Adversarial sample generation method and device, equipment and medium
By combining a generator and an image recognition model, adversarial examples are directly generated and updated, solving the problem of low efficiency in adversarial example acquisition in existing technologies and achieving efficient adversarial example generation.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- MASHANG CONSUMER FINANCE CO LTD
- Filing Date
- 2022-08-25
- Publication Date
- 2026-07-21
Smart Images
Figure CN116152625B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, and medium for generating adversarial examples. Background Technology
[0002] Adversarial examples are specific sample images that interfere with deep neural network models, easily causing them to misidentify objects. Therefore, to improve the recognition performance of deep neural network models and avoid misidentification, it is necessary to obtain a large number of adversarial examples for training.
[0003] In existing technologies, when acquiring adversarial examples, it is usually necessary to first construct an image dataset, train a generative adversarial network based on the image dataset, and then acquire adversarial examples based on the trained generative adversarial network.
[0004] However, this existing method requires the prior collection of a large amount of image data to form a dataset, and also requires fine-tuning of the generative adversarial network parameters. The whole process is very time-consuming and labor-intensive, and the efficiency of obtaining adversarial examples is very low. Summary of the Invention
[0005] This application provides a method, apparatus, device, and medium for generating adversarial examples, which addresses the problem of low efficiency in obtaining existing adversarial examples.
[0006] In a first aspect, embodiments of this application provide an adversarial example generation method, including:
[0007] Acquire latent variables and target variables, wherein the latent variables are used to generate a first image, and the target variables are used to add target information to the first image or remove target information from the first image;
[0008] Generate the first image based on the preset first generator and latent variables;
[0009] Generate intermediate adversarial examples, including:
[0010] A second image is generated based on a preset second generator, the latent variables, and the target variables;
[0011] Based on the first and second images, generate initial adversarial examples;
[0012] The initial adversarial sample is superimposed on the preset image to be identified to generate a training image;
[0013] The target variable is updated based on the preset sample images, the training images, and the preset image recognition model;
[0014] The second image is updated based on the updated target variable to obtain the updated second image. The initial adversarial sample is then updated based on the updated second image to obtain the intermediate adversarial sample. The updated target variable is the target variable used to generate the second image next time.
[0015] Repeat the step of generating intermediate adversarial samples until the intermediate adversarial samples meet the preset conditions, and use the intermediate adversarial samples that meet the preset conditions as target adversarial samples.
[0016] In one possible design of the first aspect, the target variable is obtained, including:
[0017] Acquire image information of the target adversary object for the purpose of confrontation; determine a target direction vector based on the image information of the target adversary object, the target direction vector being used to add or remove the image information of the target adversary object from the first image; calculate the target variable based on the target direction vector and a preset initial scalar.
[0018] In another possible design of the first aspect, generating the initial adversarial example based on the first image and the second image includes:
[0019] The first image and the second image are compared to determine the difference region between the first image and the second image; the difference region in the first image or the second image is extracted to obtain the initial adversarial sample.
[0020] In another possible design of the first aspect, updating the target variable based on the preset sample image, the training image, and the preset image recognition model includes:
[0021] The training image is input into the preset image recognition model to extract the feature vector of the training image; the preset sample image is input into the preset image recognition model to extract the feature vector of the preset sample image; the target variable is updated based on the feature vector of the training image and the feature vector of the preset sample image.
[0022] In another possible design of the first aspect, updating the target variable based on the feature vector of the training image and the feature vector of the preset sample image includes:
[0023] Calculate the similarity value between the feature vector of the training image and the feature vector of the sample image; calculate the gradient difference between the similarity value and the preset initial scalar; update the preset initial scalar based on the gradient difference and the preset learning rate; multiply the updated preset initial scalar by the target direction vector to obtain the updated target variable.
[0024] In another possible design of the first aspect, updating the second image based on the updated target variable to obtain an updated second image, and updating the initial adversarial sample based on the updated second image to obtain an intermediate adversarial sample, includes:
[0025] The latent variable and the updated target variable are summed, and the summation result is input into the preset second generator to obtain the updated second image; based on the first image and the updated second image, the initial adversarial sample is updated to obtain the intermediate adversarial sample.
[0026] In another possible design of the first aspect, updating the initial adversarial sample based on the first image and the updated second image to obtain the intermediate adversarial sample includes:
[0027] The updated second image is compared with the first image to determine the difference region between the updated second image and the first image; the difference region in the updated second image or the first image is extracted, and the initial adversarial sample is updated to obtain the intermediate adversarial sample.
[0028] Secondly, embodiments of this application provide an adversarial sample generation apparatus, comprising:
[0029] The variable acquisition module is used to acquire latent variables and target variables. The latent variables are used to generate a first image, and the target variables are used to add target information to the first image or remove target information from the first image.
