Attack image detection model training method and device, and computer device

Abstract

The application relates to an attack image detection model training method and device and a computer device. The method comprises the following steps: acquiring a suspected attack image set, clustering the suspected attack image set to obtain a plurality of clustering suspected attack image sets; determining a target clustering image set based on the plurality of clustering suspected attack image sets, taking the target clustering image set as a training attack image set, and extracting an attack feature region image based on a training attack image in the training attack image set; acquiring a to-be-attacked image, fusing the to-be-attacked image and the attack feature region image to obtain a target training attack image; acquiring an attack image detection model to be updated, updating and training the attack image detection model to be updated based on the target training attack image, obtaining an updated attack image detection model when an update training completion condition is reached, and using the updated attack image detection model to detect an input image. The method can improve the accuracy of attack image detection.

Description

Technical Field

[0001] This application relates to the field of deep learning technology, and in particular to an attack image detection method, apparatus, computer device, storage medium, and computer program product. Background Technology

[0002] With the development of artificial intelligence (AI) technology, it has been widely applied in identity verification scenarios. For example, by sending a set of numbers to a user's client and having the user read them aloud, a recording of the user's readings is obtained. Deep learning algorithms are then used to perform face detection on the readings to determine if the user is the correct person. However, existing deep learning algorithms are not effective against attacks during face detection. Attacks refer to adding perturbations or interference to the image to be detected to generate malicious images that cause the detection model to make false detections, resulting in low accuracy in detecting malicious images. Summary of the Invention

[0003] Therefore, it is necessary to provide an attack image detection model training method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the accuracy of attack image detection by addressing the above-mentioned technical problems.

[0004] Firstly, this application provides a method for training an attack image detection model. The method includes:

[0005] Obtain a set of suspected attack images, cluster the suspected attack image set, and obtain the suspected attack image set of each cluster;

[0006] The target cluster image set is determined based on each cluster of suspected attack image sets. The target cluster image set is used as the training attack image set. Attack feature region images are extracted based on the training attack images in the training attack image set.

[0007] The image to be attacked is obtained, and the image to be attacked is fused with the image of the attack feature region to obtain the target training attack image;

[0008] Obtain the attack image detection model to be updated. Based on the target training attack image, update the attack image detection model to be updated. When the update training completion condition is met, the updated attack image detection model is obtained. The updated attack image detection model is used to detect attack images on the input image.

[0009] Secondly, this application also provides an attack image detection model training device. The device includes:

[0010] The clustering module is used to obtain a set of suspected attack images, cluster the set of suspected attack images, and obtain each cluster of suspected attack image sets.

[0011] The region extraction module is used to determine the target cluster image set based on each cluster of suspected attack image sets, use the target cluster image set as the training attack image set, and extract attack feature region images based on the training attack images in the training attack image set.

[0012] The fusion module is used to acquire the image to be attacked and fuse it with the image of the attack feature region to obtain the target training attack image;

[0013] The update module is used to obtain the attack image detection model to be updated. Based on the target training attack image, the attack image detection model to be updated is trained. When the update training completion condition is met, the updated attack image detection model is obtained. The updated attack image detection model is used to detect attack images on the input image.

[0014] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0015] Obtain a set of suspected attack images, cluster the suspected attack image set, and obtain the suspected attack image set of each cluster;

[0016] The target cluster image set is determined based on each cluster of suspected attack image sets. The target cluster image set is used as the training attack image set. Attack feature region images are extracted based on the training attack images in the training attack image set.

[0017] The image to be attacked is obtained, and the image to be attacked is fused with the image of the attack feature region to obtain the target training attack image;

[0018] Obtain the attack image detection model to be updated. Based on the target training attack image, update the attack image detection model to be updated. When the update training completion condition is met, the updated attack image detection model is obtained. The updated attack image detection model is used to detect attack images on the input image.

[0019] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0020] Obtain a set of suspected attack images, cluster the suspected attack image set, and obtain the suspected attack image set of each cluster;

[0021] The target cluster image set is determined based on each cluster of suspected attack image sets. The target cluster image set is used as the training attack image set. Attack feature region images are extracted based on the training attack images in the training attack image set.

[0022] The image to be attacked is obtained, and the image to be attacked is fused with the image of the attack feature region to obtain the target training attack image;

[0023] A new attack image detection model is obtained. Based on the target training attack image, the model is updated and trained. When the update training completion condition is met, an updated attack image detection model is obtained. This updated model is used to detect attack images on input images. Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0024] Obtain a set of suspected attack images, cluster the suspected attack image set, and obtain the suspected attack image set of each cluster;

[0025] The target cluster image set is determined based on each cluster of suspected attack image sets. The target cluster image set is used as the training attack image set. Attack feature region images are extracted based on the training attack images in the training attack image set.

