target extraction feature, calculate the product of each current occurrence probability as the current probability statistic, or calculate and add the logarithmic results of each current occurrence probability to obtain the current probability statistic, iteratively adjust the sub-distribution parameters in the direction of increasing the current probability statistic, until the change value of the current probability statistic is less than the statistic change threshold, or the change of the sub-distribution parameter is less than the sub-parameter change threshold, and use the Gaussian mixture distribution composed of the sub-distribution determined by the adjusted sub-distribution parameters as the target feature distribution. The statistic change threshold and the sub-parameter change threshold can be preset.

[0097] In this embodiment, the distribution parameters corresponding to the current feature distribution are adjusted in the direction of increasing the current possibility statistic, so that the current feature distribution can be continuously approached to the real distribution satisfied by the features of the images of the target image category, so that the target feature distribution can accurately reflect the real distribution satisfied by the features of the images of the target image category, and the target representative features corresponding to the target feature distribution are obtained as reference extraction features, thereby realizing the use of representative features in the target feature distribution as reference extraction features, and improving the accuracy of the reference extraction features.

[0098] In some embodiments, the current feature distribution includes a first current feature distribution and a second current feature distribution, and the current occurrence possibility includes a first current occurrence possibility corresponding to the first current feature distribution and a second current occurrence possibility corresponding to the second current feature distribution; the current occurrence possibility corresponding to each target extraction feature is counted to obtain a current possibility statistic, and the feature distribution parameters corresponding to the current feature distribution are adjusted so that the current possibility statistic changes in a larger direction, and obtaining the target feature distribution includes: obtaining a first current distribution weight corresponding to the first current feature distribution and a second current distribution weight corresponding to the second current feature distribution; based on the first current distribution weight and the first current occurrence possibility, the second current distribution weight and the second current occurrence possibility are weighted and summed to obtain the current occurrence possibility corresponding to the target extraction feature; the current occurrence possibility corresponding to each target extraction feature is counted to obtain a current possibility statistic, and the distribution parameters corresponding to the first current feature distribution and the second current feature distribution, the first current distribution weight and the second current distribution weight are adjusted so that the current possibility statistic changes in a larger direction, and the first target feature distribution, the second target feature distribution, the first target distribution weight and the second target distribution weight are obtained.

[0099] The first current feature distribution and the second current feature distribution may be probability distributions of the same type, for example, both may be Gaussian distributions. The first current occurrence probability refers to the probability of the target extraction feature appearing in the first current feature distribution, and the second current occurrence probability refers to the probability of the target extraction feature appearing in the second current feature distribution.

[0100] The first current distribution weight indicates the possibility that the target extracted feature belongs to the first current feature distribution, and the second current distribution weight indicates the possibility that the target extracted feature belongs to the second current feature distribution. The sum of the weights corresponding to the distributions included in the current feature distribution is equal to 1. For example, when the current feature distribution only includes the first current feature distribution and the second current feature distribution, the sum of the first current distribution weight and the second current distribution weight is 1. The initial values ​​of the first current distribution weight and the second current distribution weight can be preset, and the initial values ​​can be, for example, 0.5 and 0.5, respectively.

[0101] The target feature distribution includes a first target feature distribution and a second target feature distribution. The first target feature distribution, the second target feature distribution, the first target distribution weight, and the second target distribution weight are respectively the distribution parameters, the first current distribution weight, and the second current distribution weight corresponding to the first current feature distribution and the second current feature distribution when the update stop condition is reached.

[0102] Specifically, the server can calculate the product of the first current distribution weight and the first current occurrence possibility to obtain a first result, calculate the product of the second current distribution weight and the second current occurrence possibility to obtain a second result, add the first result and the second result to obtain the current occurrence possibility corresponding to the target extraction feature.

[0103] In some embodiments, the server may adjust the distribution parameters, the first current distribution weight, and the second current distribution weight corresponding to the first current feature distribution and the second current feature distribution in a direction that increases the current probability statistic until the update stop condition is reached, and the updated first current feature distribution is used as the first target feature distribution, the updated second current feature distribution is used as the second target feature distribution, the updated first current distribution weight is used as the first target distribution weight, and the updated second current distribution weight is used as the second target distribution weight. The update stop condition may also include that the difference between two adjacent current distribution weights is less than a weight difference threshold.

[0104] In this embodiment, the distribution parameters corresponding to the first current feature distribution and the second current feature distribution, the first current distribution weight, and the second current distribution weight are adjusted in a direction that increases the current possibility statistic, to obtain the first target feature distribution, the second target feature distribution, the first target distribution weight, and the second target distribution weight, so that the target feature distribution includes the first target feature distribution and the second target feature distribution, which can better reflect the distribution satisfied by the characteristics of the image of the target image type through the two distributions, thereby improving the accuracy of the target feature distribution.

[0105] In some embodiments, Figure 5 As shown, obtaining the target representative feature corresponding to the target feature distribution and obtaining the reference extraction feature includes: S502, determining the first target occurrence possibility of the adversarial extraction feature in the first target feature distribution, and obtaining a first weighted possibility based on the first target distribution weight and the first target occurrence possibility; S504, determining the second target occurrence possibility of the adversarial extraction feature in the second target feature distribution, and obtaining a second weighted possibility based on the second target distribution weight and the second target occurrence possibility; S506, based on the first weighted possibility and the second weighted possibility, selecting the feature distribution with the largest possibility from the first target feature distribution and the second target feature distribution as the representative feature distribution; S508, obtaining the target representative feature corresponding to the representative feature distribution as the reference extraction feature.

[0106] The first target occurrence probability refers to the probability of the adversarial extraction feature appearing in the first target feature distribution, and the second target occurrence probability refers to the probability of the adversarial extraction feature appearing in the second target feature distribution. The representative feature distribution can be any one of the first target feature distribution and the second target feature distribution. The target representative feature refers to the representative feature corresponding to the representative feature distribution, for example, the feature with the highest probability of appearing in the representative feature distribution.

[0107] Specifically, the server can calculate the product of the first target distribution weight and the first target occurrence possibility to obtain a first weighted possibility, calculate the product of the second target distribution weight and the second target occurrence possibility to obtain a second weighted possibility, compare the first weighted possibility with the second weighted possibility, determine the larger weighted possibility between the first weighted possibility and the second weighted possibility as the target weighted possibility, and use the feature distribution corresponding to the target weighted possibility as the representative feature distribution. For example, when the first weighted possibility is greater than the second weighted possibility, the first target feature distribution corresponding to the first weighted possibility can be used as the target weighted possibility.

[0108] In some embodiments, the server can obtain a first image loss value based on the feature difference value, and obtain a target image loss value based on the first image loss value, the target image loss value is positively correlated with the first image loss value, and the first image loss value is positively correlated with the feature difference value.

