Adversarial sample generation method and device

Abstract

This disclosure provides a method and apparatus for generating adversarial examples, relating to image processing, object detection, and deep learning in artificial intelligence. The specific implementation involves: acquiring an original image and initial adversarial examples generated from the original image; performing object detection on the target objects in the original image and the initial adversarial examples to obtain detection information; constructing a loss function for the target objects based on the detection information, the original image, and the initial adversarial examples; and adjusting the initial adversarial examples based on the target object's loss function to obtain the final adversarial examples. This method avoids the drawback of low accuracy caused by manually generating the final adversarial examples, improving the accuracy and reliability of the generated final adversarial examples, and increasing generation efficiency.

Description

Technical Field

[0001] This disclosure relates to image processing, object detection, and deep learning in artificial intelligence, and particularly to a method and apparatus for generating adversarial examples. Background Technology

[0002] To test the effectiveness of object detection algorithms in the field of artificial intelligence (AI) security, adversarial examples can be generated by perturbing sample images.

[0003] In related technologies, perturbation information can be added to sample images artificially to generate adversarial examples.

[0004] However, the above method has the technical problem of low accuracy in generating adversarial examples. Summary of the Invention

[0005] This disclosure provides a method and apparatus for generating adversarial examples to improve the accuracy of generating adversarial examples.

[0006] According to a first aspect of this disclosure, a method for generating adversarial examples is provided, comprising:

[0007] Acquire the original image and the initial adversarial sample generated based on the original image;

[0008] Target detection is performed on the target objects in the original image and the initial adversarial sample to obtain detection information;

[0009] Based on the detection information, the original image, and the initial adversarial sample, a loss function for the target object is constructed, and the initial adversarial sample is adjusted based on the loss function for the target object to obtain the final adversarial sample.

[0010] According to a second aspect of this disclosure, an apparatus for generating adversarial examples is provided, comprising:

[0011] The first acquisition unit is used to acquire the original image and the initial adversarial sample generated based on the original image;

[0012] The detection unit is used to perform target detection on the target objects in the original image and the initial adversarial sample to obtain detection information;

[0013] The construction unit is configured to construct a loss function for the target object based on the detection information, the original image, and the initial adversarial sample.

[0014] An adjustment unit is used to adjust the initial adversarial sample based on the loss function of the target object to obtain the final adversarial sample.

[0015] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0016] At least one processor; and

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect.

[0019] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method according to the first aspect.

[0020] According to a fifth aspect of this disclosure, a computer program product is provided, the computer program product comprising: a computer program stored in a readable storage medium, wherein at least one processor of an electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to cause the electronic device to perform the method described in the first aspect.

[0021] According to the present disclosure, the technical solution of combining detection information, original image and initial adversarial sample to construct loss function of target object, and adjusting the final adversarial sample based on the constructed loss function can avoid the drawback of low accuracy caused by manually generating the final adversarial sample in the relevant process, improve the accuracy and reliability of the generated final adversarial sample, and improve the generation efficiency.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0023] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0024] Figure 1 This is a schematic diagram based on the first embodiment of the present disclosure;

[0025] Figure 2 This is a schematic diagram according to the second embodiment of the present disclosure;

[0026] Figure 3 This is a schematic diagram according to the third embodiment of the present disclosure;

[0027] Figure 4 This is a schematic diagram according to the fourth embodiment of the present disclosure;

[0028] Figure 5 This is a schematic diagram according to the fifth embodiment of the present disclosure;

[0029] Figure 6 This is a schematic diagram according to the sixth embodiment of the present disclosure;

[0030] Figure 7 This is a schematic diagram according to the seventh embodiment of the present disclosure;

[0031] Figure 8 This is a block diagram of an electronic device used to implement the adversarial sample generation method of the embodiments of this disclosure. Detailed Implementation

[0032] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0033] Adversarial examples are widely used in the field of artificial intelligence security. They refer to samples formed by deliberately adding subtle interference information to the input dataset, causing the network model to give an incorrect output with high confidence.

[0034] For example, a dataset includes sample images. Samples created by adding subtle perturbations to these sample images can be called adversarial examples. In other words, adding perturbation information to sample images results in adversarial examples.

[0035] In some embodiments, interference information can be manually set and added to the sample image to obtain adversarial examples.

[0036] However, this method of generating adversarial examples requires human intervention, so the interference information set is easily affected by human factors, resulting in low accuracy of the generated adversarial examples.

[0037] In other embodiments, adversarial examples can be generated in a manner desired by affine transformation.

[0038] For example, the affine transformation expectation of a sample image, i.e., a biased estimate of the pose of the sample image, can be calculated to generate adversarial examples based on the affine transformation expectation.

[0039] However, the required input size of the network model and the sample image size may not be consistent. Therefore, additional learning parameters need to be introduced to meet the required input size of the model network, which slows down the convergence of the network model and increases the difficulty of convergence, resulting in the disadvantage of low efficiency in generating adversarial examples.

[0040] In other embodiments, adversarial examples can be generated using the Expectation Over Transformation (EoT) approach.

[0041] Transformation expectation refers to an adversarial noise that can successfully attack multiple different transformations of the same image, causing the network model to make incorrect predictions on all of these transformed images.

