Attack object detection method and device, medium, equipment and product

Abstract

The embodiment of the specification provides an attack object detection method, an attack object detection device, a computer readable storage medium, an electronic device and a computer program product. The method comprises the following steps: acquiring a to-be-detected image of at least one image type about a to-be-detected object, wherein a corresponding prediction model is set for each image type. Inputting a target to-be-detected image into a prediction model corresponding to the type of the target to-be-detected image (denoted as a target prediction model), to predict a probability (denoted as a target attack probability) that the target to-be-detected image is an attack object, and also predict a confidence (denoted as a target confidence) about the target attack probability. Wherein, the target confidence is used to determine whether to perform screening processing on the target to-be-detected image, so as to realize screening processing of the to-be-detected image. Further, according to the attack probability corresponding to the to-be-detected image remaining after the screening processing, the detection result of the to-be-detected object is determined.

Description

Technical Field

[0001] This specification relates to the field of identity recognition technology, and in particular to an attack target detection method, an attack target detection device, a computer-readable storage medium, an electronic device, and a computer program product. Background Technology

[0002] Identity verification systems have been widely used in recent years, and it is essential to ensure their reliability. Currently, liveness detection attacks pose a security risk to identity verification systems. Generally, liveness detection attacks involve attackers using photos, screen displays, masks, or other means to impersonate users.

[0003] To address the issue of liveness detection attacks, related technologies have provided attack target detection schemes, typically using single-frame images as input. However, since a single-frame image contains limited information, the detection capability of attack targets needs improvement.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this specification, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this specification is to provide an attack target detection method, attack target detection device, computer-readable storage medium, electronic device, and computer program product that can improve the detection capability of attack targets to a certain extent.

[0006] Other features and advantages of this specification will become apparent from the following detailed description, or may be learned in part by practice of this specification.

[0007] According to one aspect of this specification, an attack target detection method is provided, the method comprising: acquiring a test image of at least one image type of the target object; acquiring a target attack probability of the target test image based on a target prediction model, and acquiring a target confidence level of the target attack probability, wherein the image type of the training sample images of the target prediction model is consistent with the image type of the target test image, and the attack probability represents the probability that the target test image is an attack target; determining whether to perform a screening process on the target test image based on the target confidence level; and determining a detection result for the target object based on the attack probability corresponding to the remaining test images after the screening process.

[0008] In an exemplary embodiment, based on the aforementioned scheme, the target confidence level is a confidence level matrix; determining whether to perform screening processing on the target image to be tested based on the target confidence level includes: determining whether there are matrix elements in the target confidence level matrix that are less than a first preset value; wherein, if there are matrix elements in the target confidence level matrix that are less than the first preset value, the target image to be tested is screened out; if there are no matrix elements in the target confidence level matrix that are less than the first preset value, the target image to be tested is retained.

[0009] In an exemplary embodiment, based on the foregoing scheme, both the image feature matrix of the target image to be tested and the target confidence level are M×N matrices, and the matrix element A of the target confidence level is... xy Represents: Matrix element B for predicting the above image feature matrix. xy The probability of belonging to the target of the attack is the confidence value of the target attack probability. x takes a positive integer not greater than M, y takes a positive integer not greater than N, and M and N are positive integers.

[0010] In an exemplary embodiment, based on the foregoing scheme, before obtaining the target attack probability of the target image to be tested based on the target prediction model, the method further includes: obtaining K training sample images of the target image type, and training an improved classification model through the K training sample images to obtain a prediction model corresponding to the target image type, where K is a positive integer.

[0011] In an exemplary embodiment, based on the foregoing scheme, the improved classification model includes a prediction part, which includes a first prediction branch and a second prediction branch; training the improved classification model using the K training sample images includes: inputting the i-th training sample image into the improved classification model, outputting the i-th attack probability from the first prediction branch, and outputting the i-th confidence score from the second prediction branch, where i is a positive integer not greater than K; and determining a loss function based on the i-th attack probability, the i-th confidence score, and the label corresponding to the i-th training sample image, and optimizing the model parameters of the improved classification model using the loss function to train the improved classification model.

[0012] In an exemplary embodiment, based on the foregoing scheme, the improved classification model further includes: a feature extraction part; the input of the i-th training sample image into the improved classification model includes: inputting the i-th training sample image into the feature extraction part of the improved classification model to obtain the i-th image feature matrix;

[0013] The above-mentioned output of the i-th attack probability from the first prediction branch includes: performing feature processing on the i-th image feature matrix through the first prediction branch to determine the probability that the i-th training sample image is an attack target, and thus obtaining the i-th attack probability.

[0014] The above-mentioned output of the i-th confidence score from the second prediction branch includes: outputting the i-th confidence score matrix through the second prediction branch, wherein the matrix elements S of the i-th confidence score matrix are... i,xy Represents: Matrix element B of the predicted i-th image feature matrix. i,xy The probability of belonging to the attack target is the confidence value of the i-th attack probability mentioned above;

[0015] Wherein, the i-th image feature matrix and the i-th confidence matrix are both M×N matrices, x takes the value of a positive integer not greater than M, y takes the value of a positive integer not greater than N, and M and N are positive integers.

[0016] In an exemplary embodiment, based on the foregoing scheme, determining the loss function according to the i-th attack probability, the i-th confidence level, and the label corresponding to the i-th training sample image includes:

[0017] Loss i =CrossEntropy((u i,xy +∈ i,xy ×S i,xy )*p i ,y i )

[0018] Among them, Loss i Let y represent the loss function corresponding to the i-th training sample image above, and CrossEntropy() represent the cross-entropy function. i p represents the label corresponding to the i-th training sample image mentioned above. i S represents the probability of the i-th attack mentioned above. i,xy Let u represent a matrix element in the i-th confidence matrix. i,xy and ∈ i,xy They are respectively with S i,xy The corresponding mean and variance.