[0109] In some embodiments, the target feature distribution can be a Gaussian mixture distribution, and the first target feature distribution and the second target feature distribution are sub-distributions in the Gaussian mixture distribution respectively. The server can determine a sub-distribution from the sub-distribution of the Gaussian mixture distribution as the representative feature distribution. For example, the server can determine the probability of the adversarial extraction feature appearing in each sub-distribution, obtain a probability set, and use the sub-distribution corresponding to the largest probability in the probability set as the representative feature distribution. For example, the representative feature distribution can be determined using formula (4). Formula (4) indicates that the probability of the adversarial extraction feature appearing in the k'th sub-distribution of the Gaussian mixture distribution is greater than the probability of the adversarial extraction feature appearing in other sub-distributions, that is, the k'th sub-distribution is the sub-distribution closest to the current adversarial image, that is, the k'th sub-distribution can be used as the representative feature distribution. x2 refers to the current adversarial image, Represents the adversarial extracted features output by the current adversarial image x2 in the lth layer of the pre-trained image recognition model.

[0110]

[0111] In some embodiments, when the representative feature distribution is a sub-distribution of a Gaussian mixture distribution, the server may determine the probability of the adversarial extracted feature in the sub-distribution corresponding to the representative feature distribution, and adjust the pixel values ​​of the current adversarial image in the direction of increasing the probability of the occurrence, to obtain a target adversarial image corresponding to the target image. The probability of the adversarial extracted feature in the sub-distribution corresponding to the representative feature distribution may be, for example, is the mean of the k'th sub-distribution, is the covariance matrix representing the k'th sub-distribution. Since the first two terms in formula (5) are constants, In the direction of increase, the pixel values ​​of the current adversarial image are adjusted to obtain the target adversarial image corresponding to the target image.

[0112]

[0113] In some embodiments, the reference extraction feature may be the mean of the sub-distribution corresponding to the representative feature distribution. The server may use formula (6) to calculate the layer image loss value corresponding to the adversarial extraction feature of the first layer of the pre-trained image recognition model, and count the layer image loss values ​​corresponding to each feature extraction layer to obtain a first image loss value. The first image loss value may be expressed as formula (7). Where, J l represents the layer image loss value corresponding to the adversarial extraction feature of the lth layer, λ l is the weight of the lth layer, so it can be set as needed. HFC represents the first image loss value, 1≤l≤L, 1≤L. The server can adjust the pixel value of the current adversarial image in the direction of reducing the first image loss value, that is, adjust the pixel value of the current adversarial image in the direction of reducing the difference between the current extracted features and the reference extracted features, which can shorten the distance between the current adversarial image and the target image of the target image category in the high-dimensional feature space.

[0114]

[0115]

[0116] In some embodiments, normal sample data can be collected offline to train a Gaussian mixture model. On the server side, the Gaussian mixture model is deployed to input normal samples and output adversarial samples.

[0117] In this embodiment, the feature distribution with the largest probability is selected from the first target feature distribution and the second target feature distribution as the representative feature distribution, so that the probability of the adversarial extraction feature appearing in the representative feature distribution is greater than the probability of the adversarial extraction feature appearing in the non-representative feature distribution, thereby obtaining the target representative feature corresponding to the representative feature distribution as a reference extraction feature, which can improve the convergence speed of the interference adjustment value, and is more conducive to obtaining the target adversarial image when the interference adjustment value is small, thereby improving the efficiency of generating the target adversarial image. In addition, since the feature difference value is positively correlated with the target image loss value, that is, when the target image loss value decreases, the feature difference value decreases, and the difference between the adversarial extraction feature and the reference extraction feature decreases, thereby reducing the difference between the features of the adversarial sample and the image features of the target image category, thereby achieving the goal of hiding the features of the adversarial sample in the distribution satisfied by the features of the image of the target image category.

[0118] In some embodiments, obtaining a target image loss value based on a feature difference value includes: obtaining a first image loss value based on the feature difference value, the feature difference value being positively correlated with the first image loss value; determining a first confidence of the current adversarial image in the target image category based on adversarial extraction features; obtaining a second image loss value based on the first confidence; the second image loss value is negatively correlated with the first confidence; and obtaining a target image loss value based on the first image loss value and the second image loss value.

[0119] The first confidence refers to the probability that the current adversarial image belongs to the target image category. The second image loss value is negatively correlated with the first confidence, and the opposite or reciprocal of the first confidence can be used as the second image loss value. The target image loss value is positively correlated with the first image loss value and the second image loss value.

[0120] Specifically, the server may input the current adversarial image into a pre-trained image recognition model to obtain an image recognition result output by the pre-trained image recognition model. The image recognition result may include that the current adversarial image belongs to the target image category, and may also include a reference confidence that the current adversarial image belongs to the reference image category. The reference image category may be any category other than the target image category, and may include at least one of the adversarial image category and the image category other than the adversarial image category. The reference confidence refers to the confidence that the current adversarial image belongs to the reference image category. The server may obtain a second image loss value based on the first confidence and the reference confidence, for example, the second image loss value may be obtained based on the difference between the first confidence and the reference confidence.

[0121] In some embodiments, the server may perform weighted calculation on the first image loss value and the second image loss value and use the result of the weighted calculation as the target image loss value, or may use the result of adding the first image loss value and the second image loss value as the target image loss value.

[0122] In this embodiment, the second image loss value is negatively correlated with the first confidence. When the second image loss value changes in a decreasing direction, the first confidence changes in an increasing direction, thereby increasing the probability that the current adversarial image is identified as a target image category, and increasing the probability that the current adversarial image becomes an adversarial sample of the target image category.

[0123] In some embodiments, obtaining a second image loss value based on the first confidence level includes: determining a second confidence level of the current adversarial image in the adversarial image category based on adversarial extraction features; obtaining a second image loss value based on a first confidence difference value between the first confidence level and the second confidence level; and the second image loss value is negatively correlated with the first confidence difference value.

[0124] The second confidence refers to the probability that the current adversarial image belongs to the adversarial image category. The first confidence difference value may be positively correlated with the result obtained by subtracting the second confidence from the first confidence, for example, the result obtained by subtracting the second confidence from the first confidence. The second image loss value is negatively correlated with the first confidence.

[0125] Specifically, the server may use the opposite or inverse of the first confidence difference value as the second image loss value, or scale the first confidence difference value and use the opposite or inverse corresponding to the scaling result as the second image loss value.

[0126] In this embodiment, the second image loss value is negatively correlated with the first confidence difference value, so that the difference between the first confidence and the second confidence can be reduced, thereby increasing the probability that the current adversarial image is identified as the first image category.

