Method, device, electronic device and storage medium for generating adversarial images

Abstract

The present disclosure provides a method, device, electronic device and storage medium for generating an adversarial image, which relates to the field of artificial intelligence, and specifically to the field of computer vision and deep learning technology. The specific implementation scheme of the method for generating an adversarial image is: adding random perturbations to a first image to obtain an initial adversarial image; and adjusting the initial adversarial image to obtain a first adversarial image for the first image with the goal of minimizing the difference between a first probability that the initial adversarial image belongs to a target category and a second probability that the initial adversarial image does not belong to the target category. The method provided by the present disclosure can increase the recognition difficulty of the first adversarial image.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence, specifically to the field of computer vision and deep learning technology, and in particular to a method, device, electronic device and storage medium for generating adversarial images. Background Art

[0002] With the development of computer technology and network technology, deep learning technology has been widely used in many fields. When deep learning technology is used illegally, it may provide a favorable tool for illegal access to data. For example, there are cases where deep learning technology is used to illegally identify images, resulting in data security being affected. Summary of the invention

[0003] The present disclosure aims to provide a method, device, electronic device and storage medium for generating an adversarial image that improves data security.

[0004] According to one aspect of the present disclosure, a method for generating an adversarial image is provided, comprising: adding random perturbations to a first image to obtain an initial adversarial image; and adjusting the initial adversarial image with the goal of minimizing the difference between a first probability that the initial adversarial image belongs to a target category and a second probability that the initial adversarial image does not belong to the target category to obtain a first adversarial image for the first image.

[0005] According to one aspect of the present disclosure, there is provided an adversarial image generation device, comprising: a perturbation adding module, configured to add random perturbations to a first image, to obtain an initial adversarial image; and an image adjustment module, configured to adjust the initial adversarial image, with the goal of minimizing the difference between a first probability that the initial adversarial image belongs to a target category and a second probability that the initial adversarial image does not belong to the target category, to obtain a first adversarial image for the first image.

[0006] According to another aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for generating adversarial images provided by the present disclosure.

[0007] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute the method for generating an adversarial image provided by the present disclosure.

[0008] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the method for generating an adversarial image provided by the present disclosure.

[0009] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0011] Figure 1 is a schematic diagram of an application scenario of a method and device for generating an adversarial image according to an embodiment of the present disclosure;

[0012] Figure 2 is a flowchart of a method for generating an adversarial image according to an embodiment of the present disclosure;

[0013] Figure 3 is a schematic diagram of a process of adjusting an initial adversarial image according to an embodiment of the present disclosure;

[0014] Figure 4 is a schematic diagram of the principle of adjusting the initial adversarial image according to an embodiment of the present disclosure;

[0015] Figure 5 is a schematic diagram of the principle of a method for generating an adversarial image according to an embodiment of the present disclosure;

[0016] Figure 6 is a structural block diagram of a device for generating an adversarial image according to an embodiment of the present disclosure; and

[0017] Figure 7 It is a block diagram of an electronic device for implementing the method for generating an adversarial image according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0018] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0019] The present disclosure provides a method for generating an adversarial image, which includes a disturbance adding stage and an image adjustment stage. In the disturbance adding stage, random disturbances are added to a first image to obtain an initial adversarial image. In the image adjustment stage, the initial adversarial image is adjusted to obtain a first adversarial image for the first image with the goal of minimizing the difference between a first probability that the initial adversarial image belongs to a target category and a second probability that the initial adversarial image does not belong to the target category.

[0020] The following will be combined Figure 1 The application scenarios of the method and device provided by the present disclosure are described.

[0021] Figure 1 It is a schematic diagram of an application scenario of the method and device for generating an adversarial image according to an embodiment of the present disclosure.

[0022] like Figure 1 As shown, the application scenario 100 of this embodiment may include an electronic device 110, which may be various electronic devices with processing functions, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, servers, and the like.

[0023] The electronic device 110 may, for example, process the image 101, and specifically add disturbance to the image 101 to obtain the adversarial image 102 after the disturbance is added, so that the characters in the adversarial image 102 are not easily automatically recognized by other electronic devices.

[0024] In one embodiment, the application scenario 100 may further include a terminal device 120, which is connected to the electronic device 110 via a network communication. The network may include a wired or wireless communication link. For example, the electronic device 110 may send the adversarial image 102 after adding the disturbance to the terminal device 120 in response to the image acquisition request sent by the terminal device 120, so that the terminal device 120 can display it.

