Adversarial sample image generation method and device, electronic device and storage medium

Abstract

The present disclosure relates to a method and device for generating adversarial sample images, an electronic device and a storage medium, the method comprising: training a teacher model through a training sample image set; augmenting the training sample image set according to the training sample images in the training sample image set to obtain an augmented training sample image set; training a proxy model according to the augmented training sample image set and the trained teacher model; obtaining adversarial sample images according to the trained proxy model and the test sample images in the test sample image set; obtaining an evaluation tool according to the adversarial sample images. According to the adversarial sample image generation method of an embodiment of the present disclosure, a teacher model can be trained, and the teacher model can be used to train the proxy model to obtain adversarial sample images, and the augmented training set can be used to increase the dark knowledge learned by the proxy model, improve the transferability of the adversarial sample images obtained based on the proxy model, and make the security evaluation more efficient.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method and device for generating adversarial sample images, an electronic device, and a storage medium. Background Art

[0002] Deep learning models are vulnerable to adversarial samples. Adversarial samples are data obtained by adding some perturbations that are difficult for humans to detect to normal sample data in a specific way. They can be used to deceive deep learning models and artificially manipulate the output results of deep learning models. When deploying deep learning models to real-world scenarios, it is usually necessary to evaluate the security of the model in advance to avoid malicious attacks by others using the above adversarial samples. In order to reliably evaluate the security of a model, research on adversarial sample attack technology is very necessary.

[0003] The generation of adversarial samples is also known as adversarial attack technology, which can be roughly divided into three categories: white-box attack, query-based attack, and transfer-based attack. White-box attack requires all the details of the model to be attacked, while query-based attack does not need to explicitly obtain all the details of the model to be attacked, but often requires inputting a large amount of data into the model to be attacked and obtaining its output. Transfer-based attack is suitable for situations where the information of the attack model is completely unknown, that is, it is suitable for black-box attack. When using transfer-based attack technology, the attacker can first train a deep learning model, that is, a proxy model, and then the attacker generates adversarial samples by attacking the proxy model trained by himself, and uses the obtained adversarial samples to attack the unknown model to be attacked. Existing research shows that adversarial samples generated by proxy models have a certain attack success rate when attacking unknown models, but how to improve the attack success rate to a more practical level and make the assessment of model security more accurate is still an unresolved problem. Summary of the invention

[0004] The present disclosure proposes a method and device for generating adversarial sample images, an electronic device, and a storage medium.

[0005] According to one aspect of the present disclosure, a method for generating adversarial sample images is provided, comprising: training a teacher model through a training sample image set to obtain a trained teacher model, wherein the training sample image set includes multiple training sample images, and the training sample images have annotation information; augmenting the training sample image set according to the training sample images in the training sample image set to obtain an augmented training sample image set, wherein the augmented training sample image set includes the training sample images in the training sample image set and augmented training sample images obtained by augmenting the training sample images; training a proxy model according to the augmented training sample image set and the trained teacher model to obtain a trained proxy model; obtaining adversarial sample images according to the trained proxy model and test sample images in the test sample image set; and obtaining an evaluation tool for evaluating network security according to multiple adversarial sample images.

[0006] In a possible implementation, based on the training sample images in the training sample image set, the training sample image set is augmented to obtain an augmented training sample image set, including: fusing any two or more training sample images in the training sample image set to obtain augmented training sample images; and obtaining the augmented training sample image set based on the training sample images and the augmented training sample images.

[0007] In a possible implementation, performing fusion processing on any two or more training sample images in the training sample image set to obtain an augmented training sample image includes: performing weighted sum processing on the any two or more training sample images to obtain the augmented training sample image.

[0008] In a possible implementation, any two or more training sample images in the training sample image set are fused to obtain an augmented training sample image, including: deleting a first image area at a first position in a first training sample image to obtain an image to be added in which the first position is blank; obtaining a second image area at a corresponding position in a second training sample image; and adding the second image area to the first position in the image to be added to obtain the augmented training sample image.

[0009] In a possible implementation, a proxy model is trained according to the augmented training sample image set and the trained teacher model to obtain the trained proxy model, including: determining a reference result of the training sample image according to the teacher model and the type of training sample image used to train the proxy model; processing the training sample image through the proxy model to obtain a first processing result; obtaining a model loss of the proxy model according to the first processing result and the reference result; and training the proxy model according to the model loss.

[0010] In one possible implementation, a reference result of the training sample image is determined based on the teacher model and the type of the training sample image used to train the proxy model, including: when the type of the training sample image is an augmented training sample image, the augmented training sample image is processed by the teacher model to obtain the reference result.

[0011] In one possible implementation, a reference result of the training sample image is determined based on the teacher model and the type of the training sample image used to train the proxy model, including: when the type of the training sample image used to train the proxy model is a training sample image in the training sample image set, determining the annotation information of the training sample image as the reference result.

[0012] In a possible implementation, an adversarial sample image is obtained based on a trained proxy model and a test sample image in a test sample image set, including: adding perturbation information to any test sample image in the test sample image set to obtain a sample image to be tested; inputting the sample image to be tested into the trained proxy model to obtain a second processing result; and adjusting the sample image to be tested based on a first error between the sample image to be tested and the test sample image, and a second error between the second processing result and the annotation information of the test sample image, to obtain the adversarial sample image.