[0127] In some embodiments, obtaining a target image loss value based on a feature difference value includes: obtaining a first image loss value based on the feature difference value, the feature difference value being positively correlated with the first image loss value; determining a reference confidence of the current adversarial image in each reference image category based on adversarial extraction features; selecting the maximum confidence from each reference confidence as a third confidence; obtaining a third image loss value based on a second confidence difference value between the first confidence and the third confidence; and obtaining a target image loss value based on the first image loss value and the third image loss value.

[0128] Among them, the third confidence is the maximum confidence among the reference confidences. The second confidence difference value refers to the difference between the first confidence and the third confidence, and can be positively correlated with the result obtained by subtracting the third confidence from the first confidence, for example, it can be the result obtained by subtracting the third confidence from the first confidence. The third image loss value is negatively correlated with the second confidence difference value. The third image loss value is negatively correlated with the first confidence.

[0129] Specifically, the server can perform statistical calculations on the first image loss value and the third image loss value, such as weighted calculations, to obtain a target image loss value, and the target image loss value is positively correlated with the first image loss value and the third image loss value. The server can perform statistical calculations on the first image loss value, the second image loss value, and the third image loss value, such as weighted calculations, to obtain the target image loss value.

[0130] In this embodiment, the maximum confidence is selected from each reference confidence as the third confidence, and the third image loss value is obtained based on the second confidence difference value between the first confidence and the third confidence. When the third image loss value changes in a decreasing direction, the second confidence difference value can be changed in an increasing direction, that is, the first confidence changes in an increasing direction and the third confidence changes in a decreasing direction, so that the first confidence can be greater than the third confidence, that is, the first confidence can be made the largest confidence among the various confidences included in the image recognition result, so that the current adversarial image can be identified as the first image category.

[0131] In some embodiments, adjusting the pixel values ​​of the current adversarial image based on the interference adjustment value to obtain a target adversarial image corresponding to the target image includes: when the second confidence difference value is less than the confidence difference threshold, adjusting the pixel values ​​of the current adversarial image based on the interference adjustment value to obtain an updated current adversarial image; returning to the step of extracting features from the current adversarial image to obtain adversarial extracted features, until the second confidence difference value reaches the confidence difference threshold, and using the current adversarial image as the target adversarial image corresponding to the target image.

[0132] Specifically, the confidence difference threshold can be set as needed or can be pre-set. The second confidence difference value can be the result of subtracting the third confidence from the first confidence. The pixel value adjustment end condition can also include the second confidence difference value reaching the confidence difference threshold. When the second confidence difference value reaches the preset value, the server can determine that the pixel value adjustment end condition is met, stop the step of adjusting the pixel value of the current adversarial image based on the interference adjustment value, and use the current adversarial image that meets the pixel value adjustment end condition as the target adversarial image. For example, the third image loss value can be expressed as formula (8), and the target image loss value can be expressed as formula (9), where Jfinal represents the target image loss value, J HFC represents the first image loss value, J CW Represents the third image loss value. represents the second confidence difference value, kk represents the confidence difference threshold, represents the first confidence level, represents the current adversarial image, Indicates the third confidence level.

[0133]

[0134] J final =J HFC +J CW (9)

[0135] In this embodiment, when the second confidence difference value is less than the confidence difference threshold, the pixel value of the current adversarial image is adjusted based on the interference adjustment value to obtain an updated current adversarial image, and the step of performing feature extraction on the current adversarial image to obtain the adversarial extraction feature is returned until the second confidence difference value reaches the confidence difference threshold. The current adversarial image is used as the target adversarial image corresponding to the target image. The degree to which the first confidence is higher than the third confidence can be controlled so that the first confidence is not too larger than the third confidence, thereby reducing overfitting.

[0136] In some embodiments, adjusting the pixel values ​​of the current adversarial image based on the interference adjustment value to obtain a target adversarial image corresponding to the target image includes: adjusting the pixel values ​​of the current adversarial image based on the interference adjustment value to obtain an updated current adversarial image; calculating the current image difference value between the updated current adversarial image and the original adversarial image corresponding to the current adversarial image, and when the current image difference value is less than the image difference threshold, returning to the step of extracting features from the current adversarial image to obtain adversarial extraction features, until the current image difference value reaches the image difference threshold, and using the current adversarial image as the target adversarial image corresponding to the target image.

[0137] Among them, the original adversarial image has not been subjected to adversarial attack. By adding perturbations that are invisible to the human eye to the original adversarial image, such as modifying the pixel values, the current adversarial image can be obtained. The current image difference value refers to the difference between the updated current adversarial image and the original adversarial image. For example, the difference in pixel values ​​of each pixel point between the current adversarial image and the original adversarial image can be obtained to obtain the pixel difference value corresponding to each pixel point. The pixel difference value is counted to obtain the current image difference value. For example, the result of weighted calculation of each pixel difference value can be used as the current image difference value, or the P norm of the vector composed of each pixel difference value can be used as the current image difference value. P can be set as needed, for example, it can be 3. The current image difference value can also be the difference between the features of the updated current adversarial image and the features of the original adversarial image.

[0138] Specifically, the server can superimpose the interference adjustment value as the updated pixel value on the basis of the pixel value of the current adversarial image to obtain the updated current adversarial image. The interference adjustment value can be one or more, and more means at least two. When there is only one interference adjustment value, the interference adjustment value can be used to make the same adjustment to each pixel value in the current adversarial image. For example, when the interference adjustment value is 0.1, 0.1 can be added to each pixel value in the current adversarial image to obtain the updated pixel value.

[0139] In some embodiments, the pixel value adjustment termination condition may also include that the current image difference value reaches an image difference threshold. The server may calculate the difference value between the updated current adversarial image and the original adversarial image corresponding to the current adversarial image to obtain the current image difference value. When the current image difference value is less than the image difference threshold, the server returns to the step of extracting features from the current adversarial image to obtain adversarial extracted features until the current image difference value reaches the image difference threshold and the current adversarial image is used as the target adversarial image corresponding to the target image.

[0140] In some embodiments, there may be interference adjustment values ​​corresponding to multiple pixels, and each interference adjustment value may be the same or different. For example, the interference adjustment value corresponding to one pixel is -0.1, and the interference adjustment value corresponding to another pixel is 0.1. The server may adjust the corresponding pixel in the current adversarial image based on the interference adjustment value corresponding to each pixel to obtain an updated current adversarial image.

[0141] In some embodiments, the current image difference value can be obtained using the formula ||x adv -x|| p ≤ε(10), where ε represents the image difference threshold, also known as the interference budget. adv -x|| p Represents xadv -p norm of x. adv represents the current adversarial image, and x represents the original adversarial image.

