Training Method, Device, Equipment and Medium for Doubling Model

Abstract

The present application discloses a training method, device, equipment and medium for a substitute model, belonging to the field of artificial intelligence. The method includes: under the guidance of the embedding features of the first image category, generating a synthetic image based on the first random noise, inputting the synthetic image into the replaceable model, and training to obtain a first substitute model. Among them, the first substitute model generates a first adversarial sample, and the first substitute model is trained based on the first adversarial sample to obtain a second substitute model. Among them, the second substitute model generates a second adversarial sample, and the second adversarial sample is used to test the robustness of the target model. In the above solution, the first substitute model is trained using the first adversarial sample, so that the obtained second substitute model can better simulate the decision boundary of the target model, and finally generate an adversarial sample with transferability.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and in particular, to a method, apparatus, device, and medium for training a surrogate model. Background Art

[0002] Deep network models are sensitive to certain noises and are prone to outputting incorrect results. For example, adding some random white noise to a panda image will cause the deep network model to misclassify the panda as a gibbon when the human eye can hardly tell the difference.

[0003] To test the decision boundary of a deep network model, related technologies first train a surrogate model (also called a substitute model) corresponding to the deep network model, and this surrogate model continuously fits and learns the decision boundary of the deep network model; then, adversarial samples are generated based on this surrogate model.

[0004] The above surrogate model usually uses the same / homologous / similar real sample data as the deep network model for training. However, due to the large limitations in the quantity and diversity of real sample data, the deep network model cannot truly fit the decision boundary of the target model. Summary of the Invention

[0005] This application provides a method, apparatus, device, and medium for training a surrogate model, which can improve the success rate of fitting the decision boundary of the target model. The technical solutions are as follows:

[0006] According to one aspect of this application, a method for training a surrogate model is provided. The method includes:

[0007] Generate a synthetic image based on first random noise under the guidance of first image category embedding features;

[0008] Train a first surrogate model corresponding to the target model based on the synthetic image and a first classification result (label or probability), where the first classification result is the classification result predicted by the target model for the synthetic image;

[0009] Generate a first adversarial sample from the synthetic image through the first surrogate model;

[0010] Retrain the first surrogate model to obtain a second surrogate model based on the first adversarial sample and a second classification result, where the second classification result is the classification result predicted by the target model for the first adversarial sample;

[0011] Generate a second adversarial sample from the synthetic image through the second surrogate model, and the second adversarial sample is used to test the robustness of the target model.

[0012] According to another aspect of this application, a device for training a surrogate model is provided. The device includes:

[0013] A first generation module, configured to generate a synthetic image based on first random noise under the guidance of first image category embedding features;

[0014] A training module, configured to train a first surrogate model corresponding to the target model based on the synthetic image and a first classification result (label or probability), where the first classification result is the classification result predicted by the target model for the synthetic image;

[0015] A second generation module, configured to generate a first adversarial sample from the synthetic image through the first surrogate model;

[0016] The training module is further configured to retrain the first surrogate model based on the first adversarial sample and a second classification result to obtain a second surrogate model, where the second classification result is the classification result predicted by the target model for the first adversarial sample;

[0017] The second generation module is further configured to generate a second adversarial sample from the synthetic image through the second surrogate model, and the second adversarial sample is used to test the robustness of the target model.

[0018] According to one aspect of the present application, a computer device is provided. The computer device includes: a processor and a memory. The memory stores a computer program, and the computer program is loaded and executed by the processor to implement the training method of the surrogate model as described above.

[0019] According to another aspect of the present application, a computer-readable storage medium is provided. The storage medium stores a computer program, and the computer program is loaded and executed by a processor to implement the training method of the surrogate model as described above.

[0020] According to another aspect of the present application, a computer program product or a computer program is provided. The computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the training method of the surrogate model as described above.

[0021] The beneficial effects brought by the technical solutions provided in the embodiments of the present application at least include:

[0022] By inputting a synthetic image into a surrogate model, a first surrogate model is trained. The first surrogate model generates a first adversarial sample, and the first surrogate model is retrained based on the first adversarial sample to obtain a second surrogate model. The second surrogate model generates a second adversarial sample, and the second adversarial sample is used to test the robustness of the target model. In the above solution, the first surrogate model is trained using the first adversarial sample, so that the obtained second surrogate model can better simulate the decision boundary of the target model (i.e., the attacked model), and finally generate an adversarial sample with transferability. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] To more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0024] Figure 1 is a schematic diagram of a training system for a surrogate model according to an exemplary embodiment;

[0025] Figure 2 is a flowchart of a training method for a surrogate model according to an exemplary embodiment of the present application;

[0026] Figure 3 is a schematic structural diagram of a training system for a surrogate model according to an exemplary embodiment of the present application;

[0027] Figure 4 shows a schematic structural diagram of a training system for a surrogate model according to another exemplary embodiment of the present application;

[0028] Figure 5 is a schematic comparison diagram of a black-box attack method according to an exemplary embodiment of the present application and other black-box attack methods;

[0029] Figure 6 is a schematic comparison diagram of a black-box attack method according to an exemplary embodiment of the present application and other black-box attack methods;

[0030] Figure 7 is a schematic comparison diagram of a black-box attack method according to an exemplary embodiment of the present application and other black-box attack methods;

[0031] Figure 8 is a schematic comparison diagram of each structure in a black-box attack model according to an exemplary embodiment of the present application;

[0032] Figure 9 is a schematic comparison diagram of the impacts generated by different attack methods according to an exemplary embodiment of the present application;

[0033] Figure 10 It is a comparative schematic diagram of different replaceable model structures in an exemplary embodiment of the present application;

[0034] Figure 11 It is a comparative schematic diagram of the black-box attack method and the synthetic images generated by DaST in an exemplary embodiment of the present application;

[0035] Figure 12 It is a comparative schematic diagram of the black-box attack method and the synthetic images generated by DaST in an exemplary embodiment of the present application;

[0036] Figure 13 It is a schematic diagram of a certain type of synthetic image generated by the black-box attack method in an exemplary embodiment of the present application;

[0037] Figure 14 It is a comparative schematic diagram of four attacks included in the black-box attack method in an exemplary embodiment of the present application;

[0038] Figure 15 It is a structural block diagram of a training device for a surrogate model provided in an exemplary embodiment of the present application;

[0039] Figure 16 It shows a structural block diagram of an electronic device provided in an exemplary embodiment of the present application;

[0040] Figure 17 It shows a schematic diagram of a data sharing system provided in an exemplary embodiment of the present application;

[0041] Figure 18 It shows a schematic diagram of a blockchain structure provided in an exemplary embodiment of the present application;

[0042] Figure 19 It shows a schematic diagram of a new block generation process provided in an exemplary embodiment of the present application. Detailed implementation manners

[0043] To make the objectives, technical solutions and advantages of the present application clearer, the following will further describe the embodiments of the present application in detail with reference to the accompanying drawings.

[0044] First, a brief introduction to the terms involved in the embodiments of the present application is given:

[0045] Adversarial example: Assume that the input images of the target model can be divided into two categories A and B. For example, the input images x1, x2, x3 are divided into category A, and x4, x5 are divided into category B. After training the surrogate model of the target model, it can still divide the input images into two categories A and B, but it divides x1, x2, x5 into category A and x3, x4 into category B. At this time, there are errors in the classification of x3 and x5 by the surrogate model, and the corresponding x3 and x5 are adversarial examples.

[0046] The generation of the above adversarial examples is due to the fact that the target model is based on an incomplete training dataset, and there are some unlabeled data. These unlabeled data make the decision boundary trained by the model unstable, making it easy for adversarial examples to succeed in attacks.

[0047] Non-targeted attack: Without prior knowledge of the network details of the attack and without specifying the predicted class, adversarial examples are generated to deceive the defender's network.

[0048] Targeted attack: Making the images be misclassified into a given class.