[0019] In an exemplary embodiment, based on the foregoing scheme, before obtaining the target attack probability of the target image to be tested, the method further includes: performing face detection on the target image to be tested to obtain a face region image corresponding to the target image to be tested; wherein the face region image is used as input to the target prediction model to obtain the target attack probability of the target image to be tested.

[0020] In an exemplary embodiment, based on the foregoing scheme, determining the detection result of the target object according to the attack probability corresponding to the remaining test images after the above-mentioned screening process includes: calculating the average attack probability according to the attack probability corresponding to the remaining test images after the above-mentioned screening process; comparing the average attack probability with a second preset value; determining that the target object is a non-attack target if the average attack probability is greater than the second preset value; and determining that the target object is an attack target if the average attack probability is not greater than the second preset value.

[0021] In an exemplary embodiment, based on the foregoing scheme, the image type includes one or more of the following: RGB (Red, Green, Blue) type, near-infrared spectral type, and three-dimensional type.

[0022] According to another aspect of this specification, an attack target detection device is provided, the device comprising: an image acquisition module, a model prediction module, an image filtering module, and a detection result determination module.

[0023] The image acquisition module is configured to: acquire a test image of at least one image type of the target object; the model prediction module is configured to: acquire a target attack probability of the target test image and a target confidence score of the target attack probability based on a target prediction model, wherein the image type of the training sample images of the target prediction model is consistent with the image type of the target test image, and the attack probability represents the probability that the target test image is an attack object; the image filtering module is configured to determine whether to filter out the target test image based on the target confidence score; and the detection result determination module is configured to: determine the detection result of the target object based on the attack probability corresponding to the remaining test images after the filtering process.

[0024] According to another aspect of this specification, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the attack target detection method as described in the above embodiments.

[0025] According to one aspect of this specification, a computer-readable storage medium is provided that stores instructions that, when executed on a computer or processor, cause the computer or processor to perform the attack target detection method as described in the above embodiments.

[0026] According to another aspect of this specification, a computer program product containing instructions is provided that, when the computer program product is run on a computer or processor, causes the computer or processor to perform the attack target detection method as described in the above embodiments.

[0027] The attack target detection method, attack target detection device, computer-readable storage medium, electronic device, and computer program product provided in the embodiments of this specification have the following technical effects:

[0028] In the exemplary embodiments provided in this specification, a test image of at least one image type of a target object is acquired, wherein a corresponding prediction model is set for each image type. The target test image is input into the prediction model corresponding to its type (denoted as, target prediction model) to predict the probability that the target test image is an attack target (denoted as, target attack probability), and also to predict the confidence level of the target attack probability (denoted as, target confidence level). The target confidence level is used to determine whether to perform a screening process on the target test image, thereby achieving the screening process for the test images. Further, the detection result for the target object is determined based on the attack probability corresponding to the remaining test images after the screening process. Since the above screening can remove images of poor quality, the attack object detection scheme provided in the embodiments of this specification has a high detection capability.

[0029] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0030] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this specification and, together with the description, serve to explain the principles of this specification. It is obvious that the drawings described below are merely some embodiments of this specification, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0031] Figure 1 This is a flowchart illustrating an attack target detection method provided in one embodiment of this specification.

[0032] Figure 2 This is a flowchart illustrating a method for predicting the attack probability and confidence level of an image under test, provided in one embodiment of this specification.

[0033] Figure 3 This is a schematic diagram of the structure of a prediction model provided in one embodiment of this specification.

[0034] Figure 4This is a schematic flowchart of a model training method provided in one embodiment of this specification.

[0035] Figure 5 This is a flowchart illustrating the model training process provided in one embodiment of this specification.

[0036] Figure 6 This is a flowchart illustrating an attack target detection method provided in another embodiment of this specification.

[0037] Figure 7 This is a schematic diagram of the attack target detection device provided in one embodiment of this specification.

[0038] Figure 8 This is a schematic diagram of the attack target detection device provided in another embodiment of this specification.

[0039] Figure 9 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this specification. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this specification clearer, the embodiments of this specification will be described in further detail below with reference to the accompanying drawings.

[0041] In the following description, when referring to the accompanying drawings, the same numbers in different drawings denote the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification as detailed in the appended claims.

[0042] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this specification more comprehensive and complete, and to fully convey the concept of example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of the embodiments described herein. However, those skilled in the art will recognize that the technical solutions described herein may be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., may be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this specification.

[0043] Furthermore, the accompanying drawings are merely illustrative diagrams of this specification and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0044] One attack target detection method provided by related technologies detects attack targets based on a single image. Although this method can intercept attacks on low-resolution images (such as mobile phone screens, printed photos, etc.), its interception effect on high-resolution images (such as high-definition mobile phone screens, high-precision head models, etc.) is minimal, indicating low accuracy in attack target detection.

[0045] To improve the detection capability (also known as recall) of various attacks, existing attack object detection methods address this from two aspects. The first type of method aims to improve the detection capability for attacks in different shooting scenarios by implementing attack object detection based on images of various image types. Specifically, it determines the probability that a test image belonging to different image types might be an attack object, and further combines multiple probability results for attack interception. However, while this type of method can improve detection capability (recall rate), the accuracy of the detection results is poor, with a high probability of falsely detecting real objects as attack objects, causing unnecessary disturbance to users and resulting in a poor user experience for identity verification. The second type of method is attack object detection based on multi-frame data. Specifically, it increases the detection capability for different attacks by extending the time and amount of data collected. However, this type of method generally requires user interaction, such as shaking the head or blinking, which also degrades the user's identity verification experience.

[0046] This specification provides an attack target detection method, an attack target detection device, a computer-readable storage medium, an electronic device, and a computer program product, which can solve the problems existing in the attack target detection solutions provided by related technologies.

