A method, system, device and medium for generating adversarial samples

Abstract

The present invention discloses a method, system, device and medium for generating adversarial samples. In the scheme, after determining the target area and background area in the original image, N target pixels and N first interference pixels are selected, and then the pixel values ​​of the N first interference pixels are used to replace the pixel values ​​of the N target pixels one by one to generate a first interference image as an adversarial sample. Since the first interference pixels are pixels adjacent to the target area in the background area, the first interference pixels have a stronger similarity with the target pixels. Therefore, the generated adversarial sample is less likely to be recognized by the human eye or the target detector, so that the generated adversarial sample has a stronger offensiveness, so that it can be defended more targetedly.

Description

Technical Field

[0001] The present invention relates to the field of target recognition, and in particular to a method, system, device and medium for generating adversarial samples. Background Art

[0002] Object detection has been thriving thanks to the continuous power provided by deep learning. It has demonstrated excellent performance in the fields of robot navigation, intelligent video surveillance, industrial detection, aerospace, etc. However, they also inherit the vulnerability of deep neural networks—vulnerability to adversarial attacks. Adversarial attacks are to add carefully designed perturbations to the original input images to generate new images. The human visual system can hardly detect the difference between these new images (adversarial samples) and the original images. However, when adversarial samples are tested on target detectors, the target detectors will not be able to recognize the target objects. The existence of adversarial samples exposes serious security risks in the application of target detectors. For example, for face recognition systems, attackers can easily tamper with face images to induce target detectors to detect wrong information; for autonomous driving systems, attackers can make target detectors unable to correctly recognize parking signs, and can even disguise vehicles to make them unrecognizable. Studying this issue not only helps to understand the working mechanism of deep neural networks, but also helps to inspire the generation of more powerful defense solutions. Summary of the invention

[0003] The purpose of the present invention is to provide a method, system, device and medium for generating adversarial samples. Since the first interfering pixel point is a pixel point in the background area adjacent to the target area, the adversarial sample generated by the method is not easily recognized by the human eye, so that the generated adversarial sample has stronger offensiveness, so that the defense can be more targeted.

[0004] In order to solve the above technical problems, the present invention provides a method for generating adversarial samples, comprising:

[0005] Determine a target area and a background area in the original image, wherein the target area is an area where a first target object is located, and the background area is an area in the original image other than the target area;

[0006] Selecting N first interfering pixel points in the background area that are adjacent to the target area, and selecting N target pixel points in the target area, the N target pixel points correspond one to one to the N first interfering pixel points, and N is an integer not less than 1;

[0007] The pixel values ​​of the N target pixels in the original image are replaced one by one with the pixel values ​​of the first interference pixels corresponding to the original image to obtain a first interference image, and the first interference image is used as an adversarial sample.

[0008] Preferably, after the N target pixels in the original image are replaced one by one with interference pixels corresponding to the original image to obtain a first interference image, the method further includes:

[0009] Constructing a second target object;

[0010] Selecting M second interference pixels in the area where the second target object is located, and selecting M target pixels in the target area, the M second interference pixels and the M target pixels correspond one to one, and M is an integer not less than 1;

[0011] The pixel values ​​of the M target pixels in the first interference image are replaced one by one with the pixel values ​​of the second interference pixels corresponding to the first interference image to obtain a second interference image, and the second interference image is used as the adversarial sample.

[0012] Preferably, determining the target area and the background area in the original image includes:

[0013] Processing the original image using a fully convolutional neural network method to set the area where the first target object is located to a first color, and setting the area of ​​the original image other than the first target object to a second color;

[0014] The area where the first color is located is used as the target area, and the area where the second color is located is used as the background area.

[0015] Preferably, selecting N first interfering pixel points in the background area adjacent to the target area, and selecting N target pixel points in the target area, wherein the N target pixel points correspond one-to-one to the N first interfering pixel points, comprises:

[0016] Setting a first preset step length;

[0017] Performing polling detection on all pixels in the original image according to the first preset step size;

[0018] In the polling detection process, determining whether the detected pixel point is a pixel point in the target area;

[0019] If yes, the pixel point in the target area detected is used as the target pixel point, and the target row or target column where the target pixel point is located is determined;

[0020] A pixel point in the target row or target column in the background area and adjacent to the target area is used as a first interference pixel point corresponding to the target pixel point.