[0030] The first image generation module is used to generate a first image based on a preset first generator and hidden variables;
[0031] An adversarial example generation module is used to generate a second image based on a preset second generator, the latent variable, and the target variable; generate an initial adversarial example based on the first image and the second image; overlay the initial adversarial example with a preset image to be recognized to generate a training image; update the target variable based on a preset sample image, the training image, and a preset image recognition model; update the second image based on the updated target variable to obtain an updated second image; and update the initial adversarial example based on the updated second image to obtain an intermediate adversarial example. The updated target variable is the target variable used to generate the second image next time.
[0032] The loop execution module is used to repeatedly execute the step of generating intermediate adversarial samples performed by the adversarial sample generation module until the intermediate adversarial sample meets the preset conditions, and the intermediate adversarial sample that meets the preset conditions is used as the target adversarial sample.
[0033] Thirdly, embodiments of this application provide a computer device, including: a processor, and a memory communicatively connected to the processor;
[0034] The memory stores computer-executed instructions;
[0035] The processor executes computer execution instructions stored in the memory to implement the above-described method.
[0036] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer instructions that, when executed by a processor, are used to implement the above-described method.
[0037] This application provides an adversarial example generation method, apparatus, device, and medium. By utilizing latent variables and a trained first generator, a first image is generated. Simultaneously, the latent variables and target variables are input into a second generator to generate a second image. Based on the first and second images, initial adversarial examples can be generated. These initial adversarial examples are updated until intermediate samples meeting preset conditions are obtained, which serve as target adversarial examples. The entire process does not involve training a generative adversarial network, yet the target adversarial examples can be obtained, effectively improving the efficiency of adversarial example acquisition. Attached Figure Description
[0038] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application;
[0039] Figure 1 A schematic diagram of a face image provided in an embodiment of this application;
[0040] Figure 2 This is a schematic diagram of the adversarial sample generation method provided in the embodiments of this application;
[0041] Figure 3 A schematic diagram of a face image provided in an embodiment of this application;
[0042] Figure 4 A schematic diagram of a face image provided for another embodiment of this application;
[0043] Figure 5 A schematic diagram illustrating the acquisition of adversarial examples provided in an embodiment of this application;
[0044] Figure 6 This is a schematic diagram of image overlay provided for an embodiment of this application;
[0045] Figure 7 This is a schematic diagram of the target variable update process provided in an embodiment of this application;
[0046] Figure 8 This is a schematic diagram of the adversarial sample generation process provided in an embodiment of this application;
[0047] Figure 9 This is a schematic diagram of the adversarial example generation process provided in another embodiment of this application;
[0048] Figure 10 This is a schematic diagram of the adversarial sample generation device provided in an embodiment of this application;
[0049] Figure 11 A schematic diagram of the structure of a computer device provided in an embodiment of this application.
[0050] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0052] First, let me explain the terms used in this application:
[0053] Generative Adversarial Networks (GANs) are deep learning models and one of the most promising unsupervised learning methods on complex distributions in recent years. The model framework includes at least two modules: a generator and a discriminator, whose interactive learning produces quite good outputs. In the field of face image generation, pre-trained GAN models include Progressive Growth Generative Adversarial Networks (PG-GAN) and Style-GAN, among others.
[0054] Generator: Defines a latent space containing d-dimensional vectors, where the latent variable z is a vector containing d elements. The latent variable z can generate a color image through the generator.
[0055] Interpretable directions in the latent space of GANs: Given a latent variable z, an image G(z) is generated. In certain directions n (n is a normalized d-dimensional vector), as the value of the scalar β changes, G(z+βn) will change in certain specific attributes. For example, given a face generation model StyleGAN, choosing a direction n with interpretable hair length means that as the value of β changes, the hair length of the generated face changes, while other attributes remain unchanged. Alternatively, choosing another direction n with interpretable glasses wearing means that as the value of β changes, the original face changes from not wearing glasses to generating various glasses styles, while other attributes remain unchanged.
[0056] For example, Figure 1 A schematic diagram of a face image provided in an embodiment of this application, such as... Figure 1 As shown, given a latent variable z, a face image G(z) can be generated using a generator G, i.e. Figure 1 The image shows a face image ①. Given a specific direction n (where n is the direction from which hair length can be interpreted), generate another face image G(z+βn) using a generator G, i.e. Figure 1 The face image ②. Comparing face image ① and face image ②, it can be found that a face with hair has become a face without hair.
[0057] For example, there are other specific directions n, such as whether a mask is worn or not, or whether glasses are worn or not. By adjusting the specific direction n and the scalar β, a face image can be transformed, for example, from a face image of a person not wearing glasses to a face image of a person wearing glasses.
