Image attack detection, image attack detection model training method and device

Abstract

The present application relates to an image attack detection method, apparatus, computer equipment, and storage medium. The method comprises: acquiring an image to be detected, performing global classification and recognition based on the image to be detected to obtain a global classification and recognition result; randomly extracting local images based on the image to be detected to obtain a target number of local images, where the target number is calculated based on the defense rate of a reference image corresponding to the image to be detected; performing local classification and recognition based on the target number of local images to obtain local classification and recognition results, fusing the local classification and recognition results to obtain a target classification and recognition result; and detecting the consistency of the recognition result based on the target classification and recognition result and the global recognition result. When the target classification and recognition result are inconsistent with the global classification and recognition result, the image to be detected is determined to be an attack image. This method can improve the accuracy of image attack detection and reduce security risks.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an image attack detection, an image attack detection model training method, an apparatus, a computer device, and a storage medium. Background Art

[0002] With the development of image recognition technology, image adversarial attack techniques have emerged. For example, physical attacks (the attack area can be physically generated through methods such as 3D printing) can be used to attack image recognition, causing the image recognition results to be incorrect, which can easily pose a security risk. Currently, pre-processing or post-processing methods are usually used to modify the pixel values ​​of the attack area to destroy the physical attack effect, such as adding image filtering or color transformation. However, current defenses against physical attacks are very easy to circumvent, which reduces the accuracy of image attack detection and creates security risks. Summary of the Invention

[0003] Based on this, it is necessary to provide an image attack detection, image attack detection model training method, device, computer equipment and storage medium that can improve the accuracy of image attack detection in response to the above technical problems.

[0004] A method for detecting image attacks, comprising:

[0005] Acquire an image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result;

[0006] Randomly extract local images based on the image to be detected to obtain the target number of local images. The target number is calculated based on the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to represent the defense level of the reference image when it is attacked by an image.

[0007] Perform local classification and recognition on the local images of the target number respectively to obtain the local classification and recognition results, and fuse the local classification and recognition results to obtain the target classification and recognition results;

[0008] The consistency of the recognition results is detected based on the target classification recognition result and the global recognition result. When the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is judged as an attack image.

[0009] An image attack detection device, comprising:

[0010] A global classification module is used to obtain an image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result;

[0011] The local extraction module is used to randomly extract local images based on the image to be detected to obtain a target number of local images. The target number is calculated based on the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to represent the defense level of the reference image when it is attacked by an image.

[0012] The local classification module is used to perform local classification and recognition based on the local images of the target number, obtain the local classification and recognition results, and fuse the local classification and recognition results to obtain the target classification and recognition result;

[0013] The detection module is used to detect the consistency of the recognition results based on the target classification recognition results and the global recognition results. When the target classification recognition results and the global classification recognition results are inconsistent, the image to be detected is judged to be an attack image.

[0014] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0015] Acquire an image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result;

[0016] Randomly extract local images based on the image to be detected to obtain the target number of local images. The target number is calculated based on the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to represent the defense level of the reference image when it is attacked by an image.

[0017] Perform local classification and recognition on the local images of the target number respectively to obtain the local classification and recognition results, and fuse the local classification and recognition results to obtain the target classification and recognition results;

[0018] The consistency of the recognition results is detected based on the target classification recognition result and the global recognition result. When the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is judged as an attack image.

[0019] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0020] Acquire an image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result;

[0021] Randomly extract local images based on the image to be detected to obtain the target number of local images. The target number is calculated based on the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to represent the defense level of the reference image when it is attacked by an image.

[0022] Perform local classification and recognition on the local images of the target number respectively to obtain the local classification and recognition results, and fuse the local classification and recognition results to obtain the target classification and recognition results;

[0023] The consistency of the recognition results is detected based on the target classification recognition result and the global recognition result. When the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is judged as an attack image.

[0024] The above-mentioned image attack detection method, apparatus, computer device, and storage medium obtain an image to be detected and perform global classification and recognition based on the image to be detected to obtain a global classification and recognition result. Since the global recognition result of a real image is consistent with any local recognition result, and image attacks performed through physical attacks cannot change each local recognition result, a target number of local images can be randomly extracted. This target number is calculated based on the defense rate of a reference image corresponding to the image to be detected. The defense rate of the reference image is used to represent the defense level of the reference image when subjected to image attacks. The local classification and recognition results are then identified and fused. When the target classification and recognition result obtained is inconsistent with the global classification and recognition result, the image to be detected is determined to be an attack image, thereby improving the accuracy of image attack detection and reducing security risks.

[0025] A method for training an image attack detection model, the method comprising:

[0026] Obtain training data, which includes training images and image attack category labels;

[0027] Input the training image into the global image classification and recognition model for global classification and recognition, and obtain the training global classification and recognition result vector;

[0028] Randomly extract local images based on the training image to obtain the number of training target local images. The number of training targets is calculated by the defense rate of the training reference image corresponding to the training image. The defense rate of the training reference image is used to represent the defense degree of the training reference image when it is attacked by an image.

[0029] Inputting the target number of training local images into the local image classification and recognition model for local classification and recognition, respectively, obtains each training local classification and recognition result vector, and fuses each training local classification and recognition result vector to obtain the target training classification and recognition result vector;

[0030] Input the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection on the recognition results and obtain the initial consistency detection result;

[0031] The initial image attack detection model is updated based on the initial consistency detection result and the image attack category label, and the target training classification recognition result vector and the training global classification recognition result vector are input into the initial image attack detection model for consistency detection of the recognition results. The steps of obtaining the initial consistency detection result are executed until the training is completed to obtain the target image attack detection model.

[0032] In one embodiment, the method further includes:

[0033] Obtaining a training global size of the training image, and obtaining a training reference image based on the training global size of the training image, wherein the training reference image includes a preset training reference attack area, and the training reference attack area is determined according to an upper limit size of the preset training attack area;

[0034] Calculating parameters based on the training global size and the preset upper limit size of the training attack area to obtain a weight parameter of a training target local image, wherein the training target local image contains image content of the training reference attack area;

[0035] Obtaining a number of training reference partial image extractions, and randomly performing partial image extraction on the training reference image based on the number of training reference partial image extractions to obtain partial images of the number of training reference partial image extractions;

[0036] Performing local classification and recognition based on the number of local images extracted from the training reference local images to obtain local classification and recognition results of the number of local images extracted from the training reference local images, and performing statistical calculations based on the local classification and recognition results of the number of local images extracted from the training reference local images to obtain a lower limit number of extractions of the training target local images;

[0037] A binomial distribution summation calculation is performed based on the lower limit number of extractions of the training target partial image, the number of extractions of the training reference partial image, and the weight parameter of the training target partial image to obtain a defense rate corresponding to the training reference image;

[0038] When the defense rate corresponding to the training reference image meets a preset condition, the number of the training reference partial images extracted is used as the training target number.

[0039] In one embodiment, the parameter calculation based on the training global size and the preset training attack area upper limit size to obtain the weight parameter of the training target local image includes:

[0040] Determine a training local size based on the training global size, and calculate a total number of training local images that can be extracted from the training reference image based on the training global size and the training local size;

[0041] Calculating the total number of training target local images that can be extracted from the training reference image based on the training global size, the training local size, and the preset training attack area upper limit size;

[0042] The ratio of the total number of the training target partial images to the total number of the training partial images is calculated to obtain a weight parameter of the training target partial images.

[0043] In one embodiment, the statistical calculation of the local classification recognition results based on the number of extractions of the training reference local images to obtain the lower limit number of extractions of the training target local images includes:

[0044] Counting the number of first training categories and the number of second training categories in the local classification recognition results of the training reference local image extraction number, where the first training category refers to the category with the largest number in the local classification recognition results of the training reference local image extraction number, and the second training category refers to the category with the largest number other than the first training category in the local classification recognition results of the training reference local image extraction number;

[0045] The lower limit number of extraction of the training target partial image is calculated based on the number of the first training categories and the number of the second training categories.

[0046] In one embodiment, the training of the global image classification recognition model includes the following steps:

[0047] Acquire global training data, where the global training data includes global training images and corresponding global category labels;

[0048] Inputting the global training image into an initial global image classification and recognition model to perform global image classification and recognition, thereby obtaining an initial global classification and recognition result;

[0049] Performing loss calculation based on the initial global classification recognition result and the global category label to obtain global loss information;

[0050] Reversely updating the parameters in the initial global image classification and recognition model based on the global loss information to obtain an updated global image classification and recognition model;

[0051] The updated global image classification and recognition model is used as the initial global image classification and recognition model, and the step of inputting the global training image into the initial global image classification and recognition model for global image classification and recognition to obtain the initial global classification and recognition result is executed until the global training completion condition is met, and the initial global image classification and recognition model when the global training completion condition is met is used as the global image classification and recognition model.

[0052] In one embodiment, the reverse updating of the parameters in the initial global image classification and recognition model based on the global loss information to obtain an updated global image classification and recognition model includes:

[0053] Get the current learning rate;

[0054] The parameters of the initial global image classification and recognition model are reversely updated based on the current learning rate and the global loss information to obtain an updated global image classification and recognition model.

[0055] In one embodiment, obtaining the current learning rate includes:

[0056] Obtain a historical learning rate, and adjust the historical learning rate using a preset cosine function to obtain a current learning rate.

[0057] In one embodiment, the training of the local image classification recognition model includes the following steps:

[0058] Using the global image classification and recognition model as an initial local image classification and recognition model;

[0059] Acquire local training data, where the local training data includes local training images and corresponding local image category labels;

[0060] Inputting the local training image into the initial local image classification and recognition model to perform local classification and recognition to obtain an initial local classification and recognition result;

[0061] Performing loss calculation based on the initial local classification and recognition result and the local image category label to obtain local loss information, and reversely updating the initial local image classification and recognition model based on the local loss information to obtain an updated local image classification and recognition model;

[0062] The updated local image classification and recognition model is used as the initial local image classification and recognition model, and the step of inputting the local training image into the initial local image classification and recognition model for local classification and recognition to obtain the initial local classification and recognition result is executed until the local training completion condition is met, and the initial local image classification and recognition model when the local training completion condition is met is used as the local image classification and recognition model.

[0063] A device for training an image attack detection model, comprising:

[0064] A data acquisition module is used to obtain training data, which includes training images and image attack category labels;

[0065] A training global classification module is used to input the training image into the global image classification and recognition model for global classification and recognition, and obtain a training global classification and recognition result vector;

[0066] A training local extraction module is used to randomly extract local images based on the training image to obtain a training target number of training local images. The number of training targets is calculated by the defense rate of the training reference image corresponding to the training image. The defense rate of the training reference image is used to represent the defense degree of the training reference image when it is attacked by an image.

[0067] A training local classification module is used to input a target number of training local images into a local image classification and recognition model for local classification and recognition, obtain individual training local classification and recognition result vectors, and fuse the individual training local classification and recognition result vectors to obtain a target training classification and recognition result vector;

[0068] The training detection module is used to input the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection on the recognition results and obtain an initial consistency detection result;

[0069] The iteration module is used to update the initial image attack detection model based on the initial consistency detection result and the image attack category label, and return the target training classification recognition result vector and the training global classification recognition result vector to the initial image attack detection model for consistency detection of the recognition results. The steps of obtaining the initial consistency detection result are executed until the training is completed to obtain the target image attack detection model.

[0070] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0071] Obtain training data, which includes training images and image attack category labels;

[0072] Input the training image into the global image classification and recognition model for global classification and recognition, and obtain the training global classification and recognition result vector;

[0073] Randomly extract local images based on the training image to obtain the number of training target local images. The number of training targets is calculated by the defense rate of the training reference image corresponding to the training image. The defense rate of the training reference image is used to represent the defense degree of the training reference image when it is attacked by an image.

[0074] Inputting the target number of training local images into the local image classification and recognition model for local classification and recognition, respectively, obtains each training local classification and recognition result vector, and fuses each training local classification and recognition result vector to obtain the target training classification and recognition result vector;

[0075] Input the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection on the recognition results and obtain the initial consistency detection result;

[0076] The initial image attack detection model is updated based on the initial consistency detection result and the image attack category label, and the target training classification recognition result vector and the training global classification recognition result vector are input into the initial image attack detection model for consistency detection of the recognition results. The steps of obtaining the initial consistency detection result are executed until the training is completed to obtain the target image attack detection model.

[0077] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0078] Obtain training data, which includes training images and image attack category labels;

[0079] Input the training image into the global image classification and recognition model for global classification and recognition, and obtain the training global classification and recognition result vector;

[0080] Randomly extract local images based on the training image to obtain the number of training target local images. The number of training targets is calculated by the defense rate of the training reference image corresponding to the training image. The defense rate of the training reference image is used to represent the defense degree of the training reference image when it is attacked by an image.