[0042] For example, when generating adversarial examples, data augmentation is performed by executing affine transformations, which simultaneously characterizes changes in the real-world scenario and enhances the learning performance of adversarial examples.

[0043] However, affine transformations primarily target adversarial regions, rather than the final constructed adversarial sample. They neglect sample transformations that exclude adversarial patch regions, thus failing to achieve the purpose of data augmentation.

[0044] To avoid one or more of the above problems, the inventors of this disclosure have creatively arrived at the inventive concept of this disclosure: to perform target detection on the original image and initial adversarial samples to obtain detection information, and to combine the detection information, the original image, and the initial adversarial samples to construct a loss function for the target object, thereby continuously learning to obtain the final adversarial samples.

[0045] Based on the above inventive concept, this disclosure provides a method and apparatus for generating adversarial examples, which can be applied to image processing, object detection and deep learning in artificial intelligence to achieve the reliability of the generated adversarial examples.

[0046] Figure 1 This is a schematic diagram based on the first embodiment of the present disclosure, as shown below. Figure 1 As shown, the method for generating adversarial examples according to embodiments of this disclosure includes:

[0047] S101: Obtain the original image and the initial adversarial examples generated from the original image.

[0048] For example, the execution subject of this embodiment can be an adversarial sample generation device (hereinafter referred to as the generation device). The generation device can be a server (such as a local server, or a cloud server, or a server cluster), a computer, a terminal device, a processor, a chip, etc. This embodiment does not limit the scope of the application.

[0049] The original image can be understood as the image used to generate the final adversarial example. Referring to the example above, the original image can be a sample image, which, after undergoing a series of processing steps, yields the adversarial example.

[0050] The initial adversarial example refers to the adversarial example obtained by preprocessing the original image. The specific implementation method is not limited in this embodiment.

[0051] For example, the original image can be preprocessed based on the application requirements of the generated adversarial examples (such as the network model to which the final adversarial examples are applied) to obtain the initial adversarial examples.

[0052] Correspondingly, the initial adversarial examples can be understood as adversarial examples that meet the input parameter requirements of the network model.

[0053] For example, the original image can be preprocessed based on the input parameter requirements of the network model to obtain adversarial examples that meet the input parameter requirements of the network model.

[0054] The original image and the initial adversarial examples include the target object.

[0055] The target object is the object to be interfered with; that is, the adversarial example is a sample image used to interfere with the target object. The target object may be different depending on the network model.

[0056] For example, if the network model is a face recognition model for recognizing faces, then the target object is a face; if the network model is a model for recognizing traffic lights, then the target object is a traffic light, and so on. These will not be listed one by one here.

[0057] S102: Perform target detection on the target objects in the original image and the initial adversarial sample to obtain detection information.

[0058] This embodiment does not limit the method of target detection. For example, a target detection model can be used to perform target detection and obtain detection information.

[0059] For example, an object detection model including an end-to-end object detection algorithm (YOLO) can be used to perform object detection and obtain detection information. Specifically, the YOLO object detection model within the Paddle framework can be used to perform object detection and obtain detection information. Furthermore, the output function (sigmoid) can be used to process the output of the object detection model (YOLO-head) to obtain the detection information.

[0060] Correspondingly, the detection information is the output of the target detection model, including: category (determined based on industry standards for target detection), confidence (characterizing the probability of the category), and coordinate position (which can be understood as the coordinate position of the detection box).

[0061] S103: Based on the detection information, the original image, and the initial adversarial sample, construct the loss function of the target object, and adjust the initial adversarial sample based on the loss function of the target object to obtain the final adversarial sample.

[0062] The loss function for the target object can be understood as the loss function used for attacking the target object.

[0063] In this embodiment, by combining the detection information, the original image, and the initial adversarial example, a loss function for the target object is constructed. This makes the constructed loss function more reliable, and when the final adversarial example is obtained by adjusting the loss function, the final adversarial example has a strong adversarial capability.

[0064] Correspondingly, when the network model is trained with the final adversarial examples, the trained network model can have a stronger ability to resist interference, thereby improving the network model's recognition ability.

[0065] Based on the above analysis, this disclosure provides a method for generating adversarial samples, including: acquiring an original image and an initial adversarial sample generated from the original image; performing target detection on the target object in the original image and the initial adversarial sample to obtain detection information; constructing a loss function for the target object based on the detection information, the original image, and the initial adversarial sample; and adjusting the initial adversarial sample based on the loss function of the target object to obtain the final adversarial sample. In this embodiment, by combining detection information, constructing a loss function for the target object based on the detection information, the original image, and the initial adversarial sample, and adjusting the final adversarial sample based on the constructed loss function, the technical features of the final adversarial sample can be obtained. This avoids the drawback of low accuracy caused by manually generating the final adversarial sample in related studies, improves the accuracy and reliability of the generated final adversarial sample, and increases the generation efficiency.

[0066] Figure 2This is a schematic diagram based on the second embodiment of the present disclosure, as shown below. Figure 2 As shown, the method for generating adversarial examples according to embodiments of this disclosure includes:

[0067] S201: Obtain the initial perturbation region of the original image.

[0068] It should be understood that the technical features that are the same as those in the above embodiments will not be repeated in this embodiment.

[0069] A disturbed region refers to a region in the original image that has been disturbed, such as a region where interfering information has been added.

