Training method and device of disturbance generation model

Abstract

Embodiments of the present disclosure disclose a method and device for training a perturbation generation model. A specific implementation of the method includes: obtaining a training data set, wherein the training data in the training data set includes an original image and an original label; obtaining an initial perturbation generation model and an objective function, wherein the optimization target of the objective function includes minimizing a loss function, the optimization target of the loss function includes maximizing a perturbation loss, the perturbation loss represents the difference between the output label of a perturbed image and the corresponding original label, and the perturbed image is generated based on adding a perturbation to the original image; and training the perturbation generation model using the training data set and the objective function to obtain a trained perturbation generation model. The implementation realizes a new perturbation generation method to avoid image being learned by adversarial training by using the generated perturbation.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of computer technology, and more specifically to a training method and apparatus for perturbation generation models. Background Technology

[0002] The internet currently contains a vast amount of freely accessible image data, such as facial images, which may be collected and used to train neural network models. In many cases, the collection of image data from the internet is done without the prior authorization of the uploader, thus posing a potential risk of user privacy breaches.

[0003] To address this issue, existing technologies mainly involve adding imperceptible perturbations or noise to images (such as loss minimization noise methods, adversarial poisoning noise methods, etc.). These perturbations or noises are usually specially designed to make it difficult to train high-quality neural network models using images with added perturbations or noise, thereby reducing the risk of user privacy leaks.

[0004] However, these existing methods are prone to failure under adversarial training. Image data collectors can train high-quality neural network models by performing slight adversarial training on images with added perturbations or noise. Summary of the Invention

[0005] The embodiments of this disclosure present a method and apparatus for training a perturbation generation model.

[0006] In a first aspect, embodiments of this disclosure provide a training method for a perturbation generation model. The method includes: acquiring a training dataset, wherein the training data in the training dataset includes original images and original labels; acquiring an initial perturbation generation model and an objective function, wherein the optimization objective of the objective function includes minimizing a loss function, the optimization objective of the loss function includes maximizing the perturbation loss, the perturbation loss representing the difference between the output label of the perturbation image and the corresponding original label, and the perturbation image being generated by adding perturbation to the original image; and training the perturbation generation model using the training dataset and the objective function to obtain a trained perturbation generation model.

[0007] Secondly, embodiments of this disclosure provide an image processing method, the method comprising: acquiring an original image set; for an original image in the original image set, performing the following processing steps: determining a target perturbation corresponding to the original image using a pre-trained perturbation generation model, wherein the training dataset of the perturbation generation model includes the original image set, and the target perturbation is a perturbation that satisfies the optimization objective of the objective function of the perturbation generation model; and adding the target perturbation to the original image.

[0008] Thirdly, embodiments of this disclosure provide a training apparatus for a perturbation generation model, the apparatus comprising: a first acquisition unit configured to acquire a training dataset, wherein the training data in the training dataset includes original images and original labels; a second acquisition unit configured to acquire an initial perturbation generation model and an objective function, wherein the optimization objective of the objective function includes minimizing a loss function, the optimization objective of the loss function includes maximizing the perturbation loss, the perturbation loss representing the difference between the output label of the perturbation image and the corresponding original label, the perturbation image being generated by adding perturbation to the original image; and a training unit configured to train the perturbation generation model using the training dataset and the objective function to obtain a trained perturbation generation model.

[0009] Fourthly, embodiments of this disclosure provide an image processing apparatus, comprising: a third acquisition unit configured to acquire an original image set; and a processing unit configured to perform the following processing steps on the original images in the original image set: determining a target perturbation corresponding to the original image using a pre-trained perturbation generation model, wherein the training dataset of the perturbation generation model includes the original image set, and the target perturbation is a perturbation that satisfies the optimization objective of the objective function of the perturbation generation model; and adding the target perturbation to the original image.

[0010] Fifthly, embodiments of this disclosure provide an electronic device comprising: one or more processors; a storage device for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the method described in any implementation of the first aspect.

[0011] In a sixth aspect, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon that, when executed by a processor, implements the method as described in any implementation of the first aspect.

