Adversarial sample detection method and device, computer device and storage medium

Abstract

The application relates to an adversarial sample detection method and device, computer equipment, a storage medium and a computer program product, and relates to the field of artificial intelligence. The method comprises the following steps: for an original face sample image set, at least two different shape types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations; the general adversarial perturbations are adversarial perturbations generated by at least two general adversarial attack methods based on gradients; the simulated adversarial perturbations of each shape type are added to original face sample images in the original face sample image set to obtain a simulated adversarial sample image set; a target adversarial detection training set is generated according to the simulated adversarial sample image set and the original face sample image set; the target adversarial detection training set is used for training a face adversarial detection model; and the face adversarial detection model is used for detecting whether a to-be-detected face image is a face adversarial sample. The method can improve the detection accuracy of face adversarial samples.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and in particular to an adversarial example detection method, apparatus, computer equipment, storage medium, and computer program product. Background Technology

[0002] In recent years, with the significant leap in computing power of graphics processing units, convolutional neural networks (CNNs) have made great strides in a wide range of tasks, including image classification, person re-identification, and face recognition.

[0003] CNNs are susceptible to adversarial examples, which are often difficult for humans to perceive but can cause serious errors in algorithm output. Face adversarial examples, as a type of adversarial example, seriously affect the security of face recognition systems.

[0004] However, the adversarial sample detection methods for faces in related technologies are usually designed for specific attacks or specific tasks. New adversarial samples need to be generated after a new attack appears in order to retrain the adversarial detection model. This results in poor generalization of the adversarial detection model, which cannot accurately identify adversarial samples of different adversarial attack types.

[0005] Therefore, the relevant technologies suffer from low accuracy in detecting adversarial examples on faces. Summary of the Invention

[0006] Therefore, it is necessary to provide an adversarial example detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the detection accuracy of adversarial examples against faces, in order to address the aforementioned technical problems.

[0007] Firstly, this application provides a method for detecting adversarial examples. The method includes:

[0008] For the original set of human face sample images, at least two different types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations; the general adversarial perturbations are generated by at least two gradient-based general adversarial attack methods.

[0009] Add simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set to obtain a simulated adversarial sample image set;

[0010] Based on the simulated adversarial sample image set and the original face sample image set, a target adversarial detection training set is generated; the target adversarial detection training set is used to train a face adversarial detection model; the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial sample.

[0011] In one embodiment, the process of obtaining at least two different types of simulated adversarial perturbations by simulating a universal adversarial perturbation for the original set of face sample images includes:

[0012] A predetermined number of the original face sample images are used as the first original sample images, and the images in the original face sample image set other than the first original sample images are used as the second original sample images.

[0013] For the first original sample image, a simulated adversarial perturbation of the first shape type is obtained by simulating the general adversarial perturbation;

[0014] For the second original sample image, a simulated adversarial perturbation of the second shape type is obtained by simulating the general adversarial perturbation;

[0015] The simulated adversarial perturbations of the at least two different shape types are determined based on the simulated adversarial perturbations of the first shape type and the simulated adversarial perturbations of the second shape type.

[0016] In one embodiment, obtaining a simulated adversarial perturbation of a first shape type for the first original sample image by simulating the general adversarial perturbation includes:

[0017] Obtain a first all-zero matrix; the size of the first all-zero matrix matches the image size of the first original sample image;

[0018] For each pixel in the first original sample image, a random perturbation value is added to the corresponding pixel position in the first all-zero matrix to obtain the first target matrix.

[0019] The first target matrix is ​​used as a point-like simulated adversarial perturbation to obtain the simulated adversarial perturbation of the first shape type.

[0020] In one embodiment, obtaining a simulated adversarial perturbation of a second shape type for the second original sample image by simulating the general adversarial perturbation includes:

[0021] Obtain the second all-zero matrix; the size of the second all-zero matrix matches the image size of the second original sample image;

[0022] Traverse the mask region corresponding to each pixel in the second original sample image in the second all-zero matrix, and add random perturbation values ​​to each mask region to obtain the second target matrix; the mask region is a pixel region with a preset size and containing the corresponding pixel.

[0023] The second target matrix is ​​used as a block-shaped simulated adversarial perturbation to obtain the simulated adversarial perturbation of the second shape type.

[0024] In one embodiment, adding simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set to obtain a simulated adversarial sample image set includes:

[0025] The simulated adversarial perturbation of the first shape type is added to the first original sample image to obtain the first simulated sample image;

[0026] The simulated adversarial perturbation of the second shape type is added to the second original sample image to obtain the second simulated sample image;

[0027] The set of simulated adversarial sample images is determined based on the first simulated sample image and the second simulated sample image.

[0028] In one embodiment, generating a target adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set includes:

[0029] An adversarial detection training set is obtained based on the simulated adversarial sample image set and the original face sample image set; the adversarial detection training set includes several adversarial detection sample images;

[0030] Locate the classification-sensitive region of the adversarial detection sample image to obtain the target adversarial detection training set; the classification-sensitive region is the region in the adversarial detection sample image whose classification influence weights meet preset conditions.

[0031] In one embodiment, locating the classification-sensitive region of the adversarial detection sample image to obtain the target adversarial detection training set includes:

[0032] Determine the random probability value corresponding to the adversarial detection sample image;

[0033] When the random probability value is greater than a preset probability value threshold, the classification sensitive region of the adversarial detection sample image is located to obtain an optimized adversarial detection sample image.

[0034] The target adversarial detection training set is obtained based on the optimized adversarial detection sample images.

[0035] In one embodiment, locating the classification-sensitive region of the adversarial detection sample image includes:

[0036] By inputting the adversarial detection sample image into the face adversarial detection model to be trained, a fake attention map is calculated on the adversarial detection sample image to obtain the attention mask map corresponding to the adversarial detection sample image; the attention mask map is used to characterize the classification sensitivity of the face adversarial detection model to each pixel in the adversarial detection sample image;

[0037] Based on the classification sensitivity corresponding to each pixel in the adversarial detection sample image, target pixels are selected from the adversarial detection sample image to obtain the classification sensitive region of the adversarial detection sample image; the classification sensitivity corresponding to the target pixel is greater than a preset sensitivity threshold.

[0038] In one embodiment, the step of inputting the adversarial detection sample image into the face adversarial detection model to be trained, and calculating a fake attention map on the adversarial detection sample image to obtain an attention mask map corresponding to the adversarial detection sample image includes:

[0039] By inputting the adversarial detection sample image into the face adversarial detection model to be trained, the adversarial class probability value and the non-adversarial class probability value corresponding to the adversarial detection sample image are obtained;

[0040] The perturbation gradient value corresponding to the adversarial detection sample image is determined based on the difference between the adversarial probability value and the non-adversarial probability value; the perturbation gradient value is determined by performing gradient calculation based on the absolute value of the difference.

[0041] For each pixel in the adversarial detection sample image, the maximum perturbation gradient value is determined and used as the mask value for each pixel.

[0042] The attention mask map is obtained based on the mask value corresponding to each pixel of the adversarial detection sample image.

[0043] In one embodiment, obtaining the optimized adversarial detection sample image includes:

[0044] Based on the location of the classification-sensitive region in the adversarial detection sample image, a corresponding area to be covered in the adversarial detection sample image is determined; the area to be covered is obtained by expanding the classification-sensitive region according to a random starting point position and a random size.

[0045] The region to be covered is covered by a random number matrix to obtain an adversarial detection sample image after suspicious forgery removal; the size of the random number matrix is ​​matched with the size of the region to be covered.

[0046] The adversarial detection sample image after the suspicious forgery has been removed is used as the optimized adversarial detection sample image.

