An image encryption method and device, electronic equipment and storage medium

Abstract

The application relates to an image encryption method and device, electronic equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: obtaining an image to be encrypted; inputting the image to be encrypted into a first neural network model to obtain an encrypted noise image of the image to be encrypted, the category of the encrypted noise image of the image to be encrypted being the same as the category of the image to be encrypted, and the category of the image to be encrypted being used to represent the category of an object in the image to be encrypted. In the application, the encrypted noise image of the image to be encrypted obtained by the electronic equipment can play a good encryption role on the image to be encrypted. Furthermore, when other equipment needs to be trained, the electronic equipment can send a plurality of encrypted noise images to the other equipment, so that the other equipment cannot obtain a plurality of sample images, the sample images can be effectively protected, and security risks can be reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to an image encryption method and device, electronic equipment and storage medium. BACKGROUND

[0002] In the scene of image classification or image recognition, an image encryption device can obtain a sample image, and encrypt the sample image in an encryption module of the image encryption device to generate an encrypted image. Then, the image encryption device can send the encrypted image to another device. After receiving the encrypted image, the other device can decrypt the encrypted image in a decryption module of the other device to obtain the sample image. Then, the other device can obtain a target neural network model for predicting the category of an image based on the sample image and an initial neural network model.

[0003] However, in the above method, the process of training the neural network model in the other device needs to use the sample image, so the other device or the target personnel can obtain the sample image, which has certain security risks. SUMMARY

[0004] The present application provides an image encryption method and device, electronic equipment and storage medium, which solves the technical problem that the other device or the target personnel can obtain the sample image, which has certain security risks.

[0005] The technical solutions of the embodiments of the present application are as follows:

[0006] According to a first aspect of the embodiments of the present application, an image encryption method is provided. The method can include: obtaining an image to be encrypted; inputting the image to be encrypted into a first neural network model to obtain an encrypted noise image of the image to be encrypted, the category of the encrypted noise image of the image to be encrypted being the same as the category of the image to be encrypted, the category of the image to be encrypted being used to represent the category of an object in the image to be encrypted, and the first neural network model being trained based on a plurality of sample images and encrypted noise images of the plurality of sample images.

[0007] Optionally, the image encryption method further comprises: obtaining a first sample image and a to-be-trained noise image of the first sample image, the first sample image being one of the plurality of sample images; inputting the to-be-trained noise image of the first sample image and the first sample image into a second neural network model to obtain a first probability, a first feature matrix and a second feature matrix, the second neural network model being an initial neural network model of the first neural network model, an input of the second neural network model being each sample image of the plurality of sample images and a to-be-trained noise image of the each sample image, the first probability being a probability that a category of the to-be-trained noise image of the first sample image is predicted as a first category, the first category being a category of the first sample image, the first feature matrix being a feature matrix output by a target network layer of the to-be-trained noise image of the first sample image, the second feature matrix being a feature matrix output by the target network layer of the first sample image, the first feature matrix and the second feature matrix being respectively used to identify the category of the first sample image and a category of the to-be-trained noise image of the first sample image, the target network layer being one of a plurality of network layers included in the second neural network model; inputting the to-be-trained noise image of the first sample image into a third neural network model to obtain a second probability, the second probability being a probability that the category of the to-be-trained noise image of the first sample image is predicted as a second category, the second category being a category of a random noise image; updating the to-be-trained noise image of the first sample image according to the first probability, the second probability, the first feature matrix and the second feature matrix to generate an encrypted noise image of the first sample image.

[0008] Optionally, the updating the to-be-trained noise image of the first sample image according to the first probability, the second probability, the first feature matrix and the second feature matrix to generate an encrypted noise image of the first sample image specifically comprises: determining a target loss function according to the first probability, the second probability, the first feature matrix and the second feature matrix, and performing a gradient backpropagation operation on the target loss function to obtain an input gradient of the to-be-trained noise image of the first sample image, the target loss function being used to represent a degree of inconsistency between the category of the first sample image and the encrypted noise image of the first sample image; updating the to-be-trained noise image of the first sample image based on the input gradient and a learning rate of the to-be-trained noise image of the first sample image to generate the encrypted noise image of the first sample image.

[0009] Optionally, the determining the target loss function according to the first probability, the second probability, the first feature matrix and the second feature matrix specifically comprises: determining a first loss function according to the first probability, the first loss function being used to represent an inconsistency degree between the first category and a third category, the third category being a category of a to-be-trained noise image of the first sample image; determining a second loss function according to the second probability, the second loss function being used to represent an inconsistency degree between the second category and the third category; determining a third loss function according to the first feature matrix and the second feature matrix, the third loss function being used to represent a similarity between the first feature matrix and the second feature matrix; and determining the target loss function according to the first loss function, the second loss function and the third loss function.

[0010] Optionally, the image encryption method further comprises: obtaining a plurality of to-be-trained noise images, a plurality of random noise images, a first label of each to-be-trained noise image in the plurality of to-be-trained noise images and a second label of each random noise image in the plurality of random noise images, the first label being used to represent a non-noise image, and the second label being used to represent a noise image; training a third initial neural network model based on the plurality of to-be-trained noise images, the plurality of random noise images, the first label of each to-be-trained noise image in the plurality of to-be-trained noise images and the second label of each random noise image in the plurality of random noise images, the third initial neural network model being used to determine whether an image is a noise image; and determining the trained third initial neural network model as the third neural network model.

[0011] According to a second aspect of the embodiments of the present application, an image encryption device is provided. The device can comprise an obtaining module and a processing module. The obtaining module is configured to obtain a to-be-encrypted image. The processing module is configured to input the to-be-encrypted image into a first neural network model to obtain an encrypted noise image of the to-be-encrypted image, the encrypted noise image of the to-be-encrypted image having a same category as the to-be-encrypted image, the category of the to-be-encrypted image being used to represent a category of an object in the to-be-encrypted image, and the first neural network model being trained based on a plurality of sample images and encrypted noise images of the plurality of sample images.

