Method, apparatus, and electronic device for obtaining adversarial sample images

Abstract

The present disclosure provides a method, apparatus, and electronic device for obtaining adversarial sample images, which relate to the field of artificial intelligence technologies such as image classification. The specific implementation solution is as follows: when obtaining adversarial sample images, first obtain the respective ratios and adversarial parameters of a plurality of sample images and a plurality of adversarial operators; then, according to the respective ratios of the plurality of adversarial operators, determine a plurality of to-be-processed sample images to be adversarially processed from the plurality of sample images; and then, based on the adversarial parameters of the adversarial operators corresponding to the respective plurality of to-be-processed sample images, process the plurality of to-be-processed sample images to obtain adversarial sample images, thereby obtaining adversarial sample images. By using the adversarial parameters of a plurality of adversarial operators to perform adversarial processing on sample images, the uniformity of the perturbation norm size of the adversarial sample images can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of image processing technologies, and in particular to artificial intelligence technologies such as image classification. Specifically, it relates to a method, device, and electronic device for obtaining adversarial sample images. Background Art

[0002] An adversarial attack is a tiny perturbation generated based on the weights of a deep learning model. This tiny perturbation causes the output result of the deep learning model to deviate significantly from the normal output result, thereby leading to an error in the output result of the deep learning model.

[0003] In order to enable a deep learning model to have the ability to cope with such adversarial attacks, usually the deep learning model is subjected to adversarial training. This requires obtaining adversarial sample images for adversarial training. Therefore, how to obtain adversarial sample images for adversarial training is crucial. Summary of the Invention

[0004] The present disclosure provides a method, device, and electronic device for obtaining adversarial sample images, which can accurately obtain adversarial sample images and improve the uniformity of the perturbation norm size of the adversarial sample images.

[0005] According to a first aspect of the present disclosure, there is provided a method for obtaining an adversarial sample image. The method for obtaining an adversarial sample image may include:

[0006] Obtain a plurality of sample images, as well as the respective ratios and adversarial parameters of a plurality of adversarial operators.

[0007] Determine a plurality of to-be-processed sample images to be adversarially processed from the plurality of sample images according to the respective ratios of the plurality of adversarial operators; wherein, the plurality of to-be-processed sample images correspond to their respective adversarial operators.

[0008] Process the plurality of to-be-processed sample images based on the adversarial parameters of the respective adversarial operators corresponding to the plurality of to-be-processed sample images to obtain adversarial sample images.

[0009] According to a second aspect of the present disclosure, there is provided an apparatus for obtaining an adversarial sample image. The apparatus for obtaining an adversarial sample image may include:

[0010] A first obtaining unit, configured to obtain a plurality of sample images, as well as the respective ratios and adversarial parameters of a plurality of adversarial operators.

[0011] A first processing unit, configured to determine a plurality of to-be-processed sample images to be adversarially processed from the plurality of sample images according to the respective ratios of the plurality of adversarial operators; wherein, the plurality of to-be-processed sample images correspond to their respective adversarial operators.

[0012] A second processing unit, configured to process the plurality of to-be-processed sample images based on the adversarial parameters of the adversarial operators corresponding to the plurality of to-be-processed sample images respectively, so as to obtain adversarial sample images.

[0013] According to a third aspect of the present disclosure, there is provided an electronic device, which may include:

[0014] At least one processor; and

[0015] A memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for obtaining adversarial sample images according to the first aspect above.

[0017] According to a fourth aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the method for obtaining adversarial sample images according to the first aspect above.

[0018] According to a fifth aspect of the present disclosure, there is provided a computer program product, which includes: a computer program, the computer program is stored in a readable storage medium, and at least one processor of an electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to cause the electronic device to execute the method for obtaining adversarial sample images according to the first aspect.

[0019] According to the technical solution of the present disclosure, adversarial sample images can be accurately obtained, and the uniformity of the perturbation norm size of the adversarial sample images can be improved.

[0020] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it used to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. Description of the Drawings

[0021] The drawings are used to better understand the solution and do not constitute a limitation to the present disclosure. Among them:

[0022] Figure 1 is a flowchart of the method for obtaining adversarial sample images according to the first embodiment of the present disclosure;

[0023] Figure 2 is a flowchart of the method for processing a plurality of to-be-processed sample images to obtain adversarial sample images according to the second embodiment of the present disclosure;

[0024] Figure 3 It is a schematic flowchart of a method for co-training and generating an image processing model based on adversarial sample images according to the third embodiment of the present disclosure;

[0025] Figure 4 It is a schematic structural diagram of an apparatus for obtaining adversarial sample images according to the fourth embodiment of the present disclosure;

[0026] Figure 5 It is a schematic block diagram of an electronic device provided by an embodiment of the present disclosure. Specific embodiments

[0027] The following describes exemplary embodiments of the present disclosure with reference to the accompanying drawings. Various details of the embodiments of the present disclosure are included to assist in understanding, and they should be considered merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0028] In the embodiments of the present disclosure, "at least one" means one or more, and "a plurality" means two or more. "And / or" describes the access relationship of associated objects and indicates that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. Here, A and B can be singular or plural. In the written description of the present disclosure, the character " / " generally represents an "or" relationship between the associated objects before and after. In addition, in the embodiments of the present disclosure, "first", "second", "third", "fourth", "fifth", and "sixth" are only used to distinguish the contents of different objects and have no other special meanings.

