Method, device and electronic device for generating adversarial samples

Abstract

The present disclosure provides a method, device and electronic device for generating adversarial samples, which relate to the field of artificial intelligence technology, and in particular to computer vision technology. The method comprises: adding an initial perturbation to a first original image to obtain an initial adversarial sample; inputting the first original image into a target detection model to obtain a first feature map and a first category with the highest confidence; inputting the initial adversarial sample into a target detection model to obtain a second feature map and a second category with the highest confidence, and if the second category is a true category, then updating the initial adversarial sample according to the first feature map and the second feature map, and iterating this step using the updated initial adversarial sample until the second category is a category other than the true category, then stopping the iteration and determining the initial adversarial sample at this time as the first adversarial sample corresponding to the first original image. This method increases the generation space of adversarial samples.

Description

Technical Field

[0001] The present disclosure relates to computer vision technology in the field of artificial intelligence technology, and in particular to a method, device and electronic device for generating adversarial samples. Background Art

[0002] The task of object detection is to find the targets (objects) of interest in the image and determine their categories and locations. Since various objects have different appearances, shapes and postures, and are interfered by factors such as illumination and occlusion during imaging, object detection has always been the most challenging problem in the field of computer vision.

[0003] In order to ensure the robustness of the target detector under artificial interference, it is usually necessary to artificially add perturbations to the image to form adversarial samples, use the adversarial samples to attack the target detector, and further enhance the robustness of the target detector based on the attack results.

[0004] Existing adversarial sample generation algorithms generally use cross-entropy loss to characterize the gap between the output of the adversarial sample and the true label of the image. This approach limits the generation space of adversarial samples. Summary of the invention

[0005] The present disclosure provides a method, device and electronic device for generating adversarial samples which increase the generation space of adversarial samples.

[0006] According to a first aspect of the present disclosure, a method for generating an adversarial sample is provided, comprising:

[0007] Add an initial perturbation to the first original image to obtain an initial adversarial sample;

[0008] Inputting the first original image into a target detection model to obtain a first feature map related to the confidence of all categories of target detection and a first category with the highest confidence, wherein the first category is a true category of the target;

[0009] The initial adversarial sample is input into the target detection model to obtain a second feature map related to the confidence of all categories of target detection and a second category with the highest confidence. If the second category is the true category, the initial adversarial sample is updated according to the first feature map and the second feature map, and this step is iteratively performed using the updated initial adversarial sample until the second category is a category other than the true category. The iteration is stopped and the initial adversarial sample at this time is determined as the first adversarial sample corresponding to the first original image.

[0010] According to a second aspect of the present disclosure, a device for generating an adversarial sample is provided, comprising:

[0011] A perturbation module, used for adding an initial perturbation to the first original image to obtain an initial adversarial sample;

[0012] A first input module, used for inputting the first original image into a target detection model to obtain a first feature map related to the confidence of all categories of target detection and a first category with the highest confidence, wherein the first category is a true category of the target;

[0013] A second input module is used to input the initial adversarial sample into the target detection model to obtain a second feature map related to the confidence of all categories of target detection and a second category with the highest confidence. If the second category is the true category, the initial adversarial sample is updated according to the first feature map and the second feature map, and this step is iteratively performed using the updated initial adversarial sample until the second category is a category other than the true category. The iteration is stopped and the initial adversarial sample at this time is determined as the first adversarial sample corresponding to the first original image.

[0014] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in the first aspect above.

[0018] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the first aspect above.

[0019] According to a fifth aspect of the present disclosure, a computer program product is provided, the program product comprising: a computer program, the computer program being stored in a readable storage medium, at least one processor of an electronic device being able to read the computer program from the readable storage medium, and the at least one processor executing the computer program so that the electronic device executes the method described in the first aspect.

[0020] According to the technical solution disclosed in the present invention, the generation space of adversarial samples is increased.