[0012] Optionally, the obtaining module is further configured to obtain a first sample image and a to-be-trained noise image of the first sample image, the first sample image being one of the plurality of sample images; and the processing module is further configured to input the to-be-trained noise image of the first sample image and the first sample image into a second neural network model to obtain a first probability, a first feature matrix, and a second feature matrix, the second neural network model being an initial neural network model of the first neural network model, an input of the second neural network model being each sample image of the plurality of sample images and a to-be-trained noise image of the each sample image, the first probability being a probability that a category of the to-be-trained noise image of the first sample image is predicted as a first category, the first category being a category of the first sample image, the first feature matrix being a feature matrix output by a target network layer from the to-be-trained noise image of the first sample image, the second feature matrix being a feature matrix output by the target network layer from the first sample image, the first feature matrix and the second feature matrix being respectively used to identify the category of the first sample image and a category of the to-be-trained noise image of the first sample image, the target network layer being one of a plurality of network layers included in the second neural network model; the processing module is further configured to input the to-be-trained noise image of the first sample image into a third neural network model to obtain a second probability, the second probability being a probability that the category of the to-be-trained noise image of the first sample image is predicted as a second category, the second category being a category of a random noise image; and the processing module is further configured to update the to-be-trained noise image of the first sample image according to the first probability, the second probability, the first feature matrix, and the second feature matrix to generate an encrypted noise image of the first sample image.

[0013] Optionally, the image encryption apparatus further includes a determination module configured to determine a target loss function according to the first probability, the second probability, the first feature matrix, and the second feature matrix, and perform a gradient backpropagation operation on the target loss function to obtain an input gradient of the to-be-trained noise image of the first sample image, the target loss function being used to represent a degree of inconsistency between the category of the first sample image and the encrypted noise image of the first sample image; and the processing module is specifically configured to update the to-be-trained noise image of the first sample image based on the input gradient and a learning rate of the to-be-trained noise image of the first sample image to generate the encrypted noise image of the first sample image.

[0014] Optionally, the determining module is specifically configured to determine a first loss function according to the first probability, the first loss function being used to represent an inconsistency degree between the first category and a third category, the third category being a category of a to-be-trained noise image of the first sample image; the determining module is specifically further configured to determine a second loss function according to the second probability, the second loss function being used to represent an inconsistency degree between the second category and the third category; the determining module is specifically further configured to determine a third loss function according to the first feature matrix and the second feature matrix, the third loss function being used to represent a similarity between the first feature matrix and the second feature matrix; and the determining module is specifically further configured to determine the target loss function according to the first loss function, the second loss function, and the third loss function.

[0015] Optionally, the obtaining module is further configured to obtain a plurality of to-be-trained noise images, a plurality of random noise images, a first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and a second label of each random noise image in the plurality of random noise images, the first label being used to represent a non-noise image, and the second label being used to represent a noise image; the processing module is further configured to train a third initial neural network model based on the plurality of to-be-trained noise images, the plurality of random noise images, the first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and the second label of each random noise image in the plurality of random noise images, the third initial neural network model being used to determine whether an image is a noise image; and the determining module is configured to determine the trained third initial neural network model as the third neural network model.

[0016] According to a third aspect of embodiments of the present application, an electronic device can include a processor and a memory configured to store processor-executable instructions; wherein the processor is configured to execute the instructions to implement any of the optional image encryption methods in the first aspect.

[0017] According to a fourth aspect of embodiments of the present application, a computer-readable storage medium is provided, and the computer-readable storage medium stores instructions, when the instructions in the computer-readable storage medium are executed by an electronic device, the electronic device can execute any of the optional image encryption methods in the first aspect.

[0018] According to a fifth aspect of embodiments of the present application, a computer program product is provided, and the computer program product includes computer instructions, when the computer instructions are executed on an electronic device, the electronic device executes any of the optional image encryption methods in the first aspect.

[0019] The technical solutions provided by the embodiments of the present application at least bring the following beneficial effects:

[0020] In any of the above aspects, in the present application, the electronic device can obtain a to-be-encrypted image, and input the to-be-encrypted image into a first neural network model to obtain an encrypted noise image of the to-be-encrypted image. Since the category of the encrypted noise image of the to-be-encrypted image is the same as the category of the to-be-encrypted image, it indicates that the encrypted noise image of the to-be-encrypted image can replace the to-be-encrypted image. Since the encrypted noise image of the to-be-encrypted image is a noise image, that is, an image that cannot be recognized by the human eye, the encrypted noise image of the to-be-encrypted image obtained by the electronic device can play a good encryption role on the to-be-encrypted image. Further, when other devices need to perform model training, the electronic device can send a plurality of encrypted noise images to the other devices, avoiding the other devices from obtaining a plurality of sample images, which can effectively protect the sample images and reduce security risks.

[0021] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0022] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the present application, and do not constitute an undue limitation on the present application.

[0023] Figure 1 A schematic diagram of an image encryption system provided by an embodiment of the present application is shown;

[0024] Figure 2 A flowchart of an image encryption method provided by an embodiment of the present application is shown;

[0025] Figure 3 A flowchart of another image encryption method provided by an embodiment of the present application is shown;

[0026] Figure 4 A flowchart of another image encryption method provided by an embodiment of the present application is shown;

[0027] Figure 5 A flowchart of another image encryption method provided by an embodiment of the present application is shown;

[0028] Figure 6 A flowchart of another image encryption method provided by an embodiment of the present application is shown;

[0029] Figure 7 A flowchart of another image encryption method provided by an embodiment of the present application is shown;

[0030] Figure 8 A flowchart of another image encryption method provided by an embodiment of the present application is shown;

[0031] Figure 9 A flow diagram of still another image encryption method provided by the embodiments of the present application is shown;

[0032] Figure 10 A structural diagram of an image encryption device provided by the embodiments of the present application is shown;

[0033] Figure 11 A structural diagram of still another image encryption device provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0034] In order to make the ordinary person skilled in the art better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. The implementation described in the following exemplary embodiments does not represent all the implementations consistent with the present application. Rather, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0036] It should also be understood that the term "comprising" indicates the presence of the described features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, and / or components.

[0037] The data involved in the present application can be data authorized by the user or sufficiently authorized by all parties.

[0038] Some concepts involved in the embodiments of the present application are explained below.

[0039] Noise attack: a mass of noise is used to attack a certain sample image (for example, a first sample image), and the first sample image becomes a noise image. The noise image can have at least two capabilities: (1) it can change the recognition ability of the human eye, that is, the noise image looks like a noise image with a large number of waves to the human eye, and the category of the noise image cannot be identified; (2) it ensures the recognition ability of the network, that is, the noise image can replace the first sample image to complete the training of the downstream model (for example, the target neural network model). In the embodiments of the present application, the electronic device performing noise attack can be understood as updating the to-be-trained noise image of the first sample image (specifically, updating the pixel value of the to-be-trained noise image of the first sample image) based on the learning rate of the to-be-trained noise image of the first sample image and the input gradient of the to-be-trained noise image of the first sample image, to generate an encrypted noise image of the first sample image. The encrypted noise image can replace the first sample image in the training process of the target neural network model, and specifically, the similarity between the features of the encrypted noise image in the target neural network model and the features of the first sample image in the target neural network model can be greater than or equal to a similarity threshold.

