Model reverse attack method, model reverse attack device and readable storage medium

Abstract

The embodiments of the present application disclose a model reverse attack method, a model reverse attack device, and a computer-readable storage medium for performing a model reverse attack while improving the similarity between a generated target attack image and a target privacy image. The method of the embodiment of the present application includes: performing preset rule processing on an obtained target space vector, inputting the processed target space vector into a pre-trained synthesis network to obtain an attack image output by the synthesis network, inputting the attack image into a target classifier to obtain a probability value of a target class of the attack image output by the target classifier, and optimizing the processed target space vector based on the probability value of the target class of the attack image so that the optimized target space vector is input into the synthesis network to obtain an optimized attack image output by the synthesis network.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of model reverse attack, and more specifically, to a model reverse attack method, a model reverse attack device, and a computer-readable storage medium. Background Art

[0002] With the rapid development of the artificial intelligence industry, there is a need to study model reverse attacks.

[0003] The existing model reverse attack method is to first obtain the z-space vector, then input the z-space vector into the synthesis network, obtain the attack image corresponding to the z-space vector output by the synthesis network, and use the gradient descent method to optimize the z-space vector so that the optimized z-space vector can be input into the synthesis network to obtain the optimized attack image output by the synthesis network.

[0004] However, this model inverse attack method is greatly affected by the initial value limitation, and the obtained optimized attack image has low similarity with the target private image. Summary of the Invention

[0005] The embodiments of the present application provide a model inverse attack method, a model inverse attack device, and a computer-readable storage medium, which can perform a model inverse attack while improving the similarity between a generated target attack image and a target privacy image.

[0006] In a first aspect, an embodiment of the present application provides a model reverse attack method, comprising:

[0007] Get the target space vector;

[0008] Performing preset rule processing on the target space vector to obtain a processed target space vector;

[0009] Inputting the processed target space vector into a pre-trained synthetic network to obtain an attack image output by the synthetic network;

[0010] Inputting the attack image into a target classifier to obtain a probability value of the target class of the attack image output by the target classifier;

[0011] The processed target space vector is optimized according to the probability value of the target class of the attack image, so that the obtained optimized target space vector is input into the synthesis network to obtain the optimized attack image output by the synthesis network.

[0012] Optionally, obtaining the target space vector includes:

[0013] Get the first space vector;

[0014] Inputting the first space vector into a mapping network to obtain a second space vector output by the mapping network;

[0015] The second space vector is used as the target space vector.

[0016] Optionally, performing preset rule processing on the target space vector to obtain a processed target space vector includes:

[0017] performing noise adding processing on the target space vector to obtain a target space vector after noise addition;

[0018] Using the noise-added target space vector as the processed target space vector;

[0019] Inputting the processed target space vector into a pre-trained synthetic network to obtain an attack image output by the synthetic network includes:

[0020] The target space vector after adding noise is input into the synthesis network to obtain an attack image output by the synthesis network.

[0021] Optionally, optimizing the processed target space vector according to the probability value of the target class, inputting the obtained optimized target space vector into the synthesis network, and obtaining an optimized attack image output by the synthesis network includes:

[0022] For each target space vector after adding noise, determining a mutation probability value corresponding to the target space vector after adding noise;

[0023] Mutation processing is performed according to the mutation probability value corresponding to each target space vector after adding noise and a preset mutation method to obtain a mutated target space vector, and the mutated target space vector is used as the optimized target space vector, so that the obtained optimized target space vector is input into the synthesis network to obtain the optimized attack image output by the synthesis network.

[0024] Optionally, determining, for each noise-added target space vector, a mutation probability value corresponding to the noise-added target space vector includes:

[0025] Sorting the probability values ​​of the target class of each attack image in descending order to obtain a ranking corresponding to the probability value of the target class of each attack image;

[0026] Determine the sum of the number n of probability values ​​to be sorted and 1 to obtain a sum value n+1; wherein n is an integer greater than or equal to 2;

[0027] For each probability value of the target class of the attack image, the ranking corresponding to the probability value of the target class of the attack image is compared with the sum value n+1 to obtain a mutation probability value corresponding to the target space vector after adding noise.