[0029] The technical solutions provided by the embodiments of the present disclosure can be applied to image processing scenarios, such as image classification scenarios, image recognition scenarios, or image segmentation scenarios, etc., which can be specifically set according to actual needs. In image processing scenarios, deep learning models can be used to process images. However, when deep learning models process images, they are vulnerable to adversarial attacks.

[0030] In order to enable deep learning models to have the ability to cope with such adversarial attacks, the usual approach is to perform adversarial training on the deep learning models. In existing solutions, when performing adversarial training on deep learning models, it is usually programmers who, according to their respective ideas, implement the adversarial training of deep learning models through programming methods for the face process. However, the adversarial ability of the deep learning models obtained through adversarial training is still poor.

[0031] To improve the adversarial ability of deep learning models, when training a deep learning model, adversarial sample images can be added to the training sample image set. That is, the training sample image set includes both regular sample images and adversarial sample images, and a deep learning model is generated through joint training of the regular sample images and the adversarial sample images. The deep learning model obtained through such training can handle regular images well and adversarial images well, thus improving the adversarial ability of the deep learning model.

[0032] Therefore, how to obtain adversarial sample images is crucial for obtaining a deep learning model with good adversarial ability. To better obtain adversarial sample images, some of the obtained regular sample images can be selected as the sample images to be adversarially processed, and the adversarial parameters of multiple adversarial operators can be used to perform adversarial processing on the sample images to obtain adversarial sample images. Using the adversarial parameters of multiple adversarial operators to perform adversarial processing on the sample images can improve the uniformity of the perturbation norm of the adversarial sample images.

[0033] In this way, subsequently, a deep learning model can be generated through joint training of the regular sample images and the adversarial sample images, so that the trained deep learning model can handle regular images well and adversarial images well, thus improving the adversarial ability of the deep learning model.

[0034] Exemplarily, the deep learning model can be an image processing model, which can be an image classification model, an image recognition model, an image segmentation model, etc., and can be specifically set according to actual needs.

[0035] It should be noted that when the image processing model is different deep learning models, their corresponding model outputs are different. For example, when the image processing model is an image classification model, the model output of the image classification model is the category to which the image belongs; when the image processing model is an image recognition model, the model output of the image recognition model is the recognition result of the image; when the image processing model is an image segmentation model, the model output of the image segmentation model is the segmentation result of the image.

[0036] Based on the above technical concept, an embodiment of the present disclosure provides a method for obtaining adversarial sample images. Below, the method for obtaining adversarial sample images provided by the present disclosure will be described in detail through specific embodiments. It can be understood that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0037] Embodiment 1

[0038] Figure 1It is a schematic flowchart of a method for obtaining adversarial sample images according to the first embodiment of the present disclosure. The method for obtaining adversarial sample images can be executed by software and / or hardware devices. For example, the hardware device can be a terminal or a server. For example, please refer to Figure 1 As shown, the method for obtaining adversarial sample images may include:

[0039] S101. Obtain a plurality of sample images, and the respective ratios and adversarial parameters of a plurality of adversarial operators.

[0040] Among them, the plurality of sample images can be understood as normal sample images. The ratio of the adversarial operator can be used to determine the number of sample images that need to be adversarially processed among the plurality of sample images. Suppose the number of adversarial operators is 3, the ratio of one adversarial operator is 10%, the ratio of one adversarial operator is 15%, and the ratio of one adversarial operator is 25%. Then, according to the ratios of the 3 adversarial operators, it can be determined that among the plurality of sample images, the number of sample images that need to be adversarially processed is 50% of the number of the plurality of sample images.

[0041] In the embodiment of the present disclosure, by setting the ratio of the adversarial operator, the number and generation frequency of the sample images that need to be adversarially processed during the generation process of the adversarial sample images can be flexibly adjusted through the ratio of the adversarial operator, improving the flexibility of adjustment.

[0042] Among them, the parameter information of the adversarial operator is used to set a predetermined norm and a norm boundary, so that the perturbation can be controlled within the predetermined norm and the norm boundary through the parameter information of the adversarial operator, realizing controllable perturbation size and capable of enhancing the uniformity of the perturbation norm size of the adversarial sample images. For example, the parameter information of the adversarial operator may include the accepted norm category, the maximum perturbation size, and the single-step perturbation step size, and may also include other information, which can be specifically set according to actual needs. Here, the embodiment of the present disclosure only takes the parameter information of the adversarial operator including the accepted norm category, the maximum perturbation size, and the single-step perturbation step size as an example for illustration, but does not represent that the embodiment of the present disclosure is only limited thereto.