[0025] In one embodiment, the application scenario 100 may also include another electronic device 130, which may obtain the display page of the terminal device 120 in various ways and recognize the adversarial image 102 displayed in the display page of the terminal device 120, so as to access the non-public page in the terminal device 120 when the characters in the adversarial image 102 are correctly recognized.

[0026] In one embodiment, another electronic device 130 may, for example, use an image segmentation model to obtain the region where the characters in the adversarial image 102 are located, and then use character recognition technology (such as optical character recognition technology) to recognize the region where the characters are located, thereby identifying the characters in the adversarial image 102.

[0027] In one embodiment, in order to prevent illegal access to non-public pages in the terminal device, the generation method of the adversarial image 102 can be improved so that the other electronic device 130 cannot correctly recognize the characters in the adversarial image 102. The improved generation method of the adversarial image can be described below and will not be described in detail here.

[0028] It should be noted that the method for generating an adversarial image provided by the present disclosure may be executed by the electronic device 110. Accordingly, the device for generating an adversarial image provided by the present disclosure may be disposed in the electronic device 110.

[0029] It should be understood that Figure 1 The number and type of the electronic device 110, the terminal device 120, the other electronic device 130 and the image 101 in the embodiment are only illustrative. According to the implementation requirements, there may be any number and type of electronic devices 110, the terminal device 120, the other electronic device 130 and the image 101.

[0030] The following will be combined Figure 1 ,pass Figure 2 to Figure 5 The method for generating an adversarial image provided by the present disclosure is described in detail.

[0031] Figure 2 It is a flowchart of a method for generating an adversarial image according to an embodiment of the present disclosure.

[0032] like Figure 2 As shown, the method 200 for generating an adversarial image in this embodiment may include operations S210 to S220.

[0033] In operation S210, random perturbations are added to the first image to obtain an initial adversarial image.

[0034] According to an embodiment of the present disclosure, a confrontation attack method may be used to add random perturbations to the first image. The confrontation attack method may use a gradient-based iterative attack algorithm (Momentum Iterative Method, MIM), a fast gradient descent method (Fast Gradient Sign Method, FGSM), an iterative FGSM algorithm (Basic Iterative Method, BIM), a projected gradient descent algorithm (Projected Gradient Descent, PGD) or an optimization-based attack algorithm.

[0035] For example, the operation S210 may first construct a perturbation matrix of the same size as the first image, and randomly initialize the perturbation matrix. Subsequently, the perturbation matrix is ​​added to the pixel matrix representing the first image to obtain a pixel matrix representing the initial adversarial image. Each element in the perturbation matrix may be a learnable element.

[0036] It is understandable that different first images may be used according to different application scenarios. For example, in a verification code recognition scenario, the first image may be a verification code image.

[0037] In operation S220 , the initial adversarial image is adjusted to obtain a first adversarial image for the first image with the goal of minimizing a difference between a first probability that the initial adversarial image belongs to the target category and a second probability that the initial adversarial image does not belong to the target category.

[0038] According to an embodiment of the present disclosure, a target detection algorithm and an image segmentation algorithm may be used to process the initial adversarial image, and a first probability and a second probability may be obtained according to the processing results.

[0039] For example, if a target detection algorithm is used, the processing result may include a predicted bounding box of an object in an initial adversarial image and a probability value that the object belongs to a target category. In this embodiment, the probability value that the object belongs to a target category may be used to represent the first probability, and the difference between 1 and the probability value that the object belongs to the target category may be used to represent the second probability. The target detection algorithm may use a region with CNN Feature (R-CNN), a single shot multi-box detector (SSD), or a single look detector (YOLO).

[0040] For example, if a semantic segmentation algorithm is used, the processing result may include the probability value of each pixel in the initial adversarial image belonging to the target category and the probability value of each pixel belonging to other categories except the target category. In this embodiment, a probability matrix composed of probability values ​​of all pixels belonging to the target category may be used to represent the first probability, and a probability matrix composed of probability values ​​of all pixels belonging to other categories may be used to represent the second probability. It is understandable that for an initial adversarial image of size H×W, including H rows and W columns of pixels, the probability values ​​of all pixels belonging to the target category can be represented as a probability matrix of H rows and W columns, which is the first probability. Similarly, the probability matrix representing the second probability is also a probability of H rows and W columns. Among them, one or more categories may be included in other categories. When the other categories are multiple categories, the value of each element in the probability matrix composed of probability values ​​belonging to other categories can be the sum of multiple probability values ​​of a pixel belonging to multiple categories, or the maximum value of multiple probability values ​​of a pixel belonging to multiple categories, etc., and the present disclosure does not limit this. Among them, the semantic segmentation algorithm can adopt a deep feature aggregation network (Deep Feature Aggregation Network, DFANet), a pyramid scene parsing network (Pyramid Scene Parsing Network, PSPNet) or a bilateral segmentation network (Bilateral segmentation Network, BiseNet), etc., and the present disclosure does not limit this.