[0026] The image to be attacked is obtained, and the image to be attacked is fused with the image of the attack feature region to obtain the target training attack image;

[0027] Obtain the attack image detection model to be updated. Based on the target training attack image, update the attack image detection model to be updated. When the update training completion condition is met, the updated attack image detection model is obtained. The updated attack image detection model is used to detect attack images on the input image.

[0028] The aforementioned attack image detection model training method, apparatus, computer equipment, storage medium, and computer program product cluster suspected attack images to obtain sets of suspected attack images for each cluster. Then, a target cluster image set is determined from each set of suspected attack images. This target cluster image set is used as the training attack image set, and attack feature region images are extracted from the training attack images. These attack feature region images are then fused with the image to be attacked to obtain the target training attack image, thereby increasing the number and diversity of samples for the attack image detection model. Furthermore, using the target training attack image to update and train the attack image detection model can improve the accuracy of the model in detecting suspected attack images, thus improving the overall accuracy of attack image detection. Attached Figure Description

[0029] Figure 1 This is a diagram illustrating the application environment of an attack image detection model training method in one embodiment.

[0030] Figure 2 This is a flowchart illustrating the training method for an attack image detection model in one embodiment;

[0031] Figure 3 This is a schematic diagram of the attack feature region in one embodiment;

[0032] Figure 4 This is a schematic diagram illustrating the training process of an initial attack image detection model in one embodiment.

[0033] Figure 5 This is a schematic diagram of the attack image detection process in one embodiment;

[0034] Figure 6 This is a structural block diagram of an attack image detection model training device in one embodiment;

[0035] Figure 7 This is an internal structural diagram of a computer device in one embodiment;

[0036] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0038] The attack image detection model training method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Server 104 acquires a set of suspected attack images, clusters these images to obtain individual clusters of suspected attack images, determines a target cluster image set based on these clusters, uses the target cluster image set as a training attack image set, and extracts attack feature region images from the training attack images in the training attack image set. Server 104 can acquire an image to be attacked through terminal 102, fuses the image to be attacked with the attack feature region images, and obtains a target training attack image. Server 104 acquires an attack image detection model to be updated, updates and trains the model based on the target training attack image, and obtains an updated attack image detection model when the update training is completed. This updated attack image detection model is used to detect attack images on input images. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0039] In one embodiment, such as Figure 2 As shown, a method for training an attack image detection model is provided, which is then applied to... Figure 1 Taking a server as an example, it can be understood that this method can also be applied to a terminal, and also to a system that includes both a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0040] Step 202: Obtain a set of suspected attack images, and cluster the set of suspected attack images to obtain each cluster of suspected attack image sets.

[0041] The suspected attack image set refers to the set of images where the probability of detecting an image as an attack image reaches a certain level of suspicion. The suspicion level is a pre-set threshold representing the likelihood that an image is a suspected attack image. An attack image refers to an image subjected to adversarial attacks. An adversarial attack is a technique that applies perturbations to images to cause incorrect classification and recognition. Clustering refers to dividing a dataset into different classes or clusters according to a specific criterion. Clustered suspected attack images refer to the image set obtained by clustering the suspected attack image set.

[0042] Specifically, the server can obtain a set of suspected attack images from the data storage space, a set of suspected attack images sent by the terminal, or a set of suspected attack images provided by the business server. The server can cluster the suspected attack images in the suspected attack image set according to the attack type, resulting in clustered suspected attack image sets composed of the suspected attack images after each category. The attack type can refer to the method of generating the attack images.

[0043] Step 204: Determine the target cluster image set based on the various clustered suspected attack image sets, use the target cluster image set as the training attack image set, and extract attack feature region images based on the training attack images in the training attack image set.

[0044] The target clustering image set refers to the clustered suspected attack image set that provides attack image samples. The training attack images refer to the attack image samples used during training; these samples are used to update and train the attack image detection model. The attack feature region images refer to the local images corresponding to pre-defined feature extraction regions in the training attack images, used to generate attack image samples.

[0045] Specifically, the server counts the number of suspected attack images in each cluster of suspected attack image sets. Based on the number of suspected attack images, a target cluster image set is determined within each cluster of suspected attack image sets. This target cluster image set is used as the training attack image set. Then, a preset feature point detection algorithm is used to detect the feature points corresponding to each training attack image in the training attack image set. Attack feature region images corresponding to each training attack image are extracted based on the feature points. The size of the extracted attack feature region images is predetermined; all attack feature region images can have the same size or different sizes. In one embodiment, the size of the attack feature region image can be determined according to a preset ratio between the attack feature region image size and the overall image size, or it can be determined according to a preset relationship between the area of ​​the attack feature region image and the area of ​​the overall image.