[0047] Secondly, this application also provides an adversarial sample detection device. The device includes:

[0048] The simulation module is used to obtain at least two different types of simulated adversarial perturbations by simulating general adversarial perturbations for the original set of face sample images; the general adversarial perturbations are adversarial perturbations generated by at least two gradient-based general adversarial attack methods;

[0049] An add module is used to add simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set, thereby obtaining a simulated adversarial sample image set;

[0050] The generation module is used to generate a target adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set; the target adversarial detection training set is used to train a face adversarial detection model; the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial sample.

[0051] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0052] For the original set of human face sample images, at least two different types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations; the general adversarial perturbations are generated by at least two gradient-based general adversarial attack methods.

[0053] Add simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set to obtain a simulated adversarial sample image set;

[0054] Based on the simulated adversarial sample image set and the original face sample image set, a target adversarial detection training set is generated; the target adversarial detection training set is used to train a face adversarial detection model; the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial sample.

[0055] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0056] For the original set of human face sample images, at least two different types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations; the general adversarial perturbations are generated by at least two gradient-based general adversarial attack methods.

[0057] Add simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set to obtain a simulated adversarial sample image set;

[0058] Based on the simulated adversarial sample image set and the original face sample image set, a target adversarial detection training set is generated; the target adversarial detection training set is used to train a face adversarial detection model; the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial sample.

[0059] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0060] For the original set of human face sample images, at least two different types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations; the general adversarial perturbations are generated by at least two gradient-based general adversarial attack methods.

[0061] Add simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set to obtain a simulated adversarial sample image set;

[0062] Based on the simulated adversarial sample image set and the original face sample image set, a target adversarial detection training set is generated; the target adversarial detection training set is used to train a face adversarial detection model; the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial sample.

[0063] The aforementioned adversarial example detection method, apparatus, computer equipment, storage medium, and computer program product obtain at least two different types of simulated adversarial perturbations by simulating general adversarial perturbations on an original set of face sample images. The general adversarial perturbations are generated using at least two gradient-based general adversarial attack methods. Simulated adversarial perturbations of each shape type are added to the original face sample images in the original set of face sample images to obtain a set of simulated adversarial example images. A target adversarial detection training set is generated based on the simulated adversarial example image set and the original face sample image set. The target adversarial detection training set is used to train a face adversarial detection model. The face adversarial detection model is used to detect whether a face image to be detected is a face adversarial example.

[0064] Thus, although various gradient-based general adversarial attack methods can generate various general adversarial perturbations, these perturbations have fixed patterns and general shapes. By simulating these fixed patterns for the original face sample image set, at least two different types of simulated adversarial perturbations can be obtained. These simulated perturbations are then added to the original face sample images to create a simulated adversarial sample image set. This simulated adversarial sample image set can cover various general adversarial perturbations. Therefore, it is possible to train a face adversarial detection model using only the original face sample image set and the simulated adversarial sample image set, without using real face adversarial samples obtained from perturbations generated by general gradient-based adversarial attack methods. This results in a face adversarial detection model that can detect face adversarial samples against various general gradient-based adversarial attack methods, rather than just against a specific adversarial attack method. This effectively improves the performance and generalization ability of the face adversarial detection model, enabling it to detect face adversarial samples against various adversarial attacks and thus improving the accuracy of face adversarial sample detection. Attached Figure Description

[0065] Figure 1 This is a flowchart illustrating an adversarial example detection method in one embodiment;

[0066] Figure 2 This is a schematic diagram of a point-shaped simulated counter-disturbance and a block-shaped simulated counter-disturbance in one embodiment;

[0067] Figure 3 This is a flowchart illustrating an adversarial example detection method in another embodiment;

[0068] Figure 4 This is a general framework diagram of an adversarial example detection method in one embodiment;

[0069] Figure 5 This is a structural block diagram of an adversarial sample detection device in one embodiment;

[0070] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0071] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0072] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0073] In one embodiment, such as Figure 1 As shown, an adversarial example detection method is provided. This embodiment illustrates the application of this method to a server, which can be a standalone server or a server cluster composed of multiple servers. It is understood that this method can also be applied to a terminal, or to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0074] Step S110: For the original set of face sample images, at least two different types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations.

[0075] Among them, the general adversarial perturbation is an adversarial perturbation generated by at least two gradient-based general adversarial attack methods.

[0076] Among them, gradient-based general adversarial attack methods may include, but are not limited to, general adversarial attack methods such as FGSM (Fast Gradient Sign Method), BIM (Basic Iterative Method), PGD (Projected Gradient Descent), RFGSM (Random Fast Gradient Sign Method), and MIFGSM (Momentum Iterative Fast Gradient Sign Method).

[0077] In a specific implementation, the server can obtain a set of preprocessed original face sample images. For the original face sample images in the set of original face sample images, it can obtain at least two simulated adversarial perturbations of different shapes by simulating adversarial perturbations generated by at least two gradient-based general adversarial attack methods.

[0078] In practical applications, the server can use stochastic gradients instead of the classification loss gradients calculated by backpropagation, and generate simulated adversarial perturbations of at least two shapes using stochastic gradients.

[0079] Preprocessing includes operations such as image size unification (e.g., unifying to 112×112 pixels), random cropping, random horizontal flipping, center cropping, and normalization. Preprocessing the original face sample images effectively expands the dataset and improves the generalization ability of the face adversarial detection model for real-world images with mirrored or tilted features.

[0080] Step S120: Add simulated adversarial perturbations of various shape types to the original face sample images in the original face sample image set to obtain the simulated adversarial sample image set.

[0081] In practice, the server can add simulated adversarial perturbations of various shapes to the original face sample images in the original face sample image set according to the settings. The original face sample images with simulated adversarial perturbations are used as simulated sample images, and the simulated adversarial sample image set is composed of each simulated sample image.

[0082] Step S130: Generate a target adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set.

[0083] The target adversarial detection training set is used to train the face adversarial detection model.

[0084] Among them, the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial sample.

[0085] In practice, the server can generate a target adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set. The face adversarial detection model to be trained is trained using the target adversarial detection training set, and a trained face adversarial detection model is generated. Thus, the face adversarial detection model can detect whether the face image to be detected is a face adversarial sample.

[0086] In the aforementioned adversarial example detection method, at least two different types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations for the original face sample image set; wherein, the general adversarial perturbation is an adversarial perturbation generated by at least two gradient-based general adversarial attack methods; the simulated adversarial perturbations of each shape type are added to the original face sample images in the original face sample image set to obtain a simulated adversarial example image set; a target adversarial detection training set is generated based on the simulated adversarial example image set and the original face sample image set; the target adversarial detection training set is used to train a face adversarial detection model; the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial example.

[0087] Thus, although various gradient-based general adversarial attack methods can generate various general adversarial perturbations, these perturbations have fixed patterns and general shapes. By simulating these fixed patterns for the original face sample image set, at least two different types of simulated adversarial perturbations can be obtained. These simulated perturbations are then added to the original face sample images to create a simulated adversarial sample image set. This simulated adversarial sample image set can cover various general adversarial perturbations. Therefore, it is possible to train a face adversarial detection model using only the original face sample image set and the simulated adversarial sample image set, without using real face adversarial samples obtained from perturbations generated by general gradient-based adversarial attack methods. This results in a face adversarial detection model that can detect face adversarial samples against various general gradient-based adversarial attack methods, rather than just against a specific adversarial attack method. This effectively improves the performance and generalization ability of the face adversarial detection model, enabling it to detect face adversarial samples against various adversarial attacks and thus improving the accuracy of face adversarial sample detection.