[0040] As described in the background, there is a certain security risk because other devices or target personnel can obtain sample images during the training process of the neural network model. Based on this, the embodiments of the present application provide an image encryption method, and the encrypted noise image obtained by the electronic device for the to-be-encrypted image can play a good encryption role on the to-be-encrypted image. Further, when other devices need to perform model training, the electronic device can send multiple encrypted noise images to the other devices, avoiding the other devices from obtaining multiple sample images, which can effectively protect the sample images and reduce security risks.

[0041] The image encryption method, device, electronic device and storage medium provided by the embodiments of the present application are applied in the scene of image classification or image recognition, and specifically, the electronic device can determine the category of the to-be-encrypted image based on the encrypted noise image of the to-be-encrypted image. When the electronic device obtains the to-be-encrypted image, the encrypted noise image of the to-be-encrypted image can be obtained according to the method provided by the embodiments of the present application.

[0042] The image encryption method provided by the embodiments of the present application is exemplarily described below with reference to the accompanying drawings:

[0043] Figure 1 A schematic diagram of an image encryption system provided by the embodiments of the present application is shown in FIG. Figure 1 As shown in the figure, the image encryption system can include an electronic device 101 and an electronic device 102, and the electronic device 101 can establish a connection between the electronic device 101 and the electronic device 102 through a wired network or a wireless network.

[0044] Specifically, the electronic device 101 can obtain a to-be-encrypted image and input the to-be-encrypted image into a first neural network model to obtain an encrypted noise image of the to-be-encrypted image. In an implementation manner of the embodiment of the present application, the electronic device 101 can further send the encrypted noise image of the to-be-encrypted image and the category of the encrypted noise image (or the category of the to-be-encrypted image) to the electronic device 102.

[0045] After receiving the encrypted noise image of the to-be-encrypted image and the category of the encrypted noise image, the electronic device 102 can train a certain initial neural network model based on the encrypted noise image of the to-be-encrypted image and the category of the encrypted noise image to obtain a target neural network model, and the target neural network model can predict the category of a certain to-be-identified noise image.

[0046] The electronic device (including the electronic device 101 and the electronic device 102) in the embodiment of the present application can be a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, and a device such as a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) \ virtual reality (VR) device, etc. that can install and use a content community application, and the specific form of the electronic device is not specially limited in the present application. It can interact with the user through one or more ways such as a keyboard, a touchpad, a touch screen, a remote controller, voice interaction, or a handwriting device.

[0047] As shown in Figure 2 When the image encryption method is applied to the electronic device 101, the image encryption method can include S101-S104.

[0048] S101, the electronic device obtains a first sample image and a to-be-trained noise image of the first sample image.

[0049] The first sample image is one of a plurality of sample images.

[0050] It should be understood that the to-be-trained noise image of the first sample image is a noise image with the same size as the sample image.

[0051] In combination with Figure 2 As shown in Figure 3 In an implementation manner of the embodiment of the present application, obtaining the to-be-trained noise image of the first sample image can specifically include S1011-S1012.

[0052] S1011, the electronic device creates a noise pool.

[0053] The noise pool includes noise images of the plurality of sample images.

[0054] It should be understood that the number of noise images included in the noise pool is the same as the number of the plurality of sample images (i.e., the noise pool includes a plurality of noise images), and the size of each noise image included in the noise pool is also the same as the size of the sample image corresponding to the each noise image (i.e., each sample image in the plurality of sample images corresponds to a noise image), and the to-be-trained noise image of the first sample image is one of the plurality of noise images.

[0055] S1012, the electronic device obtains the to-be-trained noise image of the first sample image from the noise pool based on the first sample image.

[0056] It can be understood that the electronic device obtains the to-be-trained noise image of the first sample image from the noise pool, i.e., obtains the to-be-trained noise image of the first sample image from the noise images of the plurality of sample images included in the noise pool, and the to-be-trained noise image is the corresponding noise image of the first sample image in the noise pool (or the plurality of noise images).

[0057] In the embodiments of the present application, the electronic device creates a noise pool, and can obtain the to-be-trained noise image of the first sample image from the noise pool (specifically, the plurality of noise images included in the noise pool) based on the first sample image, which can effectively obtain the to-be-trained noise image of each sample image and improve the efficiency of image encryption.

[0058] Optionally, before model training (or when the model is initially trained), the plurality of noise images included in the noise pool can be blank images, i.e., the pixel values of the plurality of noise images are 0; in the subsequent training process, the plurality of noise images included in the noise pool are trained round by round to be noise images with pixel values between 0 and 1, and thus the encrypted noise images of the plurality of sample images can be obtained.

[0059] S102, the electronic device inputs the to-be-trained noise image of the first sample image and the first sample image into the second neural network model to obtain a first probability, a first feature matrix, and a second feature matrix.

[0060] The second neural network model is an initial neural network model of the first neural network model, an input of the second neural network model is each sample image in the plurality of sample images and a to-be-trained noise image of the each sample image, the first probability is a probability that a category of the to-be-trained noise image of the first sample image is predicted as a first category, the first category is a category of the first sample image, the first feature matrix is a feature matrix output by a target network layer from the to-be-trained noise image of the first sample image, the second feature matrix is a feature matrix output by the target network layer from the first sample image, the first feature matrix and the second feature matrix are respectively used to identify the category of the first sample image and the category of the to-be-trained noise image of the first sample image, and the target network layer is one of a plurality of network layers included in the second neural network model.

[0061] It should be understood that the category of the first sample image is a category of an object in the first sample image. For example, the first sample image includes a monkey, and the category of the first sample image can be a monkey.

[0062] Optionally, the target network layer can be a convolutional layer included in the second neural network model, that is, the first feature matrix can be a shallow convolutional matrix output by the convolutional layer from the to-be-trained noise image of the first sample image, and the second feature matrix can be a shallow convolutional matrix output by the convolutional layer from the first sample image.

[0063] In S103, the electronic device inputs the to-be-trained noise image of the first sample image into a third neural network model to obtain a second probability.

[0064] The second probability is a probability that the category of the to-be-trained noise image of the first sample image is predicted as a second category, and the second category is a category of a random noise image.