[0046] Step 206: Obtain the image to be attacked, and fuse the image to be attacked with the attack feature region image to obtain the target training attack image.

[0047] The image to be attacked refers to the image fused with images of the attack feature regions, used to generate attack image samples. The target training attack image refers to the fused image, which serves as the attack image sample.

[0048] Specifically, the server can obtain the set of images to be attacked from the data storage space, the set of images to be attacked sent by the terminal, or the set of images to be attacked provided by the business server. The server uses a preset feature point detection algorithm to detect feature points in the image to be attacked, determines the region to be fused with the attack feature region image based on the feature points in the image to be attacked, and then fuses the attack feature region image into this region to obtain the target training attack image.

[0049] Step 208: Obtain the attack image detection model to be updated. Based on the target training attack image, update the attack image detection model to be updated. When the update training completion condition is met, the updated attack image detection model is obtained. The updated attack image detection model is used to detect attack images on input images.

[0050] The "attack image detection model to be updated" refers to the attack image detection model that needs updating. This model is used to detect whether an image to be detected is a real image or an attack image. The "preset update training completion condition" refers to the pre-set criteria for determining whether the attack image detection model to be updated has been completed. The "updated attack image detection model" refers to the updated attack image detection model.

[0051] Specifically, the server can retrieve the attack image detection model to be updated from the data storage system, and obtain the training labels corresponding to the target training attack image. These training labels can be pre-labeled. The server uses the target training attack image and its corresponding training labels to update and train the attack image detection model, obtaining the updated training result. When the updated training result does not meet the update training completion condition, the attack image detection model is iteratively updated until the updated training result meets the update training completion condition, resulting in the updated attack image detection model. The update training completion condition can be that the loss result of the attack image detection model to be updated reaches a preset loss threshold or the number of iterations reaches a preset iteration threshold, etc. The server can then use the updated image detection model to perform attack image detection on the image to be detected.

[0052] In the aforementioned attack image detection model training method, suspected attack images are clustered to obtain sets of suspected attack images for each cluster. Then, a target cluster image set is determined from each cluster of suspected attack images. This target cluster image set is used as the training attack image set, and attack feature region images are extracted from the training attack images. These attack feature region images are then fused with the image to be attacked to obtain the target training attack image, thereby increasing the number and diversity of samples for the attack image detection model. Furthermore, using the target training attack image to update and train the attack image detection model can improve the accuracy of the model in detecting suspected attack images, thus improving the overall accuracy of attack image detection.

[0053] In one embodiment, step 202, obtaining a set of suspected attack images, includes:

[0054] Acquire the target image, perform attack image detection on the target image based on the attack image detection model to be updated, and obtain the degree of certainty of the attack image corresponding to the target image;

[0055] When the degree of certainty of the attack image corresponding to the target image meets the preset criteria for judging a suspected attack image, the target image is included as a suspected attack image in the set of suspected attack images.

[0056] The target image is the image used for attack image detection. Attack image certainty refers to the degree of certainty that the attack image detection model to be updated determines the image to be detected as an attack image; it can be the probability that the image to be detected is an attack image. Preset suspected attack image judgment conditions refer to the pre-set judgment conditions for whether the target image is a suspected attack image.

[0057] Specifically, the server can collect user reading video data via a terminal. This reading video data represents a video file of the user reading out a digit, sent to the user client for user authentication. The server splits the video data frame by frame to obtain at least one target image frame. Alternatively, the server can acquire the user's facial image via the user terminal as the target image. The server inputs the acquired target image into an attack image detection model to detect attacks and obtains the attack image confirmation level corresponding to the target image. The server obtains a pre-set range of suspected attack image confirmation levels, which can be a probability range. When the server detects that the attack image confirmation level corresponding to the target image is within this range, it determines that the target image meets the pre-set suspected attack image judgment criteria and designates it as a suspected attack image. The server then uses at least one suspected attack image as a suspected attack image set. The server can pre-establish a suspected attack image database to store suspected attack images, including suspected attack images detected over historical time periods.

[0058] In one embodiment, the lower limit of the range of suspected attack image confirmation can be the confirmation threshold of the attack image detection model in determining that the target image is an attack image. Then, the range of suspected attack image confirmation represents the non-affirmative region in which the attack image detection model determines that the target image is an attack image. Target images in this region are confirmed as suspected attack images, for example, 50%-80%. 50% is the confirmation threshold of the attack image detection model in determining that the target image is an attack image, 0-50% is the negative region in which the attack image detection model determines that the target image is an attack image, and 80%-100% is the affirmative region in which the attack image detection model determines that the target image is an attack image.