[0088] In one embodiment, for an original set of face sample images, at least two different types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations, including: taking a preset number of original face sample images as first original sample images, and taking images other than the first original sample images from the original face sample image set as second original sample images; obtaining a first type of simulated adversarial perturbation by simulating general adversarial perturbations for the first original sample images; obtaining a second type of simulated adversarial perturbation by simulating general adversarial perturbations for the second original sample images; and determining at least two different types of simulated adversarial perturbations based on the first type of simulated adversarial perturbation and the second type of simulated adversarial perturbation.

[0089] In the specific implementation, when the server obtains at least two different types of simulated adversarial perturbations by simulating general adversarial perturbations for the original face sample image set, the server can use a preset number of original face sample images as the first original sample images, and use the images in the original face sample image set other than the first original sample images as the second original sample images.

[0090] In practical applications, the server can use 50% of the original face sample images as the first original sample image and the remaining 50% as the second original sample image. Alternatively, other ratios can be used to divide the original face sample images into the first and second original sample images; no specific limitation is made here.

[0091] Then, for the first original sample image, the server can simulate a general adversarial perturbation, replacing the classification loss gradient calculated by backpropagation with a stochastic gradient, and obtain a simulated adversarial perturbation of the first shape by calculating the stochastic gradient. Simultaneously, for the second original sample image, the server can simulate a general adversarial perturbation, replacing the classification loss gradient calculated by backpropagation with a stochastic gradient, and obtain a simulated adversarial perturbation of the second shape by calculating the stochastic gradient.

[0092] Thus, the server can determine at least two different types of simulated adversarial perturbations based on the simulated adversarial perturbations of the first and second shape types.

[0093] The technical solution of this embodiment uses a preset number of original face sample images as first original sample images, and images other than the first original sample images in the original face sample image set as second original sample images. For the first original sample images, a first-shape simulated adversarial perturbation is obtained by simulating a general adversarial perturbation; for the second original sample images, a second-shape simulated adversarial perturbation is obtained by simulating a general adversarial perturbation; based on the first-shape simulated adversarial perturbation and the second-shape simulated adversarial perturbation, at least two different shape types of simulated adversarial perturbations are determined. Thus, the original face sample image set is divided into first and second original sample images. For the first and second original sample images, a fixed pattern of general adversarial perturbation is simulated to generate two shape types of simulated adversarial perturbations. By adding the corresponding simulated adversarial perturbations to the corresponding original face sample images, simulated sample images corresponding to the two simulated adversarial perturbations can be obtained. This allows the simulated adversarial sample image set obtained based on the simulated sample images corresponding to the two simulated adversarial perturbations to cover multiple general adversarial perturbations, improving the performance and generalization ability of the face adversarial detection model, and accurately identifying face adversarial samples.

[0094] In one embodiment, for a first original sample image, a simulated adversarial perturbation of a first shape type is obtained by simulating a general adversarial perturbation, including: obtaining a first all-zero matrix; the matrix size of the first all-zero matrix is ​​matched with the image size of the first original sample image; for each pixel in the first original sample image, a random perturbation value is added at each pixel position corresponding to the pixel position in the first all-zero matrix to obtain a first target matrix; the first target matrix is ​​used as a point-like simulated adversarial perturbation to obtain a simulated adversarial perturbation of the first shape type.

[0095] In specific implementation, during the process of simulating general adversarial perturbations to obtain simulated adversarial perturbations of the first shape type for the first original sample image, since various general adversarial perturbations have fixed patterns, one of which corresponds to a point-shaped adversarial perturbation, the server can obtain a preset all-zero matrix as the first all-zero matrix in order to simulate the general adversarial perturbation with a point-shaped shape. The matrix size of the first all-zero matrix matches the image size of the first original sample image. In practical applications, the matrix size of the first all-zero matrix can be equal to the image matrix size corresponding to the first original sample image. It should be noted that the image sizes of all original face sample images in the original face sample image set are the same, that is, the image sizes of the first original sample image and the second original sample image are the same.

[0096] Then, the server can add random perturbation values ​​at the corresponding pixel positions in the first all-zero matrix for each pixel in the first original sample image, to obtain the first target matrix; then, the first target matrix is ​​used as a point-like simulated adversarial perturbation to obtain a simulated adversarial perturbation of the first shape type. The aforementioned random perturbation values ​​can be single-step perturbation values.

[0097] In practical applications, for the original set of human face sample images S normal Original face sample image X with width, height, and number of color channels W, H, C. real When the original face sample image X real When using the first original sample image, the server employs the first all-zero matrix M. point The server records point-based simulated adversarial perturbations. To fully simulate adding point-based adversarial perturbations to each pixel in the first original sample image, the server can iterate through X... real The pixel positions corresponding to all pixels in the first all-zero matrix, for X real The pixel at [h,w] corresponds to the pixel position in the first all-zero matrix. The perturbation required at this pixel position is calculated using the stochastic gradient value rs and the single-step perturbation magnitude α, i.e., M. point [h,w]=M point [h,w]+α×rs. Where rs is a random number with a value of 1 or -1, and α is the single-step perturbation amplitude set by the algorithm, which defaults to 1, but can be adjusted according to the actual situation.

[0098] Thus, the single-step perturbation calculation process is repeated until all pixels in the first original sample image have had their corresponding pixel positions in the first all-zero matrix traversed. After traversing the pixels, a point-like simulated adversarial perturbation M is obtained. point ', as the first type of simulated adversarial perturbation.

[0099] In this embodiment, since various general adversarial perturbations have fixed patterns, one of which corresponds to a point-like adversarial perturbation shape, a first all-zero matrix is ​​obtained. The size of the first all-zero matrix matches the image size of the first original sample image. For each pixel in the first original sample image, a random perturbation value is added at the pixel position corresponding to the first all-zero matrix to obtain a first target matrix. The first target matrix is ​​used as a point-like simulated adversarial perturbation to obtain a simulated adversarial perturbation of the first shape type. In this way, a point-like adversarial perturbation can be generated for each pixel in the first original sample image, resulting in a first target matrix whose matrix size matches the image size of the first original sample image, forming a point-like simulated adversarial perturbation corresponding to the first original sample image. This can fully simulate the general adversarial perturbation with a point-like shape.

[0100] In one embodiment, for a second original sample image, a simulated adversarial perturbation of a second shape type is obtained by simulating a general adversarial perturbation, including: obtaining a second all-zero matrix; the matrix size of the second all-zero matrix is ​​matched with the image size of the second original sample image; traversing the mask region corresponding to each pixel in the second original sample image in the second all-zero matrix, and adding random perturbation values ​​to each mask region to obtain a second target matrix; the mask region is a pixel region with a preset size and containing corresponding pixels; and using the second target matrix as a block-shaped simulated adversarial perturbation to obtain a simulated adversarial perturbation of the second shape type.

[0101] In the specific implementation, when the server obtains the simulated adversarial perturbation of the second shape type by simulating general adversarial perturbation for the second original sample image, since there are fixed patterns for various general adversarial perturbations, and the adversarial perturbation shape corresponding to another fixed pattern is blocky, in order to simulate the general adversarial perturbation with the corresponding adversarial perturbation shape being blocky, the server can obtain a preset all-zero matrix as the second all-zero matrix. The matrix size of the second all-zero matrix matches the image size of the second original sample image.

[0102] Then, the server can, for the second original sample image, traverse the mask region corresponding to each pixel in the second all-zero matrix, adding random perturbation values ​​to each mask region to obtain the second target matrix. The mask region is a pixel region of a preset size containing the corresponding pixels; that is, the mask region corresponding to each pixel overlaps with the mask regions corresponding to adjacent pixels. The random perturbation values ​​can be single-step perturbation values.