[0049] DaST: A training method for a surrogate model that can obtain a surrogate model for adversarial black-box attacks without any real data. It uses a generative adversarial network to generate synthetic samples to train the surrogate model, and the labels of the synthetic samples come from the target model. In terms of performance, the synthetic samples can be evenly distributed in the input space, and the sample labels cover all classes.

[0050] White-box attack and black-box attack: A white-box attack means that the attacker knows all the internal information and parameters of the attacked model, and generates adversarial examples based on the gradient of the given attacked model to attack the network. When the attacker cannot access the internal information of the attacked model, a white-box attack is obviously not applicable. A black-box attack means that without knowing the parameter and structure information of the attacked model, only through the input and output of the attacked model, adversarial examples are generated and then used to attack the attacked model.

[0051] For a white-box attack, it needs to fully obtain the gradient information of the target model, and then use it to generate adversarial examples to attack the target model. For a black-box attack, a surrogate model of the target model is trained to generate adversarial examples, and the samples are migrated to attack the target model. The success rate of a black-box attack highly depends on the transferability of the adversarial examples.

[0052] The black-box attack mentioned in the embodiments of this application is used to test the robustness of the target model against adversarial examples. Specifically, the black-box attack provided by this application can be directly deployed in front of any target model related to an image classification task, and the target model is attacked with the adversarial examples generated by the surrogate model, so as to test the robustness of the target model against adversarial examples.

[0053] Surrogate model: Also known as a replaceable model, in a black-box attack, it is trained to continuously approach the target model. In traditional training of a surrogate model, the surrogate model often only learns the output results (probabilities or labels) of the target model, and does not well learn the decision boundary of the target model. The technical solution of this application provides a training method for the surrogate model to learn the decision boundary of the target model.

[0054] Computer Vision Technology (CV): Computer vision is a science that studies how to enable machines to "see". More specifically, it refers to using cameras and computers to replace human eyes for tasks such as object recognition, tracking, and measurement in machine vision, and further performing image processing to make the computer-processed images more suitable for human eye observation or transmission to instrument detection. As a scientific discipline, computer vision researches related theories and technologies, and attempts to build artificial intelligence systems that can obtain information from images or multi-dimensional data. Computer vision technology usually includes image processing, image recognition, image semantic understanding, image retrieval, OCR (Optical Character Recognition), video processing, video semantic understanding, video content / behavior recognition, 3D object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping, etc. It also includes common biometric recognition technologies such as face recognition and fingerprint recognition.

[0055] Artificial Intelligence Cloud Service: The so-called artificial intelligence cloud service is generally also referred to as AIaaS (AI as a Service). This is a current mainstream service mode of artificial intelligence platforms. Specifically, the AIaaS platform splits several common AI (Artificial Intelligence) services and provides independent or packaged services in the cloud. This service mode is similar to opening an AI-themed mall: all developers can access and use one or more artificial intelligence services provided by the platform through the API (Application Program Interface) interface. Some senior developers can also use the AI frameworks and AI infrastructure provided by the platform to deploy and operate their own exclusive cloud artificial intelligence services.

[0056] The solution of the embodiment of this application includes a synthetic image generation stage and an adversarial replacement training stage. Figure 1 It is a schematic diagram of a training system for a substitute model shown according to an exemplary embodiment. As Figure 1 shown, when performing a black-box attack, an image generation device 110 and an adversarial replacement training device 120 are used. In response to the synthetic image generated by the image generation device 110 being input into the adversarial replacement training device 120, a complete black-box attack is completed, and this black-box attack is used to test the robustness of the target model against adversarial samples.

[0057] Among them, the above-mentioned image generation device 110 and adversarial replacement training device 120 can be computer devices with machine learning capabilities. For example, this computer device can be a terminal or a server.

[0058] Optionally, the above-mentioned image generation device 110 and adversarial replacement training device 120 can be the same computer device, or the image generation device 110 and adversarial replacement training device 120 can also be different computer devices. Moreover, when the image generation device 110 and adversarial replacement training device 120 are different devices, the image generation device 110 and adversarial replacement training device 120 can be devices of the same type. For example, both the image generation device 110 and adversarial replacement training device 120 can be servers; or, the image generation device 110 and adversarial replacement training device 120 can also be devices of different types. The above-mentioned server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The above-mentioned terminal can be a smart phone, tablet computer, notebook computer, desktop computer, smart speaker, smart watch, etc., but is not limited thereto. The terminal and the server can be directly or indirectly connected through wired or wireless communication methods, and the present application does not make any restrictions in this regard.

[0059] In the related art, the surrogate model is often directly trained with images, and a black-box attack is performed based on the adversarial samples output by the surrogate model. In the present application, it also involves training the surrogate model with adversarial samples. Based on this, the following discussion is carried out.

[0060] Figure 2 It is a flowchart of a method for training a surrogate model according to an exemplary embodiment of the present application. In this embodiment, it is exemplified that the method is executed by the Figure 1 surrogate model training system shown, and the method includes:

[0061] Step 201, under the guidance of the first image category embedding feature, generate a synthetic image based on the first random noise;

[0062] The first image category embedding feature is an embedding feature used to represent the first image category, and the first image category is any one of multiple image categories supported by the target model. The target model is the image classification model to be attacked, also known as the model to be attacked.

[0063] This embodiment does not require real sample images. Instead, under the guidance of the first image category embedding feature, a synthetic image belonging to the first image category is generated based on the first random noise.

[0064] Exemplarily, there are n image categories. This step can embed features based on different image categories, and use the first random noise to generate synthetic images belonging to the n image categories as sample images.

[0065] For example, image categories are divided into: human category and animal category. Through this step, the first random noise is used to generate a first synthetic image belonging to the human category and a second synthetic image belonging to the animal category.

[0066] It should be noted that in order to allow the substitute model to learn the classification characteristics of the target model as much as possible, a large number of synthetic images are formed to form a synthetic image set.

[0067] Step 202: Based on the synthesized image and the first classification result, a first avatar model corresponding to the target model is trained;

[0068] The first classification result is the classification result predicted by the target model for the synthetic image.

[0069] The synthetic image is used as the sample image, the first classification result is used as the true label of the sample image, and the initial stand-in model is trained to obtain a first stand-in model corresponding to the target model.

[0070] The model structure and parameters of the target model are unknown, while the model structure and parameters of the first substitute model are known.

[0071] Step 203: Generate a first adversarial sample from the synthesized image using a first stand-in model;

[0072] Since the model structure and parameters of the first stand-in model are known, based on the white-box attack method, the synthetic image can be generated as a first adversarial sample using the model structure and parameters of the first stand-in model.

[0073] Simply put, adversarial examples are samples that are not common in real samples, but can cause the attacked model to misidentify them. For example, subtle interference that is imperceptible to some people is deliberately added to the input sample, causing the attacked model to give an incorrect output with high confidence.

[0074] Step 204: retrain the first avatar model based on the first adversarial sample and the second classification result to obtain a second avatar model;

[0075] The second classification result is the classification result predicted by the target model for the first adversarial example.

[0076] Taking the first adversarial sample as the sample image and the second classification result as the true label of the first adversarial sample, the first stand-in model is retrained to obtain a second stand-in model corresponding to the target model.

[0077] Among them, the second surrogate model can better fit the decision boundary of the target model, and the decision boundary is used to indicate the boundary when the target model classifies different image categories.

[0078] Step 205: Generate a second adversarial sample from the synthesized image through the second surrogate model.

[0079] Among them, the second adversarial sample is used to test the robustness of the target model.

[0080] Since the model structure and parameters of the second surrogate model are known, based on the white-box attack method, using the model structure and parameters of the second surrogate model, the synthesized image can be generated into a second adversarial sample.

[0081] Figure 3 Fig. shows a schematic structural diagram of a training system for a surrogate model. In the figure, the training system of the surrogate model includes an image generation network 310 and an adversarial replacement training network 320. Among them, the image generation network 310 includes: a generator 311 and a category feature extractor 312, and the adversarial replacement training network 320 includes a target model 11 and a surrogate model 12. Among them, in response to inputting random noise 301 into the generator 311 and inputting the image category label into the category feature extractor 312 to obtain the mean and variance of the image category embedding features, under the guidance of the mean and variance, the generator 311 outputs a synthesized image 325. In response to inputting the synthesized image 325 into the target model 11 to obtain image distribution information 1, inputting the synthesized image 325 into the surrogate model 12 to obtain image distribution information 2, based on the white-box attack algorithm, the surrogate model 12 outputs an adversarial image 323, where the adversarial image 323 is generated by combining the synthesized image 325 and an interference image 324.

