Interference image detection method and apparatus, electronic device, and storage medium

Abstract

The technical scheme of the embodiment of the application discloses an interference image detection method and device, electronic equipment and a storage medium. The method comprises the following steps: inputting a target image into an image classification model to obtain an image category of the target image; acquiring at least one intermediate feature of the image classification model; performing influence degree regularity detection on the target image according to the image category and the intermediate features; and detecting whether the target image is an interference image according to the influence degree regularity detection result of the target image, wherein the interference image comprises an image to which category interference information is added. The technical scheme of the embodiment of the application avoids modifying or increasing the model, realizes the detection of the interference image by using the existing data of the image classification model, and improves the universality and accuracy of the interference image detection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting interference images. Background Technology

[0002] With the development of computer technology, the application of deep learning technologies such as image classification is becoming increasingly widespread, which also places higher demands on the accuracy and security of image classification models. Malicious attackers can add invisible category interference information to normal images input into image classification models to obtain interference images. When these interference images are input into the image classification model, the model will make a misclassification.

[0003] Currently, attacks by interfering images can be defended against by modifying the parameters of image classification models; alternatively, new image recognition models can be trained to identify interfering images.

[0004] However, both modifying the parameters of the image classification model and training a new image recognition model consume a lot of resources, and the universality and accuracy of interference image detection are poor. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for detecting interfering images. It avoids modifying or adding models and utilizes existing data from image classification models to detect interfering images, thereby improving the versatility and accuracy of interfering image detection.

[0006] According to one aspect of the present invention, a method for detecting interference images is provided, comprising:

[0007] The target image is input into the image classification model to obtain the image category of the target image;

[0008] Obtain at least one intermediate feature from the image classification model;

[0009] Based on image category and intermediate features, the influence pattern of the target image is detected.

[0010] Based on the regularity detection results of the influence degree of the target image, it is determined whether the target image is a interference image. Interference images include images with added category interference information.

[0011] According to another aspect of the present invention, an interference image detection apparatus is provided, comprising:

[0012] The image category determination module is used to input the target image into the image classification model and obtain the image category of the target image;

[0013] The intermediate feature acquisition module is used to acquire at least one intermediate feature of the image classification model;

[0014] The influence degree detection module is used to detect the regularity of influence degree of the target image based on the image category and intermediate features;

[0015] The interference image detection module is used to detect whether a target image is an interference image based on the regularity detection results of the degree of influence of the target image. Interference images include images with added category interference information.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] At least one processor; and

[0018] A memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the interference image detection method according to any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the interference image detection method according to any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the interference image detection method according to any embodiment of the present invention.

[0022] The technical solution of this invention involves inputting a target image into an image classification model to obtain the image category of the target image; acquiring at least one intermediate feature of the image classification model; performing influence degree regularity detection on the target image based on the image category and each intermediate feature; and detecting whether the target image is an interference image based on the influence degree regularity detection result. Interference images include images with added category interference information. This solution solves the problems of requiring significant resources, poor versatility, and difficulty in guaranteeing accuracy when modifying or adding models. It avoids modifying or adding models and utilizes existing data from the image classification model to detect interference images, thus improving the versatility and accuracy of interference image detection.

[0023] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of an interference image detection method provided in Embodiment 1 of the present invention;

[0026] Figure 2 This is a classification principle diagram of the image classification model provided in Embodiment 1 of the present invention;

[0027] Figure 3 This is a flowchart of an interference image detection method provided in Embodiment 2 of the present invention;

[0028] Figure 4 This is a scene diagram for determining the image category of a normal image according to Embodiment 2 of the present invention;

[0029] Figure 5 This is a scene diagram for determining the image category of an interfering image according to Embodiment 2 of the present invention;

[0030] Figure 6 This is a class-activated heatmap of a normal image provided according to Embodiment 2 of the present invention;

[0031] Figure 7 This is a class activation heatmap of the interference image provided in Embodiment 2 of the present invention;

[0032] Figure 8 This is a schematic diagram of the structure of an interference image detection device according to Embodiment 3 of the present invention;

[0033] Figure 9 This is a schematic diagram of the structure of an electronic device that implements the interference image detection method of the present invention. Detailed Implementation

[0034] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0036] Example 1

[0037] Figure 1 This is a flowchart of an interference image detection method provided in Embodiment 1 of the present invention. This embodiment is applicable to the detection of interference images input to an image classification model. The method can be executed by an interference image detection device, which can be implemented in hardware and / or software and can be configured in an electronic device that carries interference image detection functionality.

