Image processing method and related device

Abstract

Embodiments of the present application provide an image processing method and related equipment, which can generate an adversarial sample and be used to attack a multi-label classification model. The method of the embodiments of the present application comprises: obtaining original image samples; wherein any original image sample is an image sample with multiple different image labels identified by a multi-label classification model; inputting the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample; adding perturbation to the initial adversarial sample based on a differential evolution algorithm to generate a target fitness value of a target individual in a population and an intermediate adversarial sample corresponding to the target fitness value, and determine whether the target fitness value meets a first preset sample threshold; if yes, determining that the intermediate adversarial sample is a target adversarial sample, and outputting the target adversarial sample to make the attack on the multi-label classification model successful; wherein the target adversarial sample is an image sample with a target image label identified by the multi-label classification model.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of artificial intelligence and deep learning, and in particular to an image processing method and related equipment. BACKGROUND

[0002] In recent years, deep neural networks have risen rapidly and have been widely used in many intelligent fields such as face recognition and automatic driving. However, deep neural networks are facing the threat of adversarial samples. Adversarial samples refer to a small perturbation that is imperceptible to the human eye added to the original image, so that the deep learning model produces an incorrect classification result with high confidence. The existence of adversarial samples greatly threatens the security of deep neural network models and brings great security risks to application systems based on deep learning.

[0003] Currently, most of the research on adversarial sample generation algorithms at home and abroad is focused on single-label classification models, that is, existing technical solutions can only be used to attack single-label classification models, but cannot attack multi-label classification models. However, in daily life, whether it is an image or a text, it often contains multiple labels, so the research on multi-label adversarial sample generation is more practical. SUMMARY

[0004] Embodiments of the present application provide an image processing method and related equipment, which can generate adversarial samples and be used to attack multi-label classification models.

[0005] The first aspect of the embodiments of the present application provides an image processing method, comprising:

[0006] obtaining an original image sample; wherein the original image sample is an image sample with multiple different image labels identified by a multi-label classification model;

[0007] inputting the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample;

[0008] adding perturbation to the initial adversarial sample based on a differential evolution algorithm to generate a target fitness value of a target individual in a population and an intermediate adversarial sample corresponding to the target fitness value, and determining whether the target fitness value meets a first preset sample threshold; wherein the target fitness value is used to feedback the similarity between the original image sample and the initial adversarial sample, and the population includes multiple randomly generated individuals;

[0009] if yes, determining that the intermediate adversarial sample is a target adversarial sample, and outputting the target adversarial sample to make the attack on the multi-label classification model successful; wherein the target adversarial sample is an image sample with a target image label identified by the multi-label classification model.

[0010] Optionally, the inputting the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample comprises:

[0011] obtaining a substitute image sample; wherein the substitute image sample is an image sample with the same image label as the original image sample;

[0012] obtaining a target image region in the substitute image sample that matches an attack image region of the original image sample;

[0013] covering an image sample corresponding to the target image region on the attack image region to generate the initial adversarial sample.

[0014] Optionally, the adding perturbation to the initial adversarial sample based on a differential evolution algorithm to generate a target fitness value of a target individual in a population and an intermediate adversarial sample corresponding to the target fitness value comprises:

[0015] calculating a mask matrix of the original image sample and the initial adversarial sample;

[0016] generating a perturbation image sample; wherein any of the perturbation image samples is a matrix vector with the same size as the mask matrix;

[0017] inputting any of the perturbation image samples, the original image sample and the mask matrix into the differential evolution algorithm to obtain fitness values corresponding to all the perturbation image samples;

[0018] determining that the minimum fitness value among all the fitness values is the target fitness value.

[0019] Optionally, the generating a perturbation image sample comprises:

[0020] generating a noise matrix with the same matrix size as the mask matrix; wherein any element in the noise matrix is a non-negative number and is associated with an element in the mask matrix;

[0021] determining a direction function and an amplification coefficient; the direction function is used to determine that any element in the mask matrix and any element in the perturbation image sample correspond to the same position direction;

[0022] calculating any of the noise matrices based on the algorithm parameters to generate the perturbation image sample; wherein the perturbation image sample comprises a plurality of noise matrices calculated based on the algorithm parameters.

[0023] Optionally, after inputting any of the perturbation image samples, the original image sample and the mask matrix into the differential evolution algorithm, the method further comprises:

[0024] obtaining a first perturbed image sample, a second perturbed image sample and a third perturbed image sample in the perturbed image samples with the same iteration number; wherein the first perturbed image sample is the perturbed image sample with the smallest fitness value in the perturbed image samples with the current iteration number, and the second perturbed image sample and the third perturbed image sample are any two perturbed image samples in the perturbed image samples with the current iteration number;

[0025] determining a sample variation algorithm and a corresponding scale factor;

[0026] inputting the first perturbed image sample, the second perturbed image sample, the third perturbed image sample and the scale factor into the sample variation algorithm to obtain all perturbed image samples with the next iteration number.

[0027] Optionally, after the first perturbed image sample, the second perturbed image sample, the third perturbed image sample and the scale factor are inputted into the sample variation algorithm to obtain all perturbed image samples with the next iteration number, the method further comprises:

[0028] determining whether the fitness value or the magnification factor corresponding to the perturbed image sample with the current iteration number satisfies a preset termination condition;

[0029] if yes, performing the step of determining that the smallest fitness value in all the fitness values is the target fitness value;

[0030] if no, determining that the next iteration number is the current iteration number, and adjusting the magnification factor based on a preset scale to perform the step of obtaining the first perturbed image sample, the second perturbed image sample and the third perturbed image sample in the perturbed image samples with the same iteration number.

[0031] Optionally, before the step of determining that the smallest fitness value in all the fitness values is the target fitness value, the method further comprises:

[0032] determining a selection function taking the fitness value as an output value;

[0033] inputting the mask matrix and all the perturbed image samples with the current iteration number into the selection function to determine the perturbed image sample with the smallest fitness value in the current iteration number as the perturbed image sample with the next iteration number.

[0034] Optionally, after the original image sample is obtained, before the original image sample is inputted into the initial adversarial sample generation algorithm to obtain an initial adversarial sample, the method further comprises:

[0035] determine whether the current number of perturbations meets a preset number threshold;

[0036] if the current number of perturbations meets the preset number threshold, perform the step of inputting the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample;

[0037] if the current number of perturbations does not meet the preset number threshold, determine that an adversarial sample meeting a minimum fitness value is an optimal adversarial sample;

[0038] determine whether the fitness value of the optimal adversarial sample meets a second preset sample threshold;

[0039] if the fitness value of the optimal adversarial sample meets the second preset sample threshold, determine that the optimal adversarial sample is a target adversarial sample, and perform the step of outputting the target adversarial sample to make an attack on the multi-label classification model successful;

[0040] if the fitness value of the optimal adversarial sample does not meet the second preset sample threshold, output the original image sample and determine that the attack on the multi-label classification model fails.

[0041] Optionally, after the step of determining whether the target fitness value meets the first preset sample threshold, the method further comprises:

[0042] if the target fitness value does not meet the first preset sample threshold, adjust the current number of perturbations to a next number of perturbations, and perform the step of determining whether the current number of perturbations meets a preset number threshold.

