A method and device for generating an adversarial sample image and an electronic device

Abstract

The application provides a method and device for generating an adversarial sample image and an electronic device. The method comprises: generating an initial adversarial sample image of a first target region according to a target mask request; determining an initial recognition classification corresponding to the initial adversarial sample image based on the initial adversarial sample image and a trained target image recognition model; determining an iteration gradient of the initial adversarial sample image based on a difference between the initial recognition classification and a true classification corresponding to the initial adversarial sample image; and determining a target adversarial sample image corresponding to a target sample image based on the iteration gradient and a gradient accumulation algorithm of a preset momentum parameter. The application can dynamically select a target adversarial sample image according to an attack target, thereby enhancing the difficulty of identifying the target adversarial sample image by a target image recognition model, improving the attack resistance of the target image recognition model, and improving the recognition accuracy and robustness of the target image recognition model.

Description

Technical Field

[0001] This application relates to the field of image processing technology, and in particular to a method, apparatus and electronic device for generating adversarial sample images. Background Technology

[0002] Deep learning is a major branch of artificial intelligence. As an algorithm for learning data features, deep learning has achieved great success in fields such as computer vision and natural language processing, which involve behavioral decision-making. Deep learning also has a wide range of applications in life and production, such as facial recognition and autonomous driving. However, with social development, technological progress and the maturity of artificial intelligence technology, deep learning is playing an important role in more and deeper fields.

[0003] However, the emergence of adversarial examples highlights the vulnerability of deep learning models. Adversarial examples are a type of sample that can cause neural networks to produce erroneous outputs. These samples are highly similar to the original samples. In the early days, adversarial examples only appeared in image classification, but with the development of technology, adversarial examples have appeared in various deep learning models. The existence of adversarial examples has also brought the security of deep learning models into widespread concern.

[0004] Adversarial examples in existing technologies have obvious adversarial traces, making them easy for deep learning models to identify. This results in a failure to improve the deep learning model's ability to resist attacks, leading to low recognition accuracy and robustness. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide a method, apparatus and electronic device for generating adversarial sample images, which realizes the ability to dynamically select and generate target adversarial sample images according to the attack target, thereby increasing the difficulty for the target image recognition model to identify the target adversarial sample images, thereby improving the anti-attack capability of the target image recognition model, and further improving the recognition accuracy and robustness of the target image recognition model.

[0006] This application provides a method for generating adversarial sample images, the method comprising:

[0007] According to the target mask request, a mask for the first target region and an initial perturbation amount for the first target region are added to the target sample image to be identified, thereby generating an initial adversarial sample image of the first target region, wherein the target mask request includes the location information of the first target region;

[0008] Based on the initial adversarial sample image and the trained target image recognition model, determine the initial recognition classification corresponding to the initial adversarial sample image;

[0009] Based on the difference between the initial identification classification and the true classification corresponding to the initial adversarial sample image, the iterative gradient of the initial adversarial sample image is determined;

[0010] Based on the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, the target adversarial sample image corresponding to the target sample image is determined, wherein the target adversarial sample image is an adversarial sample image with added momentum balance parameter and target perturbation amount.

[0011] Furthermore, the target sample image to be identified is determined in the following way:

[0012] Obtain the initial sample image to be identified;

[0013] The initial sample image is standardized and cropped within a preset size range to determine the target sample image to be identified.

[0014] Furthermore, before adding a mask to the first target region and an initial perturbation amount to the first target region to generate an initial adversarial sample image of the first target region according to the target mask request, the method for generating the adversarial sample image further includes:

[0015] The target sample image to be identified is input into the trained target image recognition model to determine the target recognition classification corresponding to the target sample image, wherein the target recognition classification is used to determine the mask region of the target sample image;

[0016] Based on the target recognition and classification, locate the first target region of the target sample image;

[0017] Based on the first target region, generate a target mask request.

[0018] Furthermore, the gradient accumulation algorithm based on the iterative gradient and preset momentum parameters, which determines the target adversarial sample image corresponding to the target sample image, includes:

[0019] Based on the gradient accumulation algorithm of iterative gradient and preset momentum parameter, the initial perturbation amount of the first target region is updated at least once to determine the target perturbation amount corresponding to the first target region of the target sample image.

[0020] Based on the target perturbation amount and the target sample image to be identified, the target adversarial sample image corresponding to the target sample image is determined.

[0021] Furthermore, the step of updating the initial perturbation amount of the first target region at least once based on the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, and determining the target perturbation amount corresponding to the first target region of the target sample image, includes:

[0022] Based on the gradient accumulation algorithm of iterative gradient and preset momentum parameter, the initial perturbation amount of the first target region is updated at least once to determine the intermediate update perturbation amount corresponding to the first target region of the target sample image.

[0023] Based on the intermediate update perturbation and the initial adversarial sample image, the intermediate adversarial sample image is determined;

[0024] Based on the intermediate adversarial sample image and the trained target image recognition model, the target iterative gradient of the intermediate adversarial sample image is determined, wherein the target iterative gradient is the iterative gradient of the target loss function of the trained target image recognition model when it converges;

[0025] Based on the gradient accumulation algorithm of the target iterative gradient and the preset momentum parameter, the intermediate update perturbation of the first target region is updated to determine the target perturbation corresponding to the first target region of the target sample image.