[0013] According to one aspect of the present disclosure, an adversarial sample image generation device is provided, including: a teacher model training module, used to train a teacher model through a training sample image set to obtain a trained teacher model, wherein the training sample image set includes multiple training sample images, and the training sample images have annotation information; an augmentation module, used to perform augmentation processing on the training sample image set according to the training sample images in the training sample image set to obtain an augmented training sample image set, wherein the augmented training sample image set includes the training sample images in the training sample image set and augmented training sample images obtained by performing augmentation processing on the training sample images; a proxy model training module, used to train a proxy model according to the augmented training sample image set and the trained teacher model to obtain a trained proxy model; an adversarial sample image generation module, used to obtain an adversarial sample image according to the trained proxy model and a test sample image in a test sample image set; and an evaluation tool generation module, used to obtain an evaluation tool for evaluating network security according to multiple adversarial sample images.

[0014] In a possible implementation, the augmentation module is further used to: perform fusion processing on any two or more training sample images in the training sample image set to obtain augmented training sample images; and obtain the augmented training sample image set based on the training sample images and the augmented training sample images.

[0015] In a possible implementation manner, the augmentation module is further used to: perform weighted sum processing on any two or more training sample images to obtain the augmented training sample image.

[0016] In a possible implementation, the augmentation module is further used to: delete a first image area at a first position in a first training sample image to obtain an image to be added in which the first position is blank; obtain a second image area at a corresponding position in a second training sample image; and add the second image area to the first position in the image to be added to obtain the augmented training sample image.

[0017] In one possible implementation, the proxy model training module is further used to: determine a reference result of the training sample image based on the teacher model and the type of training sample image used to train the proxy model; process the training sample image through the proxy model to obtain a first processing result; obtain a model loss of the proxy model based on the first processing result and the reference result; and train the proxy model based on the model loss.

[0018] In a possible implementation, the proxy model training module is further used to: when the type of the training sample image is an augmented training sample image, process the augmented training sample image through the teacher model to obtain the reference result.

[0019] In a possible implementation, the proxy model training module is further used to: when the type of the training sample image used to train the proxy model is a training sample image in the training sample image set, determine the annotation information of the training sample image as the reference result.

[0020] In a possible implementation, the adversarial sample image generation module is further used to: add perturbation information to any test sample image in the test sample image set to obtain a sample image to be tested; input the sample image to be tested into the trained proxy model to obtain a second processing result; and adjust the sample image to be tested according to a first error between the sample image to be tested and the test sample image, and a second error between the second processing result and the annotation information of the test sample image, to obtain the adversarial sample image.

[0021] According to one aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to call the instructions stored in the memory to execute the above method.

[0022] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0023] According to the adversarial sample image generation method of the embodiment of the present disclosure, a teacher model can be trained, so that the teacher model can be used to train the proxy model to obtain adversarial sample images, so that the adversarial sample images have better transferability, that is, they can adapt to more neural network models, and an augmented training set can be used to increase the dark knowledge learned by the proxy model, further improving the transferability of the adversarial sample images obtained based on the proxy model, making the adversarial sample images suitable for more models, improving the attack success rate of adversarial sample images attacking other models, obtaining a more efficient security assessment tool, and making the adversarial sample images more valuable for security research.

[0024] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and do not limit the present disclosure. Other features and aspects of the present disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used to illustrate the technical solutions of the present disclosure together with the specification.

[0026] Figure 1 A flowchart showing a method for generating an adversarial sample image according to an embodiment of the present disclosure is shown;

[0027] Figure 2A and Figure 2B A schematic diagram showing an application of the adversarial sample image generation method according to an embodiment of the present disclosure;

[0028] Figure 3 A block diagram showing an adversarial sample image generating device according to an embodiment of the present disclosure is shown;

[0029] Figure 4 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0030] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0031] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0032] The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can represent including any one or more elements selected from the set consisting of A, B, and C.

[0033] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0034] Figure 1 A flowchart of a method for generating an adversarial sample image according to an embodiment of the present disclosure is shown. Figure 1 As shown, the method includes:

[0035] In step S11, the teacher model is trained by a training sample image set to obtain a trained teacher model, wherein the training sample image set includes a plurality of training sample images, and the training sample images have annotation information;

[0036] In step S12, according to the training sample images in the training sample image set, the training sample image set is augmented to obtain an augmented training sample image set, wherein the augmented training sample image set includes the training sample images in the training sample image set and the augmented training sample images obtained by augmenting the training sample images;

[0037] In step S13, the proxy model is trained according to the augmented training sample image set and the trained teacher model to obtain the trained proxy model;

[0038] In step S14, an adversarial sample image is obtained according to the trained proxy model and the test sample image in the test sample image set;

[0039] In step S15, an evaluation tool for evaluating network security is obtained based on the multiple adversarial sample images.

[0040] According to the adversarial sample image generation method of the embodiment of the present disclosure, a teacher model can be trained, so that the teacher model can be used to train the proxy model to obtain adversarial sample images, so that the adversarial sample images have better transferability, that is, they can adapt to more neural network models, and an augmented training set can be used to increase the dark knowledge learned by the proxy model, further improving the transferability of the adversarial sample images obtained based on the proxy model, making the adversarial sample images suitable for more models, improving the attack success rate of adversarial sample images attacking other models, obtaining a more efficient security assessment tool, and making the adversarial sample images more valuable for security research.