[0081] Inputting the target number of training local images into the local image classification and recognition model for local classification and recognition, respectively, obtains each training local classification and recognition result vector, and fuses each training local classification and recognition result vector to obtain the target training classification and recognition result vector;

[0082] Input the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection on the recognition results and obtain the initial consistency detection result;

[0083] The initial image attack detection model is updated based on the initial consistency detection result and the image attack category label, and the target training classification recognition result vector and the training global classification recognition result vector are input into the initial image attack detection model for consistency detection of the recognition results. The steps of obtaining the initial consistency detection result are executed until the training is completed to obtain the target image attack detection model.

[0084] In the above-mentioned image attack detection model training method, the training image is input into the global image classification and recognition model for global classification and recognition to obtain a training global classification and recognition result vector; local images are randomly extracted based on the training image to obtain a training target number of training local images, where the training target number is calculated by the defense rate of the training reference image corresponding to the training image, and the defense rate of the training reference image is used to characterize the defense degree of the training reference image when it is attacked by an image; the target number of training local images are respectively input into the local image classification and recognition model for local classification and recognition to obtain respective training local classification and recognition result vectors, and the respective training local classification and recognition result vectors are fused to obtain a target training classification and recognition result vector; the target training classification and recognition result vector and the training global classification and recognition result vector are input into the initial image attack detection model for consistency detection of the recognition results to obtain an initial consistency detection result; the initial image attack detection model is updated based on the initial consistency detection result and the image attack category label and iterated cyclically to obtain a target image attack detection model, that is, the target image attack detection model obtained by training the target training classification and recognition result vector and the training global classification and recognition result can improve the accuracy of consistency detection of the target image attack detection model, thereby improving the accuracy of image attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] Figure 1 A diagram showing an application environment of an image attack detection method in one embodiment;

[0086] Figure 2 1 is a flow chart of an image attack detection method according to an embodiment;

[0087] Figure 3 1 is a flow chart of an image attack detection method according to another embodiment;

[0088] Figure 4 A schematic diagram of a process for obtaining a target quantity in one embodiment;

[0089] Figure 5 Schematic diagram of a process for training an image attack detection model in one embodiment;

[0090] Figure 6 A schematic diagram of a process for obtaining the number of training targets in one embodiment;

[0091] Figure 7 Schematic diagram of a process for obtaining a training local image in one embodiment;

[0092] Figure 8 A schematic diagram of a training result of a local image binarization in a specific embodiment;

[0093] Figure 9 A schematic diagram of a process for obtaining a global image classification and recognition model in one embodiment;

[0094] Figure 10 is a schematic diagram of a learning rate variation function in a specific embodiment;

[0095] Figure 11 A schematic diagram of a process for obtaining a local image classification and recognition model in one embodiment;

[0096] Figure 12 1 is a flow chart of an image attack detection method according to a specific embodiment;

[0097] Figure 13 A schematic diagram of attacking an attack image in a specific embodiment;

[0098] Figure 14 for Figure 13 A schematic diagram of the architecture of an image attack detection method in a specific embodiment;

[0099] Figure 15 is a structural block diagram of an image attack detection device in one embodiment;

[0100] Figure 16 A structural block diagram of an image attack detection model training device in one embodiment

[0101] Figure 17 is a diagram of the internal structure of a computer device in one embodiment;

[0102] Figure 18 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0103] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0104] Computer vision (CV) is the science of making machines "see." Specifically, it refers to machine vision, where cameras and computers replace the human eye in identifying and measuring objects, performing further image processing to create images more suitable for human observation or transmission to instruments. As a scientific discipline, computer vision studies related theories and technologies, attempting to build artificial intelligence systems capable of extracting information from images or multidimensional data. Computer vision technologies typically include image processing, image recognition, image semantic understanding, image retrieval, optical character recognition (OCR), video processing, video semantic understanding, video content / behavior recognition, three-dimensional object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping, and common biometric recognition technologies such as facial recognition and fingerprint recognition.

[0105] The solutions provided in the embodiments of the present application involve technologies such as artificial intelligence image recognition, which are specifically described through the following embodiments:

[0106] The image attack detection method provided in this application can be applied to Figure 1In the application environment shown, the terminal 102 communicates with the server 104 via a network. The server 104 obtains the image to be detected sent by the terminal 102, performs global classification and recognition based on the image to be detected, and obtains a global classification and recognition result. The server 104 randomly extracts local images based on the image to be detected to obtain a target number of local images. The target number is calculated based on the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to represent the defense level of the reference image when it is attacked by an image. The server 104 performs local classification and recognition based on the target number of local images to obtain local classification and recognition results, and fuses the local classification and recognition results to obtain a target classification and recognition result. The server 104 detects the consistency of the recognition result based on the target classification and recognition result and the global recognition result. When the target classification and recognition result are inconsistent with the global classification and recognition result, the server 104 determines that the image to be detected is an attack image. The server 104 sends the detection result to the terminal for display and can also save the detection result to the database 106. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices. The server 104 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited to these. The terminal and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in this application.

[0107] In one embodiment, Figure 2 As shown, an image attack detection method is provided, which is applied to Figure 1 The server in the example is used for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and implemented through the interaction between the terminal and the server. In this embodiment, the following steps are included:

[0108] Step 202: Acquire the image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result.

[0109] The image to be tested refers to the image that requires image attack detection to determine whether it is a real image or an attack image. A real image refers to a real image, and an attack image refers to an adversarial attack image. Adversarial attacks involve perturbing an image to cause classification errors. Physical attacks are a key branch of this technique. Physical attacks involve applying unrestricted perturbations to a localized area of ​​the image, creating an attack zone. Because this attack zone can be physically generated through methods such as 3D printing, the perturbation is large and less susceptible to environmental interference, posing a greater risk of safety hazards. The image to be tested can be any image whose content requires classification and recognition, such as facial images for face recognition, face detection, and liveness detection. It can also be an image of an object for object classification, such as images of cars or obstacles. It can also be an image of a species for species classification, such as images of cats and dogs. The global classification and recognition result refers to the overall classification and recognition result of the image to be tested.

[0110] Specifically, the server can obtain the image to be detected from a terminal, from a server, from the internet, or from a service server. The server then performs global classification and recognition on the image to be detected, obtaining a global classification and recognition result. A global image classification and recognition model can be pre-established using a neural network algorithm and deployed on the server. When the image to be detected is obtained, the global image classification and recognition model is invoked to perform global classification and recognition on the image to be detected, thereby obtaining a global classification and recognition result.

[0111] In step 204, local images are randomly extracted based on the image to be detected to obtain a target number of local images. The target number is calculated based on the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to represent the defense level of the reference image when it is attacked by an image.

[0112] The reference image is used to determine the number of partial images to be extracted. Its size matches that of the image to be detected. The defense rate of the reference image indicates its defense against image attacks. This defense rate indicates the likelihood that the image attack detection result will be an attacking image when the reference image is an attacking image.

[0113] Specifically, the server randomly extracts local images based on the image to be detected according to the target number, and obtains the target number of local images, wherein each time a local image is extracted, it is extracted on the entire image to be detected, ensuring that each local image extraction is independent of each other and has no dependencies. The size of the extracted local images is predetermined, and the size of all local images is the same. In one embodiment, the size of the local image can be determined according to a preset proportional relationship between the local image size and the overall image size, or can be determined according to a preset size relationship between the local image area and the overall image area. The target number can be calculated in advance based on the defense rate of the reference image corresponding to the image to be detected, and the defense rate of the reference image is used to characterize the degree of defense of the reference image when it is attacked by an image.

[0114] Step 206 , performing local classification and recognition based on the local images of the target number to obtain local classification and recognition results, and fusing the local classification and recognition results to obtain the target classification and recognition result.

[0115] The local classification and recognition result refers to the result obtained after classification and recognition of the local image, and the target classification and recognition result refers to the result obtained by integrating the local classification and recognition results.

[0116] Specifically, the server performs local classification and recognition on the target number of local images respectively to obtain each local classification and recognition result. Among them, a local image classification and recognition model established by a neural network algorithm can be first used and deployed in the server. When the image to be detected is obtained, the local image classification and recognition model is called to perform local classification and recognition on the local image, thereby obtaining a local classification and recognition result. Local classification and recognition are performed on each local image in turn to obtain the local classification and recognition results of the target number, and the local classification and recognition results of the target number are added to obtain the total local classification and recognition result, and then the average calculation is performed based on the total local classification and recognition result and the target number to obtain the target classification and recognition result. In one embodiment, the server can also first perform weighted processing on the local classification and recognition results of the target number to obtain the weighted local classification and recognition results, and then the average calculation is performed based on the weighted local classification and recognition results and the target number to obtain the target classification and recognition result.

[0117] Step 208 : detecting consistency of the recognition results based on the target classification recognition result and the global recognition result. When the target classification recognition result and the global classification recognition result are inconsistent, determining that the image to be detected is an attack image.

[0118] Specifically, the server determines the consistency of the target classification recognition result and the global recognition result detection recognition result, wherein the target classification recognition result and the global recognition result detection recognition result can be matched, and the consistency can be determined based on the matching result, or the similarity between the target classification recognition result and the global recognition result detection recognition result can be calculated, and the consistency can be determined based on the similarity. Consistency detection and recognition can also be performed using a pre-established image attack detection model. When the target classification recognition result and the global classification recognition result are inconsistent, it means that the global classification recognition result is an erroneous result formed after the counter-attack, and the image to be detected is judged to be an attack image. When the target classification recognition result and the global classification recognition result are consistent, it means that the global classification recognition result is a true result, and the image to be detected is judged to be a true image.

[0119] The above-mentioned image attack detection method, apparatus, computer device, and storage medium obtain an image to be detected and perform global classification and recognition based on the image to be detected to obtain a global classification and recognition result. Since the global recognition result of a real image is consistent with any local recognition result, and image attacks performed through physical attacks cannot change each local recognition result, a target number of local images can be randomly extracted. This target number is calculated based on the defense rate of a reference image corresponding to the image to be detected. The defense rate of the reference image is used to represent the defense level of the reference image when subjected to image attacks. The local classification and recognition results are then identified and fused. When the target classification and recognition result obtained is inconsistent with the global classification and recognition result, the image to be detected is determined to be an attack image, thereby improving the accuracy of image attack detection and reducing security risks.

[0120] In one embodiment, Figure 3 As shown, the image attack detection method further includes:

[0121] Step 302: Input the image to be detected into the global image classification and recognition model for global classification and recognition to obtain a global classification and recognition result vector.

[0122] Among them, the global image classification and recognition model refers to an image classification and recognition model obtained by training the entire image through a neural network algorithm, which is used to classify and recognize the entire image, wherein the neural network algorithm can be a CNN (Convolutional Neural Networks, convolutional neural network) algorithm, RNN (Recurrent Neural Network, recurrent neural network), etc. In a specific embodiment, the neural network algorithm can be a ResNet18 (residual network) network algorithm or a VGGNet (deep convolutional neural network) network algorithm, an Inception (a convolutional neural network structure) network algorithm, a DenseNet (Densely Connected Convolutional Networks, dense convolutional neural network) network algorithm, etc.

[0123] Specifically, the server can use the entire image to train a neural network algorithm in advance to obtain a global image classification and recognition model, and deploy the global image classification and recognition model for use. When the image to be detected is obtained, the server inputs the image to be detected into the global image classification and recognition model for global classification and recognition, and obtains an output global classification and recognition result vector. The global classification and recognition result vector refers to the classification probability vector of the entire image to be detected, that is, each element in the global classification and recognition result vector is used to characterize the probability of the corresponding category. In one embodiment, the image to be detected can also be input into the global image classification and recognition model for global classification and recognition, and the feature map output by the convolution layer during global classification and recognition is obtained as the global classification and recognition result vector.

[0124] Step 304 : randomly extracting local images based on the image to be detected to obtain a target number of local images.

[0125] In step 306 , the target number of local images are respectively input into the local image recognition model for local classification and recognition to obtain local classification and recognition result vectors, and the local classification and recognition result vectors are fused to obtain the target classification and recognition result vector.

[0126] The local image recognition model refers to a model trained using a neural network algorithm using local images, or it can be a model obtained by further training a global image recognition model using local images. This local image recognition model is used to classify and recognize local images. The local classification recognition result vector refers to the classification probability vector corresponding to the local image, that is, each element in the local classification recognition result vector represents the probability of the corresponding category. The target classification recognition result vector refers to the fused local classification recognition result vector, which represents the classification recognition result obtained when using the local image for classification and recognition.

