A method and system for detecting adversarial attacks

Abstract

This disclosure provides a method and system for adversarial attack detection, relating to the field of data processing technology. The method and system provided in this disclosure perform local image reconstruction on regions with high face recognition response rates in a target image sample to obtain a reconstructed image. Then, based on the differences between the reconstructed image and the original image, unsupervised adversarial attack detection is performed to determine the sample attributes of the original image. The aforementioned adversarial attack detection method of this disclosure achieves high-precision adversarial attack detection without relying on manual annotation or preprocessing of the original image, thus improving the accuracy and efficiency of adversarial attack detection.

Description

Technical Field

[0001] This disclosure relates to the field of data processing technology, and in particular to a method and system for detecting adversarial attacks. Background Technology

[0002] In recent years, facial recognition systems have brought considerable convenience to people's lives and work, such as facial recognition payment, facial recognition entry, and facial recognition attendance. However, while providing convenience, facial recognition systems also face new security risks, one of which is adversarial attacks. Because adversarial attacks typically target live faces, the adversarial elements are difficult to detect, thus severely impacting the accuracy of facial recognition systems. Summary of the Invention

[0003] In order to solve the problems existing in the prior art, the main purpose of this disclosure is to provide a method and system for detecting adversarial attacks.

[0004] Firstly, this disclosure provides a method for detecting adversarial attacks, including:

[0005] Acquire a target image sample and determine a target region prediction map of the target image sample, wherein the face recognition response of the target region prediction map is higher than that of the face recognition response of the target image sample;

[0006] Based on the predicted map of the target region, the target image sample is reconstructed to determine the reconstructed image of the target image sample; and

[0007] Based on the reconstructed image and the target image sample, the sample attributes of the target image sample are determined, and the sample attributes include at least one of normal samples and adversarial attack samples.

[0008] In some embodiments, determining the target region prediction map of the target image sample based on the target image sample includes:

[0009] Interpretability analysis is performed on the target image samples to obtain M interpretable maps, where M is a natural number greater than 1; and

[0010] Based on a preset first model, feature fusion is performed on the M interpretable maps to obtain the target region prediction map.

[0011] In some embodiments, the interpretability map includes at least one of a class activation heatmap and a saliency map.

[0012] In some embodiments, the step of reconstructing the target image sample based on the target region prediction map to determine the reconstructed image of the target image sample includes:

[0013] Multiply the predicted map of the target region by the target image sample to obtain the modulated image of the target image sample; and

[0014] Based on the preset second model and the modulation image, the target image sample is reconstructed to determine the reconstructed image of the target image sample.

[0015] In some embodiments, the step of reconstructing the target image sample based on a preset second model and the modulated image to determine the reconstructed image of the target image sample includes:

[0016] The modulated image is divided into N modulation partition images. The second model includes N reconstruction sub-networks. Each of the N modulation partition images corresponds to a reconstruction sub-network, and N is a natural number greater than zero.

[0017] For each of the modulation partition images: determine the partition reconstruction image of the target image sample based on the reconstruction subnetwork and the modulation partition image; and

[0018] The N partitioned reconstructed images are integrated to obtain the reconstructed image of the target image sample.

[0019] In some embodiments, determining the partitioned reconstructed image of the target image sample based on the reconstructed subnetwork and the modulation partitioned image includes:

[0020] Obtain the pixel distribution information of the modulation partition image;

[0021] Based on the pixel distribution information, the target reconstruction region map of the modulation partition image is determined; and

[0022] Based on the reconstruction sub-network and the target reconstruction region map, the partitioned reconstruction image of the target image sample is determined.

[0023] In some embodiments, determining the target reconstruction region map of the modulation partition image based on the pixel distribution information includes:

[0024] Obtain the preset pixel threshold; and

[0025] The pixel distribution information is compared with the pixel threshold, and the target reconstruction region map of the modulation partition image is determined based on the comparison result.

[0026] In some embodiments, determining the sample attributes of the target image sample based on the reconstructed image and the target image sample includes:

[0027] Based on a preset first model, feature extraction is performed on the reconstructed image to obtain a reconstructed feature map;

[0028] Based on the first model, feature extraction is performed on the target image samples to obtain an initial feature map; and

[0029] Based on the reconstructed feature map and the initial feature map, the sample attributes of the target image sample are determined.

[0030] In some embodiments, determining the sample attributes of the target image sample based on the reconstructed feature map and the initial feature map includes:

[0031] Based on a preset third model, feature mapping is performed on the initial feature map to obtain a first mapped feature map;

[0032] Based on the third model, feature mapping is performed on the reconstructed feature map to obtain a second mapped feature map; and

[0033] Based on the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map, the sample attributes of the target image sample are determined.

[0034] In some embodiments, determining the sample attributes of the target image sample based on the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map includes:

[0035] Determine the first difference between the original feature map and the reconstructed feature map;

[0036] Determine the second difference between the first mapped feature map and the initial feature map;

[0037] Determine the third difference between the second mapped feature map and the reconstructed feature map;

[0038] Based on the first difference, the second difference, and the third difference, a comprehensive feature difference is determined; and

[0039] The sample attributes of the target image sample are determined based on the comprehensive feature difference.

[0040] In some embodiments, determining the sample attributes of the target image sample based on the comprehensive feature difference includes:

[0041] Obtain the preset feature difference threshold;

[0042] The comparison result is obtained by comparing the comprehensive feature difference with the feature difference threshold; and

[0043] The sample attributes of the target image sample are determined based on the comparison results.

[0044] In some embodiments, the training process of the first model includes:

[0045] Obtain the target image sample;

[0046] Obtain the target image sample;

[0047] Based on the first model, a target region prediction map of the target image sample is determined;

[0048] Based on the first model and the target region prediction map, a target feature prediction map of the target image sample is determined; and

[0049] Based on the target region prediction map and the target feature prediction map, the first model is converged to obtain the trained first model.

[0050] In some embodiments, determining the target feature prediction map of the target image sample based on the first model and the target region prediction map includes:

[0051] Multiply the predicted map of the target region by the target image sample to obtain the modulated image of the target image sample; and

[0052] Based on the first model, feature extraction is performed on the modulated image to obtain the target feature prediction map.

[0053] In some embodiments, the step of converging the first model based on the target region prediction map and the target feature prediction map to obtain the trained first model includes:

[0054] Based on the target region prediction map, determine the sparsity loss information of the target region;

[0055] The initial feature map of the target image sample is obtained, and the initial feature map is compared with the target feature prediction map to obtain feature consistency loss information.

[0056] The target region sparsity loss information and the feature consistency loss information are fused to obtain the first model loss information; and

[0057] The first model is converged based on the loss information of the first model to obtain the trained first model.

[0058] In some embodiments, obtaining the initial feature map of the target image sample includes:

[0059] Based on the first model, feature extraction is performed on the target image sample to obtain the initial feature map.

[0060] In some embodiments, the training process of the second model includes:

[0061] Acquire the modulated image of the target image sample; and

[0062] Based on the second model, the modulated image is reconstructed to obtain the reconstructed image of the target image sample;

[0063] The second model is converged based on the reconstructed image to obtain the trained second model.

[0064] In some embodiments, the step of converging the second model based on the reconstructed image to obtain the trained second model includes:

[0065] The reconstructed image and the target image sample are compared to obtain reconstruction loss information; and

[0066] The second model is converged based on the reconstructed loss information to obtain the trained second model.

[0067] In some embodiments, the training process of the third model includes:

[0068] Obtain the initial feature map of the target image sample;

[0069] Obtain the reconstructed feature map of the reconstructed image; and

[0070] The third model is converged based on the initial feature map and the reconstructed feature map to obtain the trained third model.

[0071] In some embodiments, the step of converging the third model based on the initial feature map and the reconstructed feature map to obtain the trained third model includes:

[0072] Based on the third model, feature mapping is performed on the initial feature map to obtain the first mapped feature map;

[0073] Based on the third model, feature mapping is performed on the reconstructed feature map to obtain a second mapped feature map; and

[0074] The third model is converged based on the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map to obtain the trained third model.