[0043] The second aspect of the embodiments of the present application provides an image processing system, comprising:

[0044] an acquisition unit configured to acquire an original image sample; wherein the original image sample is an image sample with multiple different image labels identified by a multi-label classification model;

[0045] an input unit configured to input the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample;

[0046] an execution unit configured to add perturbations to the initial adversarial sample based on a differential evolution algorithm to generate a target fitness value of a target individual in a population and an intermediate adversarial sample corresponding to the target fitness value, and determine whether the target fitness value meets a first preset sample threshold; wherein the target fitness value is used to feedback a similarity degree between the original image sample and the initial adversarial sample, and the population comprises multiple randomly generated individuals;

[0047] The determining unit is configured to determine the intermediate adversarial sample as a target adversarial sample when the target fitness value meets the first preset sample threshold, and output the target adversarial sample so as to make the attack on the multi-label classification model successful; wherein the target adversarial sample is an image sample with a target image label recognized by the multi-label classification model.

[0048] The embodiment of the present application provides the image processing method.

[0049] The embodiment of the present application provides an image processing device.

[0050] The central processor, the memory, the input and output interface, the wired or wireless network interface and the power supply;

[0051] The memory is a transient storage memory or a persistent storage memory;

[0052] The central processor is configured to communicate with the memory and execute the instruction operation in the memory to execute the method of the first aspect.

[0053] The embodiment of the present application provides a computer readable storage medium.

[0054] From the above technical solutions, it can be seen that the embodiment of the present application has the following advantages: the image processing method provided by the embodiment of the present application obtains an original image sample; inputs the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample; adds perturbation to the initial adversarial sample based on a differential evolution algorithm to generate a target fitness value of a target individual in a population, a target fitness value and an intermediate adversarial sample, and determines whether the target fitness value meets a first preset sample threshold; if yes, determines that the intermediate adversarial sample is a target adversarial sample, and outputs the target adversarial sample so as to make the attack on the multi-label classification model successful. Thus, the multi-label adversarial sample can be efficiently generated, the image processing method only needs to set a sample label without setting other training information, and the image processing method needs very little known information, only needs to obtain the label information output by the attack target model, and does not need any label confidence and other internal information of the model. Therefore, the image processing method has high expansibility and is convenient for attacking the multi-label classification model. BRIEF DESCRIPTION OF DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments description will be briefly introduced. Obviously, the drawings in the following description only represent some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0056] Figure 1 A flowchart of an image processing method disclosed by an embodiment of the present application;

[0057] Figure 2 A flowchart of another image processing method disclosed by an embodiment of the present application;

[0058] Figure 3 A flowchart of a differential evolution algorithm disclosed by an embodiment of the present application;

[0059] Figure 4 An adversarial sample comparison chart disclosed by an embodiment of the present application;

[0060] Figure 5 A structural diagram of an image processing system disclosed by an embodiment of the present application;

[0061] Figure 6 A structural diagram of an image processing device disclosed by an embodiment of the present application. DETAILED DESCRIPTION

[0062] The terms used herein are only for the purpose of describing specific embodiments and not as a limitation of the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising", when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. As used herein, the term "and / or" includes any and all combinations of the associated listed items.

[0063] The terms "first", "second", "third", "fourth" and the like in the description and in the claims of the present application and above-mentioned drawings, if any, are used for distinguishing between similar objects and not necessarily for describing a specific sequential or chronological order. It is to be understood that the use of the terms so construed herein is merely for convenience and only to aid in understanding the application and in no way define the scope of the application. Further, the terms "comprise", "comprising", "include", "including", and "contains", "containing" as well as any variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises, includes or contains an element or list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0064] It should be noted that the terms "first", "second", etc. in the description of the present application are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined as "first", "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of various embodiments can be combined with each other, but it must be based on the fact that a person skilled in the art can realize it. When the combination of technical solutions contradicts each other or cannot be realized, it should be considered that the combination of technical solutions does not exist, and is not within the scope of protection required by the present application.

[0065] The technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person skilled in the art without creative labor are within the scope of protection of the present application.

[0066] In recent years, deep neural networks have risen rapidly and have been widely used in many intelligent fields such as face recognition and automatic driving. However, deep neural networks are facing the threat of adversarial samples. Adversarial samples refer to a small perturbation that is imperceptible to the human eye added to the original image, so that the deep learning model produces an incorrect classification result with high confidence. The existence of adversarial samples greatly threatens the security of deep neural network models and brings great security risks to application systems based on deep learning. The technical solutions of the present application aim to generate multi-label adversarial samples efficiently in a black-box environment without knowing the internal parameters of the model, the training data set, and the prediction confidence, only relying on the predicted label of the model.

[0067] For example, a multi-label classification model is widely used in deep learning-based intelligent systems. When any picture sample containing several labels (such as a picture containing a cat, a dog, etc.) is input, the multi-label classification model calculates the confidence of each label contained in the sample. When the confidence of any label is greater than 0.5, it is considered that the sample contains this label. For example, the model may calculate the following confidence: person: 0.1; cow: 0.2; cat: 0.9; dog: 0.8. Then, the model considers that the picture contains two labels of cat and dog, and outputs "cat, dog".

[0068] The algorithm proposed in the technical solution of the present application generates a multi-label adversarial sample only by using the output label of the model without using any other known information. That is, after attacking the input sample, the human eye cannot distinguish it from the original sample, and it is still a picture of a cat and a dog, but the classifier will make a mistake according to the requirement, such as failing to recognize the "cat" label or identifying the "dog" label as "car" and the like.

[0069] Correspondingly, most of the current domestic and foreign researches on initial adversarial sample generation algorithms are focused on single-label classification models. That is, most of the existing technical solutions can only be used to attack single-label classification models, and cannot attack multi-label classification models. However, in daily life, whether it is an image or a text, it often contains multiple labels, so the research on multi-label adversarial sample generation is more practical.

[0070] Up to now, there are few researches on multi-label adversarial samples, and the existing multi-label adversarial attack algorithms are all designed for white-box environment, that is, the existing multi-label adversarial sample generation technology must be able to access the internal parameters, gradient information, training set and prediction confidence of the model in order to achieve attack. And these algorithms cannot be applied to black-box environment where only the prediction label of the model can be obtained and no other information can be obtained. At present, there is no multi-label initial adversarial sample generation algorithm designed for black-box environment in the world.

[0071] It should be noted in advance that the various algorithms or methods disclosed in the image processing method proposed by the embodiments of the present application can be run on a client or a server. For the convenience of description, this will not be described again in the following.

[0072] Please refer to Figure 1 , Figure 1 The flowchart of the image processing method disclosed by the embodiments of the present application is shown in the figure. It includes steps 101-104.

[0073] 101, obtain an original image sample.

[0074] Before attacking the target model, i.e., the multi-label classification model, it is necessary to obtain the original sample. In one embodiment, the original sample refers to the sample that the attacker wants to attack; the specific source of the original sample is not limited here. It is easy to understand that the original sample described in this embodiment is the original image sample described above. For ease of understanding and description, this will not be elaborated further. It is easy to understand that the original image sample at this time can be identified by the multi-label classification model with multiple different image labels. Correspondingly, it is also possible that the original image sample can only be identified with one image label, but it should be noted that this embodiment mainly describes the multi-label classification model. Therefore, it can be known that the original image sample at this time should be an image sample with multiple image labels.