[0127] Specifically, the server calculates the number of targets based on the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to characterize the degree of defense of the reference image when it is attacked by an image. Then, local images are randomly extracted from the image to be detected according to the number of targets to obtain the target number of local images. The server inputs each local image into the local image recognition model for local classification and recognition to obtain each local classification and recognition result vector. In one embodiment, the local image can also be input into the local image classification and recognition model for local classification and recognition, and the feature map output by the convolution layer during the local classification and recognition is obtained as the local classification and recognition result vector. The server then fuses the various local classification and recognition result vectors to obtain the target classification and recognition result vector.

[0128] In one embodiment, the server may calculate the average vector of each local classification recognition result vector to obtain the target classification recognition result vector. That is, the server may calculate the vector sum of each local classification recognition result vector, then calculate the ratio of the vector sum to the number of targets to obtain the average vector, and use the average vector as the target classification recognition result vector.

[0129] In one embodiment, the server may also obtain the weights corresponding to the local classification recognition result vectors and perform a weighted average of the weights corresponding to the local classification recognition result vectors to obtain the target classification recognition result vector. The weights corresponding to the local classification recognition result vectors may be determined based on the importance of the local image, which may be calculated using a CAM (Class Activation Mapping) algorithm.

[0130] In step 308 , the target classification recognition result vector and the global classification recognition result vector are input into the image attack detection model for consistency detection. When the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is determined to be an attack image.

[0131] The image attack detection model is used to test the consistency between the target classification recognition result vector and the global classification recognition result, thereby obtaining a model that determines whether the image being detected is an attack image or a real image. The image attack detection model is a binary classification model, pre-trained using the target classification recognition result vector of the training image and the global classification recognition result using a binary classification algorithm. The binary classification algorithm can be a linear regression algorithm, a support vector machine algorithm, a neural network algorithm, a decision tree algorithm, a random forest algorithm, and so on.

[0132] Specifically, when the server obtains the target classification recognition result vector and the global classification recognition result vector, it can directly input the target classification recognition result vector and the global classification recognition result vector into the image attack detection model for consistency detection. When the image attack detection model determines that the target classification recognition result and the global classification recognition result are inconsistent, it outputs the detection result that the image to be detected is an attack image.

[0133] In one embodiment, the server concatenates the target local recognition result vector and the global recognition result vector to obtain a concatenated vector. The concatenation can be performed with the target local recognition result vector first and the global recognition result vector second, or with the global recognition result vector first and the target local recognition result vector second. The concatenation vector is then input into an image attack detection model, which detects the consistency between the target local recognition result vector and the global recognition result vector. If the target classification recognition result and the global classification recognition result are consistent, the model outputs a detection result indicating that the image to be detected is a true image. If the target classification recognition result and the global classification recognition result are inconsistent, the model outputs a detection result indicating that the image to be detected is an attack image.

[0134] In the above embodiment, the global image recognition model is used to perform global classification and recognition on the image to be detected, and the local image is locally classified and recognized by the local image recognition model. Finally, the consistency of the target local recognition result vector and the global recognition result vector is detected by the image attack detection model to obtain the image detection result, which not only improves the accuracy of image attack detection, but also improves the efficiency of image attack detection.

[0135] In one embodiment, the detection results of the image to be detected in the image attack detection method of the present application can be saved on the blockchain to ensure the security and non-tamperability of the data.

[0136] In one embodiment, Figure 4 As shown, the image attack detection method further includes:

[0137] Step 402 : obtaining the global size of the image to be detected, and obtaining a reference image based on the global size of the image to be detected, wherein the reference image includes a preset reference attack area, and the reference attack area is determined according to an upper limit size of the preset attack area.

[0138] The global size refers to the width and height of the image to be detected. The reference attack area refers to the pre-set attack area in the reference image. The preset attack area upper limit size refers to the pre-set maximum width and height of the attack area.

[0139] Specifically, the server obtains the global size of the image to be detected. Different image classification and recognition scenarios involve classifying and recognizing images of different sizes. Images of different sizes correspond to different numbers of targets. Once the server obtains the global size of the image to be detected, it can retrieve a reference image based on the global size of the image to be detected. The reference image's global size matches that of the image to be detected. This reference image contains a preset reference attack area, which is determined based on the preset upper limit size of the attack area.

[0140] Step 404 , performing parameter calculation based on the global size and the preset upper limit size of the attack area to obtain a weight parameter of the target local image, wherein the target local image contains image content of the reference attack area.

[0141] The target partial image refers to the partial image containing the image content of the reference attack region, and the partial image is the partial image corresponding to the reference image. The target partial image can contain part of the reference attack region or all of the reference attack region. The target partial image weight parameter is the ratio of the number of target partial images corresponding to the reference image to the total number of partial images. The target partial image weight parameter is used to indicate the likelihood of extracting the target partial image during image extraction.

[0142] Specifically, the server may determine the local size of the local image to be extracted from the reference image based on the global size, and then perform parameter calculation using the global size, the local size, and a preset upper limit size of the attack area to obtain a weight parameter of the target local image.

[0143] In one embodiment, step 404, performing parameter calculation based on the global size and the preset upper limit size of the attack area to obtain the weight parameter of the target local image, includes the following steps:

[0144] The local size is determined based on the global size. The total number of local images that can be extracted from the reference image is calculated based on the global and local sizes. The total number of target local images that can be extracted from the reference image is calculated based on the global size, local size, and the preset upper limit size of the attack area. The ratio of the total number of target local images to the total number of local images is calculated to obtain the target local image weight parameter.

[0145] The total number of partial images that can be extracted from the reference image refers to the maximum number of partial images that can be extracted when performing partial image extraction on the reference image. The total number of target partial images refers to the maximum number of target partial images that can be extracted when performing partial image extraction on the reference image.

[0146] Specifically, the server can determine the local size of the reference image's global size based on a pre-set ratio between the global and local images. This local size is the size of the local image extracted from the reference image. The server then uses the global and local sizes to calculate the total number of local images that can be extracted from the reference image. Furthermore, the server uses the global, local, and preset upper limit sizes of the attack area to calculate the total number of target local images that can be extracted from the reference image. Finally, the server calculates the ratio of the total number of target local images to the total number of local images to obtain a weight parameter for the target local images.

[0147] In a specific embodiment, the server may use the following formula (1) to calculate the total number of partial images that can be extracted from the reference image.

[0148] n all =(wk i +1)×(hk j +1)Formula (1)

[0149] Among them, n all Represents the total number of local images, w represents the width in the global size, and h represents the height in the global size. i Indicates the width of the local size, k j The server can use the following formula (2) to calculate the total number of target local images that can be extracted from the reference image.

[0150]

[0151] Among them, n adv Indicates the total number of target local images, p i Indicates the width of the preset upper limit size of the attack area, p j The server can use the following formula (3) to calculate the weight parameter of the target local image.

[0152]

[0153] Among them, p la Represents the weight parameter of the target local image.

[0154] Step 406 , obtaining a reference partial image extraction quantity, and randomly performing partial image extraction on the reference image based on the reference partial image extraction quantity to obtain partial images corresponding to the reference partial image extraction quantity.

[0155] The reference partial image extraction quantity refers to the partial image extraction quantity to be determined.

[0156] Specifically, the server may obtain the reference partial image extraction number from the terminal or from a database. The server randomly extracts partial images from the reference image according to the reference partial image extraction number to obtain the reference partial image extraction number of partial images. The server extracts the partial images independently, i.e., each time the server extracts a partial image, it uses the reference partial image as the basis.

[0157] Step 408, performing local classification and recognition on the local images based on the reference local image extraction quantity to obtain the local classification and recognition results of the reference local image extraction quantity, performing statistical calculation on the local classification and recognition results based on the reference local image extraction quantity to obtain the lower limit number of extraction of the target local image.

[0158] Specifically, the server may use the local image classification and recognition model to perform local classification and recognition on the local images of the reference local image extraction quantity, thereby obtaining local classification and recognition results for the reference local image extraction quantity. The largest number of local classification and recognition results and the second largest number of local classification and recognition results among the local classification and recognition results for the reference local image extraction quantity are counted, and the largest number of local classification and recognition results and the second largest number of local classification and recognition results are used to calculate a lower limit number of target local images to be extracted.

[0159] In one embodiment, a statistical calculation is performed based on the local classification recognition results of the reference local image extraction quantity to obtain the lower limit number of target local image extractions, including:

[0160] Count the number of first categories and the number of second categories in the local classification recognition results of the reference local image extraction number, where the first category refers to the category with the largest number in the local classification recognition results of the reference local image extraction number, and the second category refers to the category with the largest number other than the first category in the local classification recognition results of the reference local image extraction number; calculate the lower limit number of extraction of the target local image based on the number of the first category and the number of the second category.

[0161] Among them, different local classification recognition results may exist in different categories. For example, in face recognition, the face image of A is locally extracted to obtain a local image. When the local image is recognized, the local recognition result includes the recognition result of A, and there may also be other recognition results, such as recognition as B, recognition as C, and so on.

[0162] Specifically, the server calculates the number of categories of local classification recognition results based on the number of reference local image extractions, obtains the number of local classification recognition results for different categories, sorts each category according to the number of local classification recognition results for different categories, and takes the category with the largest number of local classification recognition results as the first category. The category with the largest number of local classification recognition results other than the first category among the local classification recognition results for the reference local image extractions is taken as the second category. The first category is the actual classification recognition result corresponding to the reference image. The number of the first category and the number of the second category are used to calculate the lower limit number of extractions for the target local image. This is the number of local classification recognition results that must be changed at least for the attack image to be successfully attacked.

[0163] In a specific embodiment, the lower limit number of extractions of the target partial image can be calculated using the formula (4) shown below.

[0164]

[0165] Among them, n a Indicates the lower limit number of target local images to be extracted, n c1 Indicates the number of the first category, n c2 Indicates the number of the second category.

[0166] Step 410 , performing binomial distribution summation calculation based on the lower limit number of target partial image extractions, the number of reference partial image extractions, and the target partial image weight parameter to obtain the defense rate of the reference image;

[0167] Specifically, the server uses a binomial distribution summation formula to calculate based on the lower limit number of target local images extracted, the number of reference local images extracted, and the target local image proportion parameter to obtain the defense rate of the reference image.

[0168] In a specific embodiment, the defense rate of the reference image can be calculated using the binomial distribution summation formula (5) shown below.

[0169]

[0170] Among them, p e The defense rate of the reference image is used to characterize the probability that the number of reference partial images extracted does not exceed the lower limit of the number of target partial images extracted. N refers to the number of reference partial images extracted. That is, p e It is a monotonically increasing function of the variable N. When p e When it is 1, the classification recognition will not be defeated by the attack image under any circumstances, that is, all attack images can be detected.

[0171] Step 412: When the defense rate of the reference image meets the preset condition, the number of reference partial image extractions is used as the target number.

[0172] Among them, the preset condition refers to a pre-set defense rate condition, which can be a defense rate lower limit value. Different defense rate lower limits can be set in different image classification and recognition scenarios, that is, they can be set according to needs.

[0173] Specifically, when the defense ratio of the reference image meets the preset conditions, the server uses the number of reference partial images extracted as the target number. If the defense ratio of the reference image does not meet the preset conditions, the server obtains an updated number of reference partial images extracted, uses the updated number of reference partial images extracted as the reference partial images extracted, and iterates back to step 406 until the defense ratio of the reference image meets the preset conditions, setting the number of reference partial images extracted as the target number.

[0174] In the above embodiment, the defense rate of the reference image is obtained by summing the calculated lower limit number of target local image extractions and the target local image proportion parameter and the reference local image extraction number through binomial distribution, so that the obtained defense rate of the reference image is more accurate. When the defense rate of the reference image meets the preset conditions, the reference local image extraction number is used as the target number, so that the determined target number is more accurate.

[0175] In one embodiment, the image attack detection method further includes the steps of:

[0176] Obtain the number of reference local image extractions, calculate the corresponding defense rates based on the number of reference local image extractions, and establish a correlation between the number of reference local image extractions and the defense rates based on the number of reference local image extractions and the corresponding defense rates; obtain a preset defense rate corresponding to the image to be detected, find the target number of reference local image extractions corresponding to the preset defense rate from the correlation between the number of reference local image extractions and the defense rate, and use the target number of reference local image extractions as the target number.

[0177] The correlation between the number of reference local image extractions and the defense rate refers to a one-to-one correspondence between the number of reference local image extractions and the defense rate, and the preset defense rate refers to a preset defense level of the image to be detected when it is subjected to an image attack.