[0058] Based on the above explanation, adversarial examples used to attack deep learning models have emerged in real-life applications. Specifically, when person A wears an adversarially designed example (such as glasses, a mask, or a wig), it can cause the face recognition model to misidentify person A as person B, resulting in a sharp decline in the model's performance. Therefore, to improve the accuracy of face recognition models, adversarial training is necessary. This involves training the model with various physical adversarial examples to enhance its accuracy. Currently, to improve the concealment of adversarial examples and make them less easily detected, Generative Adversarial Networks (GANs) are used to train and generate adversarial example images. Specifically, this involves first collecting an image dataset, then training a GAN (comprising a generator and a discriminator) based on the image training set. The generator can generate an adversarial example image (e.g., an image of glasses) based on a latent space encoding vector. This adversarial example image is then superimposed on the original face image from the face recognition dataset and input into the face recognition model for recognition. By fine-tuning the generator and discriminator, the superimposed image of a face wearing glasses can cause the face recognition model to misidentify it. However, this method requires preparing an image dataset and training a dedicated adversarial example image generation GAN network. Data preparation is time-consuming, and the training effect of the GAN network requires a delicate parameter tuning process.
[0059] To address the aforementioned issues, this application provides a method, apparatus, device, medium, and program product for processing adversarial examples. To improve the efficiency of acquiring adversarial example images, it is necessary to avoid the time-consuming and labor-intensive data collection and training of the generative adversarial network (GAN). Specifically, by utilizing the interpretable orientation of the GAN in the latent space, a first image can be generated using latent variables and a preset generator. Simultaneously, a second image is generated based on the latent variables, target variables, and another preset generator. Initial adversarial examples are generated based on the first and second images. Training images are then generated based on the initial adversarial examples and preset images to be recognized. The initial adversarial examples are then updated using a pre-trained image recognition model, sample images, and training images until intermediate adversarial examples meeting preset conditions are obtained as target adversarial examples. This avoids the complex and cumbersome process of establishing an image dataset and training the GAN based on that dataset, thus improving the efficiency of acquiring adversarial examples.
[0060] The technical solution of this application will now be described in detail through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.
[0061] Figure 2This is a schematic flowchart of an adversarial example generation method provided in an embodiment of this application. This method can be applied to electronic devices, such as computer equipment, servers, and mobile terminals. Figure 2 As shown, the method may specifically include the following steps:
[0062] Step S201: Obtain latent variables and target variables. The latent variables are used to generate the first image, and the target variables are used to add or remove target information from the first image.
[0063] In this embodiment, the latent variable is represented by the letter z, and the target variable is represented by βn, where n is a direction vector and β is a preset initial scalar (its initial value can be 0). The latent variable z can be a vector containing d elements, and the target variable includes a specific direction n (n is a normalized d-dimensional vector) and a preset initial scalar β. For example, the specific direction n can be the direction interpretable by hair length, the direction of whether or not a mask is worn, or the direction of whether or not glasses are worn; the specific direction is not limited.
[0064] For example, a face image G(z) can be generated using a latent variable z. Adding a specific direction n and a scalar β to the latent variable z will yield another face image G(z+βn). The difference between face image G(z+βn) and G(z) lies in whether or not it contains target information. This target information can be objects worn on or used to modify the face, such as glasses, masks, hair, or other similar items.
[0065] Step S202: Generate the first image based on the preset first generator and latent variables.
[0066] Step S203, generating intermediate adversarial samples, includes step (1) generating a second image based on a preset second generator, latent variables, and target variables; step (2) generating an initial adversarial sample based on the first image and the second image; step (3) overlaying the initial adversarial sample with a preset image to be identified to generate a training image; step (4) updating the target variables based on preset sample images, training images, and preset image recognition models; step (5) updating the second image based on the updated target variables to obtain an updated second image, and updating the initial adversarial sample based on the updated second image to obtain intermediate adversarial samples, wherein the updated target variables are the target variables used to generate the second image next time.
[0067] In this embodiment, the preset first generator and the preset second generator can be the generators in the above-mentioned PG-GAN generative adversarial network. The PG-GAN generative adversarial network is a pre-trained generative adversarial network that can be directly obtained and does not need to be trained with the help of image datasets.
[0068] The first image can be a face image, and the second image corresponds to either the face image with target information added or the face image with target information removed.
[0069] For example, Figure 3 This is a schematic diagram of a face image provided in an embodiment of this application, such as... Figure 3 As shown, Figure 3 The image at the top center can be the first image, which is generated by the generator using the latent variable z (i.e., G(z)). Figure 3 The image in the lower center can be the second image, which is generated by a generator using the latent variable z and the target variable βn (i.e., G(z+βn)). The target information is the image information of the glasses; that is, the second image, compared to the first image, adds the image information of the glasses.
[0070] In other scenarios, Figure 4 A schematic diagram of a face image provided for another embodiment of this application, such as... Figure 4 As shown, Figure 4 The image at the top can also be the first image, which is generated by the generator using the latent variable z (i.e., G(z)). Figure 4 The image below can be the second image, which is generated by a generator using the latent variable z and the target variable βn (i.e., G(z+βn)). The target information is the image information of a mask; that is, the second image, compared to the first image, adds the image information of a mask.
[0071] In this embodiment, the initial adversarial sample includes at least target information. For example, Figure 5 This is a schematic diagram illustrating the acquisition of adversarial examples provided in an embodiment of this application, such as... Figure 5 As shown, a face image without glasses is used as the first image 51, and a face image with glasses is used as the second image 52. An initial adversarial sample 53 is obtained through subtraction, which includes image information of someone wearing glasses.