[0043] For example, when obtaining a plurality of sample images, the plurality of sample images can be received from other electronic devices, or obtained from local storage, or obtained in other ways, which can be specifically set according to actual needs. Here, the present disclosure does not make specific limitations on the acquisition method of the plurality of sample images.

[0044] Exemplarily, when obtaining the respective ratios and adversarial parameters of multiple adversarial operators, the respective ratios and adversarial parameters of the multiple adversarial operators can be set fixedly or set dynamically according to actual needs, and can be specifically set according to actual needs. Here, for the obtaining of the respective ratios and adversarial parameters of the multiple adversarial operators, the embodiments of the present disclosure do not make specific limitations.

[0045] After respectively obtaining multiple sample images and the respective ratios and adversarial parameters of multiple adversarial operators, the multiple sample images to be adversarially processed, i.e., the multiple to-be-processed sample images, can be determined from the multiple sample images according to the respective ratios of the multiple adversarial operators, that is, the following S102 is executed:

[0046] S102: Determine multiple to-be-processed sample images to be adversarially processed from multiple sample images according to the respective ratios of the multiple adversarial operators; wherein, each of the multiple to-be-processed sample images corresponds to an adversarial operator.

[0047] Suppose the number of multiple sample images is 1000 and the number of multiple adversarial operators is 3, which can be respectively denoted as the first adversarial operator, the second adversarial operator, and the third adversarial operator; wherein, the ratio of the first adversarial operator is 10%, the ratio of the second adversarial operator is 15%, and the ratio of the third adversarial operator is 25%. Then, according to the ratio of 10% of the first adversarial operator, 100 sample images can be randomly selected from 1000 sample images as the to-be-processed sample images that need to be adversarially processed; according to the ratio of 15% of the second adversarial operator, 150 sample images can be randomly selected from the remaining 900 sample images as the to-be-processed sample images that need to be adversarially processed, and then 250 sample images can be randomly selected from the remaining 750 sample images as the to-be-processed sample images that need to be adversarially processed. In this way, 500 sample images can be randomly selected from the 1000 sample images as the multiple to-be-processed sample images that need to be adversarially processed.

[0048] It can be understood that after determining multiple to-be-processed sample images that need to be adversarially processed from multiple sample images according to the respective ratios of the multiple adversarial operators, each to-be-processed sample image among the multiple to-be-processed sample images will correspond to an adversarial operator. For example, among the 500 selected sample images, 100 to-be-processed sample images are determined based on the ratio of 10% corresponding to the first adversarial operator, then the adversarial operator corresponding to each of the 100 to-be-processed sample images is the first adversarial operator; similarly, 150 to-be-processed sample images are determined based on the ratio of 15% corresponding to the second adversarial operator, then the adversarial operator corresponding to each of the 150 to-be-processed sample images is the second adversarial operator; 250 to-be-processed sample images are determined based on the ratio of 25% corresponding to the third adversarial operator, then the adversarial operator corresponding to each of the 250 to-be-processed sample images is the third adversarial operator.

[0049] After determining multiple to-be-processed sample images to be adversarially processed from multiple sample images according to the respective ratios of multiple adversarial operators, the multiple to-be-processed sample images can be processed based on the adversarial parameters of the adversarial operators corresponding to the multiple to-be-processed sample images respectively, that is, the following S103 is executed:

[0050] S103: Process the multiple to-be-processed sample images based on the adversarial parameters of the adversarial operators corresponding to the multiple to-be-processed sample images respectively to obtain adversarial sample images.

[0051] Processing the multiple to-be-processed sample images based on the adversarial parameters of the adversarial operators corresponding to the multiple to-be-processed sample images respectively can control the perturbation within a predetermined norm and norm boundary through the parameter information of the adversarial operators, realizing controllable perturbation size and improving the uniformity of the perturbation norm size of the adversarial sample images.

[0052] It can be seen that in the embodiments of the present disclosure, when obtaining adversarial sample images, the respective ratios and adversarial parameters of multiple sample images and multiple adversarial operators can be obtained separately first; then, multiple to-be-processed sample images to be adversarially processed are determined from the multiple sample images according to the respective ratios of the multiple adversarial operators; and then, the multiple to-be-processed sample images are processed based on the adversarial parameters of the adversarial operators corresponding to the multiple to-be-processed sample images respectively to obtain adversarial sample images, thereby obtaining adversarial sample images; in addition, using the adversarial parameters of multiple adversarial operators to perform adversarial processing on the sample images can improve the uniformity of the perturbation norm size of the adversarial sample images.

[0053] In this way, subsequently, an image processing model can be jointly trained based on the normal sample images and the adversarial sample images, so that the trained image processing model can process normal images well and process adversarial images well, thereby improving the adversarial ability of the image processing model.

[0054] Based on the above Figure 1 shown embodiments, for the sake of facilitating understanding of how to process the multiple to-be-processed sample images based on the adversarial parameters of the adversarial operators corresponding to the multiple to-be-processed sample images respectively to obtain adversarial sample images in S103 shown in Embodiment 1, hereinafter, the following Figure 2 shown Embodiment 2 will be described in detail.