[0082] In response to inputting the adversarial image 323 into the target model 11 to obtain image distribution information 1', in response to inputting the adversarial image 323 into the surrogate model 12 to obtain image distribution information 2', based on the white-box attack algorithm, the surrogate model 12 outputs the adversarial image 323 again, and the adversarial image 323 is input into the target model 11. Based on this, a black-box attack is completed, and the executed black-box attack is used to test the robustness of the target model against the adversarial image 323 (adversarial sample).

[0083] In the optional embodiment based on Figure 3 :

[0084] For step 201, generate a synthesized image based on the first random noise under the guidance of the first image category embedding features;

[0085] In one embodiment, input the first image category embedding features and the first random noise into the generator to obtain the synthesized image output by the generator.

[0086] Schematically, in combination with reference toFigure 3 , Figure 3 shows a schematic structural diagram of a training system for a substitute model. In the figure, the training system of the substitute model includes an image generation network 310 and an adversarial replacement training network 320. Among them, the image generation network 310 includes: a generator 311 and a category feature extractor 312.

[0087] In response to extracting random noise 301 that conforms to a Gaussian distribution from space, the random noise 301 is input into the generator 311. In response to inputting an image category label into the category feature extractor 312, an image category embedding feature vector e (i) is obtained. Then, through two fully connected layers, from the image category embedding feature vector e (i) the mean m (i) of the image category embedding feature vector e (i) and the variance σ (i) are extracted.

[0088] In one embodiment, the generator 311 includes five deconvolution blocks, as Figure 3 shown. Each deconvolution block performs an operation of generating a synthetic image under the guidance of the mean m (i) and the variance σ (i) . Schematically, the guidance method is as follows:

[0089] x (i) = DeConv(x (i) ) * σ (i) + m (i)

[0090] where DeConv(·) is the image generation function of each deconvolution block, x (i) is the synthetic image obtained after each deconvolution block. When the random noise 301 is first input into the deconvolution block, x (i) = z (i) on the right side of the equation, where z (i) indicates the random noise 301. Based on the random noise 301, through five deconvolution blocks, that is, the above guidance method is executed five times, and the final synthetic image 325 is obtained.

[0091] For step 202, based on the synthetic image and the first classification result, a first substitute model corresponding to the target model is trained;

[0092] where the first classification result is the classification result predicted by the target model for the synthetic image. The first classification result is represented by an image classification label (abbreviation: label), or the first classification result is represented by an image classification probability (abbreviation: probability).

[0093] With reference to Figure 3, based on the synthetic image 325 input into the target model 11 and the surrogate model 12, the image distribution information 1 of the synthetic image 325 passing through the target model 11 (i.e., the above first classification result) is output, and the image distribution information 2 of the synthetic image 325 passing through the surrogate model 12 is output. Based on the error between the image distribution information 1 and the image distribution information 2, the loss function is calculated. Schematically,

[0094]

[0095] where L d represents the loss function of the classification information output by the target model 11 and the surrogate model 12, and L c represents the generation loss. Among them, M is the number of input image class labels, G(·) represents the output function of the generator 311, S(·) represents the output function of the surrogate model, T(·) represents the output function of the target model. Based on the prediction distribution of the surrogate model, CE(·) represents the cross-entropy loss function between the classification result predicted by the surrogate model 12 and the input image class label i. is the min-max game of L d . Therefore, by alternately controlling the above L d and L c , the above L d and L c alternately reach the minimum value, and the surrogate model 12 gradually approaches the target model 11.

[0096] At this time, the above surrogate model 12 is the first surrogate model.

[0097] For step 203, the synthetic image is generated into the first adversarial sample through the first surrogate model;

[0098] Based on the gradient-based adversarial sample generation strategy, the synthetic image is generated into the first adversarial sample based on the network parameters of the first surrogate model.

[0099] Among them, the gradient-based adversarial sample generation strategy refers to using a gradient-based algorithm to generate adversarial samples. Exemplarily, this algorithm includes FGSM (Fast Gradient Sign Method), PGD (Project Gradient Descent), BIM (Basic Iterative Methods), and C&W (an attack method for adversarial samples).

[0100] Combined with reference Figure 3, in response to inputting the synthetic image 325 into the surrogate model 12, where the internal parameters of the surrogate model 12 are known, that is, the surrogate model 12 is equivalent to a white box. Based on the white-box attack algorithm, the interference image 324 can be obtained. Based on the obtained interference image 324, the adversarial image 323 can be obtained. The formula for generating the synthetic image 325 is as follows:

[0101]

[0102] Among them, the L(·) function represents the probability of obtaining the adversarial image 323 or can be understood as the cross-entropy of predicting i (i) obtained from x (adv) +ε, i (adv) represents the class label of the adversarial image 323, i is the input image class label, ε is the perturbation information, λ is the regularization coefficient. When the adversarial image 323 performs a non-targeted attack, i (adv) ≠i. When the adversarial image 323 performs a targeted attack, i (adv) =t, t is the label output by the target model, and x (i) indicates the synthetic image 325.

[0103] At this time, the obtained adversarial image 323 is the first adversarial sample.

[0104] For step 204, based on the first adversarial sample and the second classification result, the first surrogate model is retrained to obtain the second surrogate model;

[0105] Among them, the second classification result is the classification result predicted by the target model for the first adversarial sample. The second classification result is represented by an image classification label (abbreviation: label), or the second classification result is represented by an image classification probability (abbreviation: probability). The representation method of the second classification result is the same as that of the first classification result.

[0106] In one embodiment, the first adversarial sample is input into the first surrogate model for prediction to obtain a predicted classification result; the error loss between the predicted classification result and the second classification result is calculated; the network parameters of the first surrogate model are updated based on the error loss; when the training end condition is satisfied, the second surrogate model is obtained.

[0107] In the case where the second surrogate model is trained to convergence, the second surrogate model is obtained; or, in the case where the maximum number of training rounds is reached, the second surrogate model is obtained.

[0108] Schematically, in combination with reference Figure 3, based on the adversarial image 323 input to the target model 11 and the surrogate model 12, output the image distribution information 1' of the adversarial image 323 passing through the target model 11 (i.e., the above-mentioned second classification result), and output the image distribution information 2' of the synthesized image 32 passing through the surrogate model 12. Based on the error between the image distribution information 1' and the image distribution information 2', calculate the loss function where is similar to the definition of the above L d , is similar to the definition of L c , and will not be elaborated here. By alternately controlling the above and such that the above and alternately reach the minimum value, the surrogate model 12 gradually approaches the target model 11, and finally the surrogate model 12 becomes the second surrogate model.

[0109] Based on the above steps 202 to 204, the second surrogate model is finally obtained.

[0110] In one embodiment, the loss function of the surrogate model 12 is L S , then

[0111]

[0112] The network parameters of the surrogate model 12 are θ S , and as the iterative training continues,

[0113]

[0114] θ' S is the network parameter of the current surrogate model 12, and θ S is the network parameter of the previous surrogate model 12. Where γ1 is a hyperparameter.

[0115] Based on the loss function L of the above surrogate model 12 S update the network parameters of the surrogate model 12. In the case where the surrogate model 12 is trained to convergence, the second surrogate model is obtained; or, in the case where the surrogate model 12 reaches the maximum number of training rounds, the second surrogate model is obtained.

[0116] For step 205, generate a second adversarial sample from the synthesized image through the second surrogate model.

[0117] Through the gradient-based adversarial sample generation strategy, generate the synthesized image as a second adversarial sample based on the network parameters of the second surrogate model. The second adversarial sample is used to test the robustness of the target model.