[0047] Specifically, this specification first introduces an embodiment of the attack target detection method. The attack target detection scheme provided in this specification can be applied to terminals that require identity recognition, such as facial recognition terminals used in facial recognition entry scenarios, mobile phones, tablets, laptops, ATMs, etc. In this case, the execution subject of the attack target detection scheme provided in this specification can be the terminal.

[0048] In an exemplary embodiment, Figure 1 This is a flowchart illustrating an attack target detection method provided in one embodiment of this specification. Figure 1 As shown in the figure, the embodiment includes: S110-S140.

[0049] In S110, a test image of at least one image type of the object to be detected is acquired.

[0050] In exemplary embodiments, to obtain high-quality images for testing and thus improve the accuracy of attack target detection, this specification embodiment acquires images of at least one image type related to the target object as the test image. Different image types are suitable for different acquisition scenarios. For example, RGB (Red, Green, Blue) images acquired at night, when used as test images, result in poor attack target detection. Instead, an image sensor can be used to acquire NIR (near-infrared) images corresponding to the RGB image type, and then the NIR images can be used as test images for attack target detection, achieving higher accuracy. As another example, image depth data is beneficial for reflecting the three-dimensional information of the target object. An image sensor can be used to acquire three-dimensional images corresponding to the RGB image type, and then the depth images can be used as test images for attack target detection, achieving higher accuracy.

[0051] Among them, the above image types include one or more of the following: RGB (Red, Green, Blue) type, near-infrared spectral type, and three-dimensional type.

[0052] In an exemplary embodiment, reference is made to Figure 2 Different image types correspond to different prediction models. For example, the prediction model for RGB images is used to process RGB image types, the prediction model for NIR images is used to process NIR image types, the prediction model for 3D (3D) images is used to process 3D image types, and so on. The prediction models for each of these image types are pre-trained machine learning models.

[0053] In an exemplary embodiment, the prediction model described above employs an improved classification model, referring to... Figure 3The improved classification model 300 includes a feature extraction part 310 and a prediction part 320, wherein the prediction part 320 further includes a first prediction branch 32 and a second prediction branch 34. For example, the feature extraction part 310 and the first prediction branch 32 adopt the ResNet18 neural network model, and the second prediction branch 34 is connected to the third-to-last layer of ResNet18, specifically consisting of two 3x3 convolutional layers and one fully connected layer.

[0054] In an exemplary embodiment, taking the training process of the prediction model corresponding to the target image type as an example, the training process of the improved classification model described above is introduced. First, K training sample images of the target image type are obtained. Further, the improved classification model is trained using these K training sample images to obtain the prediction model corresponding to the target image type, where K is a positive integer. For example, ... Figure 4 This is a flowchart illustrating a prediction model training method provided in one embodiment of this specification. Figure 4 As shown in the figure, the embodiment includes: S410-S440.

[0055] In S410, the i-th training sample image is input into the feature extraction part of the improved classification model to obtain the i-th image feature matrix.

[0056] For example, refer to Figure 5 The i-th training sample image I is input into the feature extraction part 310 of the improved classification model to obtain the feature matrix corresponding to the i-th training sample image I, which is represented as: the feature matrix B of the i-th image. i .

[0057] It should be noted that the i-th training sample image I mentioned above can be a face region image after face detection. If the i-th training sample image I mentioned above is not a face region image after face detection, then face detection needs to be performed on the i-th training sample image I first, and the obtained face region image is input into the feature extraction part 310 mentioned above.

[0058] Continue to refer to Figure 4 In S420, the feature matrix of the i-th image is processed by the first prediction branch to determine the probability that the i-th training sample image is the target of attack, and thus the i-th attack probability is obtained.

[0059] For example, refer to Figure 5 The first prediction branch 32 is used to predict the feature matrix B of the i-th image. i After feature processing, the output of the first prediction branch 32 is the probability that the i-th training sample image I is the target of attack, expressed as: the attack probability p of the i-th image. i .

[0060] Continue to refer to Figure 4 In S430, the second prediction branch outputs the i-th confidence matrix, where the matrix elements S of the i-th confidence matrix are... i,xy Represents: Matrix element B of the predicted i-th image feature matrix i,xy The probability of belonging to the attack target is the confidence value of the i-th attack probability.

[0061] Wherein, the i-th image feature matrix B i The matrix B, with confidence levels of M×N, is used as an example. x takes positive integer values ​​no greater than M, y takes positive integer values ​​no greater than N, and M and N are positive integers. i Both the aforementioned M×N matrices with the i-th confidence level can be represented as 7×7 matrices. If the (3rd,4th)th matrix element S in the i-th confidence level matrix... i,34 Representation: Matrix element B of the feature matrix of the i-th image i,34 The probability of being a target of attack is p i The confidence level value.

[0062] As can be seen, the confidence level of the i-th training sample image provided in the embodiments of this specification can actually be represented as a confidence matrix (also called a "confidence map"). That is, each image corresponds to a confidence matrix, and multiple matrix elements in the confidence matrix are used to measure the confidence value of multiple local regions of the i-th training sample image belonging to the attack target as the i-th attack probability. Therefore, the embodiments of this specification can achieve quality measurement at the local region level for each image through the confidence matrix. For example, if a local region in an image is occluded (poor clarity), this can be reflected in the confidence matrix element corresponding to that local region. Thus, more precise image filtering can be achieved through the confidence matrix elements.

[0063] It should be noted that the second prediction branch, in addition to outputting the confidence matrix, also outputs the mean and variance of each matrix element. Similarly, for a normal distribution, the confidence level can be determined based on the mean and variance. In the embodiment of this specification, the matrix element S of the i-th confidence matrix... i,xy A set of mean and variance can be represented as: (u i,xy ,∈ i,xy ).

[0064] Continue to refer to Figure 4 In S440, the loss function is determined based on the i-th attack probability, the i-th confidence level, and the label corresponding to the i-th training sample image.