[0041] After obtaining the first probability and the second probability, the embodiment can randomly adjust the initial adversarial image according to the first difference between the first probability and the second probability, and redetermine the first probability and the second probability according to the adjusted image, and determine the adjustment direction of the initial adversarial image according to the relationship between the second difference between the redetermined first probability and the second probability and the first difference. The image is adjusted iteratively until the difference between the redetermined first probability and the second probability is no longer reduced relative to the difference determined in the previous iteration, and the image in the previous iteration is used as the first adversarial image for the first image.

[0042] The difference between the first probability and the second probability can be represented by the difference between the two probabilities, the Manhattan distance, the Euclidean distance, the cosine distance, etc. between the two probabilities, and the present disclosure does not limit this.

[0043] The disclosed embodiment adjusts the initial adversarial image obtained by random perturbation with the goal of minimizing the difference between a first probability of belonging to a target category and a second probability of not belonging to the target category. This can enable learning of correlations between different categories when generating a perturbed image of an image, thereby increasing the construction space of adversarial images to a certain extent, increasing the recognition difficulty of the obtained adversarial images, and improving the security of the data to be protected.

[0044] Figure 3 It is a schematic diagram of a process of adjusting an initial adversarial image according to an embodiment of the present disclosure.

[0045] like Figure 3 As shown, in this embodiment, when adjusting the initial adversarial image, the initial adversarial image may be used as the initial image of the first adversarial image, and operations S321 to S325 may be performed cyclically until the first adversarial image reaches a predetermined convergence condition.

[0046] In operation S321 , a segmentation result of the first adversarial image is determined.

[0047] According to an embodiment of the present disclosure, the first adversarial image can be input into any network adopted by the semantic segmentation algorithm described above, and the segmentation result is output by any network. The segmentation result may include multiple probability matrices corresponding to multiple predetermined categories respectively. The size of each probability matrix in the multiple probability matrices is equal to the size of the pixel matrix representing the first adversarial image. Each element in each probability matrix represents the probability value that the corresponding pixel in the pixel matrix belongs to the predetermined category corresponding to each probability matrix. Among them, the position of the corresponding pixel in the pixel matrix corresponds to the position of each element in each probability matrix. That is, the segmentation result includes the probability value that each pixel in the first adversarial image belongs to each category in multiple predetermined categories. Among them, the multiple predetermined categories include the aforementioned target category. For example, in the scene of character recognition, the multiple predetermined categories include character categories and background categories, and the target category is the character category.

[0048] In operation S322, a first probability is determined according to the probability value of each pixel belonging to the target category.

[0049] For example, a probability matrix corresponding to the target category in a plurality of probability matrices may be used to represent the first probability. Alternatively, the first probability may be represented by the average of the probability values ​​in the probability matrix corresponding to the target category, that is, operation S322 may determine the average of the probability values ​​of all pixels in the first adversarial image belonging to the target category, and use the average as the first probability.

[0050] In one embodiment, the target pixel among all pixels may be determined based on the probability value of all pixels belonging to the target category, and then the probability matrix formed by the probability value of the target pixel belonging to the target category may be used as the first probability, or the average value of the probability value of the target pixel belonging to the target category may be used as the first probability. The target pixel is a pixel among all pixels whose probability value of belonging to the target category is greater than a predetermined threshold, and the predetermined threshold may be any value less than 1 and close to 1, such as 0.6, which is not limited in the present disclosure.

[0051] In operation S323, a second probability is determined according to a probability value of each pixel belonging to a category other than the target category among the plurality of predetermined categories.

[0052] It is understandable that the operation S323 and the operation S322 may be performed in any execution order. For example, the operation S323 may be performed simultaneously with the operation S322, or may be performed after the operation S322. This is not limited in the present disclosure.