[0118] In one embodiment, the method for generating the second adversarial sample based on the second surrogate model is similar to the method for generating the first adversarial sample based on the first surrogate model, which will not be elaborated here.

[0119] With reference to Figure 3 , in response to generating the second adversarial sample from the synthetic image 325 through the second surrogate model, inputting the second adversarial sample into the target model 11 completes a black-box attack, and the executed black-box attack is used to test the robustness of the target model against the second adversarial sample. Among them, the internal parameters of the target model 11 are unknown.

[0120] In summary, by inputting the synthetic image into the surrogate model, the first surrogate model is trained, where the first surrogate model generates the first adversarial sample, and the first surrogate model is trained based on the first adversarial sample to obtain the second surrogate model, where the second surrogate model generates the second adversarial sample, and the second adversarial sample is used to test the robustness of the target model. In the above solution, the first surrogate model is trained using the first adversarial sample, so that the obtained second surrogate model can better simulate the decision boundary of the target model, and finally generate transferable adversarial samples.

[0121] To make the distribution of the synthetic images as uniform as possible in the sample space, the differences between classes of the synthetic images are more obvious, and the images within each class of the synthetic images are diversified. Based on Figure 2 the embodiment shown, step 201 further includes:

[0122] Step 201-1, training a generator based on at least the first loss function;

[0123] The first loss function is used to train the diversity of the synthetic images generated by the generator within the same class;

[0124] In one embodiment, the synthetic image output by the generator is input into the decoder to obtain the second random noise (i.e., the reverse random noise in the figure) and the second image class embedding feature (i.e., the reverse image class embedding feature vector) reversely generated by the decoder. The first loss function is calculated based on the consistency loss between the first random noise and the second random noise, and the consistency loss between the first image class embedding feature and the second image class embedding feature; the generator is trained with the first loss function as a constraint.

[0125] Schematically, with reference to Figure 4 , Figure 4 shows a schematic structural diagram of the training system of the surrogate model according to another exemplary embodiment of the present application. Compared with the training system of the surrogate model shown in Figure 3 , the training system of the surrogate model shown in Figure 4 further includes an inter-class diversity constraint network 401 and a noise / class re-generation network 402.

[0126] In one embodiment, the noise / class regeneration network 402 includes a decoder. The decoder is used to generate a second random noise and a second image class embedding feature Thus, the loss function of the noise / class regeneration network 402 (i.e., the first loss function) is obtained:

[0127]

[0128] The above formula calculates the loss between the random noise z (i) and the second random noise using the L1 norm, and calculates the cosine distance between the image class embedding feature vector e (i) and the second image class embedding feature vector using f(·). CE(·) represents the cross-entropy loss between the input image class label i and the obtained cosine distance calculated by Softmax (a normalized exponential function), and M represents the number of input image class labels.

[0129] Through the constraint of L rec on the generator 311, the intra-class images in the synthetic image 325 are made diverse. Schematically, the constraint of L rec on the generator 311 refers to step 201-3.

[0130] Step 201-2, training the generator based at least on the second loss function;

[0131] The second loss function is used to train the diversity between different classes of synthetic images generated by the generator.

[0132] In one embodiment, for each type of synthetic image output by the generator, the feature mean is calculated through a similarity matrix; aiming at a sufficiently large distance between the feature means of the synthetic images of different image classes, the second loss function is calculated; and the generator is trained with the second loss function as a constraint.

[0133] Schematically, in combination with reference Figure 4 , the inter-class diversity constraint network 401 is used to increase the feature means between different classes in the synthetic image 325, that is, to increase x (i) the feature means between different image class embedding feature vectors e (i) within. Optionally, the inter-class diversity constraint network 401 includes a similarity matrix.

[0134] Schematically, the synthetic image 325 includes images of three categories: dogs, cats, and snakes. Through the similarity matrix, the image class embedding feature vectors e (1) of the above three categories of images are increased(2) and e (3) By increasing the feature mean between classes, the goal of increasing the diversity between classes of the synthetic image 325 is achieved. The loss function of the input similarity matrix of the synthetic image 325 is thus obtained (i.e., the second loss function):

[0135]

[0136] Among them, O B is the similarity matrix of the composite image 325, is the known true value similarity matrix, the above above In this truth similarity matrix, except for the diagonal element value of 1, all other elements are 0. B is the number of categories of the above-mentioned synthetic image 325, TRI(·) is used to extract the elements of the upper triangular area in the difference matrix, and the difference matrix is the difference between the similarity matrix and the true value similarity matrix.

[0137] Therefore, through L div The constraints on the generator 311 make the images of each class in the composite image 325 have independent distributions. div The constraints on the generator 311 refer to step 201 - 3 .

[0138] Step 201-3: The generator is trained based on at least the first loss function and the second loss function.

[0139] In one embodiment, the loss function L of the generator 311 is G By L c 、 L rec , and L div Composition. Schematic,

[0140]

[0141] Among them, β1, β2 and β3 are hyperparameters.

[0142] In response to the generator 311 being trained to convergence, or reaching the maximum number of training rounds, the network parameters of the generator 311 are updated.

[0143]

[0144] Among them, θ′ G is the network parameter of the current generator 311, θ G is the network parameter of the generator 311 before updating, and γ2 is a hyperparameter.

[0145] The above steps 201-1, 201-2, and 201-3 are parallel steps, that is, performing any one of these steps can achieve the effect of optimizing the distribution of the synthesized images.

[0146] In summary, by calculating the consistency loss between the first random noise and the second random noise, and the consistency loss between the first image class embedding feature and the second image class embedding feature through the noise / class regeneration network, a first loss function is obtained, and the generator is trained with the first loss function as a constraint. The above method not only achieves the goal of data class control but also ensures the diversity of samples within the synthesized image classes.

[0147] The feature mean of the synthesized images of each image class output by the generator is calculated through the inter-class diversity constraint network, and then, with the goal of a large enough distance between the feature means of the synthesized images of different image classes, a second loss function is calculated. Finally, the generator is trained with the second loss function as a constraint. The above method realizes the goal of increasing the inter-class diversity of the synthesized images and ensures the independent distribution of images of each class in the synthesized images.

[0148] Based on the above, the technical solution of this application has been fully described. Next, the technical solution will be described in detail through multiple sets of experiments.

[0149] Introduction to the relevant content of the experiment:

[0150] First, four publicly available datasets are introduced: (1) MNIST: a labeled dataset, and the corresponding target models are trained using AlexNet (a convolutional neural network), VGG-16 (a convolutional neural network), and ResNet-18 (a convolutional neural network), and the corresponding default surrogate model is a network containing three convolutional layers; (2) CIFAR-10: a labeled dataset, abbreviated as C-10 hereafter, and the corresponding target models are trained using AlexNet, VGG-16, and ResNet-18, and the corresponding default surrogate model is VGG-13 (a convolutional neural network); (3) CIFAR-100: abbreviated as C-100 hereafter, a labeled dataset, and the corresponding target models are trained using VGG-19 (a convolutional neural network) and ResNet-50 (a convolutional neural network), and the corresponding default surrogate model is ResNet-18; (4) Tiny Imagenet: a labeled dataset, and the corresponding target model is trained using ResNet-50 (a convolutional neural network), and the corresponding default surrogate model is ResNet-34 (a convolutional neural network).

[0151] Next, the evaluation criterion ASRs (Attack Success Rates) is introduced: the success rate of using adversarial examples generated by the surrogate model to attack the target black-box model.

[0152] In the first experiment, the surrogate model was trained using real images. All the black-box attacks mentioned in the embodiments of the present application are used to test the robustness of the target model.

[0153] Combined with reference Figure 5 and Figure 6 , Figure 5 the effects of the black-box attack method provided in the present application and other methods were compared when the output of the target model is a probability. Specifically, the ASRs results obtained by different black-box attack methods were compared under non-targeted attack and targeted attack conditions.

[0154] Figure 6 the effects of the black-box attack method provided in the present application and other methods were compared when the output of the target model is a label. Specifically, the ASRs obtained by different black-box attack methods were compared under non-targeted attack and targeted attack conditions.