[0065] Loss i =CrossEntropy((u i,xy +∈i,xy ×S i,xy )*p i ,y i )

[0066] Among them, Loss i Let y represent the loss function corresponding to the i-th training sample image, and CrossEntropy() represent the cross-entropy function. i p represents the label corresponding to the i-th training sample image. i S represents the probability of the i-th attack. i,xy Let u represent a matrix element in the i-th confidence matrix. i,xy and ∈ i,xy They are respectively with S i,xy The corresponding mean and variance.

[0067] Furthermore, the model parameters of the improved classification model are optimized using the aforementioned loss function, thereby enabling the training of the improved classification model. In an exemplary embodiment, based on the trained prediction model corresponding to each image type, the following is performed: Figure 1 The attack probability prediction and confidence prediction process is shown in S120.

[0068] Continue to refer to Figure 1 In S120, based on the target prediction model, the target attack probability of the target image to be tested is obtained, as well as the target confidence level of the target attack probability.

[0069] In this context, the image type of the training sample images for the aforementioned target prediction model is consistent with the image type of the target image to be tested, and the aforementioned attack probability represents the probability that the target image to be tested is the target of the attack. For example, refer to... Figure 2 The prediction model for RGB images is used to predict the probability P1 that image 12 belongs to the target of the attack and the confidence level of the predicted probability P1. The prediction model for NIR images is used to predict the probability P2 that image 14 belongs to the target of the attack and the confidence level of the predicted probability P2. The prediction model for 3D images is used to predict the probability P3 that image 16 belongs to the target of the attack and the confidence level of the predicted probability P3.

[0070] In an exemplary embodiment, if the target image to be tested is of RGB type, face detection is first performed on the target image to obtain the face region image corresponding to the target image. Further, the face region image is used as input to the prediction model of the RGB image, and then the attack probability P of the target image being the target can be obtained based on the first prediction branch of the prediction model of the RGB image. s Furthermore, the attack probability P of the target image to be tested can be obtained from the second prediction branch of the RGB image prediction model.s The confidence level.

[0071] In S130, it is determined whether to perform screening processing on the target image to be tested based on the target confidence level.

[0072] In an exemplary embodiment, the target confidence level is a confidence matrix; if both the image feature matrix of the target image to be tested and the target confidence level are M×N matrices, and the matrix element A of the target confidence level... xy Representation: Matrix element B of the predicted image feature matrix xy The probability of belonging to an attack target is the confidence value of the target attack probability. x is a positive integer not greater than M, y is a positive integer not greater than N, and M and N are positive integers. It can be seen that each target image corresponds to a confidence matrix, and multiple matrix elements in the confidence matrix are used to measure the confidence value of the probability that multiple local regions of the target image belong to the attack target. Therefore, the embodiments in this specification can achieve local region-level quality measurement of each test image through the confidence matrix.

[0073] For example, refer to Figure 6 The specific implementations of S110 and S120 have been described in the above embodiments and will not be repeated here. S1302-S1306 are executed as a specific implementation of S130.

[0074] In S1302, it is determined whether there are matrix elements in the target confidence matrix that are less than a first preset value.

[0075] If there exists a matrix element A in the target confidence matrix that is less than the first preset value. 12 Matrix element A 21 and matrix element A 11 This indicates that the matrix element B of the image feature matrix... 12 Matrix element B 21 and matrix element B 11 If the corresponding local area of ​​the image is unfavorable for attack target detection due to poor clarity or occlusion, then S1304 is executed: the target image to be tested is filtered out. If there are no matrix elements in the target confidence matrix that are less than the first preset value, it means that the target image to be tested is suitable for attack target detection, then S1306 is executed: the target image to be tested is retained.

[0076] Continue to refer to Figure 1 In S140, the detection result of the target object is determined based on the attack probability corresponding to the remaining test images after the filtering process. In the attack object detection scheme provided in this specification, the attack probability corresponding to the test images retained after the above filtering process is used as the decision detection result.

[0077] For example, refer to Figure 6 S1402-S1408 are executed as one specific implementation of S140. In S1402, the average attack probability is calculated based on the attack probability corresponding to the remaining test images after the filtering process.

[0078] For example, suppose in S110, we obtain: 3 RGB image types, represented as image 11, image 12, and image 13; 2 NIR image types, represented as image 21 and image 22; and one 3D image, represented as image 31. Further, in S120, we determine: the attack probability corresponding to image 11 is p11 and the confidence matrix is ​​S11; the attack probability corresponding to image 12 is p12 and the confidence matrix is ​​S12; the attack probability corresponding to image 13 is p13 and the confidence matrix is ​​S13; the attack probability corresponding to image 21 is p21 and the confidence matrix is ​​S21; and the attack probability corresponding to image 31 is p31 and the confidence matrix is ​​S31. After S130, it is determined that: since there is no matrix element in confidence matrix S11 that is less than the first preset value, image 11 is retained; since there is no matrix element in confidence matrix S12 that is less than the first preset value, image 12 is retained; since there is a matrix element in confidence matrix S13 that is less than the first preset value, image 13 is eliminated; since there is a matrix element in confidence matrix S21 that is less than the first preset value, image 21 is eliminated; since there is no matrix element in confidence matrix S22 that is less than the first preset value, image 22 is retained; since there is a matrix element in confidence matrix S33 that is less than the first preset value, image 33 is eliminated. Therefore, in S1402, the retained test images are determined to be: image 11, image 12, and image 21. Further, the average attack probability of p11, p12, and p21 is calculated to obtain the average attack probability.

[0079] In S1404, the average attack probability is compared with a second preset value.

[0080] If the average attack probability is greater than the second preset value, execute S1406: determine the target to be detected as a non-attack target, i.e., a real person. If the average attack probability is not greater than the second preset value, execute S1408: determine the target to be detected as an attack target.