[0075] In another embodiment, the original sample can also be a video frame, etc., which is not limited here. For ease of understanding and description, it will be described in detail with images or pictures later.

[0076] 102. Input the original image samples into the initial adversarial sample generation algorithm to obtain the initial adversarial samples.

[0077] Once the original image sample is obtained, it needs to be input into the initial adversarial sample generation algorithm so that the algorithm can generate the corresponding initial adversarial sample.

[0078] In one embodiment, specifically, a YOLOv3 object detector is first trained using an alternative dataset similar to the dataset used to train the attack target model. Then, regions matching the attack target are identified and cropped from the alternative dataset, and finally randomly pasted into the original samples to generate initial adversarial examples. If initial adversarial examples cannot be generated after pasting, the YOLO object detector is used to identify regions matching the attack target from other samples in the alternative dataset, and then cropping and pasting are performed again. It's easy to understand that the alternative dataset contains the same number and types of labels as the original dataset. The alternative dataset can be obtained in various ways, such as by crawling images of specified categories from a large dataset to create the alternative dataset. Correspondingly, the original dataset includes multiple original sample data.

[0079] It should also be noted that any sample in the alternative dataset at this point is the alternative image sample described above, and the YOLOv3 object detector can be understood as an initial adversarial sample generation algorithm. Correspondingly, the YOLOv3 object detector can identify and attack multiple alternative image samples, and the size of the alternative image sample here can be the same as or different from the original image sample; there is no specific restriction here.

[0080] Specifically, that is to say, in the case of extremely limited known information of the attack target model, by adding a tiny perturbation that is difficult for human eyes to detect to the original image sample, an adversarial sample can be generated which can induce the multi-label classification model to produce misclassification according to the user's requirements.

[0081] In another embodiment, if the initial adversarial sample cannot be generated after the entire process is run several times, the YOLOv3 target detector is abandoned, and a sample that meets the attack target is directly selected from the alternative data set as the initial adversarial sample. Correspondingly, the initial adversarial sample at this time is equivalent to the image sample of the alternative image sample.

[0082] 103、Based on the differential evolution algorithm, perturbations are added to the initial adversarial sample to generate target fitness values of target individuals in the population and intermediate adversarial samples corresponding to the target fitness values, and it is determined whether the target fitness values meet the first preset sample threshold. If yes, step 103 is executed.

[0083] After the initial adversarial sample is generated, the current adversarial sample needs to be continuously optimized by differential evolution so that the perturbation becomes increasingly invisible. It should be noted that differential evolution is an evolutionary algorithm. Its basic idea is to use the differences between individuals in the current population to produce offspring. Differential evolution mainly includes four steps: initialization, mutation, crossover and selection. In the initial evolution stage, an initial population is randomly generated. In the subsequent mutation process, two different individual vectors are randomly selected to subtract to generate a differential vector. The differential vector is multiplied by a scale factor and added to a randomly selected third individual to generate a mutation vector. Then the mutation vector and the specified parent individual vector are crossed according to certain rules to generate offspring individuals. The newly generated offspring individuals are directly compared with their parents. The fitness value of each individual is used as the selection measure, and the individual with a better fitness function survives to the next generation. Through continuous evolution, better individuals are retained, and the search process is guided to the optimal solution.

[0084] It should be noted that the parent individual refers to the two different individual vectors selected above. At the same time, the fitness value is calculated according to the fitness evaluation function. According to different optimization problems, the design of the fitness evaluation function is different.

[0085] It should also be noted that the population is essentially a multi-dimensional matrix composed of multiple "individuals", each of which is a matrix of the same size as the initial adversarial sample. The idea of differential evolution is to simulate the reproduction of species in nature, allowing individuals in the entire population to mutate and cross, and iterating to gradually approach the optimal solution. The final result is to find an individual in the population, add the individual to the adversarial sample, and the adversarial sample will become very close to the original sample and still be able to induce the multi-label classifier to produce misclassification consistent with the attack target.

[0086] In one embodiment, by adding perturbation to the initial adversarial sample, the l2 norm of the perturbed adversarial sample and the perturbation of the population can be determined, i.e. the fitness value. When the fitness value at this time is the minimum, it can be determined that the fitness value at this time is the target fitness value. That is, the smaller the perturbation of the new sample generated by adding the "individual" of this population to the initial adversarial sample, the closer it is to the original sample, and such "individual" is more consistent with our attack target. If the perturbation at this time is the smallest, the corresponding target fitness value is the target fitness value. It is not difficult to understand that at this time, the perturbed adversarial sample is the intermediate adversarial sample.

[0087] Correspondingly, if the target fitness value at this time, i.e. the perturbation, satisfies the first preset sample threshold, step 104 is performed.

[0088] Specifically, the first preset sample threshold at this time is the maximum distance of the algorithm-acceptable adversarial sample, which is also a threshold set in advance. It is usually set by the user according to experience. The larger the first preset sample threshold is set, the faster the generation of adversarial samples is, the higher the success rate is, but the perturbation will be more obvious. That is, if the perturbation at this time, i.e. the target fitness value, is less than the maximum distance of the algorithm-acceptable adversarial sample, step 104 is performed.

[0089] In another embodiment, if the perturbation at this time, i.e. the target fitness value, is greater than the maximum distance of the algorithm-acceptable adversarial sample, the adversarial sample needs to be regenerated, and correspondingly, step 102 is performed.

[0090] 104, determining that the intermediate adversarial sample is the target adversarial sample, and outputting the target adversarial sample to make the attack on the multi-label classification model successful.

[0091] When the target fitness value is determined, the intermediate adversarial sample can be determined as the target adversarial sample at this time. At this time, the target adversarial sample can be outputted, so as to determine the success of the attack on the multi-label prediction model. That is, at this time, the prediction result vector of the multi-label prediction model on the adversarial sample is completely consistent with the target label vector defined by the attacker.

[0092] It is understandable that the embodiment mainly describes how to generate a target adversarial sample according to an original image sample.

[0093] By the image processing method provided in the embodiment, the original image sample is obtained, the original image sample is input into an initial adversarial sample generation algorithm to obtain an initial adversarial sample, a differential evolution algorithm is used to add perturbation to the initial adversarial sample to generate a target fitness value of a target individual in a population and an intermediate adversarial sample, and it is determined whether the target fitness value meets a first preset sample threshold. If yes, the intermediate adversarial sample is determined as the target adversarial sample, and the target adversarial sample is output, so that the attack on the multi-label classification model is successful. Thus, the multi-label adversarial sample can be efficiently generated, the image processing method only needs to set the sample label and does not need to set other training information, and the image processing method needs very little known information, only needs to know the label information output by the attack target model, and does not need any label confidence and other internal information of the model. Therefore, the image processing method has high expansibility and is convenient for attacking the multi-label classification model.

[0094] For the convenience of describing the image processing method provided in the embodiment in detail, please refer to Figure 2 , Figure 2 is a flowchart of another image processing method disclosed in the embodiment of the application. It includes steps 201-209.