[0028] Optionally, performing preset rule processing on the target space vector to obtain a processed target space vector includes:

[0029] Performing average processing on the target space vector to obtain a target space average vector;

[0030] Inputting the processed target space vector into a pre-trained synthetic network to obtain an attack image output by the synthetic network includes:

[0031] The target space average vector is input into the synthesis network to obtain an attack image output by the synthesis network.

[0032] Optionally, after inputting the target space average vector into the pre-trained synthetic network to obtain the attack image output by the synthetic network, and before inputting the attack image into the target classifier, the method further includes:

[0033] Performing cropping on a region of interest in the attack image output by the synthetic network to obtain an image of interest;

[0034] resizing the image of interest to obtain a resized image of interest;

[0035] The step of inputting the attack image into a target classifier comprises:

[0036] The resized image of interest is input into the object classifier.

[0037] Optionally, optimizing the processed target space vector according to the probability value of the target class of the attack image includes:

[0038] According to the probability value of the target class of the attack image, the processed target space vector is optimized using an Adam optimizer and a cross entropy loss function.

[0039] In a second aspect, an embodiment of the present application provides a model reverse attack device, including:

[0040] An acquisition unit, used for acquiring a target space vector;

[0041] a processing unit, configured to perform preset rule processing on the target space vector to obtain a processed target space vector;

[0042] An input unit, configured to input the processed target space vector into a pre-trained synthesis network to obtain an attack image output by the synthesis network;

[0043] The input unit is further configured to input the attack image into a target classifier to obtain a probability value of the target class of the attack image output by the target classifier;

[0044] An optimization unit is used to optimize the processed target space vector according to the probability value of the target class of the attack image, so that the obtained optimized target space vector is input into the synthesis network to obtain the optimized attack image output by the synthesis network.

[0045] In a third aspect, an embodiment of the present application provides a model reverse attack device, including:

[0046] CPU, memory, input and output interfaces, wired or wireless network interfaces, and power supply;

[0047] The memory is a transient storage memory or a persistent storage memory;

[0048] The central processing unit is configured to communicate with the memory and execute instruction operations in the memory to perform the aforementioned model reverse attack method.

[0049] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium includes instructions, and when the instructions are executed on a computer, the computer executes the aforementioned method.

[0050] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when the computer program product is run on a computer, enables the computer to execute the aforementioned model reverse attack method.

[0051] It can be seen from the above technical solution that the embodiments of the present application have the following advantages: a target space vector can be obtained, the target space vector is processed according to preset rules to obtain a processed target space vector, the processed target space vector is input into a pre-trained synthetic network to obtain an attack image output by the synthetic network, the attack image is input into a target classifier to obtain a probability value of the target class of the attack image output by the target classifier, the processed target space vector is optimized according to the probability value of the target class of the attack image, so that the obtained optimized target space vector is input into the synthetic network to obtain an optimized attack image output by the synthetic network, the target space vector can be obtained, the target space vector is processed according to preset rules to obtain a processed target space vector, and the similarity between the generated target attack image and the target privacy image is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of a flow chart of a model reverse attack method disclosed in an embodiment of the present application;

[0053] Figure 2 A schematic diagram of the structure of StyleGAN-2 disclosed in an embodiment of this application;

[0054] Figure 3 A schematic diagram of a method for synthesizing a single-style attack image from a single latent vector disclosed in an embodiment of the present application;

[0055] Figure 4 A schematic diagram of a method for synthesizing multi-style attack images from multiple latent vectors disclosed in an embodiment of the present application;

[0056] Figure 5 A schematic diagram of the structure of a model reverse attack device disclosed in an embodiment of the present application;

[0057] Figure 6 This is a structural diagram of another model reverse attack device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The embodiments of the present application provide a model inverse attack method, a model inverse attack device, and a computer-readable storage medium, which can perform a model inverse attack while improving the similarity between a generated target attack image and a target privacy image.

[0059] See also Figure 1 , Figure 1 This is a flow chart of a model reverse attack method disclosed in an embodiment of the present application, which includes:

[0060] 101. Obtain the target space vector.

[0061] In this embodiment, when performing a model reverse attack, a target space vector can be obtained.

[0062] 102. Process the target space vector according to a preset rule to obtain a processed target space vector.