[0065] It should be understood that the random noise image of the first sample image is a noise image with the same size as the first sample image, and the random noise image is a matrix with a certain parameter randomness, that is, a random matrix with the same size as the first sample image, and a value of the random matrix is between 0 and 1.

[0066] Optionally, the random noise image can be a randomly generated Gaussian noise image.

[0067] In the embodiment of the present application, the category of the random noise image of the first sample image can be understood as noise (or a noise image). The electronic device inputs the noise image to be trained of the first sample image into the third neural network model to obtain the second probability, so as to improve the similarity between the noise to be trained of the first sample image and the random noise image of the first sample image, so that the noise image to be trained of the first sample image becomes more and more like a noise image, that is, the category of the noise image to be trained of the first sample image cannot be identified by the human eye, and the only thing that can be identified is that the noise image to be trained of the first sample image is a noise image.

[0068] Optionally, the electronic device can set the label of the second category (i.e., label) to 1 (hereinafter referred to as the second label, which is used to characterize the noise image). The second probability obtained by the above electronic device is the probability that the noise image to be trained of the first sample image is predicted to be the second label.

[0069] It should be noted that the embodiment of the present application does not limit the execution order of the above S102 and the above S103. For example, S102 may be executed first and then S103, or S103 may be executed first and then S102, or S102 and S103 may be executed at the same time. Figure 2 Here, S102 is executed first and then S103 is executed as an example.

[0070] S104: The electronic device updates the noise image to be trained of the first sample image according to the first probability, the second probability, the first characteristic matrix, and the second characteristic matrix to generate an encrypted noise image of the first sample image.

[0071] Specifically, the electronic device may update the pixel values ​​of the noise image to be trained of the first sample image based on the first probability, the second probability, the first feature matrix, and the second feature matrix to obtain an encrypted noise image of the first sample image. It should be understood that the similarity between the second feature matrix and the third feature matrix (i.e., the feature matrix output by the target network layer of the encrypted noise image of the first sample image) is greater than or equal to a similarity threshold.

[0072] Combine Figure 2 ,like Figure 4 As shown, in one implementation of an embodiment of the present application, the above-mentioned updating of the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix and the second feature matrix to generate an encrypted noise image of the first sample image specifically includes S1041-S1042.

[0073] S1041, the electronic device determines a target loss function according to the first probability, the second probability, the first feature matrix, and the second feature matrix, and performs a gradient back propagation operation on the target loss function to obtain an input gradient of the to-be-trained noise image of the first sample image.

[0074] The target loss function is used to represent a degree of inconsistency between the category of the first sample image and the encrypted noise image of the first sample image.

[0075] It should be understood that the electronic device can update the pixel value of the to-be-trained noise image of the first sample image based on the target loss function to obtain the encrypted noise image of the first sample image, so that the similarity between the second feature matrix and the third feature matrix is greater than or equal to the similarity threshold, that is, the encrypted noise image of the first sample image can replace the first sample image.

[0076] In combination with Figure 4 As Figure 5 shown, in an implementation manner of an embodiment of the present application, the determination of the target loss function according to the first probability, the second probability, the first feature matrix, and the second feature matrix specifically includes S1041a-S1041d.

[0077] S1041a, the electronic device determines a first loss function according to the first probability.

[0078] The first loss function is used to represent a degree of inconsistency between the first category and a third category, and the third category is a category of the to-be-trained noise image of the first sample image.

[0079] In combination with the description of the above embodiments, it should be understood that the first category is the category of the first sample image.

[0080] It can be understood that after the electronic device determines the first loss function, the electronic device can update the to-be-trained noise image of the first sample image based on the first loss function, so that the category of the updated to-be-trained noise image of the first sample image (specifically, the category predicted by the second neural network model for the updated to-be-trained noise image of the first sample image) is the same as the first category. That is, for the updated to-be-trained noise image of the first sample image and the first sample image, the prediction results obtained by the second neural network model should be the same, so that the updated to-be-trained noise image of the first sample image can replace the first sample image.

[0081] In an implementation manner of an embodiment of the present application, the electronic device determines that the first loss function satisfies the following formula:

[0082] loss1 = nll_loss(A)

[0083] wherein loss1 represents the first loss function, and A represents the first probability.

[0084] In S1041b, the electronic device determines a second loss function according to the second probability.

[0085] The second loss function is used to represent a degree of inconsistency between the second category and the third category.

[0086] In combination with the description of the above embodiments, it should be understood that the second category is a category of random noise images of the first sample image, and the third category is a category of to-be-trained noise images of the first sample image.

[0087] It can be understood that the second loss function can ensure that the to-be-trained noise image of the first sample image (or the updated to-be-trained noise image of the first sample image) is a noise image, i.e., an image in which the category cannot be recognized by the human eye.

[0088] In an implementation form of the embodiments of the present application, the electronic device determines that the second loss satisfies the following formula:

[0089] loss2 = log B

[0090] wherein loss2 represents the second loss function, and B represents the second probability.

[0091] In S1041c, the electronic device determines a third loss function according to the first feature matrix and the second feature matrix.

[0092] The third loss function is used to represent a similarity between the first feature matrix and the second feature.

[0093] It should be understood that the greater the third loss function, the smaller the similarity between the first feature matrix and the second feature matrix; correspondingly, the smaller the third loss function, the greater the similarity between the first feature matrix and the second feature matrix.

[0094] Optionally, the third loss function can also represent a degree of inconsistency between the first feature matrix and the second feature matrix.

[0095] In an implementation form of the embodiments of the present application, the electronic device can determine a mean square error between the first feature matrix and the second feature matrix as the third loss function. That is, the third loss function can satisfy the following formula:

[0096] loss3 = MSE(C, D)

[0097] wherein loss3 represents the third loss function, C represents the first feature matrix, and D represents the second feature matrix.

[0098] S1041d. The electronic device determines a target loss function based on the first loss function, the second loss function, and the third loss function.

[0099] In one implementation of the embodiment of the present application, the electronic device may determine the sum of the first loss function, the second loss function, and the third loss function as the target loss function.

[0100] S1042: The electronic device updates the noise image to be trained of the first sample image based on the input gradient and the learning rate of the noise image to be trained of the first sample image to generate an encrypted noise image of the first sample image.

[0101] In combination with the description of the above embodiment, it should be understood that the input gradient is the input gradient of the noise image to be trained of the first sample image. The electronic device can determine a value based on the input gradient and the learning rate, and update the noise image to be trained of the first sample image based on the value to generate an encrypted noise image of the first sample image.