[0038] See Figure 1 The interference image detection method shown includes:

[0039] S110. Input the target image into the image classification model to obtain the image category of the target image.

[0040] The target image can be an image for classification. When classifying a target image, the target image is input into an image classification model, which outputs the image category. The image classification model can include Convolutional Neural Networks (CNN) models. For example, image classification models can include, but are not limited to, Inception V3 or VGG16 (Visual Geometry Group Network) models. The image category can be the category to which the objects contained in the image belong. Specifically, it can include the broad category and / or sub-category of the objects contained in the image. For example, the broad category could be "cat"; the sub-category could be a specific breed, such as "tabby cat".

[0041] S120. Obtain at least one intermediate feature of the image classification model.

[0042] Intermediate features can be features output by any convolutional layer in an image classification model. For example, intermediate features can include feature maps, feature matrices, or feature vectors. There must be at least one intermediate feature. The number of intermediate features is determined by the number of convolutional kernels in the convolutional layer. For example, if the number of convolutional kernels in the convolutional layer is N, then the number of intermediate features is also N. Compared to the normalization layer in an image classification model, the convolutional layer in the convolutional layer loses a significant amount of spatial information about the target image after classification, making it less effective for detecting interfering images. In contrast, the terminal convolutional layer retains a large amount of spatial information about the target image, facilitating the detection of interfering images.

[0043] Specifically, the get layer function can be used to obtain intermediate features from the output of any convolutional layer in an image classification model.

[0044] In an optional embodiment of the present invention, the intermediate feature is the feature matrix output by the terminal convolutional layer.

[0045] The terminal convolutional layer can be the last convolutional layer before the normalization layer in an image classification model. The deeper the convolutional layers in an image classification model, the richer the spatial information of the target image. Compared to other convolutional layers in an image classification model, the terminal convolutional layer contains more spatial information about the target image. Furthermore, the feature matrix of the terminal convolutional layer better reflects the attention mechanism of the image classification model when determining the image category of the target image. Compared to other convolutional layers in an image classification model, the terminal convolutional layer can balance the spatial information of the target image with the attention mechanism of the image classification model, making it more advantageous in detecting interfering images.

[0046] This scheme concretizes intermediate features into feature matrices output by the terminal convolutional layers. By utilizing the feature matrices of the terminal convolutional layers, which take into account both the spatial information of the target image and the attention mechanism of the image classification model, interference image detection is performed, further improving the accuracy of interference image screening.

[0047] S130. Based on the image category and intermediate features, perform regularity detection of the degree of influence on the target image.

[0048] The degree of influence can be defined as the extent to which the position of each pixel in a target image affects the image category. The position of each pixel in the target image can be represented by intermediate features. For example, an intermediate feature matrix can be used, where the position of each feature element represents the position of each pixel in the target image. When determining the image category of a target image, the degree of influence of the position of each pixel on the image category varies. Detecting the regularity of the degree of influence in a target image is essentially detecting the regularity of the attention mechanism of the image classification model. When classifying normal images, the image classification model's attention regularly focuses on the key parts of the normal image, and the image category is determined by analyzing these key parts. However, for interfering images with added category information, the attention of the image classification model is chaotic, failing to capture the key parts of the interfering image, thus causing misclassification of the image category. Therefore, detecting the regularity of the degree of influence in a target image can determine whether it is an interfering image.

[0049] Specifically, based on the image category and the intermediate features of the image classification model, the influence of each intermediate feature on the image category can be calculated. Then, according to the influence of each intermediate feature on the image category, the intermediate features are fused to obtain the fused result of the target image. The fused result of the target image is then subjected to regularity detection, which is the process of detecting the regularity of the influence on the target image.

[0050] S140 detects whether the target image is an interfering image based on the regularity detection results of the influence degree of the target image. Interfering images include images with added category interference information.

[0051] The results of the influence degree regularity detection can include both regularity and irregularity. Category interference information can be information that interferes with the classification of an image. Category interference information is invisible. It can be understood as adding category interference information to a normal image to obtain an interfering image. The interfering image has the same visual features as the normal image, and the human eye cannot distinguish it. However, when the interfering image is input into an image classification model, the model will obtain a classification result different from that of the normal image.