[0053] The implementation of operation S323 is similar to that of operation S322. For example, when multiple predetermined categories include a target category and one other category, the embodiment may use a probability matrix corresponding to the other category in multiple probability matrices to represent the second probability. Alternatively, the second probability may be represented by the average value of each probability value in the probability matrix corresponding to the other category. In one embodiment, the probability matrix composed of the probability values ​​of the target pixel belonging to other categories may be used as the second probability, or the average value of the probability values ​​of the target pixel belonging to other categories may be used as the second probability. It should be noted that when multiple predetermined categories include a target category and one other category, the first probability and the second probability should be obtained in the same manner.

[0054] According to an embodiment of the present disclosure, when multiple predetermined categories include a target category and multiple other categories, the average of multiple probability values ​​that each pixel belongs to other categories can be first determined as the average probability value of each pixel, and then the average of the average probability values ​​of all pixels can be used as the second probability. Alternatively, the maximum probability value among multiple probability values ​​that each pixel among all pixels belongs to other categories can be first determined, and the probability value can be used as the target probability value of each pixel. Then the average of the target probability values ​​of all pixels is used as the second probability. In this way, the second probability can be made to represent the probability of other categories that are easily confused with the target category, and when the first adversarial image is adjusted based on the difference between the first probability and the second probability, the adjusted first adversarial image can be made more difficult to recognize.

[0055] After the first probability and the second probability are obtained, operation S324 may be performed to adjust the first adversarial image according to a difference between the first probability and the second probability.

[0056] This embodiment can adjust the first adversarial image in the manner described above. After adjusting the first adversarial image, operation S325 can be performed to determine whether the adjusted image reaches a predetermined convergence condition. If the predetermined convergence condition is not reached, the adjusted image can be used as the first adversarial image, and the operation S321 can be returned to be performed. If the adjusted image reaches the predetermined convergence condition, operation S326 can be performed to determine that the adjustment of the first adversarial image is completed, and the adjusted image obtained by operation S324 is used as the first adversarial image for the first image.

[0057] According to an embodiment of the present disclosure, when determining whether the adjusted image has reached a predetermined convergence condition, for example, the operations S321 to S323 described above may be used to determine the difference between the first probability and the second probability obtained according to the adjusted image as the first difference. Then, it is determined whether the difference between the second difference between the first probability and the second probability obtained according to the image before adjustment and the first difference is less than a predetermined value. If so, it is determined that the adjusted image has reached the predetermined convergence condition. The predetermined value may be 10 -3 The value is much smaller than 1, and the present disclosure does not limit this.

[0058] According to an embodiment of the present disclosure, when determining whether the adjusted image has reached a predetermined convergence condition, a first pixel belonging to the target category in the adjusted image may be determined based on the segmentation result of the adjusted image. A second pixel belonging to the target category in the first image may be determined at the same time. Subsequently, based on the intersection between the first pixel and the second pixel, it is determined whether the adjusted image has reached a predetermined convergence condition.

[0059] For example, based on the probability values ​​of all pixels in the segmentation result belonging to the target category, pixels whose probability values ​​belonging to the target category are greater than the predetermined threshold described above can be determined as the first pixels (ie, the target pixels described above).

[0060] Similarly, the embodiment can obtain the segmentation result of the first image in advance, and determine the pixel in the first image whose probability value of belonging to the target category is greater than a predetermined threshold value as the second pixel according to the segmentation result of the first image. Alternatively, the embodiment can obtain the segmentation result of the first image by using an operation similar to operation S321 in the first cycle of performing operations S321 to S325, and obtain the second pixel according to the segmentation result.

[0061] For example, this embodiment may first determine the intersection-and-union ratio between the first pixel and the second pixel, and when the intersection-and-union ratio is less than a predetermined intersection-and-union ratio, determine that the first adversarial image has reached a predetermined convergence condition. The predetermined intersection-and-union ratio may be any positive number much less than 1, such as 0.3, and the present disclosure does not limit this. Alternatively, this embodiment may first determine the ratio between the number of pixels in the intersection and the number of second pixels, and when the ratio is less than a predetermined ratio, determine that the first adversarial image has reached a predetermined convergence condition. The predetermined ratio may be any positive number of 0.5 or less than 0.5, and the present disclosure does not limit this. The intersection between the first pixel and the second pixel is determined based on the position of the first pixel in the adjusted image and the position of the second pixel in the first image. If the position of a first pixel in the adjusted image corresponds to the position of a second pixel in the first image, it can be determined that the pixel pair formed by the first pixel and the second pixel is an element in the intersection.