[0026] Furthermore, after determining the target adversarial example image corresponding to the target sample image using the gradient accumulation algorithm based on the iterative gradient and the preset momentum parameter, the method for generating the adversarial example image further includes:

[0027] Based on the target perturbation amount, the test sample image, and the mask of the second target region, an adversarial sample image is generated in the second target region, wherein the second target region is a local attack region in the test sample image.

[0028] Furthermore, the trained target image recognition model is determined in the following way:

[0029] Input the training sample images into a preset image recognition model to determine the preset recognition category corresponding to the training sample images;

[0030] Based on the loss value between the preset recognition classification and the label classification corresponding to the training sample image, the trained target image recognition model is determined.

[0031] This application embodiment also provides an apparatus for generating adversarial sample images, the apparatus comprising:

[0032] The second generation module is used to add a mask for the first target region and an initial perturbation amount to the first target region to the target sample image to be identified according to the target mask request, thereby generating an initial adversarial sample image of the first target region, wherein the target mask request includes the location information of the first target region;

[0033] The second determining module is used to determine the initial recognition classification corresponding to the initial adversarial sample image based on the initial adversarial sample image and the trained target image recognition model;

[0034] The third determining module is used to determine the iterative gradient of the initial adversarial sample image based on the difference between the initial identification classification and the true classification corresponding to the initial adversarial sample image;

[0035] The fourth determining module is used to determine the target adversarial sample image corresponding to the target sample image based on the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, wherein the target adversarial sample image is an adversarial sample image with added momentum balance parameter and target perturbation amount.

[0036] This application also provides an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the adversarial sample image generation method described above are performed.

[0037] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the adversarial sample image generation method described above.

[0038] Compared with existing adversarial sample image generation methods, the adversarial sample image generation method, apparatus, electronic device, and storage medium provided in this application embodiment input an initial adversarial sample image generated through target mask request and initial perturbation amount of the first target region into a trained target image recognition model. The initial recognition classification corresponding to the initial adversarial sample image is determined, and a gradient accumulation algorithm based on the iterative gradient between the initial recognition classification and the true classification corresponding to the initial adversarial sample image and preset momentum parameters is used to determine the target adversarial sample image corresponding to the target sample image. This enables the dynamic selection and generation of target adversarial sample images according to the attack target, increasing the difficulty for the target image recognition model to identify the target adversarial sample image, thereby improving the target image recognition model's ability to resist attacks, and ultimately improving the target image recognition model's recognition accuracy and robustness.

[0039] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This document illustrates one of the flowcharts of a method for generating adversarial sample images provided in an embodiment of this application.

[0042] Figure 2 The diagram illustrates the training flowchart of the target image recognition model in a method for generating adversarial sample images provided in an embodiment of this application.

[0043] Figure 3 A flowchart illustrating the use of a standard adversarial sample image in a method for generating adversarial sample images provided in an embodiment of this application is shown.

[0044] Figure 4 The diagram illustrates the training flowchart of the target adversarial sample image in a method for generating adversarial sample images provided in an embodiment of this application.

[0045] Figure 5 The second flowchart of a method for generating adversarial sample images provided in an embodiment of this application is shown.

[0046] Figure 6 This illustration shows one of the structural schematic diagrams of an adversarial sample image generation apparatus provided in an embodiment of this application;

[0047] Figure 7 This is a second schematic diagram of the structure of an adversarial sample image generation device provided in an embodiment of this application;

[0048] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown.

[0049] In the picture:

[0050] 600 - Apparatus for generating adversarial sample images; 610 - First determining module; 620 - Positioning module; 630 - First generating module; 640 - Second generating module; 650 - Second determining module; 660 - Third determining module; 670 - Fourth determining module; 680 - Third generating module; 800 - Electronic device; 810 - Processor; 820 - Memory; 830 - Bus. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0052] First, the applicable scenarios for this application will be introduced. This application can be applied to the field of image processing technology.

[0053] Research has found that adversarial examples in existing technologies have obvious adversarial traces, making them easy for deep learning models to identify. This results in a failure to improve the deep learning models' ability to resist attacks, leading to low recognition accuracy and robustness.

[0054] Based on this, embodiments of this application provide a method, apparatus, and electronic device for generating adversarial sample images, which enables the dynamic selection of target adversarial sample images based on the attack target, thereby increasing the difficulty for the target image recognition model to identify the target adversarial sample images, thereby improving the anti-attack capability of the target image recognition model, and further improving the recognition accuracy and robustness of the target image recognition model.

[0055] Please see Figure 1 , Figure 1 This is one of the flowcharts illustrating a method for generating adversarial sample images provided in an embodiment of this application. Figure 1 As shown in the figure, the method for generating adversarial example images provided in this application includes the following steps:

[0056] S101. According to the target mask request, the target sample image to be identified is masked for the first target region and the initial perturbation amount of the first target region is added to generate the initial adversarial sample image of the first target region, wherein the target mask request includes the location information of the first target region.

[0057] In this step, the target mask request in the embodiments provided in this application can be a custom mask request set by the administrator according to specific needs, or it can be a mask request generated after inputting the training sample image into the preset image recognition model and determining the preset recognition classification corresponding to the training sample image at the location of the feature of the preset recognition classification.