[0070] For example, the disturbance region can be a predefined region, such as a region containing disturbance information defined manually. Alternatively, the disturbance region can also be a region containing disturbance information pre-configured by the generating device based on requirements, historical records, and experiments.

[0071] The perturbation region contains both size and location information. Size information can be understood as the proportion of the original image occupied by the perturbation region; location information can be understood as the pixel position of the perturbation region in the original image.

[0072] S202: Preprocess the disturbance region according to the preset preprocessing function to obtain the preprocessed disturbance region.

[0073] Correspondingly, the preprocessed disturbance region has information on its size and location.

[0074] The preprocessing function can be a size normalization function, an image size resizing function, etc., which will not be listed here.

[0075] The preprocessed perturbation region is used to determine the initial adversarial examples. In this embodiment, by combining the preprocessing function to determine the preprocessed perturbation region, and then combining the preprocessed perturbation region to determine the initial adversarial examples, the problem of low efficiency caused by size processing can be avoided, thereby improving the efficiency of generating adversarial examples.

[0076] S203: Perform parameter initialization processing on the preprocessed perturbation region according to the target model to obtain the perturbation region of the target.

[0077] For example, this step can be understood as: obtaining the target model for the original image application, where the target model can be a face recognition model as described in the above embodiment. When the original image is used as a sample image (i.e., input data) for the target model, its size, such as the dimensions of the original image, may differ from the required input size of the target model. Therefore, parameter initialization processing is required on the original image to obtain initialization parameters suitable for the target model, i.e., initialization parameters that meet the required input size of the target model. Correspondingly, parameter initialization processing can also be performed on the preprocessed perturbation region based on the required input size of the target model to obtain initialization parameters that satisfy the required input size of the target model for the preprocessed perturbation region, thereby completing the subsequent replacement processing and obtaining the initial adversarial example.

[0078] In other words, different application scenarios use different network models, and different network models may have different requirements for parameters such as image size. Therefore, the target model can obtain the perturbation region of the target (hyperparameters with size information and hyperparameters with position information) based on its own parameter initialization implementation method.

[0079] The perturbation region of the target is used to determine the initial adversarial sample.

[0080] It is worth noting that in this embodiment, the initial adversarial examples are obtained by combining the target model, thereby introducing the drawbacks of additional learning, in order to accelerate the convergence speed of the target model and improve the efficiency of the generated final adversarial examples.

[0081] S204: Replace the initial perturbation region in the original image with the perturbation region of the target to obtain the initial adversarial sample.

[0082] S205: Input the original image into the object detection model to obtain the ground truth of the target object in the original image.

[0083] S206: Input the initial adversarial sample into the target detection model to obtain the detection information of the target object.

[0084] The detection information includes the initial adversarial sample's bounding boxes and the confidence level of each bounding box in each category.

[0085] As can be seen from the above embodiments, the target object has a true category, and correspondingly, non-true categories can be referred to as other categories. That is to say, the detection information can include the confidence level of the target object in the true category and the confidence level of the target object in other categories.

[0086] In this embodiment, the detection information includes two dimensions (i.e., the confidence of the target object in the true category and the confidence of the target object in other categories). Therefore, when the detection information with two dimensions is combined to construct the loss function of the target object, the constructed loss function can have high reliability and resistance to attacks, thereby making the generated final adversarial sample highly reliable.

[0087] S207: Determine the difference information between the original image and the initial adversarial sample.

[0088] The difference information is used to construct the loss function for the target object.

[0089] In some embodiments, the difference information Diff(x′) can be determined based on Equation 1, Equation 1:

[0090] Diff(x′)=λ1(x′-x) 2

[0091] Where λ1 is a preset coefficient that can be set based on requirements, historical records, and experiments, x′ is the initial adversarial sample, and x is the original image.

[0092] In this embodiment, a loss function for the target object is constructed by combining difference information to fully consider the differences between the original graph and the initial adversarial sample, thereby constructing a loss function with relatively strong resistance to attack on the target object.

[0093] S208: Determine the smoothing information of the initial adversarial sample.

[0094] The smoothing information represents the difference in confidence scores of the initial adversarial samples at the same pixel location but different classes, as well as the difference in confidence scores of the initial adversarial samples at the same class but different pixel locations. The smoothing information is used to construct the loss function for the target object.

[0095] In some embodiments, the difference information TV(x′) can be determined based on Equation 2, Equation 2:

[0096] TV(x′)=λ2∑ i，j ((x i，j ′-x i，j+1 ′) 2 +(x i，j ′-x i+1，j ′) 2 ) 1 / 2

[0097] Where x′ is the initial adversarial sample, λ2 is the preset coefficient, which can also be set based on requirements, historical records, and experiments, i is the category, and j is the pixel position.

[0098] In this embodiment, by combining smoothing information to construct the loss function of the target object, the content of the generated final adversarial sample can be avoided to be abrupt, thereby making the final adversarial sample more realistic.

[0099] S209: Construct an inter-class differential loss function based on the confidence level of the target object in other categories.

[0100] The inter-class variance loss function is the sum of the confidence scores of the target object in all other classes. It is used to construct the loss function for the target object.