[0095] It should be noted that the entire algorithm is divided into three stages: a YOLO initialization stage, a distance reduction stage, and a judgment stage. In the YOLO initialization stage, first, with the help of the YOLOv3 target detector, an initial adversarial sample with a large perturbation amount is generated without cost. In the subsequent distance reduction stage, the differential evolution algorithm is used to continuously optimize the current adversarial sample to reduce the gap between it and the original clean sample, so that it is visually closer and closer to the original sample; until the perturbation amount of the adversarial sample is small enough (the l2 distance between the adversarial sample and the original sample is used as a measure) or the algorithm reaches the specified number of queries. Finally, in the judgment stage, according to the perturbation amount of the generated adversarial sample, it is determined whether to use the result of the algorithm this time as the final output or to restart the initialization stage of the algorithm for re-optimization.

[0096] Correspondingly, the YOLO algorithm uses a single convolutional neural network (CNN) model to realize end-to-end target detection. YOLOv3 is a target detection algorithm project, and the essence of target detection is identification and regression, and the most commonly used method for processing images is CNN, so YOLOv3 is essentially a deep convolutional neural network that realizes the regression function. It should be noted that the l2 distance between the adversarial sample and the original sample as a measure means that the l2 distance between the adversarial sample and the original sample is used to measure the similarity between the adversarial sample and the original sample. The l2 distance, also known as the Euclidean distance, is the most common representation of the distance between multiple points. In simple terms, the smaller the L2 distance, the more similar the adversarial sample is to the original sample. For the convenience of understanding and description, this will not be described in detail hereinafter.

[0097] 201, obtain an original image sample.

[0098] Before attacking the target model, that is, the multi-label classification model, the original sample needs to be obtained. In one embodiment, the original sample refers to the sample that the attacker wants to attack, and the source of the original sample is not limited here. It is not difficult to understand that the original sample described in this embodiment is the original image sample described above. For the convenience of understanding and description, this will not be described in detail hereinafter. It is not difficult to understand that the original image sample at this time can be identified by the multi-label classification model as having multiple different image labels. Correspondingly, it is also possible that the original image sample can only be identified as having one image label, but it should be noted that this embodiment mainly describes a multi-label classification model, and therefore it can be known that the original image sample at this time should be an image sample with multiple image labels.

[0099] In another embodiment, the original sample can also be a video frame, etc., and the specific implementation is not limited here. For the convenience of understanding and description, the image or picture will be described in detail hereinafter.

[0100] 202, determine whether the current perturbation number meets the preset number threshold. If yes, execute step 203; if no, execute step 207.

[0101] In the initial stage, the perturbation number at this time can be set to 0, and correspondingly, i=0 is determined. It should be noted that i at this time is the perturbation number for generating the target adversarial sample in the entire algorithm operation process. It can also be understood as a number of attempts.

[0102] At this time, after obtaining the current perturbation number, it can be determined whether the current perturbation number meets the preset number threshold. If yes, execute step 203; if no, execute step 207.

[0103] In one embodiment, that is, judging i max It is understood that T max is the maximum number of attempts of the algorithm, which is a preset value, that is, the preset number threshold described in the above, for the convenience of understanding and description, which will not be described hereinafter.

[0104] Correspondingly, if i max at this time, it is determined that the number of attempts has not reached the maximum number of attempts, at this time, step 203 is executed. If i max at this time, it is determined that the number of attempts has reached the maximum number of attempts, at this time, step 207 is executed.

[0105] 203, obtaining a substitute image sample and any target image region in the substitute image sample matched with the attack image region of the original image sample.

[0106] Steps 203-204 in this embodiment are similar to step 102 in the foregoing Figure 1 , which will not be described hereinafter.

[0107] It should be noted that when the original image sample is obtained, a part of the substitute image sample can be cropped to generate an image region matched with the attack image region of the original image sample, and the image region at this time is the target image region. It is understood that at this time, any substitute image sample in the substitute data set can be understood as being identified, and then an image region is collected from the substitute image sample, and then the region is overlaid on the required attack region of the original image sample, at this time, the area of the region of the selected substitute image sample is the target image region. The required attack region of the original image sample is the attack image region.

[0108] 204, covering the image sample corresponding to the target image region on the attack image region to generate an initial adversarial sample.

[0109] Correspondingly, after the target image region is determined, the image corresponding to the substitute image sample can be overlaid on the attack image region of the original image sample to generate an initial adversarial sample.

[0110] In another embodiment, if the initial adversarial sample cannot be generated after the entire process is run several times, the YOLOv3 target detector is abandoned, and a sample that meets the attack target is selected from the substitute data set as the initial adversarial sample. Correspondingly, the initial adversarial sample at this time is equivalent to the image sample of the substitute image sample.

[0111] It is understood that steps 203-204 are the YOLO initialization stage described in the above.

[0112] In one embodiment, please refer to Figure 4 , Figure 4 A confrontation sample comparison chart disclosed in an embodiment of the present application. Specifically, the chart can be understood as an initial confrontation sample generated in the YOLO initialization stage, where the first row is the original sample, the second row is the initial confrontation sample, and the prediction label of the multi-label classifier is below each image. For example, for the original sample and the initial confrontation sample in the first column, the label predicted by the original sample in the first column is "person" and "dog". Identify and crop the region matching the attack target from the alternative data set (for example, for the first column, the image in the second column is used), and finally randomly paste them into the original sample, that is, the first row corresponding to the first column, to generate the initial confrontation sample. As can be seen from the first row of the first column, there is an occlusion part in the initial confrontation sample at this time, so that the multi-label classifier can only predict that the initial confrontation sample has only one label, which is "person".

[0113] The significance of the YOLO initialization stage is that it can generate an initial confrontation sample with the least number of queries. And through cropping and pasting, it ensures that the covered part of the original sample is as small as possible, thereby reducing the optimization difficulty of the subsequent distance reduction stage.

[0114] 205、Based on the differential evolution algorithm, perturbations are added to the initial confrontation sample to generate a target fitness value of a target individual in the population and an intermediate confrontation sample, and it is determined whether the target fitness value meets a first preset sample threshold. If not, step 206 is executed; if yes, step 209 is executed.

[0115] Step 205 in the embodiment is similar to step 103 in the foregoing Figure 1 , and details are not repeated here. However, it should be noted that if the target fitness value meets the first preset sample threshold at this time, step 209 is executed; if the target fitness value does not meet the first preset sample threshold at this time, step 206 is executed.

[0116] It is not difficult to understand that step 205 at this time is the distance reduction stage described in the foregoing.

[0117] Specifically, in one specific embodiment, the core idea of the distance reduction stage of the differential evolution algorithm is as follows. It should be noted that for the convenience of understanding and description, the original image sample will be described in detail as an original sample hereinafter.

[0118] For the original sample x, first initialize an initial adversarial sample matching the attack target through the YOLO target detector, that is, steps 203-204. Then calculate the mask mask = ~x-x. Then generate the perturbation population per, and optimize the perturbation through the differential evolution algorithm. It should be noted that the mask is the part of the attack image region corresponding to the substitute image sample in steps 203-204. Correspondingly, the perturbation population per is essentially a multi-dimensional matrix composed of multiple individuals per(n), and each individual per(n) is a matrix with the same size as the initial adversarial sample. Correspondingly, n is the nth individual in the perturbation population. The optimization objective is as follows:

[0119] min||mask-per(n)||2

[0120] s.t.f(x+mask-per(n))=target,target≠y。

[0121] Where target represents the attack target vector, y represents the label vector of the original sample, and per(n) represents the nth individual in the population per. That is, the optimization objective is to find an individual per(n) in the population per such that ||mask-per(n)||2 is as small as possible, and ensure that after adding mask-per(n) to the original sample, the multi-label classifier can make an incorrect judgment according to the attack target. Its physical meaning is that the smaller ||mask-per(n)||2 is, the less the mask covers, the more the original sample is exposed, and the closer the generated adversarial sample is to the original sample. It is not difficult to understand that ||mask-per(n)||2 is a kind of l2 norm of adversarial sample, that is, the fitness value or perturbation amount described above.