[0052] For example, Figure 2 This is a diagram illustrating the classification principle of an image classification model. In an animal classification task, the image classification model aims to classify a target image X into the correct image category. Here, f1 is the process of classifying the target image based on the image classification model, resulting in the image category Y = cat. f2 is based on the human eye's discriminative mechanism, where the human eye reads the visual features of the image, such as the cat's fur, eyes, and ears, resulting in the image category Y = cat. If the image classification model's classification result is correct, the result obtained by the image classification model is the same as the human eye's classification result, i.e., f1(X) = f2(X). Adding category interference information to the normal image X results in an interference image X'. For example, the category interference information can be a value limited to a threshold range. This causes the human eye to recognize the image category as the normal image category, while the image classification model obtains a new image category. This new image category is different from the normal image category.

[0053] Specifically, the attack principle of image interference can be represented by the following formula:

[0054] confirmX';

[0055] stΔ(X,X')<ε;

[0056] f1(X)≠f1(X');

[0057] f2(X) = f2(X');

[0058] In the formula, X' is the interfering image; confirmX' is the generated interfering image; ε is the threshold; stΔ(X,X')<ε is the condition that the difference between the interfering image and the normal image is less than the threshold; f1(X) is the image category obtained by the image classification model for the normal image; f1(X') is the image category obtained by the image classification model for the interfering image; f2(X) is the image category of the normal image as recognized by the human eye; f2(X') is the image category of the interfering image as recognized by the human eye.

[0059] When classifying a target image, an image classification and recognition model provides confidence scores for multiple classification results and selects the classification result with the highest confidence score as the image category. The confidence score represents the probability that the target image is classified into a particular image category. For example, a confidence score P(Yx=X) represents the probability that the target image X is classified into image category Y.

[0060] Specifically, the following formula can be used to represent the principle of generating interference images:

[0061]

[0062] X'∈(X-ε,X+ε);

[0063] In the formula, X' is the interfering image; α is the adjustment ratio; P(Y'|x=X') is the confidence level of the image category of the interfering image; and ε is the threshold.

[0064] Specifically, in the process of generating interfering images, an interfering image generation algorithm can be used on the basis of a normal image to obtain an interfering image. The interfering image generation algorithm can include at least one of the following: gradient descent, L-BFGS (Limited memory-Broyden Fletcher Goldforb Shanno), FGSM (Fast Gradient Sign Attack), or JSMA (Jacobian-based Saliency Map Attack).

[0065] If a distracting image is input into an image classification model, the resulting image will be classified incorrectly; conversely, if a normal image is input, the resulting image will be classified correctly. Therefore, it is necessary to detect distracting images in the target image to ensure the accuracy of the classification model's results. By detecting whether the target image is a distracting image, the image classification model's output image category can be verified.

[0066] Specifically, if the detection result of the influence degree regularity of the target image is regular, then the target image is a normal image. If the target image is a normal image, then the image category output by the image classification model can be verified as correct. If the detection result of the influence degree regularity of the target image is irregular, then the target image is a distractor image. If the target image is a distractor image, then the image category output by the image classification model can be verified as incorrect. By detecting whether the target image is a distractor image, a secondary verification of the output result of the image classification model can be achieved, further ensuring the reliability of the output result of the image classification model.

[0067] In existing technologies, there are two main ways to defend against attacks from interfering images: modifying the image classification model and training a new image recognition model. Modifying the image classification model by adjusting the parameters of each convolutional and pooling layer can improve its redundancy and resistance to interfering images, making it less vulnerable to such attacks. However, modifying the structure of the image classification model to increase redundancy can lead to a decrease in the accuracy of classifying normal images. Furthermore, modifying the structure of an existing image classification model requires significant resources and is difficult to implement. Alternatively, interfering images can be used as a training set to train a new image recognition model, which can then filter out interfering images and identify their features. However, training a new image recognition model also has problems: processing a large number of similar interfering images requires significant resources, and the category information of the interfering images may be irregular, making it difficult to guarantee the accuracy of the image recognition model in recognizing interfering images.