[0075] In some embodiments, the step of converging the third model based on the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map to obtain the trained third model includes:

[0076] The first mapped feature map is compared with the reconstructed feature map to obtain the first mapping loss information;

[0077] The second mapped feature map is compared with the initial feature map to obtain the second mapped loss information;

[0078] The first mapping loss information and the second mapping loss information are fused to obtain the third model loss information; and

[0079] The third model is converged based on the loss information of the third model to obtain the trained third model.

[0080] Secondly, this disclosure provides an anti-attack detection system, including:

[0081] At least one storage medium, including at least one instruction set, for implementation analysis of adversarial attack detection methods; and

[0082] At least one processor is communicatively connected to the at least one storage medium.

[0083] When the system is running, the at least one processor reads the at least one instruction set and executes any of the methods described above according to the instructions of the at least one instruction set.

[0084] As can be seen from the above technical solutions, the adversarial attack detection method and system provided in this disclosure are as follows: The method and system acquire a target image sample, determine the target region prediction map of the target image sample, reconstruct the target image sample based on the target region prediction map, and determine the reconstructed image of the target image sample; and determine the sample attributes of the target image sample based on the reconstructed image and the target image sample. In the above process, the method and system perform local image reconstruction on the region with high face recognition response (i.e., the target region prediction map) in the target image sample to obtain the reconstructed image, and perform unsupervised adversarial attack detection based on the difference between the reconstructed image and the original image (target image sample), thereby determining the sample attributes of the original image. The above adversarial attack detection method of this disclosure does not rely on manual annotation and does not require preprocessing of the original image to achieve high-precision adversarial attack detection, thus improving the accuracy and efficiency of adversarial attack detection.

[0085] Other functions of the adversarial attack detection methods and systems provided in this disclosure will be partially listed in the following description. The figures and examples described below will be apparent to those skilled in the art. The inventive aspects of the adversarial attack detection methods and systems provided in this disclosure can be fully explained by practice or use of the methods, apparatus, and combinations described in the detailed examples below. Attached Figure Description

[0086] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0087] Figure 1 A schematic diagram of the terminal structure of the hardware operating environment involved in the embodiments of this disclosure is shown;

[0088] Figure 2 A server schematic diagram of an adversarial attack detection method according to some embodiments of the present disclosure is shown;

[0089] Figure 3 A flowchart of an adversarial attack detection method provided according to some embodiments of the present disclosure is shown;

[0090] Figure 4 A schematic diagram of the model structure of a first model provided according to some embodiments of the present disclosure is shown;

[0091] Figure 5 A basic flowchart of data input and output for a first model provided according to some embodiments of the present disclosure is shown;

[0092] Figure 6 A basic flowchart of data input and output for a first model provided according to some embodiments of the present disclosure is shown; and

[0093] Figure 7 A schematic diagram of the model structure of a second model provided according to some embodiments of the present disclosure is shown. Detailed Implementation

[0094] The following description provides specific application scenarios and requirements for this disclosure, intended to enable those skilled in the art to make and use the content of this disclosure. Various partial modifications to the disclosed embodiments will be apparent to those skilled in the art, and the general principles defined herein can be applied to other embodiments and applications without departing from the spirit and scope of this disclosure. Therefore, this disclosure is not limited to the embodiments shown, but rather to the widest scope consistent with the claims.

[0095] The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not restrictive. For example, unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “the” as used herein may also include the plural forms. When used in this disclosure, the terms “comprising,” “including,” and / or “containing” mean that the associated integers, steps, operations, elements, and / or components are present, but do not exclude the presence of one or more other features, integers, steps, operations, elements, components, and / or groups, or that other features, integers, steps, operations, elements, components, and / or groups may be added to the system / method.

[0096] In view of the following description, these and other features of this disclosure, as well as the operation and function of the related elements of the structure, and the economy of assembly and manufacture of the components, can be significantly improved. All of these form part of this disclosure with reference to the accompanying drawings. However, it should be clearly understood that the drawings are for illustrative and descriptive purposes only and are not intended to limit the scope of this disclosure. It should also be understood that the drawings are not drawn to scale.

[0097] The flowcharts used in this disclosure illustrate operations implemented according to some embodiments of this disclosure. It should be clearly understood that the operations in the flowcharts may not be implemented sequentially. Instead, the operations may be implemented in reverse order or simultaneously. Furthermore, one or more additional operations may be added to the flowcharts. One or more operations may be removed from the flowcharts.

[0098] For ease of description, the terms that will appear in the following descriptions will be explained as follows.

[0099] Adversarial attacks: In the field of artificial intelligence technology, attackers use various methods to bypass or directly attack machine learning models to achieve adversarial goals, causing the model to malfunction or make misjudgments. Among them, the core method of adversarial attacks is to create adversarial attack samples to confuse the model.

[0100] Adversarial attack samples: Generally speaking, adversarial attack samples involve adding imperceptible perturbations to the original samples (normal samples). These perturbations do not affect human recognition but can cause confusion and errors in the model's label prediction of image sample data. Building on this, if the requirements for modifying the target image sample data are relaxed, and an "adversarial sticker" is used (an "adversarial sticker" can be understood as a real, perceptible sticker), pasting an "adversarial sticker" on any area of ​​the target image sample (especially the face area) can similarly cause the model to misjudge the label prediction of the image sample data (for example, after pasting an adversarial sticker on an image of user A, it is incorrectly identified as user B).

[0101] Original features: Features that can be obtained directly through measurement. Original features usually have a lot of redundancy. If original features are directly fed into the classifier as classification features, it will not only make the classifier complex and computationally intensive, but the classification error rate may not be small. Therefore, it is necessary to reduce the number of features to obtain fewer but more precise classification features.

[0102] Feature extraction: This involves obtaining effective features through mapping (or transformation) methods to achieve dimensionality reduction in the feature space. The mapped features are a combination of the original features, typically a linear combination.

[0103] Class Activation Map (CAM): Generates a heatmap of class activations for an input image. For each image, this heatmap represents the importance of each location to that class. For a trained convolutional neural network, input information undergoes multiple convolutional and pooling operations. The last convolutional layer of a network contains the richest visual and semantic information. The CAM utilizes the feature maps from this last convolutional layer and uses backpropagation to find the weights corresponding to each channel. Larger weights indicate greater importance of the corresponding feature map. Based on image class labels and annotations, the CAM can roughly locate discriminative object regions in an image.

[0104] Gradient-weighted Class Activation Mapping (Grad-CAM): The full-class activation heatmap of the last convolutional layer is weighted by the gradient of the target class on the last convolutional layer of the model, so as to obtain the distribution of the sensitive regions of the model inferring the target class on the training / prediction image, and is displayed in the form of a "heatmap".

[0105] A saliency map addresses the impact of pixels in an image on the classification result. It is obtained by calculating the derivative of the output class with respect to the input image. The derivative represents how the model's output class changes when the input pixels undergo small changes. If a region in the input image has a large positive derivative for the output class, then even a slight change in this region will have a significant impact on the output class. This region can be considered a significant contributor to the model's classification result.

[0106] Class Activation Map: Generates a heatmap of class activations for an input image. For an image, this heatmap represents the importance of each location to that class. For a trained convolutional neural network, the input information is processed through multiple layers of convolution and pooling operations. The last convolutional layer of a network contains the richest visual and semantic information, and the class activation map utilizes the information from this last convolutional layer.

[0107] Image reconstruction (image inpainting): a technique that fills in missing pixels in an image and reconstructs it based on pixel information from the background.

[0108] Interpretability: This refers to the variety of features sought in a machine learning model, which may be auxiliary or complementary, or even competing features. Gradient-weighted class activation mapping can use the gradient of any target concept, flowing into the final convolutional layer to generate a coarse localization map, highlighting important regions in the image used for predicting the concept.