[0041] In a possible implementation, the adversarial sample image generation method can be executed by an electronic device such as a terminal device or a server, and the terminal device can be a user equipment (UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. The method can be implemented by a processor calling a computer-readable instruction stored in a memory. Alternatively, the method can be executed by a server.

[0042] In a possible implementation, the training sample image set may include multiple training sample images. Accordingly, the neural network model trained using the training sample set may be used to perform image processing tasks such as image classification, recognition, detection, and segmentation. In the example, the training sample image set may be represented as D T ={(x1,y1),(x2,y2)…(x n ,y n )}, where n represents the number of training sample images in the training sample image set, x i represents the i-th (i is a positive integer, 1≤i≤n) training sample image, y i Represents the annotation information of the i-th training sample image.

[0043] In one possible implementation, when training the proxy model, the training sample image set can be used directly for training, or the training can be performed through a teacher model in the manner of steps S11-S13, thereby improving the transferability of adversarial sample images obtained based on the proxy model.

[0044] In a possible implementation, in step S11, the teacher model can be trained by training the sample image set. The teacher model can be a neural network model of the same category as the proxy model. For example, if the proxy model is a neural network model for image processing tasks, then the teacher model is also a neural network model for image processing tasks. If the proxy model is a neural network model for text processing tasks, then the teacher model is also a neural network model for text processing tasks. The present disclosure does not limit the types of the proxy model and the teacher model.

[0045] In one possible implementation, the training of the teacher model can be described based on the following formula (1):

[0046]

[0047] Where f(x; θ) is the output obtained by the teacher model with model parameter θ when inputting the training sample image x, that is, the prediction result of the teacher model for the training sample image x. y is the annotation information of the training sample image x, It can represent the expected value of the loss function determined based on the annotation information of the training sample image x and the prediction result f(x; θ) of the teacher model for the training sample image x. Argmin is the index function, that is, it is used to determine the parameters of the teacher model that minimize the expected value of the loss function. After the training is completed, the parameters of the teacher model are the solution results of the index function, that is, the parameters of the teacher model are θ t .

[0048] In a possible implementation, based on the above formula (1), it can be known that the teacher model can be trained by multiple training sample images with labeled information. When a training sample image is input to the teacher model, the output information of the teacher model is the prediction result of the teacher model for the training sample image. The prediction result may contain errors, that is, there is a certain gap between the annotation information of the training sample image and the training sample image. The loss function of the teacher model can be determined based on the gap. For example, in the image classification task, the loss function can be a cross entropy loss function, which can be determined based on the following formula (2):

[0049] CE(p,q)=-∑ i p i logq i (2)

[0050] Among them, CE(p,q) is the cross entropy loss function, p i is the classification of the i-th category output by the teacher model, q i is the classification of the i-th category in the annotation information.

[0051] In one possible implementation, the loss function such as the cross entropy loss function can be back-propagated, and the parameters of the teacher model can be adjusted using the gradient descent method to reduce the loss function. After multiple trainings, the teacher model can be tested in the test set. For example, the teacher model is used to process the test sample images in the test set, and the accuracy of the processing is determined. If the accuracy meets the requirements, the training is completed and the trained teacher model is obtained. At this time, the parameters of the teacher model minimize the error between the prediction results of the teacher model for the training sample images and the annotation information of the training sample images. Therefore, the parameters of the teacher model in this state are the above θ t . If the processing accuracy does not meet the requirements when testing in the test set, the teacher model can continue to be trained until the accuracy of the test in the test set meets the requirements, and the trained teacher model can be obtained. Alternatively, other training conditions can be set, for example, when the number of training times reaches a preset number, the training is completed and the trained teacher model is obtained, or, when the model loss is less than or equal to a preset threshold, or converges to a preset interval, the training is completed and the trained teacher model is obtained. The present disclosure does not limit the training conditions.

[0052] In a possible implementation, after obtaining the trained teacher model, the teacher model can be used to train the proxy model. When training the proxy model, the above training sample image set D can also be used. T Alternatively, we can also use the training sample image set D TAugmentation processing is performed to obtain an augmented training sample image set, so that in the augmentation processing process, the obtained augmented training sample images have more dark knowledge, that is, knowledge that can be used by the neural network model for processing but is difficult to describe in words or cannot be understood or used by humans. For example, when using augmented training sample images for training, the augmented training sample images can have the features of multiple training sample images after fusion, and after feature extraction processing of the neural network model, more feature information that can be used for neural network processing but is difficult to describe in words (for example, dark knowledge) can be obtained. When using augmented training sample images to train a proxy model, the proxy model can learn more dark knowledge, making the proxy model more adversarial and transferable. The adversarial sample images obtained based on the proxy model are more difficult to be correctly identified by other neural network models, making the adversarial sample images more aggressive, and thus a more efficient security assessment tool can be obtained based on the adversarial sample images.

[0053] In a possible implementation, in step S12, the training sample image set can be augmented based on the training sample images in the training sample image set to obtain an augmented training sample image set. This step may include: fusing any two or more training sample images in the training sample image set to obtain augmented training sample images; and obtaining the augmented training sample image set based on the training sample images and the augmented training sample images.

[0054] In a possible implementation, in the process of augmenting the training sample image set, multiple augmenting functions can be used to perform fusion processing on two or more training sample images to obtain augmented training sample images, and the augmenting functions correspond to the fusion methods in the fusion processing process, that is, different augmenting functions can be selected to perform fusion processing on two or more training sample images using different fusion methods. In the example, the augmenting functions may include Mixup function and CutMix function, etc.