[0068] The technical solution of this invention involves inputting a target image into an image classification model to obtain the image category of the target image, acquiring at least one intermediate feature of the image classification model, performing influence degree regularity detection on the target image based on the image category and each intermediate feature, and detecting whether the target image is an interference image based on the influence degree regularity detection result. Interference images include images with added category interference information. This solves the problems of requiring a large amount of resources to modify or add models, poor versatility, and difficulty in guaranteeing accuracy. It avoids modifying the model structure or training a new model, reducing resource waste. By utilizing existing data from the image classification model to detect interference images, it improves the accuracy and versatility of interference image detection.

[0069] Example 2

[0070] Figure 3This is a flowchart of an interference image detection method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment performs regularity detection of the influence degree of the target image according to the image category and various intermediate features. Specifically, it is refined as follows: "Based on the image category and intermediate features, calculate the first influence degree value of the feature elements included in the intermediate features on the image category; based on the feature elements and the first influence degree value of the feature elements, calculate the second influence degree value of the feature elements on the image category; fuse the second influence degree values ​​of the corresponding feature elements in each intermediate feature, and determine the distribution position of pixels with the same influence degree value in the target image based on the fusion result; determine the regularity detection result of the influence degree of the target image based on the distribution position of pixels with the same influence degree value in the target image." This further improves the accuracy of the regularity detection result of the influence degree of the target image. It should be noted that parts not described in detail in this embodiment of the present invention can be referred to in the descriptions of other embodiments.

[0071] See Figure 3 The interference image detection method shown includes:

[0072] S310. Input the target image into the image classification model to obtain the image category of the target image.

[0073] S320. Obtain at least one intermediate feature of the image classification model.

[0074] S330. Based on the image category and intermediate features, calculate the first degree of influence of the feature elements included in the intermediate features on the image category.

[0075] Intermediate features can include feature maps, feature matrices, or feature vectors. Each intermediate feature contains multiple feature elements. Since intermediate features are the output of any convolutional layer of the image classification model, the feature elements can reflect the attention mechanism of the target classification model for classifying the target image.

[0076] The first degree of influence value can be seen as the degree of influence of each feature element on the classification result of the image classification model. In other words, the first degree of influence value can be seen as the degree of influence of each feature element on the image category. By determining the first degree of influence value, the attention mechanism of the image classification model can be visualized.

[0077] Specifically, the backend gradients function can be used to calculate the first degree of influence of each feature element on the image category.

[0078] In an optional embodiment of the present invention, after calculating the first influence value of the feature elements included in the intermediate feature on the image category based on the image category and the intermediate feature, the method further includes: calculating the mean of the first influence values ​​of each feature element included in the same intermediate feature; and updating the first influence values ​​of each feature element included in the same intermediate feature with the mean.

[0079] Convolutional layers in image classification and recognition models contain at least one intermediate feature, and each intermediate feature contains multiple feature elements. Directly calculating the feature elements requires a significant amount of computation. Therefore, for multiple feature elements included in the same intermediate feature, the mean of the first influence values ​​of each feature element is calculated, and this mean is used to update the first influence values ​​of all feature elements included in the same intermediate feature. Unifying the first influence values ​​of all feature elements included in the same intermediate feature reduces the computational cost of calculating the second influence value based on the first influence value, thus improving the efficiency of detecting patterns in the influence of target images.

[0080] This scheme simplifies the calculation of the second influence value by introducing the average value of the first influence degree of each feature element, thereby improving the efficiency of detecting the regularity of influence degree in the target image and thus improving the efficiency of interference image detection.

[0081] In an optional embodiment of the present invention, calculating the first degree of influence of the feature elements included in the intermediate features on the image category based on the image category and the intermediate features includes: calculating the gradient information of the feature extraction layer where the intermediate features are located based on the image category; and calculating the first degree of influence of the feature elements included in the intermediate features on the image category based on the gradient information.

[0082] The feature extraction layer can be a convolutional layer that extracts intermediate features. Gradient information can represent the degree of influence of the feature extraction layer on the image category. Optionally, based on the gradient information, the degree of influence of each feature element of the intermediate features of the feature extraction layer on the image category can be determined.

[0083] Specifically, based on the image category of the image classification model, the extraction information of the feature extraction layer containing the intermediate features can be calculated; based on the gradient information, the first degree of influence of each feature element on the image category can be calculated.