[0055] Embodiment 2

[0056] Figure 2 is a schematic flowchart of a method for processing multiple to-be-processed sample images to obtain adversarial sample images according to the second embodiment of the present disclosure, and this method can also be executed by software and / or hardware devices. For example, please refer to Figure 2As shown, the method for processing multiple sample images to be processed to obtain adversarial sample images may include:

[0057] S201. Process the multiple sample images to be processed based on the adversarial parameters of the adversarial operators corresponding to the multiple sample images to be processed, so as to obtain the inverse-normalized adversarial samples corresponding to the multiple sample images to be processed.

[0058] Exemplarily, when processing the multiple sample images to be processed based on the adversarial parameters of the adversarial operators corresponding to the multiple sample images to be processed, there may be two cases:

[0059] One case is: Given that generally, when performing adversarial processing on a sample image, the adversarial processing is usually performed on the sample image before normalization. Therefore, when the multiple sample images to be processed are sample images after normalization processing, the multiple sample images to be processed may first be subjected to inverse-normalization processing to obtain the inverse-normalized sample images corresponding to the multiple processed sample images; and based on the adversarial parameters of the adversarial operators corresponding to the multiple sample images to be processed, perform adversarial processing on the inverse-normalized sample images corresponding to the multiple processed sample images.

[0060] In this case, when performing normalization processing on the sample image, generally, the sample information corresponding to the sample image dataset, such as the mean and variance, may also include other information, such as dimensions, to perform normalization processing on the sample image to obtain the sample image after normalization processing; taking the sample information including the mean and method as an example, correspondingly, when performing inverse-normalization processing on the multiple sample images to be processed, the mean and variance corresponding to the sample image dataset may also be used to perform inverse-normalization processing on the sample image to obtain the inverse-normalized sample image corresponding to the sample image.

[0061] Another case is: When the multiple sample images to be processed are directly unnormalized sample images, then the multiple unnormalized sample images to be processed may be directly processed based on the adversarial parameters of the adversarial operators corresponding to the multiple sample images to be processed.

[0062] Exemplarily, when processing the multiple sample images to be processed, in addition to processing the multiple sample images to be processed according to the adversarial parameters of the adversarial operator, the adversarial target of the adversarial operator, such as targeted adversarial or untargeted adversarial, may also be combined to jointly process the multiple sample images to be processed; here, the embodiments of the present disclosure only take processing the multiple sample images to be processed based on the adversarial parameters of the adversarial operators corresponding to the multiple sample images to be processed as an example for illustration, but it does not mean that the embodiments of the present disclosure are only limited to this.

[0063] Based on the adversarial parameters of the adversarial operators corresponding to multiple sample images to be processed, processing the multiple sample images to be processed can obtain the inverse-normalized adversarial samples corresponding to the multiple sample images to be processed. In general, the input of an image processing model is a normalized sample image. Therefore, in order to meet the input requirements of the image processing model, the obtained inverse-normalized adversarial samples can be further normalized, that is, execute the following S202:

[0064] S202. Normalize the inverse-normalized adversarial samples corresponding to the multiple sample images to be processed to obtain the normalized adversarial samples corresponding to the multiple sample images to be processed.

[0065] Exemplarily, when normalizing the inverse-normalized adversarial samples corresponding to the multiple sample images to be processed, refer to the description in the above S201. The sample images can also be normalized using the mean and variance corresponding to the sample image dataset to obtain the normalized adversarial samples corresponding to the multiple sample images to be processed.

[0066] After obtaining the normalized adversarial samples corresponding to the multiple sample images to be processed in this way, an adversarial sample image can be further obtained based on the multiple sample images to be processed and the normalized adversarial samples corresponding to the multiple sample images to be processed, that is, execute the following S203:

[0067] S203. Obtain an adversarial sample image based on the multiple sample images to be processed and the normalized adversarial samples corresponding to the multiple sample images to be processed.

[0068] Exemplarily, when obtaining an adversarial sample image based on the multiple sample images to be processed and the normalized adversarial samples corresponding to the multiple sample images to be processed, the normalized adversarial samples corresponding to the multiple sample images to be processed can be input into the image processing model to obtain the label information corresponding to each normalized adversarial sample; and match the label information corresponding to the multiple sample images to be processed with the label information corresponding to the normalized adversarial samples. If the label information corresponding to the sample image to be processed is different from the label information corresponding to the normalized adversarial sample image, it is determined that the generation of the adversarial sample image fails; on the contrary, if the label information corresponding to the sample image to be processed is the same as the label information corresponding to the normalized adversarial sample image, it indicates that the generation of the adversarial sample image is successful, and the normalized adversarial sample image is determined as the adversarial sample image, thereby obtaining the adversarial sample image.

[0069] Exemplarily, the above-described inverse-normalized adversarial sample image, normalized adversarial sample image, and the predicted classification information of the normalized adversarial sample image can be stored in a finite state machine.