[0103] Specifically, when the original face sample image X realWhen using the second original sample image, the server employs a second all-zero matrix M. block This process records block-shaped simulated adversarial perturbations. To fully simulate adding block-shaped adversarial perturbations to each pixel in the second original sample image, the server iterates through X during this stage. real The mask regions corresponding to all pixels in the second all-zero matrix are calculated. For the mask region corresponding to the pixel at [h, w], a preset mask region length sl can be used as the preset size to calculate the x and y coordinates of the top-left and bottom-right corners of the mask region corresponding to that pixel. The specific calculation process is as follows:

[0104] The top-left corner coordinate is top = max(h-sl, 0);

[0105] The x-coordinate of the top-left corner point is lef = max(w-sl, 0);

[0106] The x-coordinate of the bottom right corner point is rig = min(w + sl, 0);

[0107] The ordinate of the bottom right corner point is bot = min(h + sl, 0).

[0108] The mask region [top:bot,lef:rig] can be calculated. The mask region corresponding to a pixel contains the area of ​​that pixel's pixel region; that is, the area of ​​the mask region corresponding to the pixel at [h,w] is larger than the area of ​​that pixel's pixel region. For the mask region corresponding to the pixel at [h,w], the perturbation that needs to be added to this mask region is calculated using a new stochastic gradient value rs and a new single-step perturbation amplitude α. M block [top:bot,lef:rig]=M block [top:bot,lef:rig]+α×rs.

[0109] Thus, the single-step perturbation calculation process is repeated until all pixels in the second original sample image have been traversed in the mask region corresponding to the second all-zero matrix. After traversing the mask regions corresponding to the pixels, a block-shaped simulated adversarial perturbation M is obtained. block ', as a simulated adversarial perturbation of the second shape type.

[0110] For the ease of understanding of those skilled in the art, Figure 2 A schematic diagram is provided for generating dot-shaped and block-shaped simulated adversarial perturbations for original face sample images.

[0111] In this embodiment, since various general adversarial perturbations have fixed patterns, and another fixed pattern corresponds to a block-shaped adversarial perturbation, a second all-zero matrix is ​​obtained. The matrix size of the second all-zero matrix matches the image size of the second original sample image. Each pixel in the second original sample image is traversed through the mask region corresponding to the second all-zero matrix, and random perturbation values ​​are added to each mask region to obtain a second target matrix. The mask region is a pixel region with a preset size and containing corresponding pixels. The second target matrix is ​​used as a block-shaped simulated adversarial perturbation to obtain a simulated adversarial perturbation of the second shape type. In this way, a block-shaped adversarial perturbation can be generated for each pixel in the second original sample image, resulting in a second target matrix whose matrix size matches the image size of the second original sample image, forming a block-shaped simulated adversarial perturbation corresponding to the second original sample image. This can fully simulate the general adversarial perturbation whose corresponding adversarial perturbation shape is block-shaped.

[0112] In one embodiment, adding simulated adversarial perturbations of various shape types to the original face sample images in the original face sample image set to obtain a simulated adversarial sample image set includes: adding simulated adversarial perturbations of a first shape type to a first original sample image to obtain a first simulated sample image; adding simulated adversarial perturbations of a second shape type to a second original sample image to obtain a second simulated sample image; and determining the simulated adversarial sample image set based on the first simulated sample image and the second simulated sample image.

[0113] In the specific implementation, during the process of adding simulated adversarial perturbations of various shapes to the original face sample images in the original face sample image set to obtain the simulated adversarial sample image set, the server can add the simulated adversarial perturbation of the first shape type to the first original sample image to obtain the first simulated sample image, and add the simulated adversarial perturbation of the second shape type to the second original sample image to obtain the second simulated sample image according to the preset addition method.

[0114] Specifically, when the simulated adversarial perturbation of the first shape type is a point-like simulated adversarial perturbation and the simulated adversarial perturbation of the second shape type is a block-like simulated adversarial perturbation, the server can obtain two simulated sample images through the following two perturbation addition methods:

[0115] The first simulated sample image with added dotted simulated adversarial perturbations.

[0116] A second simulated sample image with added blocky simulated adversarial perturbations.

[0117] Finally, the pixel values ​​of the two simulated sample images are compressed to the range [0, 255], resulting in a set of dot-matrix simulated face adversarial samples composed of the compressed first simulated sample image. And a blocky set of simulated adversarial examples of faces consisting of compressed second simulated sample images. Based on the set of point-based simulated adversarial face examples Block-based simulated face adversarial example set It can output a set of simulated adversarial sample images. In practical applications, this set of simulated adversarial sample images can also be named the set of simulated adversarial samples of human faces.

[0118] The technical solution of this embodiment obtains a first simulated sample image by adding a simulated adversarial perturbation of a first shape type to a first original sample image; and obtains a second simulated sample image by adding a simulated adversarial perturbation of a second shape type to a second original sample image. Based on the first and second simulated sample images, a set of simulated adversarial sample images is determined. Since the simulated adversarial perturbations of the first and second shapes are obtained by simulating the adversarial perturbation shapes corresponding to fixed patterns of various general adversarial perturbations, the simulated adversarial sample images in the set of simulated adversarial sample images can cover various general adversarial perturbations, thereby improving the generalization ability of the face adversarial detection model and accurately identifying face adversarial samples.

[0119] In one embodiment, generating a target adversarial detection training set based on a set of simulated adversarial sample images and a set of original face sample images includes: obtaining an adversarial detection training set based on the set of simulated adversarial sample images and the set of original face sample images; the adversarial detection training set includes several adversarial detection sample images; locating the classification-sensitive regions of the adversarial detection sample images to obtain the target adversarial detection training set.

[0120] Among them, the classification sensitive region is the region in the adversarial detection sample image whose classification influence weight meets the preset condition, that is, the classification sensitive region is the region in the adversarial detection sample image that has a large influence weight on the model output.

[0121] In practical applications, the adversarial detection training set can be named the face adversarial detection training set.

[0122] In the specific implementation, during the process of generating the target adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set, the server can obtain the adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set. The adversarial detection training set includes several adversarial detection sample images.

[0123] Specifically, the simulated adversarial example image set S adv Compared with the original set of human face sample images Snormal The adversarial detection training set S is obtained by combining the data. train ={S normal ,S adv}

[0124] Then, the server can perform gradient calculations on the adversarial detection sample images to locate regions in the adversarial detection sample images whose classification influence weights meet preset conditions, and use these regions as classification-sensitive regions. By locating the adversarial detection sample images with classification-sensitive regions, the target adversarial detection training set can be obtained.

[0125] The technical solution of this embodiment obtains an adversarial detection training set based on a set of simulated adversarial sample images and a set of original face sample images. The adversarial detection training set includes several adversarial detection sample images. The classification-sensitive regions of the adversarial detection sample images are located to obtain a target adversarial detection training set. In this way, by training the face adversarial detection model to be trained using the target adversarial detection training set, the face adversarial detection model can be guided to focus on the classification-sensitive regions of face adversarial samples, thereby further improving the performance of the face adversarial detection model and enhancing its generalization ability.

[0126] In one embodiment, locating the classification-sensitive region of an adversarial detection sample image to obtain a target adversarial detection training set includes: determining a random probability value corresponding to the adversarial detection sample image; locating the classification-sensitive region of the adversarial detection sample image when the random probability value is greater than a preset probability value threshold to obtain an optimized adversarial detection sample image; and obtaining the target adversarial detection training set based on the optimized adversarial detection sample image.

[0127] The random probability value corresponding to the adversarial detection sample image is a random number between 0 and 1.