[0101] In this embodiment, the loss function of the target object is constructed by combining the inter-class difference loss function, so that the constructed loss function is highly correlated with the confidence of the target object in other categories. That is, the constructed loss function has the ability to distinguish between the real category and other categories, thereby improving the reliability of the final adversarial example.

[0102] In some embodiments, S209 may include the following steps:

[0103] First step: Obtain the N highest confidence scores from the confidence scores of the target object in other categories.

[0104] Where N is a positive integer greater than 1.

[0105] The second step is to construct an inter-class difference loss function based on the N largest confidence scores obtained.

[0106] For example, if N equals 3, then the three largest confidence scores of the target object in other categories are selected, and the inter-class difference loss function is constructed based on these three largest confidence scores.

[0107] In this embodiment, by constructing an inter-class difference loss function based on N maximum confidence scores, tedious calculations can be avoided, and the efficiency of generating the final adversarial examples can be improved.

[0108] In some embodiments, the inter-class difference loss function L2(x′) can be constructed based on Equation 3, Equation 3:

[0109]

[0110] Where x′ is the initial adversarial example, t is the true class, i is the class, j is the pixel position, and ∑ i≠t cmax i This is the sum of the top N confidence scores of the target object across all other categories, sorted from highest to lowest. It is the sum of the first N confidence scores of category i at different pixel positions, arranged from largest to smallest. Category i can also be determined based on demand, historical records, and experiments.

[0111] S210: Construct the loss function for the target object based on the difference information, the confidence level of the target object in the true category, the inter-class difference loss function, and the smoothing information.

[0112] In some embodiments, the loss function L(x′) of the target object can be constructed based on Equation 4, Equation 4:

[0113] L(x′)=L2(x′)-L1(x′)+Diff(x′)+TV(x′)

[0114] Where x′ is the initial adversarial example, x is the original image, L2(x′) is the inter-class differential loss function, L1(x′) is the confidence of the target object in the true class, Diff(x′) is the differential information, and TV(x′) is the smoothing information.

[0115] S211: Minimize the loss function of the target object to obtain the final adversarial example.

[0116] For example, the initial adversarial sample is adjusted, specifically by adjusting the size and location information of the perturbation region of the initial adversarial sample, so that when the adjusted initial adversarial sample satisfies the minimization of the loss function of the target object, the initial adversarial sample is determined as the final adversarial sample.

[0117] In this embodiment, by combining the loss function that minimizes the target object to obtain the final adversarial sample, the final adversarial sample is not easy to be identified, thereby improving the reliability of the final adversarial sample. Furthermore, when the network model is trained with the final adversarial sample, the performance of the network model can be improved. If the network model is a face recognition model, the recognition performance of the face recognition model can be improved, that is, the accuracy and reliability of the recognition can be improved.

[0118] In some embodiments, the confidence level of the final adversarial sample in the real category can be determined (this can be achieved in the manner described above, and will not be repeated here). If the determined confidence level is less than a preset threshold (such as 0.5), it indicates that the target object attack was successful, or the target object message was misclassified as another category.

[0119] Figure 3 This is a schematic diagram based on the third embodiment of the present disclosure, as shown below. Figure 3 As shown, the method for generating adversarial examples according to embodiments of this disclosure includes:

[0120] S301: Obtain the original image and the initial adversarial examples generated from the original image.

[0121] Similarly, the technical features that are the same as those in the above embodiments will not be repeated in this embodiment.

[0122] For example, the implementation principle of S301 can be found in the description of S101, and the descriptions of S201-S204.

[0123] S302: Perform target detection on the target objects in the original image to obtain the true category of the target objects in the original image and the confidence level of each target object under each category.

[0124] Based on the above analysis, it can be seen that in the above embodiments, the true category of the target object is determined based on the original image, and the confidence level of the target object under each category is determined based on the initial adversarial sample. In this embodiment, the confidence level of the target object under each category can also be determined based on the original image, so as to improve the flexibility and diversity of determining the confidence level.

[0125] S303: Determine the confidence level of the target object in the true category based on the confidence level of the target object in each category.

[0126] Similarly, based on the above analysis, in the above embodiment, the confidence level of the target object under the real category is determined based on the initial adversarial examples, while in this embodiment, the confidence level of the target object under the real category is determined based on the original image, thereby improving the diversity and flexibility of determining the confidence level of the target object under the real category.

[0127] In some embodiments, S303 may include the following steps:

[0128] The first step is to determine the confidence level of the target object in the preset misjudgment category based on the confidence level of the target object in each category.

[0129] The misclassification category can be determined based on requirements, historical records, and experimentation. Based on the above analysis, the misclassification category can be understood as one of the other categories (i.e., non-true categories), and the misclassification category is the desired outcome where the true category of the target object is incorrectly identified as one of the other categories.

[0130] For example, if the target object is a traffic light, then the true category is traffic light, while the misclassified category could be vehicle, etc.

[0131] The second step is to obtain the target confidence score from the confidence scores of the target object in each category, where the target confidence score is greater than the confidence score of the misclassified category.

[0132] The third step: Based on the target confidence level, determine the confidence level of the target object in the true category.

[0133] For example, the target confidence scores can be weighted and summed to obtain the confidence score of the target object in the true category.