[0142] Different image difference thresholds will result in different target adversarial images, that is, different adversarial samples. Figure 6 As shown in the figure, the adversarial samples corresponding to different image difference thresholds are displayed. The first image in the first row is a normal sample image, which comes from the chest X-ray dataset. The second to fifth images in the first row are adversarial samples generated when the image difference thresholds are 0.5, 1, 2, 4, and 8, respectively. The first image in the second row is a normal sample image, which comes from the fundus dataset. The second to fifth images in the first row are adversarial samples generated when the image difference thresholds are 0.5, 1, 2, 4, and 8, respectively. Figure 6 It can be seen that the difference between adversarial samples and normal samples cannot be obviously found by human eyes, but for image recognition models, as the image difference threshold increases, the ability of image recognition models to distinguish adversarial samples from normal samples becomes higher and higher.

[0143] In this embodiment, the current image difference value between the current adversarial image before and after the update and the current adversarial image after the update corresponding to the original adversarial image of the current adversarial image is calculated. When the current image difference value is less than the image difference threshold, the step of performing feature extraction on the current adversarial image to obtain adversarial extraction features is returned until the current image difference value is greater than the image difference threshold. The current adversarial image is used as the target adversarial image corresponding to the target image. The difference between the current adversarial image and the original adversarial image before and after the update can be controlled, so that the current adversarial image and the original adversarial image before and after the update cannot be distinguished by the naked eye, thereby improving the accuracy of the target adversarial image.

[0144] In some embodiments, the interference adjustment value includes pixel adjustment values ​​corresponding to each pixel point respectively, and adjusting the pixel values ​​of the current adversarial image based on the interference adjustment value to obtain the target adversarial image corresponding to the target image includes: deriving the target image loss value based on the pixel values ​​of each pixel point of the current adversarial image to obtain the pixel adjustment values ​​corresponding to each pixel point in the current adversarial image; adjusting the pixel values ​​of the pixels in the current adversarial image based on the pixel adjustment values ​​corresponding to each pixel point to obtain the target adversarial image corresponding to the target image.

[0145] Specifically, the server can use the target image loss value to derive the pixel values ​​of the pixels in the current adversarial image to obtain the pixel adjustment values ​​corresponding to each pixel, and use the pixel adjustment values ​​corresponding to the pixel to adjust the pixel values ​​of the corresponding pixels to obtain the adjusted current adversarial image, and obtain the target adversarial image based on the adjusted current adversarial image.

[0146] In some embodiments, the server may use the target image loss value to derive the pixel value of the pixel in the current adversarial image, obtain the derivative value corresponding to each pixel, determine the pixel adjustment coefficient according to the derivative value, obtain the pixel value adjustment amplitude, calculate the product of the pixel adjustment coefficient and the pixel adjustment amplitude, and obtain the pixel adjustment value corresponding to the pixel. The pixel adjustment amplitude is the maximum pixel value that can be increased or decreased each time the pixel value is adjusted, which can be preset, for example, it can be 1, for example, the pixel value of the pixel is 90, and the adjusted pixel value range is 89 to 91. The server may compare the derivative value with the numerical threshold, and determine the pixel adjustment coefficient according to the comparison result, wherein when the derivative value is greater than the numerical threshold, the pixel adjustment coefficient corresponding to the derivative value is determined to be a first numerical value, and when the derivative value is less than the numerical threshold, the pixel adjustment coefficient corresponding to the derivative value is determined to be a second numerical value, and the numerical threshold can be set as needed, for example, it can be 0, the first numerical value is greater than the second numerical value, the first numerical value is, for example, 1, and the second numerical value is, for example, -1.

[0147] In this embodiment, the pixel values ​​of the pixels in the current adversarial image are adjusted based on the pixel adjustment values ​​corresponding to each pixel point, so as to obtain a target adversarial image corresponding to the target image, thereby realizing the pixel value adjustment of each pixel point and improving the flexibility and accuracy of adjusting the pixel value.

[0148] In some embodiments, the method also includes: inputting the target adversarial image into the image recognition model to be trained corresponding to the target image category to obtain the adversarial confidence of the target adversarial image in the target image category; determining the target model loss value based on the adversarial confidence; the target model loss value is positively correlated with the adversarial confidence; adjusting the model parameters of the image recognition model based on the target model loss value to obtain a trained image recognition model.

[0149] The image recognition model to be trained corresponding to the target image category refers to the pre-trained image recognition model. The adversarial confidence is the confidence that the target adversarial image output by the image recognition model belongs to the target image category. The model parameter refers to the variable parameter inside the model. For a neural network model, it can also be called the neural network weight.

[0150] Specifically, the server can use the target adversarial image as a negative sample of the image recognition model to be trained to train the image recognition model to be trained. The server can obtain a target image whose real image category is the target image category, use the target image as a positive sample of the image recognition model to be trained, and use the positive sample and the negative sample to train the image recognition model to be trained to obtain a trained image recognition model. In each training process, the number of positive samples and the number of negative samples can be determined as needed.

[0151] In some embodiments, the server may train the image recognition model in an iterative training manner. Specifically, the server may adjust the model parameters of the image recognition model in the direction of reducing the loss value of the target model, and perform iterative training until the model convergence condition is met, and the image recognition model after adjusting the model parameters is used as the trained image recognition model. The model convergence condition includes but is not limited to that the change in the loss value of the target model is less than the change in the preset loss value or the change in the model parameter is less than the preset parameter change value.

[0152] In this embodiment, the target model loss value is determined based on the adversarial confidence. Since the target model loss value is positively correlated with the adversarial confidence, when the target model loss value decreases, the adversarial confidence also decreases, that is, the possibility of the target adversarial image being recognized as the target image category decreases, thereby reducing the possibility that the trained image recognition model will recognize the target adversarial image as the target image category, thereby improving the robustness of the image recognition model to adversarial samples and improving the reliability of the image recognition model.

[0153] In some embodiments, Figure 7 As shown, an image recognition method is provided, comprising the following steps:

[0154] 702. Obtain a target image of a target image category and a current adversarial image corresponding to an adversarial image category.

[0155] 704. Perform feature extraction on each target image to obtain target extraction features corresponding to each target image, obtain current feature distribution, calculate the current occurrence probability of each target extraction feature in the current feature distribution, perform statistics on the current occurrence probability corresponding to each target extraction feature to obtain the current probability statistic, adjust the feature distribution parameters corresponding to the current feature distribution so that the current probability statistic changes in a larger direction, and obtain the target feature distribution.

[0156] Among them, the target feature distribution may include a first target feature distribution and a second target feature distribution, the first target feature distribution corresponds to a first target distribution weight, and the second target feature distribution corresponds to a second target distribution weight. Based on the first target distribution weight and the second target distribution weight, the first target feature distribution and the second target feature distribution are weightedly calculated to obtain the target feature distribution, that is, the target feature distribution is a distribution obtained by superimposing the first target feature distribution and the second target feature distribution.