[0059] In one embodiment, the server acquires a set of target images within the current time period, inputs the target image set into an attack image detection model to detect attack images, obtains the attack image confirmation degree corresponding to each target image in the target image set, identifies suspected attack images among each target image based on the range of attack image confirmation degree, stores each suspected attack image in a suspected attack image database, and clusters all suspected attack images in the suspected attack image database according to attack type, obtaining each cluster of suspected attack image sets. The server can use the K-means algorithm for image clustering, and different clusters of suspected attack image sets correspond to different attack types, such as suspected attack images of screenshot type, suspected attack images of color difference type, suspected attack images of blurred contour edges, etc. The server counts the number of suspected attack images corresponding to each cluster of suspected attack image sets, and selects the cluster of suspected attack image sets with the fewest suspected attack images as the target cluster of suspected attack image sets. Alternatively, the server can calculate the average probability of attack images corresponding to each cluster of suspected attack image sets, and select the cluster of suspected attack image sets with the lowest average probability as the target cluster of suspected attack image sets. The server can also determine the target cluster image set based on the labels of each cluster of suspected attack image sets. The labels of each cluster of suspected attack image sets can be pre-set.

[0060] In this embodiment, when the attack image detection model detects a certain type of attack image with few or no training samples, the confirmation level of the detected attack image will be close to the confirmation level threshold, indicating that the attack image detection model has a low confirmation level for that type of attack image. Therefore, by setting a confirmation level range for suspected attack images, it is possible to obtain certain types of attack images in the target image that have few or no training samples for the attack image detection model to be updated. This increases the diversity of the training samples for the attack image detection model, avoids missed detection of certain types of attack images with few or no training samples, and thus improves the accuracy of attack image detection.

[0061] In one embodiment, step 204, extracting attack feature region images based on training attack images in the training attack image set, includes:

[0062] Feature point detection is performed on the training attack image to obtain the coordinates of the attack feature points;

[0063] Determine attack feature regions in training attack images based on feature point coordinates;

[0064] Extract the image data corresponding to the attack feature regions from the training attack images to obtain the attack feature region images.

[0065] Feature point detection refers to the detection of feature points representing the attack region in the training attack image. Attack feature point coordinates refer to the position coordinates of the feature points in the training attack image. Attack feature region refers to a local region in the training attack image.

[0066] Specifically, the training attack image can be a face image. The server uses a face recognition algorithm to detect attack feature points in the training attack image. The face recognition algorithm can be DBFace (a lightweight face recognition algorithm), and the attack feature points can be the facial key points corresponding to the training attack image. The face recognition algorithm outputs the face bounding box and the coordinates of the attack feature points corresponding to the training attack image. The server determines the attack feature region based on the face bounding box and the coordinates of the attack feature points. The attack feature region can be the mouth region in the face image of the training attack image. The image data corresponding to the attack feature region in the training attack image is extracted to obtain the attack feature region image, i.e., the mouth region image.

[0067] In one specific embodiment, such as Figure 3 As shown, a schematic diagram of an attack feature region is provided; Figure 3 -A represents the face bounding box and facial landmarks output by the face recognition algorithm, indicated by numbers in the diagram. Figure 3 -B indicates targeting the mouth region. The server uses a rectangle to capture the mouth region, setting the top-left corner coordinates as (x, y) and the bottom-right corner coordinates as (m, n). The server uses the x-coordinate of keypoint 4 on the right side of the mouth as the x-coordinate of the top-left corner of the mouth region, and the y-coordinate of the midpoint between keypoints 3 and 4 on the nose as the y-coordinate of the top-left corner of the mouth region. The server uses the x-coordinate of keypoint 5 on the left side of the mouth as the m-coordinate of the bottom-right corner of the mouth region, and the y-coordinate of the position of keypoint 5 relative to the bottom-right corner of the face frame 0 as the n-coordinate of the bottom-right corner of the mouth region. Due to the deviation of keypoints in the mouth region, the server obtains a pre-set offset, which can be represented by b. Therefore, the top-left corner coordinates of the mouth region are (xb, y), and the bottom-right corner coordinates are (m+b, n).

[0068] In this embodiment, by determining the attack feature region in the training attack image using the coordinates of feature points, the mouth region image in the training attack image can be completely extracted, thereby enabling the accurate generation of the target training attack image based on the mouth region image.