[0070] It can be seen that in the embodiments of the present disclosure, when processing multiple to-be-processed sample images based on the adversarial parameters of the adversarial operators corresponding to each of the multiple to-be-processed sample images to obtain adversarial sample images, it is possible to first process the multiple to-be-processed sample images based on the adversarial parameters of the adversarial operators corresponding to each of the multiple to-be-processed sample images to obtain inverse-normalized adversarial samples corresponding to each of the multiple to-be-processed sample images; and perform normalization processing on the inverse-normalized adversarial samples corresponding to each of the multiple to-be-processed sample images to obtain normalized adversarial samples corresponding to each of the multiple to-be-processed sample images; then, based on the multiple to-be-processed sample images and the normalized adversarial samples corresponding to each of the multiple to-be-processed sample images, obtain the adversarial sample images, thereby obtaining the adversarial sample images.

[0071] Based on any of the above embodiments, after processing multiple to-be-processed sample images based on the sample information and the adversarial parameters of the adversarial operators corresponding to each of the multiple to-be-processed sample images to obtain adversarial sample images, it is further possible to train and generate an image processing model based on the adversarial sample images, so that the trained image processing model can not only process conventional images well, but also process adversarial images well, thereby improving the adversarial ability of the image processing model. Next, the following Figure 3 Example 3 shown will be used to describe in detail how to jointly train and generate an image processing model based on adversarial sample images.

[0072] Example 3

[0073] Figure 3 FIG. is a schematic flowchart of a method for jointly training and generating an image processing model based on adversarial sample images according to the third embodiment of the present disclosure. This method can also be executed by software and / or hardware devices. For example, please refer to Figure 3 shown. The method for jointly training and generating an image processing model based on adversarial sample images may include:

[0074] S301. Obtain a training sample image set.

[0075] Among them, the training sample image set includes multiple sample images that have not been adversarially processed and multiple adversarial sample images among the multiple sample images, as well as the label information corresponding to each target sample image, and the target sample image is any one of the multiple sample images and the multiple adversarial sample images.

[0076] It can be understood that the multiple adversarial sample images are normalized adversarial sample images. To ensure that the multiple sample images are also normalized sample images, before processing based on the multiple sample images and the multiple adversarial sample images, it is possible to first determine whether the multiple sample images are normalized sample images. If the multiple sample images are non-normalized sample images, then the above Figure 2For the means and variances in the illustrated embodiments, normalize the multiple sample images to obtain the normalized sample images, and input each target sample image into the image processing model respectively; if the multiple sample images are the normalized sample images, directly input each target sample image into the image processing model respectively, that is, execute the following S302 to train the image processing model.

[0077] S302: Input each target sample image into the image processing model respectively to obtain the predicted label information corresponding to each target sample image.

[0078] Among them, the predicted label information is the label information obtained by inputting each target sample image into the image processing model respectively through the image processing model. In order to distinguish the label information corresponding to each target sample image, the label information obtained by the image processing model can be denoted as the predicted label information here.

[0079] Exemplarily, the image processing model can be an image classification model, an image recognition model, an image segmentation model, etc., and can be specifically set according to actual needs.

[0080] It should be noted that when the image processing model is different deep learning models, their corresponding model outputs are different. For example, when the image processing model is an image classification model, the model output of the image classification model is the category to which the image belongs; when the image processing model is an image recognition model, the model output of the image recognition model is the recognition result of the image; when the image processing model is an image segmentation model, the model output of the image segmentation model is the segmentation result of the image.

[0081] After obtaining the predicted label information and the label information corresponding to each target sample image respectively through the above S301 and S302, the following S303 can be executed:

[0082] S303: Update the network parameters of the image processing model according to the predicted label information and the label information corresponding to each target sample image.

[0083] It can be understood that in order to enable the trained image processing model to process both conventional images and adversarial images well, therefore, it is necessary to train both the natural accuracy and the adversarial accuracy of the image processing model, which can be specifically realized through a loss function. Among them, the natural accuracy can be understood as the processing accuracy of the image processing model when processing conventional images, and the adversarial accuracy can be understood as the processing accuracy of the image processing model when processing adversarial images.

[0084] Exemplarily, when updating the network parameters of the image processing model according to the prediction label information and label information corresponding to each target sample image in multiple sample images and multiple adversarial sample images, for each target sample image, the loss function corresponding to the target sample image can be first calculated and determined according to the prediction label information and label information corresponding to the target sample image, so as to obtain the loss function corresponding to each target sample image, and then the network parameters of the image processing model can be updated according to the loss function corresponding to each target sample image.

[0085] Exemplarily, when updating the network parameters of the image processing model according to the loss function corresponding to each target sample image, since the multiple sample images and multiple adversarial sample images included in the training sample image set are the same batch of sample images for one training operation, therefore, the average loss function corresponding to the loss function corresponding to each target sample image can be first determined; and the network parameters of the image processing model can be updated according to the average loss function. If the updated image processing model converges, the updated image processing model is directly determined as the finally trained image processing model; if the updated image processing model does not converge, the above steps are performed again until the updated image processing model converges, and the image processing model at the time of convergence is determined as the finally trained image processing model, so as to obtain the final image processing model. The image processing model trained in this way can not only process conventional images well, but also process adversarial images well, thereby improving the adversarial ability of the image processing model.