[0021] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0023] Figure 1 It is a flowchart of a method for generating adversarial samples according to an embodiment of the present disclosure;

[0024] Figure 2 is a structural schematic diagram of a device for generating adversarial samples according to an embodiment of the present disclosure;

[0025] Figure 3 It is a schematic block diagram of an electronic device used to implement the method for generating adversarial samples according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0027] In the disclosed embodiment, the Project Gradient Descent (PGD) attack method is applied to the attack on the target detection algorithm, the perturbation is constructed in an iterative manner, and the feature maps of the original image and the perturbed image in all categories are used to calculate the loss, thereby increasing the generation space of adversarial samples, making the attack on the target detection model (target detector) more effective. After multiple iterations, adversarial samples are obtained. After inputting the adversarial samples into the target detection model, the result obtained is that the target is misdetected. According to this result, the robustness of the target detection model can be further enhanced.

[0028] The present disclosure provides a method, device and electronic device for generating adversarial samples, which are applied to the field of computer vision in the field of artificial intelligence technology, and can be specifically applied in target detection scenarios to increase the generation space of adversarial samples and improve the robustness of target detection models.

[0029] The following is a detailed description of the adversarial sample generation method provided by the present disclosure through specific embodiments. It is understandable that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0030] Figure 11 is a flow chart of a method for generating adversarial samples according to an embodiment of the present disclosure. The method is performed by a device for generating adversarial samples, which can be implemented by software and / or hardware. Figure 1 As shown, the method includes:

[0031] S101. Add an initial perturbation to the first original image to obtain an initial adversarial sample.

[0032] The purpose of the adversarial sample is to make the target detection model misidentify the target category. Therefore, perturbations are added to the first original image. The initial perturbation in this step can be random. Optionally, perturbations can be added through a perturbation region parameter pert. A perturbation region parameter pert with the same shape as the first original image x is constructed. The perturbation region parameter pert is randomly initialized, which is the initial perturbation. The perturbation region parameter pert is set to a learnable state to facilitate subsequent updates. The initial perturbation is added to the first original image to obtain the initial adversarial sample x′ t ,Right now:

[0033] x′ t =x+pert

[0034] S102: Input the first original image into the target detection model to obtain a first feature map related to the confidence of all categories of target detection and a first category with the highest confidence.

[0035] Among them, the first category is the true category of the target.

[0036] The first original image is input into the target detection model. The target detection model identifies the category of the target in the first original image by extracting the first feature map of the first original image. It can be understood that the first feature map is related to the confidence of all categories of target detection. The target detection model can determine the confidence of the target under all categories based on the first feature map, and output the first category with the highest confidence as the category of the target. Moreover, for the first original image, the target detection model can accurately identify the category of the target, that is, the first category output by the target detection model is the true category of the target. For example, the first original image is a car image, that is, the true category of the target in this first original image is a car. After the car image is input into the target detection model, the target detection model extracts the first feature map of the car image, and determines that the first category with the highest confidence is a car based on the first feature map. Then, the target detection model finally outputs the category of the target as a car.

[0037] S103. Input the initial adversarial sample into the target detection model to obtain a second feature map related to the confidence of all categories of target detection and a second category with the highest confidence. If the second category is a true category, update the initial adversarial sample according to the first feature map and the second feature map, and iterate this step using the updated initial adversarial sample until the second category is a category other than the true category. Then stop the iteration and determine the initial adversarial sample at this time as the first adversarial sample corresponding to the first original image.

[0038] Similar to the previous step, the initial adversarial sample is input into the target detection model. The target detection model identifies the category of the target in the initial adversarial sample by extracting the second feature map of the initial adversarial sample. The second feature map is also related to the confidence of all categories of target detection. The target detection model can determine the confidence of the target in all categories based on the second feature map.

[0039] Since the purpose of using adversarial samples to attack the target detection model is to make the target detection model misidentify the target category, that is, the second category with the highest confidence determined by the target detection model based on the second feature map is not the true category of the target. Therefore, when the second category is still the true category, it means that the attack has not been successful. Therefore, it is necessary to update the initial adversarial sample based on the difference between the first feature map and the second feature map output by the target detection model, and iteratively perform this step, that is, input the updated initial adversarial sample into the target detection model again to obtain the second feature map corresponding to the updated initial adversarial sample. When the second category with the highest confidence determined by the target detection model based on the second feature map is not the true category of the target, the iteration can be stopped. At this time, the initial adversarial sample is the first adversarial sample corresponding to the first original image.