[0012] The training method and apparatus for the perturbation generation model provided in the embodiments of this disclosure address the problem of privacy data leakage in images caused by adversarial training. A novel objective function is proposed, specifically minimizing the loss function, which in turn maximizes the perturbation loss. The perturbation loss represents the difference between the output label of the perturbated image and the corresponding original label. The perturbated image is generated by adding perturbations to the original image, and the perturbation generation model is trained using the objective function. This achieves perturbation processing of the original image. Furthermore, the perturbated image obtained after perturbation processing can suppress the magnitude of the loss function of the neural network model during adversarial training, ensuring that the loss function is not too large. This suppresses the knowledge that can be learned from the perturbated image, thereby avoiding the problem of user privacy leakage caused by adversarial training on the perturbated image. Attached Figure Description

[0013] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0014] Figure 1 This is an exemplary system architecture diagram to which one embodiment of this disclosure can be applied;

[0015] Figure 2 This is a flowchart of an embodiment of the training method for the perturbation generation model according to the present disclosure;

[0016] Figure 3 This is a flowchart of an embodiment of the image processing method according to the present disclosure;

[0017] Figure 4 This is a schematic diagram of an application scenario of an image processing method according to an embodiment of the present disclosure;

[0018] Figure 5 This is a schematic diagram of the structure of a training apparatus for a perturbation generation model according to an embodiment of the present disclosure;

[0019] Figure 6 This is a schematic diagram of the structure of an embodiment of the image processing apparatus according to the present disclosure;

[0020] Figure 7 This is a schematic diagram of the structure of an electronic device suitable for implementing embodiments of the present disclosure. Detailed Implementation

[0021] The present disclosure will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0022] It should be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] Figure 1 An exemplary architecture 100 is shown, which can be used to train a perturbation generation model or a training apparatus for a perturbation generation model, or to process an image, or to process an image, according to an embodiment of the present disclosure.

[0024] like Figure 1As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0025] Terminal devices 101, 102, and 103 interact with server 105 via network 104 to receive or send messages, etc. Various client applications can be installed on terminal devices 101, 102, and 103, such as browser applications, search applications, image processing applications, and machine learning applications.

[0026] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be various electronic devices, including but not limited to smartphones, tablets, e-book readers, laptops, and desktop computers. When terminal devices 101, 102, and 103 are software, they can be installed in the aforementioned electronic devices. They can be implemented as multiple software programs or software modules (e.g., multiple software programs or software modules used to provide distributed services) or as a single software program or software module. No specific limitations are imposed here.

[0027] Server 105 can be a server that provides various services, such as a backend server that provides services to client applications installed on terminal devices 101, 102, and 103. Server 105 can obtain training datasets, initial perturbation generation models, and objective functions from terminal devices 101, 102, and 103, and use the training datasets and objective functions to train the initial perturbation generation model, thereby obtaining a trained perturbation generation model.

[0028] It should be noted that the training dataset, initial perturbation generation model and objective function mentioned above can be directly stored on the local machine of server 105. Server 105 can directly extract the locally stored training dataset, initial perturbation generation model and objective function and process them. At this time, terminal devices 101, 102, 103 and network 104 may not exist.

[0029] It should be noted that the training method or image processing method of the perturbation generation model provided in the embodiments of this disclosure is generally executed by the server 105, and correspondingly, the training device or image processing device of the perturbation generation model is generally set in the server 105.

[0030] It should also be noted that model training tools or image processing applications can be installed in terminal devices 101, 102, and 103. Terminal devices 101, 102, and 103 can train the perturbation generation model based on model training tools, or perform image processing based on image processing applications. In this case, the training method or image processing method of the perturbation generation model can be executed by terminal devices 101, 102, and 103, and correspondingly, the training device or image processing device of the perturbation generation model can be located in terminal devices 101, 102, and 103. In this case, the exemplary system architecture 100 may not include server 105 and network 104.

[0031] It should be noted that server 105 can be either hardware or software. When server 105 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 105 is software, it can be implemented as multiple software programs or software modules (e.g., multiple software programs or software modules used to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0032] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0033] Continue to refer to Figure 2 The diagram illustrates a flow 200 of an embodiment of a training method for a perturbation generation model according to the present disclosure. The training method for the perturbation generation model includes the following steps:

[0034] Step 201: Obtain the training dataset.

[0035] In this embodiment, the execution entity of the training method for the perturbation generation model (such as...) Figure 1 The server 105 shown can obtain the training dataset from local storage devices or other storage devices or third-party data platforms. The training dataset can consist of training data, which may include original images and original labels.