[0122] It is not difficult to understand that step 205 can be summarized as determining the initial population and various algorithm parameters, and then calculating the fitness value of each individual in the population. Then through multiple iterations and meeting the termination condition, the smallest fitness value of all individuals at this time is obtained, and the smallest fitness value is determined as the target fitness value, and then it is judged whether the target fitness value meets the first preset sample threshold L max , that is, whether the perturbation amount at this time is less than L max . If the target fitness value at this time, that is, the perturbation amount is less than the first preset sample threshold, step 209 is executed.

[0123] Specifically, L max is the maximum l2 norm of the adversarial sample acceptable to the algorithm, and is a threshold set in advance. It is usually set by the user according to experience. L maxThe larger the setting is, the faster the speed of generating the adversarial sample is, and the higher the success rate is, but the perturbation will be more obvious. That is, if the perturbation amount at this time, that is, the target fitness value, is less than the maximum distance of the adversarial sample acceptable to the algorithm, step 209 is performed.

[0124] In another embodiment, if the perturbation amount at this time, that is, the target fitness value, is greater than the maximum distance of the adversarial sample acceptable to the algorithm, the adversarial sample needs to be regenerated, and correspondingly, step 206 is performed.

[0125] It is not difficult to understand that in the current perturbation, the initial adversarial sample after perturbation is the intermediate adversarial sample.

[0126] 206, determine the next perturbation times as the current perturbation times.

[0127] At this time, the current perturbation times i is increased, that is, i=i+1. That is, the next perturbation times i is greater than the current perturbation times by 1. Then step 202 is performed.

[0128] 207, determine the adversarial sample satisfying the minimum fitness value as the best adversarial sample, and judge whether the fitness value of the best adversarial sample satisfies the second preset sample threshold. If yes, step 209 is performed; if no, step 208 is performed.

[0129] When the current perturbation times i is greater than or equal to T max , that is, if the l2 norm of the adversarial sample generated after T max attempts is still greater than L max , the best adversarial sample at this time is determined. It is not difficult to understand that the best adversarial sample at this time is the adversarial sample with the minimum fitness value in the previous multiple perturbation processes. It is not difficult to understand that the model can always collect the adversarial samples generated in the operation process and the corresponding fitness values.

[0130] At this time, it is judged whether the fitness value corresponding to the best adversarial sample satisfies the second preset sample threshold, and correspondingly, whether the perturbation amount of the best adversarial sample at this time is less than the second preset sample threshold, if the perturbation amount of the best adversarial sample is less than the second preset sample threshold, step 209 is performed; if the perturbation amount of the best adversarial sample is greater than or equal to the second preset sample threshold, step 208 is performed.

[0131] In one embodiment, the second preset sample threshold is 2×L max , and if the l2 norm of the best adversarial sample in the previous T max times is less than 2×L max , the adversarial sample is still considered acceptable, and step 209 is performed at this time. That is, the adversarial sample in the previous Tmax The second smallest perturbation of the adversarial sample is taken as the output of the algorithm, that is, the best adversarial sample is taken as the target adversarial sample.

[0132] 208、Output the original image sample and determine that the attack on the multi-label classification model fails.

[0133] If the previous T max The l2 norm of the second best adversarial sample is greater than or equal to 2xL max It is considered that the perturbation generated by the algorithm is too large to lose its adversarial significance, and the original sample is returned (i.e. this attack fails).

[0134] It is not difficult to understand that the significance of the judgment stage of step 202 is that it divides a limited number of queries into multiple subsets. Whenever a specified number of queries is completed, the framework will determine whether the algorithm has fallen into a local optimal region during the search process through the norm of the current example, so that when it falls into a local optimum, the search position can be reselected in time. This can avoid the algorithm being stuck in a local optimal region and still being unable to jump out after a large number of iterations, thereby wasting a large number of query times.

[0135] 209、Determine that the intermediate adversarial sample is the target adversarial sample, and output the target adversarial sample, so that the attack on the multi-label classification model is successful.

[0136] Step 209 in this embodiment is similar to step 104 in the foregoing Figure 1 embodiment, and will not be described here in detail.

[0137] The image processing method proposed in this embodiment can efficiently generate a black-box adversarial attack algorithm for multi-label adversarial samples, and at the same time, the algorithm can be used in a pure label black-box environment which is more stringent than a general black-box environment. That is, only the predicted label is known, and all other information such as the predicted confidence, the training set, etc. is unknown. Correspondingly, the algorithm framework has scalability and universality. By changing the optimization method of the distance reduction stage of the algorithm framework, more initial adversarial sample generation algorithms for attacking single-label models can be transplanted to the multi-label field, so that they can be used to generate multi-label adversarial samples.

[0138] For the convenience of describing step 205 in the foregoing Figure 2 embodiment in detail, specifically, the distance reduction stage of the entire algorithm. Please refer to Figure 3 , Figure 3 is a flowchart of the differential evolution algorithm disclosed in the embodiments of the present application. It includes steps 301-309. It should be noted that the corresponding terms in this embodiment have been described in detail in the foregoing embodiments, and will not be described here in detail.

[0139] 301、Calculate the mask matrix of the original image sample and the initial adversarial sample.

[0140] It needs to be pointed out that in the distance reduction stage of the whole algorithm, there are mainly four sub-stages, population initialization, mutation operation, selection operation and setting adaptive parameters and early termination conditions. The execution order of the sub-stages is not limited here, and it will not be described in detail later.

[0141] After the above Figure 2 After step 204, step 301 can be executed. Specifically, after obtaining the original image sample, the algorithm first initializes the initial adversarial sample matched with the attack target through the YOLO target detector Then calculate the mask It is not difficult to understand that the mask at this time is the mask described in step 205 above. Specifically, the mask can be understood as a matrix.

[0142] 302, generate a noise matrix with the same matrix size as the mask matrix, and determine the direction function and the amplification coefficient.

[0143] After calculating the mask, a noise matrix noise n is generated for each individual per(n) subsequently. n It is not difficult to understand that the noise matrix noise n is the same size as the mask, and for each element noise n (j) in noise n , it has:

[0144] noise n (j)=rand(0,abs(mask(j))),

[0145] Where rand(a,b) is a function of generating random numbers uniformly in the interval [a,b], and abs() is the absolute value function. Correspondingly, mask(j) is the value of the matrix position corresponding to element j in the mask.

[0146] Subsequently, the corresponding direction function sign() and the amplification coefficient a can be determined.

[0147] Specifically, the direction function sign() is a sign function, which ensures that each element in each individual per(n) has the same direction as the corresponding position in the mask, and the value range is within the range of the mask. mask-per(n) will expose more original images.