[0040] The method of the embodiment of the present disclosure performs perturbation updates based on the feature map output by the target detection model. Since the feature map is related to the confidence of all categories of target detection, compared with the method in the related art that only considers the gap between the output of the adversarial sample and the real label of the image, the method of the embodiment of the present disclosure makes full use of other category information of the adversarial sample outside the category to which the target belongs (or called the real category, real label), increases the generation space of adversarial samples, and improves the attack effect.

[0041] Based on the above embodiments, how to update the initial adversarial sample is further explained.

[0042] Optionally, a loss value for generating an initial adversarial sample is determined based on the first feature map and the second feature map; and the initial adversarial sample is updated based on the loss value.

[0043] In a feasible implementation, the loss function in the embodiment of the present disclosure may adopt KL divergence, that is, the KL divergence of the first feature map and the second feature map is determined as the loss value.

[0044] J(x′ t , y)=KL_loss{softmax(F(x)), softmax(F(x′ t ))}

[0045] Among them, J(x′ t , y) is the loss value, y represents all categories of target detection, F(x) represents the target detection model, softmax(F(x)) is the output of the softmax layer obtained by inputting the first original image x into the target detection model, that is, the first feature map, softmax(F(x′ t )) is to convert the initial adversarial sample x′ t The output of the softmax layer obtained by inputting the target detection model is the second feature map. The KL divergence of the first feature map and the second feature map is used to more effectively characterize the difference in data distribution between the adversarial sample and the first original image, which increases the generalization ability of the adversarial attack and makes the visual transition of the adversarial sample better.

[0046] The following further explains how to update the initial adversarial example based on the loss value.

[0047] Optionally, determine the inverse value of the gradient of the loss value with respect to the perturbation; and update the initial adversarial sample according to the inverse value of the gradient and the perturbation parameter.

[0048] Among them, the inverse value of the gradient of the loss value with respect to the disturbance is calculated according to the following formula:

[0049]

[0050] Among them, grad is the inverse value of the gradient of the loss value with respect to the disturbance, is the gradient of the loss value with respect to the perturbation, and sign() is the sign function.

[0051] The product of the reverse value of the gradient and the perturbation parameter is added to the initial adversarial sample, and the result is set within the preset range, so that the updated initial adversarial sample calculation formula is as follows:

[0052] x′ t+1 =clip{x′ t +α*grad,[-ε,ε]}

[0053] Among them, x′ t+1is the updated initial adversarial sample, α is the perturbation parameter, [-ε, ε] is the preset range, the value of ε can be set as needed, and clip{} is used to convert x′ t The value of +α*grad is restricted to [-ε, ε].

[0054] After obtaining the updated initial adversarial sample, S103 is executed again, and the iteration is performed in this way until the second category with the highest confidence determined by the target detection model based on the second feature map is not the true category of the target, and then the iteration is stopped. The following is an example to illustrate the iteration process.

[0055] For example, the first original image is an image of a car, that is, the true category of the target in this first original image is a car. After adding the initial perturbation to the first original image, an initial adversarial sample is obtained, and the initial adversarial sample is input into the target detection model to obtain a second feature map. The target detection model determines that the second category with the highest confidence is a car based on the second feature map, which means that the attack has not been successful. Therefore, the initial adversarial sample is updated according to the loss between the first feature map and the second feature map, and the updated initial adversarial sample is input into the target detection model again to obtain the second feature map corresponding to the updated initial adversarial sample. This iteration is repeated until in a certain round of iterations, the second category with the highest confidence determined by the target detection model based on the second feature map is not a car. For example, the second category with the highest confidence is an airplane, that is, the target detection model incorrectly identifies the category of the target, which means that the perturbation attack is successful, and the initial adversarial sample at this time is the first adversarial sample.