[0072] In other implementations, in addition to subtraction, other methods can be used to determine the initial adversarial sample from the first image and the second image, such as manually comparing the differences between the first image and the second image and extracting the difference region as the initial adversarial sample.
[0073] For example, the first image can be a face image of a person wearing glasses, and correspondingly, the second image is a face image of a person not wearing glasses. That is, the second image, relative to the first image, eliminates the image information of glasses in the first image.
[0074] Step S204: Repeat the step of generating intermediate adversarial samples until the intermediate adversarial samples meet the preset conditions, and use the intermediate adversarial samples that meet the preset conditions as target adversarial samples.
[0075] The initial values of the target variables are set based on experience, and their values may need to be adjusted to better suit actual needs. For example, in real-life applications, people wear various types of glasses, including rimless glasses, square-framed glasses, round-framed glasses, and so on. By adjusting and updating the target variables so that the final target variables update the second image, the first image and the final second image can be used to obtain the target adversarial example.
[0076] In this embodiment, the preset image recognition model can be a face recognition model, the preset image to be recognized can be a face image of person A, and the preset sample image can be a face image of person B. The facial features of person A and person B are different. The basis for updating the target variable is to make the face recognition model misidentify person A wearing the target adversarial sample as person B. That is, first, the training image (i.e., the face image of person A wearing the initial adversarial sample) and the preset sample image are input into the face recognition model. If the face recognition model can still recognize the training image as the face image of person A, the target variable is updated. Then, the initial adversarial sample is updated based on the updated target variable. Finally, the training image is updated again based on the updated adversarial sample, and the updated training image is input into the face recognition model to continue the recognition judgment. This optimizes the target variable. After the target variable is optimized, the adversarial sample is updated again, and finally, an intermediate adversarial sample that meets the preset conditions is obtained as the target adversarial sample.
[0077] In this context, obtaining intermediate adversarial samples that meet preset conditions, and using them as target adversarial samples, involves overlaying these target adversarial samples with a preset image to be recognized to form a training image. This training image is then input into a preset image recognition model, and the model's output prediction is either the preset sample image or a sample image approximately matching the preset conditions. In simpler terms, if person A wears the target adversarial sample, the preset image recognition model will identify them as person B. For example, if the target adversarial sample is an image of glasses, after printing out the actual glasses image (the target adversarial sample), it can be worn by person A. In this case, when the preset recognition model performs facial recognition on person A, it will incorrectly identify person A as person B.
[0078] This application embodiment generates target information of the adversarial object in the face image by using the direction vector n and the preset initial scalar β. Then, based on the face image and the face image carrying the target information, the initial adversarial sample is obtained. This can improve the efficiency of obtaining the initial adversarial sample and avoid the process of building an image dataset and training a GAN network. As a result, the target adversarial sample can be obtained more efficiently.
[0079] In other embodiments, when obtaining the target variable, it is necessary to first obtain image information of the target adversary object used for the confrontation, then determine the target direction vector based on the image information of the target adversary object, and finally multiply the target direction vector by a preset initial scalar to calculate the target variable. The target direction vector is used to add or remove image information of the target adversary object from the first image.
[0080] In this embodiment, taking the application of adversarial examples in the field of facial recognition technology as an example, the adversarial object can be an object that modifies the face and whose shape, size, and detachability can be freely adjusted. For example, the adversarial object can be a wig, the color and length of which can be freely adjusted. Another example is a face mask, the size and color of which can be freely adjusted.
[0081] In this context, the image information of different adversarial objects corresponds to different target direction vectors. For example, the target direction vector for a wig is n1, while the target direction vector for a mask is n2. For instance, the adversarial object can also be wearable clothing such as clothes, pants, and shoes.
[0082] For example, adversarial examples can also be applied to the field of object recognition technology. Through adversarial examples, object M1 can be misidentified as object M2 by a preset image recognition model. At this time, the adversarial object can be various types of objects, such as animals (e.g., cats, dogs, birds, etc.).
[0083] This application embodiment achieves the acquisition of image information of the target adversarial object for adversarial purposes. Based on the image information, the direction vector n can be determined. By determining a preset initial scalar β, the generator can quickly generate a second image based on the direction vector n, thereby improving the acquisition efficiency of the initial adversarial sample. Furthermore, based on the preset initial scalar β, the image information of the target adversarial object in the second image can be effectively fine-tuned, thereby achieving the optimization of the initial adversarial sample in a simple and quick manner.
[0084] In other embodiments, when obtaining the initial adversarial sample, the first image and the second image can be compared to determine the difference region between the first image and the second image; the difference region in the first image or the second image can be extracted to obtain the initial adversarial sample.
[0085] In this embodiment, the target adversarial object may exist in the first image or in the second image. If it exists in the first image, the difference region is extracted in the first image. If it exists in the second image, the difference region is extracted in the second image.