[0109] Figure 1 A schematic diagram of an adversarial attack detection system 100 according to some embodiments of the present disclosure is shown. System 100 may include a client 110, an integrated development platform 120, an integrated development platform server 130, and a database 140.

[0110] Integrated Development Platform 120, also known as an Integrated Development Environment (IDE), is an application that provides a program development environment, typically including tools such as a code editor, compiler, debugger, and graphical user interface. Developers can write program code (i.e., program development) on the IDE through client 110. The IDE server 130 (hereinafter referred to as server 130) can be a computing device on the IDE 120 specifically used to handle anti-attack detection methods in the program. In this application, multiple developers 110A, 110B, and 110C (collectively referred to as client 110) can perform program development on the IDE 120.

[0111] Server 130 may store data or instructions for executing the anti-attack detection method described herein, and may execute or be used to execute said data and / or instructions. Server 130 may include hardware devices with data processing capabilities and the necessary programs to drive the hardware devices. Of course, server 130 may also be merely a hardware device with data processing capabilities, or merely a program running on the hardware device. In some embodiments, server 130 may also be a plug-in deployed on client 110.

[0112] Database 140 may store data and / or instructions. In some embodiments, database 140 may store data and / or instructions executed by server 130 or used to execute adversarial attack detection methods in the programs described in this disclosure. Client 110 and server 130 may have access to database 140, and client 110 and server 130 may access data or instructions stored in database 140 via a network. In some embodiments, database 140 may be directly connected to client 110 and server 130. In some embodiments, database 140 may be part of server 130. In some embodiments, database 140 may include mass storage, removable storage, volatile read-write memory, read-only memory (ROM), or similar content, or any combination thereof. Exemplary mass storage may include non-transitory storage media such as disks, optical discs, and solid-state drives. Exemplary removable storage may include flash drives, floppy disks, optical discs, memory cards, zip disks, magnetic tapes, etc. Typical volatile read-write memory may include random access memory (RAM). Example RAMs may include dynamic RAM (DRAM), dual date rate synchronous dynamic RAM (DDRSDRAM), static RAM (SRAM), thyristor RAM (T-RAM), and zero-capacitance RAM (Z-RAM), etc. Exemplary ROMs may include mask ROM (MROM), programmable ROM (PROM), virtual programmable ROM (PEROM), electronically programmable ROM (EEPROM), optical disc (CD-ROM), and digital multifunction disk ROM, etc.

[0113] It should be understood that Figure 1 The number of clients 110 and servers 130 shown is merely illustrative. Depending on implementation needs, there can be any number of clients 110 and servers 130.

[0114] It should be noted that the aforementioned anti-attack detection method can be executed entirely on the client 110, entirely on the server 130, or partially on the client 110 and partially on the server 130.

[0115] For ease of description, the following descriptions of this disclosure will use the execution of the anti-attack detection method on server 130 as an example to describe the technical solutions involved in this disclosure.

[0116] Figure 2This is a schematic diagram of the structure of a computing device 200 provided according to some embodiments of the present disclosure. The computing device 200 can be a general-purpose computer or a special-purpose computer. For example, the computing device 200 can be a server, a personal computer, a portable computer (such as a laptop computer, tablet computer, etc.), or other electronic devices with computing capabilities. Of course, the computing device can be... Figure 1 The server 130 can also be a terminal device used by multiple developers 110A, 110B, 110C (client 110) to develop programs on the integrated development platform.

[0117] like Figure 2 As shown, the computing device 200 may include a COM port 250, which can be connected to or from a network to facilitate data communication. The computing device 200 may also include a processor 220, such as a central processing unit (CPU), in the form of one or more processors for executing program instructions. The computing device 200 may also include an internal communication bus 210 and various forms of program storage media and data storage media, such as a disk 270 (non-transitory memory) and read-only memory (ROM) 230 or random access memory (RAM) 240, etc., for storing various data files to be processed and / or transmitted. The storage media may be local to the computing device 200 or shared by the computing device 200 (e.g.,...). Figure 1 The computing device 200 may also include program instructions stored in ROM 230, RAM 240, and / or other types of non-transitory storage media to be executed by processor 220. The computing device 200 may also include I / O components 260 to support data communication with other computing devices in the distributed computing system 100. The computing device 200 may also receive programming and data via network communication.

[0118] For illustrative purposes only, only one processor 220 is described in the computing device 200. However, those skilled in the art will understand that the computing device 200 in this application may also include multiple processors. Therefore, the methods / steps / operations performed by one processor as described in this application may also be performed jointly or separately by multiple processors. For example, in this application, the processor of the computing device 200 may simultaneously execute step A and step B. It should be understood that step A and step B may also be performed jointly by two different processors. For example, a first processor executes step A, a second processor executes step B, or a first processor and a second processor jointly execute steps A and B.

[0119] Figure 3A flowchart 300 of an adversarial attack detection method according to some embodiments of the present disclosure is shown. The adversarial attack detection method provided by this disclosure can be applied to face recognition systems, as well as autonomous driving and other fields. The following will be combined with... Figure 3 This disclosure describes the technical solution. The subject implementing the technical solution may be... Figure 1 The client 110, integrated development platform 120, and server 130 are selected from the above. Specifically, the client 110, integrated development platform 120, and / or server 130 may have the following characteristics: Figure 2 The aforementioned structure, namely, the client 110, the integrated development platform 120, and / or the server 130, can be a device for variable tracking in a program, comprising: at least one storage medium and at least one processor. The at least one storage medium includes at least one instruction set for adversarial attack detection in the program. The at least one processor is communicatively connected to the at least one storage medium. When the system is running, the at least one processor can read the at least one instruction set and execute instructions according to the at least one instruction set. Figure 3 The method 300. For illustrative purposes only, this application will describe the method 300 as an example in a face recognition scenario, where server 130 executes the method 300. The method 300 may include:

[0120] S310, acquire a target image sample and determine the target region prediction map of the target image sample, wherein the face recognition response of the target region prediction map is higher than the face recognition response of the target image sample.

[0121] In this disclosure, the target image sample acquired by server 130 can be either an adversarial attack sample or a normal sample without adversarial processing. The adversarial attack sample can be generated by pasting an adversarial sticker onto the normal sample. The pasting area for the adversarial sticker can be the face region in the normal sample, and the coverage area of ​​the adversarial sticker on the face region can be set by the user. Generally, the coverage ratio of the adversarial sticker on the face region is less than 50%.

[0122] In this disclosure, after the server 130 obtains the target image sample, it can determine the target region prediction map in the target image sample. The target region prediction map is a feature map corresponding to a local region in the target image sample that has a significant impact on the face recognition result. Therefore, the face recognition response of the target region prediction map is higher than that of the target image sample.

[0123] In some embodiments, S310 may include:

[0124] S311, Perform interpretability analysis on the target image sample to obtain M interpretable maps, where M is a natural number greater than 1.

[0125] In this disclosure, the server 130 can perform interpretability analysis on target image samples using methods (models) such as Class Activation Mapping (CAM), and gradient-weighted Class Activation Mapping (GradCAM), Gradient-based Generalized Visual Interpretation Deep Convolutional Network (GradCAM++), SmoothGradCAM++, ScoreCAM, SSCAM, ISCAM, etc., or saliency maps. Accordingly, the server 130 can perform interpretability analysis on target image samples using each interpretability analysis method to obtain a corresponding interpretability map. In this disclosure, the interpretability map can include at least one of class activation heatmaps and saliency maps. The class activation heatmap includes interpretability maps corresponding to CAM and interpretability analysis methods derived from CAM, such as simple class activation heatmaps and gradient-weighted class activation heatmaps.