[0134] In this embodiment, the final adversarial sample can be generated according to the generation requirements, which can misclassify the target object into a specific category (i.e., misclassified category), thereby improving the diversity of the generated final adversarial sample and making the final adversarial sample more targeted.

[0135] In some embodiments, the confidence level L1(x′) of the target object under the true category can be determined based on Equation 5, Equation 5:

[0136] L1(x′)=∑ i ε i L(x′), where F(x′) i >F(x′) c

[0137] Where x′ is the initial adversarial example, i is the class, F(x′)i is the confidence score for class i, and F(x′)i is the confidence score for class i. c Let be the confidence level of category c, where category c is a misclassified category.

[0138] S304: Perform target detection on the initial adversarial sample to obtain the confidence level of the target object in categories other than the true category.

[0139] The detection information includes the confidence level of misjudged objects corresponding to the target object in a preset category, and the confidence level of the target object in other categories besides the true category.

[0140] S305: Determine the difference information between the original image and the initial adversarial sample.

[0141] S306: Determine the smoothing information of the initial adversarial sample.

[0142] Among them, smoothing information represents the difference in confidence of the initial adversarial sample at the same pixel position and different categories, as well as the difference in confidence of the initial adversarial sample at the same category and different pixel positions.

[0143] S307: Construct a loss function for the target object based on the difference information, the confidence level of the target object in the true category, the inter-class difference loss function, and the smoothing information.

[0144] S308: Adjust the initial adversarial sample based on the loss function of the target object to obtain the final adversarial sample.

[0145] Figure 4 This is a schematic diagram based on the fourth embodiment of the present disclosure, as shown below. Figure 4 As shown, the adversarial sample generation apparatus 400 of this disclosure embodiment includes:

[0146] The first acquisition unit 401 is used to acquire the original image and the initial adversarial sample generated based on the original image.

[0147] The detection unit 402 is used to perform target detection on the target objects in the original image and the initial adversarial sample to obtain detection information.

[0148] The construction unit 403 is used to construct the loss function of the target object based on the detection information, the original image, and the initial adversarial examples.

[0149] The adjustment unit 404 is used to adjust the initial adversarial sample based on the loss function of the target object to obtain the final adversarial sample.

[0150] Figure 5 This is a schematic diagram based on the fifth embodiment of the present disclosure, as shown below. Figure 5 As shown, the adversarial sample generation apparatus 500 of this disclosure embodiment includes:

[0151] The first acquisition unit 501 is used to acquire the original image and the initial adversarial sample generated based on the original image.

[0152] The detection unit 502 is used to perform target detection on the target objects in the original image and the initial adversarial sample to obtain detection information.

[0153] Combination Figure 5 It is understood that, in some embodiments, the detection unit 502 includes:

[0154] The first detection subunit 5021 is used to perform target detection on the target object in the original image and obtain the true category of the target object.

[0155] The second detection unit 5022 is used to perform target detection on the target object in the initial adversarial sample, and obtain the confidence of the target object in the real category and the confidence of the target object in other categories, wherein the other categories are categories other than the real category. The detection information includes the confidence of the target object in the real category and the confidence of the target object in other categories.

[0156] Combination Figure 5 It is understood that, in some embodiments, the detection unit 502 includes:

[0157] The third detection subunit 5023 is used to perform target detection on the target object in the original image, and obtain the true category of the target object and the confidence level of the target object in each category.

[0158] The second detection subunit 5024 is used to perform target detection on the target object in the initial adversarial sample and obtain the confidence level of the target object in other categories besides the true category.

[0159] The detection information includes the confidence level of misjudged objects corresponding to the target object in a preset category, and the confidence level of the target object in other categories besides the true category.

[0160] The determining unit 503 is used to determine the smoothing information of the initial adversarial sample, wherein the smoothing information characterizes the difference in confidence of the initial adversarial sample at the same pixel position and different categories, and the difference in confidence of the initial adversarial sample at the same category and different pixel positions.

[0161] Construction unit 504 is used to construct the loss function of the target object based on the detection information, the original image, and the initial adversarial examples.

[0162] In some embodiments, the construction unit 504 is used to construct a loss function for the target object based on the difference information, the confidence level of the target object in the true category, the inter-class difference loss function, and the smoothing information.

[0163] Combination Figure 5 It is understood that, in some embodiments, the construction unit 504 includes:

[0164] The first construction subunit 5041 is used to construct an inter-class difference loss function based on the confidence level of the target object in other categories, wherein the inter-class difference loss function is the sum of the confidence levels of the target object in other categories.

[0165] In some embodiments, the first construction subunit 5041 includes:

[0166] The first acquisition module is used to sequentially obtain the N largest confidence scores from the confidence scores of the target object in other categories, where N is a positive integer greater than 1.

[0167] The first building module is used to construct the inter-class difference loss function based on the N largest confidence scores obtained.

[0168] The second construction subunit 5042 is used to construct the loss function of the target object based on the confidence level of the real class, the inter-class difference loss function, the original image, and the initial adversarial examples.

[0169] In some embodiments, the second building subunit 5042 includes:

[0170] The first determining module is used to determine the difference information between the original image and the initial adversarial sample.

[0171] The second construction module is used to construct the loss function of the target object based on the difference information and detection information.