[0036] The original image can be of any type. The original label can be any label set for the image. For example, the label can indicate the category of the image. Or, the label can indicate the attribute of the object included in the image. Each training data point in the training dataset includes a corresponding original image and original label; that is, the original label in each training data point is the label corresponding to the original image in that training data point.

[0037] Step 202: Obtain the initial perturbation generation model and objective function.

[0038] In this embodiment, the executing entity can obtain a pre-built initial perturbation generation model and objective function from local or other storage devices. The initial perturbation generation model can be various neural network models used for image processing. The network structure of the initial perturbation generation model can be flexibly configured by technicians according to actual application requirements. For example, the initial perturbation generation model can be constructed based on various existing image classification or image recognition models.

[0039] The objective function can be the objective function corresponding to the initial perturbation generation model. The objective function can be constructed based on the desired perturbation generation model to assist in the training of the initial perturbation generation model, thereby obtaining the desired perturbation generation model. Generally, during the training process of the initial perturbation generation model, the network parameters of the initial perturbation generation model can be updated by continuously optimizing the objective function.

[0040] The optimization objective of the objective function can include minimizing the loss function. The optimization objective of the loss function can include maximizing the perturbation loss. The perturbation loss can represent the difference between the output label of the perturbated image and the corresponding original label of the perturbated image.

[0041] Perturbed images can be generated by adding perturbations to the original image. Specifically, various perturbation methods can be used to add perturbations to the original image to generate a perturbed image corresponding to the original image. The output label of the perturbed image can refer to the label of the perturbed image determined by the initial perturbation generation model after processing the perturbed image. The original label corresponding to the perturbed image can refer to the original label corresponding to the original image. The method for calculating the difference between the output label and the original label of the perturbed image can be flexibly set according to the actual application requirements.

[0042] Step 203: Use the training dataset and objective function to train the perturbation generation model to obtain the trained perturbation generation model.

[0043] In this embodiment, based on the acquired training dataset and objective function, machine learning methods can be used to train the initial perturbation generation model, thereby obtaining the trained perturbation generation model. Specifically, various existing perturbation solution methods can be used to find the perturbation that maximizes the perturbation loss. Then, with the perturbation fixed, methods such as gradient descent and backpropagation can be used to find the network parameters that minimize the loss function on the training dataset to update the initial perturbation generation model during training.

[0044] As an example, during the training of the initial perturbation generation model, the objective function can be optimized using the projection gradient method to determine the perturbation that minimizes the loss function, and then the network parameters of the initial perturbation generation model can be updated based on the determined perturbation.

[0045] The projection gradient method refers to finding the optimal perturbation "δ" by performing multiple projection gradient updates within a spherical space ||δ||≤ρ. In the Kth iteration, the current perturbation "δ" can be updated according to the following formula. (k) ":

[0046]

[0047] Where "ρ" is the maximum perturbation radius, "α" is the learning rate, and "c" controls the gradient direction, typically set to "1" when solving maximization problems and "-1" when solving minimization problems.

[0048] The optimal perturbation δ^* is found by performing multiple projection gradient updates within the range ‖δ‖≤ρ. In the k-th iteration, the projection gradient method updates the current perturbation value δ^((k)) according to the following formula, where "Π" represents the projection operation in spherical space. θ "Corresponds to the perturbation generation model, "θ" represents the network parameters of the perturbation generation model, "l" represents the loss function, "x" represents the original image, and "y" represents the original label.

[0049] Therefore, after obtaining the trained perturbation generation model, for any image, the perturbation corresponding to the image can be determined by optimizing the objective function using the obtained perturbation generation model. Then, the perturbation can be added to the image to achieve perturbation processing. Furthermore, the perturbation image obtained after perturbation processing can suppress the magnitude of the loss function of the neural network model during adversarial training, so that the loss function is not too large, thereby suppressing the knowledge that can be learned from the perturbation image and thus avoiding the problem of user privacy leakage caused by adversarial training on perturbation images.

[0050] In some optional implementations of this embodiment, the perturbation image can be generated through the following steps:

[0051] Step 1: Add a first perturbation to the original image to obtain the first image.

[0052] In this step, the first perturbation can be any perturbation.

[0053] Step two: Perform data augmentation on the first image to obtain the augmented image.

[0054] In this step, data augmentation can be performed using various methods, such as flipping, cropping, blurring, erasing, and color transformation.

[0055] Step 3: Generate a perturbation image based on the enhanced image.