[0157] When the image recognition model is a neural network model, a Gaussian mixture model can be used to perform normal distribution modeling on each activation layer of the image recognition model to obtain the target feature distribution. By maximizing the log-likelihood of the adversarial sample, the adversarial sample is fit to the normal sample in the feature space.

[0158] 706. Perform feature extraction on the current adversarial image to obtain adversarial extracted features.

[0159] 708. Determine the probability of occurrence of a first target of the adversarial extraction feature in the first target feature distribution, obtain a first weighted probability based on the first target distribution weight and the first target occurrence probability, determine the probability of occurrence of a second target of the adversarial extraction feature in the second target feature distribution, and obtain a second weighted probability based on the second target distribution weight and the second target occurrence probability.

[0160] 710. Based on the first weighted probability and the second weighted probability, select the feature distribution with the largest probability from the first target feature distribution and the second target feature distribution as the representative feature distribution, obtain the target representative feature corresponding to the representative feature distribution, and extract the feature as a reference.

[0161] 712. Calculate the feature difference value between the adversarial extracted feature and the reference extracted feature, and obtain the target image loss value based on the feature difference value.

[0162] Among them, the feature difference value is positively correlated with the target image loss value.

[0163] 714. Determine a first confidence of the current adversarial image in the target image category based on the adversarial extraction features, determine a second confidence of the current adversarial image in the adversarial image category based on the adversarial extraction features, and obtain a second image loss value based on a first confidence difference value between the first confidence and the second confidence.

[0164] Among them, the second image loss value is negatively correlated with the first confidence difference value.

[0165] 716. Obtain a target image loss value based on the first image loss value and the second image loss value, and obtain an interference adjustment value based on the target image loss value.

[0166] 718. Determine whether the second confidence difference value is less than the confidence difference threshold, and whether the current image difference value is less than the image difference threshold. If so, execute step 720; if not (i.e., the second confidence difference value reaches the confidence difference threshold or the current image difference value reaches the image difference threshold), execute step 722.

[0167] 720. Adjust the pixel value of the current adversarial image based on the interference adjustment value to obtain an updated current adversarial image, perform feature extraction on the updated current adversarial image to obtain an updated adversarial extraction feature, and return to step 712.

[0168] 722. Use the current adversarial image as a target adversarial image corresponding to the target image.

[0169] Among them, the server can adjust the pixel value of the current adversarial image based on the interference adjustment value to obtain an updated current adversarial image, calculate the difference value between the updated current adversarial image and the original adversarial image corresponding to the current adversarial image, and obtain the current image difference value.

[0170] 724. Input the target adversarial image into the image recognition model to be trained corresponding to the target image category to obtain the adversarial confidence of the target adversarial image corresponding to the target image category.

[0171] Among them, the target adversarial image can also be called an adversarial sample.

[0172] 726. Determine a target model loss value based on the adversarial confidence, adjust model parameters of the image recognition model based on the target model loss value, obtain a trained image recognition model, and use the trained image recognition model to perform image recognition.

[0173] Among them, the target model loss value is positively correlated with the adversarial confidence.

[0174] In this embodiment, by simultaneously constraining the adversarial samples in the feature space of different layers of the image recognition model, that is, constraining the distribution of the adversarial samples in the feature space, the adversarial samples are fit to the distribution of normal samples of the target image category, and the image recognition model is trained using the adversarial samples. This can improve the robustness of the image recognition model to the adversarial samples and improve the reliability of the image recognition model.

[0175] The image processing method provided in the present application can be applied to the adversarial training of a neural network model, for example, it can be applied to the adversarial training of a neural network model in the medical field, for example, the pre-trained image recognition model is a model for identifying objects in medical images, and the medical images can include normal medical images and abnormal medical images. The normal medical images can be, for example, lung images of "no pneumonia", and the abnormal medical images can be, for example, lung images of "pneumonia". The server can use the normal medical images and the abnormal medical images to train the initial image recognition model to obtain a pre-trained image recognition model that can correctly identify whether the medical image is a normal category or an abnormal category. The server can perform feature extraction on the normal medical image to obtain a normal extracted feature, perform feature extraction on the abnormal medical image to obtain an abnormal extracted feature, adjust the normal medical image in the direction of approaching the normal extracted feature to the abnormal extracted feature, and obtain the adjusted medical image, so that the adjusted medical image is recognized as an abnormal category by the pre-trained image recognition model. The server can obtain the adjusted medical image, and use the adjusted medical image to perform adversarial training on the pre-trained image recognition model. By adjusting the pre-trained image recognition model, the pre-trained image recognition model can recognize the adjusted medical image as a normal category, that is, the pre-trained image recognition model can correctly recognize the adjusted image, thereby improving the recognition accuracy of the medical image, and preventing criminals from modifying normal medical images into abnormal medical images and using the modified medical images to apply for insurance compensation.

[0176] The image processing method provided by the present application can be applied to computer vision tasks, such as segmentation tasks or detection tasks, for example, it can be applied to the encryption of images including objects to be detected to ensure the security of the image. The server can store the interference adjustment value of the target adversarial image relative to the original image, that is, the relationship between the target adversarial image and the interference adjustment value can be stored. When it is necessary to identify the encrypted image, the interference adjustment value in the target adversarial image can be removed based on the target adversarial image and the interference adjustment value to obtain the original image, and image recognition is performed based on the original image. For example, the object to be detected can be a fundus image. By obtaining the interference adjustment value of the fundus image and adjusting the fundus image, the security of the fundus image can be guaranteed, and the fundus image can be prevented from being stolen by malicious attackers and illegally used. The server can store the interference adjustment value of the target adversarial image relative to the original image. When it is necessary to identify the image, for example, when identifying an abnormal area in the fundus image, the adjustment interference adjustment value in the target adversarial image can be removed, and then the identification is performed.

[0177] The image processing method provided in this application can be deployed under a variety of operating systems, for example, it can be used in Linux, Windows and MacOS environments, and can also be embedded in a classification model based on deep learning.

[0178] It should be understood that although Figure 2-7 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2-7 At least part of the steps may include multiple steps or multiple stages. These steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the steps or stages in other steps.

[0179] In some embodiments, Figure 8 As shown, an image processing device is provided, which can be a part of a computer device using a software module or a hardware module, or a combination of the two. The device specifically includes: a current adversarial image acquisition module 802, a reference extraction feature acquisition module 804, an adversarial extraction feature acquisition module 806, a target image loss value acquisition module 808 and a target adversarial image acquisition module 810, wherein:

[0180] The current adversarial image acquisition module 802 is used to acquire a target image of a target image category and a current adversarial image corresponding to the adversarial image category.