[0148] a is an adaptive amplification coefficient. Since noise nEach element in per is closer to 0 than the corresponding element in mask, so theoretically, only subtraction cannot eliminate mask completely, so we need to multiply the perturbation per by an amplification factor. The setting of the amplification factor (amplification factor) a is particularly important for the algorithm. If a is set too small, mask cannot be completely eliminated, resulting in an overly obvious perturbation of the generated adversarial samples. If a is set too large, the adversarial samples are likely to be correctly classified and lose their adversarial significance. Therefore, the algorithm uses an adaptive a. First, set a large initial a. In one embodiment, the current a can be set to 5 or the like. The specific value of the current a is not limited here, and will not be described in detail hereinafter.

[0149] 303. Calculate any noise matrix based on algorithm parameters to generate a perturbation image sample.

[0150] When the direction function and the amplification factor are set, and the corresponding noise matrix is determined, a population per can be generated, wherein each individual can be calculated according to the following formula. Specifically:

[0151] per(n) = a noise n · sign(mask).

[0152] During the entire initialization process, a population containing N individuals can be generated. Wherein n and N are the same. It is not difficult to understand that the population per at this time is the perturbation image sample described in the above, and correspondingly, per(n) is a matrix with the same size as the mask mask of any perturbation image sample.

[0153] 304. Input any perturbation image sample, original image sample and mask matrix into the differential evolution algorithm to obtain the fitness value corresponding to all perturbation image samples.

[0154] After determining the perturbation image sample, the original image sample and the mask matrix, the above data can be input into the differential evolution algorithm, so as to obtain the fitness value corresponding to all perturbation image samples. Specifically,

[0155] mask = ~x - x,

[0156] minmask - per(n)2,

[0157] s.t.f(x + mask - per(n)) = target, target ≠ y.

[0158] Wherein, target represents the attack target vector, y represents the label vector of the original sample, and per(n) represents the nth individual in the population per. That is, the optimization goal is to find an individual per(n) in the population per, so that mask-per(n)2 is as small as possible, and it is ensured that after adding mask-per(n) to the original sample, the multi-label classifier can be made to make a wrong judgment according to the attack target. Its physical meaning is that the smaller mask-per(n)2 is, the less the part covered by the mask is, and the more the original sample exposed is, and the closer the generated adversarial sample is to the original sample. It is not difficult to understand that mask-per(n)2 is the l2 norm of an adversarial sample, that is, the fitness value or perturbation amount described in the above.

[0159] 305. Determine whether the fitness value or the magnification factor corresponding to the perturbed image sample of the current iteration number meets the preset termination condition. If yes, execute step 309; if no, execute step 306.

[0160] It is not difficult to understand that this step is the phase of setting the early termination condition in the above-mentioned sub-phase. Specifically, based on step 302, the adaptive magnification factor a has been set, and the fitness values of all individuals have been obtained in step 304.

[0161] In one of the embodiments, during the population evolution process, when the l2 norm (fitness value) of the optimal individual does not decrease for 10 generations in succession, or the magnification factor a has decreased to less than 1, the evolution process will be terminated in advance, and enter the judgment phase of the algorithm. It is not difficult to understand that the above is the preset termination condition.

[0162] Specifically, when the fitness value or the magnification factor meets the preset termination condition, step 309 is executed; if neither the fitness value nor the magnification factor meets the preset termination condition, step 306 is executed.

[0163] 306. Obtain the first perturbed image sample, the second perturbed image sample and the third perturbed image sample with the same iteration number in the perturbed image sample, and determine the sample mutation algorithm and the corresponding scale factor thereof.

[0164] It is not difficult to understand that steps 306-307 are the mutation operation sub-phase in the sub-phase of the algorithm.

[0165] Specifically, the mutation stage adopts an algorithm of mutating to the optimal individual, mainly to obtain the optimal individual and any two individuals under the same iteration number. It is not difficult to understand that the optimal individual is the individual with the minimum fitness value under the same iteration number. Correspondingly, the optimal individual corresponds to the first perturbed image sample in the above description, and any two individuals correspond to the second and third perturbed image samples in the above description. After determining the corresponding perturbed image samples, the corresponding mutation algorithm per g+1 (n) and the corresponding scale factor F. Wherein g is the current iteration number.

[0166] 307. Input the first perturbed image sample, the second perturbed image sample, the third perturbed image sample and the scale factor into the sample mutation algorithm to obtain all perturbed image samples with the next iteration number.

[0167] In combination with step 306, the corresponding first perturbed image sample, the second perturbed image sample, the third perturbed image sample and the scale factor are input into the sample mutation algorithm. Specifically,

[0168] per g+1 (n) = per g (best) + F · (per g (r1) - per g (r2)),

[0169] Wherein, r1 and r2 are two different numbers randomly selected from the interval [0, N-1], and per g (r1) and per g (r2) correspond to the second and third perturbed image samples, and per g (best) corresponds to the first perturbed image sample. Then per g+1 (n) is the perturbed image sample with the next iteration number.

[0170] It should be noted that the iteration number can be understood as one iteration after step 306-step 307, the initial iteration number is 0, and after one iteration, i.e. step 306-step 307, the iteration number g=1. In another embodiment, the iteration number can also be increased after step 308. The specific time of increasing the iteration number is not limited here.

[0171] 308. Determine a selection function with fitness value as output value, and input the mask matrix and all perturbed image samples of the current iteration number into the selection function to determine the perturbed image sample with the minimum fitness value in the current iteration number as the perturbed image sample with the next iteration number.

[0172] It is understandable that step 308 can be understood as a selection operation sub-stage in the algorithm sub-stage.

[0173] Specifically, in the selection stage, the l2 norm of mask-per is taken as the selection function, that is, in the case of ensuring that the adversarial sample can still be misclassified, the individual with smaller l2 norm (that is, the individual with smaller perturbation and closer to the original sample) survives to participate in the subsequent iteration.

[0174] It is understandable that since the above describes the l2 norm, that is, the fitness value, it can be known that the output value of the selection function at this time is the fitness value, and then the mask matrix, that is, all perturbation image samples of the current iteration number, is input into the selection function, so that the perturbation image sample with the smallest fitness value at the current iteration number can be determined as the perturbation image sample of the next iteration number.

[0175] In another embodiment, as long as all individuals per(n) in the population per are correctly classified, or the l2 norm of the optimal individual in the population per changes too little for 10 generations, the current value of the amplification coefficient a is adjusted to 0.8. Thus, step 305 is executed again. Each individual in population per is re-iterated. It is understandable that 0.8 at this time is the preset ratio described above. Correspondingly, the preset ratio can also be set to other values, which are not limited here.

[0176] 309, generate a target fitness value and determine whether the target fitness value meets a first preset sample threshold.

[0177] Step 309 in this embodiment is similar to part of the description in step 205 in the foregoing Figure 2 Specifically, the fitness values corresponding to all individuals can be generated in combination with the above steps, and the smallest fitness value is determined as the target fitness value, and then it is determined whether the target fitness value meets the first preset sample threshold, that is, L max .

[0178] Then, according to the judgment result, step 206 or step 209 is executed. Details are not described here.