[0063] After obtaining the target space vector, the target space vector can be processed according to a preset rule to obtain a processed target space vector. It is understood that the method of processing the target space vector according to the preset rule may be to add noise to the target space vector, or other reasonable methods of processing according to the preset rule, which are not limited herein.

[0064] 103. Input the processed target space vector into the pre-trained synthesis network to obtain the attack image output by the synthesis network.

[0065] After the target space vector is processed according to preset rules to obtain the processed target space vector, the processed target space vector can be input into a pre-trained synthetic network to obtain an attack image output by the synthetic network.

[0066] 104. Input the attack image into the target classifier to obtain the probability value of the target class of the attack image output by the target classifier.

[0067] The processed target space vector is input into a pre-trained synthetic network to obtain an attack image output by the synthetic network. The attack image can then be input into a target classifier to obtain a probability value of the target class of the attack image output by the target classifier.

[0068] 105. Optimize the processed target space vector according to the probability value of the target class of the attack image, so that the optimized target space vector is input into the synthesis network to obtain the optimized attack image output by the synthesis network.

[0069] After inputting the attack image into the target classifier and obtaining the probability value of the target class of the attack image output by the target classifier, the processed target space vector can be optimized according to the probability value of the target class of the attack image, so that the obtained optimized target space vector can be input into the synthesis network to obtain the optimized attack image output by the synthesis network.

[0070] In an embodiment of the present application, a target space vector can be obtained, the target space vector is processed according to preset rules to obtain a processed target space vector, the processed target space vector is input into a pre-trained synthetic network to obtain an attack image output by the synthetic network, the attack image is input into a target classifier to obtain a probability value of the target class of the attack image output by the target classifier, the processed target space vector is optimized according to the probability value of the target class of the attack image, so that the obtained optimized target space vector is input into the synthetic network to obtain an optimized attack image output by the synthetic network, the target space vector can be obtained, the target space vector is processed according to preset rules to obtain a processed target space vector, and the similarity between the generated target attack image and the target privacy image is improved.

[0071] In the embodiment of the present application, there are multiple methods for performing preset rule processing on the target space vector to obtain the processed target space vector, which are described below respectively:

[0072] First, add noise to the target space vector to obtain the target space vector after adding noise, and use the target space vector after adding noise as the processed target space vector.

[0073] In this embodiment, when performing a model reverse attack, a target space vector can be obtained.

[0074] It's worth noting that the model inversion attack in the embodiments of this application involves research on attack algorithms for AI model data security. Specifically, the model inversion attack aims to reconstruct the training data features of the target model by accessing the target model. The implementation principle of the model inversion attack is to reconstruct an attack image with extremely high prediction confidence for the given attack label class of the target model given the target model.

[0075] Among them, the method for obtaining the target space vector can be to first obtain a first space vector, then input the first space vector into a mapping network, obtain a second space vector output by the mapping network, and finally use the second space vector as the target space vector.

[0076] Please refer to the following for details: Figure 2 , Figure 2 This is a schematic diagram of the structure of StyleGAN-2 disclosed in the embodiment of this application, consisting of Figure 2 It can be seen that the first space vector is the z space vector, and the second space vector is the w vector.

[0077] It is worth mentioning that at present, generative adversarial networks (GANs) are one of the more popular image generation technologies in academia. Traditional generative models need to estimate the probability distribution function of natural images, which is a very difficult problem for complex image data. However, GANs directly skips this step and can generate very realistic images through adversarial games. Specifically, in the training process of GANs, the generator G and the discriminator D are trained alternately. For the generator, its goal is to transform the ordinary vector Z~P Z (Z) is mapped to G(Z) in the natural image space, and G(Z) can effectively deceive the discriminator D. In contrast, the goal of the discriminator is to be able to distinguish the generated data G(Z) and the real data X~P as much as possible through training. data (X). However, traditional GANs have problems such as training difficulty and mode collapse. In the embodiments of the present application, an improved StyleGAN-2 is used to replace GANs to solve the problems of GANs such as training difficulty and mode collapse.