[0128] In specific implementation, during the process of locating the classification-sensitive regions of the adversarial detection sample images and obtaining the target adversarial detection training set, the server... train Adversarial detection sample images with width, height, and number of color channels W, H, and C. Calculate the corresponding random probability value. If the random probability value is greater than the preset probability value threshold, locate the classification sensitive region of the adversarial detection sample image. Process the classification sensitive region to obtain the optimized adversarial detection sample image. The optimized adversarial detection sample image is used to form the target adversarial detection training set.

[0129] In practical applications, the random probability threshold can be 0.5 or other values; no specific limitation is made here.

[0130] The technical solution of this embodiment determines the random probability value corresponding to the adversarial detection sample image; when the random probability value is greater than a preset probability value threshold, the classification-sensitive region of the adversarial detection sample image is located to obtain an optimized adversarial detection sample image; based on the optimized adversarial detection sample image, a target adversarial detection training set is obtained. In this way, the proportion of adversarial detection sample images with located classification-sensitive regions in the entire target adversarial detection training set can be increased, thereby improving the attention of the face adversarial detection model obtained using the target adversarial detection training set to classification-sensitive regions. This can improve the performance of the face adversarial detection model while enhancing its generalization ability, thereby improving the detection accuracy for face adversarial examples.

[0131] In one embodiment, locating the classification-sensitive region of an adversarial detection sample image includes: inputting the adversarial detection sample image into a face adversarial detection model to be trained, performing a fake attention map calculation on the adversarial detection sample image to obtain an attention mask map corresponding to the adversarial detection sample image; the attention mask map is used to characterize the classification sensitivity of the face adversarial detection model to each pixel in the adversarial detection sample image; based on the classification sensitivity corresponding to each pixel in the adversarial detection sample image, selecting target pixels in the adversarial detection sample image to obtain the classification-sensitive region of the adversarial detection sample image; the classification sensitivity corresponding to the target pixel is greater than a preset sensitivity threshold.

[0132] In the specific implementation, during the process of locating the classification-sensitive region of the adversarial detection sample image, the server can input the adversarial detection sample image into the face adversarial detection model to be trained, perform fake attention map calculation on the input adversarial detection sample image, and obtain the attention mask map corresponding to the adversarial detection sample image. This attention mask map is used to characterize the classification sensitivity of the face adversarial detection model to each pixel in the adversarial detection sample image.

[0133] In this way, the server can select pixels in the adversarial detection sample image whose classification sensitivity is greater than a preset sensitivity threshold based on the classification sensitivity of each pixel. These pixels are then designated as target pixels. The server can then define the location of the target pixels in the adversarial detection sample image as the classification-sensitive region. The size of the classification-sensitive region is smaller than the size of the adversarial detection sample image.

[0134] In practical applications, the server can obtain a preset number of pixels with the highest classification sensitivity as target pixels.

[0135] The technical solution of this embodiment involves inputting an adversarial detection sample image into a face adversarial detection model to be trained, performing a fake attention map calculation on the adversarial detection sample image, and obtaining an attention mask map corresponding to the adversarial detection sample image. The attention mask map is used to characterize the classification sensitivity of the face adversarial detection model to each pixel in the adversarial detection sample image. In this way, the attention mask map can focus on the regions that have a significant impact on classification after the addition of simulated adversarial perturbations. Thus, based on the classification sensitivity corresponding to each pixel in the adversarial detection sample image, target pixels with classification sensitivity greater than a preset sensitivity threshold are selected in the adversarial detection sample image, obtaining the classification-sensitive region of the adversarial detection sample image. This achieves more accurate localization of the classification-sensitive region of the adversarial detection sample image based on the attention mask map corresponding to the adversarial detection sample image.

[0136] In one embodiment, the process of inputting an adversarial detection sample image into a face adversarial detection model to be trained, and performing a fake attention map calculation on the adversarial detection sample image to obtain an attention mask map corresponding to the adversarial detection sample image includes: inputting the adversarial detection sample image into the face adversarial detection model to be trained to obtain adversarial and non-adversarial probability values ​​corresponding to the adversarial detection sample image; determining the perturbation gradient value corresponding to the adversarial detection sample image based on the difference between the adversarial and non-adversarial probability values; the perturbation gradient value is determined by performing gradient calculation based on the absolute value of the difference; for the perturbation gradient value corresponding to the color channel of each pixel of the adversarial detection sample image, determining the maximum perturbation gradient value as the mask value corresponding to each pixel; and obtaining the attention mask map based on the mask value corresponding to each pixel of the adversarial detection sample image.

[0137] In the specific implementation, the server, in the process of inputting the adversarial detection sample image into the face adversarial detection model to be trained, performs fake attention map calculation on the adversarial detection sample image to obtain the attention mask map corresponding to the adversarial detection sample image, can also obtain the adversarial class probability value and non-adversarial class probability value corresponding to the adversarial detection sample image by inputting the adversarial detection sample image into the face adversarial detection model to be trained.

[0138] Specifically, the server can generate adversarial detection sample images. The input is fed into the face adversarial detection model to calculate the output, which outputs two logits (unnormalized log probabilities) to represent the classification probability of the adversarial detection sample image, representing the adversarial example probability O. fake Probability O compared to normal samples real Among them, the adversarial sample probability O fake As an adversarial probability value, the probability of a normal sample is O. real As a non-adversarial probability value.

[0139] Then, the server can perform a difference operation on the adversarial class probability value and the non-adversarial class probability value corresponding to the adversarial detection sample image, take the absolute value of the difference, and then apply the absolute value of the difference to the adversarial detection sample image. Calculate the gradient to obtain the gradient value. This gradient value is used as the perturbation gradient value.

[0140] Then, the server can take the maximum value of the perturbation gradient value for each color channel to obtain the final attention map mask (i.e., attention mask image). Specifically, each pixel in the adversarial detection sample image has its own corresponding perturbation gradient value for each of the three color channels. The server can use the largest perturbation gradient value among the three perturbation gradient values ​​for each pixel as the mask value for that pixel. Then, the server can obtain the attention mask image for the adversarial detection sample image based on the mask value for each pixel. Thus, the value of each pixel in the attention mask image is the gradient value of the corresponding pixel with respect to the classification result, used to characterize the classification sensitivity of the corresponding pixel in the adversarial detection sample image.

[0141] In practical applications, the formula for calculating the attention mask is as follows:

[0142]

[0143] The technical solution of this embodiment involves inputting adversarial detection sample images into a face adversarial detection model to be trained, obtaining adversarial and non-adversarial probability values ​​corresponding to the adversarial detection sample images; determining the perturbation gradient value corresponding to the adversarial detection sample images based on the difference between the adversarial and non-adversarial probability values; the perturbation gradient value is determined by performing gradient calculations based on the absolute value of the difference; for the perturbation gradient value corresponding to the color channel of each pixel in the adversarial detection sample images, the maximum perturbation gradient value is determined and used as the mask value corresponding to each pixel; and an attention mask map is obtained based on the mask value corresponding to each pixel in the adversarial detection sample images. Thus, based on the adversarial and non-adversarial probability values ​​corresponding to the adversarial detection sample images, the maximum gradient value of each pixel in the adversarial detection sample images with respect to the classification result can be determined. By using the maximum gradient value corresponding to each pixel in the adversarial detection sample images, the corresponding attention mask map can be obtained, so that the pixel values ​​in the attention mask map can represent the classification sensitivity of the corresponding pixel in the adversarial detection sample images.