[0055] In a possible implementation, taking the Mixup augmentation function as an example, any two or more training sample images in the training sample image set are fused to obtain an augmented training sample image, including: performing weighted summation processing on any two or more training sample images to obtain the augmented training sample image.

[0056] In this example, a Mixup augmentation function with certain parameters can be selected to perform weighted summation on two training sample images. The augmentation process can be expressed by the following formula (3):

[0057] τ(x)=λx+(1-λ)x r (3)

[0058] Among them, x and x r are any two training sample images, λ is a value that obeys the Beta(α,α) distribution, and α is an arbitrary hyperparameter. Among them, α and λ can both affect the obtained augmented training sample image τ(x), that is, the augmented training sample image τ(x) can be obtained by the two training sample images x and x r , and the parameter λ and hyperparameter α in the Mixup augmentation function. Different augmented training sample images τ(x) can be obtained by selecting different training sample images, or by selecting different parameters λ and / or hyperparameter α, so that the augmented training sample images τ(x) have different dark knowledge.

[0059] In the example, more training sample images may be weighted summed to obtain augmented training sample images. The present disclosure does not limit the number of fused training sample images.

[0060] In this way, augmented training sample images can be obtained based on two or more training sample images by weighted summation, so that the augmented training sample images have more dark knowledge, and are conducive to the proxy model to learn more dark knowledge, improve the transferability of the proxy model, and help improve the transferability of adversarial sample images generated based on the proxy model, improve the success rate of attacking other models, and improve the efficiency of security assessment.

[0061] In a possible implementation, the CutMix augmentation function can also be used to fuse any two or more training sample images in the training sample image set to obtain an augmented training sample image, including: deleting a first image area at a first position in a first training sample image to obtain an image to be added with the first position being blank; obtaining a second image area at a corresponding position in a second training image; and adding the second image area to the first position in the image to be added to obtain the augmented training sample image.

[0062] In a possible implementation, the first training sample image and the second training sample image are both image sample images, and the first image area at the first position in the first training sample image can be deleted to obtain the image to be added. The first image area can be any area or an area where a target object is located in the first training sample image. The present disclosure does not limit the selection of the first image area.

[0063] In a possible implementation, a second image region at a corresponding position in the second training sample image may be obtained, and the second image region may be a region at the same position as the first image region, for example, the second image region is at the first position in the second training sample image. Alternatively, the second image region may be a region where a target object is located in the second training sample image. The size of the second image region may be consistent with the size of the first image region. If the second image region is a region where a target object is located in the second training sample image, and the size of the region is inconsistent with the first image region, the second image region may be scaled so that the size of the scaled second image region is consistent with the size of the first image region.

[0064] In a possible implementation, after obtaining the image to be added and the second image region, the second image region can be added to the first position in the image to be added (before adding, the first position in the image to be added is blank), and an augmented training sample image can be obtained. In this process, the contents of two different training sample images can be fused, for example, the target object in the second training sample image is fused with the background in the first training sample image, so that the augmented training sample image obtained after fusion has more dark knowledge.

[0065] In the example, more training sample images can also be fused using the CutMix augmentation function. For example, the first training sample image may include multiple target objects, and the image regions where the multiple target objects are located can be deleted to obtain the image to be added, and image regions with target objects can be obtained from multiple other training sample images, and these image regions can be added to the image to be added to obtain the augmented training sample image. Moreover, by selecting different target objects in different other training sample images and adding different target objects to different blank regions in the image to be added, different augmented training sample images can be obtained, and the augmented training sample images can have more dark knowledge.

[0066] In this way, an augmented training sample image can be obtained based on two or more training sample images by adding image areas in other training sample images, so that the augmented training sample image has more dark knowledge, and is conducive to the proxy model to learn more dark knowledge, improve the transferability of the proxy model, and is conducive to improving the transferability of adversarial sample images generated based on the proxy model, so that the adversarial sample image is suitable for more models, improves the attack success rate of adversarial sample images attacking other models, and improves the efficiency of security assessment.

[0067] In a possible implementation, a cutout augmentation function, a mosaic augmentation function, or the like may be selected to fuse two or more training sample images to obtain an augmented training sample image with richer dark knowledge. The present disclosure does not limit the augmentation function used and the number of training sample images to be fused.

[0068] In a possible implementation, a sample image set consisting of the training sample images in the sample image training set and the augmented training sample images obtained through the above fusion process is the augmented training sample image set.

[0069] In a possible implementation, in step S13, after obtaining the augmented sample image set, the proxy model may be trained by using the augmented sample image set and the trained teacher model, so that the proxy model has stronger transferability.

[0070] In a possible implementation, the training process of the proxy model can be described based on the following formula (4):

[0071]

[0072] Where T is a set of augmenting functions, τ is any augmenting function in the set of augmenting functions, and τ(x) is an augmented training sample image obtained by augmenting any two or more training sample images based on the augmenting function τ. f(τ(x);θ t ) is the output result obtained by the trained teacher model on the augmented training sample image τ(x), f(τ(x); θ) is the output result obtained by the proxy model on the augmented training sample image τ(x), L(f(τ(x); θ t ),f(τ(x);θ)) is the loss function determined based on the error between the output results of the two models, The expected value of the loss function between the output results of the augmented training sample image obtained by augmenting any training sample image x in the training sample image set after being processed by the two models. θ m is the parameter of the proxy model that minimizes the expected value of the above loss function. In other words, the output result of the teacher model can be used as a reference result to train the proxy model so that the output result of the proxy model is close to the reference result.