[0179] Through the image processing method proposed in this embodiment, the current adversarial sample is continuously optimized by differential evolution, so that the perturbation becomes increasingly invisible. At the same time, through continuous evolution, better individuals are retained, the search process is guided to the optimal solution, and the realizability of the scheme is improved.

[0180] It should be understood that although the steps in the flowcharts involved in the embodiments described above are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least some of the steps in the flowcharts involved in the embodiments described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or stages.

[0181] If the scheme involves sensitive information (such as user information, enterprise information), it should be explained that the collection, use and processing of sensitive information need to comply with the relevant laws, regulations and standards of the country and region, and need to be carried out with the permission or consent of the corresponding subject (such as users or enterprises, etc.).

[0182] Please refer to Figure 5 , Figure 5 A structure schematic diagram of an image processing system disclosed by the embodiments of the present application.

[0183] The acquisition unit 501 is configured to acquire an original image sample; wherein the original image sample is an image sample with multiple different image labels identified by a multi-label classification model;

[0184] The input unit 502 is configured to input the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample;

[0185] The execution unit 503 is configured to add perturbation to the initial adversarial sample based on a differential evolution algorithm to generate a target fitness value of a target individual in a population and an intermediate adversarial sample corresponding to the target fitness value, and determine whether the target fitness value meets a first preset sample threshold; wherein the target fitness value is used to feedback the similarity between the original image sample and the initial adversarial sample, and the population includes multiple randomly generated individuals;

[0186] The determination unit 504 is configured to determine that the intermediate adversarial sample is a target adversarial sample when the target fitness value meets the first preset sample threshold, and output the target adversarial sample, so that the attack on the multi-label classification model is successful; wherein the target adversarial sample is an image sample with a target image label identified by the multi-label classification model.

[0187] By way of example, the system includes:

[0188] The acquisition unit 501 is specifically configured to acquire a substitute image sample; wherein the substitute image sample is an image sample with the same image label as the original image sample;

[0189] The acquisition unit 501 is specifically configured to acquire any target image region in the substitute image sample that matches the attack image region of the original image sample;

[0190] The execution unit 503 is specifically configured to cover the image sample corresponding to the target image region on the attack image region to generate an initial adversarial sample.

[0191] Exemplarily, the system further includes a calculation unit 505 and a generation unit 506;

[0192] The calculation unit 505 is configured to calculate a mask matrix of the original image sample and the initial adversarial sample;

[0193] The generation unit 506 is configured to generate a perturbed image sample; wherein any perturbed image sample is a matrix vector with the same size as the mask matrix;

[0194] The input unit 502 is specifically configured to input any perturbed image sample, the original image sample and the mask matrix into a differential evolution algorithm to acquire an adaptive value corresponding to all perturbed image samples;

[0195] The determination unit 504 is specifically configured to determine that the smallest adaptive value in all adaptive values is a target adaptive value.

[0196] Exemplarily, the system includes:

[0197] The generation unit 506 is specifically configured to generate a noise matrix with the same matrix size as the mask matrix; wherein any element in the noise matrix is a non-negative number and is associated with an element in the mask matrix;

[0198] The determination unit 504 is specifically configured to determine a direction function and an amplification coefficient; the direction function is used to determine that any element in the mask matrix and any element in the perturbed image sample correspond to the same position direction;

[0199] The calculation unit 505 is specifically configured to calculate any noise matrix based on an algorithm parameter to generate a perturbed image sample; wherein the perturbed image sample includes a plurality of noise matrices calculated based on the algorithm parameter.

[0200] Exemplarily, the system further includes:

[0201] The acquisition unit 501 is further configured to acquire a first perturbed image sample, a second perturbed image sample and a third perturbed image sample with the same iteration number in the perturbed image samples; the first perturbed image sample is a perturbed image sample with the smallest fitness value in the perturbed image samples with the current iteration number, and the second perturbed image sample and the third perturbed image sample are any two perturbed image samples in the perturbed image samples with the current iteration number;

[0202] The determination unit 504 is further configured to determine the sample variation algorithm and the corresponding scale factor;

[0203] The input unit 502 is further configured to input the first perturbed image sample, the second perturbed image sample, the third perturbed image sample and the scale factor into the sample variation algorithm, so as to acquire all perturbed image samples with the next iteration number.

[0204] Exemplarily, the system further comprises a judgment unit 507;

[0205] The judgment unit 507 is configured to judge whether the fitness value or the magnification factor corresponding to the perturbed image sample with the current iteration number satisfies a preset termination condition;

[0206] The execution unit 503 is further configured to, when the fitness value or the magnification factor corresponding to the perturbed image sample with the current iteration number satisfies the preset termination condition, execute the step of determining that the smallest fitness value in all fitness values is a target fitness value;

[0207] The determination unit 504 is further configured to, when the fitness value or the magnification factor corresponding to the perturbed image sample with the current iteration number does not satisfy the preset termination condition, determine that the next iteration number is the current iteration number, and adjust the magnification factor based on a preset scale, so as to execute the step of acquiring the first perturbed image sample, the second perturbed image sample and the third perturbed image sample with the same iteration number in the perturbed image samples.

[0208] Exemplarily, the system further comprises:

[0209] The determination unit 504 is further configured to determine a selection function with the fitness value as an output value;

[0210] The input unit 502 is further configured to input the mask matrix and all perturbed image samples with the current iteration number into the selection function, so as to determine the perturbed image sample with the smallest fitness value in the current iteration number as the perturbed image sample with the next iteration number.

[0211] Exemplarily, the system further comprises:

[0212] The determination unit 504 is further configured to determine whether the current perturbation number satisfies a preset number threshold;

[0213] The execution unit 503 is further configured to execute the step of inputting the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample when the current perturbation number meets the preset number threshold.

[0214] The determination unit 504 is further configured to determine that the adversarial sample meeting the minimum fitness value is the optimal adversarial sample when the current perturbation number does not meet the preset number threshold.

[0215] The judgment unit 507 is further configured to judge whether the fitness value of the optimal adversarial sample meets a second preset sample threshold.

[0216] The determination unit 504 is further configured to determine that the optimal adversarial sample is the target adversarial sample when the fitness value of the optimal adversarial sample meets the second preset sample threshold, and execute the step of outputting the target adversarial sample to make the attack on the multi-label classification model successful.

[0217] The determination unit 504 is further configured to output the original image sample and determine that the attack on the multi-label classification model fails when the fitness value of the optimal adversarial sample does not meet the second preset sample threshold.

[0218] Exemplarily, the system further comprises:

[0219] The execution unit 503 is further configured to adjust the current perturbation number to a next perturbation number when the target fitness value does not meet the first preset sample threshold, and execute the step of determining whether the current perturbation number meets the preset number threshold.

[0220] Please refer to Figure 6 The structural schematic diagram of the image processing device disclosed in the embodiments of the present application comprises:

[0221] The central processor 601, the memory 605, the input and output interface 604, the wired or wireless network interface 603 and the power supply 602;

[0222] The memory 605 is a transitory storage memory or a persistent storage memory;

[0223] The central processor 601 is configured to communicate with the memory 605 and execute the instruction operation in the memory 605 to execute the method in any of the embodiments described above. Figures 1 to 3

[0224] The embodiments of the present application also provide a chip system, characterized in that the chip system comprises at least one processor and a communication interface, the communication interface and the at least one processor are interconnected through a line, and the at least one processor is used to run a computer program or instruction to execute the method in any of the embodiments described above. Figures 1 to 3

[0225] ​​Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0226] In several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0227] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0228] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0229] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, read-only memory), a random access memory (RAM, random access memory), a magnetic disk or an optical disk, and various program code storage media.