[0081] The solution provided by the embodiments in the above specification overcomes the problems existing in the attack target detection solutions provided by related technologies. For example, by predicting the confidence level while predicting the attack probability and filtering out low-quality images unsuitable for attack target detection based on the confidence level, the detection capability is improved while minimizing the possibility of misidentifying real people as attack targets, effectively avoiding unnecessary disturbance to users. Furthermore, this solution does not require user interaction such as body language or facial expressions, which also improves the user experience. Therefore, the attack target detection solution provided by the embodiments in this specification not only improves the detection capability but also minimizes the possibility of misidentifying real people as attack targets, effectively avoiding unnecessary disturbance to users and improving the user experience for identity verification.

[0082] The attack target detection scheme provided in the embodiments of this specification can overcome the problems existing in the attack target detection schemes provided in related technologies. For example, by judging whether the pre-arrived physiological signal is empty, the situation of using a single frame image or head model as an attack target can be excluded. By judging whether the consistency between two physiological signals meets the preset conditions, the situation of using a pre-recorded video as an attack target can be excluded. It can be seen that the attack target detection scheme provided in the embodiments of this specification can improve the detection accuracy and play a good role in preventing attacks.

[0083] It should be noted that the above figures are merely illustrative of the processes included in the methods according to exemplary embodiments of this specification, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may, for example, be executed synchronously or asynchronously in multiple modules.

[0084] The following are embodiments of the apparatus described in this specification, which can be used to execute the embodiments of the methods described in this specification. For details not disclosed in the apparatus embodiments of this specification, please refer to the embodiments of the methods described in this specification.

[0085] in, Figure 7 This is a schematic diagram of the attack target detection device provided in one embodiment of this specification. Please refer to [link / reference]. Figure 7 The attack target detection device shown in the figure can be implemented as a whole or part of an electronic device through software, hardware, or a combination of both. It can also be integrated as an independent module on a server or as an independent module in an electronic device.

[0086] The attack target detection device 700 described in the embodiments of this specification includes: an image acquisition module 710, a model prediction module 720, an image filtering module 730, and a detection result determination module 740.

[0087] The image acquisition module 710 is configured to: acquire a test image of at least one image type of the target object; the model prediction module 720 is configured to: acquire a target attack probability of the target test image and a target confidence level of the target attack probability based on a target prediction model, wherein the image type of the training sample images of the target prediction model is consistent with the image type of the target test image, and the attack probability represents the probability that the target test image is an attack object; the image filtering module 730 is configured to determine whether to perform filtering processing on the target test image based on the target confidence level; and the detection result determination module 740 is configured to: determine the detection result of the target object based on the attack probability corresponding to the remaining test images after the filtering processing.

[0088] In an exemplary embodiment, Figure 8 This is a schematic diagram of an attack target detection device provided in another embodiment of this specification. Please refer to... Figure 8 :

[0089] In an exemplary embodiment, based on the aforementioned scheme, the target confidence level is a confidence matrix; the image filtering module 730 is specifically used to: determine whether there are matrix elements in the target confidence matrix that are less than a first preset value; wherein, if there are matrix elements in the target confidence matrix that are less than the first preset value, the target image to be tested is filtered out; if there are no matrix elements in the target confidence matrix that are less than the first preset value, the target image to be tested is retained.

[0090] In an exemplary embodiment, based on the foregoing scheme, both the image feature matrix of the target image to be tested and the target confidence level are M×N matrices, and the matrix element A of the target confidence level is... xy Represents: Matrix element B for predicting the above image feature matrix. xy The probability of belonging to the target of the attack is the confidence value of the target attack probability. x takes a positive integer not greater than M, y takes a positive integer not greater than N, and M and N are positive integers.

[0091] In an exemplary embodiment, based on the foregoing scheme, the above-mentioned apparatus further includes: a model training module 750.

[0092] The model training module 750 is used to: before obtaining the target attack probability of the target image to be tested based on the target prediction model: obtain K training sample images of the target image type, and train the improved classification model through the K training sample images to obtain the prediction model corresponding to the target image type, where K is a positive integer.

[0093] In an exemplary embodiment, based on the foregoing scheme, the improved classification model includes: a prediction part, which includes: a first prediction branch and a second prediction branch; the model training module 750 includes: a feature processing unit 7502 and a parameter optimization unit 7504.

[0094] The feature processing unit 7502 is configured to: input the i-th training sample image into the improved classification model, output the i-th attack probability from the first prediction branch, and output the i-th confidence score from the second prediction branch, where i is a positive integer not greater than K; and the parameter optimization unit 7504 is configured to: determine a loss function based on the i-th attack probability, the i-th confidence score, and the label corresponding to the i-th training sample image, and optimize the model parameters of the improved classification model through the loss function to train the improved classification model.

[0095] In an exemplary embodiment, based on the foregoing scheme, the improved classification model further includes: a feature extraction section; the feature processing unit 7502 is specifically configured to: input the i-th training sample image into the feature extraction section of the improved classification model to obtain the i-th image feature matrix; perform feature processing on the i-th image feature matrix through the first prediction branch to determine the probability that the i-th training sample image is an attack target, thereby obtaining the i-th attack probability; and output the i-th confidence matrix through the second prediction branch, wherein the matrix elements S of the i-th confidence matrix are... i,xy Represents: Matrix element B of the predicted i-th image feature matrix. i,xy The probability of belonging to the attack target is the confidence value of the i-th attack probability mentioned above;

[0096] Wherein, the i-th image feature matrix and the i-th confidence matrix are both M×N matrices, x takes the value of a positive integer not greater than M, y takes the value of a positive integer not greater than N, and M and N are positive integers.