[0069] In one embodiment, step 206 involves fusing the image to be attacked with the image of the attack feature region to obtain a target training attack image, including:

[0070] Feature point detection is performed on the image to be attacked to obtain the coordinates of the feature points to be attacked.

[0071] Determine the target feature region in the target image based on the coordinates of the target feature points;

[0072] Calculate the size of the feature region to be attacked, and adjust the size of the attack feature region image based on the size of the feature region to be attacked to obtain the target attack feature region image.

[0073] The target attack feature region image is fused into the feature region to be attacked to obtain the target training attack image.

[0074] Here, "image to be attacked" refers to a real image. "Coordinates of the feature point to be attacked" refers to the position coordinates of the feature point within the image to be attacked. "Feature region to be attacked" refers to a local region within the image to be attacked. "Target attack feature region image" refers to the resized image of the attack feature region, with the dimensions corresponding to the target attack feature region being identical to those of the feature region to be attacked.

[0075] Specifically, the image to be attacked can be a face image. The server can obtain the image from a face database. Then, the server uses a face recognition algorithm to detect the target feature points in the image. These target feature points can be facial key points corresponding to the face in the image. The face recognition algorithm outputs the corresponding face bounding box and the coordinates of the target feature points. The server determines the target feature region based on the face bounding box and the coordinates of the target feature points. The target feature region can be the mouth area in the face image of the image to be attacked. Then, the server calculates the size of the target feature region in the image to be attacked, which can be calculated using the coordinates of the upper left and lower right corners of the target feature region. Then, the server resizes the attack feature region image according to the size of the target feature region to obtain the target attack feature region image. The server can use bilinear interpolation to scale or enlarge the attack feature region image to make the size of the target attack feature region image consistent with the size of the target feature region. Finally, the server embeds the attack feature region image into the target feature region, for example, by replacing the pixel values ​​in the target feature region with the pixel values ​​corresponding to the attack feature region image, to obtain the target training attack image. The server can also embed the same attack feature region image into the attack feature region of multiple images to be attacked, thus obtaining multiple target training attack images.

[0076] In this embodiment, the target feature region is determined in the image to be attacked by the coordinates of feature points, and the size of the attack feature region image is adjusted according to the size of the target feature region. The target attack feature region image is fused into the target feature region, which can obtain a large number of target training attack images corresponding to suspected attack images. By using the target training attack images to update the attack image detection model to be updated, the accuracy of attack image detection can be improved.

[0077] In one embodiment, such as Figure 4 The diagram illustrates a flowchart for training an initial attack image detection model; before obtaining the suspected attack image set in step 202, the process further includes:

[0078] Step 402, obtain the pre-trained network;

[0079] Step 404: Establish an initial attack image detection model based on the pre-trained network;

[0080] Step 406: Obtain training images and training labels, input the training images into the initial attack image detection model to detect attack images, and obtain the initial recognition results;

[0081] Step 408: Calculate the loss based on the initial recognition results and training labels to obtain model loss information. Update the initial attack image detection model based on the loss information to obtain the updated attack image detection model.

[0082] Step 410: The updated attack image detection model is used as the initial attack image detection model. The training image and training label are returned. The training image is input into the initial attack image detection model to obtain the initial recognition result. The steps are executed iteratively until the training completion condition is met, and the target attack image detection model is obtained.

[0083] Step 412: When the target attack image detection model is detected to meet the update conditions, the target attack image detection model is used as the attack image detection model to be updated.

[0084] Here, "pre-trained network" refers to a pre-trained network model. "Initial attack image detection model" refers to an attack image detection model built using initial parameters. "Training images" are images used to update and train the initial attack image detection model, and can include both attack images and real images. "Training labels" are the label information corresponding to the categories of the training images, including attack image labels and non-attack image labels. "Initial recognition result" refers to the detection result output by the initial attack image detection model after detecting the training images. "Model loss information" refers to the deviation information between the initial recognition result and the actual result. "Updated attack image detection model" refers to the attack image detection model after parameter updates. "Target attack image detection model" refers to the attack image detection model that can be used after training.

[0085] Specifically, the server obtains a pre-trained network, which can be a face detection model and an object detection model. The server can replace the backbone network in the object detection model with the backbone network in the face detection model, and use the replaced object detection model as the initial attack image detection model. The object detection model can be YOLO v5 (You Only Look Once, an object detection algorithm), and the face detection model can be YOLO v5-face. The initial attack image detection model is used to detect whether the input image is an attack image.