[0021] Preferably, the preset step size is an integer not less than 2.

[0022] Preferably, selecting M second interference pixel points in the area where the second target object is located, and selecting M target pixel points in the target area, wherein the M second interference pixel points correspond to the M target pixel points in a one-to-one manner, comprises:

[0023] Setting a second preset step length;

[0024] Performing polling detection on all pixels in the original image according to the second preset step size;

[0025] In the polling detection process, determining whether the detected pixel point is a pixel point in the target area;

[0026] If yes, the pixel point in the target area detected is used as the target pixel point, and the target row or target column where the target pixel point is located is determined;

[0027] The pixel point in the target row or target column of the image where the second target object is located is used as the second interference pixel point corresponding to the target pixel point.

[0028] In order to solve the above technical problems, the present invention also provides a system for generating adversarial samples, comprising:

[0029] A region determination unit, used to determine a target region and a background region in the original image, wherein the target region is a region where a first target object is located, and the background region is a region in the original image other than the target region;

[0030] A pixel point selection unit, used to select N first interfering pixel points in the background area adjacent to the target area, and select N target pixel points in the target area, wherein the N target pixel points correspond to the N first interfering pixel points one by one;

[0031] The interference unit is used to replace the pixel values ​​of the N target pixels in the original image with the pixel values ​​of the first interference pixels corresponding to itself, so as to obtain a first interference image, and use the first interference image as an adversarial sample.

[0032] In order to solve the above technical problems, the present invention further provides a device for generating adversarial samples, comprising:

[0033] Memory for storing computer programs;

[0034] A processor is used to implement the steps of the above-mentioned method for generating adversarial samples when executing the computer program.

[0035] In order to solve the above technical problems, the present invention also provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for generating adversarial samples are implemented.

[0036] The present application provides a method, system, device and medium for generating adversarial samples. In the scheme, after determining the target area and background area in the original image, N target pixels and N first interference pixels are selected, and then the pixel values ​​of the N first interference pixels are used to replace the pixel values ​​of the N target pixels one by one to generate a first interference image as an adversarial sample. Since the first interference pixels are pixels adjacent to the target area in the background area, the adversarial samples generated by the adversarial samples are not easily recognized by the human eye, making the generated adversarial samples more aggressive, so that more targeted defense can be carried out. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the prior art and the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 A schematic diagram of a flow chart of a method for generating adversarial samples provided by the present invention;

[0039] Figure 2 A schematic diagram of an original image provided by the present invention;

[0040] Figure 3 A schematic diagram of the original image after processing provided by the present invention;

[0041] Figure 4 A schematic diagram of a first original image provided by the present invention;

[0042] Figure 5 A schematic diagram of a second original image provided by the present invention;

[0043] Figure 6 A schematic diagram of a third original image provided by the present invention;

[0044] Figure 7 A schematic diagram of a first interference image provided by the present invention;

[0045] Figure 8 A structural block diagram of a system for generating adversarial samples provided by the present invention;

[0046] Fig. 9This is a structural block diagram of a device for generating adversarial samples provided by the present invention. DETAILED DESCRIPTION

[0047] The core of the present invention is to provide a method, system, device and medium for generating adversarial samples. Since the first interfering pixel point is a pixel point in the background area adjacent to the target area, the adversarial sample generated by the method is not easily recognized by the human eye, making the generated adversarial sample more aggressive, so that the defense can be more targeted.

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Please refer to Figure 1 , Figure 1 A schematic diagram of a process for generating an adversarial sample provided by the present invention, the method comprising:

[0050] S11: determining a target area and a background area in the original image, wherein the target area is an area where the first target object is located, and the background area is an area other than the target area in the original image;

[0051] First, when generating adversarial samples, interference elements are added to the area where the first target image is located in the original image, so that the first target object cannot be identified when the target detector is used to detect the original image.

[0052] Based on this, the present application first needs to divide all areas in the original image into a target area and a background area other than the target area, so as to facilitate the subsequent processing of the first target object in the target area and to facilitate the addition of interference elements.

[0053] As a preferred embodiment, determining the target area and the background area in the original image includes:

[0054] The original image is processed using a fully convolutional neural network method to set the area where the first target object is located to a first color, and the area other than the first target object in the original image to a second color;

[0055] The area where the first color is located is taken as the target area, and the area where the second color is located is taken as the background area.