[0086] For example, if the first image is a face image of a person not wearing glasses, then the second image is a face image of a person wearing glasses based on the first image (for example, the first image is a face image of person A without glasses, and the second image is a face image of person A wearing glasses). By comparing the first image and the second image, the region containing glasses can be extracted from the second image as the target adversarial image.
[0087] For example, if the first image is a face image of a person wearing glasses, then the second image is a face image of a person without glasses, based on the first image. By comparing the first image and the second image, the region containing the glasses can be extracted from the first image and used as the target adversarial image.
[0088] This application embodiment compares the difference regions between the first image and the second image, and the target sample image can be extracted more quickly based on the difference regions without training a dedicated image generation GAN network, thus improving the efficiency of adversarial sample acquisition.
[0089] Furthermore, in some embodiments, the step S204 above, "updating the target variable according to the preset sample image, training image, and preset image recognition model," can be specifically implemented through the following steps: inputting the training image into the preset image recognition model to extract the feature vector of the training image; inputting the preset sample image into the preset image recognition model to extract the feature vector of the preset sample image; and updating the target variable according to the feature vector of the training image and the feature vector of the preset sample image.
[0090] In this embodiment, the initial adversarial sample can be an image of glasses, a mask, hair, etc. For example, the preset image to be identified can be a face image of person A, and the preset sample image can be a face image of person B. Based on the category of the target adversarial image, the overlay position of the initial adversarial sample in the preset image to be identified can be determined. Then, by overlaying the initial adversarial sample onto the overlay position in the preset image to be identified, a training image can be obtained.
[0091] For example, Figure 6 This is a schematic diagram of image overlay provided for an embodiment of this application, such as... Figure 6 As shown, in the preset image to be identified 61, person A is not wearing glasses, while the initial adversarial sample 62 belongs to the category of glasses images. At this time, based on common sense, the initial adversarial sample 62 can be overlaid around person A's face and eyes, thereby obtaining training image 63. For example, if the initial adversarial sample 62 belongs to the category of mask images, it needs to be overlaid around person A's mouth, thereby obtaining another training image.
[0092] In this embodiment, the preset image recognition model can be a face recognition model. The feature vector of the training image is extracted by the face recognition model, and the feature vector of the preset sample image is extracted by the face recognition model. The target variable is updated in reverse by using the feature vector of the training image and the feature vector of the preset sample image to ensure that the feature vector of the final training image and the feature vector of the preset sample image are as close as possible.
[0093] This application embodiment forms a training image by superimposing an initial adversarial sample image onto a preset image to be identified. Then, based on the feature vectors of the training image and the feature vectors of the sample image, the target variable is updated in reverse, which can optimize the adversarial sample and improve the image quality of the generated adversarial sample.
[0094] Furthermore, in some embodiments, updating the target variable can be achieved through the following steps: calculating the similarity value between the feature vector of the training image and the feature vector of the sample image; calculating the gradient difference between the similarity value and the preset initial scalar; updating the preset initial scalar based on the gradient difference and the preset learning rate; obtaining the updated preset initial scalar; and multiplying the updated preset initial scalar with the target direction vector to obtain the updated target variable.
[0095] In this embodiment, let I represent the training image and Y represent the sample image. The feature vector of the training image is F(I), and the feature vector of the sample image is F(Y). The similarity Sim(F(I), F(Y)) between the feature vectors extracted from image I and image Y is calculated using the function Sim. The loss function L is defined as L(X, β, Y) = Sim(F(I), F(Y)), and the gradient difference of the loss function L relative to the preset initial scalar β is calculated. Then, the original preset initial scalar β is updated in reverse based on the gradient difference g. The specific formula is as follows:
[0096] β=β-r*g / ||g||2
[0097] In the above formula, r is the preset learning rate, β on the right side of the equal sign is the preset initial scalar, β on the left side of the equal sign is the updated preset initial scalar (i.e., the updated target vector), and g is the gradient difference.
[0098] In other embodiments, the number of iterations can be set to repeatedly update the target variable. For example, the number of iterations can be K. After K rounds of updates, the updated preset initial scalar (the updated target scalar) is obtained. The iteration process can be implemented through the following steps:
[0099] (1) Initialize β = 0 and set the iteration count K;
[0100] (2. Set the iteration count k = 1;)
[0101] (3) Extract the initial adversarial sample G(z+βn)-G(z), and then superimpose the preset image to be identified x to obtain the training image I=x+G(z+βn)-G(z);
[0102] (4) The face recognition model F outputs features F(I) and F(Y) for image I and preset sample image Y, respectively;
[0103] (5) The loss function L is defined as L(x, β, y) = Sim(F(I), F(Y)), where Sim defines the similarity of the features extracted from two images, which can be cosine similarity.
[0104] (6) Calculate the gradient of the loss function L with respect to β.
[0105] (7) Update β=β-r·g / ||g||2;
[0106] (8) k = k + 1; if k < K, then proceed to step (3) to continue execution, that is, continue to update the preset initial scalar β.