[0181] The reference extraction feature obtaining module 804 is used to extract features from the target image to obtain target extraction features, and obtain reference extraction features based on the target extraction features.

[0182] The adversarial extraction feature obtaining module 806 is used to extract features from the current adversarial image to obtain adversarial extraction features.

[0183] The target image loss value obtaining module 808 is used to calculate the feature difference value between the adversarial extracted feature and the reference extracted feature, and obtain the target image loss value based on the feature difference value; the feature difference value is positively correlated with the target image loss value.

[0184] The target adversarial image obtaining module 810 is used to obtain an interference adjustment value based on the target image loss value, and adjust the pixel value of the current adversarial image based on the interference adjustment value to obtain a target adversarial image corresponding to the target image.

[0185] In some embodiments, there are multiple target images, and the reference feature extraction module 804 includes:

[0186] The target extraction feature obtaining unit is used to extract features from each target image to obtain target extraction features corresponding to each target image.

[0187] The current occurrence probability calculation unit is used to obtain the current feature distribution and calculate the current occurrence probability of each target extraction feature in the current feature distribution.

[0188] The target feature distribution obtaining unit is used to count the current occurrence probability corresponding to each target extraction feature, obtain the current probability statistical value, adjust the feature distribution parameters corresponding to the current feature distribution, so that the current probability statistical value changes in the direction of increasing, and obtain the target feature distribution.

[0189] The reference extraction feature obtaining unit is used to obtain the target representative feature corresponding to the target feature distribution to obtain the reference extraction feature.

[0190] In some embodiments, the current feature distribution includes a first current feature distribution and a second current feature distribution, and the current occurrence possibility includes a first current occurrence possibility corresponding to the first current feature distribution and a second current occurrence possibility corresponding to the second current feature distribution; the target feature distribution obtaining unit is also used to obtain a first current distribution weight corresponding to the first current feature distribution and a second current distribution weight corresponding to the second current feature distribution; based on the first current distribution weight and the first current occurrence possibility, the second current distribution weight and the second current occurrence possibility are weighted and summed to obtain the current occurrence possibility corresponding to the target extracted feature; the current occurrence possibility corresponding to each target extracted feature is counted to obtain the current possibility statistical value, and the distribution parameters, the first current distribution weight and the second current distribution weight corresponding to the first current feature distribution and the second current feature distribution are adjusted to make the current possibility statistical value change in the direction of increasing, and the first target feature distribution, the second target feature distribution, the first target distribution weight and the second target distribution weight are obtained.

[0191] In some embodiments, the reference extraction feature obtaining unit is also used to determine the possibility of occurrence of a first target of the adversarial extraction feature in the first target feature distribution, and obtain a first weighted possibility based on the first target distribution weight and the first target occurrence possibility; determine the possibility of occurrence of a second target of the adversarial extraction feature in the second target feature distribution, and obtain a second weighted possibility based on the second target distribution weight and the second target occurrence possibility; based on the first weighted possibility and the second weighted possibility, select the feature distribution with the largest possibility from the first target feature distribution and the second target feature distribution as the representative feature distribution; obtain the target representative feature corresponding to the representative feature distribution as the reference extraction feature.

[0192] In some embodiments, the target image loss value obtaining module 808 includes:

[0193] The first image loss value obtaining unit is used to obtain the first image loss value based on the feature difference value, and the feature difference value is positively correlated with the first image loss value.

[0194] The first confidence determination unit is used to determine a first confidence of the current adversarial image in the target image category based on the adversarial extraction feature.

[0195] The second image loss value obtaining unit is used to obtain the second image loss value based on the first confidence level; the second image loss value is negatively correlated with the first confidence level.

[0196] The target image loss value obtaining unit is used to obtain the target image loss value based on the first image loss value and the second image loss value.

[0197] In some embodiments, the second image loss value obtaining unit is also used to determine a second confidence of the current adversarial image in the adversarial image category based on the adversarial extraction feature; based on a first confidence difference value between the first confidence and the second confidence, obtain the second image loss value; the second image loss value is negatively correlated with the first confidence difference value.

[0198] In some embodiments, the target image loss value obtaining module 808 includes:

[0199] The first image loss value obtaining unit is used to obtain the first image loss value based on the feature difference value, and the feature difference value is positively correlated with the first image loss value.

[0200] The reference confidence determination unit is used to determine the reference confidence of the current adversarial image in each reference image category based on the adversarial extraction feature.

[0201] The third confidence obtaining unit is used to select the maximum confidence from each reference confidence as the third confidence.

[0202] The third image loss value obtaining unit is used to obtain a third image loss value based on a second confidence difference value between the first confidence and the third confidence; the third image loss value is negatively correlated with the second confidence difference value.

[0203] The target image loss value obtaining unit is used to obtain the target image loss value based on the first image loss value and the third image loss value.

[0204] In some embodiments, the target adversarial image obtaining module 810 includes:

[0205] The updated current adversarial image obtaining unit is used to adjust the pixel value of the current adversarial image based on the interference adjustment value when the second confidence difference value is less than the confidence difference threshold, so as to obtain an updated current adversarial image.

[0206] The target adversarial image obtaining unit is used to return to the step of extracting features from the current adversarial image to obtain adversarial extracted features until the second confidence difference value reaches the confidence difference threshold, and the current adversarial image is used as the target adversarial image corresponding to the target image.

[0207] In some embodiments, the target adversarial image obtaining module 810 includes:

[0208] The updated current adversarial image obtaining unit is used to adjust the pixel values ​​of the current adversarial image based on the interference adjustment value to obtain the updated current adversarial image.

[0209] The target adversarial image acquisition unit is used to calculate the current image difference value between the updated current adversarial image and the original adversarial image corresponding to the current adversarial image. When the current image difference value is less than the image difference threshold, the step of returning to extract features of the current adversarial image to obtain adversarial extracted features is continued until the current image difference value reaches the image difference threshold, and the current adversarial image is used as the target adversarial image corresponding to the target image.

[0210] In some embodiments, the interference adjustment value includes pixel adjustment values ​​corresponding to each pixel point, and the target confrontation image obtaining module 810 includes:

[0211] The pixel adjustment value obtaining unit is used to derive the target image loss value based on the pixel value of each pixel point of the current adversarial image to obtain the pixel adjustment value corresponding to each pixel point in the current adversarial image.

[0212] The pixel value adjustment unit is used to adjust the pixel values ​​of the pixel points in the current adversarial image based on the pixel adjustment values ​​corresponding to each pixel point, so as to obtain a target adversarial image corresponding to the target image.