[0172] Combination Figure 5 It is understood that, in some embodiments, the construction unit 504 includes:

[0173] The first calculation subunit 5043 is used to calculate the difference between the inter-class difference loss function and the confidence level of the target object in the true class.

[0174] The second calculation subunit 5044 is used to calculate the sum between the difference information and the smoothing information.

[0175] The third construction subunit 5045 is used to construct the loss function of the target object based on the difference between the inter-class difference loss function and the confidence of the target object in the true class, as well as the sum of the difference information and the smoothing information.

[0176] Combination Figure 5 It is understood that, in some embodiments, the construction unit 504 includes:

[0177] The first determining subunit 5046 is used to determine the confidence level of the target object in the true category based on the confidence level of the target object in each category.

[0178] In some embodiments, the first determining subunit 5046 includes:

[0179] The second determination module is used to determine the confidence level of the target object in the preset misjudgment category of the target object based on the confidence level of the target object in each category.

[0180] The second acquisition module is used to obtain the target confidence score from the confidence scores of the target object in each category, wherein the target confidence score is greater than the confidence score of the misjudged category.

[0181] The third determination module is used to determine the confidence level of the target object under the true category based on the target confidence level.

[0182] The fourth construction subunit 5047 is used to construct an inter-class difference loss function based on the confidence of the target object in other categories besides the true category, wherein the inter-class difference loss function is the sum of the confidence of the target object in other categories.

[0183] The fifth construction subunit 5048 is used to construct the loss function of the target object based on the confidence level under the real category, the inter-class difference loss function, the original image, and the initial adversarial examples.

[0184] The adjustment unit 505 is used to adjust the initial adversarial sample based on the loss function of the target object to obtain the final adversarial sample.

[0185] Combination Figure 5 It is understood that, in some embodiments, the adjustment unit 505 includes:

[0186] Adjustment subunit 5051 is used to adjust the initial adversarial sample to ensure that the loss function of the target object is less than a preset loss threshold.

[0187] The second determining subunit 5052 is used to determine the adjusted initial adversarial sample when the loss function of the target object is less than the loss threshold as the final adversarial sample.

[0188] Figure 6 This is a schematic diagram based on the sixth embodiment of the present disclosure, as shown below. Figure 6 As shown, the adversarial sample generation apparatus 600 of this disclosure embodiment includes:

[0189] The second acquisition unit 601 is used to acquire the initial perturbation region of the original image.

[0190] The replacement unit 602 is used to replace the initial perturbation region in the original image according to the target model applied to the final adversarial example, so as to obtain the initial adversarial example.

[0191] Combination Figure 6 It is understood that, in some embodiments, the replacement unit 602 includes:

[0192] The processing subunit 6021 is used to perform parameter initialization processing on the initial disturbance region according to the target model to obtain the disturbance region of the target.

[0193] The replacement subunit 6022 is used to replace the initial perturbation region in the original image with the perturbation region of the target to obtain the initial adversarial sample.

[0194] The first acquisition unit 603 is used to acquire the original image and the initial adversarial sample generated based on the original image.

[0195] The detection unit 604 is used to perform target detection on the target objects in the original image and the initial adversarial sample to obtain detection information.

[0196] The construction unit 605 is used to construct the loss function of the target object based on the detection information, the original image, and the initial adversarial examples.

[0197] The adjustment unit 606 is used to adjust the initial adversarial sample based on the loss function of the target object to obtain the final adversarial sample.

[0198] Figure 7 This is a schematic diagram based on the seventh embodiment of the present disclosure, as shown below. Figure 7 As shown, the electronic device 700 in this disclosure may include a processor 701 and a memory 702.

[0199] Memory 702 is used to store programs. Memory 702 may include volatile memory, such as random-access memory (RAM), such as static random-access memory (SRAM), double data rate synchronous dynamic random-access memory (DDR SDRAM), etc.; memory may also include non-volatile memory, such as flash memory. Memory 702 is used to store computer programs (such as application programs, functional modules, etc. that implement the above methods), computer instructions, etc. The computer programs, computer instructions, etc., can be partitioned and stored in one or more memories 702. Furthermore, the computer programs, computer instructions, data, etc., can be accessed by processor 701.

[0200] The aforementioned computer programs and instructions can be stored in one or more partitions of memory 702. Furthermore, the aforementioned computer programs and instructions can be invoked by processor 701.

[0201] The processor 701 is configured to execute the computer program stored in the memory 702 to implement the various steps in the methods described in the above embodiments.

[0202] For details, please refer to the relevant descriptions in the preceding method embodiments.

[0203] The processor 701 and the memory 702 can be independent structures or integrated structures. When the processor 701 and the memory 702 are independent structures, the memory 702 and the processor 701 can be coupled together via bus 703.

[0204] The electronic device in this embodiment can execute the technical solution in the above method. Its specific implementation process and technical principle are the same, and will not be repeated here.

[0205] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information (such as facial features) in this technical solution comply with relevant laws and regulations and do not violate public order and good morals.

[0206] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0207] According to embodiments of this disclosure, this disclosure also provides a computer program product comprising: a computer program stored in a readable storage medium, at least one processor of an electronic device being able to read the computer program from the readable storage medium, and the at least one processor executing the computer program causing the electronic device to perform the scheme provided in any of the above embodiments.