[0062] By determining whether the adjusted image reaches a predetermined convergence condition according to the intersection between the first pixel and the second pixel, the finally determined first adversarial image can be made to be far away from the first image, thereby increasing the recognition difficulty of the first adversarial image.

[0063] Figure 4 It is a schematic diagram of the principle of adjusting the initial adversarial image according to an embodiment of the present disclosure.

[0064] According to an embodiment of the present disclosure, when adjusting the first adversarial image according to the difference between the first probability and the second probability, the loss for the first adversarial image can be determined according to the difference between the first probability and the second probability. Then, the first adversarial image is adjusted according to the gradient value of the loss. By adjusting the first adversarial image according to the gradient value of the loss, the adjustment efficiency of the first adversarial image can be improved, and the speed of generating the adversarial image can be improved.

[0065] For example, Figure 4 As shown, taking the first probability and the second probability as the probability average, and the multiple predetermined categories including the target category and the background category as an example, in each cycle of adjusting the initial adversarial image, the embodiment 400 can first determine the first probability 420 according to the probability matrix 411 composed of the probability values ​​of all pixels in the first adversarial image belonging to the target category. Specifically, the average value of all elements in the probability matrix 411 can be used as the first probability 420. Similarly, the second probability 430 can be determined according to the probability matrix 412 composed of the probability values ​​of all pixels in the first adversarial image belonging to the background category.

[0066] After obtaining the first probability 420 and the second probability 430, the embodiment may determine the loss 440 according to the difference between the first probability 420 and the second probability 430. For example, the difference between the first probability and the second probability may be used to represent the loss of the first adversarial image. For example, the loss J(x′) of the first adversarial image t，y ) can be expressed by the following formula (1):

[0067] J(x′ t，y )=mean(F(x i ′,y i =1))-mean(F(x i ′,y i =0)). Formula (1)

[0068] Among them, mean() represents the function of calculating the average value of all elements in the matrix, F(x i ′,y i =1) represents the first adversarial sample x i All pixels in the segmentation result of ′ belong to category 1 (i.e., y i=1). i ′,y i =0) represents the first adversarial sample x i All pixels in the segmentation result of ′ belong to category 0 (i.e., y i =0). For example, in a character recognition scenario, category 1 may be a character category, and category 0 may be a background category.

[0069] It is understandable that when the multiple predetermined categories include multiple other categories, any of the above-described methods can be used to obtain the second probability 430. When the multiple other categories include only one background category, this embodiment can use each category other than the background category in the multiple predetermined categories as a target category to obtain a probability group, which includes a first probability 420 and a second probability 430. For each category as the target category, y in the above formula (1) i =0 may be the category corresponding to the maximum probability value among the multiple probability values ​​that each pixel belongs to other categories. Thus, using formula (1), a loss may be obtained for each category as the target category. In this embodiment, the average value of the obtained multiple losses may be used as the loss 440 for the first adversarial image.

[0070] After obtaining the loss 440, the gradient value 450 of the loss 440 may be calculated first, and then the pixel value of each pixel in the first adversarial image may be added with the gradient value to complete the adjustment of the first adversarial image. t The gradient value grad of y can be calculated by the following formula (2):

[0071]

[0072] in, Represents the loss function J() for the first adversarial sample x t Find the gradient for each pixel in ′.

[0073] In the embodiment, a sign function may be used to determine the gradient value of the loss to ensure that the gradient value is a predetermined value. In this way, the step size of adjusting the first adversarial image may be fixed, so as to improve the efficiency of adjusting the first adversarial image. Therefore, in this embodiment, the loss J(x′ t，y The gradient value grad of ) can be calculated using the following formula (3):

[0074]

[0075] Where sign() is the sign function. is less than 0, then the loss J(x′t，y ) has a gradient value of -1. is a value greater than 0, then the loss J(x′ t，y ) has a gradient value of 1. Then the loss J(x′ t，y ) has a gradient value of 0.