[0126] Since each interpretability analysis method has its own characteristics, in this disclosure, server 130 can comprehensively utilize the above-mentioned interpretability analysis methods to process the target image sample. That is, server 130 can use M types of interpretability analysis methods (M is a natural number greater than 1) to perform interpretability analysis on the target image sample, thereby obtaining M interpretable maps. For example, server 130 can use CAM, GradCAM, and GradCAM++ to perform interpretability analysis on the target image sample, obtaining three (types) of interpretable maps. Server 130 can also use CAM, GradCAM, GradCAM++, and Saliency Map to perform interpretability analysis on the target image sample, obtaining four (types) of interpretable maps. It should be understood that server 130 can also use other combinations of methods to perform interpretability analysis on the target image sample and obtain a corresponding number of interpretable maps, which will not be listed here.

[0127] S312, based on the preset first model 400, feature fusion is performed on the M interpretable maps to obtain the target region prediction map.

[0128] In this disclosure, such as Figure 4As shown, the preset first model 400 includes a multi-map fusion network. The network structure of the multi-map fusion network can include several convolutional layers and an attention-based fusion layer. After obtaining M interpretable maps, the server 130 can input the M interpretable maps into the first model and use the multi-map fusion network included in the first model to perform feature fusion on the M interpretable maps, thereby obtaining the target region prediction map.

[0129] In this disclosure, the target area prediction map is obtained by server 130 by integrating the features of M interpretable maps, thus incorporating the important features of each of the M interpretable maps. Therefore, compared with the single-type interpretable map obtained by traditional single interpretability analysis, the target area prediction map of this disclosure has higher accuracy and comprehensiveness.

[0130] S320, Based on the target region prediction map, the target image sample is reconstructed to determine the reconstructed image of the target image sample.

[0131] Traditional adversarial attack detection methods typically use preprocessing techniques (such as high-intensity Gaussian blurring, color transformation, etc.) to defend against adversarial attacks on images. While the attack effect can be weakened after adversarial attack preprocessing, it will also have a significant negative impact on the identification of normal samples.

[0132] In this disclosure, server 130 performs image reconstruction on the predicted map of the target region, that is, it performs local reconstruction on the region with high face recognition response in the target image sample, which can avoid negative impact on normal samples.

[0133] In some embodiments, S320 may include:

[0134] S321, multiply the predicted map of the target region with the target image sample to obtain the modulated image of the target image sample; and

[0135] S322, Based on the preset second model 500 and the modulation image, the target image sample is reconstructed to determine the reconstructed image of the target image sample.

[0136] In this disclosure, server 130 modulates the target image sample using a target region prediction map. Specifically, this involves multiplying the feature vector of the target region prediction map with the feature vector of the target image sample. It is important to note that since the feature dimension of the target region prediction map is smaller than that of the target image sample, server 130 needs to adjust the feature dimension of the target region prediction map to be consistent with that of the target image sample before multiplying them, thus performing calculations on features of the same dimension.

[0137] In this disclosure, the server 130 can adjust the feature dimension of the target region prediction map to be consistent with the feature dimension of the target image sample in several ways. For example, it can use the feature dimension of the target image sample as a reference and perform zero padding around the target region prediction map to expand the feature dimension of the target region prediction map to be the same as the feature dimension of the target image sample.

[0138] In this disclosure, server 130 can input a modulated image into second model 500, use second model 500 to fill in missing pixels in the modulated image, and reconstruct the image based on background pixel information to obtain a reconstructed image of the target image sample. The preset model structure of second model 500 can be UNet.

[0139] In some embodiments, S322 may include:

[0140] S322-a, the modulated image is divided into N modulation partition images, the second model 500 includes N reconstruction sub-networks, each of the N modulation partition images corresponds to a reconstruction sub-network, and N is a natural number greater than zero.

[0141] S322-b, for each of the N modulation partition images: determine the partition reconstruction image of the target image sample based on the reconstruction sub-network and the modulation partition image.

[0142] S322-c, Integrate the N partitioned reconstructed images to obtain the reconstructed image of the target image sample.

[0143] In this disclosure, the second model 500 includes N reconstructed subnetworks. Each of the N reconstructed subnetworks can perform reconstruction prediction. The difference lies in the fact that the neurons in each reconstructed subnetwork have different sensitivities to features of different regions of the face. That is, each reconstructed subnetwork targets a different face region for reconstruction prediction.

[0144] In this disclosure, server 130 can partition the modulated image into N modulated partition images (N is a natural number greater than zero), and establish a one-to-one correspondence between each modulated partition image and the reconstruction sub-networks included in the second model 500, that is, the number of modulated partition images is the same as the number of reconstruction sub-networks in the second model. Accordingly, server 130 can obtain the partition reconstruction image of the corresponding region using each reconstruction sub-network. Server 130 can obtain N partition reconstruction images using N reconstruction sub-networks. Server 130 stitches together the N partition reconstruction images to obtain the reconstructed image of the modulated image, that is, the reconstructed image of the target image sample.

[0145] For example, server 130 can divide the modulated image into 9 regions and train 9 reconstruction subnetworks, so that each reconstruction subnetwork performs reconstruction processing on one of the 9 regions, thereby obtaining 9 partitioned reconstructed images. It should be understood that server 130 can also divide the modulated image into other numbers of regions, which will not be listed here.

[0146] In this disclosure, server 130 divides the modulated image into N modulated partition images; and performs reconstruction processing on each of the N modulated partition images using a corresponding reconstruction sub-network to obtain N reconstructed partition images; then, the N reconstructed partition images are integrated and stitched together to obtain the reconstructed image of the target image sample. Compared with the traditional method of reconstructing the entire image sample, the above method can avoid the loss of facial structural information.

[0147] In some embodiments, determining the partitioned reconstruction image of the target image sample based on the reconstruction sub-network and the modulation partitioned image in S322-b may specifically include: obtaining pixel distribution information of the modulation partitioned image; determining the target reconstruction region map of the modulation partitioned image based on the pixel distribution information; and determining the partitioned reconstruction image of the target image sample based on the reconstruction sub-network and the target reconstruction region map.

[0148] Pixels are an important attribute of images in computer vision. They are numerical values ​​representing the color intensity of light in a specific space within an image, and are the smallest unit of data in an image. Digital images are composed of many pixels. Therefore, different image samples have different pixel distribution information.

[0149] In this disclosure, server 130 can further filter the modulation partition image based on the pixel distribution information of the modulation partition image to obtain a partial region map in the modulation partition image whose pixel distribution information meets preset conditions, i.e., the target reconstruction region map. Server 130 then inputs the target reconstruction region map into the reconstruction sub-network to obtain the partition reconstruction image of the target image sample.

[0150] In some embodiments, determining the target reconstruction region map of the modulation partition image based on the pixel distribution information may specifically include: obtaining a preset pixel threshold; and comparing the pixel distribution information with the pixel threshold, and determining the target reconstruction region map of the modulation partition image based on the comparison result.

[0151] In this disclosure, server 130 can pre-set a specific pixel threshold and compare the pixels contained in the modulation partition image with the preset pixel threshold to filter out pixels in the modulation partition image that are greater than the pixel threshold. Combining the filtered pixels yields the target reconstructed region map. Server 130 can set the pixel threshold itself. For example, server 130 can determine the average value of all pixels in the modulation partition image as the pixel threshold. Server 130 can also extract the top 50% of pixels from the modulation partition image to obtain the target reconstructed region map; correspondingly, the lowest pixel value among the top 50% can be used as the pixel threshold.

[0152] It should be understood that server 130 can also extract pixels with pixel values ​​in other ratio ranges to obtain the target reconstructed region map. Accordingly, the pixel threshold will also change. To save space, they will not be listed here.

[0153] S330, determine the sample attributes of the target image sample based on the reconstructed image and the target image sample, wherein the sample attributes include at least one of normal samples and adversarial attack samples.

[0154] In this disclosure, the reconstructed image is obtained by server 130 through local reconstruction based on the target image sample. Server 130 determines the sample attributes of the target image sample by analyzing the differences between the reconstructed image and the target image sample. When server 130 determines that the difference between the reconstructed image and the target image sample is large, server 130 can determine that the target image sample is an adversarial attack sample; when server 130 determines that the difference between the reconstructed image and the target image sample is small, server 130 can determine that the target image sample is a normal sample.