[0084] For example, the gradient information of the feature extraction layer containing the intermediate features can be calculated using the following formula:

[0085]

[0086] In the formula, A is the feature extraction layer; K is the intermediate feature; i is the row containing the feature element of the intermediate feature; j is the column containing the feature element of the intermediate feature; y CThe classification result of the image classification model, i.e., the image category; Let be the value of the feature element in the i-th row and j-th column of the intermediate feature K in feature extraction layer A; This represents the gradient information of the feature element in the i-th row and j-th column of the intermediate feature K in the feature extraction layer A with respect to the image category.

[0087] This scheme calculates the gradient information of the feature extraction layer containing the intermediate features based on the image category, and then calculates the first influence value of the feature elements included in the intermediate features on the image category based on the gradient information. This introduces gradient information and realizes the process of calculating the first influence value based on the gradient information, thereby improving the versatility of the first influence value calculation and thus improving the versatility of the interference image detection method.

[0088] S340. Based on the feature element and the first influence value of the feature element, calculate the second influence value of the feature element on the image category.

[0089] Specifically, the product of the feature element and its first influence value can be used as the second influence value of the feature element on the image category.

[0090] The values ​​of feature elements can be obtained by convolving the pixel values ​​of the target image multiple times. The values ​​of feature elements also reflect the pixel distribution of the target image. Compared to the first influence value, the second influence value focuses more on the attention mechanism of the image classification model, while the first influence value, in addition to considering the pixel values ​​of the target image, also considers the pixel values ​​of the target image. The second influence value comprehensively considers both the attention mechanism of the image classification model and the pixel values ​​of the target image, providing a more comprehensive assessment. Using more comprehensive numerical values, the detection of interference in the target image is more accurate.

[0091] S350. The second influence values ​​of the corresponding feature elements in each intermediate feature are fused, and the distribution positions of pixels with the same influence value in the target image are determined based on the fusion result.

[0092] Specifically, the second influence values ​​of corresponding feature elements in each intermediate feature can be fused according to the feature elements at the same position to obtain the fusion result corresponding to the target image. Based on the fusion result, the distribution positions of pixels with the same influence value in the target image can be determined.

[0093] In an optional embodiment of the present invention, after fusing the second influence values ​​of the corresponding feature elements in each intermediate feature, the method further includes: removing negative numbers from the fusion result; normalizing the fusion result; and updating the fusion result.

[0094] For the numerical values ​​in the fusion results, the larger the value, the more attention the image classification model pays to the pixel position of the target image corresponding to that value when classifying the target image, and the greater the influence of the pixel position of the target image corresponding to that value; conversely, the smaller the value, the less attention the image classification model pays to the pixel position of the target image corresponding to that value when classifying the target image, and the smaller the influence of the pixel position of the target image corresponding to that value.

[0095] Removing negative numbers from the fusion result removes those with minimal influence, allowing for a more intuitive identification of those with greater impact. This facilitates the determination of patterns in the target image's influence based on the fusion result. Similarly, normalizing the fusion result, representing identical values ​​in the same way, further enhances the intuitiveness of the result and makes it easier to determine patterns in the target image's influence based on the fusion result.

[0096] This scheme further processes the fusion result by fusing the second influence values ​​of the corresponding feature elements in each intermediate feature, removing negative numbers from the fusion result, normalizing the fusion result, and updating the fusion result. This improves the intuitiveness of the fusion result and makes it easier to determine the regularity detection result of the influence degree.

[0097] S360. Based on the distribution location of pixels with the same influence value in the target image, determine the regularity detection result of the influence degree of the target image.

[0098] Specifically, it can determine whether the distribution of pixels with the same degree of influence in the target image has a regularity. If it does, the result of the influence degree regularity detection of the target image is regular; if it does not, the result of the influence degree regularity detection of the target image is irregular. Thus, the influence degree regularity detection of the target image is realized.

[0099] In an optional embodiment of the present invention, determining the regularity detection result of the influence degree of the target image based on the distribution positions of pixels with the same influence degree value in the target image includes: generating a class activation heatmap based on the distribution positions of pixels with the same influence degree value in the target image; superimposing the target image and the class activation heatmap to obtain a superimposed image; and detecting whether the distribution of pixels with the same influence degree value in the target image is regular based on the superimposed image to determine the regularity detection result of the influence degree of the target image.