[0078] Typically, the model inversion attack searches for the latent vector Z in the Z space. For the target class y C , its optimization objective function is formula 1:

[0079]

[0080] G in formula 1 is the generator, f θ is the target classifier model, z* is the optimal latent vector obtained by search;

[0081] Since the generated image has better continuity properties for the latent vector W, and the mapping network f helps the features to have stronger decoupling in the W space, we choose to optimize in the W space. C , the proposed optimization objective function is Formula 2:

[0082]

[0083] G in formula 2 is the generator, f θ is the target classifier model, and w* is the optimal latent vector obtained by search.

[0084] After obtaining the target space vector, the target space vector may be processed according to a preset rule to obtain a processed target space vector.

[0085] Among them, the method of processing the target space vector according to preset rules to obtain the processed target space vector can be: first add noise to the target space vector to obtain the target space vector after adding noise, and then use the target space vector after adding noise as the processed target space vector.

[0086] Specifically, for StyleGAN, a single style image can be synthesized using only a single latent vector W0, see Figure 3 , Figure 3 A schematic diagram of a method for synthesizing a single-style attack image from a single latent vector disclosed in an embodiment of the present application is shown in FIG. Figure 3 It can be seen that W0 is a single latent vector, which can be represented by the symbol W (i) (i=1,2,...,n) represents the latent vector used to synthesize the i-th single-style image. Finally, the single-style attack image corresponding to the latent vector of each i-th single-style image can be obtained. For example, w0 represents the facial features of person No. 1, and the single-style attack image corresponding to w0 is the single-style attack image based on the facial features of person No. 1. That is, the whole process of adding noise to the target space vector to obtain the target space vector after adding noise can be: first sample Z on the Gaussian distribution (i) , and then the sampled Z is mapped through the mapping network f (i) Map to W space and get initialized multiple sets of W (i) , and then adjust W according to the number of iteration steps (i) Introduce random noise with periodic standard deviation and get the noised W (i) .

[0087] It is worth mentioning that images near the manifold space of the target class image should generally be classified into this class with a high confidence. By introducing random noise with a periodic standard deviation, we can reduce the amount of computation while ensuring that the images near the searched target image are also highly similar to it, thereby improving the similarity between the generated target attack image and the target privacy image.

[0088] After obtaining the processed target space vector, the processed target space vector can be input into a pre-trained synthetic network to obtain an attack image output by the synthetic network.

[0089] The processed target space vector is input into a pre-trained synthetic network to obtain an attack image output by the synthetic network. The attack image can then be input into a target classifier to obtain a probability value of the target class of the attack image output by the target classifier.

[0090] After inputting the attack image into the target classifier and obtaining the probability value of the target class of the attack image output by the target classifier, the processed target space vector can be optimized according to the probability value of the target class of the attack image, so that the obtained optimized target space vector can be input into the synthesis network to obtain the optimized attack image output by the synthesis network.

[0091] Among them, the processed target space vector is optimized according to the probability value of the target class, and the obtained optimized target space vector is input into the synthesis network. The method for obtaining the optimized attack image output by the synthesis network can be: first, for each target space vector after adding noise, determine the mutation probability value corresponding to the target space vector after adding noise, and then perform mutation processing according to the mutation probability value corresponding to each target space vector after adding noise and a preset mutation method to obtain the mutated target space vector, and use the mutated target space vector as the optimized target space vector, so as to input the obtained optimized target space vector into the synthesis network to obtain the optimized attack image output by the synthesis network.

[0092] Among them, for each target space vector after adding noise, the method for determining the mutation probability value corresponding to the target space vector after adding noise can be: first, sort the probability values ​​of the target class of each attack image in order from large to small, and obtain the ranking corresponding to the probability value of the target class of each attack image, and then determine the sum of the number n of sorted probability values ​​and 1, and obtain the sum value n+1; n is an integer greater than or equal to 2, and finally, for the probability value of the target class of each attack image, compare the ranking corresponding to the probability value of the target class of the attack image with the sum value n+1 to obtain the mutation probability value corresponding to the target space vector after adding noise.

[0093] It is worth mentioning that the attack image obtained after adding noise to the target space vector is greatly affected by the initial value. That is, the final attack image, although its similarity with the target class is very low, has a higher prediction probability on the target class. In order to reduce the negative impact of the initial value on the final attack image, a mutation operation can be used. Specifically, according to the latent vector W (i) Sort the confidence scores on the target class and assign W with different probabilities (i) Perform mutation operation, and the mutation probability calculation formula is as follows:

[0094]

[0095] R in Formula 3 (i) is the confidence ranking, P (i) is the mutation probability.