[0056] In this step, various methods can be used to generate a perturbation image from the enhanced image. For example, the resulting enhanced image can be directly identified as the perturbation image.

[0057] When generating perturbation images, image augmentation operations can be used to process images, which can expand the amount of training data, thereby helping to improve the stability and transferability of the perturbations determined by the resulting perturbation generation model.

[0058] Optionally, when performing data augmentation on the first image, a random augmentation method can be used to further expand the amount of training data, thereby further improving the stability and transferability of the perturbation determined by the obtained perturbation generation model.

[0059] Optionally, after data augmentation of the first image to obtain an augmented image, a second perturbation can be added to the augmented image to obtain a perturbed image. The second perturbation can be arbitrary. Generally, the first perturbation can characterize the magnitude of the perturbation to the original image. The second perturbation can characterize the ability to resist adversarial training.

[0060] It should be noted that, in order to distinguish between different disturbances, they are named the first disturbance and the second disturbance, respectively. The terms "first" and "second" do not constitute a special limitation on the disturbance.

[0061] Therefore, by using the trained perturbation generation model to generate perturbations in the image and then adding perturbations to the image, the resulting perturbation image can have a certain ability to resist adversarial training, thereby effectively protecting the data privacy of the original image and improving data security.

[0062] In some optional implementations of this embodiment, the optimization objective of the objective function may further include minimizing the expected value of maximizing the perturbation loss. The expected value of the perturbation loss may refer to the expected value of the perturbation loss corresponding to various data augmentations performed after adding perturbations to the original images of the training data.

[0063] By controlling the expected value of the perturbation loss, the stability of the perturbation determined by the obtained perturbation generation model can be further improved, making the obtained perturbation generation model have a certain degree of robustness.

[0064] As an example, the objective function of the initial perturbation generation model can be:

[0065]

[0066] Where "min" means minimization, "max" means maximization, "n" represents the number of original images included in the training dataset, "i" represents the "i"th original image, "E" represents the expectation, and "∑" represents the summation operation. "f′ θThe symbol "" represents a perturbation-generated model, where "θ" represents the network parameters of the perturbation-generated model. "t~T" represents random data augmentation. "l" represents the loss function. i "Indicates the original image." i " indicates the original label. Indicates the first disturbance. This represents the second perturbation. "ρ" u " and "ρ a "It can be preset by technicians, among which, "ρ u "Limit the disturbance amplitude, "ρ a "Limited ability to resist confrontation training. Generally, "ρ u "greater than" ρ a ".

[0067] Based on this objective function, the network parameters of the initial perturbation generation model can be updated in each iteration by solving... and Then solve the outermost layer ∑ to determine the optimal perturbation Then, gradient descent and backpropagation algorithms are used to update the network parameters of the initial perturbation generation model based on the optimal perturbation.

[0068] Among them, for The projected gradient method can be used to solve for the perturbation that maximizes l. for about The gradient can be approximated using the following formula:

[0069]

[0070]

[0071] Meanwhile, the expected gradient based on random data augmentation can be approximated by solving the gradient in the same way, and then calculating the average of the gradients corresponding to each data augmentation. The gradient calculated for the outermost minimization can also be solved using the projected gradient method.

[0072] The method provided in the above embodiments of this disclosure optimizes the objective function by minimizing the loss function, and the optimization objective of the loss function includes maximizing the perturbation loss. The perturbation loss represents the difference between the output label of the perturbation image and the corresponding original label. The perturbation image is generated by adding perturbation to the original image, and the perturbation generation model is trained using the objective function. This enables the perturbation processing of the original image. Furthermore, the perturbation image obtained after perturbation processing can suppress the size of the loss function of the neural network model during adversarial training, ensuring that the loss function is not too large. This suppresses the knowledge that can be learned from the perturbation image, thereby avoiding the problem of user privacy leakage caused by adversarial training on the perturbation image.

[0073] The following is for reference. Figure 3 The diagram illustrates a flow 300 of an embodiment of an image processing method according to the present disclosure. The image processing method includes the following steps:

[0074] Step 301: Obtain the original image set.

[0075] In this embodiment, the original image set can consist of original images. The original images can be of various types. The execution entity of the image processing method (such as...) Figure 1 Servers such as 105 can obtain the original image set from local storage devices or other storage devices or third-party data platforms.

[0076] Step 302: For the original images in the original image set, perform the following processing steps 3021-3022:

[0077] Step 3021: Determine the target perturbation corresponding to the original image using a pre-trained perturbation generation model.