[0155] The surrogate model was trained using the training data of the target model or ImageNet (a large visual database for visual object recognition software research). Through Figure 5 , it can be seen that real data cannot enable the surrogate model to learn the target model well.

[0156] In the second experiment, the ASRs of the technical solution of the present application were compared with those of PBBA (a black-box attack method that requires real data), Knockoff (a black-box attack method that requires real data), and DaST (a black-box attack method based on synthetic data). From Figure 5 and Figure 6 , it can be seen that the technical solution provided in the present application is superior to other black-box attack methods in most cases. Figure 5 and Figure 6 The bold fonts in

[0157] show the maximum values of ASRs under the same target model. Figure 7 It shows that the technical solution provided in the present application is superior to other black-box attack methods whether the output of the target model is a probability or a label.

[0158] Next, the effects of the technical solution provided in the present application will be analyzed from the perspectives of quantitative analysis and qualitative analysis.

[0159] First, analyze the effects of each network in this application from a quantitative analysis perspective.

[0160] To combine the image class embedding features and random noise to generate synthetic images, and to enable the substitute model to better simulate the decision boundary of the target model, referring to Figure 4 The technical solution of this application mainly includes four networks, the generator 311, that is, Figure 8 the ALNG (Adaptive Label Normalized Generator) in Figure 8 the N / LR (Noise / Label Reconstruction) in Figure 8 the ICR (Inter-Class Diversity) in Figure 8 the AST (Adversarial Substitute Training) in

[0161] The above-mentioned ALNG is used to generate synthetic images from the input random noise and class embedding features; N / LR is used to reconstruct the input random noise and class embedding features; ICR is used to constrain the feature means between classes of synthetic images; AST uses adversarial samples to better train the substitute model.

[0162] Figure 8 The basic substitute model in Figure 8 refers to the substitute model directly trained from random noise and image class embedding features. Figure 8 Including two cases where the target model is trained based on the MNIST dataset or the C-100 dataset, and two cases where the output of the target model is a probability or a label. Figure 8 It also includes two cases of performing untargeted attacks and targeted attacks.

[0163] Based on Figure 8 It can be seen that without ALNG, the basic substitute model cannot learn the target model; the substitute model with the N / LR or ICR module added can achieve greater ASRs; AST generates adversarial samples as data around the decision boundary, enabling the substitute model to better simulate the target model and ultimately obtaining a better attack effect.

[0164] Secondly, analyze the effects under different attack methods from a quantitative analysis perspective.

[0165] Figure 9Shows the attack methods of FGSM, PGD, BIM, and C&W. Among them, the third FGSM column and the fourth PGD column represent the methods of attacking the surrogate model with adversarial examples, and the FGSM row, BIM row, PGD row, and C&W row represent the methods of attacking the target model with adversarial examples. -P represents the case where the output of the target model is a probability, and -L represents the case where the output of the target model is a label.

[0166] From Figure 9 It can be obtained that different attack methods have no obvious impact on the technical solution of this application, that is, the technical solution provided by this application is effective under various attack methods, and there is no need to limit the attack method on the surrogate model when implementing this technical solution.

[0167] Then, analyze the effects of different surrogate model structures from a quantitative analysis perspective.

[0168] Figure 10 Shows the structures of various surrogate models, such as AlexNet, VGG-13, VGG-16, VGG-19, ResNet-18, and ResNet-34. Figure 10 The structure of the target model in Figure 10 is the VGG-16 structure based on CIFAR-10. From

[0169] Qualitative analysis perspective:

[0170] First, analyze the differences between the synthetic images provided by the technical solution of this application and the synthetic images provided by DaST;

[0171] Figure 11 Shows the differences between the synthetic images obtained by the above two methods. Figure 11 The different numbers in Figure 11 represent different categories. From Figure 12 it can be seen that among the synthetic images obtained by DaST, the images between different categories are more similar. For example, the synthetic images between the 3rd, 5th, 6th, and 7th categories are extremely similar.

[0172] From Figure 12 it can be seen that the distribution between different categories of the synthetic images obtained by DaST is not obvious, and the synthetic images are interspersed. The distribution of the synthetic images generated by the method provided by this application is obvious, and the synthetic images are classified and distributed.

[0173] Figure 11It shows that in the synthetic images obtained by DaST, the images within the same category are more similar, such as the synthetic images within categories 8 and 9 are extremely similar. Figure 13 It shows the synthetic data within a certain category generated by the method provided by the present application. Figure 13 On the left in it is the real data provided by MNIST, and on the right is the synthetic data generated by the method of the present application. Figure 13 It can be seen that the data obtained by the method provided by the present application is more in quantity, and the synthetic data within the category is more widely distributed than the real data within the category.

[0174] Figure 14 It shows four situations: (a) inputting real data into the target model; (b) attacking the target model with real data and adversarial samples; (c) inputting synthetic data into the surrogate model; (d) attacking the surrogate model with synthetic data and adversarial samples. Figure 14 In it, the circle represents the input data, the star represents the adversarial sample, and the line represents the decision boundary.

[0175] From Figure 14 it can be seen that in situations (a) and (b), the decision boundary obtained by attacking the target model with real data and adversarial samples is clearer. From Figure 14 it can be seen that compared with (c), the decision boundary obtained by attacking the surrogate model through (d) is more similar to the decision boundary obtained by (a), intuitively reflecting that the surrogate model can better learn the decision boundary of the target model through the AST method.

[0176] In one embodiment, the above image generation network 310 is composed of three sub-networks: an adaptive category control generator, a noise and category re-generation network, and an inter-class diversity constraint network.

[0177] (1) The adaptive category control generator is a neural network model composed of a category embedding layer and a data generation network. The embedding features of the specified category information are obtained through the category embedding layer, and the random noise iteratively generates data through the data generation network under the guidance of the category embedding features, so as to complete the goal of generating a large amount of high-quality category-controllable data generation. The synthetic data is input into both the target model and the surrogate model at the same time, and the surrogate model is trained by bringing the output results of the two closer.

[0178] (2) The noise / category re-generation network is a decoder composed of a multi-layer neural network. The data generated in the adaptive category control generator is sent into the noise / category re-generation module, and the random noise and the specified category are generated in reverse, and the consistency between the generation and the input is added for constrained training. Thus, not only the goal of data category control is achieved, but also the random noise generated in reverse ensures the diversity of samples within the category.

[0179] (3) The inter-class diversity constraint network is a loss function that increases inter-class diversity implemented through a similarity matrix. By the feature means of each class of data in a batch of generated data, it is constrained that the feature means between classes are large enough, thereby achieving the goal of increasing the inter-class diversity of the generated data.

[0180] In one embodiment, the above adversarial replacement training network 320 is mainly used to prompt the substitute model to simulate the decision boundary of the target model as closely as possible, so as to generate high-quality and highly aggressive adversarial samples through the replaceable model. By feeding the generated data into the current substitute model to generate adversarial samples, and using the output of the target model for the adversarial samples as the true label of the substitute model, the training of the substitute model is completed. Since the adversarial samples are samples on the decision boundary, by having the substitute model learn from the adversarial samples, it can be forced to learn a more refined decision boundary of the target model.

[0181] In one embodiment, during the training phase, random noise and class labels are used as the inputs of the adaptive class control generator, and then a large amount of data with class labels is generated. At the same time, the inter-class diversity constraint loss function is used to increase the diversity of the generated samples; meanwhile, the adversarial replacement training method is adopted, that is, for the substitute model, the gradient-based adversarial sample generation method is used to generate adversarial samples for the generated data. Subsequently, the generated data and the adversarial samples are simultaneously fed into the target model and the substitute model, and by constraining the consistency of the output results of the two models, the substitute model is helped to learn the knowledge of the target model. The above steps are continuously iteratively trained until the replaceable model is trained to convergence or the maximum number of training rounds is reached.

[0182] In the testing phase, the gradient-based adversarial sample generation method is adopted to generate adversarial samples by attacking the trained replaceable model, and the adversarial samples are used to test the robustness of the target model.