[0102] It can be understood that the electronic device updates the noise image to be trained of the first sample image, that is, updates the pixel values ​​of the noise image to be trained of the first sample image to obtain the pixel values ​​of the encrypted noise image of the first sample image, that is, obtains the encrypted noise image of the first sample image.

[0103] In an optional implementation, the electronic device may determine whether the pixel values ​​of the encrypted noise image of the first sample image satisfy the following formula:

[0104] Z=Z'-Z grad *I noise

[0105] Wherein, Z represents the pixel value of the encrypted noise image of the first sample image, Z' represents the pixel value of the noise image to be trained of the first sample image, and Z grad Represents the input gradient of the noise image to be trained of the first sample image, I noise Represents the learning rate of the noise image to be trained for the first sample image.

[0106] Combine Figure 2 ,like Figure 6 As shown, in one implementation, the image encryption method provided in the embodiment of the present application may further include S105-S107.

[0107] S105: The electronic device obtains a plurality of noise images to be trained, a plurality of random noise images, a first label of each of the plurality of noise images to be trained, and a second label of each of the plurality of random noise images.

[0108] The first label is used to represent a non-noise image, and the second label is used to represent a noise image.

[0109] It should be understood that the plurality of to-be-trained noise images and the plurality of random noise images are one-to-one correspondence, specifically, one to-be-trained noise image in the plurality of to-be-trained noise images can correspond to one random noise image in the plurality of random noise images, that is, one to-be-trained noise image corresponds to one random noise image. The to-be-trained noise image of the first sample image can be one of the plurality of to-be-trained noise images, that is, the random noise image of the first sample image is the random noise image corresponding to the to-be-trained noise image of the first sample image in the plurality of random noise images.

[0110] Optionally, the electronic device can set the label (i.e., label) of the category (e.g., the third category) of each to-be-trained noise image in the plurality of to-be-trained noise images as 0 (i.e., the first label), and can set the label of the category of each random noise image in the plurality of random noise images as 1 (i.e., the second label). Specifically, at the beginning of the training of the model, the electronic device can default that the plurality of to-be-trained noise images are not noise images (i.e., non-noise images), and the plurality of random noise images are noise images.

[0111] S106, the electronic device trains a third initial neural network model based on the plurality of to-be-trained noise images, the plurality of random noise images, the first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and the second label of each random noise image in the plurality of random noise images.

[0112] The third initial neural network model is used to determine whether an image is a noise image.

[0113] Specifically, the electronic device trains the third initial neural network model, that is, updates the parameters of the third initial neural network model based on the plurality of to-be-trained noise images, the plurality of random noise images, the first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and the second label of each random noise image in the plurality of random noise images.

[0114] S107, the electronic device determines the trained third initial neural network model as a third neural network model.

[0115] In an implementation manner of the embodiment of the present application, the electronic device obtaining the third neural network model can include steps A-C.

[0116] Step A, the electronic device inputs the first to-be-trained noise image and the first random noise image into the third initial neural network model to obtain a third probability and a fourth probability.

[0117] The first to-be-trained noise image is one of the plurality of to-be-trained noise images, the first random noise image is a random noise image corresponding to the first to-be-trained noise image in the plurality of random noise images, the third probability is a probability that a category of the first to-be-trained noise is predicted as the first label, and the fourth probability is a probability that a category of the first random noise is predicted as the second label.

[0118] In combination with the description of the above embodiments, it should be understood that the probability that the category of the first to-be-trained noise image is predicted as the first label is the probability that the first to-be-trained noise image is predicted as a non-noise image, and the probability that the category of the first random noise image is predicted as the second label is the probability that the first random noise image is predicted as a noise image.

[0119] Step B, determining, by the electronic device, a fourth loss function according to the third probability and the fourth probability.

[0120] The fourth loss function is used to represent degrees of inconsistency of a first prediction result with the non-noise image and of a second prediction result with the noise image, the first prediction result is a prediction result of the category of the first to-be-trained noise image in the third initial neural network model, and the second prediction result is a prediction result of the category of the first random noise image in the third initial neural network model.

[0121] In an implementation form of the embodiments of the present application, the electronic device determines that the fourth loss function satisfies the following formula:

[0122] loss4 = logE + log(1-F)

[0123] loss4 represents the fourth loss function, E represents the fourth probability, and F represents the third probability.

[0124] Step C, updating parameters included in the third initial neural network model based on the fourth loss function to obtain a third neural network model.

[0125] It should be understood that, in a case where the electronic device obtains the plurality of sample images, the electronic device can generate encrypted noise images of the plurality of sample images based on the image encryption method described in the above embodiments (specifically, S101-S104). In this way, the electronic device can also train the first neural network model based on the plurality of sample images and the encrypted noise images of the plurality of sample images. Specifically, in combination with the description of the above embodiments, it should be understood that the electronic device can obtain the plurality of sample images and the encrypted noise images of the plurality of sample images based on the image encryption method described in the above embodiments (specifically, S101-S104). Figure 2 As shown in FIG. 1, the image encryption method provided by the embodiments of the present application further includes S108-S110. Figure 7

[0126] S108, obtaining a plurality of sample images and encrypted noise images of the plurality of sample images. ​

[0127] S109, training a first initial neural network model based on the plurality of sample images and the plurality of encrypted noise images of the plurality of sample images.

[0128] The first initial neural network model is used to determine an encrypted noise image of an image (including a sample image).

[0129] S110, determining the trained first initial neural network model as a first neural network model.

[0130] At this point, when the electronic device obtains a certain image (for example, a to-be-encrypted image), the to-be-encrypted image can be input into the first neural network model to obtain an encrypted noise image of the to-be-encrypted image.

[0131] As Figure 8 shown, the image encryption provided by the embodiments of the present application can also include S201-S202.

[0132] S201, the electronic device obtains a to-be-encrypted image.

[0133] S202, the electronic device inputs the to-be-encrypted image into the first neural network model to obtain an encrypted noise image of the to-be-encrypted image.

[0134] The encrypted noise image of the to-be-encrypted image has the same category as the to-be-encrypted image, the category of the to-be-encrypted image is used to represent the category of the object in the to-be-encrypted image, and the first neural network model is trained based on the plurality of sample images and the plurality of encrypted noise images of the plurality of sample images.

[0135] Specifically, the second neural network model (i.e., the initial neural network model of the first neural network model) can also be understood as the above-mentioned first initial neural network model.