[0078] In this embodiment, the training dataset of the perturbation generation model may include the original image set obtained in step 301, and may also include the original labels corresponding to each original image in the obtained original image set.

[0079] The target perturbation can refer to the perturbation that satisfies the optimization objective of the perturbation generation model, that is, the optimal perturbation that satisfies the optimization objective of the objective function. The objective function of the perturbation generation model can be found by referring to... Figure 2 The relevant descriptions in the examples are as follows.

[0080] Step 3022: Add target perturbation to the original image.

[0081] In this embodiment, a target perturbation can be added to the original image to obtain a corresponding perturbed image. Combined with... Figure 2As can be seen from the examples, the original image with added target perturbation has a certain ability to resist adversarial training. Therefore, even if the original image with added target perturbation is collected and used for training a neural network model, a high-quality neural network model can be obtained, thereby reducing the risk of data privacy leakage in the original image.

[0082] and Figure 2 The example in the image shows that the target perturbation can be added to the original image using the following formula:

[0083]

[0084] Where "x" represents the original image. "x′" represents the original image after adding the target perturbation, or the perturbated image. "y" represents the original label. "f′" represents the original label. θ The symbol "" represents a perturbation-generated model, where "θ" represents the network parameters of the perturbation-generated model. "t~T" represents random data augmentation. "l" represents the loss function. "δ" represents the perturbation-generated model. u "δ" represents the first perturbation. a "This indicates the second perturbation." u " and "ρ a "It can be preset by technicians, among which, "ρ u "Limit the disturbance amplitude, "ρ a "Limited ability to resist confrontation training. Generally, "ρ u "greater than" ρ a The optimal "δ" was obtained by solving the problem. u This is the target disturbance.

[0085] It should be noted that the execution subject of the image processing method in this embodiment can be the same as that described above. Figure 2 The entities executing the training methods of the perturbation generation models in the embodiments may be the same or different.

[0086] See also Figure 4 , Figure 4 This is an illustrative application scenario 400 of the image processing method according to this embodiment. Figure 4 In the application scenario, after the executing entity obtains the original image set 301 uploaded by the user through terminal 306, for each original image in the original image set 301, it can use a perturbation generation model 303, pre-trained with the original image set 301 and the corresponding original label set 302, to determine the target perturbation 304. Then, the corresponding target perturbation can be added to the original image to obtain a perturbed image 305. Afterwards, the perturbed images corresponding to each original image in the original image set 301 can be displayed, thereby protecting the privacy data in the original images.

[0087] The method provided in the above embodiments of this disclosure uses a trained perturbation generation model to determine the target perturbation corresponding to each original image in the original image set, and adds the corresponding target perturbation to each original image to obtain a perturbation image, thereby protecting the original images, preventing the original images from being collected for training neural network models and causing the data in the original images to be leaked, and improving the security of data that can be arbitrarily accessed on the network.

[0088] Further reference Figure 5 As a response to the above Figure 2 The implementation of the method shown herein provides an embodiment of a training apparatus for a perturbation generation model, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0089] like Figure 5 As shown, the training device 500 for the perturbation generation model provided in this embodiment includes a first acquisition unit 501, a second acquisition unit 502, and a training unit 503. The first acquisition unit 501 is configured to acquire a training dataset, wherein the training data in the training dataset includes original images and original labels. The second acquisition unit 502 is configured to acquire an initial perturbation generation model and an objective function, wherein the optimization objective of the objective function includes minimizing a loss function, and the optimization objective of the loss function includes maximizing the perturbation loss. The perturbation loss represents the difference between the output label of the perturbation image and the corresponding original label, and the perturbation image is generated by adding perturbation to the original image. The training unit 503 is configured to train the perturbation generation model using the training dataset and the objective function to obtain a trained perturbation generation model.

[0090] In this embodiment, the specific processing of the first acquisition unit 501, the second acquisition unit 502, and the training unit 503 in the training device 500 for the perturbation generation model, and the resulting technical effects, can be found in the following references: Figure 2 The relevant descriptions of steps 201, 202 and 203 in the corresponding embodiments will not be repeated here.

[0091] In some optional implementations of this embodiment, the perturbation image is generated through the following steps: adding a first perturbation to the original image to obtain a first image; performing data augmentation on the first image to obtain an enhanced image; and generating the perturbation image based on the enhanced image.