[0058] Here, according to the target mask request, a mask is established for the first target region of the target sample image to be identified. Then, an initial perturbation is randomly added to the first target region after the mask is established, generating an initial adversarial sample image with a mask for the first target region.

[0059] Among them, the initial adversarial sample images have brought the security of target image recognition models into sharp focus. Therefore, improving the robustness of target image recognition models is particularly important, and thus, research on the diversity of adversarial sample images is of paramount importance.

[0060] Optionally, in step S101, the target sample image to be identified is determined through the following sub-steps:

[0061] Sub-step 1: Obtain the initial sample image to be identified.

[0062] In this step, the target sample image in the embodiments provided in this application is the image after normalization of the initial sample image.

[0063] Sub-step 2: Standardize and crop the initial sample image according to the preset size range to determine the target sample image to be identified.

[0064] In this step, after determining the initial sample image to be identified, the initial sample image is normalized. The specific normalization method can be customized and managed according to different application scenarios. In the embodiments provided in this application, the normalization method can be specifically to standardize and crop the initial sample image according to a preset size range to determine the target sample image to be identified.

[0065] In the above, obtaining a consistent size helps to standardize the initial sample images of the input when using different types of target image recognition models.

[0066] Here, the expression for the target sample image in the embodiments provided in this application can be specifically as follows:

[0067]

[0068] Where X represents the initial sample image and adv represents the perturbation amount.

[0069] S102. Based on the initial adversarial sample image and the trained target image recognition model, determine the initial recognition classification corresponding to the initial adversarial sample image.

[0070] In this step, the target image recognition model in the embodiments provided in this application can be specifically, but is not limited to, two typical target detectors, YOLOv3 and FAST-RCNN, as the attack model.

[0071] Here, the target image recognition model (target detector) is one of the core tasks of computer vision. Its main task is to achieve localization based on classification. That is, target detection is to classify and locate the target in the output results. Target detection is also the foundation of deep learning tasks such as image segmentation and target tracking.

[0072] With the rapid development of object detection technology, the application of object image recognition models is becoming increasingly widespread, such as in pedestrian detection, autonomous driving, vehicle detection, and satellite object detection. Deep learning object image recognition models have shown excellent performance on public datasets. However, as deep learning models, they are inevitably susceptible to attacks from adversarial example images. The presence of adversarial example images in object detectors can cause even greater harm. For example, in autonomous driving, attacks targeting road sign detection can cause autonomous vehicles to make dangerous judgments, and attacks targeting vehicle detection may prevent disguised vehicles from being detected. Compared to other image classification models, object image recognition models involve more nodes in terms of network structure, data augmentation, and feature processing. Therefore, the attack difficulty of object image recognition models is greater, and their effectiveness in resisting adversarial example images is worse. Therefore, it is necessary to use the target adversarial example images generated in the embodiments provided in this application to train image recognition models with deep learning networks in order to improve the recognition accuracy of image recognition models.

[0073] Optionally, in step S102, the trained target image recognition model is determined through the following sub-steps:

[0074] Sub-step 1: Input the training sample image into the preset image recognition model to determine the preset recognition category corresponding to the training sample image.

[0075] In this step, the preset recognition classification in the embodiments provided in this application can be a preset predicted classification corresponding to the training sample image.

[0076] Sub-step 2: Based on the loss value between the preset recognition classification and the label classification corresponding to the training sample image, determine the trained target image recognition model.

[0077] In this step, the true classification corresponding to the label of the training sample image is compared with the preset recognition classification to determine the loss value between the true classification and the preset recognition classification. Training ends when the loss value is less than the loss threshold, and the trained target image recognition model is determined.

[0078] Furthermore, the loss value between the actual classification and the preset recognition classification is calculated using the following formula:

[0079]

[0080] Here, C represents the set of all object categories, B represents the set of bounding boxes, and conf represents the confidence in the target image recognition model (YOLOv3). The loss function extracts the confidence of the largest target in the training sample image and minimizes it to achieve the attack purpose. In YOLOv3, when the target confidence is lower than a certain threshold, the target will be identified as background and discarded in the subsequent processing stage.

[0081] Confidence level, also known as reliability, confidence level, or confidence coefficient, refers to the uncertainty of the conclusions drawn when estimating population parameters through sampling due to the randomness of the sample.

[0082] Here, the specific training flowchart for the target image recognition model is as follows: Figure 2 , Figure 2 The diagram illustrates the training flowchart of the target image recognition model in a method for generating adversarial example images provided in this application. Figure 2 As shown:

[0083] First, the training sample images are input into the preset image recognition model. Then, the parameters of the training sample images and the preset image recognition model are combined for calculation, and the functions within the preset image recognition model are activated for processing to determine the preset recognition category corresponding to the training sample images. Then, based on the preset recognition category, the gradient is calculated in a chain, and the model parameters of the preset recognition category are continuously adjusted to finally determine the trained target image recognition model.

[0084] In the above-described embodiments, the present application optimizes and iterates the backpropagation process of a deep learning-based trained target image recognition model, and adds perturbation (satisfying L) to the pixels of the target sample image in the region to be attacked (the first target region or the second target region). ∞ The norm was used to improve the efficiency of the trained target image recognition model.