[0056] In the iterative process of generating the first adversarial sample, after each update of the initial adversarial sample, the difference between the updated initial adversarial sample and the first original image is the perturbation value pert = x′ of this iteration. t+1 After the iteration is completed to obtain the first adversarial sample, the difference between the first adversarial sample and the first original image is the perturbation value of the first adversarial sample, and other adversarial samples can be further generated based on the perturbation value.

[0057] Optionally, the difference between the first adversarial sample and the first original image is determined as the perturbation value of the first adversarial sample; the perturbation value is added to the second original image to obtain a second adversarial sample corresponding to the second original image. This method can quickly obtain adversarial samples corresponding to a large number of original images, thereby improving efficiency.

[0058] Figure 2 is a schematic diagram of the structure of a device for generating adversarial samples according to an embodiment of the present disclosure. Figure 2 As shown, the adversarial sample generation device 200 includes:

[0059] A perturbation module 201 is used to add an initial perturbation to the first original image to obtain an initial adversarial sample;

[0060] A first input module 202 is used to input the first original image into the target detection model to obtain a first feature map related to the confidence of all categories of target detection and a first category with the highest confidence, where the first category is the true category of the target;

[0061] The second input module 203 is used to input the initial adversarial sample into the target detection model to obtain a second feature map related to the confidence of all categories of target detection and a second category with the highest confidence. If the second category is a true category, the initial adversarial sample is updated according to the first feature map and the second feature map, and this step is iteratively performed using the updated initial adversarial sample until the second category is a category other than the true category. The iteration is stopped and the initial adversarial sample at this time is determined as the first adversarial sample corresponding to the first original image.

[0062] In a possible implementation, the second input module 203 includes:

[0063] A determination unit, configured to determine a loss value for generating an initial adversarial sample according to the first feature map and the second feature map;

[0064] The update unit is used to update the initial adversarial sample according to the loss value.

[0065] In a possible implementation, the determining unit includes:

[0066] The first determining subunit is used to determine the KL divergence of the first feature map and the second feature map as a loss value.

[0067] In a possible implementation, the updating unit includes:

[0068] A second determination subunit, used to determine the reverse direction value of the gradient of the loss value with respect to the disturbance;

[0069] The first updating subunit is used to update the initial adversarial sample according to the reverse value of the gradient and the perturbation parameter.

[0070] In a possible implementation manner, the first updating subunit is used to:

[0071] The product of the inverse value of the gradient and the perturbation parameter is added to the initial adversarial sample, and the result is set within a preset range.

[0072] In a possible implementation, the adversarial sample generating device 200 further includes:

[0073] A third determining subunit, configured to determine a difference between the first adversarial sample and the first original image as a perturbation value of the first adversarial sample;

[0074] The first perturbation subunit is used to add the perturbation value to the second original image to obtain a second adversarial sample corresponding to the second original image.

[0075] The device of the embodiment of the present disclosure can be used to execute the method for generating adversarial samples in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0076] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a non-transitory computer-readable storage medium storing computer instructions.

[0077] According to an embodiment of the present disclosure, the present disclosure also provides a computer program product, the program product includes: a computer program, the computer program is stored in a readable storage medium, at least one processor of an electronic device can read the computer program from the readable storage medium, and at least one processor executes the computer program so that the electronic device executes the solution provided by any of the above embodiments.

[0078] Figure 3 It is a schematic block diagram of an electronic device for implementing the method for generating adversarial samples of an embodiment of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0079] like Figure 3 As shown, the electronic device 300 includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the device 300 can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0080] A number of components in the electronic device 300 are connected to the I / O interface 305, including: an input unit 306, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the device 300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0081] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above, such as the generation method of adversarial samples. For example, in some embodiments, the generation method of adversarial samples may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 300 via ROM 302 and / or communication unit 309. When the computer program is loaded into RAM 303 and executed by the computing unit 301, one or more steps of the generation method of the adversarial sample described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the generation method of the adversarial sample in any other appropriate manner (e.g., by means of firmware).