[0096] However, randomly changing W (i) Will cause W (i) Departing from the valid W space, resulting in distortion of the generated image. Since the input space of the generated network has interpolation continuity, we use the preset mutation formula four to W (i) Perform mutation:

[0097]

[0098] W in Formula 4 (i) is the latent vector to be mutated, Z (i) is a Gaussian random vector, f is Figure 2 The mapping network in For all W (i) The first hidden vector in W ,λ Z is the coefficient of variation of the decay over time.

[0099] It is worth mentioning that the method for optimizing the processed target space vector according to the probability value of the target class of the attack image can also be to use the Adam optimizer and the cross entropy loss function L(f0(X (i) ),y C ) for the processed target space vector W (i) Optimize.

[0100] In this embodiment, a target space vector can be obtained, processed according to preset rules, and a processed target space vector can be obtained. The processed target space vector is then input into a pre-trained synthetic network to obtain an attack image output by the synthetic network. The attack image is then input into a target classifier to obtain a target class probability value for the attack image output by the target classifier. The processed target space vector is then optimized based on the target class probability value for the attack image. The optimized target space vector is then input into the synthetic network to obtain an optimized attack image output by the synthetic network. The target space vector can then be obtained, processed according to preset rules, and the processed target space vector is obtained. This improves the similarity between the generated target attack image and the target private image. Secondly, a mutation method can be designed for model inversion attack problems to expand the search space and prevent the model inversion attack from being trapped in a local optimal solution. Furthermore, random noise with a periodic standard deviation can be used to prevent the model inversion attack from being trapped in a local optimal solution. Finally, the Bayesian estimation model inversion attack method can be applied to scenarios with complex target data structures. This can improve the generalization capability of the model inversion attack method that uses auxiliary data to train an inverse generation model.

[0101] 2. Performing average processing on the target space vector to obtain a target space average vector, and using the target space average vector as the processed target space vector.

[0102] In this embodiment, when performing a model reverse attack, a target space vector can be obtained.

[0103] Among them, the method for obtaining the target space vector can be to first obtain a first space vector, then input the first space vector into a mapping network, obtain a second space vector output by the mapping network, and finally use the second space vector as the target space vector.

[0104] After obtaining the target space vector, the target space vector may be processed according to a preset rule to obtain a processed target space vector.

[0105] The target space vector is processed according to preset rules to obtain the processed target space vector. The target space vector may be first processed by averaging to obtain the target space average vector, and then the target space average vector is used as the processed target space vector.

[0106] For details, please refer to Figure 4 , Figure 4 Schematic diagram of a method for synthesizing multi-style attack images from multiple latent vectors disclosed in an embodiment of the present application, Figure 4 It can be seen that different W (i) To synthesize a style-mixed image, specifically, all the hidden vectors W obtained before can be(i) Average and use the average value As all W (i) For example, a set of W (i) The latent vectors of (i=1,2,...,n) generate a multi-style attack image corresponding to the group of latent vectors. For example, w1, w2, w3 to wn represent the facial features of person No. 1, person No. 2, person No. 3 to person No. n, respectively. The multi-style attack image corresponding to the group of latent vectors can be a multi-style attack image that combines the facial features of all the n persons.

[0107] After obtaining the processed target space vector, the processed target space vector can be input into a pre-trained synthetic network to obtain an attack image output by the synthetic network.

[0108] After obtaining the attack image output by the synthetic network, the attack image can be input into the target classifier to obtain the probability value of the target class of the attack image output by the target classifier.

[0109] Among them, a method for inputting the attack image into the target classifier to obtain the probability value of the target class of the attack image output by the target classifier can be: first, cropping the region of interest in the attack image output by the synthetic network to obtain the image of interest, then resizing the image of interest to obtain the resized image of interest, and finally inputting the resized image of interest into the target classifier to obtain the probability value of the target class of the attack image output by the target classifier.