[0073] In one possible implementation, as described above, step S13 may include: determining a reference result of the training sample image based on the teacher model and the type of training sample image used to train the proxy model; processing the training sample image through the proxy model to obtain a first processing result; obtaining a model loss of the proxy model based on the first processing result and the reference result; and training the proxy model based on the model loss.

[0074] In a possible implementation, a reference result of a training sample image may be determined according to a teacher model and the type of training sample images used to train a proxy model. The training sample image comes from an augmented training sample image set, that is, the type of the training sample image may be a training sample image in the original training sample image set, or may be an augmented training sample image obtained by augmenting the training sample images in the original training sample image set.

[0075] In a possible implementation, determining the reference result of the training sample image according to the teacher model and the type of the training sample image used to train the proxy model includes: when the type of the training sample image is an augmented training sample image, processing the augmented training sample image by the teacher model to obtain the reference result. That is, if the type of the training sample image is an augmented training sample image, the result of processing the augmented training model by the teacher model can be used as a reference result to supervise the training of the proxy model.

[0076] In this way, the processing results of the teacher model on the augmented training sample images can be used as reference results to supervise the training of the proxy model, so that the proxy model can learn more dark knowledge in the augmented training sample images, which is beneficial to improving the transferability of the proxy model, and is beneficial to improving the transferability of the adversarial sample images obtained based on the proxy model, making the adversarial sample images suitable for more models, improving the attack success rate of adversarial sample images attacking other models, and improving the efficiency of security assessment.

[0077] In a possible implementation, determining the reference result of the training sample image according to the teacher model and the type of the training sample image used to train the proxy model includes: when the type of the training sample image used to train the proxy model is a training sample image in the training sample image set, determining the annotation information of the training sample image as the reference result. That is, if the type of the training sample image is a training sample image in the original training sample image set, the annotation information of the training sample image can be used as the reference result to supervise the training of the proxy model.

[0078] In this way, the annotation information of the training model can be used as a reference result to supervise the training of the proxy model, which is conducive to improving the training efficiency.

[0079] In one possible implementation, of course, when the type of training sample images used to train the proxy model is a training sample image in a training sample image set, the training sample images can also be output to the teacher model, and the output results can be used as reference results to supervise the training of the proxy model.

[0080] In a possible implementation, after obtaining a reference result for supervised training, the training sample image can be input into the proxy model to obtain a first processing result, which may have an error, that is, may be different from the reference result. Therefore, the model loss of the proxy model can be obtained based on the reference result and the first processing result. For example, the cross entropy loss function can also be calculated according to formula (2) as the model loss of the proxy model. The present disclosure does not limit the type of loss function.

[0081] In one possible implementation, after determining the model loss, the model loss such as the cross entropy loss function can be back-propagated, and the parameters of the proxy model can be adjusted using the gradient descent method to reduce the model loss. After multiple trainings, the proxy model can be tested in the test set. For example, the proxy model is used to process the test sample images in the test set, and the accuracy of the processing is determined. If the accuracy meets the requirements, the training is completed and the trained proxy model is obtained. At this time, the parameters of the proxy model minimize the model loss between the reference result and the first processing result. Therefore, the parameters of the proxy model in this state are the above θ m . If the processing accuracy does not meet the requirements when testing in the test set, the proxy model can continue to be trained until the accuracy of the test in the test set meets the requirements, and the trained proxy model can be obtained. Alternatively, other training conditions can be set, for example, when the number of training times reaches a preset number, the training is completed and the trained proxy model is obtained, or when the model loss is less than or equal to a preset threshold, or converges to a preset interval, the training is completed and the trained proxy model is obtained. The present disclosure does not limit the training conditions.

[0082] In a possible implementation, after obtaining the trained proxy model, in step S14, an adversarial sample image can be obtained based on the proxy model and the test sample image in the test sample image set. The test sample image set can be an image set that is the same as the training sample image set (i.e., the test sample image set is the training sample image set), or an image set that is different from the training sample image set. In other words, the test sample image in the test sample image set can be a sample image that is the same as the training sample image in the training sample image set (i.e., the test sample image is the training sample image), or a sample image that is different from the training sample image. The present disclosure does not limit this. The process of obtaining the adversarial sample image can be expressed by the following formula (5):

[0083]

[0084] Among them, x * is the sample image to be tested obtained by adding disturbance information ∈ based on the test sample image x. The sample image may be different from any sample image in the test sample image set. * θ m ) is to convert x * The output result obtained after inputting the trained proxy model, y is the annotation information of the test sample image x, argmax is the index function, that is, in the sample image x to be tested * When the difference between the test sample image x and the perturbation information ∈ is less than or equal to the perturbation information ∈, the annotation information y of the test sample image x is consistent with the proxy model of the test sample image x. * The processing result f(x * θ m ) when the loss function is the largest * , in this case x * That is the adversarial sample image x adv In other words, obtain a sample image x to be tested * , the sample image x to be tested * The error between the sample image x and the test image x is very small and difficult for humans to detect, but the proxy model is * The processing result f(x * θ m ) and the annotation information y of the test sample image x have a large error. If the annotation information y of the test sample image x is used as the standard, then the proxy model is * The sample image x to be tested is misidentified. * The output result of the proxy model is wrong. In this case, the sample image x * Can be determined as an adversarial sample image x adv .