[0082] According to an embodiment of the present disclosure, the present disclosure further provides an autonomous driving vehicle, comprising the electronic device in the aforementioned embodiment and a mechanical dot matrix display screen disposed outside the autonomous driving vehicle. Optionally, the mechanical dot matrix display screen is disposed at the rear, side or top of the autonomous driving vehicle.

[0083] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0084] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0085] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0086] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0087] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0088] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0089] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution disclosed in this disclosure can be achieved, and this document is not limited here.

[0090] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for generating an adversarial sample, comprising: Add an initial perturbation to the first original image to obtain an initial adversarial sample; The initial disturbance is a disturbance region parameter after random initialization, and the disturbance region parameter has the same shape as the first original image; Inputting the first original image into a target detection model to obtain a first feature map related to the confidence of all categories of target detection and a first category with the highest confidence, wherein the first category is a true category of the target; The initial adversarial sample is input into the target detection model to obtain a second feature map related to the confidence of all categories of target detection and a second category with the highest confidence. If the second category is the true category, the loss value of the initial adversarial sample is determined according to the KL divergence of the first feature map and the second feature map, the initial adversarial sample is updated according to the loss value, and this step is iteratively performed using the updated initial adversarial sample until the second category is a category other than the true category, then the iteration is stopped and the initial adversarial sample at this time is determined as the first adversarial sample corresponding to the first original image.

2. The method according to claim 1, wherein: The updating the initial adversarial sample according to the loss value comprises: Determine the inverse value of the gradient of the loss value with respect to the disturbance; The initial adversarial sample is updated according to the reverse value of the gradient and the perturbation parameter.

3. The method according to claim 2, wherein: The updating of the initial adversarial sample according to the reverse direction value of the gradient and the disturbance parameter includes: The product of the reverse value of the gradient and the perturbation parameter is added to the initial adversarial sample, and the obtained result is set within a preset range.

4. The method according to any one of claims 1 to 3, further comprising: Determine a difference between the first adversarial sample and the first original image as a perturbation value of the first adversarial sample; The perturbation value is added to the second original image to obtain a second adversarial sample corresponding to the second original image.

5. A device for generating an adversarial sample, comprising: A perturbation module, used for adding an initial perturbation to the first original image to obtain an initial adversarial sample; The initial disturbance is a disturbance region parameter after random initialization, and the disturbance region parameter has the same shape as the first original image; A first input module, used for inputting the first original image into a target detection model to obtain a first feature map related to the confidence of all categories of target detection and a first category with the highest confidence, wherein the first category is a true category of the target; A second input module is used to input the initial adversarial sample into the target detection model to obtain a second feature map related to the confidence of all categories of target detection and a second category with the highest confidence. If the second category is the true category, the loss value of the initial adversarial sample is determined according to the KL divergence of the first feature map and the second feature map, the initial adversarial sample is updated according to the loss value, and this step is iteratively performed using the updated initial adversarial sample until the second category is a category other than the true category, then the iteration is stopped and the initial adversarial sample at this time is determined as the first adversarial sample corresponding to the first original image.

6. The device according to claim 5, wherein: The second input module comprises: A second determination subunit, used to determine a reverse value of the gradient of the loss value with respect to the disturbance; The first updating subunit is used to update the initial adversarial sample according to the reverse direction value of the gradient and the perturbation parameter.

7. The device according to claim 6, wherein: The first updating subunit is used for: The product of the reverse value of the gradient and the perturbation parameter is added to the initial adversarial sample, and the obtained result is set within a preset range.

8. The device according to any one of claims 5 to 7, further comprising: A third determining subunit, configured to determine a difference between the first adversarial sample and the first original image as a perturbation value of the first adversarial sample; The first perturbation subunit is used to add the perturbation value to the second original image to obtain a second adversarial sample corresponding to the second original image.

9. An electronic device, comprising: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor so that the at least one processor can execute the method according to any one of claims 1 to 4.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 4.

11. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images