[0183] In one embodiment, the technical solution provided by this application is a black-box attack based on replaceable training under the condition of no real data. Therefore, it can be directly deployed in front of any target model related to image classification tasks, and the target model is attacked through the adversarial samples generated by the substitute model, thereby testing the robustness of the target model to the adversarial samples. The technical solution provided by this application can be applied to all applications related to image classification, such as face recognition, picture classification, and person re-identification. This application does not limit this.

[0184] Figure 15 is the structural block diagram of the training device of the substitute model provided by an exemplary embodiment of this application, as Figure 15 shown, the device includes:

[0185] The first generation module 1510 is configured to generate a synthetic image based on the first random noise under the guidance of the first image category embedding features;

[0186] The training module 1520 is configured to train a first surrogate model corresponding to the target model based on the synthetic image and the first classification result (label or probability), where the first classification result is the classification result predicted by the target model for the synthetic image;

[0187] The second generation module 1530 is configured to generate a first adversarial sample from the synthetic image through the first surrogate model;

[0188] The training module 1520 is further configured to retrain the first surrogate model based on the first adversarial sample and the second classification result to obtain a second surrogate model, where the second classification result is the classification result predicted by the target model for the first adversarial sample;

[0189] The second generation module 1530 is further configured to generate a second adversarial sample from the synthetic image through the second surrogate model, and the second adversarial sample is used to test the robustness of the target model.

[0190] In an optional embodiment, the training module 1520 includes:

[0191] The prediction module 1521 is configured to input the first adversarial sample into the first surrogate model for prediction to obtain a predicted classification result;

[0192] The calculation module 1522 is configured to calculate the error loss between the predicted classification result and the second classification result;

[0193] The update module 1523 is configured to update the network parameters of the first surrogate model based on the error loss;

[0194] The output module 1524 is configured to obtain the second surrogate model when the training end condition is met.

[0195] In an optional embodiment, the output module 1524 is further configured to obtain the second surrogate model when the second surrogate model is trained to convergence.

[0196] In an optional embodiment, the output module 1524 is further configured to obtain the second surrogate model when the maximum number of training rounds is reached.

[0197] In an optional embodiment, the second generation module 1530 is further configured to generate a first adversarial sample from the synthetic image based on the network parameters of the first surrogate model through a gradient-based adversarial sample generation strategy.

[0198] In an alternative embodiment, the second generation module 1530 is further configured to generate the synthetic image as a second adversarial sample based on the network parameters of the second surrogate model by means of a gradient-based adversarial sample generation strategy.

[0199] In an alternative embodiment, the first generation module 1510 is further configured to input the first image category embedding feature and the first random noise into a generator to obtain a synthetic image output by the generator.

[0200] In an alternative embodiment, the first generation module 1510 is further configured to train a generator based at least on a first loss function, where the first loss function is used to train the diversity of the synthetic images generated by the generator within the same category.

[0201] In an alternative embodiment, the first generation module 1510 is further configured to train a generator based at least on a second loss function, where the second loss function is used to train the diversity of the synthetic images generated by the generator between different categories.

[0202] In an alternative embodiment, the first generation module 1510 is further configured to train a generator based at least on the first loss function and the second loss function.

[0203] In an alternative embodiment, the apparatus further includes a decoding module 1540.

[0204] In an alternative embodiment, the decoding module 1540 is configured to input the synthetic image output by the generator into a decoder to obtain a second random noise and a second image category embedding feature reversely generated by the decoder.

[0205] In an alternative embodiment, the computing module 1522 is further configured to calculate the first loss function based on the consistency loss between the first random noise and the second random noise and the consistency loss between the first image category embedding feature and the second image category embedding feature.

[0206] In an alternative embodiment, the training module 1520 is further configured to train the generator with the first loss function as a constraint.

[0207] In an alternative embodiment, the computing module 1522 is further configured to calculate the feature mean for each image category of the synthetic images output by the generator through a similarity matrix.

[0208] In an alternative embodiment, the computing module 1522 is further configured to calculate the second loss function with the goal that the distance between the feature means of the synthetic images of different image categories is large enough.

[0209] In an alternative embodiment, the training module 1520 is further configured to train the generator with the second loss function as a constraint.

[0210] It should be noted that: The training device for the substitute model provided in the above embodiments is only illustrated by dividing the above-mentioned functional modules. In actual applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the training device for the substitute model provided in the above embodiments belongs to the same concept as the embodiment of the training method for the substitute model. For the specific implementation process, please refer to the method embodiment and will not be elaborated here.

[0211] In summary, for the device provided in this embodiment, a synthetic image is input into a replaceable model to train a first substitute model. Among them, the first substitute model generates a first adversarial sample, and the first substitute model is trained based on the first adversarial sample to obtain a second substitute model. Among them, the second substitute model generates a second adversarial sample, and the second adversarial sample is used to test the robustness of the target model. In the above solution, the first substitute model is trained using the first adversarial sample, so that the obtained second substitute model can better simulate the decision boundary of the target model, and finally generate an adversarial sample with transferability.

[0212] Among them, the above synthetic image also calculates the consistency loss between the first random noise and the second random noise, and the consistency loss between the first image class embedding feature and the second image class embedding feature through a noise / class regeneration network, obtains a first loss function, and trains the generator with the first loss function as a constraint. The above device not only achieves the goal of data class control, but also ensures the diversity of samples within the synthetic image class.

[0213] Among them, the above synthetic image also calculates the feature mean of the synthetic images of each image class output by the generator through an inter-class diversity constraint network, then calculates a second loss function with the goal that the distance between the feature means of the synthetic images of different image classes is large enough, and finally trains the generator with the second loss function as a constraint. The above device realizes the goal of increasing the inter-class diversity of the synthetic images and ensures the independent distribution of the images of each class in the synthetic images.

[0214] Figure 16The structural block diagram of an electronic device 1600 provided by an exemplary embodiment of the present application is shown. The electronic device 1600 may be a portable mobile terminal, such as: a smart phone, a tablet computer, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer or a desktop computer. The electronic device 1600 may also be referred to by other names such as a user equipment, a portable terminal, a laptop terminal, a desktop terminal, etc.

[0215] Generally, the electronic device 1600 includes: a processor 1601 and a memory 1602.

[0216] The processor 1601 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 1601 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), PLA (Programmable Logic Array). The processor 1601 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the wake state, also known as the CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1601 may be integrated with a GPU (Graphics Processing Unit), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1601 may further include an AI processor, and the AI processor is used to process computational operations related to machine learning.

[0217] The memory 1602 may include one or more computer-readable storage media, and the computer-readable storage media may be non-transitory. The memory 1602 may also include high-speed random access memory, as well as non-volatile memory, such as one or more disk storage devices, flash storage devices. In some embodiments, the non-transitory computer-readable storage media in the memory 1602 is used to store at least one instruction, and the at least one instruction is used to be executed by the processor 1601 to implement the image repair method provided in the method embodiments of the present application.

[0218] In some embodiments, the electronic device 1600 may further optionally include: a peripheral device interface 1603 and at least one peripheral device. The processor 1601, the memory 1602, and the peripheral device interface 1603 may be connected through a bus or signal lines. Each peripheral device may be connected to the peripheral device interface 1603 through a bus, signal lines, or a circuit board. Specifically, the peripheral device includes at least one of a radio frequency circuit 1604, a display screen 1605, a camera assembly 1606, an audio circuit 1607, a positioning assembly 1608, and a power supply 1609.

[0219] The peripheral device interface 1603 can be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 1601 and the memory 1602. In some embodiments, the processor 1601, the memory 1602, and the peripheral device interface 1603 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1601, the memory 1602, and the peripheral device interface 1603 can be implemented on a separate chip or circuit board, and this embodiment does not limit this.