[0085] In a possible implementation, based on the above formula (5), step S14 may include: adding disturbance information to any test sample image in the test sample image set to obtain a sample image to be tested; inputting the sample image to be tested into the trained proxy model to obtain a second processing result; and adjusting the sample image to be tested according to a first error between the sample image to be tested and the test sample image, and a second error between the second processing result and the annotation information of the test sample image, to obtain the adversarial sample image.

[0086] In a possible implementation, perturbation information is added to any test sample image in the test sample image set to obtain a sample image to be tested (the method of adding perturbation information can be implemented by related technologies), and the sample image to be tested is input into the trained proxy model for processing to obtain a second processing result (for example, f(x) in formula (5) * θ m )), and then determine the second error between the second processing result and the annotation information of the test sample image (for example, L(y,f(x) in formula (5) * θ m ))). Further, based on the first error between the sample image to be tested and the test sample image (for example, ||x in formula (5) * -x||), and the second error between the second processing result and the annotation information of the test sample image (for example, a loss function determined according to the second error) is used to adjust the sample image to be tested. For example, the first error is made less than or equal to the disturbance information shown, so that it is difficult for humans to perceive the difference between the test sample image and the sample image to be tested, and the second error or the loss function determined based on the second error is maximized. After multiple adjustments, if the second error or the loss function determined based on the second error is difficult to continue to increase, or converges to a preset interval, the sample image to be tested in this state can be determined as an adversarial sample image. The error between the adversarial sample image and the original test sample image is very small, but the error between the processing result of the proxy model for the adversarial sample image and the processing result or annotation information of the original test sample image is very large, that is, the adversarial sample image can cause misrecognition of the proxy model.

[0087] In one possible implementation, based on the above method, adversarial sample images corresponding to multiple test sample images can be obtained, which can form an adversarial sample image set to be used to evaluate the security of other neural network models, which can help find security vulnerabilities and obtain a more secure network environment.

[0088] In a possible implementation, in step S15, an evaluation tool for evaluating network security can be obtained based on the above-mentioned multiple adversarial sample images or adversarial sample image sets. For example, the adversarial sample image set can be used as the above-mentioned evaluation tool to make any neural network model process the adversarial sample images in the adversarial sample image set, so as to determine the processing accuracy of the neural network. If the neural network model can still maintain a high accuracy when processing the adversarial sample images, the security of the neural network model is relatively high. On the contrary, if the neural network model has a low accuracy when processing the adversarial sample images, the neural network model may have security vulnerabilities, and it needs to be upgraded or trained to eliminate the security vulnerabilities.

[0089] According to the adversarial sample image generation method of the embodiment of the present disclosure, the teacher model can be trained, so that the teacher model can be used to train the proxy model to obtain the adversarial sample image, so that the adversarial sample image has better transferability, that is, it can adapt to more neural network models, and the augmented training set can be used to increase the dark knowledge learned by the proxy model, further improve the transferability based on the proxy model and the transferability of the adversarial sample image obtained based on it, so that the adversarial sample image is applicable to more models, improve the attack success rate of the adversarial sample image attacking other models, obtain a more efficient security assessment tool, and more easily discover security vulnerabilities, which is helpful to eliminate security vulnerabilities and improve security. And make the adversarial sample image more valuable for security research.

[0090] Figure 2A and Figure 2B A schematic diagram showing an application of the adversarial sample image generation method according to an embodiment of the present disclosure is shown as follows: Figure 2A As shown, 9 convolutional neural network models for image classification in the related art can be selected for testing. They are recorded as Inc-v3, Inc-v4, IncRes-v2, Inc-v3-ens3, Inc-v3-ens4, IncRes-v2-ens, HGD, R&D and NIPS-r3. These neural network models are all known image classification models and can be used to measure the quality of adversarial sample images. Among them, the first three neural network models are ordinary neural network models and are vulnerable to attacks by adversarial sample images. The last six neural network models are obtained by a special training method and are more secure. ResNet18 ( Figure 2A RN18 in), DenseNet121( Figure 2ADN121) and MobileNetv2 (MNv2) in the ImageNet training set are used as proxy models to generate adversarial sample images in the ImageNet training set to attack the above 9 image classification convolutional neural network models to evaluate their security. The three methods of generating adversarial sample images based on proxy models, namely FGSM, MI-FGSM, and MI-DI2-FGSM, can be used to generate adversarial sample images, and the results of the attack success rate are displayed in Figure 2A A comparison has been made in the table. Figure 2A The numbers in represent the attack success rate, that is, the probability of causing the above 9 image classification convolutional neural network models to misidentify. The higher the success rate, the higher the quality of the generated adversarial sample images. The adversarial sample images generated by this adversarial sample image generation method are more suitable for evaluating the security of deep learning neural network models. Figure 2A In , RN18, DN121 and MNv2 represent proxy models obtained using the training method in the related art, while the proxy model of +DSM represents a proxy model trained using the teacher model method in the present disclosure. Figure 2A In the figure, the teacher neural network model can adopt the same structure as the neural network model. For example, the agent model is RN18+DSM, which means that the teacher model is also RN18.