[0085] S103. Based on the difference between the initial identification classification and the true classification corresponding to the initial adversarial sample image, determine the iterative gradient of the initial adversarial sample image.

[0086] In this step, the loss value corresponding to the initial identification classification is determined based on the difference between the initial identification classification and the true classification corresponding to the initial adversarial sample image, which is the iterative gradient of the initial adversarial sample image.

[0087] Here, the initial adversarial sample image is iterated multiple times. The iteration stops when the loss value between the recognition classification and the true classification corresponding to the initial adversarial sample image begins to converge.

[0088] The specific expression for determining the adversarial example image with the added perturbation at the (N+1)th time is as follows:

[0089]

[0090] so, Π is used to represent adversarial example images trained N+1 times, α is used to represent the step size of each iteration, and Π X+S The term "adv" is used to characterize the projection of the constraint adversarial perturbation onto the range ∈-ball (i.e., an abstract sphere representing the neighborhood of the initial sample image), and "adv" is used to characterize the adversarial sample. This represents an adversarial example that has been trained n times.

[0091] In the above, the core of the process of generating adversarial sample images lies in increasing the error of the target image recognition model, so that the output value shifts from the true value to the error value. Therefore, generating adversarial sample images is also a problem of obtaining the maximum value of the internal optimization. The internal maximization problem can be solved by a first-order method.

[0092] S104. Based on the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, determine the target adversarial sample image corresponding to the target sample image, wherein the target adversarial sample image is an adversarial sample image with added momentum balance parameter and target perturbation amount.

[0093] In the above process, after determining the iterative gradient, a gradient accumulation algorithm with preset momentum parameters is introduced. The target perturbation amount is determined by combining the momentum parameters and the iterative gradient in the gradient accumulation algorithm with preset momentum parameters. Based on the target perturbation amount, the target adversarial sample image corresponding to the target sample image is determined.

[0094] In this step, step S104 includes the following sub-steps:

[0095] Sub-step 1041: Based on the gradient accumulation algorithm of iterative gradient and preset momentum parameters, update the initial perturbation amount of the first target region at least once to determine the target perturbation amount corresponding to the first target region of the target sample image.

[0096] In this step, after determining the iterative gradient of the initial adversarial sample image, the momentum parameter and the iterative gradient in the gradient accumulation algorithm with the preset momentum parameter are superimposed to calculate, so as to update the initial perturbation amount of the first target region at least once and determine the target perturbation amount corresponding to the first target region of the target sample image.

[0097] Here, the purpose of introducing the momentum parameter in the gradient accumulation algorithm with a preset momentum parameter is to improve the attack effect, reduce the average accuracy of the target image recognition model, increase the transferability of the target image recognition model against adversarial perturbations, and improve the attack and hiding capabilities of adversarial sample images against the target image recognition model.

[0098] Optionally, sub-step 1041 includes the following sub-steps:

[0099] Sub-step 10411: Based on the gradient accumulation algorithm of iterative gradient and preset momentum parameters, update the initial perturbation amount of the first target region at least once, and determine the intermediate update perturbation amount corresponding to the first target region of the target sample image.

[0100] In this step, the embodiments provided in this application generate multiple updated intermediate perturbation quantities by continuously updating the initial perturbation quantity.

[0101] Sub-step 10412: Based on the intermediate update perturbation amount and the initial adversarial sample image, determine the intermediate adversarial sample image.

[0102] In this step, the perturbation amount of the synchronously superimposed initial adversarial sample image is increased according to the intermediate update perturbation amount generated in each superposition, and the intermediate adversarial sample image is determined.

[0103] Here, the convergence stability and speed are improved by introducing a momentum parameter, and intermediate adversarial sample images are generated iteratively.

[0104] Sub-step 10413: Based on the intermediate adversarial sample image and the trained target image recognition model, determine the target iterative gradient of the intermediate adversarial sample image, wherein the target iterative gradient is the iterative gradient of the target loss function of the trained target image recognition model at convergence.

[0105] In this step, the specific formula for determining the target iterative gradient is as follows:

[0106]

[0107] here, Used to characterize pairs The gradient is L1 regularized, m N Used to characterize the gradient accumulated over the first n iterations, where N represents the first n iterations. The value is used to characterize the result of training the adversarial example image n times. β is used to characterize the decay factor, and grad is used to obtain the iterative gradient in the first N iterations using the decay factor β.

[0108] Among them, the gradient accumulation algorithm with preset momentum parameters is a method for accumulating gradients, which is used to save and accumulate the momentum parameters of the previous n times.

[0109] In this way, the introduction of a gradient accumulation algorithm with preset momentum parameters can stably update the direction and prevent the first target region from getting trapped in a local optimum.

[0110] In the above, when β = 0, the generation method of the target perturbation will degenerate into the projected gradient descent (PGD) algorithm. This is because the pure projected gradient descent algorithm does not accumulate momentum parameters. The algorithm that accumulates momentum parameters saves the current accumulated momentum and combines it with the projected gradient descent algorithm for calculation and training in the next iteration. However, when β is 0, the accumulation of momentum will disappear, and it becomes a pure projected gradient method.