[0100] Specifically, based on the class activation heatmap generation algorithm, different brightness colors are added to the distribution positions of pixels with the same level of influence in the target image to generate a class activation heatmap. The class activation heatmap is then adjusted to the size of the target image, and the target image and the class activation heatmap are superimposed to obtain a superimposed image. Based on the overlap between the highlighted parts of the class activation heatmap in the superimposed image and the objects contained in the target image, the distribution of pixels with the same level of influence in the target image is detected to be regular. If the overlapping part is a key part of the objects contained in the target image, the result of the regularity detection of the influence level of the target image is regular; otherwise, the result of the regularity detection of the influence level of the target image is irregular. Optionally, the class activation heatmap generation algorithm may include, but is not limited to: Class Activation Mapping (CAM) method, Grad-weighted Class Activation Mapping (Grad-CAM) method, and Score-Weighted Visual Explanations for Convolutional Neural Networks (Score-CAM) method, etc.

[0101] For example, the following formula can be used to generate an overlay image:

[0102] IMG = heatmap * μ + image;

[0103] In the formula, IMG is the overlay image; heatmap is the class activation heatmap; μ is the overlay ratio; and image is the target image.

[0104] This scheme improves the intuitiveness of detecting the regularity of the influence degree of a target image by generating a class activation heatmap. Simultaneously, by overlaying the target image and the class activation heatmap, a superimposed image is obtained. The distribution of pixels with the same influence degree value in the target image is then analyzed based on the superimposed image to determine the regularity of the target image's influence degree. Furthermore, the comparison between the target image and the class activation heatmap more intuitively displays whether the distribution of pixels with the same influence degree value in the target image is regular, thus improving the accuracy of the detection results.

[0105] S370. Based on the regularity detection results of the influence degree of the target image, detect whether the target image is an interfering image, wherein interfering images include images with added category interference information.

[0106] The technical solution of this invention calculates a first influence value of the feature elements included in the intermediate features on the image category based on the image category and intermediate features. Based on the feature elements and the first influence value of the feature elements, a second influence value of the feature elements on the image category is calculated. The second influence values ​​of the corresponding feature elements in each intermediate feature are fused, and the distribution position of pixels with the same influence value in the target image is determined based on the fusion result. Based on the distribution position of pixels with the same influence value in the target image, the influence degree regularity detection result of the target image is determined. By using more comprehensive numerical values ​​to obtain the fusion result, and performing influence degree regularity detection on the target image through the fusion result, the accuracy of the influence degree regularity detection result of the target image is further improved.

[0107] For example, a normal image of an Egyptian cat can be randomly selected, and an interference image generation algorithm can be applied to the target image of the Egyptian cat to obtain an interference image. Figure 4 This is a scene diagram for determining the image category of a normal image; Figure 5 This is a scene diagram where image category determination is affected by interference from other images. For example... Figure 4 As shown, when a normal image is input into an image classification model, three classification results with different confidence levels are obtained: Egyptian cat, tabby cat, and tiger cat. The Egyptian cat has the highest confidence level; therefore, the normal image is classified as an Egyptian cat, consistent with the actual classification result. Figure 5 As shown, when the interference image is input into the image classification model, a classification result of "laptop" with a confidence level of 1 is obtained. Therefore, the classification result of the interference image is "laptop", but this does not match the actual result. Figure 6 It is a class activation heatmap of a normal image; Figure 7 It is a class activation heatmap of the interfering image. For example... Figure 6 As shown, in the class activation heatmap of a normal image, the brighter areas of the image regularly display the outline of a cat, containing key cat features. Figure 7 As shown, in the class activation heatmap of the interfering image, the highlighted parts are irregular, and the image as a whole is in a chaotic state. Therefore, by detecting the regularity of the degree of influence on the target image, it is possible to determine whether the target image is an interfering image.

[0108] Example 3

[0109] Figure 8This is a schematic diagram of an interference image detection device provided in Embodiment 3 of the present invention. This embodiment is applicable to detecting interference images input to an image classification model. The device can execute an interference image detection method and can be implemented in hardware and / or software. The device can be configured in an electronic device that carries interference image detection functionality.

[0110] See Figure 8 The interference image detection device shown includes: an image category determination module 810, an intermediate feature acquisition module 820, an influence degree detection module 830, and an interference image detection module 840.