[0213] In some embodiments, the apparatus further comprises:

[0214] The adversarial confidence obtaining module is used to input the target adversarial image into the image recognition model to be trained corresponding to the target image category, and obtain the adversarial confidence of the target adversarial image corresponding to the target image category.

[0215] The target model loss value determination module is used to determine the target model loss value based on the adversarial confidence; the target model loss value is positively correlated with the adversarial confidence.

[0216] The trained image recognition model obtaining module is used to adjust the model parameters of the image recognition model based on the target model loss value to obtain the trained image recognition model.

[0217] For the specific definition of the image processing device, please refer to the definition of the image processing method above, which will not be repeated here. Each module in the above image processing device can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0218] In some embodiments, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Fig. 9 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data involved in the image processing method. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an image processing method is implemented.

[0219] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0220] In some embodiments, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0221] In some embodiments, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0222] In some embodiments, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in the above-mentioned method embodiments.

[0223] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0224] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0225] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. An image processing method, characterized in that: The method comprises: Obtain multiple target images of the target image category and a current adversarial image corresponding to the adversarial image category; Performing feature extraction on each of the target images to obtain target extraction features corresponding to each of the target images, performing statistics on the current occurrence probability of each of the target extraction features in the current feature distribution to obtain a current probability statistical value, and adjusting the feature distribution parameters corresponding to the current feature distribution so that the current probability statistical value changes in a direction of increasing, thereby obtaining a target feature distribution; Acquire target representative features corresponding to the target feature distribution to obtain reference extraction features; Perform feature extraction on the current adversarial image to obtain adversarial extracted features; Calculating a feature difference value between the adversarial extracted feature and the reference extracted feature, and obtaining a target image loss value based on the feature difference value; the feature difference value is positively correlated with the target image loss value; An interference adjustment value is obtained based on the target image loss value, and a pixel value of the current adversarial image is adjusted based on the interference adjustment value to obtain a target adversarial image corresponding to the target image.

2. The method according to claim 1, characterized in that The current feature distribution includes a first current feature distribution and a second current feature distribution, and the current occurrence possibility includes a first current occurrence possibility corresponding to the first current feature distribution and a second current occurrence possibility corresponding to the second current feature distribution; The current occurrence probability of each target extraction feature in the current feature distribution is counted to obtain a current probability statistical value, and the feature distribution parameter corresponding to the current feature distribution is adjusted so that the current probability statistical value changes in a larger direction to obtain the target feature distribution. Obtaining a first current distribution weight corresponding to the first current feature distribution and a second current distribution weight corresponding to the second current feature distribution; Based on the first current distribution weight and the first current occurrence probability, the second current distribution weight and the second current occurrence probability are weighted summed to obtain the current occurrence probability corresponding to the target extraction feature; Statistics are performed on the current occurrence probability corresponding to each of the target extraction features to obtain the current probability statistical value, and the distribution parameters corresponding to the first current feature distribution and the second current feature distribution, the first current distribution weight, and the second current distribution weight are adjusted to make the current probability statistical value change in a larger direction, so as to obtain the first target feature distribution, the second target feature distribution, the first target distribution weight, and the second target distribution weight.

3. The method according to claim 2, characterized in that The acquiring the target representative feature corresponding to the target feature distribution to obtain the reference extraction feature comprises: Determine a first target occurrence probability of the adversarial extraction feature in the first target feature distribution, and obtain a first weighted probability based on the first target distribution weight and the first target occurrence probability; Determine the second target occurrence probability of the adversarial extraction feature in the second target feature distribution, and obtain a second weighted probability based on the second target distribution weight and the second target occurrence probability; Based on the first weighted probability and the second weighted probability, selecting a feature distribution with the largest probability from the first target feature distribution and the second target feature distribution as a representative feature distribution; The target representative feature corresponding to the representative feature distribution is obtained as the reference extraction feature.

4. The method according to claim 1, characterized in that: The obtaining of the target image loss value based on the feature difference value comprises: Obtaining a first image loss value based on the feature difference value, wherein the feature difference value is positively correlated with the first image loss value; Determine a first confidence level of the current adversarial image in the target image category based on the adversarial extracted features; Obtaining a second image loss value based on the first confidence level; the second image loss value is negatively correlated with the first confidence level; A target image loss value is obtained based on the first image loss value and the second image loss value.

5. The method according to claim 4, characterized in that The obtaining a second image loss value based on the first confidence level includes: Determine a second confidence level of the current adversarial image in the adversarial image category based on the adversarial extracted features; Based on a first confidence difference value between the first confidence and the second confidence, a second image loss value is obtained; the second image loss value is negatively correlated with the first confidence difference value.

6. The method according to claim 1, characterized in that The obtaining of the target image loss value based on the feature difference value comprises: Determine a first confidence level of the current adversarial image in the target image category based on the adversarial extracted features; Obtaining a first image loss value based on the feature difference value, wherein the feature difference value is positively correlated with the first image loss value; Determine the reference confidence of the current adversarial image in each reference image category based on the adversarial extracted features; Selecting the maximum confidence level from each of the reference confidence levels as the third confidence level; Based on a second confidence difference value between the first confidence and the third confidence, a third image loss value is obtained; the third image loss value is negatively correlated with the second confidence difference value; A target image loss value is obtained based on the first image loss value and the third image loss value.

7. The method according to claim 6, characterized in that The step of adjusting the pixel value of the current adversarial image based on the interference adjustment value to obtain a target adversarial image corresponding to the target image includes: When the second confidence difference value is less than the confidence difference threshold, adjusting the pixel value of the current adversarial image based on the interference adjustment value to obtain an updated current adversarial image; Return to the step of extracting features from the current adversarial image to obtain adversarial extracted features, until the second confidence difference value reaches a confidence difference threshold, and use the current adversarial image as a target adversarial image corresponding to the target image.

8. The method according to claim 1, characterized in that The step of adjusting the pixel value of the current adversarial image based on the interference adjustment value to obtain a target adversarial image corresponding to the target image includes: Adjusting pixel values ​​of the current adversarial image based on the interference adjustment value to obtain an updated current adversarial image; Calculate the current image difference value between the updated current adversarial image and the original adversarial image corresponding to the current adversarial image. When the current image difference value is less than the image difference threshold, return to the step of extracting features from the current adversarial image to obtain adversarial extracted features, until the current image difference value reaches the image difference threshold, and use the current adversarial image as the target adversarial image corresponding to the target image.

9. The method according to claim 1, characterized in that: The interference adjustment value includes pixel adjustment values ​​corresponding to each pixel point, and adjusting the pixel values ​​of the current adversarial image based on the interference adjustment value to obtain a target adversarial image corresponding to the target image includes: The target image loss value is derived based on the pixel value of each pixel point of the current adversarial image to obtain the pixel adjustment value corresponding to each pixel point in the current adversarial image; The pixel values ​​of the pixel points in the current adversarial image are adjusted based on the pixel adjustment values ​​respectively corresponding to the pixel points to obtain a target adversarial image corresponding to the target image.