[0086] The server retrieves pre-stored training images and training labels, inputs the training images into the initial attack image detection model, and obtains initial recognition results, including the classification results corresponding to the training images. Then, the server calculates the loss using a loss function based on the classification results and training labels, obtaining the model loss information for the initial attack image detection model. The server updates the initial parameters of the initial attack image detection model based on the loss information, obtaining an updated attack image detection model. The server then uses the updated attack image detection model as the initial attack image detection model and performs iterative training using the above steps. When the model loss information of the updated attack image detection model is detected to be less than a preset threshold, the training is considered complete, and the target attack image detection model is obtained.

[0087] Then the server obtains the image to be detected uploaded by the user and inputs it into the target attack image detection model for detection. The detection continues until the number of detections corresponding to the target attack image detection model reaches a preset threshold or the detection accuracy of the target attack image detection model drops to a preset accuracy threshold. At this point, the target attack image detection model meets the update conditions and is used as the target attack image detection model to be updated for training.

[0088] In this embodiment, by replacing the backbone network of the target detection model with the backbone network of the face detection model, and using the replaced target detection model as the initial attack image detection model for training, the detection speed of the target attack image detection model in determining whether a face image is an attack image can be improved, thereby increasing the training speed of the attack image detection model.

[0089] In one embodiment, in step 208, the attack image detection model to be updated is updated based on the target training attack image. After the update training is completed and the updated attack image detection model is obtained, the method further includes:

[0090] The image to be detected is acquired, and the attack image detection model is updated to detect the attack image in the image to be detected, thereby obtaining the degree of certainty of the attack image corresponding to the image to be detected.

[0091] When the degree of certainty of the attack image corresponding to the image to be detected reaches the preset attack threshold, the image to be detected is determined to be an attack image.

[0092] Here, the image to be detected refers to the image that needs to be detected as an attack image, determining whether the image to be detected is a real image or an attack image. The preset attack threshold is a pre-set threshold for determining whether the image to be detected is an attack image.

[0093] Specifically, the server obtains the image to be detected uploaded by the user, inputs the image to be detected into the updated attack image detection model for attack image detection, obtains the degree of certainty of the attack image corresponding to the image to be detected, compares the degree of certainty of the attack image corresponding to the image to be detected with a preset attack threshold, and determines the image to be detected as an attack image when the degree of certainty of the attack image corresponding to the image to be detected reaches the preset attack threshold.

[0094] In one embodiment, the server can obtain user-uploaded facial reading video data through a user terminal. This uploaded facial reading video data is used for identity verification. The server splits the facial reading video data into multiple frames of images to be detected, and inputs each frame into an updated attack image detection model for attack image detection. When an attack image is detected, the server determines that the user-uploaded facial reading video data is fake and returns an identity verification failure message to the user terminal. An attack image refers to an image that forges the mouth area during facial reading detection. For example, a forger uses a static image of the victim's face (such as an ID photo) and overlays each frame of the forger's mouth reading video onto the victim's mouth area, creating the illusion that the victim is taking a reading. Based on the generalization ability of the attack image detection model, other non-compliant facial images can also be detected, such as those containing masks, face masks, or labels around the mouth, which are non-compliant in facial reading liveness detection.

[0095] In this embodiment, by using an updated attack image detection model to detect attack images uploaded by users, or to detect attacks on reading video data uploaded by users, the ability to verify user identity can be improved.

[0096] In one specific embodiment, such as Figure 5The diagram illustrates a process for attack image detection. The server can obtain an image to be attacked from a face database and suspected attack images from a database of suspected attack images. Alternatively, the server can obtain suspected attack images directly from the face database. The server uses a face detection algorithm to detect facial landmarks in both the image to be attacked and the suspected attack images. Then, it determines the mouth region in both images and obtains the mouth region image from the suspected attack image. The server overlays the mouth region image from the suspected attack image onto the mouth region in the image to be attacked, resulting in an attack image. The server can overlay the mouth region images from multiple suspected attack images onto the mouth regions in multiple images to be attacked, resulting in an attack image set. The server uses this attack image set as the target training attack image set and randomly selects at least one real face image from the face database as the training normal image set. The server uses the target training attack image set and the training normal image set as training images for the target detection model and trains the model using the training images, resulting in a trained target detection model.

[0097] The server obtains the image to be detected uploaded by the user, inputs the image to be detected into the trained target detection model to detect the attack image. When the probability of the attack image corresponding to the image to be detected is within the range of the probability of the suspected attack image, the image to be detected is regarded as the suspected attack image and stored in the suspected attack image database.

[0098] When the trained target detection model is detected to have met the update conditions, it is used as the target detection model to be updated. Image clustering is then performed on all suspected attack images in the suspected attack image database to obtain sets of suspected attack images for each cluster. The cluster with the fewest suspected attack images is selected as the target cluster image, and the image to be attacked is obtained. The process then returns to the server to iterate through the step of retrieving suspected attack images from the face database until the target detection model to be updated is trained and updated, resulting in the updated target detection model. Alternatively, the server can obtain suspected attack images from external databases or other means and store them in the suspected attack image database.