[0086] Combined with the above description, after the image processing model is trained, in the application process, the image processing model can be used to process the image to be processed, thereby effectively improving the accuracy of the image processing result.

[0087] Embodiment 4

[0088] Figure 4 It is a schematic structural diagram of an adversarial sample image acquisition device 40 provided according to the fourth embodiment of the present disclosure. Exemplarily, please refer to Figure 4 As shown, the adversarial sample image acquisition device 40 may include:

[0089] A first acquisition unit 401, configured to acquire a plurality of sample images, as well as the respective ratios and adversarial parameters of a plurality of adversarial operators.

[0090] A first processing unit 402, configured to determine a plurality of sample images to be adversarially processed from the plurality of sample images according to the respective ratios of the plurality of adversarial operators; wherein, each of the plurality of sample images to be processed corresponds to an adversarial operator.

[0091] The second processing unit 403 is configured to process a plurality of sample images to be processed based on the adversarial parameters of the adversarial operators corresponding to the plurality of sample images to be processed, so as to obtain adversarial sample images.

[0092] Optionally, the second processing unit 403 includes a first processing module, a second processing module, and a third processing module.

[0093] The first processing module is configured to process a plurality of sample images to be processed based on the adversarial parameters of the adversarial operators corresponding to the plurality of sample images to be processed, so as to obtain inverse-normalized adversarial samples corresponding to the plurality of sample images to be processed.

[0094] The second processing module is configured to perform normalization processing on the inverse-normalized adversarial samples corresponding to the plurality of sample images to be processed, so as to obtain normalized adversarial samples corresponding to the plurality of sample images to be processed.

[0095] The third processing module is configured to obtain adversarial sample images according to the plurality of sample images to be processed and the normalized adversarial samples corresponding to the plurality of sample images to be processed.

[0096] Optionally, the plurality of sample images to be processed are sample images after normalization processing; the first processing module includes a first processing sub-module and a second processing sub-module.

[0097] The first processing sub-module is configured to perform inverse-normalization processing on the plurality of sample images to be processed, so as to obtain inverse-normalized sample images corresponding to the plurality of processed sample images.

[0098] The second processing sub-module is configured to perform adversarial processing on the inverse-normalized sample images corresponding to the plurality of processed sample images based on the adversarial parameters of the adversarial operators corresponding to the plurality of sample images to be processed, so as to obtain inverse-normalized adversarial samples corresponding to the plurality of sample images to be processed.

[0099] Optionally, the third processing module includes a third processing sub-module and a fourth processing sub-module.

[0100] The third processing sub-module is configured to input the normalized adversarial samples corresponding to the plurality of sample images to be processed into an image processing model, so as to obtain label information corresponding to each normalized adversarial sample.

[0101] The fourth processing sub-module is configured to determine the normalized adversarial sample image as an adversarial sample image if the label information corresponding to the sample image to be processed is the same as the label information corresponding to the normalized adversarial sample image corresponding thereto.

[0102] Optionally, the apparatus 40 for obtaining the adversarial sample image further includes a second obtaining unit, a third processing unit, and an updating unit.

[0103] A second acquisition unit, configured to acquire a set of training sample images; wherein, the set of training sample images includes a plurality of sample images that have not been adversarially processed and a plurality of adversarial sample images among the plurality of sample images, as well as label information corresponding to each target sample image, and the target sample image is any one of the plurality of sample images and the plurality of adversarial sample images.

[0104] A third processing unit, configured to input each target sample image into an image processing model respectively, to obtain prediction label information corresponding to each target sample image.

[0105] An update unit, configured to update network parameters of the image processing model according to the prediction label information and the label information corresponding to each target sample image.

[0106] Optionally, the update unit includes a first update module and a second update module.

[0107] The first update module is configured to, for each target sample image, determine a loss function corresponding to the target sample image according to the prediction label information and the label information corresponding to the target sample image.

[0108] The second update module is configured to update network parameters of the image processing model according to the loss functions corresponding to each target sample image.

[0109] Optionally, the second update module includes a first update sub-module and a second update sub-module.

[0110] The first update sub-module is configured to determine an average loss function corresponding to the loss function corresponding to each target sample image.

[0111] The second update sub-module is configured to update network parameters of the image processing model according to the average loss function.

[0112] The acquisition device 40 for adversarial sample images provided by an embodiment of the present disclosure can execute the technical solution of the method for acquiring adversarial sample images shown in any of the above embodiments. Its implementation principle and beneficial effects are similar to those of the method for acquiring adversarial sample images. For details, refer to the implementation principle and beneficial effects of the method for acquiring adversarial sample images, which will not be elaborated here.

[0113] According to an embodiment of the present disclosure, the present disclosure further provides an electronic device, a readable storage medium, and a computer program product.