[0097] In an exemplary embodiment, based on the foregoing scheme, the parameter optimization unit 7504 is specifically used for:

[0098] Loss i =CrossEntropy((u i,xy +∈ i,xy ×S i,xy )*p i ,y i )

[0099] Among them, Loss i Let y represent the loss function corresponding to the i-th training sample image above, and CrossEntropy() represent the cross-entropy function. ip represents the label corresponding to the i-th training sample image mentioned above. i S represents the probability of the i-th attack mentioned above. i,xy Let u represent a matrix element in the i-th confidence matrix. i,xy and ∈ i,xy They are respectively with S i,xy The corresponding mean and variance.

[0100] In an exemplary embodiment, based on the foregoing scheme, the above-mentioned device further includes an image processing module 760.

[0101] The image processing module 760 is configured to: perform face detection on the target image before obtaining the target attack probability of the target image to be tested, and obtain a face region image corresponding to the target image to be tested; wherein the face region image is used to input the target prediction model to obtain the target attack probability of the target image to be tested.

[0102] In an exemplary embodiment, based on the aforementioned scheme, the detection result determination module 740 is specifically configured to: calculate the average attack probability based on the attack probability corresponding to the remaining test image after the aforementioned screening process; compare the average attack probability with a second preset value; if the average attack probability is greater than the second preset value, determine that the test object is a non-attack object; and if the average attack probability is not greater than the second preset value, determine that the test object is an attack object.

[0103] In an exemplary embodiment, based on the foregoing scheme, the image type includes one or more of the following: RGB (Red, Green, Blue) type, near-infrared spectral type, and three-dimensional type.

[0104] It should be noted that the attack target detection device provided in the above embodiments is only illustrated by the division of the above functional modules when executing the attack target detection method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0105] Furthermore, the attack target detection device and attack target detection method embodiments provided in the above embodiments belong to the same concept. Therefore, for details not disclosed in the device embodiments of this specification, please refer to the attack target detection method embodiments described above in this specification, which will not be repeated here.

[0106] The example numbers in this specification are for descriptive purposes only and do not represent the superiority or inferiority of the examples.

[0107] This specification also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the methods described above.

[0108] Figure 9 This is a schematic diagram of the electronic device provided in the embodiments of this specification. Please refer to... Figure 9 As shown, the electronic device 900 includes a processor 901 and a memory 902.

[0109] In this embodiment, processor 901 is the control center of the computer system and can be a processor of a physical machine or a processor of a virtual machine. Processor 901 may include one or more processing cores, such as a 4-core processor or a 9-core processor. Processor 901 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). Processor 901 may also include a main processor and a coprocessor; the main processor is used to process data in the wake-up state, and the coprocessor is a low-power processor used to process data in the standby state.

[0110] In the embodiments described in this specification, the processor 901 is specifically used for:

[0111] The process involves: acquiring a test image of at least one image type related to the target object; obtaining a target attack probability for the target test image based on a target prediction model, and obtaining a target confidence score for the target attack probability, wherein the image type of the training sample images of the target prediction model is consistent with the image type of the target test image, and the attack probability represents the probability that the target test image is an attack target; determining whether to perform a screening process on the target test image based on the target confidence score; and determining the detection result for the target object based on the attack probability corresponding to the remaining test images after the screening process.

[0112] Further, the aforementioned target confidence level is a confidence level matrix; the determination of whether to perform screening processing on the aforementioned target test image based on the aforementioned target confidence level includes: determining whether there are matrix elements in the aforementioned target confidence level matrix that are less than a first preset value; wherein, if there are matrix elements in the aforementioned target confidence level matrix that are less than the aforementioned first preset value, the aforementioned target test image is screened out; if there are no matrix elements in the aforementioned target confidence level matrix that are less than the aforementioned first preset value, the aforementioned target test image is retained.

[0113] Furthermore, both the image feature matrix of the target image to be tested and the target confidence level are M×N matrices, and the matrix element A of the target confidence level is... xy Represents: Matrix element B for predicting the above image feature matrix. xy The probability of belonging to the target of the attack is the confidence value of the target attack probability. x takes a positive integer not greater than M, y takes a positive integer not greater than N, and M and N are positive integers.

[0114] Furthermore, the processor 901 described above is specifically used for:

[0115] Before obtaining the target attack probability of the target image based on the target prediction model: obtain K training sample images of the target image type, and train the improved classification model through the above K training sample images to obtain the prediction model corresponding to the above target image type, where K is a positive integer.

[0116] Furthermore, the improved classification model includes a prediction part, which includes a first prediction branch and a second prediction branch. Training the improved classification model using the K training sample images includes: inputting the i-th training sample image into the improved classification model, outputting the i-th attack probability from the first prediction branch, and outputting the i-th confidence score from the second prediction branch, where i is a positive integer not greater than K; and determining a loss function based on the i-th attack probability, the i-th confidence score, and the label corresponding to the i-th training sample image, and optimizing the model parameters of the improved classification model using the loss function to train the improved classification model.

[0117] Furthermore, the improved classification model also includes a feature extraction part; the input of the i-th training sample image into the improved classification model includes: inputting the i-th training sample image into the feature extraction part of the improved classification model to obtain the i-th image feature matrix;

[0118] The above-mentioned output of the i-th attack probability from the first prediction branch includes: performing feature processing on the i-th image feature matrix through the first prediction branch to determine the probability that the i-th training sample image is an attack target, and thus obtaining the i-th attack probability.

[0119] The above-mentioned output of the i-th confidence score from the second prediction branch includes: outputting the i-th confidence score matrix through the second prediction branch, wherein the matrix elements S of the i-th confidence score matrix are... i,xy Represents: Matrix element B of the predicted i-th image feature matrix. i,xy The probability of belonging to the attack target is the confidence value of the i-th attack probability mentioned above;

[0120] Wherein, the i-th image feature matrix and the i-th confidence matrix are both M×N matrices, x takes the value of a positive integer not greater than M, y takes the value of a positive integer not greater than N, and M and N are positive integers.