[0056] This embodiment aims to provide a specific implementation method for determining the target area and background area in the original image. Specifically, the full convolutional neural network can perform dense predictions on each pixel task in semantic segmentation. Therefore, the full convolutional neural network is used in the present application to perform semantic segmentation on the original image to set the target area to a first color and the background area to a second color, thereby obtaining the target area and background area corresponding to the first target object according to the color information of the first target object obtained by semantic segmentation.

[0057] Please refer to Figure 2 and Figure 3 , Figure 2 A schematic diagram of an original image provided by the present invention, Figure 3 This is a schematic diagram of the original image after being processed provided by the present invention. Figure 2 The cat in the figure is the first target object, and the fully convolutional neural network method is used to Figure 2 To process, Figure 2 The area where the cat is located is set to light color, and the area other than the cat is set to dark color, such as Figure 3 shown.

[0058] Specifically, x i,j Represents the data vector of the original image X at position (i, j), then the output y of the next layer after processing by the convolutional neural network layer is i,j Shown as

[0059] y ij =f ks ({X si+δi,sj+δj} 0≤δi,δi≤k ),

[0060] Among them, k represents the size of the convolution kernel, s represents the step size, δ represents the offset, and f ks (·) indicates the type of convolutional layer. In order to obtain more accurate semantic information of the image, a skip connection strategy is used, multiple upsampling is performed, and then high-level information is combined, and finally upsampled to the original image size. Upsampling is actually a bilinear interpolation operation, that is, linear interpolation is performed in the a and b directions respectively (where a is the horizontal coordinate direction and b is the vertical coordinate direction). The coordinates of the four points of the known function f are Q 11 =(a1,b1),Q 12 =(a1,b2),Q 21 =(a2,b1) and Q 22 =(a2,b2), linear interpolation in the a (horizontal axis) direction yields,

[0061]

[0062]

[0063] Then perform linear interpolation in the b (ordinate) direction to obtain f(a,b):

[0064]

[0065] Finally, the pixels of the first target object of interest are painted with the first color. For example, when the first target object in the original image is a cat, all pixels of the cat are filled with blue, and the position of the blue pixel is the target area of ​​the cat.

[0066] S12: selecting N first interfering pixel points adjacent to the target area in the background area, and selecting N target pixel points in the target area, the N target pixel points correspond to the N first interfering pixel points one by one, and N is an integer not less than 1;

[0067] S13: Replace the pixel values ​​of the N target pixels in the original image one by one with the pixel values ​​of the first interference pixels corresponding to the original image to obtain a first interference image, and use the first interference image as an adversarial sample.

[0068] Specifically, when generating adversarial samples, it is necessary to modify or replace several pixels in the target area to change the pixel values ​​of these pixels so that the first target image is disturbed.

[0069] The specific implementation method of interfering with the first target image in the present application is: select N pixels in the background area as the first interfering pixels, and replace the N target pixels in the target area that correspond to the N first interfering pixels one by one, so as to interfere with the first target image. The reason why the first interfering pixels in the present application are selected from the pixels in the background area is that the background area is part of the original image, and when the pixels in the background area are used to replace the pixels in the target area, the similarity is large, and it is not easy to be detected when the human eye is used to identify the first interfering image.

[0070] Specifically, how to select N target pixels and how to select N first interference pixels are not limited in this application.

[0071] In summary, the adversarial sample in this application is not easily recognized by the human eye because the first interfering pixel point is a pixel point in the background area adjacent to the target area. Therefore, the adversarial sample generated by it is more aggressive and can be defended more targetedly.

[0072] Based on the above embodiments:

[0073] As a preferred embodiment, after replacing N target pixels in the original image with interference pixels corresponding to the original image one by one to obtain a first interference image, the method further includes:

[0074] Constructing a second target object;

[0075] Selecting M second interference pixels in the area where the second target object is located, and selecting M target pixels in the target area, the M second interference pixels and the M target pixels correspond one to one, and M is an integer not less than 1;

[0076] The pixel values ​​of the M target pixels in the first interference image are replaced one by one with the pixel values ​​of the second interference pixels corresponding to themselves to obtain a second interference image, and the second interference image is used as an adversarial sample.