[0114] According to an embodiment of the present disclosure, the present disclosure also provides a computer program product, which includes: a computer program stored in a readable storage medium, and at least one processor of the electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to enable the electronic device to execute the solution provided in any of the above embodiments.

[0115] Figure 5 FIG. 4 is a schematic block diagram of an electronic device 50 provided by an embodiment of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as, for example, a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, for example, a personal digital processor, a cellular phone, a smart phone, a wearable device, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0116] As Figure 5 shown in FIG. 4, the device 50 includes a computing unit 501, which can execute various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the device 50 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0117] A plurality of components in the device 50 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a magnetic disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the device 50 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0118] The computing unit 501 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 executes the various methods and processes described above, such as the method for obtaining adversarial sample images. For example, in some embodiments, the method for obtaining adversarial sample images can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device 50 via the ROM 502 and / or the communication unit 509. When the computer program is loaded into the RAM 503 and executed by the computing unit 501, one or more steps of the method for obtaining adversarial sample images described above can be executed. Alternatively, in other embodiments, the computing unit 501 can be configured to execute the method for obtaining adversarial sample images in any other suitable manner (e.g., by means of firmware).

[0119] Various embodiments of the systems and techniques described above in this document can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special-purpose or general-purpose programmable processor, receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting the data and instructions to the storage system, the at least one input device, and the at least one output device.

[0120] The program code for implementing the methods of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing devices, such that when the program codes are executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program codes can be executed entirely on the machine, partially on the machine, as an independent software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0121] In the context of this disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0122] In order to provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, speech input, or tactile input).

[0123] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer having a graphical user interface or a web browser through which the user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0124] A computer system may include a client and a server. The client and the server are generally far from each other and usually interact via a communication network. The relationship between the client and the server is created by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system, and solves the defects of difficult management and weak business scalability existing in traditional physical hosts and VPS services ("Virtual Private Server", or simply "VPS"). The server may also be a server of a distributed system or a server combined with a blockchain.

[0125] It should be understood that various forms of processes shown above can be used, steps can be reordered, added or deleted. For example, the steps described in the present disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved, and no limitations are imposed herein.

[0126] The above specific embodiments do not constitute a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principle of the present disclosure shall be included within the protection scope of the present disclosure.

Claims

1. A method for obtaining adversarial sample images, comprising: Obtaining a plurality of sample images, as well as the respective ratios and adversarial parameters of a plurality of adversarial operators, where the adversarial operator is an algorithm that performs adversarial processing on the sample images based on the corresponding adversarial parameters to obtain adversarial sample images; Determining a plurality of sample images to be adversarially processed from the plurality of sample images according to the respective ratios of the plurality of adversarial operators; wherein, the plurality of sample images to be processed correspond to their respective adversarial operators; Processing the plurality of sample images to be processed based on the adversarial parameters of the adversarial operators corresponding to the plurality of sample images to be processed, to obtain the inverse-normalized adversarial samples corresponding to the plurality of sample images to be processed; Performing normalization processing on the inverse-normalized adversarial samples corresponding to the plurality of sample images to be processed, to obtain the normalized adversarial samples corresponding to the plurality of sample images to be processed; Obtaining adversarial sample images according to the plurality of sample images to be processed and the normalized adversarial samples corresponding to the plurality of sample images to be processed.

2. The method according to claim 1, wherein The plurality of sample images to be processed are sample images after normalization processing; The processing the plurality of sample images to be processed based on the adversarial parameters of the adversarial operators corresponding to the plurality of sample images to be processed, to obtain the inverse-normalized adversarial samples corresponding to the plurality of sample images to be processed, includes: Performing inverse-normalization processing on the plurality of sample images to be processed, to obtain the inverse-normalized sample images corresponding to the plurality of processed sample images; Performing adversarial processing on the inverse-normalized sample images corresponding to the plurality of processed sample images based on the adversarial parameters of the adversarial operators corresponding to the plurality of sample images to be processed, to obtain the inverse-normalized adversarial samples corresponding to the plurality of sample images to be processed.

3. The method according to claim 1 or 2, wherein The obtaining the adversarial sample images according to the plurality of sample images to be processed and the normalized adversarial samples corresponding to the plurality of sample images to be processed, includes: Inputting the normalized adversarial samples corresponding to the plurality of sample images to be processed into an image processing model, to obtain the label information corresponding to each normalized adversarial sample; If the label information corresponding to the sample image to be processed is the same as the label information corresponding to its corresponding normalized adversarial sample image, then determining the normalized adversarial sample image as the adversarial sample image.

4. According to the method described in claim 3, the method further includes: Obtaining a training sample image set; wherein, the training sample image set includes a plurality of sample images that have not been adversarially processed and a plurality of adversarial sample images among the plurality of sample images, as well as the label information corresponding to each target sample image, and the target sample image is any one of the plurality of sample images and the plurality of adversarial sample images; Inputting each of the target sample images into the image processing model respectively, to obtain the predicted label information corresponding to each target sample image; Updating the network parameters of the image processing model according to the predicted label information and the label information corresponding to each target sample image.