[0107] (9) The iteration ends and returns O = G(z + βn) - G(z). At this time, O represents the intermediate adversarial sample that meets the preset conditions, i.e., the target adversarial sample.
[0108] Here, G(z) can be understood as the first image, with direction vector n, latent variable z, and preset initial scalar β.
[0109] For example, Figure 7 This is a schematic diagram illustrating the target variable update process provided in an embodiment of this application. Figure 7As shown, the latent variable z generates an image G(z) (the first image) through a generator G. The sum of the latent variable and the target variable (z+βn) generates an image G(z+βn) (the second image) through a generator G. After subtracting the image G(z+βn) from the image G(z), an initial adversarial sample (e.g., an image of glasses, a mask, etc.) is obtained. The initial adversarial sample is then added to a preset image to be recognized X to obtain a superimposed training image, which is input into a preset image recognition model 71. Finally, the loss function L(x, β, y) is calculated, and β, which was previously input to the generator G, is updated based on the loss function L(x, β, y). After k iterations of updating the target variable, O = G(z+βn) - G(z) is returned as the target adversarial sample using the β obtained from the k iterations.
[0110] This application embodiment optimizes the target variable by setting the number of iterations K and updating the preset initial scalar β multiple times. This optimizes the final target adversarial sample O and improves the sample quality of the target adversarial sample O.
[0111] In other embodiments, after updating the preset initial scalar β, the target variable can be updated based on the updated preset initial scalar β to obtain the updated target variable. Then, the target variable is updated based on the initial adversarial sample to obtain the intermediate adversarial sample. Specifically, this can be achieved through the following steps: summing the latent variable and the updated target variable, inputting the summation result into a preset second generator to obtain the updated second image; updating the initial adversarial sample based on the first image and the updated second image to obtain the intermediate adversarial sample.
[0112] In this embodiment, the updated target variable is the product of the updated β and the target direction vector, i.e., βn. The latent variable z is added to the updated target variable, i.e., z+βn, and input into a preset second generator to obtain the updated second image. Then, intermediate adversarial samples are obtained based on the updated second image and the first image.
[0113] Among them, intermediate adversarial samples refer to images. Once an intermediate adversarial sample meets the preset conditions (i.e., it is the target adversarial sample), it can be printed out to obtain the adversarial sample in physical form.
[0114] This application embodiment updates the second image by using the updated target variable and a preset second generator, then compares the updated second image with the first image to obtain intermediate adversarial samples, and finally obtains the target adversarial samples. In this way, the target adversarial samples can be used to train the recognition model to improve the recognition accuracy of the model.
[0115] Furthermore, in some embodiments, the above method can be implemented by the following steps when obtaining intermediate adversarial samples: comparing the updated second image with the first image to determine the difference region between the updated second image and the first image; extracting the difference region in the updated second image or the first image to update the initial adversarial sample and obtain the intermediate adversarial sample.
[0116] In this embodiment, the updated second image is generated by the generator based on the updated target variable (i.e., βn) and the latent variable z, i.e., the updated G(z+βn), while the first image is generated by the generator based on the latent variable z, i.e., G(z). By comparing the updated G(z+βn) and G(z), the difference region is selected as the intermediate adversarial example.
[0117] In extracting intermediate adversarial examples, the choice between extracting the difference region from the first image or the updated second image can be determined based on the differences. For example, if the first image is a face image of a person not wearing glasses, and the updated second image is a face image of a person wearing glasses, the difference region can be extracted from the updated second image as an intermediate adversarial example. Conversely, if the first image is a face image of a person wearing glasses, and the updated second image is a face image of a person not wearing glasses, the difference region can be extracted from the first image as an intermediate adversarial example.
[0118] This application embodiment compares the difference regions between the updated second image and the first image, and then extracts the difference regions as intermediate adversarial samples in the updated second image or the first image. This eliminates the need for time-consuming and laborious collection of a large amount of image data to train the GAN network, and also eliminates the need to rely on the training effect of the GAN network to obtain high-quality intermediate adversarial samples. While ensuring the image quality of the intermediate adversarial samples, it can also improve the efficiency of obtaining intermediate adversarial samples.
[0119] For example, Figure 8 This is a schematic diagram of the adversarial example generation process provided in an embodiment of this application, such as... Figure 8 As shown, taking person A in the preset image to be recognized 81 as an example, the preset image to be recognized 81 is superimposed with the target adversarial sample 82 (obtained by multiple iterations of the intermediate adversarial sample) to form a training image 83 for training the image recognition model 84. When the training image 83 is input into the image recognition model 84, the image recognition model obtains a preset sample image 85, which includes person B. That is, the target adversarial sample caused the image recognition model to misidentify.