[0136] In one case, namely S202, the electronic device can directly use the first neural network model after the training is completed, that is, the to-be-encrypted image can be input into the first neural network model to obtain an encrypted noise image of the to-be-encrypted image.

[0137] In another case, the electronic device can also perform neural network training based on the plurality of sample images and the plurality of encrypted noise images of the plurality of sample images to obtain the first neural network model, and then input the to-be-encrypted image into the first neural network model to obtain an encrypted noise image of the to-be-encrypted image.

[0138] It should be noted that the training process of the first neural network model can refer to the description in S108-S110 above, which will not be repeated here.

[0139] In the embodiments of the present application, the category of the encrypted noise image of the to-be-encrypted image is the same as the category of the to-be-encrypted image, which indicates that the encrypted noise image of the to-be-encrypted image can replace the to-be-encrypted image. Since the encrypted noise image of the to-be-encrypted image is a noise image, that is, an image that cannot be recognized by the human eye, the encrypted noise image of the to-be-encrypted image obtained by the electronic device can play a good encryption role on the to-be-encrypted image. Further, when other devices need to perform model training, the electronic device can send a plurality of encrypted noise images to the other devices, so as to avoid the other devices from obtaining a plurality of sample images, thereby effectively protecting the sample images and reducing security risks.

[0140] In an implementation manner of the embodiments of the present application, the electronic device can obtain a plurality of to-be-encrypted images, and encrypt the plurality of to-be-encrypted images to obtain encrypted noise images of the plurality of to-be-encrypted images. Then, based on the encrypted noise images of the plurality of to-be-encrypted images and the categories of the plurality of to-be-encrypted images (or the categories of the encrypted noise images of the plurality of to-be-encrypted images), an initial neural network model is trained to generate a target neural network model. The target neural network model can be used to determine the category of a noise image.

[0141] In another implementation manner of the embodiments of the present application, after the electronic device obtains the plurality of to-be-encrypted images and inputs the plurality of to-be-encrypted images into the first neural network model (which can also be understood as encrypting the plurality of to-be-encrypted images) to obtain the encrypted noise images of the plurality of to-be-encrypted images, the electronic device can further send the encrypted noise images of the plurality of to-be-encrypted images and the categories of the plurality of to-be-encrypted images (or the categories of the encrypted noise images of the plurality of to-be-encrypted images) to other devices, so that the other devices can train a certain initial neural network model based on the encrypted noise images of the plurality of to-be-encrypted images and the categories of the plurality of to-be-encrypted images to generate a target neural network model. Further, when the other devices obtain a certain noise image, the noise image can be input into the target neural network model to determine the category of the noise image. As shown in the figure, the process can include S301-S308. Figure 9

[0142] S301, the electronic device obtains a plurality of to-be-encrypted images and categories of the plurality of to-be-encrypted images.

[0143] S302, the electronic device encrypts the plurality of to-be-encrypted images to obtain encrypted noise images of the plurality of to-be-encrypted images.

[0144] Among them, one to-be-encrypted image corresponds to one encrypted noise image, and the category of the encrypted noise image of one to-be-encrypted image is the same as the category of the to-be-encrypted image.

[0145] ​S303, the electronic device sends the encryption noise image of the plurality of images to be encrypted and the category of the plurality of images to be encrypted to the other device.

[0146] For example, the electronic device can be the electronic device 101 in the above Figure 1 The other device can be the electronic device 102 in the above Figure 1

[0147] S304, the other device receives the encryption noise image of the plurality of images to be encrypted and the category of the plurality of images to be encrypted sent by the electronic device.

[0148] S305, the other device trains the initial neural network model based on the encryption noise image of the plurality of images to be encrypted and the category of the plurality of images to be encrypted.

[0149] S306, the other device determines the trained initial neural network model as a target neural network model.

[0150] The target neural network model is used to determine the category of a noise image.

[0151] S307, the other device obtains a noise image to be identified.

[0152] S308, the other device inputs the noise image to be identified into the target neural network model to obtain the category of the noise image to be identified.

[0153] At this point, the other device can predict the category of a certain noise image (for example, the noise image to be identified) based on the target neural network model.

[0154] It can be understood that in actual implementation, the electronic device described in the embodiments of the present application can include one or more hardware structures and / or software modules for implementing the foregoing image encryption method. These execution hardware structures and / or software modules can constitute an electronic device. Those skilled in the art should easily realize that, in combination with the algorithm steps of the examples described in the embodiments disclosed herein, the present application can be realized in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0155] Based on such understanding, the embodiments of the present application also correspondingly provide an image encryption device, Figure 10 The structure schematic diagram of the image encryption device provided by the embodiments of the present application is shown. As shown in Figure 10 ​As shown, the image encryption apparatus 20 can include an obtaining module 201 and a processing module 202.

[0156] The obtaining module 201 is configured to obtain an image to be encrypted.

[0157] The processing module 202 is configured to input the image to be encrypted into a first neural network model to obtain an encrypted noise image of the image to be encrypted, the encrypted noise image of the image to be encrypted being of the same category as the image to be encrypted, the category of the image to be encrypted being used to represent the category of an object in the image to be encrypted, and the first neural network model being trained based on a plurality of sample images and encrypted noise images of the plurality of sample images.

[0158] Optionally, the obtaining module 201 is further configured to obtain a first sample image and a to-be-trained noise image of the first sample image, the first sample image being one of the plurality of sample images.

[0159] The processing module 202 is further configured to input the to-be-trained noise image of the first sample image and the first sample image into a second neural network model to obtain a first probability, a first feature matrix, and a second feature matrix, the second neural network model being an initial neural network model of the first neural network model, an input of the second neural network model being each sample image of the plurality of sample images and a to-be-trained noise image of the each sample image, the first probability being a probability that the category of the to-be-trained noise image of the first sample image is predicted to be a first category, the first category being the category of the first sample image, the first feature matrix being a feature matrix output by a target network layer from the to-be-trained noise image of the first sample image, the second feature matrix being a feature matrix output by the target network layer from the first sample image, the first feature matrix and the second feature matrix being respectively used to identify the category of the first sample image and the category of the to-be-trained noise image of the first sample image, and the target network layer being one of a plurality of network layers included in the second neural network model.

[0160] The processing module 202 is further configured to input the to-be-trained noise image of the first sample image into a third neural network model to obtain a second probability, the second probability being a probability that the category of the to-be-trained noise image of the first sample image is predicted to be a second category, and the second category being the category of a random noise image.