[0111] in,

[0112] The image category determination module 810 is used to input the target image into the image classification model to obtain the image category of the target image;

[0113] The intermediate feature acquisition module 820 is used to acquire at least one intermediate feature of the image classification model;

[0114] The influence degree detection module 830 is used to detect the regularity of influence degree of the target image based on the image category and intermediate features;

[0115] The interference image detection module 840 is used to detect whether a target image is an interference image based on the regularity detection results of the influence degree of the target image. The interference image includes an image with added category interference information.

[0116] The technical solution of this invention involves inputting a target image into an image classification model to obtain the image category of the target image, acquiring at least one intermediate feature of the image classification model, performing influence degree regularity detection on the target image based on the image category and each intermediate feature, and detecting whether the target image is an interference image based on the influence degree regularity detection result. Interference images include images with added category interference information. This solves the problems of requiring a large amount of resources to modify or add models, poor versatility, and difficulty in guaranteeing accuracy. It avoids modifying the model structure or training a new model, reducing resource waste. By utilizing existing data from the image classification model to detect interference images, it improves the accuracy and versatility of interference image detection.

[0117] In an optional embodiment of the present invention, the influence degree detection module 830 includes: a first influence degree value calculation unit, configured to calculate a first influence degree value of the feature elements included in the intermediate features on the image category based on the image category and the intermediate features; a second influence degree value calculation unit, configured to calculate a second influence degree value of the feature elements on the image category based on the feature elements and the first influence degree value of the feature elements; a second influence degree value fusion unit, configured to fuse the second influence degree values ​​of the corresponding feature elements in each intermediate feature, and determine the distribution position of pixels with the same influence degree value in the target image based on the fusion result; and an influence degree detection unit, configured to determine the influence degree regularity detection result of the target image based on the distribution position of pixels with the same influence degree value in the target image.

[0118] In an optional embodiment of the present invention, after the first influence degree value calculation unit calculates the first influence degree value of the feature elements included in the intermediate feature on the image category based on the image category and the intermediate feature, the influence degree detection module 830 is further specifically used to: calculate the average of the first influence degree values ​​of each feature element for multiple feature elements included in the same intermediate feature; and update the first influence degree values ​​of each feature element included in the same intermediate feature with the average value.

[0119] In an optional embodiment of the present invention, the first influence degree value calculation unit is specifically used for: calculating the gradient information of the feature extraction layer where the intermediate feature is located according to the image category; and calculating the first influence degree value of the feature elements included in the intermediate feature on the image category according to the gradient information.

[0120] In an optional embodiment of the present invention, after the second influence degree value fusion unit fuses the second influence degree values ​​of the corresponding feature elements in each intermediate feature, the influence degree detection module 830 is further specifically used to: remove negative numbers in the fusion result; normalize the fusion result and update the fusion result.

[0121] In an optional embodiment of the present invention, the influence degree detection unit is specifically used to: generate a class activation heatmap based on the distribution positions of pixels with the same influence degree value in the target image; superimpose the target image and the class activation heatmap to obtain a superimposed image; and determine the influence degree regularity detection result of the target image by detecting whether the distribution of pixels with the same influence degree value in the target image is regular based on the superimposed image.

[0122] In an optional embodiment of the present invention, the intermediate feature is the feature matrix output by the terminal convolutional layer.

[0123] The interference image detection device provided in this embodiment of the invention can execute the interference image detection method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0124] The acquisition, storage, and application of intermediate features involved in the technical solution of this invention comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0125] Example 4

[0126] Figure 9 A schematic diagram of an electronic device 900 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0127] like Figure 9 As shown, the electronic device 900 includes at least one processor 901 and a memory, such as a read-only memory (ROM) 902 or a random access memory (RAM) 903, communicatively connected to the at least one processor 901. The memory stores computer programs executable by the at least one processor. The processor 901 can perform various appropriate actions and processes based on the computer program stored in the ROM 902 or loaded into the RAM 903 from storage unit 908. The RAM 903 can also store various programs and data required for the operation of the electronic device 900. The processor 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0128] Multiple components in electronic device 900 are connected to I / O interface 905, including: input unit 906, such as keyboard, mouse, etc.; output unit 907, such as various types of displays, speakers, etc.; storage unit 908, such as disk, optical disk, etc.; and communication unit 909, such as network card, modem, wireless transceiver, etc. Communication unit 909 allows electronic device 900 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0129] Processor 901 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 901 performs the various methods and processes described above, such as interference image detection methods.