[0110] After obtaining the target class probability value of the attack image output by the target classifier, the processed target space vector can be optimized based on the target class probability value of the attack image, so that the obtained optimized target space vector can be input into the synthesis network to obtain the optimized attack image output by the synthesis network. It can be understood that cropping the region of interest in the attack image output by the synthesis network, resizing the image of interest, and finally inputting the resized image of interest into the target classifier can improve the similarity of key features between the generated attack image and the target private image.

[0111] It is worth mentioning that the method for optimizing the processed target space vector according to the probability value of the target class of the attack image can be to optimize the processed target space vector according to the probability value of the target class of the attack image using the Adam optimizer and the cross entropy loss function.

[0112] In this embodiment, a target space vector can be obtained, processed according to preset rules, and a processed target space vector can be obtained. The processed target space vector is then input into a pre-trained synthesis network to obtain an attack image output by the synthesis network. The attack image is then input into a target classifier to obtain a target class probability value for the attack image output by the target classifier. The processed target space vector is then optimized based on the target class probability value for the attack image. The optimized target space vector is then input into the synthesis network to obtain an optimized attack image output by the synthesis network. The target space vector can then be obtained, processed according to preset rules, and the processed target space vector is obtained. This improves the similarity between the generated target attack image and the target private image. Furthermore, a model inversion attack can be implemented in W space, effectively improving the quality of the attack image. Furthermore, a style mixing post-processing technique can be proposed. The searched latent vector is used as the initial value for post-processing, and constraints are relaxed to further optimize the latent vector in a high-degree-of-freedom space, improving the quality of the generated attack image and the similarity between the attack image and the target private image. Finally, the Bayesian estimation model inverse attack method can be applied to scenarios with more complex target data structures. For the method of using auxiliary data to train the inverse generation model to perform model inverse attack, the generalization ability can be improved.

[0113] It can be understood that in addition to the method of obtaining the target space vector described above; in addition to the method of performing preset rule processing on the target space vector to obtain the processed target space vector described above; in addition to the method of inputting the processed target space vector into a pre-trained synthetic network to obtain the attack image output by the synthetic network described above; in addition to the method of optimizing the processed target space vector according to the probability value of the target class of the attack image so that the obtained optimized target space vector is input into the synthetic network to obtain the optimized attack image output by the synthetic network described above; in addition to the method of determining the mutation probability value corresponding to the target space vector after adding noise for each target space vector after adding noise described above; other reasonable methods can also be used, which are not limited here.

[0114] The above describes the model reverse attack method in the embodiment of the present application. The following describes the model reverse attack device in the embodiment of the present application. Figure 5 , an embodiment of the model reverse attack device in the embodiment of the present application includes:

[0115] An obtaining unit 501 is used to obtain a target space vector;

[0116] A processing unit 502 is configured to perform preset rule processing on the target space vector to obtain a processed target space vector;

[0117] An input unit 503 is configured to input the processed target space vector into a pre-trained synthesis network to obtain an attack image output by the synthesis network;

[0118] The input unit 503 is further configured to input the attack image into a target classifier to obtain a probability value of the target class of the attack image output by the target classifier;

[0119] The optimization unit 504 is used to optimize the processed target space vector according to the probability value of the target class of the attack image, so that the obtained optimized target space vector is input into the synthesis network to obtain the optimized attack image output by the synthesis network.

[0120] In an embodiment of the present application, a target space vector can be obtained, the target space vector is processed according to preset rules to obtain a processed target space vector, the processed target space vector is input into a pre-trained synthetic network to obtain an attack image output by the synthetic network, the attack image is input into a target classifier to obtain a probability value of the target class of the attack image output by the target classifier, the processed target space vector is optimized according to the probability value of the target class of the attack image, so that the obtained optimized target space vector is input into the synthetic network to obtain an optimized attack image output by the synthetic network, the target space vector can be obtained, the target space vector is processed according to preset rules to obtain a processed target space vector, thereby improving the similarity between the generated target attack image and the target privacy image.

[0121] See below Figure 6 Another embodiment of the model reverse attack device 600 in the embodiment of the present application includes:

[0122] CPU 601, memory 605, input / output interface 604, wired or wireless network interface 603 and power supply 602;

[0123] The memory 605 is a temporary storage memory or a permanent storage memory;

[0124] The CPU 601 is configured to communicate with the memory 605 and execute the instructions in the memory 605 to perform the aforementioned Figure 1 The method in the embodiment shown.