[0155] In some embodiments, S330 may include:

[0156] S331, Based on the preset first model 400, feature extraction is performed on the reconstructed image to obtain a reconstructed feature map.

[0157] S332, Based on the first model 400, feature extraction is performed on the target image sample to obtain an initial feature map.

[0158] In this disclosure, such as Figure 4As shown, the preset first model 400 also includes a face recognition network. The server 130 can input a reconstructed image into the first model 400 and use the face recognition network included in the first model 400 to extract features from the reconstructed image to obtain a reconstructed feature map. Similarly, the server 130 can also input a target image sample into the first model 400 and use the face recognition network included in the first model 400 to extract features from the target image sample to obtain an initial feature map.

[0159] S333, Based on the reconstructed feature map and the initial feature map, determine the sample attributes of the target image sample.

[0160] In this disclosure, the difference between the reconstructed feature map and the initial feature map is the difference between the reconstructed image and the target image sample. Therefore, by analyzing the difference between the reconstructed feature map and the initial feature map, the server 130 can determine the sample attributes of the target image sample.

[0161] In some embodiments, S333 may include:

[0162] S333-a, based on the preset third model 600, the initial feature map is mapped to obtain the first mapped feature map.

[0163] S333-b, based on the third model 600, feature mapping is performed on the reconstructed feature map to obtain the second mapped feature map.

[0164] In this disclosure, the preset third model 600 can have a multilayer perceptron (MLP) structure. An MLP, as a feedforward artificial neural network, can map a set of input vectors to a set of output vectors. The server 130 can input the initial feature map into the third model 600 and use the third model 600 to perform feature mapping on the initial feature map to obtain a first mapped feature map. The server 130 can also input the reconstructed feature map into the third model 600 and use the third model 600 to perform feature mapping on the reconstructed feature map to obtain a second mapped feature map.

[0165] S333-c, Based on the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map, determine the sample attributes of the target image sample.

[0166] In this disclosure, after the server 130 obtains the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map, it can determine whether the target image sample is a normal sample based on the relationship between the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map.

[0167] For ease of representation, the initial feature map will be denoted as f1, the reconstructed feature map as f2, the first mapped feature map as f3, and the second mapped feature map as f4.

[0168] In some embodiments, determining the sample attributes of the target image sample based on the initial feature map (f1), the first mapped feature map (f3), the reconstructed feature map (f2), and the second mapped feature map (f4) may specifically include: determining a first difference between the original feature map (f1) and the reconstructed feature map (f2); determining a second difference between the first mapped feature map (f3) and the initial feature map (f1); determining a third difference between the second mapped feature map (f4) and the reconstructed feature map (f2); determining a comprehensive feature difference based on the first difference, the second difference, and the third difference; and determining the sample attributes of the target image sample based on the comprehensive feature difference.

[0169] In this disclosure, server 130 can use the abs() function to represent the absolute difference between feature vectors. Since the initial feature map (f1), reconstructed feature map (f2), first mapped feature map (f3), and second mapped feature map (f4) all contain multiple feature vectors, the first difference can be expressed as sum(abs(f1-f2)), which is the sum of the differences between the corresponding feature vectors in the original feature map (f1) and the reconstructed feature map (f2). Correspondingly, the second difference can be expressed as sum(abs(f3-f1)); the third difference can be expressed as sum(abs(f4-f2)). In this disclosure, the comprehensive feature difference is the sum of the first difference, the second difference, and the third difference, that is, comprehensive feature difference = sum(abs(f1-f2)) + sum(abs(f3-f1)) + sum(abs(f4-f2)).

[0170] In this disclosure, server 130 can determine the difference between the reconstructed image and the target image sample based on the magnitude of the comprehensive feature difference, thereby determining the sample attributes of the target image sample.

[0171] In some embodiments, determining the sample attributes of the target image sample based on the comprehensive feature difference may specifically include: obtaining a preset feature difference threshold; comparing the comprehensive feature difference with the feature difference threshold to obtain a comparison result; and determining the sample attributes of the target image sample based on the comparison result.

[0172] In this disclosure, server 130 may preset a feature difference threshold and use this feature difference threshold as a standard for judging the magnitude of the comprehensive feature difference (the difference between the reconstructed image and the target image sample). Specifically, if the comprehensive feature difference is greater than the feature difference threshold, server 130 determines that the target image sample is an adversarial attack sample; if the comprehensive feature difference is less than or equal to the feature difference threshold, server 130 determines that the target image sample is a normal sample.

[0173] In this disclosure, the server 130 can arbitrarily specify the size of the feature difference threshold, and the server 130 can also set or adjust the size of the feature difference threshold according to the actual situation.

[0174] In this disclosure, server 130 acquires a target image sample and determines a target region prediction map of the target image sample. Based on the target region prediction map, server 130 reconstructs the target image sample to determine a reconstructed image of the target image sample. Server 130 then determines the sample attributes of the target image sample based on the reconstructed image and the target image sample. In this process, server 130 performs local image reconstruction on regions with high face recognition response rates (i.e., the target region prediction map) in the target image sample to obtain a reconstructed image. Based on the difference between the reconstructed image and the original image (target image sample), server 130 performs unsupervised adversarial attack detection to determine the sample attributes of the original image. The adversarial attack detection method of this disclosure achieves high-precision adversarial attack detection without relying on manual annotation or preprocessing of the original image, thus improving the accuracy and efficiency of adversarial attack detection.

[0175] In this disclosure, server 130 utilizes the anti-attack detection method 300 during the execution of the method.

[0176] There are three preset network models: the first model 400, the second model 500, and the third model 600. The training process for these three network models will be explained below.

[0177] like Figure 4 As shown, the first model 400 may include a multi-graph fusion network and a face recognition network.

[0178] In this disclosure, the training process of the first model 400 may include:

[0179] S410, acquire the target image sample.

[0180] S420, Based on the first model 400 and the target image sample, determine the target region prediction map of the target image sample.

[0181] In this disclosure, such as Figure 5As shown, server 130 can input M interpretable maps into the multi-map fusion network of the first model 400, and use the multi-map fusion network to perform feature fusion on the M interpretable maps to obtain the target region prediction map. Specifically, as mentioned earlier, server 130 can perform interpretability analysis on target image samples to obtain M interpretable maps.

[0182] S430, based on the first model 400 and the target region prediction map, determine the target feature prediction map of the target image sample.

[0183] In this disclosure, server 130 can determine target feature prediction map based on the face recognition network and target region prediction map of the first model 400.

[0184] In some embodiments, S430 may include:

[0185] S431, multiply the predicted map of the target region with the target image sample to obtain the modulated image of the target image sample; and

[0186] S432, Based on the first model 400, feature extraction is performed on the modulated image to obtain the target feature prediction map.

[0187] In this disclosure, such as Figure 6 As shown, server 130 can input the modulated image of the target image sample into the face recognition network of the first model 400, and use the face recognition network to extract features from the modulated image to obtain a target feature prediction map. Specifically, server 130 can multiply the target region prediction map with the target image sample to obtain the modulated image of the target image sample.

[0188] S440, based on the target region prediction map and the target feature prediction map, the first model 400 is converged to obtain the trained first model 400.

[0189] In this disclosure, during the training of the first model 400 by the server 130, information from both the target region prediction map and the target feature prediction map can be combined to converge the first model 400.

[0190] In some embodiments, S440 may include:

[0191] S441, Determine the sparsity loss information of the target region based on the target region prediction map.