[0144] In one embodiment, obtaining the optimized adversarial detection sample image includes: determining the area to be covered in the adversarial detection sample image corresponding to the classification sensitive region based on the position of the classification sensitive region in the adversarial detection sample image; the area to be covered is determined by expanding the classification sensitive region according to a random starting position and a random size; covering the area to be covered using a random number matrix to obtain the adversarial detection sample image after suspicious forgery removal; the matrix size of the random number matrix matches the region size of the area to be covered; and using the adversarial detection sample image after suspicious forgery removal as the optimized adversarial detection sample image.

[0145] The random starting point position includes the random height starting point position and the random width starting point position; the random size includes the random height and the random width.

[0146] Specifically, for any category-sensitive region corresponding to the region to be covered, the size of the corresponding random number matrix can be equal to the size of the region to be covered.

[0147] In practice, when the server obtains the optimized adversarial detection sample image, it can determine the area to be covered in the adversarial detection sample image based on the location of the classification sensitive region in the image.

[0148] Specifically, the server can expand the classification-sensitive region based on random height and width for the region size, as well as random height and width starting positions for the location of the classification-sensitive region, to obtain the corresponding area to be covered in the adversarial detection sample image.

[0149] In practical applications, for classification-sensitive regions (x) i ,y i The server calculates the coordinates of the top-left and bottom-right corners of the area to be covered using random height maskh, random width maskw, random height start point sh, and random width start point sw, as follows:

[0150] The top-left corner point's y-coordinate is top(x) i -sh,0);

[0151] The ordinate of the bottom right corner point is bot = min(x i +(maskh-sh),H);

[0152] The x-coordinate of the top-left corner point is lef = max(y i -sw,0);

[0153] The x-coordinate of the bottom right corner point is rig = min(y i+(maskw-sw),W).

[0154] Classification sensitive region (x) i ,y i The corresponding area to be covered is

[0155] Then, the region to be covered is covered by a random number matrix whose size matches the region size of the region to be covered in the adversarial detection sample image, thus obtaining the adversarial detection sample image after suspicious forgery removal.

[0156] Specifically, targeting classification-sensitive regions (x) i ,y i The corresponding area to be covered The server can use a random number matrix M specified by random numbers. random ,right Perform coverage to eliminate suspicious forgeries. When the number of pixels undergoing suspicious forgery removal reaches a preset number, the forgery removal operation is stopped, and an adversarial detection sample image with classified sensitive region masks is obtained. The above adversarial detection sample images This refers to the adversarial detection sample image after suspicious forgery removal. The server can use the adversarial detection sample image after suspicious forgery removal as the optimized adversarial detection sample image.

[0157] The technical solution of this embodiment determines the area to be covered in the adversarial detection sample image based on the position of the classification-sensitive region in the image. The area to be covered is determined by expanding the classification-sensitive region according to a random starting point and a random size. A random number matrix is ​​used to cover the area to be covered to obtain an adversarial detection sample image after suspicious forgery removal. The matrix size of the random number matrix matches the size of the area to be covered. The adversarial detection sample image after suspicious forgery removal is used as the optimized adversarial detection sample image. Thus, by performing random number masking on the classification-sensitive region in the adversarial detection sample image to remove suspicious forgery, an optimized adversarial detection sample image can be obtained. This optimized adversarial detection sample image is a data-enhanced adversarial detection sample image. Therefore, by training the model using the data-enhanced adversarial detection sample image, the face adversarial detection model can be guided to focus on the classification-sensitive region, improving the performance of the face adversarial detection model while enhancing its generalization ability.

[0158] In another embodiment, such as Figure 3 As shown, an adversarial example detection method is provided, including the following steps:

[0159] Step S302: Use a preset number of original face sample images as the first original sample images, and use the images in the original face sample image set other than the first original sample images as the second original sample images.

[0160] Step S304: For the first original sample image, point-like simulated adversarial perturbations are obtained by simulating general adversarial perturbations.

[0161] Step S306: For the second original sample image, block-shaped simulated adversarial perturbation is obtained by simulating general adversarial perturbation.

[0162] Step S308: Add simulated adversarial perturbations of various shapes to the original face sample images in the original face sample image set to obtain the simulated adversarial sample image set.

[0163] Step S310: Obtain the adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set.

[0164] Step S312: By inputting the adversarial detection sample image into the face adversarial detection model to be trained, a fake attention map is calculated on the adversarial detection sample image to obtain the attention mask map corresponding to the adversarial detection sample image.

[0165] Step S314: Based on the classification sensitivity of each pixel in the adversarial detection sample image, target pixels are selected in the adversarial detection sample image to obtain the classification sensitive region of the adversarial detection sample image.

[0166] Step S316: Cover the classification-sensitive region with a random number matrix to obtain the adversarial detection sample image after suspicious forgery removal.

[0167] Step S318: Use the adversarial detection sample image after suspicious forgery removal as the optimized adversarial detection sample image to obtain the target adversarial detection training set.

[0168] It should be noted that the specific limitations of the above steps can be found in the specific limitations of an adversarial example detection method described above.

[0169] In some embodiments, the backbone network of the face adversarial detection model is InceptionNet, used for adversarial feature extraction and classification. Similar to other adversarial detection settings, this application uses binary classification (adversarial face examples, normal face examples) as the model output. The face adversarial detection model is trained using a target adversarial detection training set. Using this set allows the model to be trained without using any real adversarial face examples, while simultaneously enabling the model to efficiently and accurately detect real adversarial face examples. During model training, the Adam optimizer and cross-entropy loss can be used, with a fixed learning rate of 0.0002 and a training data batch size of 64. Specific parameters can also be adjusted according to actual needs and are not specifically limited here.

[0170] For the face adversarial detection test set S test Sample images in After the model extracts features, the output is processed by the softmax function to generate a prediction vector similar to [0.7, 0.3]. If the element with index 0 is greater than the element with index 1, the predicted label is 0, representing a normal face sample; otherwise, the predicted label is 1, representing an adversarial face sample.

[0171] After training the adversarial face detection model, the face image to be detected can be input into the model to obtain the detection result, thus determining whether the face image is an adversarial sample. Specifically, the face image to be detected can be preprocessed before input. Preprocessing of the face image to be detected can include operations such as size unification, center cropping, and normalization, without the need for random cropping and random horizontal flipping operations.

[0172] The technical solution of this application does not require pre-constructing a face adversarial sample dataset for training a face adversarial detection model against a specific general adversarial attack method. The generation process of the simulated adversarial sample image set used for training is integrated into the training of the face adversarial detection model. Furthermore, the technical solution proposed in this application does not require access to a protected face recognition system to obtain face feature vectors during adversarial detection, and the network structure of the face adversarial detection model used in this application is simple and free of redundancy.

[0173] For the ease of understanding of those skilled in the art, Figure 4 A general framework diagram of an adversarial example detection method is provided. For example... Figure 4As shown, the above method can be divided into three stages: a general adversarial perturbation simulation stage, which is used to obtain point-like and block-like simulated adversarial perturbations; a classification sensitive region masking stage, which is used to calculate and locate the classification sensitive region of the adversarial detection sample image by forging attention maps and to use a random number matrix to eliminate suspicious forgeries; and an adversarial detection stage, which detects the input face image based on the backbone network of the trained face adversarial detection model and determines whether the input face image is a normal face sample or a face adversarial sample.

[0174] In some embodiments, to demonstrate the advantages of the adversarial example detection method based on simulated general adversarial perturbation simulation in terms of both performance and adaptability, this application verifies and analyzes the following experiments:

[0175] A. Experimental Dataset

[0176] Training Set: Two datasets were used for normal face samples: LFW, VGGFACE, and VGGFACE2. LFW contains over 13,000 collected face images from the internet. VGGFACE consists of 2,622 face classes. Each face class has a text file containing an image URL (uniform resource locator) and the corresponding face detection result. VGGFACE2 contains 3.31 million images with 9,131 identities. The images were downloaded from Google Image Search. Adversarial examples were generated using a set of simulated adversarial example images that underwent general adversarial perturbation simulation and classification-sensitive region masking.