[0099] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0100] Based on the same inventive concept, this application also provides an attack image detection model training apparatus for implementing the attack image detection model training method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the attack image detection model training apparatus provided below can be found in the limitations of the attack image detection model training method described above, and will not be repeated here.

[0101] In one embodiment, such as Figure 6 As shown, an attack image detection model training device 600 is provided, including: a clustering module 602, a region extraction module 604, a fusion module 606, and an update module 608, wherein:

[0102] Clustering module 602 is used to acquire a set of suspected attack images, cluster the set of suspected attack images, and obtain each cluster of suspected attack image sets.

[0103] The region extraction module 604 is used to determine the target cluster image set based on each cluster of suspected attack image sets, use the target cluster image set as the training attack image set, and extract attack feature region images based on the training attack images in the training attack image set.

[0104] The fusion module 606 is used to acquire the image to be attacked and fuse it with the image of the attack feature region to obtain the target training attack image;

[0105] The update module 608 is used to obtain the attack image detection model to be updated. Based on the target training attack image, the attack image detection model to be updated is trained. When the update training completion condition is met, the updated attack image detection model is obtained. The updated attack image detection model is used to detect attack images on the input image.

[0106] In one embodiment, clustering module 602 includes:

[0107] The judgment unit is used to acquire the target image, perform attack image detection on the target image based on the attack image detection model to be updated, and obtain the attack image certainty degree corresponding to the target image; when the attack image certainty degree corresponding to the target image meets the preset suspected attack image judgment condition, the target image is regarded as a suspected attack image in the suspected attack image set.

[0108] In one embodiment, the region extraction module 604 includes:

[0109] The region determination unit is used to detect feature points based on the training attack image to obtain the coordinates of the attack feature points; determine the attack feature region in the training attack image based on the coordinates of the feature points; and extract the image data corresponding to the attack feature region in the training attack image to obtain the attack feature region image.

[0110] In one embodiment, the fusion module 606 includes:

[0111] The region fusion unit is used to detect feature points based on the image to be attacked and obtain the coordinates of the feature points to be attacked; determine the feature regions to be attacked in the image to be attacked based on the coordinates of the feature points to be attacked; calculate the size of the feature regions to be attacked and adjust the size of the attack feature region image based on the size of the feature regions to be attacked to obtain the target attack feature region image; and fuse the target attack feature region image into the feature regions to be attacked to obtain the target training attack image.

[0112] In one embodiment, the attack image detection model training device 600 further includes:

[0113] Training units are used to acquire pre-trained networks;

[0114] An initial attack image detection model is established based on a pre-trained network. Training images and training labels are acquired, and the training images are input into the initial attack image detection model to detect attack images and obtain initial recognition results. Loss is calculated based on the initial recognition results and training labels to obtain model loss information. The initial attack image detection model is updated based on the loss information to obtain an updated attack image detection model. The updated attack image detection model is used as the initial attack image detection model, and the steps of acquiring training images and training labels, inputting training images into the initial attack image detection model, and obtaining initial recognition results are iteratively executed until the training completion condition is met, thus obtaining the target attack image detection model. When the target attack image detection model is detected to have met the update condition, it is used as the attack image detection model to be updated.

[0115] In one embodiment, the attack image detection model training device 600 further includes:

[0116] The detection unit is used to acquire the image to be detected, perform attack image detection on the image to be detected based on the updated attack image detection model, and obtain the degree of certainty of the attack image corresponding to the image to be detected; when the degree of certainty of the attack image corresponding to the image to be detected reaches the preset attack threshold, the image to be detected is determined to be an attack image.

[0117] Each module in the aforementioned attack image detection model training device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0118] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores images to be detected and attack image detection models to be updated. The I / O interfaces are used for information exchange between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for training an attack image detection model.