[0192] As mentioned earlier, the target region prediction map is a feature map corresponding to local regions in the target image sample that have a significant impact on the face recognition result. Compared to the target image sample, the target region prediction map can be understood as selecting feature vectors in the target image sample that have a significant impact on the face recognition result and marking them as "1", while the remaining feature vectors in the target image sample are marked as "0". In this disclosure, when the feature vectors marked as "1" in the target region prediction map are sufficiently sparse, it indicates that the server 130 has a relatively accurate recognition of the local regions in the target image sample that have a significant impact on the face recognition result. In this disclosure, the server 130 can pre-set a target sparsity (for example, a target sparsity of 0.1) and calculate the true sparsity of the target region prediction map obtained each time, compare the true sparsity with the target sparsity, and obtain the target region sparsity loss information based on the comparison result.

[0193] In this disclosure, server 130 can utilize a sparse autoencoder to converge the sparsity loss information of the target region. It should be understood that server 130 can also set the target sparsity to other values ​​such as 0.05 or 0.2, which will not be listed here.

[0194] S442, obtain the initial feature map of the target image sample, compare the initial feature map with the target feature prediction map, and obtain feature consistency loss information;

[0195] In some embodiments, obtaining the initial feature map of the target image sample may include: extracting features from the target image sample based on the first model to obtain the initial feature map.

[0196] like Figure 6 As shown, server 130 can also directly input the target image sample into the face recognition network of the first model 400, and use the face recognition network to extract features from the target image sample to obtain an initial feature map. That is, the initial feature map in this disclosure can be understood as the map obtained after directly extracting features from the target image sample without preprocessing.

[0197] In this disclosure, the feature consistency loss information can be understood as the loss information formed by the difference between the initial feature map and the target feature prediction map. This loss information can be used to constrain the face image features before and after the server 130 modulates the target image sample using the first model to maintain consistency.

[0198] S443, the target region sparsity loss information and the feature consistency loss information are fused to obtain the first model loss information.

[0199] In this disclosure, the first model loss information involved in the training process of the first model 400 (Loss model1 It can include two parts, the first part being the sparsity loss information of the target region ( Loss sparstity The second part is the feature consistency loss information (). Loss feat ). The sparsity loss information of the target region ( Loss sparstity ) and feature consistency loss information ( Loss feat There are several ways to fuse data. For example, server 130 can fuse the sparse loss information of the target region (…). Loss sparstity ) and feature consistency loss information ( Loss feat The two are added together to obtain the loss information of the first model. Loss model1 ),Right now Loss model1 = Loss sparstity + Loss feat .

[0200] In some embodiments, server 130 can also obtain sparsity loss information of the target region ( Loss sparstity ) and feature consistency loss information ( Loss feat Each of the loss weights is assigned to a different value, and the sparsity loss information of the target region is analyzed based on these weights. Loss sparstity ) and feature consistency loss information ( Loss feat The sparse loss information of the target region is then weighted and then applied to the weighted target region. Loss sparstity ) and feature consistency loss information ( Loss feat The two are added together to obtain the loss information of the first model. Loss model1 ).

[0201] Server 130 obtains the first model loss information ( Loss model1 After that, S444 can be executed to converge the first model based on the loss information of the first model, so as to obtain the trained first model.

[0202] In this disclosure, server 130 can be based on the model structure of the first model 400 described above, and the first model loss information ( Loss model1The first model 400 is trained on its performance until it converges, thus obtaining the trained first model 400.

[0203] Server 130 is based on the first model loss information ( Loss model1 There are several ways to converge the first model 400. For example, server 130 can use the gradient descent algorithm based on the loss information of the first model ( Loss model1 The network parameters of the first model 400 are updated until the first model 400 converges, thus obtaining the trained first model 400. In addition, the server 130 can also use other parameter update algorithms based on the first model's loss information ( Loss model1 The network parameters of the first model 400 are updated until the first model 400 converges, thus obtaining the trained first model 400.

[0204] It should be understood that the above-described convergence method is only applicable to the loss information based on the first model in this disclosure. Loss model1 This is an example of how the first model 400 converges, but it does not represent the actual method that can be used in this disclosure based on the loss information of the first model. Loss model1 The convergence method of the first model 400 has a limiting effect.

[0205] In this disclosure, the training process of the second model 500 may include:

[0206] S510, acquire the modulated image of the target image sample.

[0207] In this disclosure, S510 is basically the same as S321. The server 130 multiplies the target region prediction map with the target image sample to obtain the modulated image of the target image sample.

[0208] S520, based on the second model 500, the modulated image is reconstructed to obtain the reconstructed image of the target image sample.

[0209] In this disclosure, S520 is basically the same as S322. The server 130 can input the modulated image into the second model, use the second model to fill in the missing pixels in the modulated image, and reconstruct it based on the pixel information of the background, thereby obtaining the reconstructed image of the target image sample.

[0210] S530, the second model 500 is converged based on the reconstructed image to obtain the trained second model 500.

[0211] In some embodiments, S530 may include:

[0212] S531, compare the reconstructed image and the target image sample to obtain reconstruction loss information; and

[0213] S532, the second model 500 is converged based on the reconstruction loss information to obtain the trained second model 500.

[0214] In this disclosure, during the training of the second model 500 by the server 130, information from both the reconstructed image and the target image samples can be combined to converge the second model 500. The reconstruction loss information is the same as the second model loss information. Loss model2 The reconstruction loss information can be understood as the loss information formed by the difference between the reconstructed image and the target image sample. This loss information can be used to constrain the reconstructed image predicted by the second model 500 to be consistent with the image of the face region in the target image sample.

[0215] In some embodiments, server 130 can use a graph autoencoder (GAE) to reconstruct the adjacency relationships between nodes and compare the similarity between the reconstructed matrix (i.e., the reconstructed image) and the original matrix (the target image sample) to update the parameters. The reconstruction loss of the graph autoencoder can be as follows:

[0216]

[0217] in, It is the original matrix (target image sample). It is the reconstructed adjacency matrix. In this disclosure, server 130 can use the inner product of vectors to represent the adjacency relationship between nodes.

[0218] In this disclosure, server 130 can reconstruct loss information based on the model structure of the aforementioned second model 500. Loss model2 The second model 500 is trained on its performance until it converges, thus obtaining the trained second model 500.

[0219] It should be understood that the above-described convergence method is merely an example of the convergence method of the second model 500 based on the reconstruction loss information in this disclosure, and it does not limit the actual convergence method of the second model 500 based on the reconstruction loss information in this disclosure.

[0220] like Figure 7As shown, the second model 500 includes N reconstruction sub-networks, where N is a natural number greater than zero. As mentioned earlier, each of the N reconstruction sub-networks can perform reconstruction prediction. The difference lies in the different sensitivities of neurons in each reconstruction sub-network to features of different facial regions, meaning that each reconstruction sub-network targets different facial regions for reconstruction prediction.

[0221] In this disclosure, server 130 can partition the reconstructed image into N partitioned reconstructed images (N is a natural number greater than zero), and establish a one-to-one correspondence between each partitioned reconstructed image and the reconstructed sub-networks contained in the second model 500. Correspondingly, server 130 can also partition the target image samples into N target partitioned images (N is a natural number greater than zero), and establish a one-to-one correspondence between each target partitioned image and the partitioned reconstructed image. Thus, it can construct the correspondence between each target partitioned image, each partitioned reconstructed image, and each reconstructed sub-network, and train each reconstructed sub-network based on the mutually related target partitioned images and partitioned reconstructed images to obtain the trained reconstructed sub-network.