[0121] Furthermore, the loss function determined based on the i-th attack probability, the i-th confidence level, and the label corresponding to the i-th training sample image includes:

[0122] Loss i =CrossEntropy((u i,xy +∈ i,xy ×S i,xy )*p i ,y i )

[0123] Among them, Loss i Let y represent the loss function corresponding to the i-th training sample image above, and CrossEntropy() represent the cross-entropy function. i p represents the label corresponding to the i-th training sample image mentioned above. i S represents the probability of the i-th attack mentioned above. i,xy Let u represent a matrix element in the i-th confidence matrix. i,xy and ∈ i,xy They are respectively with S i,xy The corresponding mean and variance.

[0124] Furthermore, the processor 901 described above is specifically used for:

[0125] Before obtaining the target attack probability of the target image to be tested: face detection is performed on the target image to be tested to obtain the face region image corresponding to the target image to be tested; wherein, the face region image is used as input to the target prediction model to obtain the target attack probability of the target image to be tested.

[0126] Furthermore, determining the detection result of the target object based on the attack probability corresponding to the remaining test images after the above screening process includes: calculating the average attack probability based on the attack probability corresponding to the remaining test images after the above screening process; comparing the average attack probability with a second preset value; determining the target object as a non-attack target if the average attack probability is greater than the second preset value; and determining the target object as an attack target if the average attack probability is not greater than the second preset value.

[0127] Furthermore, the above image types include one or more of the following: RGB (Red, Green, Blue) type, near-infrared spectral type, and three-dimensional type.

[0128] The first body part mentioned above is the face, and the method further includes: performing facial recognition based on the first video corresponding to the face to obtain a facial recognition result; and determining the identity recognition result of the object to be detected based on the detection result and the facial recognition result.

[0129] Memory 902 may include one or more computer-readable storage media, which may be non-transitory. Memory 902 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments of this specification, the non-transitory computer-readable storage media in memory 902 is used to store at least one instruction for execution by processor 901 to implement the methods in the embodiments of this specification.

[0130] In some embodiments, the electronic device 900 further includes a peripheral device interface 903 and at least one peripheral device. The processor 901, memory 902, and peripheral device interface 903 are connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface 903 via a bus, signal line, or circuit board. Specifically, the peripheral device includes at least one of a display screen 904, a camera 905, and an audio circuit 906.

[0131] Peripheral interface 903 can be used to connect at least one input / output (I / O) related peripheral device to processor 901 and memory 902. In some embodiments of this specification, processor 901, memory 902, and peripheral interface 903 are integrated on the same chip or circuit board; in other embodiments of this specification, any one or two of processor 901, memory 902, and peripheral interface 903 can be implemented on separate chips or circuit boards. This specification does not specifically limit the embodiments in this regard.

[0132] Display screen 904 is used to display a user interface (UI). The UI may include graphics, text, icons, videos, and any combination thereof. When display screen 904 is a touch display screen, it also has the ability to collect touch signals on or above its surface. These touch signals can be input as control signals to processor 901 for processing. In this case, display screen 904 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments of this specification, there may be one display screen 904, which is disposed on the front panel of electronic device 900; in other embodiments, there may be at least two display screens 904, respectively disposed on different surfaces of electronic device 900 or in a folded design; in still other embodiments, display screen 904 may be a flexible display screen, disposed on a curved or folded surface of electronic device 900. Furthermore, display screen 904 may be configured as a non-rectangular irregular shape, i.e., a non-rectangular screen. Display screen 904 may be made of materials such as Liquid Crystal Display (LCD) or Organic Light-Emitting Diode (OLED).

[0133] Camera 905 is used to capture images or videos. Optionally, camera 905 includes a front-facing camera and a rear-facing camera. Typically, the front-facing camera is located on the front panel of the electronic device, and the rear-facing camera is located on the back of the electronic device. In some embodiments, there are at least two rear-facing cameras, which are any one of a main camera, a depth-sensing camera, a wide-angle camera, and a telephoto camera, to achieve background blurring by fusion of the main camera and the depth-sensing camera, panoramic shooting by fusion of the main camera and the wide-angle camera, virtual reality (VR) shooting, or other fusion shooting functions. In some embodiments of this specification, camera 905 may also include a flash. The flash can be a single-color temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cool light flash, which can be used for light compensation at different color temperatures.

[0134] The audio circuit 906 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals that are input to the processor 901 for processing. For stereo sound acquisition or noise reduction purposes, there may be multiple microphones, each located in a different part of the electronic device 900. The microphone may also be an array microphone or an omnidirectional microphone.

[0135] Power supply 907 is used to supply power to various components in electronic device 900. Power supply 907 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery. When power supply 907 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery that is charged via a wired line, while a wireless rechargeable battery is a battery that is charged via a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0136] The block diagrams of the electronic device shown in the embodiments of this specification do not constitute a limitation on the electronic device 900. The electronic device 900 may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0137] In the description of this specification, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Those skilled in the art can understand the specific meaning of these terms in this specification based on the specific circumstances. Furthermore, in the description of this specification, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0138] This specification also provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform one or more steps in the above embodiments. If the constituent modules of the above-described attack target detection device are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium.

[0139] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this specification are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The aforementioned available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., Digital Versatile Discs (DVDs)), or semiconductor media (e.g., Solid State Disks (SSDs)).

[0140] It should be noted that the above description describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims may be performed in a different order than that shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0141] The above description is merely a specific embodiment of this specification, but the scope of protection of this specification is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this specification should be included within the scope of protection of this specification. Therefore, equivalent variations made in accordance with the claims of this specification are still within the scope of this specification.