[0161] The processing module 202 is further configured to update the to-be-trained noise image of the first sample image according to the first probability, the second probability, the first feature matrix, and the second feature matrix to generate the encrypted noise image of the first sample image.

[0162] Optionally, the image encryption apparatus 20 further includes a determining module 203.

[0163] The determining module 203 is configured to determine a target loss function according to the first probability, the second probability, the first feature matrix, and the second feature matrix, and perform gradient back propagation on the target loss function to obtain an input gradient of the to-be-trained noise image of the first sample image, where the target loss function is used to represent a degree of inconsistency between the category of the first sample image and the encrypted noise image of the first sample image.

[0164] The processing module 202 is specifically configured to update the to-be-trained noise image of the first sample image based on the input gradient and a learning rate of the to-be-trained noise image of the first sample image, to generate the encrypted noise image of the first sample image.

[0165] Optionally, the determining module 203 is specifically configured to determine a first loss function according to the first probability, where the first loss function is used to represent a degree of inconsistency between the first category and a third category, and the third category is a category of the to-be-trained noise image of the first sample image.

[0166] The determining module 203 is specifically further configured to determine a second loss function according to the second probability, where the second loss function is used to represent a degree of inconsistency between the second category and the third category.

[0167] The determining module 203 is specifically further configured to determine a third loss function according to the first feature matrix and the second feature matrix, where the third loss function is used to represent a similarity between the first feature matrix and the second feature matrix.

[0168] The determining module 203 is specifically further configured to determine the target loss function according to the first loss function, the second loss function, and the third loss function.

[0169] Optionally, the obtaining module 201 is further configured to obtain a plurality of to-be-trained noise images, a plurality of random noise images, a first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and a second label of each random noise image in the plurality of random noise images, where the first label is used to represent a non-noise image, and the second label is used to represent a noise image.

[0170] The processing module 202 is further configured to train a third initial neural network model based on the plurality of to-be-trained noise images, the plurality of random noise images, the first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and the second label of each random noise image in the plurality of random noise images, where the third initial neural network model is used to determine whether an image is a noise image.

[0171] The determining module 203 is configured to determine the trained third initial neural network model as the third neural network model.

[0172] As described above, the embodiments of the present application can divide the functional modules of the image encryption device according to the method examples described above. Among them, the integrated modules can be realized in the form of hardware or in the form of software functional modules. In addition, it should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical functional division. Actual implementation can have another division manner. For example, each functional module can be divided according to each function, or two or more functions can be integrated in one processing module.

[0173] As for the image encryption device in the above embodiments, the specific manner in which each module performs operations and the beneficial effects possessed have been described in detail in the foregoing method embodiments, and will not be described here.

[0174] Figure 11 is another structural schematic diagram of an image encryption device provided by the present application. As Figure 11 The image encryption device 30 can include at least one processor 301 and a memory 303 for storing processor-executable instructions. The processor 301 is configured to execute the instructions in the memory 303 to implement the image encryption method in the above embodiments.

[0175] In addition, the image encryption device 30 can also include a communication bus 302 and at least one communication interface 304.

[0176] The processor 301 can be a central processing unit (CPU), a micro processing unit, an ASIC, or one or more integrated circuits for controlling the execution of programs of the present application scheme.

[0177] The communication bus 302 can include a channel for transmitting information between the above components.

[0178] The communication interface 304 uses any transceiver device to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0179] The memory 303 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM), or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage or other magnetic storage devices, or any other medium capable of storing desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to this. The memory can exist independently, and is connected to the processing unit through the bus. The memory can also be integrated with the processing unit.

[0180] The memory 303 is configured to store instructions for implementing the solutions of the present application, and the processor 301 is configured to control the execution of the instructions. The processor 301 is configured to execute the instructions stored in the memory 303, thereby realizing the functions in the methods of the present application.

[0181] In a specific implementation, as an example, the processor 301 can include one or more CPUs, such as CPU0 and CPU1 in Figure 11 .

[0182] In a specific implementation, as an example, the image encryption device 30 can include multiple processors, such as the processor 301 and the processor 307 in Figure 11 . Each of these processors can be a single-CPU processor or a multi-CPU processor. The processor here can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0183] In a particular implementation, as an example, the image encryption apparatus 30 can further include an output device 305 and an input device 306. The output device 305 is in communication with the processor 301 and can display information in a variety of ways. For example, the output device 305 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, a projector, or the like. The input device 306 is in communication with the processor 301 and can accept user input in a variety of ways. For example, the input device 306 can be a mouse, a keyboard, a touch screen device, a sensor device, or the like.

[0184] Those skilled in the art can understand that the structure shown in the figure does not constitute a limitation on the image encryption apparatus 30, and can include more or fewer components than shown, or combine certain components, or use different component arrangements. Figure 11 Those skilled in the art can understand that the structure shown in the figure does not constitute a limitation on the image encryption apparatus 30, and can include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0185] In addition, the present application also provides a computer readable storage medium, comprising instructions, when the instructions are executed by an electronic device, the electronic device executes the image encryption method provided by the above-mentioned embodiments.

[0186] In addition, the present application also provides a computer program product, comprising instructions, when the instructions are executed by an electronic device, the electronic device executes the image encryption method provided by the above-mentioned embodiments.

[0187] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

Claims

1. An image encryption method characterized by, The method comprises: obtaining a to-be-encrypted image; inputting the to-be-encrypted image into a first neural network model to obtain an encrypted noise image of the to-be-encrypted image, the encrypted noise image of the to-be-encrypted image having the same category as the to-be-encrypted image, the category of the to-be-encrypted image being used to represent the category of an object in the to-be-encrypted image, and the first neural network model being trained based on a plurality of sample images and encrypted noise images of the plurality of sample images; The method further comprises: obtaining a to-be-trained noise image of a first sample image from a noise pool based on the first sample image, the first sample image being one of the plurality of sample images, and the noise pool comprising noise images of each of the plurality of sample images; inputting the to-be-trained noise image of the first sample image and the first sample image into a second neural network model to obtain a first probability, a first feature matrix of the to-be-trained noise image of the first sample image, and a second feature matrix of the first sample image, the first probability being a probability that the category of the to-be-trained noise image of the first sample image is predicted as a first category, the first category being the category of the first sample image, and the first feature matrix and the second feature matrix being used to identify the category of the first sample image and the category of the to-be-trained noise image of the first sample image, respectively; inputting the to-be-trained noise image of the first sample image into a third neural network model to obtain a second probability, the second probability being a probability that the category of the to-be-trained noise image of the first sample image is predicted as a second category, the second category being the category of a random noise image; determining a target loss function based on the first probability, the second probability, the first feature matrix, and the second feature matrix, the target loss function being used to represent the inconsistency between the first category and a third category, the inconsistency between the second category and the third category, and the similarity between the first feature matrix and the second feature matrix, the third category being the category of the to-be-trained noise image of the first sample image; updating the pixel value of the to-be-trained noise image of the first sample image based on the target loss function to generate an encrypted noise image of the first sample image.