[0178] Specifically, the server obtains the number of reference local image extractions and calculates the corresponding defense rates based on the number of reference local image extractions. The server calculates the weight parameter of the target local image and the lower limit number of target local image extractions corresponding to each reference local image extraction number, performs a binomial distribution sum calculation using the number of reference local image extractions, the weight parameter of the target local image, and the lower limit number of target local image extractions to obtain the defense rate corresponding to each reference local image extraction number. The server then associates and saves each reference local image extraction number and the corresponding defense rate. When image attack detection is required for an image to be detected, the server obtains a preset defense rate corresponding to the image to be detected, then searches for the target reference local image extraction number corresponding to the preset defense rate from the saved association between the number of reference local image extractions and the defense rate, and uses the target reference local image extraction number as the target number.

[0179] In the above embodiment, by associating and saving the extraction quantities of each reference local image with the corresponding defense rate, when the preset defense rate corresponding to the image to be detected is obtained, the corresponding target reference local image extraction quantity can be directly found, and the target reference local image extraction quantity can be used as the target quantity, which can improve the efficiency of obtaining the target quantity.

[0180] In one embodiment, step 412, extracting the number of reference partial images as the target number, includes the steps of:

[0181] Obtain resource information corresponding to the current device, and determine the current local image extraction quantity based on the resource information corresponding to the current device; when the reference local image extraction quantity exceeds the current local image extraction quantity, use the current local image extraction quantity as the target quantity; when the reference local image extraction quantity does not exceed the current local image extraction quantity, use the reference local image extraction quantity as the target quantity.

[0182] The current device refers to the device performing image attack detection. Resource information refers to the resources available to the current device when performing image attack detection, including but not limited to memory resources, storage resources, computing resources, and time resources. Memory resources refer to the memory available on the current device for image attack detection. Storage resources refer to the storage space available on the current device for image attack detection. Computing resources refer to the computing power available on the current device for image attack detection. Time resources refer to the time available on the current device for image attack detection. The current number of local image extractions refers to the number of local images that can be extracted based on the resource information of the current device.

[0183] Specifically, the server obtains its own corresponding resource information, which may be pre-allocated. The server then determines the current number of partial image extractions based on the corresponding resource information. The server determines the current number of partial image extractions for the resource information corresponding to the current device based on the resource information consumed during a single extraction. The server then determines that when the reference number of partial image extractions exceeds the current number of partial image extractions, the current number of partial image extractions is used as the target number. When the reference number of partial image extractions does not exceed the current number of partial image extractions, the reference number of partial image extractions is used as the target number. For example, if the time resource of the current device is 1 second, the target number determined based on this time resource cannot cause the time consumed by image attack detection to exceed 1 second.

[0184] In the above embodiment, by obtaining the resource information of the current device, the current local image extraction quantity is determined based on the resource information of the current device, and then compared with the reference local image extraction quantity, and finally the target quantity is determined, so that the obtained target quantity is the quantity that the server, i.e., the current device, can process, thereby avoiding the resource information consumed by image attack detection exceeding the resource information of the current device.

[0185] In one embodiment, Figure 5 As shown in the figure, a method for training an image attack detection model is provided, which is applied to Figure 1 The server in the example is used for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and implemented through the interaction between the terminal and the server. In this embodiment, the following steps are included:

[0186] Step 502: Acquire training data, where the training data includes training images and image attack category labels.

[0187] The training image refers to the image used to train the image attack detection model. The image attack category label refers to the attack category label corresponding to the training image. The attack category label includes labels indicating whether the training image is a real image or an attack image.

[0188] Specifically, the server may obtain the training data from a database, may obtain the training data from a third-party database, or may collect the training data from the Internet.

[0189] Step 504: Input the training image into the global image classification and recognition model for global classification and recognition to obtain a training global classification and recognition result vector.

[0190] The global image classification and recognition model is a pre-trained neural network model for classifying and recognizing the entire image. The trained global classification and recognition result vector refers to the global classification and recognition result vector corresponding to the training image.

[0191] Specifically, the server inputs the training image into the global image classification and recognition model for global classification and recognition, and obtains a training global classification and recognition result vector.

[0192] In step 506, a local image is randomly extracted based on the training image to obtain a training target number of training local images. The training target number is calculated by the defense rate of the training reference image corresponding to the training image. The defense rate of the training reference image is used to represent the defense degree of the training reference image when it is attacked by an image.

[0193] The number of training targets refers to the number of local images to be extracted corresponding to the training image. The training reference image refers to the reference image during training.

[0194] Specifically, the server obtains the number of training targets and randomly extracts partial images from the training image according to the number of training targets to obtain the number of training partial images. For example, a square area of ​​a fixed size can be randomly cropped from the image to obtain the partial image.

[0195] In step 508, the target number of training local images are input into the local image classification and recognition model for local classification and recognition to obtain respective training local classification and recognition result vectors, and the respective training local classification and recognition result vectors are fused to obtain the target training classification and recognition result vector.

[0196] The local image classification and recognition model refers to a pre-trained neural network model for classifying and recognizing local images. The training local classification and recognition result vector refers to the vector of local classification and recognition results corresponding to the training local image. The target training classification and recognition result vector is the vector obtained by fusing the individual training local classification and recognition result vectors.

[0197] Specifically, the server inputs the target number of training local images into the local image classification and recognition model for local classification and recognition, obtains each training local classification and recognition result vector, and then calculates the average vector of each training local classification and recognition result vector for fusion to obtain the target training classification and recognition result vector.

[0198] In step 510 , the target training classification recognition result vector and the training global classification recognition result vector are input into the initial image attack detection model to perform consistency detection on the recognition results, thereby obtaining an initial consistency detection result.

[0199] The initial image attack detection model refers to the image attack detection model with initialized model parameters. The initial consistency test result refers to the initial consistency test result. The consistency test result refers to the result of determining whether the target training classification recognition result vector and the training global classification recognition result are consistent, and whether the image is an attack image.

[0200] Specifically, the server can splice the target training classification recognition result vector and the training global classification recognition result vector to obtain a spliced ​​vector, and input the spliced ​​vector into the initial image attack detection model. The initial image attack detection model detects the consistency of the target training classification recognition result vector and the training global classification recognition result vector, and outputs the initial consistency detection result.

[0201] Step 512 updates the initial image attack detection model based on the initial consistency detection result and the image attack category label, and returns to inputting the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model for consistency detection of the recognition results. The step of obtaining the initial consistency detection result is executed until the training is completed to obtain the target image attack detection model.

[0202] Specifically, the server uses a binary classification loss function to calculate the loss value of the initial consistency detection result and the image attack category label, wherein the binary classification loss function can be a cross-entropy loss function. It is determined whether the loss value reaches a pre-set loss threshold. When the pre-set loss threshold is not reached, the initialized parameters in the initial image attack detection model are updated based on the loss value to obtain an updated image attack detection model. The updated image attack detection model is used as the initial image attack detection model, and the target training classification recognition result vector and the training global classification recognition result vector are input into the initial image attack detection model to perform consistency detection on the recognition results. The steps of obtaining the initial consistency detection result are iteratively executed until the pre-set loss threshold is reached. The initial image attack detection model that has reached the pre-set loss threshold is used as the target image attack detection model.

[0203] The above-mentioned image attack detection model training method obtains a training global classification recognition result vector by inputting the training image into the global image classification and recognition model for global classification and recognition; randomly extracts local images based on the training image to obtain the training target number of training local images, and inputs the target number of training local images into the local image classification and recognition model for local classification and recognition to obtain each training local classification and recognition result vector; fuses each training local classification and recognition result vector to obtain a target training classification and recognition result vector; inputs the target training classification and recognition result vector and the training global classification and recognition result vector into the initial image attack detection model for consistency detection of the recognition results to obtain an initial consistency detection result; updates the initial image attack detection model based on the initial consistency detection result and the image attack category label and performs a cyclic iteration to obtain a target image attack detection model, that is, the target image attack detection model obtained by training using the target training classification and recognition result vector and the training global classification and recognition result can improve the accuracy of consistency detection of the target image attack detection model, thereby improving the accuracy of image attack detection.

[0204] In one embodiment, Figure 6 As shown, the image attack detection model training method also includes:

[0205] Step 602: Obtain a training global size of the training image, and obtain a training reference image based on the training global size of the training image. The training reference image includes a preset training reference attack area, and the training reference attack area is determined according to an upper limit size of the preset training attack area.

[0206] The global training size refers to the size of the training image, namely its width and height. When training a reference attack area, the attack area in the training image is pre-set. The preset upper limit size of the training attack area refers to the maximum size of the pre-set attack area, namely its width and height.

[0207] Specifically, the server obtains the training global size of the training image and obtains the training reference image based on the training global size of the training image. The size of the training reference image can be consistent with the training global size of the training image. In one embodiment, the training global size of the training image can be the global size of the image to be detected.

[0208] Step 604 , performing parameter calculation based on the training global size and the preset upper limit size of the training attack area, and obtaining a weight parameter of the training target local image, wherein the training target local image contains image content of the training reference attack area.

[0209] The training target partial image refers to the partial image containing the training reference attack region during training. The training target partial image can include part of the training reference attack region or all of the training reference attack region. The training target partial image ratio parameter refers to the ratio of the training target partial images corresponding to the training reference image to the total number of training partial images. It is used to indicate the likelihood of extracting the training target partial image during training image extraction.

[0210] Specifically, the server can determine the training local size of the training local image to be extracted from the training reference image based on the training global size, and then use the training global size, the training local size and the preset training attack area upper limit size to perform parameter calculation to obtain the proportion parameter of the training target local image.

[0211] In one embodiment, step 604 includes the steps of: determining a training local size based on a training global size; calculating a total number of training local images that can be extracted from a training reference image based on the training global size and the training local size; calculating a total number of training target local images that can be extracted from the training reference image based on the training global size, the training local size, and a preset upper limit size of a training attack region; and calculating a ratio of the total number of training target local images to the total number of training local images to obtain a weight parameter for the training target local images.

[0212] The total number of training partial images that can be extracted from the training reference image refers to the maximum number of partial images that can be extracted from the training reference image when performing partial image extraction. The total number of training target partial images refers to the total number of target partial images that can be extracted from the training reference image.

[0213] Specifically, the server can determine the training local size according to the training global size according to the preset size relationship between the overall image and the local image. Then, the total number of training local images that can be extracted from the training reference image is calculated using the training global size and the training local size. For example, the total number of training local images that can be extracted from the training reference image can be calculated using formula (1). Then, the total number of training target local images that can be extracted from the training reference image is calculated using the training global size, the training local size, and the preset upper limit size of the training attack area. For example, the total number of training target local images that can be extracted from the training reference image can be calculated using formula (2). Finally, the ratio of the total number of training target local images to the total number of training local images is calculated to obtain the weight parameter of the training target local images. For example, the weight parameter of the training target local images can be calculated using formula (3).

[0214] Step 606 , obtaining the number of training reference local image extractions, and randomly performing local image extraction on the training reference image based on the number of training reference local image extractions to obtain local images corresponding to the number of training reference local image extractions.

[0215] The number of training reference local image extractions refers to the number of local image extractions to be determined during training.

[0216] Specifically, the server obtains the number of training reference partial image extractions, and randomly performs partial image extraction on the training reference image according to the number of training reference partial image extractions to obtain partial images of the number of training reference partial image extractions.

[0217] Step 608, performing local classification and recognition on the local images based on the number of local images extracted from the training reference local images to obtain the local classification and recognition results of the number of local images extracted from the training reference local images, performing statistical calculations on the local classification and recognition results based on the number of local images extracted from the training reference local images to obtain the lower limit number of extractions of the training target local images.

[0218] Specifically, the server may input the local images extracted from the training reference local images into the local image classification and recognition model for local classification and recognition, and output local classification and recognition results for the number of local images extracted from the training reference local images. The server then counts the local classification and recognition results with the largest number and the second largest number among the local classification and recognition results for the number of local images extracted from the training reference local images, and uses the largest number and the second largest number of local classification and recognition results to determine a lower limit for the number of training target local images to be extracted.

[0219] In one embodiment, step 608 includes the steps of: counting the number of first training categories and the number of second training categories in the local classification recognition results of the number of training reference local images extracted, where the first training category refers to the category with the largest number in the local classification recognition results of the number of training reference local images extracted, and the second training category refers to the category with the largest number other than the first training category in the local classification recognition results of the number of training reference local images extracted; and calculating the lower limit number of extraction of the training target local images based on the number of the first training categories and the number of the second training categories.

[0220] Specifically, the service area counts the number of first training categories corresponding to the largest number of categories in the local classification recognition results of the training reference local image extractions, and counts the number of second training categories corresponding to the largest number of categories other than the first training category in the local classification recognition results of the training reference local image extractions. The number of the first training category and the number of the second training category are then used to calculate the lower limit number of extractions of the training target local image. The lower limit number of extractions of the training target local image can be calculated using formula (4).