5. The method according to claim 4, wherein Updating the network parameters of the image processing model according to the predicted label information corresponding to each of the target sample images and the label information includes: For each of the target sample images, determining a loss function corresponding to the target sample image according to the predicted label information corresponding to the target sample image and the label information; Updating the network parameters of the image processing model according to the loss functions corresponding to the target sample images.

6. The method according to claim 5, wherein The updating the network parameters of the image processing model according to the loss functions corresponding to the target sample images includes: Determining an average loss function corresponding to the loss functions corresponding to the target sample images; Updating the network parameters of the image processing model according to the average loss function.

7. An apparatus for obtaining adversarial sample images, comprising: A first obtaining unit, configured to obtain a plurality of sample images, as well as respective ratios and adversarial parameters of a plurality of adversarial operators, where the adversarial operator is an algorithm for performing adversarial processing on the sample images based on corresponding adversarial parameters to obtain adversarial sample images; A first processing unit, configured to determine a plurality of to-be-processed sample images to be adversarially processed from the plurality of sample images according to the respective ratios of the plurality of adversarial operators; wherein, each of the plurality of to-be-processed sample images corresponds to an adversarial operator; A second processing unit, configured to process the plurality of to-be-processed sample images based on the adversarial parameters of the adversarial operators corresponding to the plurality of to-be-processed sample images respectively to obtain adversarial sample images; wherein, the second processing unit includes a first processing module, a second processing module, and a third processing module; The first processing module is configured to process the plurality of to-be-processed sample images based on the adversarial parameters of the adversarial operators corresponding to the plurality of to-be-processed sample images respectively to obtain inverse-normalized adversarial samples corresponding to the plurality of to-be-processed sample images respectively; The second processing module is configured to perform normalization processing on the inverse-normalized adversarial samples corresponding to the plurality of to-be-processed sample images respectively to obtain normalized adversarial samples corresponding to the plurality of to-be-processed sample images respectively; The third processing module is configured to obtain the adversarial sample images according to the plurality of to-be-processed sample images and the normalized adversarial samples corresponding to the plurality of to-be-processed sample images respectively.

8. The apparatus according to claim 7, wherein The plurality of to-be-processed sample images are sample images after normalization processing; the first processing module includes a first processing sub-module and a second processing sub-module; The first processing sub-module is configured to perform inverse-normalization processing on the plurality of to-be-processed sample images to obtain inverse-normalized sample images corresponding to the plurality of processed sample images respectively; The second processing sub-module is configured to perform adversarial processing on the inverse-normalized sample images corresponding to the plurality of processed sample images respectively based on the adversarial parameters of the adversarial operators corresponding to the plurality of to-be-processed sample images respectively to obtain inverse-normalized adversarial samples corresponding to the plurality of to-be-processed sample images respectively.

9. The device according to claim 7 or 8, wherein, The third processing module includes a third processing sub-module and a fourth processing sub-module; The third processing sub-module is configured to input the normalized adversarial samples corresponding to the multiple sample images to be processed into an image processing model, and obtain label information corresponding to each normalized adversarial sample; The fourth processing sub-module is configured to, if the label information corresponding to the sample image to be processed is the same as the label information corresponding to the normalized adversarial sample image thereof, determine the normalized adversarial sample image as the adversarial sample image.

10. The apparatus according to claim 9, wherein the apparatus further comprises a second acquisition unit, a third processing unit, and an update unit; The second acquisition unit is configured to acquire a set of training sample images; wherein, The training sample image set includes multiple sample images that have not been adversarially processed and multiple adversarial sample images among the multiple sample images, and label information corresponding to each target sample image, and the target sample image is any sample image among the multiple sample images and the multiple adversarial sample images; The third processing unit is configured to input each of the target sample images into the image processing model, and obtain prediction label information corresponding to each of the target sample images; The update unit is configured to update network parameters of the image processing model according to the prediction label information and the label information corresponding to each of the target sample images.

11. The apparatus according to claim 10, wherein, The update unit includes a first update module and a second update module; The first update module is configured to, for each of the target sample images, determine a loss function corresponding to the target sample image according to the prediction label information and the label information corresponding to the target sample image; The second update module is configured to update network parameters of the image processing model according to the loss functions corresponding to each of the target sample images.

12. The apparatus according to claim 11, wherein, The second update module includes a first update sub-module and a second update sub-module; The first update sub-module is configured to determine an average loss function corresponding to the loss function corresponding to each of the target sample images; The second update sub-module is configured to update network parameters of the image processing model according to the average loss function.

13. An electronic device, comprising: At least one processor; And A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for obtaining an adversarial sample image according to any one of claims 1-6.

14. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to execute the method for obtaining an adversarial sample image according to any one of claims 1-6.

15. A computer program product, comprising a computer program, and when the computer program is executed by a processor, the steps of the method for obtaining an adversarial sample image according to any one of claims 1-6 are implemented.

Images