[0130] In some embodiments, the interference image detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 908. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 900 via ROM 902 and / or communication unit 909. When the computer program is loaded into RAM 903 and executed by processor 901, one or more steps of the interference image detection method described above may be performed. Alternatively, in other embodiments, processor 901 may be configured to perform the interference image detection method by any other suitable means (e.g., by means of firmware).

[0131] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0132] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0133] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0134] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0135] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0136] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and VPS (Virtual Private Server) services, such as high management difficulty and weak business scalability.

[0137] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0138] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting interference images, characterized in that, The method includes: The target image is input into an image classification model to obtain the image category of the target image; Obtain at least one intermediate feature from the image classification model; Based on the image category and each of the intermediate features, the influence degree regularity detection is performed on the target image; Based on the regularity detection results of the influence degree of the target image, it is determined whether the target image is an interfering image, wherein the interfering image includes an image with added category interference information; The step of detecting the regularity of influence on the target image based on the image category and each of the intermediate features includes: Based on the image category and the intermediate features, a first influence value of the feature elements included in the intermediate features on the image category is calculated; wherein, the first influence value is the degree of influence of each feature element on the image category classified by the image classification model; Based on the feature element and the first influence value of the feature element, calculate the second influence value of the feature element on the image category; The second influence values ​​of the corresponding feature elements in each of the intermediate features are fused, and the distribution positions of pixels with the same influence value in the target image are determined based on the fusion result. Based on the distribution location of pixels with the same degree of influence in the target image, the regularity detection result of the degree of influence of the target image is determined.

2. The method according to claim 1, characterized in that, After calculating the first influence value of the feature elements included in the intermediate features on the image category based on the image category and the intermediate features, the method further includes: For multiple feature elements included in the same intermediate feature, calculate the average of the first influence values ​​of each feature element; The mean is used to update the first influence value of each of the feature elements included in the same intermediate feature.

3. The method according to claim 1, characterized in that, The step of calculating the first influence value of the feature elements included in the intermediate features on the image category based on the image category and the intermediate features includes: Calculate the gradient information of the feature extraction layer containing the intermediate feature based on the image category; Based on the gradient information, calculate the first degree of influence of the feature elements included in the intermediate features on the image category.

4. The method according to claim 1, characterized in that, After fusing the second influence values ​​of the corresponding feature elements in each of the intermediate features, the method further includes: Negative numbers in the fusion results are removed; The fusion result is normalized and then updated.

5. The method according to claim 1, characterized in that, The step of determining the regularity detection result of the influence degree of the target image based on the distribution position of pixels with the same influence degree value in the target image includes: Based on the distribution of pixels with the same level of influence in the target image, a class activation heatmap is generated; The target image and the class activation heatmap are superimposed to obtain a superimposed image; Based on the superimposed image, detect whether the distribution of pixels with the same degree of influence in the target image is regular, and determine the regularity detection result of the degree of influence of the target image.

6. The method according to claim 1, characterized in that, The intermediate feature is the feature matrix output by the terminal convolutional layer.

7. An interference image detection device, characterized in that, The device includes: The image category determination module is used to input the target image into the image classification model to obtain the image category of the target image; An intermediate feature acquisition module is used to acquire at least one intermediate feature of the image classification model; An influence degree detection module is used to detect the regularity of influence degree of the target image based on the image category and each of the intermediate features; An interference image detection module is used to detect whether the target image is an interference image based on the regularity detection result of the degree of influence of the target image, wherein the interference image includes an image with added category interference information; The influence level detection module includes: The first influence degree value calculation unit is used to calculate the first influence degree value of the feature elements included in the intermediate features on the image category based on the image category and the intermediate features; wherein, the first influence degree value is the degree of influence of each feature element on the image category classified by the image classification model; The second influence degree value calculation unit is used to calculate the second influence degree value of the feature element on the image category based on the feature element and the first influence degree value of the feature element; The second influence degree value fusion unit is used to fuse the second influence degree values ​​of the corresponding feature elements in each intermediate feature, and determine the distribution position of pixels with the same influence degree value in the target image based on the fusion result. The influence degree detection unit is used to determine the influence degree regularity detection result of the target image based on the distribution position of pixels with the same influence degree value in the target image.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the interference image detection method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the interference image detection method according to any one of claims 1-6.

Images