[0221] Step 610 , performing binomial distribution sum calculation based on the extraction lower limit number of the training target partial image, the extraction number of the training reference partial image, and the training target partial image proportion parameter to obtain the defense rate corresponding to the training reference image.

[0222] Specifically, the server uses the lower limit of the number of training target partial images extracted, the number of training reference partial images extracted, and the training target partial image weight parameter to calculate the defense rate corresponding to the training reference image using the binomial distribution summation formula. That is, the defense rate corresponding to the training reference image can be calculated using formula (5).

[0223] Step 612: When the defense rate corresponding to the training reference image meets the preset condition, the number of training reference partial images extracted is used as the training target number.

[0224] Specifically, when the defense ratio of the training reference image satisfies a preset condition, the server uses the number of extracted training reference partial images as the training target number. If the defense ratio of the training reference image does not meet the preset condition, the server obtains an updated number of extracted training reference partial images, uses the updated number of extracted training reference partial images as the training target number, and returns to step 606 for iteration until the defense ratio of the training reference image meets the preset condition, at which point the number of extracted training reference partial images is used as the training target number.

[0225] In the above embodiment, the calculated lower limit number of extractions of the training target local image, the number of extractions of the training reference local image, and the weight parameter of the training target local image are summed up for binomial distribution to obtain the defense rate corresponding to the training reference image, and then the number of training targets is determined based on the defense rate corresponding to the training reference image, which can make the obtained number of training targets more accurate.

[0226] In one embodiment, Figure 7 As shown, step 506, i.e., randomly extracting local images based on the training image to obtain a training target number of training local images, includes:

[0227] Step 702 : Obtain the importance of each region in the training image, and perform binary division on the training image based on the importance of each region according to a preset importance threshold to obtain target regions and non-target regions.

[0228] The importance of a region is used to represent its importance in classification. The preset importance threshold is a pre-set importance threshold for binary image segmentation. The target region is a region whose importance exceeds the preset importance threshold. The target region is a region whose importance does not exceed the preset importance threshold.

[0229] Specifically, the server obtains the importance of the area in the training image, and then obtains the preset importance threshold, and divides the importance of each area into two values ​​according to the preset importance threshold to obtain the target area and the non-target area. Among them, the CAM algorithm can be used to judge the importance of each area in the training image for classification and generate a CAM heat map. Then set the threshold, define the part of the heat map that exceeds the threshold as the target area, and generate a binary map. The CAM algorithm refers to using the weight of the last fully connected layer in the classification recognition model as the importance of different areas for the classification results, and determine the importance of each channel feature map before global average pooling through the weight, and add the channel feature map according to the weight, and scale it to the original image size, so as to determine the importance of each area in the original image.

[0230] In a specific embodiment, Figure 8 As shown in the figure, it is a schematic diagram of the target area and non-target area obtained, where Figure 8 The image a in the figure is classified and identified to obtain the weight of the last fully connected layer in the classification and identification model. The importance of each channel feature map is determined by the weight. The channel feature maps are added according to the weights and scaled to the original image size to determine the importance of each area in the original image. Then, the importance threshold is obtained and the importance threshold is used to determine the importance of each area in the original image. Figure 8 The a graph in the figure is divided into two values, and we get Figure 8 In Figure b, the target area is the black part and the non-target area is the white part.

[0231] Step 704: randomly selecting a first portion of the partial image from the target area and randomly selecting a second portion of the partial image from the non-target area, wherein the area of ​​the first portion of the partial image is larger than the area of ​​the second portion of the partial image;

[0232] Step 706: Obtain a training partial image based on the first partial image and the second partial image.

[0233] Specifically, the server randomly selects a first partial image from the target area and a second partial image from the non-target area, wherein the area of ​​the first partial image is larger than the area of ​​the second partial image, and generates a training partial image based on the extracted first and second partial images. In one embodiment, the server selects a partial image from the binarized training image, wherein the area of ​​the partial image overlaps with the target area by more than 50%.

[0234] In the above embodiment, by ensuring that more image content of the target area is included in the randomly extracted partial image, the classification and recognition of the partial image can be made more accurate.

[0235] In one embodiment, Figure 9 As shown, the training of the global image classification recognition model includes the following steps:

[0236] Step 902: Acquire global training data, where the global training data includes global training images and corresponding global category labels.

[0237] Global training data refers to the training data used when training the global image classification and recognition model. Global training images refer to the complete images used when training the global image classification and recognition model. Global category labels refer to the category labels corresponding to global training images.

[0238] Specifically, the server may obtain the global training data directly from the database, or from a third-party database, or collect the global training data from the Internet.

[0239] Step 904: Input the global training image into the initial global image classification and recognition model to perform global image classification and recognition, and obtain an initial global classification and recognition result.

[0240] The initial global image classification and recognition model refers to the global image classification and recognition model with initialized model parameters, and the initial global classification and recognition result refers to the global classification and recognition result obtained using the initialized parameters.

[0241] Specifically, the service requires the global training image to be input into the initial global image classification and recognition model for global image classification and recognition, and obtains the output initial global classification and recognition result.

[0242] Step 906 , performing loss calculation based on the initial global classification recognition result and the global category label to obtain global loss information.

[0243] Among them, the global loss information refers to the model loss corresponding to the global training image, which is used to characterize the error between the classification recognition results obtained by training and the actual classification recognition results.

[0244] Specifically, the server uses the classification loss function to calculate the loss between the initial global classification recognition result and the global category label to obtain global loss information, where the classification loss function can be a cross entropy loss function, a logarithmic loss function, a square loss function, an exponential loss function, and so on.

[0245] Step 908: Reversely update the parameters in the initial global image classification and recognition model based on the global loss information to obtain an updated global image classification and recognition model.

[0246] Specifically, the server uses the gradient descent algorithm to reversely update the parameters in the initial global image classification and recognition model, that is, uses the global loss information to calculate the gradient, and uses the gradient to reversely update the parameters in the initial global image classification and recognition model. When the parameter update is completed, the updated global image classification and recognition model is obtained.

[0247] In one embodiment, step 908 includes the steps of obtaining a current learning rate, and reversely updating the parameters of the initial global image classification and recognition model based on the current learning rate and global loss information to obtain an updated global image classification and recognition model. The current learning rate may be a currently used learning rate or a preset learning rate. The learning rate is a hyperparameter in the training process.

[0248] In one embodiment, the server can also obtain the historical learning rate, and adjust the historical learning rate using a preset cosine function to obtain the current learning rate. The learning rate can be adjusted using a preset cosine function. Figure 10 As shown in the figure, the learning rate changes according to the law of the cosine function, that is, each time the current learning rate fluctuates to the lowest point, it directly jumps to the highest point. At the same time, the cosine period is also getting longer.

[0249] In one embodiment, a warm-up (adaptive training) attenuation strategy can also be used to adjust the learning rate. That is, training is performed with a very small learning rate at the beginning, and the learning rate gradually increases as the training progresses. When it reaches a certain level, training is performed with the set initial learning rate, and the learning rate gradually decreases.

[0250] Step 910, the updated global image classification and recognition model is used as the initial global image classification and recognition model, and the global training image is input into the initial global image classification and recognition model for global image classification and recognition, and the step of obtaining the initial global classification and recognition result is executed until the global training completion condition is met, and the initial global image classification and recognition model when the global training completion condition is met is used as the global image classification and recognition model.

[0251] Specifically, the server uses the updated global image classification and recognition model as the initial global image classification and recognition model, and returns to input the global training image into the initial global image classification and recognition model for global image classification and recognition, and iteratively executes the step of obtaining the initial global classification and recognition result until the global training completion condition is reached, and uses the initial global image classification and recognition model when the global training completion condition is reached as the global image classification and recognition model, wherein the global training completion condition can be that the global loss information is less than a preset loss threshold, or that a preset number of iterations is reached, and so on.

[0252] In the above embodiment, the initial global classification and recognition model is trained by using global training data, thereby obtaining a global image classification and recognition model, which is convenient for subsequent use.

[0253] In one embodiment, Figure 11 As shown in Figure 2, the training of the local image classification recognition model includes the following steps:

[0254] Step 1102: Use the global image classification and recognition model as the initial local image classification and recognition model.

[0255] Step 1104: Acquire local training data, where the regional image training data includes local training images and corresponding local image category labels.

[0256] The local training image is a portion of the complete image, and the local image category label refers to the category label corresponding to the local training image.

[0257] Specifically, when training a local image classification and recognition model, the server can fine-tune the already trained Quanj image classification and recognition model. Specifically, the server uses the global image classification and recognition model as the initial local image classification and recognition model. Local training data can then be obtained from a database. Alternatively, global training data can be obtained, and local training images can be extracted from the global training images in the global training data. The global image category labels corresponding to the global training images can be used as local training image labels. Local training data can also be obtained from third-party databases or collected from the internet.

[0258] Step 1106: Input the local training image into the initial local image classification and recognition model to perform local classification and recognition to obtain an initial local classification and recognition result.

[0259] Step 1108, performing loss calculation based on the initial local classification and recognition results and the local image category label to obtain local loss information, and reversely updating the initial local image classification and recognition model based on the local loss information to obtain an updated local image classification and recognition model.

[0260] Specifically, the server inputs the local training image into the initial local image classification and recognition model for local classification and recognition to obtain the initial local classification and recognition result, and then reversely updates the initial local image classification and recognition model through the gradient descent algorithm, that is, the classification loss function is used to calculate the local loss information between the initial local classification and recognition result and the local image category label. The local loss information is used to characterize the error between the initial local classification and recognition result and the local image category label, and then the local loss information is used to reversely update the parameters in the initial local image classification and recognition model. When the parameter update is completed, the updated local image classification and recognition model is obtained.

[0261] Step 1110, the updated local image classification and recognition model is used as the initial local image classification and recognition model, and the step of inputting the local training image into the initial local image classification and recognition model for local classification and recognition is returned to obtain the initial local classification and recognition result. The step is executed until the local training completion condition is met, and the initial local image classification and recognition model when the local training completion condition is met is used as the local image classification and recognition model.

[0262] Specifically, the server performs iterative training, using the updated local image classification and recognition model as the initial local image classification and recognition model, and returns to inputting the local training image into the initial local image classification and recognition model for local classification and recognition. The steps of obtaining the initial local classification and recognition results are iteratively executed until the local training completion conditions are met. The local training completion conditions include the local loss information obtained from the training reaching a preset local loss threshold, the number of training times reaching a preset upper limit of iterations, and the model parameters no longer changing. At this point, the server uses the initial local image classification and recognition model when the local training completion conditions are met as the local image classification and recognition model.

[0263] In the above embodiment, by using the global image classification recognition model as the initial local image classification recognition model, and then using local training data to train the initial local image classification recognition model, a local image classification recognition model is obtained, which can improve the efficiency of obtaining the local image classification recognition model.

[0264] In a specific embodiment, Figure 12 As shown, a method for detecting image attacks is provided, which specifically includes the following steps:

[0265] Step 1202: Acquire training data, where the training data includes training images and image attack category labels.

[0266] Step 1204: input the training image into the global image classification and recognition model for global classification and recognition to obtain a training global classification and recognition result vector; and randomly extract local images based on the training image to obtain a training target number of training local images.

[0267] In step 1206, the target number of training local images are input into the local image classification and recognition model for local classification and recognition, and each training local classification and recognition result vector is obtained. The average vector of each training local classification and recognition result vector is calculated to obtain the target training classification and recognition result vector.

[0268] Step 1208: The target training classification recognition result vector and the training global classification recognition result vector are concatenated and input into the initial image attack detection model to perform a consistency check on the recognition results, thereby obtaining an initial consistency check result.

[0269] Step 1210 updates the initial image attack detection model based on the initial consistency detection result and the image attack category label, and returns to inputting the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model for consistency detection of the recognition results. The step of obtaining the initial consistency detection result is executed until the training is completed to obtain the target image attack detection model.

[0270] Step 1212: Obtain an image to be detected, input the image to be detected into a global image classification and recognition model for global classification and recognition, and obtain a global classification and recognition result vector. Randomly extract local images based on the image to be detected to obtain a target number of local images.

[0271] In step 1214, the target number of local images are input into the local image recognition model for local classification recognition, and each local classification recognition result vector is obtained. The average vector of each local classification recognition result vector is calculated to obtain the target classification recognition result vector.