[0092] In some optional implementations of this embodiment, the perturbation image is generated through the following steps: adding a first perturbation to the original image to obtain a first image; performing data augmentation on the first image to obtain an enhanced image; and adding a second perturbation to the enhanced image to obtain a perturbation image.

[0093] In some optional implementations of this embodiment, the data augmentation is random data augmentation.

[0094] In some optional implementations of this embodiment, the optimization objective of the objective function also includes minimizing the expected value of maximizing the perturbation loss.

[0095] In some optional implementations of this embodiment, the training unit 503 is further configured to: optimize the objective function using the projection gradient method to determine the perturbation that minimizes the loss function; and update the parameters of the initial perturbation generation model based on the determined perturbation.

[0096] The apparatus provided in the above embodiments of this disclosure acquires a training dataset through a first acquisition unit, wherein the training data in the training dataset includes original images and original labels; a second acquisition unit acquires an initial perturbation generation model and an objective function, wherein the optimization objective of the objective function includes minimizing a loss function, and the optimization objective of the loss function includes maximizing the perturbation loss, wherein the perturbation loss represents the difference between the output label of the perturbation image and the corresponding original label, and the perturbation image is generated by adding perturbation to the original image; a training unit trains the perturbation generation model using the training dataset and the objective function to obtain a trained perturbation generation model, and then uses the perturbation generation model to realize the perturbation processing of the original image, and the perturbation image obtained after perturbation processing can suppress the size of the loss function of the neural network model during adversarial training, so that the loss function is not too large, thereby suppressing the knowledge that can be learned from the perturbation image, and thus avoiding the problem of user privacy leakage caused by adversarial training on the perturbation image.

[0097] Further reference Figure 6 As a response to the above Figure 3 The present disclosure provides an embodiment of an image processing apparatus for implementing the method shown, which is similar to... Figure 3 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0098] like Figure 6 As shown, the image processing apparatus 600 provided in this embodiment includes a third acquisition unit 601 and a processing unit 602. The third acquisition unit 601 is configured to acquire an original image set; the processing unit 602 is configured to perform the following processing steps on the original images in the original image set: determine the target perturbation corresponding to the original image using a pre-trained perturbation generation model, wherein the training dataset of the perturbation generation model includes the original image set, and the target perturbation is a perturbation that satisfies the optimization objective of the objective function of the perturbation generation model; and add the target perturbation to the original image.

[0099] In this embodiment, the specific processing of the third acquisition unit 601 and the processing unit 602 in the image processing apparatus 600 and the resulting technical effects can be referred to respectively. Figure 3 The relevant descriptions of steps 301 and 302 in the corresponding embodiments will not be repeated here.

[0100] The apparatus provided in the above embodiments of this disclosure acquires an original image set through a third acquisition unit; the processing unit performs the following processing steps on the original images in the original image set: determining the target perturbation corresponding to the original image using a pre-trained perturbation generation model, wherein the training dataset of the perturbation generation model includes the original image set, and the target perturbation is a perturbation that satisfies the optimization objective of the objective function of the perturbation generation model; adding the target perturbation to the original image, thereby protecting the original image, preventing the original image from being collected for training a neural network model and causing the data in the original image to be leaked, and improving the security of data that can be arbitrarily accessed on the network.

[0101] The following is for reference. Figure 7 It illustrates an electronic device suitable for implementing embodiments of the present disclosure (e.g., Figure 1 The structural diagram of the server (700) in the middle. Figure 7 The server shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0102] like Figure 7 As shown, the electronic device 700 may include a processing unit (e.g., a central processing unit, a graphics processor, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device 700. The processing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0103] Typically, the following devices can be connected to I / O interface 705: input devices 706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 708 including, for example, magnetic tapes, hard disks, etc.; and communication devices 709. Communication device 709 allows electronic device 700 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7An electronic device 700 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 7 Each box shown can represent a device or multiple devices as needed.

[0104] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 709, or installed from storage device 708, or installed from ROM 702. When the computer program is executed by processing device 701, it performs the functions defined in the methods of embodiments of this disclosure.