[0076] According to an embodiment of the present disclosure, when adjusting the first adversarial image according to the gradient value of the loss, the perturbation parameter α may also be used for adjustment. For example, the product of the gradient value grad of the loss and the perturbation parameter α is used as the adjustment step length, and the pixel value of each pixel in the first adversarial image is added to the adjustment step length to complete the adjustment of the first adversarial image. For example, the adjusted image is set to x″ t , then the adjusted image can be calculated using the following formula (4):

[0077] x″ t = x′ t +α*grad. Formula (4)

[0078] Among them, x″ t Adjusted image, x t ′ is the first adversarial sample, grad is the gradient value of the loss, and α is the perturbation parameter.

[0079] In one embodiment, when adjusting the first adversarial image, the value of each pixel in the adjusted first adversarial image may be limited to a predetermined value range, wherein the predetermined value range may be, for example, [0, 255], so that the value of each pixel is within a reasonable range.

[0080] For example, this embodiment may use the clipping function clip(), the gradient value grad and the disturbance parameter α to calculate the adjusted image x″ t , please refer to the following formula (5) for details:

[0081] x″ t =clip(x′ t +α*grad). Formula (5)

[0082] Among them, x″ t is the adjusted image, x′ t is the first adversarial sample, grad is the gradient value of the loss, α is the perturbation parameter, and clip() is the clipping function.

[0083] It can be understood that the above-mentioned predetermined value range is only used as an example to facilitate understanding of the present disclosure, and the present disclosure does not limit this.

[0084] Figure 5 It is a schematic diagram of the principle of the method for generating an adversarial image according to an embodiment of the present disclosure.

[0085] According to an embodiment of the present disclosure, when a first adversarial image for a first image is obtained, a target perturbation can also be determined based on the difference between the first adversarial image and the first image. In this way, for any image other than the first image, a second adversarial image for the image can be generated by adding the target perturbation to the image. In this way, the generation efficiency of multiple adversarial images for multiple images can be improved.

[0086] For example, Figure 5 As shown, when generating an adversarial image, the embodiment 500 can obtain an image from any image set 510 as the first image x t 511. After adopting the above embodiments to obtain the first image x t The first adversarial image x″ of 511 t After 521, the embodiment may convert the first adversarial image x″ t The pixel value of each pixel in 521 is the same as the first image x t The pixel values ​​of the corresponding pixels in 511 are subtracted to obtain a difference matrix representing the difference between the first adversarial image and the first image. The difference matrix can be used to represent the target disturbance 530.

[0087] After obtaining the target perturbation 530, for the image set 510 except the first image x t 511, a target perturbation 530 may be added to the second image 512, thereby obtaining a second adversarial image 522 for the second image 512. It is understandable that the second image 512 may be any image in the image set 510 except the first image x. t Any image other than 511.

[0088] Based on the method for generating an adversarial image provided by the present disclosure, the present disclosure also provides a device for generating an adversarial image. Figure 6 The device is described in detail.

[0089] Figure 6 It is a structural block diagram of a device for generating an adversarial image according to an embodiment of the present disclosure.

[0090] like Figure 6 As shown, the adversarial image generating device 600 of this embodiment may include a disturbance adding module 610 and an image adjustment module 620 .

[0091] The disturbance adding module 610 is used to add random disturbance to the first image to obtain an initial adversarial image. In one embodiment, the disturbance adding module 610 can be used to perform the operation S210 described above, which will not be described in detail here.

[0092] The image adjustment module 620 is used to adjust the initial adversarial image with the goal of minimizing the difference between the first probability that the initial adversarial image belongs to the target category and the second probability that the initial adversarial image does not belong to the target category, so as to obtain a first adversarial image for the first image. In one embodiment, the image adjustment module 620 can be used to perform the operation S220 described above, which will not be repeated here.

[0093] According to an embodiment of the present disclosure, the above-mentioned image adjustment module 620 is used to use the initial adversarial image as the initial image of the first adversarial image, cyclically adjust the first adversarial image, and the first adversarial image reaches a predetermined convergence condition. For example, the image adjustment module 620 may include a segmentation submodule, a first probability determination submodule, a second probability determination submodule, and an image adjustment submodule. The segmentation submodule is used to determine the segmentation result of the first adversarial image, and the segmentation result includes the probability value of each pixel in the first adversarial image belonging to each category in multiple predetermined categories; the multiple predetermined categories include the target category. The first probability determination submodule is used to determine the first probability according to the probability value of each pixel belonging to the target category. The second probability determination submodule is used to determine the second probability according to the probability value of each pixel belonging to other categories in multiple predetermined categories except the target category. The image adjustment submodule is used to adjust the first adversarial image according to the difference between the first probability and the second probability.