[0222] For example, if the second model 500 includes three reconstruction sub-networks (reconstruction sub-network A, reconstruction sub-network B, and reconstruction sub-network C), the server 130 can train each reconstruction sub-network separately to obtain the trained reconstruction sub-network. Specifically, the server 130 can divide the reconstruction into three partition reconstruction images (partition reconstruction image A, partition reconstruction image B, and partition reconstruction image C). The server 130 can also divide the target image sample into three target partition images (target partition image A, target partition image B, and target partition image C). Partition reconstruction image A, target partition image A, and reconstruction sub-network A correspond to each other; that is, the server 130 can compare partition reconstruction image A and target partition image A to obtain reconstruction loss information A. Loss model2A The reconstructed subnetwork A is then converged based on the reconstruction loss information A to obtain the trained reconstructed subnetwork A. Correspondingly, the partitioned reconstructed image B, the target partitioned image B, and the reconstructed subnetwork B are associated with each other. The server 130 can compare the partitioned reconstructed image B and the target partitioned image B to obtain the reconstruction loss information B. Loss model2B The reconstructed subnetwork B is then converged based on the reconstruction loss information B, resulting in the trained reconstructed subnetwork B. Simultaneously, the partitioned reconstructed image C, the target partitioned image C, and the reconstructed subnetwork C correspond to each other. The server 130 can compare the partitioned reconstructed image C and the target partitioned image C to obtain the reconstruction loss information C(…). Loss model2CThe reconstructed subnetwork C is converged based on the reconstruction loss information C to obtain the trained reconstructed subnetwork C. After obtaining the trained reconstructed subnetworks A, B, and C, server 130 can combine them into a network model group, namely the second model 500.

[0223] It should be understood that the second model 500 may also include other numbers of reconstructed subnetworks. Accordingly, the server 130 can train the second model 500 according to the number of reconstructed subnetworks included in the second model 500, which will not be listed here.

[0224] In this disclosure, the training process of the third model 600 may include:

[0225] S610, Obtain the initial feature map of the target image sample.

[0226] In this disclosure, the methods for obtaining the initial feature map in S610 and S442 are basically the same, that is, the server can input the target image sample into the face recognition network of the first model 400, and use the face recognition network to extract features from the target image sample to obtain the initial feature map.

[0227] S620, Obtain the reconstructed feature map of the reconstructed image.

[0228] In this disclosure, the reconstructed feature map can be understood as the map obtained by feature extraction after the target image sample has undergone reconstruction processing. The method of obtaining the reconstructed image is basically the same as S520 and S322. The server 130 can input the modulated image into the second model 500, use the second model 500 to fill in the missing pixels in the modulated image, and reconstruct based on the pixel information of the background, thereby obtaining the reconstructed image of the target image sample.

[0229] S630, the third model 600 is converged based on the initial feature map and the reconstructed feature map to obtain the trained third model 600.

[0230] In this disclosure, during the training process of the third model 600 by the server 130, information from both the initial feature map and the reconstructed feature map can be combined to converge the third model 600.

[0231] In some embodiments, S630 may include:

[0232] S631, based on the third model 600, perform feature mapping on the initial feature map to obtain the first mapped feature map.

[0233] In this disclosure, S631 is basically the same as S333-a. The server 130 can input the initial feature map into the third model 600 and use the third model 600 to perform feature mapping on the initial feature map to obtain the first mapped feature map.

[0234] S632, based on the third model 600, perform feature mapping on the reconstructed feature map to obtain the second mapped feature map.

[0235] In this disclosure, S632 and S333-b are basically the same. The server 130 can also input the reconstructed feature map into the third model 600 and use the third model 600 to perform feature mapping on the reconstructed feature map to obtain the second mapped feature map.

[0236] S633, the third model 600 is converged based on the initial feature map, the first mapped feature map, the reconstructed feature map and the second mapped feature map to obtain the trained third model 600.

[0237] In some embodiments, S633 may include:

[0238] S633-a, compare the first mapped feature map with the reconstructed feature map to obtain the first mapping loss information.

[0239] In this disclosure, the first mapping loss information can be understood as the loss information formed by the difference between the first mapped feature map obtained by feature mapping the initial feature map and the reconstructed feature map. This loss information can be used to constrain the consistency between the first mapped feature map predicted by the third model 600 and the reconstructed feature map. There are various methods for calculating the first mapping loss. For example, the server 130 can use a mean squared loss function to determine the first mapping loss information. Furthermore, the server 130 can use other methods to determine the first mapping loss information.

[0240] S633-b, compare the second mapping feature map with the initial feature map to obtain the second mapping loss information.

[0241] In this disclosure, the second mapping loss information can be understood as the loss information formed by the difference between the second mapped feature map obtained by reconstructing the feature map and the initial feature map. This loss information can be used to constrain the second mapped feature map predicted by the third model 600 to maintain consistency with the initial feature map. There are various methods for calculating the second mapping loss. For example, the server 130 can use a mean squared loss function to determine the second mapping loss information. Furthermore, the server 130 can use other methods to determine the second mapping loss information.

[0242] S633-c, the first mapping loss information and the second mapping loss information are fused to obtain the third model loss information.

[0243] In this disclosure, the third model loss information involved in the training process of the third model 600 ( Loss model3 It can include two parts, the first part being the first mapping loss information ( Loss 1), the second part is the second mapping loss information ( Loss 2). The first mapping loss information ( Loss 1) and second mapping loss information ( Loss 2) There are multiple ways to perform the fusion. For example, server 130 can combine the first mapping loss information ( Loss 1) and second mapping loss information ( Loss 2) Add them together to obtain the loss information of the first model. Loss model1 ),Right now Loss model1 = Loss sparstity + Loss feat .

[0244] In some embodiments, server 130 may also obtain first mapping loss information ( Loss 1) with the second mapping loss information ( Loss 2) Each of their respective loss weights, and based on their respective loss weights, the first mapping loss information ( Loss 1) with the second mapping loss information ( Loss 2) Perform weighting, and then apply the weighted first mapping loss information ( Loss 1) with the second mapping loss information ( Loss 2) Add them together to obtain the loss information of the third model. Loss model3 ).

[0245] Server 130 obtains the loss information of the third model ( Loss model3 After that, S633-d can be executed to converge the third model 600 based on the loss information of the third model, so as to obtain the trained third model.

[0246] In this disclosure, server 130 can perform performance training on third model 600 based on the aforementioned third model loss information until third model 600 converges, thereby obtaining trained third model 600. Server 130 can use various methods to converge third model 600 based on third model loss information. For example, server 130 can use a gradient descent algorithm to update the network parameters of third model 600 based on third model loss information until third model 600 converges, thereby obtaining trained third model 600. Alternatively, server 130 can use other parameter update algorithms to update the network parameters of third model 600 based on third model loss information until third model 600 converges, thereby obtaining trained third model 600.

[0247] It should be understood that the above-mentioned convergence method is merely an example of the convergence method of the third model 600 based on the loss information of the third model in this disclosure, and it does not limit the actual convergence method of the third model 600 based on the loss information of the third model in this disclosure.

[0248] In summary, after reading this detailed disclosure, those skilled in the art will understand that the foregoing detailed disclosure is presented by way of example only and is not restrictive. Although not explicitly stated herein, those skilled in the art will understand that this disclosure is intended to encompass various reasonable changes, improvements, and modifications to the embodiments. These changes, improvements, and modifications are intended to be made by this disclosure and are within the spirit and scope of the exemplary embodiments of this disclosure.

[0249] Furthermore, certain terms used in this disclosure have been used to describe embodiments of this disclosure. For example, "an embodiment," "an embodiment," and / or "some embodiments" mean that a particular feature, structure, or characteristic described in connection with that embodiment may be included in at least one embodiment of this disclosure. Therefore, it is to be emphasized and understood that two or more references to "an embodiment" or "an embodiment" or "alternative embodiment" in various parts of this disclosure do not necessarily refer to the same embodiment. Moreover, specific features, structures, or characteristics may be suitably combined in one or more embodiments of this disclosure.

[0250] It should be understood that in the foregoing description of the embodiments of this disclosure, various features are sometimes combined in a single embodiment, drawing, or description for the purpose of simplifying the disclosure and to aid in understanding a feature. Alternatively, various features may be distributed across multiple embodiments of this disclosure. However, this does not mean that the combination of these features is necessary, and those skilled in the art may extract some features as separate embodiments when reading this disclosure. That is, the embodiments in this disclosure can also be understood as an integration of multiple sub-embodiments. It is also possible for each sub-embodiment to contain fewer features than all of the features of a single foregoing disclosed embodiment.