[0177] Test set: Real adversarial face samples generated using eight gradient-based adversarial attack methods (FGSM, BIM, PGD, RFGSM, MIFGSM, TIFGSM, DIFGSM, TIPIM) and normal face samples from LFW, VGGFACE, and VGGFACE2 were used for testing.

[0178] B. Evaluation Criteria

[0179] This application adopts the mainstream evaluation standards for face recognition research both domestically and internationally. For the face adversarial example detection test, the accuracy and ROC curve are used.

[0180] The accuracy (accuracy) of adversarial face detection is evaluated using the area under the receiver operating characteristic curve (AUC). Assuming the test set contains N images, and M images are incorrectly identified, then the accuracy (accc) of adversarial face detection is:

[0181]

[0182] For ROC curves, each point on the ROC curve reflects the sensitivity to the same signal stimulus. The horizontal axis of the ROC curve represents the positive-negative class probability (FPR), and the vertical axis represents the true positive class probability (TPR). For binary classification problems:

[0183] If a sample is a positive class and is predicted to be a positive class, it is called the True Class (TP).

[0184] If a sample is a positive class but is predicted as a negative class, it is called a false negative (FN).

[0185] If a sample is a negative class but is predicted as a positive class, it is called the true positive class (FP).

[0186] If a sample is a negative class and is predicted to be a negative class, it is called the True Negative Class (TN).

[0187] The True Rate of Class Movement (TPR) and the Positive and Negative Rate of Class Movement (FPR) can be calculated using the following formulas:

[0188]

[0189]

[0190] The area under the ROC curve (AUC) is frequently used in academia and industry as an evaluation criterion for classifiers. AUC can be obtained by summing the areas under the ROC curve.

[0191] C. Experimental Results

[0192] Experiments show that the proposed method (GAPS) achieves detection accuracy exceeding 94% on LFW and VGGFACE for real adversarial face samples generated by various gradient-based general adversarial attack methods, with an AUC exceeding 0.99. Compared to models trained using real adversarial face samples generated by the FGSM algorithm (FGSM column in Tables 1 and 2), the proposed method significantly improves the detection performance for five types of real adversarial face samples: BIM, RFGSM, TIFGSM, DIFGSM, and TIPIM. Furthermore, on VGGFACE2, the proposed method achieves an AUC exceeding 0.99 for various real adversarial face samples. The proposed method achieves a leading level compared to existing adversarial face detection methods on all three datasets. Experimental results are shown in the following table:

[0193] Table 1. LFW Face Adversarial Detection Performance (Accuracy ACC, AUC)

[0194]

[0195] Table 2. LFW Face Adversarial Detection Performance (Accuracy ACC, AUC)

[0196]

[0197] Table 3. VGGFACE Face Adversarial Detection Performance (Accuracy ACC, Positive and Negative Class Rate FPR)

[0198]

[0199] Table 4. VGGFACE2 Face Adversarial Detection Performance (AUC)

[0200]

[0201] As can be seen from Tables 3 and 4, under the same experimental conditions, the method in this application shows superior performance compared with the current advanced algorithms AmI and Massli's Methods.

[0202] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0203] Based on the same inventive concept, this application also provides an adversarial sample detection device for implementing the adversarial sample detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more adversarial sample detection device embodiments provided below can be found in the limitations of the adversarial sample detection method described above, and will not be repeated here.

[0204] In one embodiment, such as Figure 5 As shown, an adversarial example detection device is provided, comprising: a simulation module 510, an addition module 520, and a generation module 530, wherein:

[0205] The simulation module 510 is used to obtain at least two different types of simulated adversarial perturbations by simulating general adversarial perturbations for the original set of face sample images; the general adversarial perturbations are adversarial perturbations generated by at least two gradient-based general adversarial attack methods.

[0206] Adding module 520 is used to add simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set, thereby obtaining a simulated adversarial sample image set.

[0207] The generation module 530 is used to generate a target adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set; the target adversarial detection training set is used to train a face adversarial detection model; the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial sample.

[0208] In one embodiment, the simulation module 510 is specifically configured to take a preset number of the original face sample images as first original sample images, and take images other than the first original sample images from the set of original face sample images as second original sample images; for the first original sample images, simulate the general adversarial perturbation to obtain a first shape type of simulated adversarial perturbation; for the second original sample images, simulate the general adversarial perturbation to obtain a second shape type of simulated adversarial perturbation; and determine the at least two different shape types of simulated adversarial perturbations based on the first shape type of simulated adversarial perturbation and the second shape type of simulated adversarial perturbation.

[0209] In one embodiment, the simulation module 510 is specifically used to obtain a first all-zero matrix; the matrix size of the first all-zero matrix matches the image size of the first original sample image; for each pixel in the first original sample image corresponding to the pixel position in the first all-zero matrix, a random perturbation value is added at each pixel position to obtain a first target matrix; the first target matrix is ​​used as a point-like simulated adversarial perturbation to obtain a simulated adversarial perturbation of the first shape type.

[0210] In one embodiment, the simulation module 510 is specifically used to obtain a second all-zero matrix; the matrix size of the second all-zero matrix matches the image size of the second original sample image; traverse the mask region corresponding to each pixel in the second original sample image in the second all-zero matrix, and add random perturbation values ​​to each of the mask regions to obtain a second target matrix; the mask region is a pixel region with a preset size and containing the corresponding pixel; the second target matrix is ​​used as a block-shaped simulated adversarial perturbation to obtain the simulated adversarial perturbation of the second shape type.

[0211] In one embodiment, the adding module 520 is specifically used to add the simulated adversarial perturbation of the first shape type to the first original sample image to obtain a first simulated sample image; add the simulated adversarial perturbation of the second shape type to the second original sample image to obtain a second simulated sample image; and determine the simulated adversarial sample image set based on the first simulated sample image and the second simulated sample image.

[0212] In one embodiment, the generation module 530 is specifically used to obtain an adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set; the adversarial detection training set includes several adversarial detection sample images; locate the classification sensitive region of the adversarial detection sample image to obtain the target adversarial detection training set; the classification sensitive region is the region in the adversarial detection sample image whose classification influence weight meets a preset condition.

[0213] In one embodiment, the generation module 530 is specifically used to determine the random probability value corresponding to the adversarial detection sample image; when the random probability value is greater than a preset probability value threshold, locate the classification sensitive region of the adversarial detection sample image to obtain an optimized adversarial detection sample image; and obtain the target adversarial detection training set based on the optimized adversarial detection sample image.

[0214] In one embodiment, the generation module 530 is specifically used to input the adversarial detection sample image into the face adversarial detection model to be trained, perform fake attention map calculation on the adversarial detection sample image, and obtain an attention mask map corresponding to the adversarial detection sample image; the attention mask map is used to characterize the classification sensitivity of the face adversarial detection model to each pixel in the adversarial detection sample image; based on the classification sensitivity corresponding to each pixel in the adversarial detection sample image, target pixels are selected in the adversarial detection sample image to obtain the classification sensitive region of the adversarial detection sample image; the classification sensitivity corresponding to the target pixel is greater than a preset sensitivity threshold.