[0094] According to an embodiment of the present disclosure, the image adjustment submodule may include a loss determination unit and an adjustment unit. The loss determination unit is used to determine the loss for the first adversarial image according to the difference between the first probability and the second probability. The adjustment unit is used to adjust the first adversarial image according to the gradient value of the loss.

[0095] According to an embodiment of the present disclosure, the image adjustment submodule may further include a gradient determination unit for determining a gradient value of the loss using a sign function.

[0096] According to an embodiment of the present disclosure, the adjustment unit is used to adjust the pixel value of each pixel in the first adversarial image according to a predetermined value range of the gradient value and the pixel value.

[0097] According to an embodiment of the present disclosure, the above-mentioned adversarial image generation device 600 may further include a disturbance determination module, which is used to determine the target disturbance according to the difference between the first adversarial image and the first image in response to the first adversarial image reaching a predetermined convergence condition. The disturbance adding module is also used to add the target disturbance to the second image to obtain a second adversarial image for the second image.

[0098] According to an embodiment of the present disclosure, the image adjustment module 620 may further include a first pixel determination submodule, a second pixel determination submodule, and a conditional achievement determination submodule. The first pixel determination submodule is used to determine a first pixel belonging to a target category in the first adversarial image according to the segmentation result. The second pixel determination submodule is used to determine a second pixel belonging to the target category in the first image. The conditional achievement determination submodule is used to determine whether a predetermined convergence condition is reached according to the intersection between the first pixel and the second pixel.

[0099] According to an embodiment of the present disclosure, the first probability determination submodule is specifically used to determine the average value of the probability values ​​of all pixels in the first adversarial image belonging to the target category as the first probability. The second probability determination submodule is specifically used to determine the average value of the maximum probability value among the probability values ​​of all pixels belonging to other categories as the second probability.

[0100] It should be noted that the collection, storage, use, processing, transmission, provision, disclosure and application of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals. In the technical solution of this disclosure, the user's authorization or consent is obtained before obtaining or collecting user personal information.

[0101] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0102] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement a method for generating an adversarial image of an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0103] like Figure 7As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0104] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0105] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as the generation method of the adversarial image. For example, in some embodiments, the generation method of the adversarial image may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the generation method of the adversarial image described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the generation method of the adversarial image in any other appropriate manner (e.g., by means of firmware).

[0106] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0107] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0108] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0109] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0110] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0111] A computer system may include a client and a server. The client and the server are generally far away from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. Among them, the server can be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server can also be a server of a distributed system, or a server combined with a blockchain.

[0112] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0113] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for generating adversarial images, include: Add random perturbations to the first image to obtain an initial adversarial image; as well as Adjusting the initial adversarial image to obtain a first adversarial image for the first image with the goal of minimizing a difference between a first probability that the initial adversarial image belongs to a target category and a second probability that the initial adversarial image does not belong to the target category; Wherein, adjusting the initial adversarial image includes: using the initial adversarial image as the initial image of the first adversarial image, and cyclically performing the following operations until the first adversarial image reaches a predetermined convergence condition: Determining a first probability that a current image of the first adversarial image belongs to the target category and a second probability that the first adversarial image does not belong to the target category; Adjusting the current image according to a difference between the first probability and the second probability to obtain an adjusted image; In response to the adjusted image reaching the predetermined convergence condition, using the adjusted image as a first adversarial image for the first image; In response to the adjusted image not meeting the predetermined convergence condition, updating the current image to the adjusted image.

2. The method according to claim 1, in, Determining a first probability that the current image belongs to the target category and a second probability that the first adversarial image does not belong to the target category includes: Determine a segmentation result of the current image, the segmentation result comprising a probability value of each pixel in the current image belonging to each category of a plurality of predetermined categories; the plurality of predetermined categories including the target category; Determining the first probability according to the probability value of each pixel belonging to the target category; and The second probability is determined according to the probability value that each pixel belongs to a category other than the target category among the multiple predetermined categories.

3. The method according to claim 1, in, The adjusting the current image according to the difference between the first probability and the second probability comprises: determining a loss for the current image according to a difference between the first probability and the second probability; and The current image is adjusted according to the gradient value of the loss.

4. The method according to claim 3, in, The adjusting the current image according to the difference between the first probability and the second probability further comprises: Using a sign function, the gradient value of the loss is determined.