[0208] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0209] like Figure 8 As shown, device 800 includes a computing unit 801, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 802 or a computer program loaded from storage unit 808 into random access memory (RAM) 803. RAM 803 may also store various programs and data required for the operation of device 800. The computing unit 801, ROM 802, and RAM 803 are interconnected via bus 804. Input / output (I / O) interface 805 is also connected to bus 804.

[0210] Multiple components in device 800 are connected to I / O interface 805, including: input unit 806, such as keyboard, mouse, etc.; output unit 807, such as various types of monitors, speakers, etc.; storage unit 808, such as disk, optical disk, etc.; and communication unit 809, such as network card, modem, wireless transceiver, etc. Communication unit 809 allows device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0211] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as adversarial example generation methods. For example, in some embodiments, the adversarial example generation method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the adversarial example generation method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform adversarial example generation methods by any other suitable means (e.g., by means of firmware).

[0212] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0213] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0214] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0215] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0216] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0217] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service system that addresses the management difficulties and weak business scalability inherent in traditional physical hosts and VPS (Virtual Private Server) services. Servers can also be servers for distributed systems or servers integrated with blockchain technology.

[0218] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0219] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for generating adversarial examples, comprising: Acquire the original image and the initial adversarial sample generated based on the original image; Target detection is performed on the target objects in the original image and the initial adversarial sample to obtain the confidence score of the target object in the true category and the confidence score of the target object in other categories, wherein the other categories are categories other than the true category; Based on the confidence scores of the target object in other categories, an inter-class difference loss function is constructed, wherein the inter-class difference loss function is the sum of the confidence scores of the target object in other categories; The loss function for the target object is constructed based on the confidence score of the target object in the true category, the inter-class differential loss function, the original image, and the initial adversarial examples. The initial adversarial samples are adjusted to ensure that the loss function of the target object is less than a preset loss threshold, and the adjusted initial adversarial samples that satisfy the condition that the loss function of the target object is less than the loss threshold are determined as the final adversarial samples; wherein, the final adversarial samples are used to train the network model; different network models have different target objects.

2. The method according to claim 1, wherein, Target detection is performed on the target objects in the original image and the initial adversarial examples to obtain the confidence scores of the target objects in the true categories and the confidence scores of the target objects in other categories, including: Target detection is performed on the target object in the original image to obtain the true category of the target object; Target detection is performed on the target object in the initial adversarial sample to obtain the confidence score of the target object in the true category and the confidence score of the target object in other categories.

3. The method according to claim 2, wherein, Based on the confidence scores of the target object in other categories, an inter-class differential loss function is constructed, including: From the confidence scores of the target object in other categories, obtain the N largest confidence scores in sequence, where N is a positive integer greater than 1; Based on the N largest confidence scores obtained, the inter-class difference loss function is constructed.

4. The method according to claim 2 or 3, wherein, Based on the confidence score of the target object in the true category, the inter-class dissimilarity loss function, the original image, and the initial adversarial examples, a loss function for the target object is constructed, including: Determine the difference information between the original image and the initial adversarial sample; Based on the difference information, the confidence level of the target object in the true category, and the inter-class difference loss function, a loss function for the target object is constructed.

5. The method according to claim 4, further comprising: Determine the smoothing information of the initial adversarial sample, wherein the smoothing information characterizes the difference in confidence of the initial adversarial sample at the same pixel position and different categories, and the difference in confidence of the initial adversarial sample at the same category and different pixel positions. Furthermore, based on the difference information, the confidence level of the target object in the true category, and the inter-class difference loss function, a loss function for the target object is constructed, including: Based on the difference information, the confidence level of the target object in the true category, the inter-class difference loss function, and the smoothing information, a loss function for the target object is constructed.

6. The method according to claim 5, wherein, Based on the difference information, the confidence score of the target object in the true category, the inter-class difference loss function, and the smoothing information, a loss function for the target object is constructed, including: Calculate the difference between the inter-class discrepancy loss function and the confidence score of the target object in the true category; Calculate the sum between the difference information and the smoothing information; The loss function for the target object is constructed based on the difference between the inter-class difference loss function and the confidence level of the target object in the true category, as well as the sum of the difference information and the smoothing information.

7. The method according to claim 1, wherein, Target detection is performed on the target objects in the original image and the initial adversarial examples to obtain the confidence scores of the target objects in the true categories and the confidence scores of the target objects in other categories, including: Target detection is performed on the target object in the original image to obtain the true category of the target object and the confidence score of the target object in each category; Target detection is performed on the target object in the initial adversarial sample to obtain the confidence score of the target object in other categories; The detection information obtained by performing target detection on the original image and the target object in the initial adversarial sample also includes the confidence level of the misjudged object corresponding to the target object under a preset category.

8. The method according to claim 7, further comprising: The confidence level of the target object in the true category is determined based on the confidence level of the target object in each category.

9. The method according to claim 8, wherein, Based on the confidence levels of the target object in each category, determine the confidence level of the target object in the true category, including: Based on the confidence level of the target object in each category, determine the confidence level of the target object in the preset misjudgment category of the target object; The target confidence score is obtained from the confidence scores of the target object in each category, wherein the target confidence score is greater than the confidence score of the misjudged category; Based on the target confidence level, determine the confidence level of the target object under the true category.