[0077] In the above embodiment, a specific implementation method for forming a first interference image is provided. Considering that the interference of the above first interference image may not be large enough, when the first interference image is detected by the target detector, there may still be a situation where the first target image can be identified from the first interference image. Therefore, in order to further ensure that the target detector cannot detect the first target image in the adversarial sample, this embodiment further interferes with the first interference image to obtain a second interference image, and uses the second interference image as an adversarial sample.

[0078] Specifically, a second target image is first constructed, and then M second interference pixels are selected from the second target image, and M target pixels are selected from the target area, and the M target pixels are replaced by the M second interference pixels. At this time, the pixels in the target area include several pixels of the first target image, N first interference pixels and M second interference pixels. When the target detector recognizes the second interference image, it is more difficult to recognize the first target image.

[0079] It should be noted that the numbers of M and N should not be too large to avoid significant distortion of the original image.

[0080] Furthermore, in this embodiment, there may be overlapping target pixels among the M target pixels and the N target pixels.

[0081] As a preferred embodiment, the way of constructing the second target object may be but is not limited to using a label-fixed sample reconstruction method.

[0082] Specifically, the sample reconstruction method using fixed labels in this embodiment includes the following two steps:

[0083] (1) Train a classifier C(X; θ) with good performance;

[0084] (2) Fixed output label (the real label of the first target object) uses model inversion technology to update the gradient information of the image based on the target loss function, and reconstructs the machine-recognizable sample (Second target object). Reconstructed sample The classifier used is ResNet50, and the selected dataset is ImageNet dataset. In addition, in this embodiment, it is not required that the reconstructed second target object is visually consistent with the original image. It only needs to ensure that the machine recognizes it as the label of the target object of interest (that is, the label of the first target object) (it only requires that the machine can recognize it). The objective function of is defined as follows:

[0085]

[0086] Initially, it is set to a full 0 matrix of the same size as the original image. Represents the probability that the classifier outputs the target object category of interest (that is, the first target object). For example, reconstructing an image that the classifier identifies as a cat, This represents the probability that the classifier is classified as a cat after each iteration. This embodiment uses the incremental gradient update method to update Right now,

[0087]

[0088]

[0089]

[0090] Among them, TV(V) represents the total variation loss (TV), which is used to ensure the smoothness of the reconstructed samples. In the initial state, V represents and The same size of all-zero matrices, λ1, λ2, α and β all represent scalar weights used to balance the weight of each item, λ1+λ2=1, λ1=0.5, α=0.1, β=0.01.

[0091] As a preferred embodiment, N first interfering pixel points adjacent to the target area in the background area are selected, and N target pixel points in the target area are selected, and the N target pixel points correspond to the N first interfering pixel points one by one, including:

[0092] Setting a first preset step length;

[0093] Performing polling detection on all pixels in the original image according to a first preset step size;

[0094] During the polling detection process, determining whether the detected pixel point is a pixel point in the target area;

[0095] If yes, the pixel point in the detected target area is taken as the target pixel point, and the target row or target column where the target pixel point is located is determined;

[0096] A pixel point in the target row or target column in the background area and adjacent to the target area is used as a first interference pixel point corresponding to the target pixel point.

[0097] Specifically, the method for obtaining the second interference pixel point is: first set a preset step size, and then poll all pixel points based on this preset step size. When the detected pixel point is a pixel point in the target area, this pixel point is used as the target pixel point. At this time, the row where the target pixel point is located is determined as the target row, and the column where the target pixel point is located is determined as the target column. A pixel point in the target row or target column in the background area and adjacent to the target area is used as the first interference pixel point.

[0098] Please refer to Figure 4 , Figure 5 , Figure 6 and Figure 7 , Figure 4 A schematic diagram of a first original image provided by the present invention, Figure 5 A schematic diagram of a second original image provided by the present invention, Figure 6 This is a schematic diagram of the third original image provided by the present invention. Figure 7 A schematic diagram of a first interference image provided by the present invention. Specifically, Figure 4 and Figure 5 Each square in represents a pixel point, and the number 1 in the square is the pixel point corresponding to the first target object, that is, the area formed by all the numbers 1 is the target area, and correspondingly, the area formed by all the numbers 0 is the background area. Figure 5 In , all rows and all columns in the original image are numbered, specifically, row 0-row 4 and row 0-column 4. Figure 6 The value in each square is the pixel value of each pixel in the original image.