[0120] In this embodiment, the target adversarial example 82 is an image of glasses. In other embodiments, the target adversarial example can also be a mask, etc. For example, Figure 9This is a schematic diagram of the adversarial example generation process provided in an embodiment of this application, such as... Figure 9 As shown, taking person A in the preset image to be recognized 91 as an example, after the preset image to be recognized 91 is superimposed with the target adversarial sample 92, a training image 93 is formed for training the image recognition model 94. When the training image 93 is input into the image recognition model 94, the image recognition model obtains a preset sample image 95, in which person C is shown. That is, the target adversarial sample caused the image recognition model to misidentify. At this time, the target adversarial sample 92 is an image of a mask.
[0121] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.
[0122] Figure 10 This is a schematic diagram of the adversarial example generation device provided in an embodiment of this application. The adversarial example processing device can be integrated into an electronic device, or it can be implemented independently of the adversarial example while cooperating with it. Figure 10 As shown, the adversarial sample generation device 1000 includes a variable acquisition module 1010, a first image generation module 1020, an adversarial sample generation module 1030, and a loop execution module 1040.
[0123] The variable acquisition module 1010 is used to acquire latent variables and target variables. The latent variables are used to generate a first image, and the target variables are used to add or remove target information from the first image. The first image generation module 1020 generates a first image based on a preset first generator and latent variables. The adversarial sample generation module 1030 generates a second image based on a preset second generator, latent variables, and target variables; generates an initial adversarial sample based on the first and second images; overlays the initial adversarial sample with a preset image to be recognized to generate a training image; updates the target variable based on a preset sample image, training image, and preset image recognition model; updates the second image based on the updated target variable to obtain an updated second image; updates the initial adversarial sample based on the updated second image to obtain an intermediate adversarial sample; and the updated target variable becomes the target variable for the next update. The loop execution module 1040 repeatedly executes the steps of generating intermediate adversarial samples performed by the adversarial sample generation module until the intermediate adversarial sample meets a preset condition, and uses the intermediate adversarial sample that meets the preset condition as the target adversarial sample.
[0124] In some embodiments, when acquiring target variables, the variable acquisition module can specifically be used to: acquire image information of the target adversary object used for adversarial purposes; determine a target direction vector based on the image information of the target adversary object, the target direction vector being used to add or remove image information of the target adversary object from the first image; and calculate the target variable based on the target direction vector and a preset initial scalar.
[0125] In some embodiments, when the adversarial example generation module generates initial adversarial examples based on the first image and the second image, it may specifically be used to: compare the first image and the second image to determine the difference region between the first image and the second image; extract the difference region in the first image or the second image to obtain the initial adversarial example.
[0126] In some embodiments, when the adversarial example generation module updates the target variable based on the preset sample image, training image, and preset image recognition model, it can specifically be used to: input the training image into the preset image recognition model to extract the feature vector of the training image; input the preset sample image into the preset image recognition model to extract the feature vector of the preset sample image; and update the target variable based on the feature vector of the training image and the feature vector of the preset sample image.
[0127] In some embodiments, when the adversarial example generation module updates the target variable based on the feature vector of the training image and the feature vector of the preset sample image, it can specifically be used to: calculate the similarity value between the feature vector of the training image and the feature vector of the sample image; calculate the gradient difference between the similarity value and the preset initial scalar; update the preset initial scalar based on the gradient difference and the preset learning rate; and multiply the updated preset initial scalar by the target direction vector to obtain the updated target variable.
[0128] In some embodiments, when the adversarial sample generation module updates the second image based on the updated target variable to obtain the updated second image, and updates the initial adversarial sample based on the updated second image to obtain the intermediate adversarial sample, it can specifically be used to: sum the latent variable and the updated target variable, input the summation result into a preset second generator to obtain the updated second image; and update the initial adversarial sample based on the first image and the updated second image to obtain the intermediate adversarial sample.
[0129] In some embodiments, when the adversarial sample generation module updates the initial adversarial sample based on the first image and the updated second image to obtain intermediate adversarial samples, it may specifically be used to: compare the updated second image with the first image to determine the difference region between the updated second image and the first image; extract the difference region in the updated second image or the first image, update the initial adversarial sample, and obtain intermediate adversarial samples.
[0130] The apparatus provided in this application embodiment can be used to execute the methods in the above embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.
[0131] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented by processing element calls to software, while others are implemented in hardware. For example, the variable acquisition module can be a separate processing element, or it can be integrated into a chip in the above device. Alternatively, it can be stored as program code in the memory of the above device, and its function can be called and executed by a processing element. The implementation of other modules is similar. Moreover, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.
[0132] Figure 11 A schematic diagram of the structure of a computer device provided in an embodiment of this application. For example... Figure 11 As shown, the computer device 1100 includes at least one processor 1110, a memory 1120, a bus 1130, and a communication interface 1140. The processor 1110, the communication interface 1140, and the memory 1120 communicate with each other via the bus 1130.
[0133] The communication interface 1140 is used to communicate with other devices. This communication interface includes a communication interface for data transmission and a display interface or operation interface for human-computer interaction. The processor 1110 is used to execute computer execution instructions stored in the memory 1120, specifically executing the relevant steps in the methods described in the above embodiments. The processor 1110 may be a central processing unit, an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. The computer device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs. The memory 1120 is used to store computer execution instructions. The memory may include high-speed RAM memory and may also include non-volatile memory, such as at least one disk storage device.