[0215] In one embodiment, the generation module 530 is specifically configured to: input the adversarial detection sample image into the face adversarial detection model to be trained to obtain adversarial and non-adversarial probability values ​​corresponding to the adversarial detection sample image; determine the perturbation gradient value corresponding to the adversarial detection sample image based on the difference between the adversarial probability value and the non-adversarial probability value; the perturbation gradient value is determined by performing gradient calculation based on the absolute value of the difference; for the perturbation gradient value corresponding to the color channel of each pixel of the adversarial detection sample image, determine the maximum perturbation gradient value as the mask value corresponding to each pixel; and obtain the attention mask map based on the mask value corresponding to each pixel of the adversarial detection sample image.

[0216] In one embodiment, the generation module 530 is specifically configured to determine the area to be covered in the adversarial detection sample image corresponding to the classification sensitive region based on the position of the classification sensitive region in the adversarial detection sample image; the area to be covered is determined by expanding the classification sensitive region according to a random starting position and a random size; the area to be covered is covered by a random number matrix to obtain an adversarial detection sample image after suspicious forgery removal; the matrix size of the random number matrix matches the region size of the area to be covered; and the adversarial detection sample image after suspicious forgery removal is used as the optimized adversarial detection sample image.

[0217] The modules in the aforementioned adversarial example detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0218] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores raw facial sample image sets. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements an adversarial example detection method.

[0219] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0220] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0221] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0222] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0223] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0224] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0225] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0226] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting adversarial examples, characterized in that, The method includes: For the original set of human face sample images, at least two different types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations; the general adversarial perturbations are generated by at least two gradient-based general adversarial attack methods. Add simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set to obtain a simulated adversarial sample image set; Based on the simulated adversarial sample image set and the original face sample image set, a target adversarial detection training set is generated; the target adversarial detection training set is used to train a face adversarial detection model; the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial sample. The step of generating a target adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set includes: An adversarial detection training set is obtained based on the simulated adversarial sample image set and the original face sample image set; the adversarial detection training set includes several adversarial detection sample images; Locate the classification-sensitive region of the adversarial detection sample image to obtain the target adversarial detection training set; the classification-sensitive region is the region in the adversarial detection sample image whose classification influence weights meet preset conditions.

2. The method according to claim 1, characterized in that, For the original set of face sample images, at least two different types of simulated adversarial perturbations are obtained by simulating general adversarial perturbations, including: A predetermined number of the original face sample images are used as the first original sample images, and the images in the original face sample image set other than the first original sample images are used as the second original sample images. For the first original sample image, a simulated adversarial perturbation of the first shape type is obtained by simulating the general adversarial perturbation; For the second original sample image, a simulated adversarial perturbation of the second shape type is obtained by simulating the general adversarial perturbation; The simulated adversarial perturbations of the at least two different shape types are determined based on the simulated adversarial perturbations of the first shape type and the simulated adversarial perturbations of the second shape type.

3. The method according to claim 2, characterized in that, The step of obtaining a simulated adversarial perturbation of a first shape type for the first original sample image by simulating the general adversarial perturbation includes: Obtain a first all-zero matrix; the size of the first all-zero matrix matches the image size of the first original sample image; For each pixel in the first original sample image, a random perturbation value is added to the corresponding pixel position in the first all-zero matrix to obtain the first target matrix. The first target matrix is ​​used as a point-like simulated adversarial perturbation to obtain the simulated adversarial perturbation of the first shape type.

4. The method according to claim 2, characterized in that, The step of obtaining a simulated adversarial perturbation of a second shape type for the second original sample image by simulating the general adversarial perturbation includes: Obtain the second all-zero matrix; the size of the second all-zero matrix matches the image size of the second original sample image; Traverse the mask region corresponding to each pixel in the second original sample image in the second all-zero matrix, and add random perturbation values ​​to each mask region to obtain the second target matrix; the mask region is a pixel region with a preset size and containing the corresponding pixel. The second target matrix is ​​used as a block-shaped simulated adversarial perturbation to obtain the simulated adversarial perturbation of the second shape type.

5. The method according to claim 2, characterized in that, The addition of simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set yields a simulated adversarial sample image set, including: The simulated adversarial perturbation of the first shape type is added to the first original sample image to obtain the first simulated sample image; The simulated adversarial perturbation of the second shape type is added to the second original sample image to obtain the second simulated sample image; The set of simulated adversarial sample images is determined based on the first simulated sample image and the second simulated sample image.

6. The method according to claim 1, characterized in that, The process of locating the classification-sensitive region of the adversarial detection sample image to obtain the target adversarial detection training set includes: Determine the random probability value corresponding to the adversarial detection sample image; When the random probability value is greater than a preset probability value threshold, the classification sensitive region of the adversarial detection sample image is located to obtain an optimized adversarial detection sample image. The target adversarial detection training set is obtained based on the optimized adversarial detection sample images.

7. The method according to claim 6, characterized in that, Locating the classification-sensitive region of the adversarial detection sample image includes: By inputting the adversarial detection sample image into the face adversarial detection model to be trained, a fake attention map is calculated on the adversarial detection sample image to obtain the attention mask map corresponding to the adversarial detection sample image; the attention mask map is used to characterize the classification sensitivity of the face adversarial detection model to each pixel in the adversarial detection sample image; Based on the classification sensitivity corresponding to each pixel in the adversarial detection sample image, target pixels are selected from the adversarial detection sample image to obtain the classification sensitive region of the adversarial detection sample image; the classification sensitivity corresponding to the target pixel is greater than a preset sensitivity threshold.

8. The method according to claim 7, characterized in that, The step of inputting the adversarial detection sample image into the face adversarial detection model to be trained, and calculating the forgery attention map on the adversarial detection sample image to obtain the attention mask map corresponding to the adversarial detection sample image includes: By inputting the adversarial detection sample image into the face adversarial detection model to be trained, the adversarial class probability value and the non-adversarial class probability value corresponding to the adversarial detection sample image are obtained; The perturbation gradient value corresponding to the adversarial detection sample image is determined based on the difference between the adversarial probability value and the non-adversarial probability value; the perturbation gradient value is determined by performing gradient calculation based on the absolute value of the difference. For each pixel in the adversarial detection sample image, the maximum perturbation gradient value is determined and used as the mask value for each pixel. The attention mask map is obtained based on the mask value corresponding to each pixel of the adversarial detection sample image.

9. The method according to claim 7, characterized in that, The optimized adversarial detection sample image includes: Based on the location of the classification-sensitive region in the adversarial detection sample image, the corresponding area to be covered in the adversarial detection sample image is determined; the area to be covered is obtained by expanding the classification-sensitive region according to a random starting point position and a random size. The region to be covered is covered by a random number matrix to obtain an adversarial detection sample image after suspicious forgery removal; the size of the random number matrix is ​​matched with the size of the region to be covered. The adversarial detection sample image after the suspicious forgery has been removed is used as the optimized adversarial detection sample image.

10. An adversarial sample detection device, characterized in that, The device includes: The simulation module is used to obtain at least two different types of simulated adversarial perturbations by simulating general adversarial perturbations for the original set of face sample images; the general adversarial perturbations are adversarial perturbations generated by at least two gradient-based general adversarial attack methods; An add module is used to add simulated adversarial perturbations of each of the aforementioned shape types to the original face sample images in the original face sample image set, thereby obtaining a simulated adversarial sample image set; The generation module is used to generate a target adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set; the target adversarial detection training set is used to train a face adversarial detection model; the face adversarial detection model is used to detect whether the face image to be detected is a face adversarial sample; The generation module is specifically used to obtain an adversarial detection training set based on the simulated adversarial sample image set and the original face sample image set; the adversarial detection training set includes several adversarial detection sample images; locate the classification sensitive region of the adversarial detection sample image to obtain the target adversarial detection training set; the classification sensitive region is the region in the adversarial detection sample image whose classification influence weight meets a preset condition.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

Images