[0091] In one possible implementation, Figure 2A As shown in the data, it can be seen that the latter 6 neural networks are more secure than the first 3 neural networks, which is consistent with the actual situation and shows that the adversarial sample images obtained by the adversarial sample image generation method disclosed in the present invention have the function of evaluating the security of the model. In addition, the proxy model trained by the teacher model, i.e. Figure 2A The model with the +DSM symbol in the figure can obtain adversarial sample images with a higher attack success rate than the adversarial sample images obtained by the proxy model trained by the method in the related art under the same conditions. For example, the MI-DI2-FGSM method is used to generate adversarial sample images based on the proxy model. In the best case, the adversarial sample images generated by the proxy model trained by the teacher model can increase the attack success rate by 22.9% compared with the adversarial sample images obtained in the related art. Therefore, the adversarial sample images obtained by the adversarial sample image generation method disclosed in the present invention can be used as a more efficient security assessment tool.

[0092] In one possible implementation, Figure 2AThe teacher model and the proxy model in the above examples have the same model structure. You can also use a teacher model with a different structure from the proxy model. You can use RN18, DN121, and MNv2 as teacher models, use the MI-DI2-FGSM method in the related art to generate adversarial sample images based on the proxy model, and attack the above 9 image classification convolutional neural network models to evaluate their security. The attack success rates are listed in Figure 2B In the table. Figure 2B As shown, when using proxy models and teacher models with different structures, the adversarial sample image generation method disclosed in the present invention can further improve the attack success rate. For example, when using RN18 as a proxy model, using teacher models with different structures to train the proxy model, the obtained adversarial sample images can increase the attack success rate by up to 23.3%. When using DN121 as a proxy model, using teacher models with different structures to train the proxy model, the obtained adversarial sample images can increase the attack success rate by up to 36.0%. When using MNv2 as a proxy model, using teacher models with different structures to train the proxy model, the obtained adversarial sample images can increase the attack success rate by up to 23.7%.

[0093] In a possible implementation, the present disclosure can also be used in fields such as face image comparison, for example, in scenarios of face image comparison in fields such as security, monitoring, and payment, to evaluate the security of face comparison models. In the example, IResNet50 can be used as a proxy model, and the adversarial sample images generated by the adversarial sample image generation method can be used to attack the ArcFace face comparison model. For example, adversarial sample images are generated by the LFW sample image set. Compared with the attack success rate of adversarial sample images in related technologies, the adversarial sample images obtained by the adversarial sample image generation method disclosed in the present disclosure can increase the attack success rate by 16.3%. This can more efficiently evaluate the security of face comparison models in fields such as security, monitoring, and payment, more efficiently discover security vulnerabilities, and help eliminate security vulnerabilities.

[0094] It can be understood that the above-mentioned various method embodiments mentioned in the present disclosure can be combined with each other to form a combined embodiment without violating the principle logic. Due to space limitations, the present disclosure will not repeat them. It can be understood by those skilled in the art that in the above-mentioned method of the specific implementation method, the specific execution order of each step should be determined according to its function and possible internal logic.

[0095] In addition, the present disclosure also provides an adversarial sample image generation device, an electronic device, a computer-readable storage medium, and a program, all of which can be used to implement any adversarial sample image generation method provided by the present disclosure. The corresponding technical solutions and descriptions are referred to the corresponding records in the method part and will not be repeated here.

[0096] Figure 3 A block diagram of an adversarial sample image generating device according to an embodiment of the present disclosure is shown as follows: Figure 3 As shown, the device includes: a teacher model training module 11, which is used to train the teacher model through a training sample image set to obtain a trained teacher model, wherein the training sample image set includes multiple training sample images, and the training sample images have annotation information; an augmentation module 12, which is used to perform augmentation processing on the training sample image set according to the training sample images in the training sample image set to obtain an augmented training sample image set, wherein the augmented training sample image set includes the training sample images in the training sample image set and the augmented training sample images obtained by performing augmentation processing on the training sample images; an agent model training module 13, which is used to train the agent model according to the augmented training sample image set and the trained teacher model to obtain a trained agent model; an adversarial sample image generation module 14, which is used to obtain an adversarial sample image according to the trained agent model and the test sample images in the test sample image set; an evaluation tool generation module 15, which is used to obtain an evaluation tool for evaluating network security according to multiple adversarial sample images.

[0097] In a possible implementation, the augmentation module is further used to: perform fusion processing on any two or more training sample images in the training sample image set to obtain augmented training sample images; and obtain the augmented training sample image set based on the training sample images and the augmented training sample images.

[0098] In a possible implementation manner, the augmentation module is further used to: perform weighted sum processing on any two or more training sample images to obtain the augmented training sample image.

[0099] In a possible implementation, the augmentation module is further used to: delete a first image area at a first position in a first training sample image to obtain an image to be added in which the first position is blank; obtain a second image area at a corresponding position in a second training sample image; and add the second image area to the first position in the image to be added to obtain the augmented training sample image.

[0100] In one possible implementation, the proxy model training module is further used to: determine a reference result of the training sample image based on the teacher model and the type of training sample image used to train the proxy model; process the training sample image through the proxy model to obtain a first processing result; obtain a model loss of the proxy model based on the first processing result and the reference result; and train the proxy model based on the model loss.

[0101] In a possible implementation, the proxy model training module is further used to: when the type of the training sample image is an augmented training sample image, process the augmented training sample image through the teacher model to obtain the reference result.

[0102] In a possible implementation, the proxy model training module is further used to: when the type of the training sample image used to train the proxy model is a training sample image in the training sample image set, determine the annotation information of the training sample image as the reference result.