[0119] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a method for training an attack image detection model. The display unit of the computer device is used to form a visually visible image. It can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0120] Those skilled in the art will understand that Figure 7-8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0121] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0122] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0123] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0124] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0125] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0126] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0127] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for training an attack image detection model, characterized in that, The method includes: Acquiring a set of suspected attack images includes: acquiring a target image; performing attack image detection on the target image based on the attack image detection model to be updated to obtain the degree of certainty of the attack image corresponding to the target image; when the degree of certainty of the attack image corresponding to the target image meets the preset suspected attack image judgment conditions, the target image is regarded as a suspected attack image in the suspected attack image set, and the suspected attack image set is clustered to obtain each clustered suspected attack image set. Determining a target cluster image set based on the various clustered suspected attack image sets includes: counting the number of suspected attack images corresponding to each clustered suspected attack image set, and taking the clustered suspected attack image set with the fewest suspected attack images as the target clustered image set; or calculating the average probability of attack images corresponding to each clustered suspected attack image set, taking the clustered suspected attack image set with the smallest average probability as the target clustered image set, taking the target clustered image set as the training attack image set, and extracting attack feature region images based on the training attack images in the training attack image set. The image to be attacked is acquired, and the image to be attacked is fused with the image of the attack feature region to obtain the target training attack image; The attack image detection model to be updated is obtained, and the attack image detection model to be updated is updated and trained based on the target training attack image. When the update training completion condition is met, the updated attack image detection model is obtained. The updated attack image detection model is used to detect attack images on input images.

2. The method according to claim 1, characterized in that, The acquisition of the target image includes: The terminal collects the user's reading video data. The reading video data represents a video file in which the user reads the number and sends it to the user's client. The reading video data is used for user authentication. The video data is split into frames to obtain at least one frame of the target image.

3. The method according to claim 1, characterized in that, The step of extracting attack feature region images based on training attack images in the training attack image set includes: Feature point detection is performed based on the trained attack image to obtain the coordinates of the attack feature points; The attack feature region is determined in the training attack image based on the coordinates of the feature points. Extract the image data corresponding to the attack feature region in the training attack image to obtain the attack feature region image.

4. The method according to claim 1, characterized in that, The step of fusing the image to be attacked with the attack feature region image to obtain the target training attack image includes: Based on the image to be attacked, feature point detection is performed to obtain the coordinates of the feature points to be attacked; Based on the coordinates of the feature points to be attacked, the region of feature to be attacked is determined in the image to be attacked. Calculate the size of the target feature region, and adjust the size of the attack feature region image based on the size of the target feature region to obtain the target attack feature region image. The target attack feature region image is fused into the target feature region to be attacked to obtain the target training attack image.

5. The method according to claim 1, characterized in that, Before acquiring the suspected attack image set, the following is also included: Obtain the pre-trained network; An initial attack image detection model is established based on the pre-trained network; Acquire training images and training labels, and input the training images into the initial attack image detection model to detect attack images and obtain initial recognition results; Based on the initial recognition result and the training label, loss calculation is performed to obtain model loss information. Based on the loss information, the initial attack image detection model is updated to obtain the updated attack image detection model. The updated attack image detection model is used as the initial attack image detection model. The training image and training label are returned. The training image is input into the initial attack image detection model to obtain the initial recognition result. The steps are executed iteratively until the training completion condition is met, and the target attack image detection model is obtained. When the target attack image detection model is detected to have met the update conditions, the target attack image detection model is used as the attack image detection model to be updated.

6. The method according to claim 1, characterized in that, After updating and training the attack image detection model based on the target training attack image, and obtaining the updated attack image detection model when the update training completion condition is met, the process further includes: Acquire the image to be detected, perform attack image detection on the image to be detected based on the updated attack image detection model, and obtain the degree of determination of the attack image corresponding to the image to be detected. When the degree of certainty of the attack image corresponding to the image to be detected reaches a preset attack threshold, the image to be detected is determined to be an attack image.

7. A training device for an attack image detection model, characterized in that, The device includes: The clustering module is used to obtain a set of suspected attack images, including: obtaining a target image; performing attack image detection on the target image based on the attack image detection model to be updated to obtain the attack image certainty level corresponding to the target image; when the attack image certainty level corresponding to the target image meets the preset suspected attack image judgment conditions, the target image is used as a suspected attack image in the suspected attack image set, and the suspected attack image set is clustered to obtain each clustered suspected attack image set. The region extraction module is used to determine the target cluster image set based on the various clustered suspected attack image sets, including: counting the number of suspected attack images corresponding to each clustered suspected attack image set, taking the clustered suspected attack image set with the fewest suspected attack images as the target cluster image set, or calculating the average probability of the attack images corresponding to each clustered suspected attack image set, taking the clustered suspected attack image set with the smallest average probability as the target cluster image set, taking the target cluster image set as the training attack image set, and extracting attack feature region images based on the training attack images in the training attack image set; The fusion module is used to acquire the image to be attacked and fuse the image to be attacked with the attack feature region image to obtain the target training attack image; The update module is used to obtain the attack image detection model to be updated, update and train the attack image detection model to be updated based on the target training attack image, and obtain the updated attack image detection model when the update training completion condition is met. The updated attack image detection model is used to detect attack images on input images.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images