[0220] The radio frequency circuit 1604 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 1604 communicates with a communication network and other communication devices through electromagnetic signals. The radio frequency circuit 1604 converts an electrical signal into an electromagnetic signal for transmission, or converts a received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 1604 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a subscriber identity module card, and so on. The radio frequency circuit 1604 can communicate with other terminals through at least one wireless communication protocol. The wireless communication protocol includes but is not limited to: the World Wide Web, a metropolitan area network, an intranet, each generation of mobile communication networks (2G, 3G, 4G, and 5G), a wireless local area network, and / or a WiFi (Wireless Fidelity) network. In some embodiments, the radio frequency circuit 1604 may further include a circuit related to NFC (Near Field Communication), and this application does not limit this.

[0221] The display screen 1605 is used to display the UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 1605 is a touch display screen, the display screen 1605 also has the ability to collect touch signals on or above the surface of the display screen 1605. The touch signals can be input to the processor 1601 as control signals for processing. At this time, the display screen 1605 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments, there may be one display screen 1605, which is provided on the front panel of the electronic device 1600; in other embodiments, there may be at least two display screens 1605, which are respectively provided on different surfaces of the electronic device 1600 or are in a foldable design; in other embodiments, the display screen 1605 may be a flexible display screen, which is provided on a curved surface or a folding surface of the electronic device 1600. Even, the display screen 1605 can also be set to an irregular non-rectangular shape, that is, an irregular-shaped screen. The display screen 1605 can be prepared using materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).

[0222] The camera module 1606 is used to capture images or videos. Optionally, the camera module 1606 includes a front camera and a rear camera. Generally, the front camera is provided on the front panel of the terminal, and the rear camera is provided on the back of the terminal. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth camera, a wide-angle camera, and a telephoto camera, so as to implement the function of blurring the background by fusing the main camera and the depth camera, the function of panoramic shooting by fusing the main camera and the wide-angle camera, and the VR (Virtual Reality) shooting function or other fused shooting functions. In some embodiments, the camera module 1606 may further include a flash. The flash can be a single-color temperature flash or a two-color temperature flash. A two-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation under different color temperatures.

[0223] The audio circuit 1607 may include a microphone and a speaker. The microphone is used to collect sound waves of the user and the environment, and convert the sound waves into electrical signals for input to the processor 1601 for processing, or input to the radio frequency circuit 1604 to achieve voice communication. For the purpose of stereo collection or noise reduction, there may be multiple microphones, which are respectively arranged at different parts of the electronic device 1600. The microphone may also be an array microphone or an omnidirectional collection microphone. The speaker is used to convert the electrical signal from the processor 1601 or the radio frequency circuit 1604 into sound waves. The speaker may be a traditional thin film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for uses such as ranging. In some embodiments, the audio circuit 1607 may further include a headphone jack.

[0224] The positioning component 1608 is used to locate the current geographical location of the electronic device 1600 to achieve navigation or LBS (Location Based Service). The positioning component 1608 may be a positioning component based on the GPS (Global Positioning System) of the United States, the Beidou system of China, or the Galileo system of Russia.

[0225] The power supply 1609 is used to supply power to each component in the electronic device 1600. The power supply 1609 may be alternating current, direct current, a disposable battery, or a rechargeable battery. When the power supply 1609 includes a rechargeable battery, the rechargeable battery may be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery charged through a wired line, and a wireless rechargeable battery is a battery charged through a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0226] In some embodiments, the electronic device 1600 further includes one or more sensors 1610. The one or more sensors 1610 include but are not limited to: an acceleration sensor 1611, a gyroscope sensor 1612, a pressure sensor 1613, a fingerprint sensor 1614, an optical sensor 1615, and a proximity sensor 1616.

[0227] The acceleration sensor 1611 can detect the magnitude of acceleration on the three coordinate axes of the coordinate system established with the electronic device 1600. For example, the acceleration sensor 1611 can be used to detect the components of the gravitational acceleration on the three coordinate axes. The processor 1601 can control the display screen 1605 to display the user interface in a landscape view or a portrait view according to the gravitational acceleration signal collected by the acceleration sensor 1611. The acceleration sensor 1611 can also be used for game or collection of the user's motion data.

[0228] The gyroscope sensor 1612 can detect the body direction and rotation angle of the electronic device 1600. The gyroscope sensor 1612 can cooperate with the acceleration sensor 1611 to collect the 3D actions of the user on the electronic device 1600. Based on the data collected by the gyroscope sensor 1612, the processor 1601 can implement the following functions: motion sensing (such as changing the UI according to the user's tilting operation), image stabilization during shooting, game control, and inertial navigation.

[0229] The pressure sensor 1613 can be disposed on the side frame of the electronic device 1600 and / or the lower layer of the display screen 1605. When the pressure sensor 1613 is disposed on the side frame of the electronic device 1600, it can detect the holding signal of the user on the electronic device 1600, and the processor 1601 can identify the left or right hand or perform a quick operation according to the holding signal collected by the pressure sensor 1613. When the pressure sensor 1613 is disposed on the lower layer of the display screen 1605, the processor 1601 can control the operable controls on the UI interface according to the pressure operation of the user on the display screen 1605. The operable controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.

[0230] The fingerprint sensor 1614 is used to collect the fingerprint of the user. The processor 1601 can identify the user's identity according to the fingerprint collected by the fingerprint sensor 1614, or the fingerprint sensor 1614 can identify the user's identity according to the collected fingerprint. When the identified user identity is a trusted identity, the processor 1601 authorizes the user to perform relevant sensitive operations, and the sensitive operations include unlocking the screen, viewing encrypted information, downloading software, making payments, and changing settings, etc. The fingerprint sensor 1614 can be disposed on the front, back, or side of the electronic device 1600. When there are physical buttons or a manufacturer logo on the electronic device 1600, the fingerprint sensor 1614 can be integrated with the physical buttons or the manufacturer logo.

[0231] The optical sensor 1615 is used to collect the ambient light intensity. In one embodiment, the processor 1601 can control the display brightness of the display screen 1605 according to the ambient light intensity collected by the optical sensor 1615. Specifically, when the ambient light intensity is high, the display brightness of the display screen 1605 is increased; when the ambient light intensity is low, the display brightness of the display screen 1605 is decreased. In another embodiment, the processor 1601 can also dynamically adjust the shooting parameters of the camera module 1606 according to the ambient light intensity collected by the optical sensor 1615.

[0232] The proximity sensor 1616, also known as the distance sensor, is usually disposed on the front panel of the electronic device 1600. The proximity sensor 1616 is used to collect the distance between the user and the front of the electronic device 1600. In one embodiment, when the proximity sensor 1616 detects that the distance between the user and the front of the electronic device 1600 is gradually decreasing, the processor 1601 controls the display screen 1605 to switch from the lit state to the off state; when the proximity sensor 1616 detects that the distance between the user and the front of the electronic device 1600 is gradually increasing, the processor 1601 controls the display screen 1605 to switch from the off state to the lit state.

[0233] Those skilled in the art can understand that Figure 16 the structure shown in does not constitute a limitation on the electronic device 1600, and it may include more or fewer components than shown, or combine certain components, or adopt a different component arrangement.

[0234] This application also provides a computer-readable storage medium, in which at least one instruction, at least one program segment, a code set or an instruction set is stored, and the at least one instruction, the at least one program segment, the code set or the instruction set is loaded and executed by a processor to implement the training method of the surrogate model provided in the above method embodiment.

[0235] This application provides a computer program product or a computer program, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the training method of the surrogate model provided in the above method embodiment.

[0236] In one embodiment, the synthetic image output by the above generator and the adversarial image output by the surrogate model are stored in the nodes of the data sharing system. Refer to Figure 17The data sharing system shown, the data sharing system 1700 refers to a system for data sharing between nodes. This data sharing system may include multiple nodes 1701, and the multiple nodes 1701 may refer to each client in the data sharing system. Each node 1701 can receive input information during normal operation and maintain the shared data within the data sharing system based on the received input information. To ensure information interconnection within the data sharing system, there may be information connections between each node in the data sharing system, and nodes can transmit information through the above information connections. For example, when any node in the data sharing system receives input information, other nodes in the data sharing system obtain the input information according to the consensus algorithm and store the input information as data in the shared data, so that the data stored on all nodes in the data sharing system is consistent.