[0105] It should be noted that the computer-readable medium described in the embodiments of this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the embodiments of this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the embodiments of this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0106] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: acquire a training dataset, wherein the training data in the training dataset includes original images and original labels; acquire an initial perturbation generation model and an objective function, wherein the optimization objective of the objective function includes minimizing a loss function, and the optimization objective of the loss function includes maximizing the perturbation loss, the perturbation loss representing the difference between the output label of the perturbated image and the corresponding original label, the perturbated image being generated based on adding perturbation to the original image; and train the perturbation generation model using the training dataset and the objective function to obtain a trained perturbation generation model.

[0107] Computer program code for performing the operations of embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0108] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0109] The units described in the embodiments of this disclosure can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor may be described as including a first acquisition unit, a second acquisition unit, and a training unit. The names of these units do not necessarily limit the specific unit; for example, the first acquisition unit may also be described as "a unit for acquiring a training dataset, wherein the training data in the training dataset includes original images and original labels."

[0110] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A training method for a perturbation-generated model, comprising: Obtain a training dataset, wherein the training data in the training dataset includes original images and original labels; Obtain an initial perturbation generation model and an objective function, wherein the optimization objective of the objective function includes minimizing the loss function, and the optimization objective of the loss function includes maximizing the perturbation loss, where the perturbation loss represents the difference between the output label of the perturbation image and the corresponding original label, and the perturbation image is generated based on adding perturbation to the original image; Using the training dataset and objective function, the perturbation generation model is trained to obtain the trained perturbation generation model, including: finding the perturbation that maximizes the perturbation loss, and then, with the perturbation fixed, using gradient descent and backpropagation to find the network parameters that minimize the loss function on the training dataset to update the initial perturbation generation model in training. The step of training the perturbation generation model using the training dataset and the objective function includes: The objective function is optimized using the projection gradient method to determine the perturbation that minimizes the loss function; The parameters of the initial perturbation generation model are updated based on the determined perturbation.

2. The method according to claim 1, wherein, The perturbation image is generated through the following steps: A first perturbation is added to the original image to obtain the first image; The first image is augmented to obtain an augmented image; A perturbation image is generated based on the enhanced image.

3. The method according to claim 2, wherein, The step of generating a perturbation image based on the enhanced image includes: A second perturbation is added to the enhanced image to obtain a perturbed image.

4. The method according to claim 3, wherein, The data augmentation is random data augmentation.

5. The method according to claim 4, wherein, The optimization objective of the objective function also includes minimizing the expected value of the maximum perturbation loss.

6. An image processing method, comprising: Obtain the original image set; For the original images in the original image set, the following processing steps are performed: The perturbation generation model pre-trained according to any one of claims 1-5 is used to determine the target perturbation corresponding to the original image, wherein the training dataset of the perturbation generation model includes the original image set, and the target perturbation is a perturbation that satisfies the optimization objective of the objective function of the perturbation generation model; Add the target perturbation to the original image.

7. A training device for a perturbation generation model, comprising: The first acquisition unit is configured to acquire a training dataset, wherein the training data in the training dataset includes original images and original labels; The second acquisition unit is configured to acquire an initial perturbation generation model and an objective function, wherein the optimization objective of the objective function includes minimizing a loss function, the optimization objective of the loss function includes maximizing the perturbation loss, the perturbation loss represents the difference between the output label of the perturbation image and the corresponding original label, and the perturbation image is generated based on adding perturbation to the original image; The training unit is configured to train the perturbation generation model using the training dataset and the objective function to obtain the trained perturbation generation model, including: finding the perturbation that maximizes the perturbation loss, and then, with the perturbation fixed, using gradient descent and backpropagation to find the network parameters that minimize the loss function on the training dataset to update the initial perturbation generation model in training. The step of training the perturbation generation model using the training dataset and the objective function includes: The objective function is optimized using the projection gradient method to determine the perturbation that minimizes the loss function; The parameters of the initial perturbation generation model are updated based on the determined perturbation.

8. An image processing apparatus, comprising: The third acquisition unit is configured to acquire the original image set; The processing unit is configured to perform the following processing steps on the original images in the original image set: The perturbation generation model pre-trained according to any one of claims 1-5 is used to determine the target perturbation corresponding to the original image, wherein the training dataset of the perturbation generation model includes the original image set, and the target perturbation is a perturbation that satisfies the optimization objective of the objective function of the perturbation generation model; Add the target perturbation to the original image.

9. An electronic device, comprising: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-6.

10. A computer-readable medium having a computer program stored thereon, wherein, When the program is executed by the processor, it implements the method as described in any one of claims 1-6.

Images