5. The method according to claim 3 or 4, in, The adjusting the current image according to the gradient value of the loss comprises: According to the predetermined value ranges of the gradient value and the pixel value, the pixel value of each pixel in the current image is adjusted.

6. The method according to claim 2, further comprising: include: In response to the adjusted image reaching the predetermined convergence condition, determining a target disturbance according to a difference between the first adversarial image and the first image; as well as The target perturbation is added to the second image to obtain a second adversarial image for the second image.

7. The method according to claim 2, in, Adjusting the current image further includes: Determine, according to the segmentation result, a first pixel in the current image that belongs to the target category; determining a second pixel in the first image that belongs to the target category; and Whether a predetermined convergence condition is met is determined according to the intersection between the first pixel and the second pixel.

8. The method according to claim 2, in: Determining the first probability according to the probability value of each pixel belonging to the target category includes: determining an average value of the probability values ​​of all pixels in the current image belonging to the target category as the first probability; Determining the second probability based on the probability value of each pixel belonging to other categories among the multiple predetermined categories except the target category includes: determining an average value of maximum probability values ​​among the probability values ​​of all the pixels belonging to the other categories as the second probability.

9. A device for generating an adversarial image, include: A disturbance adding module, used for adding random disturbance to the first image to obtain an initial adversarial image; as well as an image adjustment module, configured to adjust the initial adversarial image with the goal of minimizing a difference between a first probability that the initial adversarial image belongs to a target category and a second probability that the initial adversarial image does not belong to the target category, so as to obtain a first adversarial image for the first image; The image adjustment module is used to use the initial adversarial image as the initial image of the first adversarial image, and cyclically adjust the current image of the first adversarial image until the adjusted image reaches a predetermined convergence condition; the image adjustment module includes: a probability determination submodule, configured to determine a first probability that a current image of the first adversarial image belongs to the target category and a second probability that the first adversarial image does not belong to the target category; an image adjustment submodule, configured to adjust the current image according to a difference between the first probability and the second probability to obtain an adjusted image; an image determination submodule, configured to use the adjusted image as a first adversarial image for the first image in response to the adjusted image reaching the predetermined convergence condition; and The image updating submodule is configured to update the current image to the adjusted image in response to the adjusted image failing to meet the predetermined convergence condition.

10. The device according to claim 9, in, The probability determination submodule includes: a segmentation unit, configured to determine a segmentation result of the current image, wherein the segmentation result includes a probability value of each pixel in the current image belonging to each category of a plurality of predetermined categories; the plurality of predetermined categories includes the target category; A first probability determination unit, configured to determine the first probability according to a probability value of each pixel belonging to the target category; and The second probability determination unit is used to determine the second probability according to the probability value of each pixel belonging to other categories among the multiple predetermined categories except the target category.

11. The device according to claim 9, in, The image adjustment submodule comprises: a loss determining unit, configured to determine a loss for the current image according to a difference between the first probability and the second probability; and An adjustment unit is used to adjust the current image according to the gradient value of the loss.

12. The device according to claim 11, in, The image adjustment submodule also includes: The gradient determination unit is used to determine the gradient value of the loss by using a sign function.

13. The device according to claim 11 or 12, in, The adjustment unit is used for: According to the predetermined value ranges of the gradient value and the pixel value, the pixel value of each pixel in the current image is adjusted.

14. The device according to claim 10, further comprising: include: a disturbance determination module, configured to determine a target disturbance according to a difference between the first adversarial image and the first image in response to the adjusted image reaching the predetermined convergence condition; The disturbance adding module is further used to add the target disturbance to the second image to obtain a second adversarial image for the second image.

15. The device according to claim 10, in, The image adjustment module also includes: A first pixel determination submodule, used to determine a first pixel in the current image belonging to the target category according to the segmentation result; A second pixel determination submodule, configured to determine a second pixel in the first image that belongs to the target category; and The condition-reaching determination submodule is used to determine whether a predetermined convergence condition is reached according to the intersection between the first pixel and the second pixel.

16. The device according to claim 10, in: The first probability determination unit is used to: determine an average value of probability values ​​of all pixels in the current image belonging to the target category as the first probability; The second probability determination unit is used to determine an average value of maximum probability values ​​among the probability values ​​that all the pixels belong to the other categories as the second probability.

17. An electronic device, include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any one of claims 1 to 8.

18. A non-transitory computer-readable storage medium storing computer instructions, in, The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 8.

19. A computer program product, comprising a computer program / instructions, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 8.

Images