Claims

1. An attack target detection method, wherein, The method includes: Acquire a test image of at least one image type related to the object to be detected; Based on the target prediction model, the target attack probability of the target image to be tested is obtained, and the target confidence level of the target attack probability is obtained. The image type of the training sample images of the target prediction model is consistent with the image type of the target image to be tested, and the target attack probability represents the probability that the target image to be tested is an attack target. Whether to filter out the target image is determined based on the target confidence level. The detection result for the object to be detected is determined based on the attack probability corresponding to the remaining images to be tested after the filtering process. Before obtaining the target attack probability of the target image based on the target prediction model, the method further includes: K training sample images of the target image type are obtained, and an improved classification model is trained using the K training sample images to obtain a prediction model corresponding to the target image type, where K is a positive integer; the improved classification model includes a prediction part, which includes a first prediction branch and a second prediction branch. The improved classification model trained using the K training sample images includes: The i-th training sample image is input into the improved classification model, the i-th attack probability is output from the first prediction branch, and the i-th confidence score is output from the second prediction branch, where i is a positive integer not greater than K; Based on the i-th attack probability, the i-th confidence level, and the label corresponding to the i-th training sample image, a loss function is determined, and the model parameters of the improved classification model are optimized using the loss function to train the improved classification model.

2. The method according to claim 1, wherein, The target confidence level is a confidence matrix; The step of determining whether to filter out the target image based on the target confidence level includes: Determine whether there are any matrix elements in the confidence matrix that are less than a first preset value; Specifically, if there are matrix elements in the confidence matrix that are less than the first preset value, the target image to be tested is filtered out; if there are no matrix elements in the confidence matrix that are less than the first preset value, the target image to be tested is retained.

3. The method according to claim 2, wherein, The image feature matrix of the target image to be tested and the target confidence level are both M×N matrices, and the matrix element A of the target confidence level is... xy Represents: Matrix element B of the predicted image feature matrix xy The probability of belonging to the target of the attack is the confidence value of the target attack probability. x takes a positive integer not greater than M, y takes a positive integer not greater than N, and M and N are positive integers.

4. The method according to claim 1, wherein, The improved classification model also includes: a feature extraction component; The step of inputting the i-th training sample image into the improved classification model includes: The i-th training sample image is input into the feature extraction part of the improved classification model to obtain the i-th image feature matrix; The step of outputting the attack probability of the i-th attack from the first prediction branch includes: The first prediction branch is used to perform feature processing on the feature matrix of the i-th image to determine the probability that the i-th training sample image is an attack target, thereby obtaining the i-th attack probability; The step of outputting the i-th confidence level from the second prediction branch includes: The second prediction branch outputs the i-th confidence matrix, where the matrix elements S of the i-th confidence matrix are... i,xy Represents: Matrix element B of the predicted i-th image feature matrix i,xy The probability of belonging to the attack target is the confidence value of the i-th attack probability; Wherein, the i-th image feature matrix and the i-th confidence matrix are both M×N matrices, x takes the value of a positive integer not greater than M, y takes the value of a positive integer not greater than N, and M and N are positive integers.

5. The method according to claim 1, wherein, The step of determining the loss function based on the i-th attack probability, the i-th confidence level, and the label corresponding to the i-th training sample image includes: in, This represents the loss function corresponding to the i-th training sample image. Represents the cross-entropy function. This represents the label corresponding to the i-th training sample image. This represents the probability of the i-th attack. This represents the matrix element in the i-th confidence matrix. and They are respectively with The corresponding mean and variance.

6. The method according to claim 1, wherein, Before obtaining the target attack probability of the target image to be tested, the method further includes: Face detection is performed on the target image to be tested to obtain the face region image corresponding to the target image to be tested; The facial region image is used as input to the target prediction model to obtain the target attack probability of the target image to be tested.

7. The method according to claim 1, wherein, The step of determining the detection result for the target object based on the attack probability corresponding to the remaining images after the filtering process includes: The average attack probability is calculated based on the attack probability corresponding to the remaining test images after the filtering process. Compare the average attack probability with the second preset value; If the average attack probability is greater than the second preset value, the object to be detected is determined to be a non-attack object; If the average attack probability is not greater than the second preset value, the object to be detected is determined to be an attack target.

8. The method according to any one of claims 1 to 7, wherein, The image type includes one or more of the following: RGB type, near-infrared spectral type, and three-dimensional type.

9. An attack target detection device, wherein, The device includes: The image acquisition module is used to: acquire a test image of at least one image type concerning the object to be detected; The model prediction module is used to: obtain the target attack probability of the target image to be tested based on the target prediction model, and obtain the target confidence level of the target attack probability, wherein the image type of the training sample images of the target prediction model is consistent with the image type of the target image to be tested, and the target attack probability represents the probability that the target image to be tested is an attack target; An image filtering module is used to determine whether to filter out the target image based on the target confidence level. The detection result determination module is used to: determine the detection result of the object to be detected based on the attack probability corresponding to the remaining images to be tested after the screening process; The device further includes: The model training module is used to acquire K training sample images of the target image type, and train the improved classification model using the K training sample images to obtain the prediction model corresponding to the target image type, where K is a positive integer; The improved classification model includes: a prediction part, which includes: a first prediction branch and a second prediction branch; the model training module includes: a feature processing unit and a parameter optimization unit. The feature processing unit is used to input the i-th training sample image into the improved classification model, output the i-th attack probability from the first prediction branch, and output the i-th confidence from the second prediction branch, where i takes the value of a positive integer not greater than K. The parameter optimization unit is used to determine a loss function based on the i-th attack probability, the i-th confidence level, and the label corresponding to the i-th training sample image, and to optimize the model parameters of the improved classification model through the loss function in order to train the improved classification model.

10. A computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform the attack target detection method as described in any one of claims 1 to 8.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein, When the processor executes the computer program, it implements the attack target detection method as described in any one of claims 1 to 8.

12. A computer program product containing instructions that, when run on a processor, causes the processor to perform the attack target detection method as described in any one of claims 1 to 8.

Images