[0272] In step 1216, the target local recognition result vector and the global recognition result vector are concatenated to obtain a concatenated vector. The concatenated vector is input into the target image attack detection model. The target image attack detection model detects that the target classification recognition result is inconsistent with the global classification recognition result and determines that the image to be detected is an attack image.

[0273] This application also provides an application scenario, which applies the above-mentioned image attack detection method. Specifically,

[0274] In the face recognition system, the identity of a person is obtained through face image recognition for subsequent processing, such as face unlocking. Figure 13 Figure 1 shows a schematic diagram of an attack image against a face recognition system. The attacker generates an attack region by performing an adversarial attack on a real image, then physically creates an attack image from that region. The face recognition system's recognition result for the real image is A. If the face recognition system then fails to perform image attack detection, the attacker uses the generated attack image to create an incorrect face recognition result, B.

[0275] At this time, the image attack detection method of this application is applied. Figure 14The figure shows a schematic diagram of the architecture of image attack detection. When the face recognition system wants to identify a face image, it first takes the face image as the face image to be detected, inputs the face image to be detected into the global image classification recognition model for recognition, and obtains a global category vector. Then, the face image to be detected is subjected to a target number of local image extraction, and the extracted target number of local images are input into the local image classification recognition model for recognition to obtain a local category vector. The local category vectors are averaged to obtain an average vector, and the average vector is concatenated with the global category vector and input into the image attack detection model for detection, thereby obtaining a detection result of whether the face image to be detected is an attacking face image or a real face image. That is, the present application can effectively resist physical attacks launched by black industries on security systems, detect corresponding attacks and reject them. The image attack detection method in the present application can also be applied to image and text recognition scenarios, pedestrian detection scenarios, and object recognition scenarios.

[0276] In a specific embodiment, the image attack detection method of the present application and the prior art are tested to determine their effectiveness in defending against adaptive attacks. Specifically:

[0277] We tested the CIFAR10 dataset (a small dataset for identifying universal objects) and the Imagenette dataset (an image dataset). The comparison results are shown in Table 1 below.

[0278] Table 1 Test comparison

[0279] Dataset This application (%) Existing technology 1 (%) Existing technology 2 (%) Traditional technology 3(%) CIFAR10 85.4 0.0 0.0 45.4 ImageNette 92.3 0.0 0.0 62.5

[0280] It is clear that the defense rate of this application on the CIFAR10 and Imagenette datasets is much higher than that of the existing technologies. Due to their mechanisms, existing technologies 1 and 2 are completely incapable of resisting adaptive attacks. This means that this application significantly improves the defense against adaptive attacks.

[0281] It should be understood that although Figure 2-12 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figure 2-12At least part of the steps may include multiple steps or multiple stages. These steps or stages are not necessarily performed at the same time, but can be performed at different times. The order of execution of these steps or stages is not necessarily one by one, but can be performed in turn or alternately with other steps or at least part of the steps or stages in other steps.

[0282] In one embodiment, Figure 15 As shown, an image attack detection device 1500 is provided. The device can be a software module or a hardware module, or a combination of both to form a part of a computer device. The device specifically includes: a global classification module 1502, a local extraction module 1504, a local classification module 1506 and a detection module 1508, wherein:

[0283] A global classification module 1502 is configured to obtain an image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result;

[0284] The local extraction module 1504 is configured to randomly extract local images based on the image to be detected to obtain a target number of local images. The target number is calculated based on the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to indicate the defense level of the reference image when it is attacked by an image.

[0285] The local classification module 1506 is used to perform local classification and recognition based on the local images of the target number, obtain local classification and recognition results, and fuse the local classification and recognition results to obtain the target classification and recognition result;

[0286] The detection module 1508 is configured to detect the consistency of the recognition results based on the target classification recognition result and the global recognition result. When the target classification recognition result and the global classification recognition result are inconsistent, the detection image is determined to be an attack image.

[0287] In one embodiment, the image attack detection apparatus 1500 further includes:

[0288] A global model classification module is used to input the image to be detected into the global image classification and recognition model for global classification and recognition, and obtain a global classification and recognition result vector;

[0289] A random extraction module is used to randomly extract local images based on the image to be detected to obtain a target number of local images;

[0290] The local model classification module is used to input the target number of local images into the local image recognition model for local classification and recognition, obtain each local classification and recognition result vector, and fuse each local classification and recognition result vector to obtain a target classification and recognition result vector;

[0291] The detection model detection module is used to input the target classification recognition result vector and the global classification recognition result vector into the image attack detection model for consistency detection. When the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is judged to be an attack image.

[0292] In one embodiment, the detection model detection module is also used to splice the target local recognition result vector and the global recognition result vector to obtain a spliced ​​vector; the spliced ​​vector is input into the image attack detection model, and the image attack detection model identifies the consistency of the target local recognition result vector and the global recognition result vector. When the target classification recognition result and the global classification recognition result are consistent, the image to be detected is judged to be a real image; when the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is judged to be an attack image.

[0293] In one embodiment, the local model classification module is further used to calculate the average vector of each local classification recognition result vector to obtain the target classification recognition result vector.

[0294] In one embodiment, the image attack detection apparatus 1500 further includes:

[0295] A size acquisition module is used to obtain the global size of the image to be detected, and obtain a reference image based on the global size of the image to be detected, wherein the reference image includes a preset reference attack area, and the reference attack area is determined according to the upper limit size of the preset attack area;

[0296] a parameter calculation module for performing parameter calculation based on the global size and the preset upper limit size of the attack area to obtain a weight parameter of the target local image, wherein the target local image contains image content of the reference attack area;

[0297] A reference local extraction module is used to obtain a reference local image extraction quantity, and randomly perform local image extraction on the reference image based on the reference local image extraction quantity to obtain local images of the reference local image extraction quantity;

[0298] a lower limit number calculation module, configured to perform local classification and recognition based on the local images of the reference local image extraction number, obtain the local classification and recognition results of the reference local image extraction number, and perform statistical calculation based on the local classification and recognition results of the reference local image extraction number to obtain the lower limit number of extraction of the target local image;

[0299] A defense rate calculation module is used to perform binomial distribution summation calculation based on the lower limit number of target local image extractions, the number of reference local image extractions, and the target local image proportion parameter to obtain the defense rate of the reference image;

[0300] The target quantity obtaining module is used to extract the quantity of the reference local image as the target quantity when the defense rate of the reference image meets the preset conditions.

[0301] In one embodiment, the parameter calculation module is also used to determine the local size based on the global size, calculate the total number of local images that can be extracted from the reference image based on the global size and the local size; calculate the total number of target local images that can be extracted from the reference image based on the global size, the local size and the upper limit size of the preset attack area; calculate the ratio of the total number of target local images to the total number of local images to obtain the proportion parameter of the target local image.

[0302] In one embodiment, the lower limit quantity calculation module is also used to count the number of first categories and the number of second categories in the local classification recognition results of the reference local image extraction number, the first category refers to the category with the largest number in the local classification recognition results of the reference local image extraction number, and the second category refers to the category with the largest number other than the first category in the local classification recognition results of the reference local image extraction number; the lower limit quantity of extraction of the target local image is calculated based on the number of the first category and the number of the second category.

[0303] In one embodiment, the image attack detection apparatus 1500 further includes:

[0304] a relationship establishment module, configured to obtain the number of reference local image extractions, calculate the corresponding defense rates based on the number of reference local image extractions, and establish a correlation between the number of reference local image extractions and the defense rates based on the number of reference local image extractions and the corresponding defense rates;

[0305] The search module is used to obtain a preset defense rate corresponding to the image to be detected, search for a target reference local image extraction number corresponding to the preset defense rate from the correlation between the reference local image extraction number and the defense rate, and use the target reference local image extraction number as the target number.

[0306] In one embodiment, the target quantity obtaining module is also used to obtain resource information corresponding to the current device, and determine the current local image extraction quantity based on the resource information corresponding to the current device; when the reference local image extraction quantity exceeds the current local image extraction quantity, the current local image extraction quantity is used as the target quantity; when the reference local image extraction quantity does not exceed the current local image extraction quantity, the reference local image extraction quantity is used as the target quantity.

[0307] In one embodiment, Figure 16As shown, an image attack detection model training device 1600 is provided. The device can be a software module or a hardware module, or a combination of the two to form a part of a computer device. The device specifically includes: a data acquisition module 1602, a training global classification module 1604, a training local extraction module 1606, a training local classification module 1608, a training detection module 1610 and an iteration module 1612, wherein:

[0308] A data acquisition module 1602 is used to acquire training data, where the training data includes training images and image attack category labels;

[0309] A training global classification module 1604 is configured to input the training image into a global image classification and recognition model for global classification and recognition, thereby obtaining a training global classification and recognition result vector;

[0310] A training local extraction module 1606 is configured to randomly extract local images based on the training image to obtain a training target number of training local images. The training target number is calculated based on the defense rate of the training reference image corresponding to the training image. The defense rate of the training reference image is used to represent the defense level of the training reference image when it is attacked by an image.

[0311] The training local classification module 1608 is used to input the target number of training local images into the local image classification and recognition model for local classification and recognition, obtain each training local classification and recognition result vector, and fuse each training local classification and recognition result vector to obtain a target training classification and recognition result vector;

[0312] The training detection module 1610 is used to input the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection on the recognition results to obtain an initial consistency detection result;

[0313] Iterative module 1612 is used to update the initial image attack detection model based on the initial consistency detection result and the image attack category label, and return to the step of inputting the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection of the recognition results, and obtain the initial consistency detection result until the training is completed to obtain the target image attack detection model.

[0314] In one embodiment, the image attack detection model training apparatus 1600 further includes:

[0315] A training size acquisition module is used to obtain a training global size of a training image, and obtain a training reference image based on the training global size of the training image, wherein the training reference image includes a preset training reference attack area, and the training reference attack area is determined according to an upper limit size of the preset training attack area;

[0316] a training parameter calculation module for performing parameter calculation based on a training global size and a preset upper limit size of a training attack area to obtain a weight parameter of a training target local image, wherein the training target local image contains image content of a training reference attack area;

[0317] A training reference local extraction module is used to obtain the number of training reference local image extractions, and randomly perform local image extraction on the training reference image based on the number of training reference local image extractions to obtain local images of the number of training reference local image extractions;

[0318] A training lower limit number calculation module is used to perform local classification and recognition based on the local images of the training reference local image extraction number to obtain the local classification and recognition results of the training reference local image extraction number, and perform statistical calculation based on the local classification and recognition results of the training reference local image extraction number to obtain the extraction lower limit number of the training target local image;

[0319] A training defense rate calculation module is used to perform binomial distribution summation calculation based on the lower limit number of extractions of the training target local image, the number of extractions of the training reference local image, and the training target local image proportion parameter to obtain the defense rate corresponding to the training reference image;

[0320] The training target number obtaining module is used to extract the number of training reference local images as the training target number when the defense rate corresponding to the training reference image meets the preset conditions.

[0321] In one embodiment, the training parameter calculation module is also used to determine the training local size based on the training global size, calculate the total number of training local images that can be extracted from the training reference image based on the training global size and the training local size; calculate the total number of training target local images that can be extracted from the training reference image based on the training global size, the training local size and the preset training attack area upper limit size; calculate the ratio of the total number of training target local images to the total number of training local images to obtain the proportion parameter of the training target local images.

[0322] In one embodiment, the training lower limit quantity calculation module is also used to count the number of first training categories and the number of second training categories in the local classification recognition results of the training reference local image extraction quantity, the first training category refers to the category with the largest number in the local classification recognition results of the training reference local image extraction quantity, and the second training category refers to the category with the largest number other than the first training category in the local classification recognition results of the training reference local image extraction quantity; the extraction lower limit quantity of the training target local image is calculated based on the number of the first training category and the number of the second training category.

[0323] In one embodiment, the training reference local extraction module is also used to obtain the importance of each area in the training image, and based on the importance of each area, the training image is binary-divided according to a preset importance threshold to obtain a target area and a non-target area; randomly select a first part of the local image from the target area, and randomly select a second part of the local image from the non-target area, wherein the area of ​​the first part of the local image is larger than the area of ​​the second part of the local image; and obtain a training local image based on the first part of the local image and the second part of the local image.

[0324] In one embodiment, the image attack detection model training apparatus 1600 further includes:

[0325] A global recognition model training module is used to obtain global training data, which includes global training images and corresponding global category labels; input the global training images into the initial global image classification and recognition model for global image classification and recognition to obtain initial global classification and recognition results; calculate the loss based on the initial global classification and recognition results and the global category labels to obtain global loss information; reversely update the parameters in the initial global image classification and recognition model based on the global loss information to obtain an updated global image classification and recognition model; use the updated global image classification and recognition model as the initial global image classification and recognition model, and return to the step of inputting the global training images into the initial global image classification and recognition model for global image classification and recognition to obtain the initial global classification and recognition results, until the global training completion condition is met, and the initial global image classification and recognition model when the global training completion condition is met is used as the global image classification and recognition model.