[0134] This embodiment also provides a computer-readable storage medium storing computer instructions. When at least one processor of a computer device executes the computer instructions, the computer device performs the adversarial sample processing method provided in the various embodiments described above.
[0135] This embodiment also provides a computer program product including computer instructions stored in a readable storage medium. At least one processor of a computer device can read the computer instructions from the readable storage medium, and the at least one processor executes the computer instructions to cause the computer device to implement the adversarial sample processing methods provided in the various embodiments described above.
[0136] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates an "or" relationship between the preceding and following related objects; in formulas, the character " / " indicates a "division" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.
[0137] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. In the embodiments of this application, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.
[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.
Claims
1. A method for generating adversarial examples, characterized in that, include: Acquire latent variables and target variables, wherein the latent variables are used to generate a first image, and the target variables are used to add target information to the first image or remove target information from the first image; Generate the first image based on the preset first generator and latent variables; Generate intermediate adversarial examples, including: A second image is generated based on a preset second generator, the latent variables, and the target variables; The first image and the second image are compared to determine the difference regions between the first image and the second image; the difference regions in the first image or the second image are extracted to obtain the initial adversarial sample. The initial adversarial sample is superimposed on the preset image to be identified to generate a training image; The target variable is updated based on the preset sample images, the training images, and the preset image recognition model; The second image is updated based on the updated target variable to obtain the updated second image. The initial adversarial sample is then updated based on the updated second image to obtain the intermediate adversarial sample. The updated target variable is the target variable used to generate the second image next time. Repeat the step of generating intermediate adversarial samples until the intermediate adversarial samples meet the preset conditions, and use the intermediate adversarial samples that meet the preset conditions as target adversarial samples.
2. The method according to claim 1, characterized in that, Obtain the target variable, including: Acquire image information of the target adversary object for use in the confrontation; Based on the image information of the target adversary, a target direction vector is determined. The target direction vector is used to add or remove the image information of the target adversary from the first image. The target variable is calculated based on the target direction vector and the preset initial scalar.
3. The method according to claim 2, characterized in that, The step of updating the target variable based on the preset sample image, the training image, and the preset image recognition model includes: The training image is input into the preset image recognition model to extract the feature vector of the training image; The preset sample image is input into the preset image recognition model to extract the feature vector of the preset sample image; The target variable is updated based on the feature vectors of the training images and the feature vectors of the preset sample images.
4. The method according to claim 3, characterized in that, The step of updating the target variable based on the feature vector of the training image and the feature vector of the preset sample image includes: Calculate the similarity value between the feature vector of the training image and the feature vector of the sample image; Calculate the gradient difference between the similarity value and the preset initial scalar; Update the preset initial scalar based on the gradient difference and the preset learning rate; The updated preset initial scalar is multiplied by the target direction vector to obtain the updated target variable.
5. The method according to any one of claims 1-4, characterized in that, The second image is updated based on the updated target variable to obtain an updated second image. The initial adversarial sample is then updated based on the updated second image to obtain an intermediate adversarial sample, including: The latent variable and the updated target variable are summed, and the summation result is input into the preset second generator to obtain the updated second image; The initial adversarial sample is updated based on the first image and the updated second image to obtain the intermediate adversarial sample.
6. The method according to claim 5, characterized in that, The step of updating the initial adversarial sample based on the first image and the updated second image to obtain the intermediate adversarial sample includes: The updated second image is compared with the first image to determine the difference areas between the updated second image and the first image; Extract the difference regions from the updated second image or the first image, update the initial adversarial sample, and obtain the intermediate adversarial sample.
7. An adversarial sample generation device, characterized in that, include: The variable acquisition module is used to acquire latent variables and target variables. The latent variables are used to generate a first image, and the target variables are used to add target information to the first image or remove target information from the first image. The first image generation module is used to generate a first image based on a preset first generator and hidden variables; The adversarial example generation module is used to generate a second image based on a preset second generator, the latent variables, and the target variables; compare the first image and the second image to determine the difference region between the first image and the second image; extract the difference region from the first image or the second image to obtain an initial adversarial example; and overlay the initial adversarial example with a preset image to be identified to generate a training image. Based on the preset sample image, the training image, and the preset image recognition model, the target variable is updated, and the second image is updated based on the updated target variable to obtain the updated second image. Based on the updated second image, the initial adversarial sample is updated to obtain the intermediate adversarial sample. The updated target variable is the target variable used to generate the second image next time. The loop execution module is used to repeatedly execute the step of generating intermediate adversarial samples performed by the adversarial sample generation module until the intermediate adversarial sample meets the preset conditions, and the intermediate adversarial sample that meets the preset conditions is used as the target adversarial sample.
8. A computer device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, are used to implement the method as described in any one of claims 1-6.