[0099] Assuming that the preset step size is 2, at this time, polling detection starts from (0,0), that is, 0 row and 0 column. At this time, since the preset step size is 2, the polling can be along (0,0)--(0,2)--(0,4)--(2,0)--(2,2)--(2,4)... until (4,4), or along (0,0)--(2,0)--(4,0)--(0,2)--(2,2)--(4,2)... until (4,4), and this application is no longer limited. Among them, during the polling process, when (2,2) is detected, (2,2) is the target pixel. At this time, the pixel in the second row or second column in the background area and adjacent to the target area is selected (there are 4 pixels that meet this condition, namely (0,2), (2,0), (2,4) and (4,2)). One of the 4 pixels that meet the condition is selected as the first interference pixel. For example, the pixel at (2,0) is selected as the first interference pixel. Figure 6 As shown, the pixel value at (2,0) is 8, and the pixel value at the target pixel point (2,2) is 2. 8 is used to replace 2, and the pixel values ​​of each pixel point of the first interference image are obtained as follows Figure 7 At this point, the step of generating the first interference image is completed.

[0100] In this embodiment, the first interfering pixel point is a pixel point that is in the same row or column as the target pixel point and adjacent to the target area. When the target pixel point is replaced by the first interfering pixel point, the original image distortion can be further avoided.

[0101] As a preferred embodiment, the preset step size is an integer not less than 2.

[0102] Among them, considering that when the pixel values ​​of too many target pixels in the target area of ​​the original image are replaced, the original image is likely to be distorted. Therefore, the preset step size in the present application is limited to an integer not less than 2 to avoid replacing the pixel value of each target pixel. Furthermore, when there are many pixels in the target area where the first target object in the original image is located, the preset step size can also be increased accordingly, for example, to 3 or 4, etc., depending on the actual situation, and the present application will no longer limit it here.

[0103] As a preferred embodiment, M second interference pixel points in the area where the second target object is located are selected, and M target pixel points in the target area are selected, and the M second interference pixel points and the M target pixel points correspond one to one, including:

[0104] Setting a second preset step length;

[0105] Performing polling detection on all pixels in the original image according to a second preset step size;

[0106] During the polling detection process, determining whether the detected pixel point is a pixel point in the target area;

[0107] If yes, the pixel point in the detected target area is taken as the target pixel point, and the target row or target column where the target pixel point is located is determined;

[0108] The pixel point in the target row or target column of the image where the second target object is located is used as the second interference pixel point corresponding to the target pixel point.

[0109] Specifically, the method of selecting M second interference pixels and M target pixels and using the pixel values ​​of the M second interference pixels to replace the pixel values ​​of the M target pixels in a one-to-one correspondence is the same as the method described in the above embodiment of selecting N first interference pixels and N target pixels and using the pixel values ​​of the N first interference pixels to replace the pixel values ​​of the N target pixels in a one-to-one correspondence. Please refer to the above embodiment for details, and this application is not limited here.

[0110] Please refer to Figure 8 , Figure 8 A structural block diagram of a system for generating adversarial samples provided by the present invention, the system comprising:

[0111] The region determination unit 81 is used to determine a target region and a background region in the original image, wherein the target region is a region where the first target object is located, and the background region is a region other than the target region in the original image;

[0112] A pixel point selection unit 82 is used to select N first interfering pixel points in the background area that are adjacent to the target area, and select N target pixel points in the target area, where the N target pixel points correspond to the N first interfering pixel points one by one;

[0113] The interference unit 83 is used to replace the pixel values ​​of the N target pixels in the original image with the pixel values ​​of the first interference pixels corresponding to itself, to obtain a first interference image, and use the first interference image as an adversarial sample.

[0114] In order to solve the above technical problems, the present application also provides a system for generating adversarial samples. For the introduction of the system for generating adversarial samples, please refer to the above embodiments, and the present application will not go into details here.

[0115] Please refer to Fig. 9 , Fig. 9 A structural block diagram of a device for generating adversarial samples provided by the present invention, the device comprising:

[0116] A memory 91, used for storing computer programs;

[0117] The processor 92 is used to implement the steps of the above-mentioned method for generating adversarial samples when executing a computer program.