2. The image encryption method according to claim 1, characterized in that, The second neural network model is an initial neural network model of the first neural network model, the input of the second neural network model being each of the plurality of sample images and the to-be-trained noise image of each of the plurality of sample images, the first feature matrix being a feature matrix output by a target network layer from the to-be-trained noise image of the first sample image, the second feature matrix being a feature matrix output by the target network layer from the first sample image, and the target network layer being one of a plurality of network layers included in the second neural network model.

3. The image encryption method of claim 2, wherein, The updating of the to-be-trained noise image of the first sample image based on the first probability, the second probability, the first feature matrix, and the second feature matrix to generate the encrypted noise image of the first sample image comprises: determine a target loss function according to the first probability, the second probability, the first feature matrix, and the second feature matrix, and perform a gradient back propagation operation on the target loss function to obtain an input gradient of a to-be-trained noise image of the first sample image, the target loss function being used to represent a degree of inconsistency between a category of the first sample image and the encrypted noise image of the first sample image; update the to-be-trained noise image of the first sample image based on the input gradient and a learning rate of the to-be-trained noise image of the first sample image, to generate the encrypted noise image of the first sample image.

4. The image encryption method of any one of claims 2-3, wherein, The method further includes: obtaining a plurality of to-be-trained noise images, a plurality of random noise images, a first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and a second label of each random noise image in the plurality of random noise images, the first label being used to represent a non-noise image, and the second label being used to represent a noise image; training a third initial neural network model based on the plurality of to-be-trained noise images, the plurality of random noise images, the first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and the second label of each random noise image in the plurality of random noise images, the third initial neural network model being used to determine whether an image is a noise image; determining the trained third initial neural network model as the third neural network model.

5. An image encryption apparatus characterized by comprising: comprise: an obtaining module and a processing module; the obtaining module is configured to obtain a to-be-encrypted image; the processing module is configured to input the to-be-encrypted image into a first neural network model to obtain an encrypted noise image of the to-be-encrypted image, the category of the encrypted noise image of the to-be-encrypted image being the same as the category of the to-be-encrypted image, the category of the to-be-encrypted image being used to represent a category of an object in the to-be-encrypted image, and the first neural network model being trained based on a plurality of sample images and encrypted noise images of the plurality of sample images; the obtaining module is further configured to obtain a to-be-trained noise image of a first sample image from a noise pool based on the first sample image, the first sample image being one of the plurality of sample images, and the noise pool comprising noise images of each sample image in the plurality of sample images; The processing module is further configured to input the first sample image and the to-be-trained noise image of the first sample image into a second neural network model to obtain a first probability, a first feature matrix of the to-be-trained noise image of the first sample image, and a second feature matrix of the first sample image, the first probability being a probability that a category of the to-be-trained noise image of the first sample image is predicted as a first category, the first category being a category of the first sample image, the first feature matrix and the second feature matrix being respectively used to identify the category of the first sample image and the category of the to-be-trained noise image of the first sample image, and input the to-be-trained noise image of the first sample image into a third neural network model to obtain a second probability, the second probability being a probability that the category of the to-be-trained noise image of the first sample image is predicted as a second category, the second category being a category of a random noise image. The determining module is configured to determine, according to the first probability, the second probability, the first feature matrix, and the second feature matrix, a target loss function used to represent a degree of inconsistency between the first category and a third category, a degree of inconsistency between the second category and the third category, and a similarity between the first feature matrix and the second feature matrix, the third category being a category of the to-be-trained noise image of the first sample image. The processing module is further configured to update pixel values of the to-be-trained noise image of the first sample image according to the target loss function to generate an encrypted noise image of the first sample image.

6. The image encryption apparatus according to claim 5, wherein The second neural network model is an initial neural network model of the first neural network model, an input of the second neural network model is each sample image in the plurality of sample images and a to-be-trained noise image of the each sample image, the first feature matrix is a feature matrix output by a target network layer from the to-be-trained noise image of the first sample image, the second feature matrix is a feature matrix output by the target network layer from the first sample image, and the target network layer is one of a plurality of network layers included in the second neural network model.

7. The image encryption apparatus according to claim 6, characterized by, The image encryption device further includes a determining module. The determining module is configured to determine, according to the first probability, the second probability, the first feature matrix, and the second feature matrix, a target loss function, and perform a gradient backpropagation operation on the target loss function to obtain an input gradient of the to-be-trained noise image of the first sample image, the target loss function being used to represent a degree of inconsistency between the category of the first sample image and the encrypted noise image of the first sample image. The processing module is specifically configured to update the to-be-trained noise image of the first sample image based on the input gradient and a learning rate of the to-be-trained noise image of the first sample image to generate the encrypted noise image of the first sample image.

8. The image encryption apparatus according to any one of claims 5 to 7, wherein The image encryption device further includes a determining module. The acquisition module is further configured to acquire a plurality of to-be-trained noise images, a plurality of random noise images, a first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and a second label of each random noise image in the plurality of random noise images, the first label being used to represent a non-noise image, and the second label being used to represent a noise image; The processing module is further configured to train a third initial neural network model based on the plurality of to-be-trained noise images, the plurality of random noise images, the first label of each to-be-trained noise image in the plurality of to-be-trained noise images, and the second label of each random noise image in the plurality of random noise images, the third initial neural network model being used to determine whether an image is a noise image. The determining module is configured to determine the trained third initial neural network model as the third neural network model.

9. An electronic device, comprising: The electronic device includes: a processor; a memory configured to store instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the image encryption method of any one of claims 1-4.

10. A computer-readable storage medium having stored thereon instructions, the instructions comprising, When the instructions in the computer-readable storage medium are executed by the electronic device, the electronic device is enabled to perform the image encryption method of any one of claims 1-4.

11. A computer program product, characterised in that, The computer program product includes computer instructions that, when executed on an electronic device, cause the electronic device to perform the image encryption method of any one of claims 1-4.

Images