[0111] Here, the embodiments provided in this application require projecting the adversarial perturbation amount learned in each iteration onto the neighborhood or a specified range of the clean sample, so that the adversarial perturbation is less than ∈. This is because when the adversarial perturbation amount is too large, it will be very obvious on the adversarial sample image. However, when the adversarial perturbation amount of the adversarial sample image is within the neighborhood or a specified range of the clean target sample image, the adversarial perturbation amount will produce a very inconspicuous effect but still play an adversarial role. ∈ is a threshold representing the neighborhood or a specified range of the clean target sample image.

[0112] Here, the embodiments provided in this application use the projection operation of the PGD algorithm to restrict the information of the adversarial perturbation quantity to the common area of ​​the adversarial sample image and the mask, and update to form the latest target adversarial sample image.

[0113] Sub-step 10414: Based on the gradient accumulation algorithm of the target iterative gradient and the preset momentum parameter, update the intermediate update perturbation of the first target region to determine the target perturbation corresponding to the first target region of the target sample image.

[0114] In this step, the specific formula for the target perturbation amount corresponding to the first target region of the target sample image is as follows:

[0115]

[0116] Here, Π X+S The gradient accumulation algorithm used to characterize the preset momentum parameter is the momentum parameter in the embodiments provided in this application.

[0117] Sub-step 1042: Based on the target perturbation amount and the target sample image to be identified, determine the target adversarial sample image corresponding to the target sample image.

[0118] In this step, after determining the target perturbation amount, the target adversarial sample image corresponding to the target sample image is determined based on the target perturbation amount and the target sample image to be identified.

[0119] like Figure 3 As shown, Figure 3 The flowchart illustrating a method for generating adversarial sample images according to an embodiment of this application uses a standard adversarial sample image. Figure 3 :

[0120] Step 1: Obtain the image of the target sample to be identified.

[0121] Step 2: Generate initial adversarial sample images. Based on the target sample images to be identified, generate initial adversarial sample images.

[0122] Step 3: Input the initial adversarial sample image into the trained target image recognition model and calculate the parameters of the target image recognition model.

[0123] Step 4: Activate the loss function of the trained target image recognition model for processing.

[0124] Step 5: Determine the preset recognition classification output by the trained target image recognition model.

[0125] Step 6: Calculate the iterative gradient in a chain according to the preset identification classification and loss function.

[0126] Step 7: Adjust the adversarial example image. Adjust the adversarial example image according to the iterative gradient.

[0127] like Figure 4 As shown, Figure 4 The diagram illustrates a flowchart of the training process for a target adversarial example image in a method for generating adversarial example images provided in an embodiment of this application. Figure 4 :

[0128] Step 1: Obtain the target sample image to be identified and the general adversarial perturbation quantity.

[0129] Step 2: Determine the initial perturbation amount to be added to the first target region locally.

[0130] Step 3: Add the initial perturbation amount to the general counter-perturbation amount.

[0131] Step 4: Generate intermediate adversarial sample images. Based on the general adversarial perturbation, the initial perturbation, and the target sample image, generate intermediate adversarial sample images.

[0132] Step 5: Input the intermediate adversarial sample image into the trained target image recognition model.

[0133] Step 6: If the target is hidden, the attack is successful. If the target image recognition model does not recognize the classification of the intermediate adversarial sample image, it is determined that the intermediate adversarial sample image attack on the target image recognition model is successful. If the target is detected, the target loss function is calculated, the iterative gradient is calculated, and then the adversarial perturbation is updated.

[0134] The adversarial sample image generation method provided in this application, compared with the adversarial sample image generation methods in the prior art, inputs the initial adversarial sample image generated by the target mask request and the initial perturbation amount of the first target region into the trained target image recognition model, determines the initial recognition classification corresponding to the initial adversarial sample image, and determines the target adversarial sample image corresponding to the target sample image based on the gradient accumulation algorithm of the iterative gradient between the initial recognition classification and the real classification corresponding to the initial adversarial sample image with preset momentum parameters. This realizes the ability to dynamically select and generate target adversarial sample images according to the attack target, increases the difficulty for the target image recognition model to identify the target adversarial sample image, thereby improving the anti-attack capability of the target image recognition model, and thus improving the recognition accuracy and robustness of the target image recognition model.

[0135] Furthermore, the embodiments provided in this application can hide specific local target regions according to scene requirements, and combine the backpropagation principle of the target image recognition model with target detection in computer vision. By modifying the target adversarial sample image, the trained target image recognition model is attacked, thereby improving the robustness of the target image recognition model. Compared with traditional adversarial samples, the embodiments provided in this application can solve the problems of traditional adversarial samples having too large an adversarial perturbation range and being able to attack all target features in the image at the same time (i.e., the attack target cannot be locked). Furthermore, from the perspective of local target region localization, the technical effect of generating target adversarial sample images for local target regions is achieved.

[0136] Please see Figure 5 , Figure 5 This is a second flowchart illustrating a method for generating adversarial sample images according to an embodiment of this application. Figure 5 As shown, the method for generating adversarial example images includes the following steps:

[0137] S501. Input the target sample image to be identified into the trained target image recognition model to determine the target recognition classification corresponding to the target sample image, wherein the target recognition classification is used to determine the mask region of the target sample image.