[0118] In order to solve the above technical problems, the present application also provides a device for generating adversarial samples. For the introduction of the device for generating adversarial samples, please refer to the above embodiments, and the present application will not go into details here.

[0119] In order to solve the above technical problems, the present invention also provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for generating adversarial samples are implemented.

[0120] For the introduction of computer storage media, please refer to the above embodiments, and this application will not go into details here.

[0121] It should be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0122] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0123] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating adversarial samples, characterized in that: include: Determine a target area and a background area in the original image, wherein the target area is an area where a first target object is located, and the background area is an area in the original image other than the target area; Selecting N first interfering pixel points in the background area that are adjacent to the target area, and selecting N target pixel points in the target area, the N target pixel points correspond one to one to the N first interfering pixel points, and N is an integer not less than 1; The pixel values ​​of the N target pixels in the original image are replaced one by one with the pixel values ​​of the first interfering pixels corresponding to the target pixels; Constructing a second target object; Selecting M second interference pixels in the area where the second target object is located, and selecting M target pixels in the target area, the M second interference pixels and the M target pixels correspond one to one, and M is an integer not less than 1; The pixel values ​​of the M target pixels in the first interference image are replaced one by one with the pixel values ​​of the second interference pixels corresponding to the first interference image to obtain a second interference image, and the second interference image is used as the adversarial sample.

2. The method for generating an adversarial sample according to claim 1, wherein: Determine the target area and background area in the original image, including: Processing the original image using a fully convolutional neural network method to set the area where the first target object is located to a first color, and setting the area of ​​the original image other than the first target object to a second color; The area where the first color is located is used as the target area, and the area where the second color is located is used as the background area.

3. The method for generating an adversarial sample according to claim 1, wherein: Selecting N first interfering pixel points in the background area that are adjacent to the target area, and selecting N target pixel points in the target area, wherein the N target pixel points correspond one-to-one to the N first interfering pixel points, comprising: Setting a first preset step length; Performing polling detection on all pixels in the original image according to the first preset step size; In the polling detection process, determining whether the detected pixel point is a pixel point in the target area; If yes, the pixel point in the target area detected is used as the target pixel point, and the target row or target column where the target pixel point is located is determined; A pixel point in the target row or target column in the background area and adjacent to the target area is used as a first interference pixel point corresponding to the target pixel point.

4. The method for generating an adversarial sample according to claim 3, wherein: The preset step size is an integer not less than 2.

5. The method for generating an adversarial sample according to claim 1, wherein: Selecting M second interference pixels in the area where the second target object is located, and selecting M target pixels in the target area, wherein the M second interference pixels correspond to the M target pixels one by one, comprises: Setting a second preset step length; Performing polling detection on all pixels in the original image according to the second preset step size; In the polling detection process, determining whether the detected pixel point is a pixel point in the target area; If yes, the pixel point in the target area detected is used as the target pixel point, and the target row or target column where the target pixel point is located is determined; A pixel point in a target row or a target column of the image where the second target object is located is used as a second interference pixel point corresponding to the target pixel point.

6. A system for generating adversarial samples, characterized in that: include: A region determination unit, used to determine a target region and a background region in the original image, wherein the target region is a region where a first target object is located, and the background region is a region in the original image other than the target region; A pixel point selection unit, used to select N first interfering pixel points in the background area adjacent to the target area, and select N target pixel points in the target area, wherein the N target pixel points correspond to the N first interfering pixel points one by one; An interference unit, used to replace pixel values ​​of the N target pixels in the original image with pixel values ​​of first interference pixels corresponding to the original image, to obtain a first interference image; The adversarial sample generation system is further used to construct a second target object; Select M second interference pixel points in the area where the second target object is located, and select M target pixel points in the target area, the M second interference pixel points and the M target pixel points correspond one to one, and M is an integer not less than 1; replace the pixel values ​​of the M target pixel points in the first interference image with the pixel values ​​of the second interference pixel points corresponding to themselves, to obtain a second interference image, and use the second interference image as the adversarial sample.

7. A device for generating adversarial samples, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for generating an adversarial sample as described in any one of claims 1 to 5 when executing the computer program.

8. A computer storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for generating an adversarial sample according to any one of claims 1 to 5 are implemented.

Images