10. The method according to any one of claims 1-3 and 5-9, wherein before obtaining the initial adversarial example generated from the original image, the method further comprises: Obtain the initial perturbation region of the original image; Based on the target model applied to the final adversarial example, the initial perturbation region in the original image is replaced to obtain the initial adversarial example.

11. The method according to claim 10, wherein, Based on the target model applied to the final adversarial example, the initial perturbation region in the original image is replaced to obtain the initial adversarial example, including: The initial disturbance region is initialized with parameters based on the target model to obtain the target disturbance region; The perturbation region of the target is used to replace the initial perturbation region in the original image to obtain the initial adversarial sample.

12. An apparatus for generating adversarial examples, comprising: The first acquisition unit is used to acquire the original image and the initial adversarial sample generated based on the original image; The detection unit is used to perform target detection on the target object in the original image and the initial adversarial sample, and obtain the confidence score of the target object in the true category and the confidence score of the target object in other categories, wherein the other categories are categories other than the true category; Building blocks, including: The first construction subunit is used to construct an inter-class difference loss function based on the confidence scores of the target object in other categories, wherein the inter-class difference loss function is the sum of the confidence scores of the target object in other categories; The second construction subunit is used to construct the loss function of the target object based on the confidence of the target object in the real category, the inter-class difference loss function, the original image, and the initial adversarial sample; Adjustment unit, including: An adjustment subunit is used to adjust the initial adversarial sample to ensure that the loss function of the target object is less than a preset loss threshold. The second determining subunit is used to determine the adjusted initial adversarial sample as the final adversarial sample when the loss function of the target object is less than the loss threshold; wherein the final adversarial sample is used to train the network model; different network models have different target objects.

13. The apparatus according to claim 12, wherein, The detection unit includes: The first detection subunit is used to perform target detection on the target object in the original image and obtain the true category of the target object; The second detection unit is used to perform target detection on the target object in the initial adversarial sample, and obtain the confidence score of the target object in the real category and the confidence score of the target object in other categories, wherein the other categories are categories other than the real category.

14. The apparatus according to claim 13, wherein, The first building subunit includes: The first acquisition module is used to sequentially acquire N maximum confidence scores from the confidence scores of the target object under other categories, where N is a positive integer greater than 1; The first construction module is used to construct the inter-class difference loss function based on the N largest confidence scores obtained.

15. The apparatus according to claim 13 or 14, wherein, The second building subunit includes: The first determining module is used to determine the difference information between the original image and the initial adversarial sample; The second construction module is used to construct the loss function of the target object based on the difference information, the confidence level of the target object in the true category, and the inter-class difference loss function.

16. The apparatus of claim 15, further comprising: A determining unit is configured to determine the smoothing information of the initial adversarial sample, wherein the smoothing information characterizes the difference in confidence of the initial adversarial sample at the same pixel position and different categories, and the difference in confidence of the initial adversarial sample at the same category and different pixel positions. Furthermore, the construction unit is configured to construct a loss function for the target object based on the difference information, the confidence level of the target object in the true category, the inter-class difference loss function, and the smoothing information.

17. The apparatus according to claim 16, wherein, The building unit includes: The first calculation subunit is used to calculate the difference between the inter-class difference loss function and the confidence level of the target object under the true category; The second calculation subunit is used to calculate the sum between the difference information and the smoothing information; The third construction subunit is used to construct the loss function of the target object based on the difference between the inter-class difference loss function and the confidence of the target object under the true category, as well as the sum of the difference information and the smoothing information.

18. The apparatus according to claim 12, wherein, The detection unit includes: The third detection subunit is used to perform target detection on the target object in the original image, and obtain the true category of the target object and the confidence level of the target object in each category. The second detection subunit is used to perform target detection on the target object in the initial adversarial sample and obtain the confidence level of the target object in other categories; The detection information obtained by performing target detection on the original image and the target object in the initial adversarial sample also includes the confidence level of the misjudged object corresponding to the target object under a preset category.

19. The apparatus according to claim 18, wherein, The building unit further includes: The first determining subunit is used to determine the confidence level of the target object in the true category based on the confidence level of the target object in each category.

20. The apparatus according to claim 19, wherein, The first determining subunit includes: The second determining module is used to determine the confidence level of the target object in the preset misjudgment category of the target object based on the confidence level of the target object in each category; The second acquisition module is used to acquire the target confidence score from the confidence scores corresponding to each category of the target object, wherein the target confidence score is greater than the confidence score of the misjudged category; The third determining module is used to determine the confidence level of the target object under the true category based on the target confidence level.

21. The apparatus according to any one of claims 12-14, 16-20, further comprising: The second acquisition unit is used to acquire the initial perturbation region of the original image; The replacement unit is used to replace the initial perturbation region in the original image according to the target model applied to the final adversarial example, so as to obtain the initial adversarial example.

22. The apparatus according to claim 21, wherein, The replacement unit includes: The processing subunit is used to perform parameter initialization processing on the initial disturbance region according to the target model to obtain the disturbance region of the target. The replacement subunit is used to replace the initial perturbation region in the original image with the perturbation region of the target to obtain the initial adversarial sample.

23. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the method according to any one of claims 1-11.

24. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-11.

25. A computer program product comprising a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1-11.

Images