Claims

1. A method for detecting adversarial attacks, comprising: Acquire a target image sample and determine a target region prediction map of the target image sample, wherein the face recognition response of the target region prediction map is higher than that of the face recognition response of the target image sample; Based on the target region prediction map, the target image sample is modulated to obtain a modulated image of the target image sample; Based on the preset second model and the modulation image, the target image sample is reconstructed to determine the reconstructed image of the target image sample. The second model includes multiple reconstruction sub-networks. The image reconstruction includes integrating the partitioned reconstruction images output by each of the multiple reconstruction sub-networks to obtain the reconstructed image. as well as The sample attributes of the target image sample are determined based on the differences between the reconstructed image and the target image sample, and the sample attributes include at least one of normal samples and adversarial attack samples.

2. The adversarial attack detection method as described in claim 1, wherein, Determining the target region prediction map of the target image sample includes: Interpretability analysis is performed on the target image samples to obtain M interpretable maps, where M is a natural number greater than 1; and Based on a preset first model, feature fusion is performed on the M interpretable maps to obtain the target region prediction map.

3. The adversarial attack detection method as described in claim 2, wherein, The interpretability map includes at least one of class activation heatmap and saliency map.

4. The adversarial attack detection method as described in claim 1, wherein, The process of modulating the target image sample based on the target region prediction map to obtain the modulated image of the target image sample includes: The predicted map of the target region is multiplied by the target image sample to obtain the modulated image of the target image sample.

5. The adversarial attack detection method as described in claim 4, wherein, The step of reconstructing the target image sample based on the preset second model and the modulated image to determine the reconstructed image of the target image sample includes: The modulated image is divided into N modulation partition images. The second model includes N reconstruction sub-networks. Each of the N modulation partition images corresponds to one reconstruction sub-network. N is a natural number greater than zero. For each of the modulation partition images: the partition reconstruction image of the target image sample is determined based on the reconstruction subnetwork and the modulation partition image; and The N partitioned reconstructed images are integrated to obtain the reconstructed image of the target image sample.

6. The adversarial attack detection method as described in claim 5, wherein, The step of determining the partitioned reconstructed image of the target image sample based on the reconstructed subnetwork and the modulation partitioned image includes: Obtain the pixel distribution information of the modulation partition image; Based on the pixel distribution information, the target reconstruction region map of the modulation partition image is determined; and Based on the reconstruction sub-network and the target reconstruction region map, the partitioned reconstruction image of the target image sample is determined.

7. The adversarial attack detection method as described in claim 6, wherein, Determining the target reconstruction region map of the modulation partition image based on the pixel distribution information includes: Obtain the preset pixel threshold; and The pixel distribution information is compared with the pixel threshold, and the target reconstruction region map of the modulation partition image is determined based on the comparison result.

8. The adversarial attack detection method as described in claim 1, wherein, Determining the sample attributes of the target image sample based on the difference between the reconstructed image and the target image sample includes: Based on a preset first model, feature extraction is performed on the reconstructed image to obtain a reconstructed feature map; Based on the first model, feature extraction is performed on the target image samples to obtain an initial feature map; and Based on the reconstructed feature map and the initial feature map, the sample attributes of the target image sample are determined.

9. The adversarial attack detection method as described in claim 8, wherein, The step of determining the sample attributes of the target image sample based on the reconstructed feature map and the initial feature map includes: Based on a preset third model, feature mapping is performed on the initial feature map to obtain a first mapped feature map; Based on the third model, feature mapping is performed on the reconstructed feature map to obtain a second mapped feature map; and Based on the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map, the sample attributes of the target image sample are determined.

10. The adversarial attack detection method as described in claim 9, wherein, The step of determining the sample attributes of the target image sample based on the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map includes: Determine the first difference between the initial feature map and the reconstructed feature map; Determine the second difference between the first mapped feature map and the initial feature map; Determine the third difference between the second mapped feature map and the reconstructed feature map; Based on the first difference, the second difference, and the third difference, a comprehensive feature difference is determined; and The sample attributes of the target image sample are determined based on the comprehensive feature difference.

11. The adversarial attack detection method as described in claim 10, wherein, Determining the sample attributes of the target image sample based on the comprehensive feature difference includes: Obtain the preset feature difference threshold; The comparison result is obtained by comparing the comprehensive feature difference with the feature difference threshold; and The sample attributes of the target image sample are determined based on the comparison results.

12. The adversarial attack detection method as described in claim 2 or 8, wherein, The training process of the first model includes: Obtain the target image sample; Based on the first model, a target region prediction map of the target image sample is determined; Based on the first model and the target region prediction map, a target feature prediction map of the target image sample is determined; and Based on the target region prediction map and the target feature prediction map, the first model is converged to obtain the trained first model.

13. The adversarial attack detection method as described in claim 12, wherein, The step of determining the target feature prediction map of the target image sample based on the first model and the target region prediction map includes: Multiply the predicted map of the target region by the target image sample to obtain the modulated image of the target image sample; and Based on the first model, feature extraction is performed on the modulated image to obtain the target feature prediction map.

14. The adversarial attack detection method as described in claim 12, wherein, The step of converging the first model based on the target region prediction map and the target feature prediction map to obtain the trained first model includes: Based on the target region prediction map, determine the sparsity loss information of the target region; The initial feature map of the target image sample is obtained, and the initial feature map is compared with the target feature prediction map to obtain feature consistency loss information. The target region sparsity loss information and the feature consistency loss information are fused to obtain the first model loss information; and The first model is converged based on the loss information of the first model to obtain the trained first model.

15. The adversarial attack detection method as described in claim 14, wherein, The process of obtaining the initial feature map of the target image sample includes: Based on the first model, feature extraction is performed on the target image sample to obtain the initial feature map.

16. The adversarial attack detection method as described in claim 4, wherein, The training process of the second model includes: Acquire the modulated image of the target image sample; and Based on the second model, the modulated image is reconstructed to obtain the reconstructed image of the target image sample; and The second model is converged based on the reconstructed image to obtain the trained second model.

17. The adversarial attack detection method as described in claim 16, wherein, The step of converging the second model based on the reconstructed image to obtain the trained second model includes: The reconstructed image and the target image sample are compared to obtain reconstruction loss information; and The second model is converged based on the reconstructed loss information to obtain the trained second model.

18. The adversarial attack detection method as described in claim 9, wherein, The training process of the third model includes: Obtain the initial feature map of the target image sample; Obtain the reconstructed feature map of the reconstructed image; and The third model is converged based on the initial feature map and the reconstructed feature map to obtain the trained third model.

19. The adversarial attack detection method as described in claim 18, wherein, The process of converging the third model based on the initial feature map and the reconstructed feature map to obtain the trained third model includes: Based on the third model, feature mapping is performed on the initial feature map to obtain the first mapped feature map; Based on the third model, feature mapping is performed on the reconstructed feature map to obtain a second mapped feature map; and The third model is converged based on the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map to obtain the trained third model.

20. The adversarial attack detection method as described in claim 19, wherein, The process of converging the third model based on the initial feature map, the first mapped feature map, the reconstructed feature map, and the second mapped feature map to obtain the trained third model includes: The first mapped feature map is compared with the reconstructed feature map to obtain the first mapping loss information; The second mapped feature map is compared with the initial feature map to obtain the second mapped loss information; The first mapping loss information and the second mapping loss information are fused to obtain the third model loss information; and The third model is converged based on the loss information of the third model to obtain the trained third model.

21. An adversarial attack detection system, comprising: At least one storage medium, including at least one instruction set, for implementation analysis of adversarial attack detection methods; as well as At least one processor is communicatively connected to the at least one storage medium. When the system is running, the at least one processor reads the at least one instruction set and executes the method of any one of claims 1-20 according to the instructions of the at least one instruction set.

Images