[0138] In this step, the mask region of the target sample image in the embodiments provided in this application can be determined not only by the prediction and classification results of the target image recognition model described above, but also by a custom setting based on different user needs or different application scenarios.

[0139] S502. Based on the target recognition and classification, locate the first target region of the target sample image.

[0140] In this step, the target image recognition model in the embodiments provided in this application can be specifically, but is not limited to, any local region in the target sample image.

[0141] S503. Generate a target mask request based on the first target region.

[0142] In this step, the mask is a string of binary code that performs a bitwise AND operation on the target field to mask the current input bits.

[0143] S504. According to the target mask request, a mask for the first target region and an initial perturbation amount for the first target region are added to the target sample image to be identified to generate an initial adversarial sample image of the first target region, wherein the target mask request includes the location information of the first target region.

[0144] S505. Based on the initial adversarial sample image and the trained target image recognition model, determine the initial recognition classification corresponding to the initial adversarial sample image.

[0145] S506. Based on the difference between the initial identification classification and the true classification corresponding to the initial adversarial sample image, determine the iterative gradient of the initial adversarial sample image.

[0146] S507. Based on the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, determine the target adversarial sample image corresponding to the target sample image, wherein the target adversarial sample image is an adversarial sample image with added momentum balance parameter and target perturbation amount.

[0147] S508. Based on the target perturbation amount, the test sample image, and the mask of the second target region, generate an adversarial sample image in the second target region using the test sample image, wherein the second target region is a local attack region in the test sample image.

[0148] In this step, while determining the target perturbation amount, the target perturbation amount is also determined as a general perturbation amount, and the target perturbation amount is added to the test sample image after masking the second target region to generate the test adversarial sample image of the second target region.

[0149] Here, within the second target region, the target perturbation is superimposed on the test sample image, causing the target perturbation to attack the target within this region; outside the second target region, the original pixels are preserved, ensuring the target is not attacked. In this case, the expression for the adversarial sample image for the second target region is:

[0150] Img = I + P⊙M;

[0151] Where I represents the test sample image, M represents the mask, and P represents the retained general adversarial sample.

[0152] In this way, the mask is a region that is manually selected and tested on the sample image. That is, a certain region on the sample image is divided out, with 1 representing the selected region and 0 representing the rest of the sample image.

[0153] This formula mainly describes how to limit the target perturbation amount, which is the same size as the second target region graphic, through a mask, so that only the part of the perturbation in the area to be attacked on the test sample image is retained, and the perturbation is superimposed on the clean test sample image to form the second target region test adversarial sample image.

[0154] The descriptions of S504 to S507 can be referred to the descriptions of S101 to S104, and can achieve the same technical effect, so they will not be elaborated further.

[0155] The adversarial sample image generation method provided in this application, compared with the adversarial sample image generation methods in the prior art, inputs the initial adversarial sample image generated by the target mask request and the initial perturbation amount of the first target region into the trained target image recognition model, determines the initial recognition classification corresponding to the initial adversarial sample image, and determines the target adversarial sample image corresponding to the target sample image based on the gradient accumulation algorithm of the iterative gradient between the initial recognition classification and the real classification corresponding to the initial adversarial sample image with preset momentum parameters. This realizes the ability to dynamically select and generate target adversarial sample images according to the attack target, increases the difficulty for the target image recognition model to identify the target adversarial sample image, thereby improving the anti-attack capability of the target image recognition model, and thus improving the recognition accuracy and robustness of the target image recognition model.

[0156] Furthermore, the embodiments provided in this application can hide specific local target regions according to scene requirements, and combine the backpropagation principle of the target image recognition model with target detection in computer vision. By modifying the target adversarial sample image, the trained target image recognition model is attacked, thereby improving the robustness of the target image recognition model. Compared with traditional adversarial samples, the embodiments provided in this application can solve the problems of traditional adversarial samples having too large an adversarial perturbation range and being able to attack all target features in the image at the same time (i.e., the attack target cannot be locked). Furthermore, from the perspective of local target region localization, the technical effect of generating target adversarial sample images for local target regions is achieved.

[0157] Please see Figure 6 , Figure 7 , Figure 6 This is one of the structural schematic diagrams of an adversarial sample image generation device provided in an embodiment of this application. Figure 7 This is a second schematic diagram of a device for generating adversarial sample images provided in an embodiment of this application. Figure 6 As shown, the adversarial sample image generation device 600 includes:

[0158] The second generation module 640 is used to add a mask to the first target region and an initial perturbation amount to the first target region to generate an initial adversarial sample image of the first target region according to the target mask request, wherein the target mask request includes the location information of the first target region.

[0159] Optionally, the second generation module 640 determines the target sample image to be identified in the following manner:

[0160] Obtain the initial sample image to be identified.

[0161] The initial sample image is standardized and cropped within a preset size range to determine the target sample image to be identified.

[0162] The second determining module 650 is used to determine the initial recognition classification corresponding to the initial adversarial sample image based on the initial adversarial sample image and the trained target image recognition model.

[0163] The third determining module 660 is used to determine the iterative gradient of the initial adversarial sample image based on the difference between the initial recognition classification and the true classification corresponding to the initial adversarial sample image.

[0164] The fourth determining module 670 is used to determine the target adversarial sample image corresponding to the target sample image based on the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, wherein the target adversarial sample image is an adversarial sample image with added momentum balance parameter and target perturbation amount.