[0326] In one embodiment, the global recognition model training module is also used to obtain the current learning rate; based on the current learning rate and the global loss information, the parameters of the initial global image classification and recognition model are reversely updated to obtain an updated global image classification and recognition model.

[0327] In one embodiment, the global recognition model training module is further used to obtain a historical learning rate, and to adjust the historical learning rate using a preset cosine function to obtain a current learning rate.

[0328] In one embodiment, the image attack detection model training apparatus 1600 further includes:

[0329] The local recognition model training module is used to use the global image classification recognition model as the initial local image classification recognition model; obtain local training data, where the regional image training data includes local training images and corresponding local image category labels; input the local training images into the initial local image classification recognition model for local classification recognition to obtain initial local classification recognition results; calculate the loss based on the initial local classification recognition results and the local image category labels to obtain local loss information, and reversely update the initial local image classification recognition model based on the local loss information to obtain an updated local image classification recognition model; use the updated local image classification recognition model as the initial local image classification recognition model, and return to the step of inputting the local training images into the initial local image classification recognition model for local classification recognition to obtain the initial local classification recognition results, and execute until the local training completion condition is met, and the initial local image classification recognition model when the local training completion condition is met is used as the local image classification recognition model.

[0330] For the specific definitions of the image attack detection device and the image attack detection model training device, please refer to the definitions of the image attack detection method and the image attack detection model training method above, and will not be repeated here. The various modules in the above-mentioned image attack detection device and image attack detection model training device can be implemented in whole or in part by software, hardware, and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0331] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 17 As shown. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used for images to be detected or for storing training data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an image attack detection method and an image attack detection model training method are implemented.

[0332] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 18As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, an image attack detection method and an image attack detection model training method are implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a key, trackball or touchpad provided on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0333] Those skilled in the art will understand that Figure 17 and Figure 18 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0334] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0335] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0336] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of each of the above-described method embodiments.

[0337] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0338] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0339] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A method for detecting image attacks, characterized in that: The method comprises: Acquire an image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result; Randomly extracting local images based on the image to be detected to obtain a target number of local images, the target number being calculated based on a defense rate of a reference image corresponding to the image to be detected, the defense rate of the reference image being used to characterize the degree of defense of the reference image when subjected to an image attack, the defense rate of the reference image comprising a defense rate calculated by summing a binomial distribution based on a lower limit number of target local images to be extracted, a reference local image extraction number, and a target local image proportion parameter, the lower limit number of target local images to be extracted being used to characterize the number of local classification recognition results that must be changed at least when the attack is successful, and the target local image proportion parameter being used to characterize the likelihood of extracting the target local image during image extraction; Performing local classification and recognition on the local images of the target number to obtain local classification and recognition results, and fusing the local classification and recognition results to obtain a target classification and recognition result; The consistency of the recognition results is detected based on the target classification recognition result and the global classification recognition result. When the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is determined to be an attack image.

2. The method according to claim 1, characterized in that The method further comprises: Inputting the image to be detected into a global image classification and recognition model for global classification and recognition to obtain a global classification and recognition result vector; Randomly extracting local images based on the image to be detected to obtain a target number of local images; Inputting the target number of local images into the local image recognition model for local classification and recognition respectively to obtain local classification and recognition result vectors, and fusing the local classification and recognition result vectors to obtain a target classification and recognition result vector; The target classification recognition result vector and the global classification recognition result vector are input into an image attack detection model for consistency detection. When the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is determined to be an attack image.

3. The method according to claim 2, characterized in that The step of inputting the target classification recognition result vector and the global classification recognition result vector into an image attack detection model for consistency detection, and determining that the image to be detected is an attack image when the target classification recognition result and the global classification recognition result are inconsistent, includes: Splicing the target classification recognition result vector and the global classification recognition result vector to obtain a splicing vector; The splicing vector is input into an image attack detection model, and the image attack detection model identifies the consistency between the target classification recognition result vector and the global classification recognition result vector. When the target classification recognition result and the global classification recognition result are consistent, the image to be detected is judged to be a real image; when the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is judged to be an attack image.

4. The method according to claim 2, characterized in that The fusing of the local classification recognition result vectors to obtain the target classification recognition result vector includes: The average vector of the local classification recognition result vectors is calculated to obtain the target classification recognition result vector.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Obtaining a global size of the image to be detected, and obtaining a reference image based on the global size of the image to be detected, wherein the reference image includes a preset reference attack area, and the reference attack area is determined according to an upper limit size of the preset attack area; performing parameter calculation based on the global size and the preset upper limit size of the attack area to obtain a weight parameter of a target local image, wherein the target local image contains image content of the reference attack area; Acquire a reference number of partial image extractions, and randomly perform partial image extractions on the reference image based on the reference number of partial image extractions to obtain partial images of the reference number of partial image extractions; Performing local classification and recognition based on the local images of the reference local image extraction number to obtain local classification and recognition results of the reference local image extraction number, and performing statistical calculation based on the local classification and recognition results of the reference local image extraction number to obtain a lower limit number of extraction of the target local image; Performing a binomial distribution sum calculation based on the lower limit number of extractions of the target partial image, the number of extractions of the reference partial image, and the target partial image weight parameter to obtain a defense rate of the reference image; When the defense rate of the reference image meets a preset condition, the number of reference partial images extracted is used as the target number.

6. The method according to claim 5, characterized in that The parameter calculation based on the global size and the preset upper limit size of the attack area to obtain the weight parameter of the target local image includes: determining a local size based on the global size, and calculating a total number of local images that can be extracted from the reference image based on the global size and the local size; Calculating the total number of target local images that can be extracted from the reference image based on the global size, the local size, and the preset upper limit size of the attack area; The ratio of the total number of the target partial images to the total number of the partial images is calculated to obtain a weight parameter of the target partial image.

7. The method according to claim 5, characterized in that The statistical calculation of the local classification recognition result based on the number of reference local images extracted to obtain the lower limit number of target local images to be extracted includes: Counting the number of first categories and the number of second categories in the local classification recognition results of the reference local image extraction number, where the first category refers to the category with the largest number in the local classification recognition results of the reference local image extraction number, and the second category refers to the category with the largest number other than the first category in the local classification recognition results of the reference local image extraction number; A lower limit number of extraction of the target partial image is calculated based on the number of the first categories and the number of the second categories.

8. The method according to claim 5, characterized in that The method further comprises: Obtaining the number of reference partial image extractions, calculating corresponding defense rates based on the number of reference partial image extractions, and establishing a correlation between the number of reference partial image extractions and the defense rates based on the number of reference partial image extractions and the corresponding defense rates; Obtain a preset defense rate corresponding to the image to be detected, find a target reference local image extraction number corresponding to the preset defense rate from the correlation relationship between the reference local image extraction number and the defense rate, and use the target reference local image extraction number as the target number.

9. The method according to claim 5, characterized in that The extracting quantity of the reference partial image as the target quantity comprises: Obtain resource information corresponding to the current device, and determine the current number of partial images to be extracted based on the resource information corresponding to the current device; When the reference partial image extraction number exceeds the current partial image extraction number, taking the current partial image extraction number as the target number; When the reference partial image extraction number does not exceed the current partial image extraction number, the reference partial image extraction number is used as the target number.

10. A method for training an image attack detection model, characterized in that: The method comprises: Acquire training data, wherein the training data includes training images and image attack category labels; Inputting the training image into a global image classification and recognition model for global classification and recognition to obtain a training global classification and recognition result vector; Randomly extracting local images based on the training image to obtain a training target number of training local images, the training target number being calculated based on a defense rate of a training reference image corresponding to the training image, the defense rate of the training reference image being used to characterize the degree of defense of the training reference image when subjected to an image attack, the defense rate of the training reference image comprising a defense rate calculated by summing a binomial distribution based on a lower limit number of extractions of the training target local images, a number of extractions of the training reference local images, and a weight parameter of the training target local images, the lower limit number of extractions of the training target local images being used to characterize the number of local classification recognition results that must be changed at least when the attack is successful, and the weight parameter of the training target local images being used to characterize the likelihood of extracting the target local image during image extraction; Inputting the target number of training local images into the local image classification and recognition model for local classification and recognition, respectively, to obtain respective training local classification and recognition result vectors, and fusing the respective training local classification and recognition result vectors to obtain a target training classification and recognition result vector; Inputting the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection on the recognition results to obtain an initial consistency detection result; The initial image attack detection model is updated based on the initial consistency detection result and the image attack category label, and the target training classification recognition result vector and the training global classification recognition result vector are input into the initial image attack detection model for consistency detection of the recognition results to obtain the initial consistency detection result. The step is executed until the training is completed to obtain the target image attack detection model.

11. The method according to claim 10, characterized in that The randomly extracting local images based on the training image to obtain a target number of training local images includes: Obtaining the importance of each region in the training image, and performing binary division on the training image based on the importance of each region according to a preset importance threshold to obtain target regions and non-target regions; Randomly selecting a first portion of the partial image from the target area, and randomly selecting a second portion of the partial image from the non-target area, wherein the area of ​​the first portion of the partial image is larger than the area of ​​the second portion of the partial image; A training partial image is obtained based on the first partial image and the second partial image.

12. The method according to claim 10, characterized in that The method further comprises: Obtaining a training global size of the training image, and obtaining a training reference image based on the training global size of the training image, wherein the training reference image includes a preset training reference attack area, and the training reference attack area is determined according to an upper limit size of the preset training attack area; Calculating parameters based on the training global size and the preset upper limit size of the training attack area to obtain a weight parameter of a training target local image, wherein the training target local image contains image content of the training reference attack area; Obtaining a number of training reference partial image extractions, and randomly performing partial image extraction on the training reference image based on the number of training reference partial image extractions to obtain partial images of the number of training reference partial image extractions; Performing local classification and recognition based on the number of local images extracted from the training reference local images to obtain local classification and recognition results of the number of local images extracted from the training reference local images, and performing statistical calculations based on the local classification and recognition results of the number of local images extracted from the training reference local images to obtain a lower limit number of extractions of the training target local images; A binomial distribution summation calculation is performed based on the lower limit number of extractions of the training target partial image, the number of extractions of the training reference partial image, and the weight parameter of the training target partial image to obtain a defense rate corresponding to the training reference image; When the defense rate corresponding to the training reference image meets a preset condition, the number of the training reference partial images extracted is used as the training target number.

13. The method according to claim 12, characterized in that The parameter calculation based on the training global size and the preset training attack area upper limit size to obtain the weight parameter of the training target local image includes: Determine a training local size based on the training global size, and calculate a total number of training local images that can be extracted from the training reference image based on the training global size and the training local size; Calculating the total number of training target local images that can be extracted from the training reference image based on the training global size, the training local size, and the preset training attack area upper limit size; The ratio of the total number of the training target partial images to the total number of the training partial images is calculated to obtain a weight parameter of the training target partial images.

14. The method according to claim 12, characterized in that The statistical calculation of the local classification recognition results based on the number of extractions of the training reference local images to obtain the lower limit number of extractions of the training target local images includes: Counting the number of first training categories and the number of second training categories in the local classification recognition results of the training reference local image extraction number, where the first training category refers to the category with the largest number in the local classification recognition results of the training reference local image extraction number, and the second training category refers to the category with the largest number other than the first training category in the local classification recognition results of the training reference local image extraction number; The lower limit number of extraction of the training target partial image is calculated based on the number of the first training categories and the number of the second training categories.

15. The method according to claim 10, characterized in that The training of the global image classification recognition model includes the following steps: Acquire global training data, where the global training data includes global training images and corresponding global category labels; Inputting the global training image into an initial global image classification and recognition model to perform global image classification and recognition, thereby obtaining an initial global classification and recognition result; Performing loss calculation based on the initial global classification recognition result and the global category label to obtain global loss information; Reversely updating the parameters in the initial global image classification and recognition model based on the global loss information to obtain an updated global image classification and recognition model; The updated global image classification and recognition model is used as the initial global image classification and recognition model, and the step of inputting the global training image into the initial global image classification and recognition model for global image classification and recognition to obtain the initial global classification and recognition result is executed until the global training completion condition is met, and the initial global image classification and recognition model when the global training completion condition is met is used as the global image classification and recognition model.

16. The method according to claim 15, characterized in that The reverse updating of the parameters in the initial global image classification and recognition model based on the global loss information to obtain an updated global image classification and recognition model includes: Get the current learning rate; The parameters of the initial global image classification and recognition model are reversely updated based on the current learning rate and the global loss information to obtain an updated global image classification and recognition model.