10. The method according to claim 1, characterized in that The method further comprises: Inputting the target adversarial image into the image recognition model to be trained corresponding to the target image category, and obtaining the adversarial confidence of the target adversarial image corresponding to the target image category; Determining a target model loss value based on the adversarial confidence; the target model loss value is positively correlated with the adversarial confidence; The model parameters of the image recognition model are adjusted based on the target model loss value to obtain a trained image recognition model.

11. An image processing device, characterized in that: The device comprises: A current adversarial image acquisition module is used to acquire multiple target images of the target image category and a current adversarial image corresponding to the adversarial image category; A reference extraction feature acquisition module is used to extract features from each of the target images to obtain target extraction features corresponding to each of the target images, perform statistics on the current occurrence probability of each of the target extraction features in the current feature distribution to obtain a current probability statistical value, adjust the feature distribution parameters corresponding to the current feature distribution so that the current probability statistical value changes in a larger direction, obtain a target feature distribution, obtain a target representative feature corresponding to the target feature distribution, and obtain a reference extraction feature; An adversarial feature extraction module is used to extract features from the current adversarial image to obtain adversarial features; A target image loss value obtaining module, used for calculating a feature difference value between the adversarial extraction feature and the reference extraction feature, and obtaining a target image loss value based on the feature difference value; the feature difference value is positively correlated with the target image loss value; The target adversarial image obtaining module is used to obtain an interference adjustment value based on the target image loss value, adjust the pixel value of the current adversarial image based on the interference adjustment value, and obtain a target adversarial image corresponding to the target image.

12. The device according to claim 11, characterized in that The current feature distribution includes a first current feature distribution and a second current feature distribution, and the current occurrence possibility includes a first current occurrence possibility corresponding to the first current feature distribution and a second current occurrence possibility corresponding to the second current feature distribution; the reference extraction feature obtaining module is further used to: Obtaining a first current distribution weight corresponding to the first current feature distribution and a second current distribution weight corresponding to the second current feature distribution; Based on the first current distribution weight and the first current occurrence probability, the second current distribution weight and the second current occurrence probability are weighted summed to obtain the current occurrence probability corresponding to the target extraction feature; Statistics are performed on the current occurrence probability corresponding to each of the target extraction features to obtain the current probability statistical value, and the distribution parameters corresponding to the first current feature distribution and the second current feature distribution, the first current distribution weight, and the second current distribution weight are adjusted to make the current probability statistical value change in a larger direction, so as to obtain the first target feature distribution, the second target feature distribution, the first target distribution weight, and the second target distribution weight.

13. The device according to claim 12, characterized in that The reference feature extraction module is also used for: Determine a first target occurrence probability of the adversarial extraction feature in the first target feature distribution, and obtain a first weighted probability based on the first target distribution weight and the first target occurrence probability; Determine the second target occurrence probability of the adversarial extraction feature in the second target feature distribution, and obtain a second weighted probability based on the second target distribution weight and the second target occurrence probability; Based on the first weighted probability and the second weighted probability, selecting a feature distribution with the largest probability from the first target feature distribution and the second target feature distribution as a representative feature distribution; The target representative feature corresponding to the representative feature distribution is obtained as the reference extraction feature.

14. The device according to claim 11, characterized in that The target image loss value obtaining module is also used for: Obtaining a first image loss value based on the feature difference value, wherein the feature difference value is positively correlated with the first image loss value; Determine a first confidence level of the current adversarial image in the target image category based on the adversarial extracted features; Obtaining a second image loss value based on the first confidence level; the second image loss value is negatively correlated with the first confidence level; A target image loss value is obtained based on the first image loss value and the second image loss value.

15. The device according to claim 14, characterized in that The target image loss value obtaining module is also used for: Determine a second confidence level of the current adversarial image in the adversarial image category based on the adversarial extracted features; Based on a first confidence difference value between the first confidence and the second confidence, a second image loss value is obtained; the second image loss value is negatively correlated with the first confidence difference value.

16. The device according to claim 11, characterized in that The target image loss value obtaining module is also used for: Determine a first confidence level of the current adversarial image in the target image category based on the adversarial extracted features; Obtaining a first image loss value based on the feature difference value, wherein the feature difference value is positively correlated with the first image loss value; Determine the reference confidence of the current adversarial image in each reference image category based on the adversarial extracted features; Selecting the maximum confidence level from each of the reference confidence levels as the third confidence level; Based on a second confidence difference value between the first confidence and the third confidence, a third image loss value is obtained; the third image loss value is negatively correlated with the second confidence difference value; A target image loss value is obtained based on the first image loss value and the third image loss value.

17. The device according to claim 16, characterized in that The target adversarial image obtaining module is further used for: When the second confidence difference value is less than the confidence difference threshold, adjusting the pixel value of the current adversarial image based on the interference adjustment value to obtain an updated current adversarial image; Return to the step of extracting features from the current adversarial image to obtain adversarial extracted features, until the second confidence difference value reaches a confidence difference threshold, and use the current adversarial image as a target adversarial image corresponding to the target image.

18. The device according to claim 11, characterized in that The target adversarial image obtaining module is further used for: Adjusting pixel values ​​of the current adversarial image based on the interference adjustment value to obtain an updated current adversarial image; Calculate the current image difference value between the updated current adversarial image and the original adversarial image corresponding to the current adversarial image. When the current image difference value is less than the image difference threshold, return to the step of extracting features from the current adversarial image to obtain adversarial extracted features, until the current image difference value reaches the image difference threshold, and use the current adversarial image as the target adversarial image corresponding to the target image.

19. The device according to claim 11, characterized in that The interference adjustment value includes pixel adjustment values ​​corresponding to each pixel point respectively, and the target adversarial image obtaining module is further used for: The target image loss value is derived based on the pixel value of each pixel point of the current adversarial image to obtain the pixel adjustment value corresponding to each pixel point in the current adversarial image; The pixel values ​​of the pixel points in the current adversarial image are adjusted based on the pixel adjustment values ​​respectively corresponding to the pixel points to obtain a target adversarial image corresponding to the target image.

20. The device according to claim 11, characterized in that The device is also used for: Inputting the target adversarial image into the image recognition model to be trained corresponding to the target image category, and obtaining the adversarial confidence of the target adversarial image corresponding to the target image category; Determining a target model loss value based on the adversarial confidence; The target model loss value is positively correlated with the adversarial confidence; The model parameters of the image recognition model are adjusted based on the target model loss value to obtain a trained image recognition model.

21. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

22. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

23. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images