[0125] The embodiment of the present application also provides a computer-readable storage medium, which includes instructions. When the instructions are executed on a computer, the computer executes the aforementioned Figure 1 The method in the embodiment shown.

[0126] The present application also provides a computer program product comprising instructions, which, when executed on a computer, causes the computer to execute the aforementioned Figure 1 The method in the embodiment shown.

[0127] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0128] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0129] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0130] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0131] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0132] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk, and other media that can store program code.

Claims

1. A model reverse attack method, characterized in that: include: Get the target space vector; Performing preset rule processing on the target space vector to obtain a processed target space vector; Inputting the processed target space vector into a pre-trained synthetic network to obtain an attack image output by the synthetic network; Inputting the attack image into a target classifier to obtain a probability value of the target class of the attack image output by the target classifier; Optimizing the processed target space vector according to the probability value of the target class of the attack image, so that the obtained optimized target space vector is input into the synthesis network to obtain the optimized attack image output by the synthesis network; The performing of preset rule processing on the target space vector to obtain a processed target space vector includes: performing noise adding processing on the target space vector to obtain a target space vector after noise addition; Using the noise-added target space vector as the processed target space vector; Inputting the processed target space vector into a pre-trained synthetic network to obtain an attack image output by the synthetic network includes: Inputting the noise-added target space vector into the synthesis network to obtain an attack image output by the synthesis network; Optimizing the processed target space vector according to the probability value of the target class of the attack image, inputting the obtained optimized target space vector into the synthesis network, and obtaining the optimized attack image output by the synthesis network, includes: For each target space vector after adding noise, determining a mutation probability value corresponding to the target space vector after adding noise; Mutation processing is performed according to the mutation probability value corresponding to each target space vector after adding noise and a preset mutation method to obtain a mutated target space vector, and the mutated target space vector is used as the optimized target space vector, so that the obtained optimized target space vector is input into the synthesis network to obtain the optimized attack image output by the synthesis network.

2. The method according to claim 1, characterized in that The obtaining of the target space vector comprises: Get the first space vector; Inputting the first space vector into a mapping network to obtain a second space vector output by the mapping network; The second space vector is used as the target space vector.

3. The method according to claim 1, characterized in that The step of determining, for each noise-added target space vector, a mutation probability value corresponding to the noise-added target space vector includes: Sorting the probability values ​​of the target class of each attack image in descending order to obtain a ranking corresponding to the probability value of the target class of each attack image; Determine the sum of the number n of probability values ​​to be sorted and 1 to obtain a sum value n+1; wherein n is an integer greater than or equal to 2; For each probability value of the target class of the attack image, the ranking corresponding to the probability value of the target class of the attack image is compared with the sum value n+1 to obtain a mutation probability value corresponding to the target space vector after adding noise.

4. The method according to claim 1, wherein The performing of preset rule processing on the target space vector to obtain a processed target space vector includes: Performing average processing on the target space vector to obtain a target space average vector; Inputting the processed target space vector into a pre-trained synthetic network to obtain an attack image output by the synthetic network includes: The target space average vector is input into the synthesis network to obtain an attack image output by the synthesis network.

5. The method according to claim 4, characterized in that After inputting the target space average vector into the pre-trained synthetic network to obtain the attack image output by the synthetic network, and before inputting the attack image into the target classifier, the method further includes: Performing cropping on a region of interest in the attack image output by the synthetic network to obtain an image of interest; resizing the image of interest to obtain a resized image of interest; The step of inputting the attack image into a target classifier comprises: The resized image of interest is input into the object classifier.

6. The method according to claim 1, characterized in that Optimizing the processed target space vector according to the probability value of the target class of the attack image includes: According to the probability value of the target class of the attack image, the processed target space vector is optimized using an Adam optimizer and a cross entropy loss function.

7. A model reverse attack device, characterized in that: include: central processing unit and memory; The memory is a transient storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium comprises instructions, and when the instructions are executed on a computer, the computer is caused to perform the method according to any one of claims 1 to 6.

9. A computer program product comprising instructions, characterized in that When the computer program product is run on a computer, the computer is caused to perform the method according to any one of claims 1 to 6.

Images