[0237] For each node in the data sharing system, there is a corresponding node identifier, and each node in the data sharing system can store the node identifiers of other nodes in the data sharing system, so as to broadcast the generated block to other nodes in the data sharing system according to the node identifiers of other nodes later. Each node can maintain a node identifier list as shown in the following table, and store the node name and node identifier in the node identifier list correspondingly. Among them, the node identifier can be an IP (Internet Protocol) address and any other information that can be used to identify the node. Only the IP address is used as an example in Table 1 for illustration.

[0238] Table 1

[0239] Node Name Node Identifier Node 1 117.114.151.174 Node 2 117.116.189.145 … … Node N 119.123.789.258

[0240] Each node in the data sharing system stores an identical blockchain. The blockchain consists of multiple blocks. Refer to Figure 18 , the blockchain consists of multiple blocks. The genesis block includes a block header and a block body. The block header stores the input information feature value, version number, timestamp, and difficulty value, and the block body stores the input information; the next block of the genesis block uses the genesis block as the parent block, and the next block also includes a block header and a block body. The block header stores the input information feature value of the current block, the block header feature value of the parent block, version number, timestamp, and difficulty value, and so on, so that the block data stored in each block in the blockchain is associated with the block data stored in the parent block, ensuring the security of the input information in the block.

[0241] When generating each block in the blockchain, refer to Figure 19When the node where the blockchain is located receives the input information, it verifies the input information. After the verification is completed, the input information is stored in the memory pool, and its hash tree for recording the input information is updated. Then, the update timestamp is updated to the time when the input information is received, and different random numbers are tried, and the eigenvalue calculation is performed multiple times so that the calculated eigenvalue can satisfy the following formula:

[0242] SHA256(SHA256(version+prev_hash+merkle_root+ntime+nbits+x))<TARGET

[0243] Among them, SHA256 is the eigenvalue algorithm used to calculate the eigenvalue; version (version number) is the version information of the relevant block protocol in the blockchain; prev_hash is the block header eigenvalue of the parent block of the current block; merkle_root is the eigenvalue of the input information; ntime is the update time of the update timestamp; nbits is the current difficulty, which is a fixed value within a period of time and is determined again after exceeding the fixed time period; x is a random number; TARGET is the eigenvalue threshold, and this eigenvalue threshold can be determined according to nbits.

[0244] In this way, when a random number that satisfies the above formula is calculated, the information can be correspondingly stored to generate a block header and a block body, and the current block is obtained. Subsequently, the node where the blockchain is located sends the newly generated block to other nodes in the data sharing system where it is located according to the node identifiers of other nodes in the data sharing system. Other nodes verify the newly generated block, and after the verification is completed, add the newly generated block to the blockchain they store.

[0245] The serial numbers of the embodiments of the present application above are only for description and do not represent the advantages or disadvantages of the embodiments.

[0246] Those of ordinary skill in the art can understand that all or part of the steps of implementing the above embodiments can be completed by hardware, or can be completed by a program instructing related hardware. The program can be stored in a computer-readable storage medium. The storage medium mentioned above can be a read-only memory, a disk or an optical disc, etc.

[0247] The above are only optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A training method for a surrogate model, characterized in that, The method includes: generating a synthetic image based on first random noise under the guidance of the first image category embedding feature; training a first surrogate model corresponding to the target model based on the synthetic image and the first classification result, where the first classification result is the classification result predicted by the target model for the synthetic image; generating a first adversarial sample from the synthetic image through the first surrogate model; retraining the first surrogate model to obtain a second surrogate model based on the first adversarial sample and the second classification result, where the second classification result is the classification result predicted by the target model for the first adversarial sample; generating a second adversarial sample from the synthetic image through the second surrogate model, and the second adversarial sample is used to test the robustness of the target model.

2. The method according to claim 1, characterized in that, The retraining the first surrogate model to obtain a second surrogate model based on the first adversarial sample and the second classification result includes: inputting the first adversarial sample into the first surrogate model for prediction to obtain a predicted classification result; calculating the error loss between the predicted classification result and the second classification result; updating the network parameters of the first surrogate model based on the error loss; obtaining the second surrogate model when the training end condition is satisfied.

3. The method according to claim 2, characterized in that The obtaining the second surrogate model when the training end condition is satisfied includes: obtaining the second surrogate model when the second surrogate model is trained to convergence; or, obtaining the second surrogate model when the maximum number of training rounds is reached.

4. The method according to any one of claims 1 to 3, characterized in that The generating a first adversarial sample from the synthetic image through the first surrogate model includes: generating the first adversarial sample from the synthetic image based on the network parameters of the first surrogate model through a gradient-based adversarial sample generation strategy.

5. The method according to any one of claims 1 to 3, characterized in that The generating a second adversarial sample from the synthetic image through the second surrogate model includes: generating the second adversarial sample from the synthetic image based on the network parameters of the second surrogate model through a gradient-based adversarial sample generation strategy.

6. The method according to any one of claims 1 to 3, characterized in that The generating a synthetic image based on first random noise under the guidance of the first image category embedding feature includes: inputting the first image category embedding feature and the first random noise into a generator to obtain the synthetic image output by the generator.

7. The method according to claim 6, characterized in that, The method further includes: training the generator at least based on a first loss function for training the diversity of the synthetic images generated by the generator within the same category; or, training the generator at least based on a second loss function for training the diversity of the synthetic images generated by the generator between different categories; or, training the generator at least based on the first loss function and the second loss function.

8. The method according to claim 7, wherein The training the generator based on the first loss function includes: inputting the synthetic image output by the generator into a decoder to obtain a second random noise and a second image category embedding feature reversely generated by the decoder; Calculate the first loss function based on the consistency loss between the first random noise and the second random noise, and the consistency loss between the first image category embedding feature and the second image category embedding feature; Train the generator with the first loss function as a constraint.

9. The method according to claim 7, wherein The training of the generator based on the second loss function includes: Calculate the feature mean of each synthesized image output by the generator through a similarity matrix; Calculate the second loss function with the goal that the distance between the feature means of the synthesized images of different image categories is large enough; Train the generator with the second loss function as a constraint.

10. A training device for a substitute model, characterized in that The device includes: A first generation module for generating a synthesized image based on the first random noise under the guidance of the first image category embedding feature; A training module for training a first surrogate model corresponding to the target model based on the synthesized image and the first classification result (label or probability), where the first classification result is the classification result predicted by the target model for the synthesized image; A second generation module for generating a first adversarial sample from the synthesized image through the first surrogate model; The training module is further configured to retrain the first surrogate model to obtain a second surrogate model based on the first adversarial sample and the second classification result, where the second classification result is the classification result predicted by the target model for the first adversarial sample; The second generation module is further configured to generate a second adversarial sample from the synthesized image through the second surrogate model, and the second adversarial sample is used to test the robustness of the target model.

11. The device according to claim 10, characterized in that, The training module includes: A prediction module for inputting the first adversarial sample into the first surrogate model for prediction to obtain a predicted classification result; A calculation module for calculating the error loss between the predicted classification result and the second classification result; An update module for updating the network parameters of the first surrogate model based on the error loss; An output module for obtaining the second surrogate model when the training end condition is met.

12. The device according to claim 11, wherein The output module is further configured to obtain the second surrogate model when the second surrogate model is trained to convergence; The output module is further configured to obtain the second surrogate model when the maximum number of training rounds is reached.

13. The device according to any one of claims 10 to 12, wherein The second generation module is further configured to generate the first adversarial sample from the synthesized image based on the network parameters of the first surrogate model through a gradient-based adversarial sample generation strategy.

14. A computer device, characterized in that, The computer device includes: a processor and a memory, the memory stores a computer program, and the computer program is loaded and executed by the processor to implement the training method of the surrogate model according to any one of claims 1 to 9.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which is loaded and executed by a processor to implement the training method of the substitute model according to any one of claims 1 to 9.

Images