Claims

1. An image processing method, characterized by, The method comprises: obtaining an original image sample; wherein the original image sample is an image sample with multiple different image labels identified by a multi-label classification model; inputting the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample; adding perturbation to the initial adversarial sample based on a differential evolution algorithm to generate a target fitness value of a target individual in a population and an intermediate adversarial sample corresponding to the target fitness value, and determining whether the target fitness value meets a first preset sample threshold; wherein the target fitness value is used to feedback the similarity between the original image sample and the initial adversarial sample, and the population comprises multiple randomly generated individuals; if yes, determining that the intermediate adversarial sample is a target adversarial sample, and outputting the target adversarial sample to make the attack on the multi-label classification model successful; wherein the target adversarial sample is an image sample with a target image label identified by the multi-label classification model; the method further comprises: calculating a mask matrix of the original image sample and the initial adversarial sample; generating a perturbed image sample; wherein any perturbed image sample is a matrix vector with the same size as the mask matrix; inputting any perturbed image sample, the original image sample and the mask matrix into the differential evolution algorithm to obtain the fitness value corresponding to all the perturbed image samples; determining the minimum fitness value in all the fitness values as the target fitness value.

2. The image processing method of claim 1, wherein, the method further comprises: obtaining a substitute image sample; obtaining a target image region in the substitute image sample that matches an attack image region of the original image sample; covering the image sample corresponding to the target image region on the attack image region to generate the initial adversarial sample.

3. The image processing method of claim 1, wherein, the method further comprises: generating a noise matrix with the same matrix size as the mask matrix; wherein any element in the noise matrix is a non-negative number and is associated with an element in the mask matrix; determining a direction function and an amplification coefficient; the direction function is used to determine that any element in the mask matrix and any element in the perturbed image sample correspond to the same position direction; calculating any noise matrix based on algorithm parameters to generate the perturbed image sample; wherein the perturbed image sample comprises multiple noise matrices calculated based on algorithm parameters.

4. The image processing method of claim 1, wherein, after inputting any perturbed image sample, the original image sample and the mask matrix into the differential evolution algorithm, the method further comprises: acquire a first perturbed image sample, a second perturbed image sample and a third perturbed image sample in the perturbed image samples with the same iteration number; wherein the first perturbed image sample is the perturbed image sample with the smallest fitness value in the perturbed image samples with the current iteration number, and the second perturbed image sample and the third perturbed image sample are any two perturbed image samples in the perturbed image samples with the current iteration number; determine a sample variation algorithm and a corresponding scale factor; input the first perturbed image sample, the second perturbed image sample, the third perturbed image sample and the scale factor into the sample variation algorithm to acquire all perturbed image samples with the next iteration number.

5. The image processing method of claim 4, wherein, After the first perturbed image sample, the second perturbed image sample, the third perturbed image sample and the scale factor are input into the sample variation algorithm to acquire all perturbed image samples with the next iteration number, the method further comprises: determine whether the fitness value or the magnification factor corresponding to the perturbed image sample with the current iteration number satisfies a preset termination condition; if yes, execute the step of determining that the smallest fitness value in all the fitness values is the target fitness value; if no, determine that the next iteration number is the current iteration number, and adjust the magnification factor based on a preset scale to execute the step of acquiring the first perturbed image sample, the second perturbed image sample and the third perturbed image sample in the perturbed image samples with the same iteration number.

6. The image processing method of claim 4, wherein, Before the step of determining that the smallest fitness value in all the fitness values is the target fitness value, the method further comprises: determine a selection function taking the fitness value as an output value; input the mask matrix and all the perturbed image samples with the current iteration number into the selection function to determine the perturbed image sample with the smallest fitness value in the current iteration number as the perturbed image sample with the next iteration number.

7. The image processing method of claim 1, wherein, After the original image sample is acquired, before the original image sample is input into the initial adversarial sample generation algorithm to acquire the initial adversarial sample, the method further comprises: determine whether the current perturbation number satisfies a preset number threshold; if the current perturbation number satisfies the preset number threshold, execute the step of inputting the original image sample into the initial adversarial sample generation algorithm to acquire the initial adversarial sample; if the current perturbation number does not satisfy the preset number threshold, determine that the adversarial sample satisfying the minimum fitness value is the best adversarial sample; determine whether the fitness value of the best adversarial sample satisfies a second preset sample threshold; if the fitness value of the best adversarial sample satisfies the second preset sample threshold, determine that the best adversarial sample is the target adversarial sample, and execute the step of outputting the target adversarial sample to make the attack on the multi-label classification model successful; if the fitness value of the best adversarial sample does not satisfy the second preset sample threshold, output the original image sample and determine that the attack on the multi-label classification model fails.

8. The image processing method of claim 7, wherein, After the step of determining whether the target fitness value satisfies a first preset sample threshold, the method further comprises: If the target fitness value does not satisfy the first preset sample threshold, the current disturbance number is adjusted to a next disturbance number, and the step of determining whether the current disturbance number satisfies the preset number threshold is performed.

9. An image processing system, characterized by The system comprises: An acquisition unit is configured to acquire an original image sample, wherein the original image sample is an image sample with multiple different image labels identified by a multi-label classification model; An input unit is configured to input the original image sample into an initial adversarial sample generation algorithm to obtain an initial adversarial sample; An execution unit is configured to add a disturbance to the initial adversarial sample based on a differential evolution algorithm to generate a target fitness value of a target individual in a population and an intermediate adversarial sample corresponding to the target fitness value, and determine whether the target fitness value satisfies a first preset sample threshold; wherein the target fitness value is used to feedback a similarity degree between the original image sample and the initial adversarial sample, and the population comprises multiple randomly generated individuals; A determination unit is configured to determine that the intermediate adversarial sample is a target adversarial sample when the target fitness value satisfies the first preset sample threshold, and output the target adversarial sample to make an attack on the multi-label classification model successful; wherein the target adversarial sample is an image sample with a target image label identified by the multi-label classification model; The system further comprises a calculation unit and a generation unit; The calculation unit is configured to calculate a mask matrix of the original image sample and the initial adversarial sample; The generation unit is configured to generate a disturbance image sample; wherein any disturbance image sample is a matrix vector with the same size as the mask matrix; The input unit is specifically configured to input any disturbance image sample, the original image sample and the mask matrix into the differential evolution algorithm to obtain fitness values corresponding to all the disturbance image samples; The determination unit is specifically configured to determine that a minimum fitness value among all the fitness values is the target fitness value.

10. An image processing apparatus characterized by comprising: The device comprises: A central processor, a memory, an input-output interface, a wired or wireless network interface and a power supply; The memory is a transitory storage memory or a persistent storage memory; The central processor is configured to communicate with the memory and execute instruction operations in the memory to perform the image processing method in any one of claims 1 to 8.

11. A computer readable storage medium, characterized in that, The computer-readable storage medium comprises instructions which, when executed on a computer, cause the computer to perform the image processing method in any one of claims 1 to 8.

Images