17. The method according to claim 16, characterized in that The acquisition of the current learning rate includes: Obtain a historical learning rate, and adjust the historical learning rate using a preset cosine function to obtain a current learning rate.

18. The method according to claim 10, wherein: The training of the local image classification and recognition model includes the following steps: Using the global image classification and recognition model as an initial local image classification and recognition model; Acquire local training data, where the local training data includes local training images and corresponding local image category labels; Inputting the local training image into the initial local image classification and recognition model to perform local classification and recognition to obtain an initial local classification and recognition result; Performing loss calculation based on the initial local classification and recognition result and the local image category label to obtain local loss information, and reversely updating the initial local image classification and recognition model based on the local loss information to obtain an updated local image classification and recognition model; The updated local image classification and recognition model is used as the initial local image classification and recognition model, and the step of inputting the local training image into the initial local image classification and recognition model for local classification and recognition to obtain the initial local classification and recognition result is executed until the local training completion condition is met, and the initial local image classification and recognition model when the local training completion condition is met is used as the local image classification and recognition model.

19. An image attack detection device, characterized in that: The device comprises: A global classification module is used to obtain an image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result; a local extraction module for randomly extracting local images based on the image to be detected to obtain a target number of local images, wherein the target number is calculated based on the defense rate of a reference image corresponding to the image to be detected, the defense rate of the reference image being used to characterize the degree of defense of the reference image when subjected to an image attack, the defense rate of the reference image comprising a defense rate calculated by summing a binomial distribution based on a lower limit number of target local images to be extracted, a reference local image extraction number, and a target local image weight parameter, the lower limit number of target local images to be extracted being used to characterize the number of local classification recognition results that must be changed at least when the attack is successful, and the target local image weight parameter being used to characterize the likelihood of extracting the target local image during image extraction; A local classification module is used to perform local classification and recognition based on the local images of the target number, obtain local classification and recognition results, and fuse the local classification and recognition results to obtain a target classification and recognition result; The detection module is used to detect the consistency of the recognition result based on the target classification recognition result and the global classification recognition result, and when the target classification recognition result and the global classification recognition result are inconsistent, determine that the image to be detected is an attack image.

20. The device according to claim 19, characterized in that The device further comprises: A global model classification module is used to input the image to be detected into the global image classification and recognition model for global classification and recognition, and obtain a global classification and recognition result vector; A random extraction module, configured to randomly extract local images based on the image to be detected to obtain a target number of local images; A local model classification module is used to input the target number of local images into the local image recognition model for local classification and recognition, obtain each local classification and recognition result vector, and fuse the each local classification and recognition result vector to obtain a target classification and recognition result vector; The detection model detection module is used to input the target classification recognition result vector and the global classification recognition result vector into the image attack detection model for consistency detection. When the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is judged to be an attack image.

21. The device according to claim 20, characterized in that The detection model detection module is also used to splice the target classification recognition result vector and the global classification recognition result vector to obtain a spliced ​​vector; the spliced ​​vector is input into the image attack detection model, and the image attack detection model identifies the consistency between the target classification recognition result vector and the global classification recognition result vector. When the target classification recognition result is consistent with the global classification recognition result, the image to be detected is judged to be a real image; when the target classification recognition result is inconsistent with the global classification recognition result, the image to be detected is judged to be an attack image.

22. The device according to claim 20, characterized in that The local model classification module is further used to calculate the average vector of the local classification recognition result vectors to obtain the target classification recognition result vector.

23. The device according to any one of claims 19 to 22, characterized in that The device further comprises: a size acquisition module, configured to acquire the global size of the image to be detected, and acquire a reference image based on the global size of the image to be detected, wherein the reference image includes a preset reference attack area, and the reference attack area is determined according to an upper limit size of the preset attack area; a parameter calculation module, configured to perform parameter calculation based on the global size and the preset upper limit size of the attack area to obtain a weight parameter of a target local image, wherein the target local image contains image content of the reference attack area; A reference local extraction module is used to obtain a reference local image extraction number, and randomly perform local image extraction on the reference image based on the reference local image extraction number to obtain local images of the reference local image extraction number; a lower limit number calculation module, configured to perform local classification and recognition based on the local images of the reference local image extraction number to obtain the local classification and recognition results of the reference local image extraction number, and perform statistical calculation based on the local classification and recognition results of the reference local image extraction number to obtain the lower limit number of extraction of the target local image; a defense rate calculation module, configured to perform a binomial distribution sum calculation based on the lower limit number of extractions of the target partial image, the number of extractions of the reference partial image, and a weight parameter of the target partial image to obtain a defense rate of the reference image; The target number obtaining module is used to extract the number of reference partial images as the target number when the defense rate of the reference image meets a preset condition.

24. The device according to claim 23, characterized in that The parameter calculation module is further used to determine the local size based on the global size, calculate the total number of local images that can be extracted from the reference image based on the global size and the local size; calculate the total number of target local images that can be extracted from the reference image based on the global size, the local size and the upper limit size of the preset attack area; calculate the ratio of the total number of target local images to the total number of local images to obtain the proportion parameter of the target local image.

25. The device according to claim 23, characterized in that The lower limit quantity calculation module is also used to count the number of first categories and the number of second categories in the local classification recognition results of the reference local image extraction number, the first category refers to the category with the largest number in the local classification recognition results of the reference local image extraction number, and the second category refers to the category with the largest number other than the first category in the local classification recognition results of the reference local image extraction number; the lower limit quantity of the target local image extraction is calculated based on the number of the first category and the number of the second category.

26. The device according to claim 23, characterized in that The device further comprises: a relationship establishing module, configured to obtain the number of reference partial image extractions, calculate the corresponding defense rates based on the number of reference partial image extractions, and establish an association relationship between the number of reference partial image extractions and the defense rates based on the number of reference partial image extractions and the corresponding defense rates; A search module is used to obtain a preset defense rate corresponding to the image to be detected, search for a target reference local image extraction number corresponding to the preset defense rate from the correlation between the reference local image extraction number and the defense rate, and use the target reference local image extraction number as the target number.

27. The device according to claim 23, characterized in that The target quantity obtaining module is also used to obtain resource information corresponding to the current device, and determine the current local image extraction quantity based on the resource information corresponding to the current device; when the reference local image extraction quantity exceeds the current local image extraction quantity, the current local image extraction quantity is used as the target quantity; when the reference local image extraction quantity does not exceed the current local image extraction quantity, the reference local image extraction quantity is used as the target quantity.

28. An image attack detection model training device, characterized in that: The device comprises: A data acquisition module is used to acquire training data, wherein the training data includes training images and image attack category labels; A training global classification module is used to input the training image into a global image classification and recognition model for global classification and recognition, and obtain a training global classification and recognition result vector; A training local extraction module is configured to randomly extract local images based on the training image to obtain a training target number of training local images; the training target number is calculated based on the defense rate of the training reference image corresponding to the training image, the defense rate of the training reference image being used to characterize the degree of defense of the training reference image when subjected to an image attack, the defense rate of the training reference image comprising a defense rate calculated by summing a binomial distribution based on a lower limit number of extractions of the training target local images, a number of extractions of the training reference local images, and a weight parameter of the training target local images; the lower limit number of extractions of the training target local images being used to characterize the number of local classification recognition results that must be changed at least when the attack is successful, and the weight parameter of the training target local images being used to characterize the likelihood of extracting the target local image during image extraction; A training local classification module is used to input the target number of training local images into the local image classification and recognition model for local classification and recognition, obtain each training local classification and recognition result vector, and fuse the each training local classification and recognition result vector to obtain a target training classification and recognition result vector; A training detection module is used to input the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection on the recognition results to obtain an initial consistency detection result; An iterative module is used to update the initial image attack detection model based on the initial consistency detection result and the image attack category label, and return to the step of inputting the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection of the recognition results, and obtain the initial consistency detection result until the training is completed to obtain the target image attack detection model.

29. The device according to claim 28, characterized in that The training local extraction module is also used to obtain the importance of each area in the training image, and based on the importance of each area, the training image is binary-divided according to a preset importance threshold to obtain a target area and a non-target area; randomly select a first part of the local image from the target area, and randomly select a second part of the local image from the non-target area, wherein the area of ​​the first part of the local image is larger than the area of ​​the second part of the local image; and obtain a training local image based on the first part of the local image and the second part of the local image.

30. The device according to claim 28, wherein The device further comprises: a training size acquisition module, configured to acquire a training global size of the training image, and acquire a training reference image based on the training global size of the training image, wherein the training reference image includes a preset training reference attack area, and the training reference attack area is determined according to an upper limit size of the preset training attack area; a training parameter calculation module, configured to perform parameter calculation based on the training global size and the preset upper limit size of the training attack area to obtain a weight parameter of a training target local image, wherein the training target local image contains image content of the training reference attack area; A training reference local extraction module is used to obtain a number of training reference local image extractions, and randomly perform local image extraction on the training reference image based on the number of training reference local image extractions to obtain local images of the number of training reference local image extractions; a training lower limit number calculation module, configured to perform local classification and recognition based on the local images of the training reference local image extraction number to obtain the local classification and recognition results of the training reference local image extraction number, and perform statistical calculation based on the local classification and recognition results of the training reference local image extraction number to obtain the extraction lower limit number of the training target local image; a training defense rate calculation module, configured to perform a binomial distribution sum calculation based on the lower limit number of extractions of the training target partial image, the number of extractions of the training reference partial image, and the weight parameter of the training target partial image, to obtain a defense rate corresponding to the training reference image; The training target number obtaining module is used to extract the number of the training reference partial images as the training target number when the defense rate corresponding to the training reference image meets the preset conditions.

31. The device according to claim 30, characterized in that The training parameter calculation module is further configured to determine a training local size based on the training global size, and calculate a total number of training local images that can be extracted from the training reference image based on the training global size and the training local size; Calculating the total number of training target local images that can be extracted from the training reference image based on the training global size, the training local size, and the preset training attack area upper limit size; The ratio of the total number of the training target partial images to the total number of the training partial images is calculated to obtain a weight parameter of the training target partial images.

32. The device according to claim 30, characterized in that The training lower limit number calculation module is further used to count the number of first training categories and the number of second training categories in the local classification recognition results of the training reference local image extraction number, wherein the first training category refers to the category with the largest number in the local classification recognition results of the training reference local image extraction number, and the second training category refers to the category with the largest number other than the first training category in the local classification recognition results of the training reference local image extraction number; The lower limit number of extraction of the training target partial image is calculated based on the number of the first training categories and the number of the second training categories.

33. The device according to claim 28, characterized in that The device further comprises: A global recognition model training module is used to obtain global training data, wherein the global training data includes a global training image and a corresponding global category label; input the global training image into an initial global image classification and recognition model for global image classification and recognition to obtain an initial global classification and recognition result; calculate the loss based on the initial global classification and recognition result and the global category label to obtain global loss information; reversely update the parameters in the initial global image classification and recognition model based on the global loss information to obtain an updated global image classification and recognition model; use the updated global image classification and recognition model as the initial global image classification and recognition model, and return to the step of inputting the global training image into the initial global image classification and recognition model for global image classification and recognition to obtain an initial global classification and recognition result, until the global training completion condition is met, and the initial global image classification and recognition model when the global training completion condition is met is used as the global image classification and recognition model.

34. The device according to claim 33, characterized in that The global recognition model training module is also used to obtain a current learning rate; based on the current learning rate and the global loss information, the parameters of the initial global image classification and recognition model are reversely updated to obtain an updated global image classification and recognition model.

35. The device according to claim 34, characterized in that The global recognition model training module is further used to obtain a historical learning rate, and to adjust the historical learning rate using a preset cosine function to obtain a current learning rate.

36. The device according to claim 28, characterized in that The device further comprises: A local recognition model training module is used to use the global image classification recognition model as the initial local image classification recognition model; obtain local training data, wherein the local training data includes a local training image and a corresponding local image category label; input the local training image into the initial local image classification recognition model for local classification recognition to obtain an initial local classification recognition result; perform loss calculation based on the initial local classification recognition result and the local image category label to obtain local loss information, and reversely update the initial local image classification recognition model based on the local loss information to obtain an updated local image classification recognition model; use the updated local image classification recognition model as the initial local image classification recognition model, and return to the step of inputting the local training image into the initial local image classification recognition model for local classification recognition to obtain an initial local classification recognition result, until the local training completion condition is met, and the initial local image classification recognition model when the local training completion condition is met is used as the local image classification recognition model.

37. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 18 are implemented.

38. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 18 are implemented.

39. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 18 are implemented.

Images