[0165] Optionally, the fourth determining module 670 determines the trained target image recognition model in the following manner:

[0166] The training sample images are input into a preset image recognition model to determine the preset recognition category corresponding to the training sample images.

[0167] Based on the loss value between the preset recognition classification and the label classification corresponding to the training sample image, the trained target image recognition model is determined.

[0168] Optionally, the fourth determining module 670 is specifically used for:

[0169] Based on the gradient accumulation algorithm of iterative gradient and preset momentum parameters, the initial perturbation amount of the first target region is updated at least once to determine the target perturbation amount corresponding to the first target region of the target sample image.

[0170] Based on the target perturbation amount and the target sample image to be identified, the target adversarial sample image corresponding to the target sample image is determined.

[0171] Optionally, the step of updating the initial perturbation amount of the first target region at least once based on the gradient accumulation algorithm of the iterative gradient and preset momentum parameters, and determining the target perturbation amount corresponding to the first target region of the target sample image, includes:

[0172] Based on the gradient accumulation algorithm of iterative gradient and preset momentum parameters, the initial perturbation amount of the first target region is updated at least once to determine the intermediate update perturbation amount corresponding to the first target region of the target sample image.

[0173] Based on the intermediate update perturbation and the initial adversarial sample image, the intermediate adversarial sample image is determined.

[0174] Based on the intermediate adversarial sample image and the trained target image recognition model, the target iterative gradient of the intermediate adversarial sample image is determined, wherein the target iterative gradient is the iterative gradient of the target loss function of the trained target image recognition model when it converges.

[0175] Based on the gradient accumulation algorithm of the target iterative gradient and the preset momentum parameter, the intermediate update perturbation of the first target region is updated to determine the target perturbation corresponding to the first target region of the target sample image.

[0176] Compared with the adversarial example image generation device 600 in the prior art, the adversarial example image generation device 600 provided in this application inputs the initial adversarial example image generated by the target mask request and the initial perturbation amount of the first target region into the trained target image recognition model, determines the initial recognition classification corresponding to the initial adversarial example image, and determines the target adversarial example image corresponding to the target sample image based on the gradient accumulation algorithm of the iterative gradient preset momentum parameter between the initial recognition classification and the real classification corresponding to the initial adversarial example image. This realizes the ability to dynamically select and generate target adversarial example images according to the attack target, increases the difficulty for the target image recognition model to identify the target adversarial example image, thereby improving the anti-attack capability of the target image recognition model, and further improving the recognition accuracy and robustness of the target image recognition model.

[0177] Furthermore, the embodiments provided in this application can hide specific local target regions according to scene requirements, and combine the backpropagation principle of the target image recognition model with target detection in computer vision. By modifying the target adversarial sample image, the trained target image recognition model is attacked, thereby improving the robustness of the target image recognition model. Compared with traditional adversarial samples, the embodiments provided in this application can solve the problems of traditional adversarial samples having too large an adversarial perturbation range and being able to attack all target features in the image at the same time (i.e., the attack target cannot be locked). Furthermore, from the perspective of local target region localization, the technical effect of generating target adversarial sample images for local target regions is achieved.

[0178] Furthermore, such as Figure 7 As shown, the adversarial sample image generation device 600 includes:

[0179] The first determining module 610 is used to input the target sample image to be identified into the trained target image recognition model and determine the target recognition classification corresponding to the target sample image, wherein the target recognition classification is used to determine the mask region of the target sample image.

[0180] The positioning module 620 is used to locate the first target region of the target sample image based on the target recognition and classification.

[0181] The first generation module 630 is used to generate a target mask request based on the first target region.

[0182] The second generation module 640 is used to add a mask to the first target region and an initial perturbation amount to the first target region to generate an initial adversarial sample image of the first target region according to the target mask request, wherein the target mask request includes the location information of the first target region.

[0183] The second determining module 650 is used to determine the initial recognition classification corresponding to the initial adversarial sample image based on the initial adversarial sample image and the trained target image recognition model.

[0184] The third determining module 660 is used to determine the iterative gradient of the initial adversarial sample image based on the difference between the initial recognition classification and the true classification corresponding to the initial adversarial sample image.

[0185] The fourth determining module 670 is used to determine the target adversarial sample image corresponding to the target sample image based on the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, wherein the target adversarial sample image is an adversarial sample image with added momentum balance parameter and target perturbation amount.

[0186] The third generation module 680 is used to update the initial perturbation amount of the first target region at least once according to the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, and to determine the intermediate update perturbation amount corresponding to the first target region of the target sample image.

[0187] Compared with the adversarial example image generation device 600 in the prior art, the adversarial example image generation device 600 provided in this application inputs the initial adversarial example image generated by the target mask request and the initial perturbation amount of the first target region into the trained target image recognition model, determines the initial recognition classification corresponding to the initial adversarial example image, and determines the target adversarial example image corresponding to the target sample image based on the gradient accumulation algorithm of the iterative gradient preset momentum parameter between the initial recognition classification and the real classification corresponding to the initial adversarial example image. This realizes the ability to dynamically select and generate target adversarial example images according to the attack target, increases the difficulty for the target image recognition model to identify the target adversarial example image, thereby improving the anti-attack capability of the target image recognition model, and further improving the recognition accuracy and robustness of the target image recognition model.