[0103] In a possible implementation, the adversarial sample image generation module is further used to: add perturbation information to any test sample image in the test sample image set to obtain a sample image to be tested; input the sample image to be tested into the trained proxy model to obtain a second processing result; and adjust the sample image to be tested according to a first error between the sample image to be tested and the test sample image, and a second error between the second processing result and the annotation information of the test sample image, to obtain the adversarial sample image.

[0104] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0105] The embodiment of the present disclosure also provides a computer-readable storage medium, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the above method is implemented. The computer-readable storage medium may be a non-volatile computer-readable storage medium.

[0106] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to call the instructions stored in the memory to execute the above method.

[0107] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code. When the computer-readable code is executed on a device, a processor in the device executes instructions for implementing the adversarial sample image generation method provided in any of the above embodiments.

[0108] The embodiments of the present disclosure also provide another computer program product for storing computer-readable instructions, which, when executed, enable a computer to perform the operations of the adversarial sample image generation method provided in any of the above embodiments.

[0109] The electronic device may be provided as a terminal, a server, or a device in other forms.

[0110] Figure 4 1 is a block diagram of an electronic device 1900 according to an embodiment of the present disclosure. For example, the electronic device 1900 may be provided as a server or a terminal device. Figure 4 , the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0111] The electronic device 1900 may also include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output (I / O) interface 1958. The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server 2000. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM or similar.

[0112] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0113] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0114] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0115] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0116] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0117] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0118] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0119] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0120] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0121] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK) and the like.

[0122] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for generating adversarial sample images, characterized in that: include: The teacher model is trained by a training sample image set to obtain a trained teacher model, wherein the training sample image set includes a plurality of training sample images, and the training sample images have annotation information; According to the training sample images in the training sample image set, the training sample image set is augmented to obtain an augmented training sample image set, wherein the augmented training sample image set includes the training sample images in the training sample image set and augmented training sample images obtained by augmenting the training sample images; Training the proxy model according to the augmented training sample image set and the trained teacher model to obtain the trained proxy model; Obtain an adversarial sample image according to the trained proxy model and a test sample image in a test sample image set; An evaluation tool for evaluating network security is obtained based on the multiple adversarial sample images.

2. The method according to claim 1, characterized in that According to the training sample images in the training sample image set, the training sample image set is augmented to obtain an augmented training sample image set, including: Performing fusion processing on any two or more training sample images in the training sample image set to obtain an augmented training sample image; The augmented training sample image set is obtained according to the training sample images and the augmented training sample images.

3. The method according to claim 2, characterized in that Performing fusion processing on any two or more training sample images in the training sample image set to obtain an augmented training sample image includes: A weighted sum process is performed on any two or more training sample images to obtain the augmented training sample image.

4. The method according to claim 2, characterized in that: Performing fusion processing on any two or more training sample images in the training sample image set to obtain an augmented training sample image includes: Deleting a first image region at a first position in a first training sample image to obtain a blank image to be added at the first position; Acquire a second image region at a corresponding position in a second training sample image; The second image region is added to the first position in the image to be added to obtain the augmented training sample image.

5. The method according to claim 1, characterized in that The method further comprises: training the proxy model according to the augmented training sample image set and the trained teacher model to obtain the trained proxy model, including: Determining a reference result of the training sample image according to the teacher model and the type of the training sample image used to train the proxy model; Processing the training sample image through the proxy model to obtain a first processing result; Obtaining a model loss of the proxy model according to the first processing result and the reference result; The proxy model is trained according to the model loss.

6. The method according to claim 5, characterized in that Determining a reference result of the training sample image according to the teacher model and the type of the training sample image used to train the proxy model includes: In the case where the type of the training sample image is an augmented training sample image, the augmented training sample image is processed by the teacher model to obtain the reference result.

7. The method according to claim 5, characterized in that Determining a reference result of the training sample image according to the teacher model and the type of the training sample image used to train the proxy model includes: In a case where the type of the training sample image used to train the proxy model is a training sample image in the training sample image set, the labeling information of the training sample image is determined as the reference result.

8. The method according to claim 1, characterized in that According to the trained proxy model and the test sample images in the test sample image set, the adversarial sample images are obtained, including: Adding disturbance information to any test sample image in the test sample image set to obtain a sample image to be tested; Inputting the sample image to be tested into the trained proxy model to obtain a second processing result; According to a first error between the sample image to be tested and the test sample image, and a second error between the second processing result and the annotation information of the test sample image, the sample image to be tested is adjusted to obtain the adversarial sample image.

9. A device for generating adversarial sample images, characterized in that: include: A teacher model training module, used to train the teacher model through a training sample image set to obtain a trained teacher model, wherein the training sample image set includes a plurality of training sample images, and the training sample images have annotation information; an augmentation module, configured to perform augmentation processing on the training sample image set according to the training sample images in the training sample image set to obtain an augmented training sample image set, wherein the augmented training sample image set includes the training sample images in the training sample image set and augmented training sample images obtained by performing augmentation processing on the training sample images; A proxy model training module, used to train the proxy model according to the augmented training sample image set and the trained teacher model to obtain the trained proxy model; An adversarial sample image generation module, used for obtaining an adversarial sample image according to the trained proxy model and a test sample image in a test sample image set; An evaluation tool generation module is used to obtain an evaluation tool for evaluating network security based on a plurality of adversarial sample images.

10. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 8.

11. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images