[0188] Furthermore, the embodiments provided in this application can hide specific local target regions according to scene requirements, and combine the backpropagation principle of the target image recognition model with target detection in computer vision. By modifying the target adversarial sample image, the trained target image recognition model is attacked, thereby improving the robustness of the target image recognition model. Compared with traditional adversarial samples, the embodiments provided in this application can solve the problems of traditional adversarial samples having too large an adversarial perturbation range and being able to attack all target features in the image at the same time (i.e., the attack target cannot be locked). Furthermore, from the perspective of local target region localization, the technical effect of generating target adversarial sample images for local target regions is achieved.

[0189] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 As shown, the electronic device 800 includes a processor 810, a memory 820, and a bus 830.

[0190] The memory 820 stores machine-readable instructions executable by the processor 810. When the electronic device 800 is running, the processor 810 and the memory 820 communicate via the bus 830. When the machine-readable instructions are executed by the processor 810, they can perform the operations described above. Figures 1 to 5 The steps of the adversarial sample image generation method in the method embodiment shown are described in detail in the method embodiment, and will not be repeated here.

[0191] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described actions. Figures 1 to 5 The steps of the adversarial sample image generation method in the method embodiment shown are described in detail in the method embodiment, and will not be repeated here.

[0192] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0193] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0194] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0195] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0196] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0197] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for generating adversarial sample images, characterized in that, The method for generating adversarial sample images includes: According to the target mask request, a mask for the first target region and an initial perturbation amount for the first target region are added to the target sample image to be identified, thereby generating an initial adversarial sample image of the first target region, wherein the target mask request includes the location information of the first target region; Based on the initial adversarial sample image and the trained target image recognition model, determine the initial recognition classification corresponding to the initial adversarial sample image; Based on the difference between the initial identification classification and the true classification corresponding to the initial adversarial sample image, the iterative gradient of the initial adversarial sample image is determined; Based on the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, the target adversarial sample image corresponding to the target sample image is determined, wherein the target adversarial sample image is an adversarial sample image with added momentum balance parameter and target perturbation amount.

2. The method for generating adversarial sample images according to claim 1, characterized in that, The target sample image to be identified is determined using the following method: Obtain the initial sample image to be identified; The initial sample image is standardized and cropped within a preset size range to determine the target sample image to be identified.

3. The method for generating adversarial sample images according to claim 1, characterized in that, Before adding a mask to the first target region and an initial perturbation amount to the first target region to generate an initial adversarial sample image of the first target region according to the target mask request, the method for generating the adversarial sample image further includes: The target sample image to be identified is input into the trained target image recognition model to determine the target recognition classification corresponding to the target sample image, wherein the target recognition classification is used to determine the mask region of the target sample image; Based on the target recognition and classification, locate the first target region of the target sample image; Based on the first target region, generate a target mask request.

4. The method for generating adversarial sample images according to claim 1, characterized in that, The gradient accumulation algorithm based on the iterative gradient and preset momentum parameters determines the target adversarial sample image corresponding to the target sample image, including: Based on the gradient accumulation algorithm of iterative gradient and preset momentum parameter, the initial perturbation amount of the first target region is updated at least once to determine the target perturbation amount corresponding to the first target region of the target sample image. Based on the target perturbation amount and the target sample image to be identified, the target adversarial sample image corresponding to the target sample image is determined.

5. The method for generating adversarial sample images according to claim 4, characterized in that, The step of updating the initial perturbation amount of the first target region at least once based on the gradient accumulation algorithm using iterative gradients and preset momentum parameters, and determining the target perturbation amount corresponding to the first target region of the target sample image, includes: Based on the gradient accumulation algorithm of iterative gradient and preset momentum parameter, the initial perturbation amount of the first target region is updated at least once to determine the intermediate update perturbation amount corresponding to the first target region of the target sample image. Based on the intermediate update perturbation and the initial adversarial sample image, the intermediate adversarial sample image is determined; Based on the intermediate adversarial sample image and the trained target image recognition model, the target iterative gradient of the intermediate adversarial sample image is determined, wherein the target iterative gradient is the iterative gradient of the target loss function of the trained target image recognition model when it converges; Based on the gradient accumulation algorithm of the target iterative gradient and the preset momentum parameter, the intermediate update perturbation of the first target region is updated to determine the target perturbation corresponding to the first target region of the target sample image.

6. The method for generating adversarial sample images according to claim 5, characterized in that, After determining the target adversarial example image corresponding to the target sample image using the gradient accumulation algorithm based on the iterative gradient and preset momentum parameters, the method for generating the adversarial example image further includes: Based on the target perturbation amount, the test sample image, and the mask of the second target region, an adversarial sample image is generated in the second target region, wherein the second target region is a local attack region in the test sample image.

7. The method for generating adversarial sample images according to claim 1, characterized in that, The trained target image recognition model is determined in the following way: Input the training sample images into a preset image recognition model to determine the preset recognition category corresponding to the training sample images; Based on the loss value between the preset recognition classification and the label classification corresponding to the training sample image, the trained target image recognition model is determined.

8. An apparatus for generating adversarial sample images, characterized in that, The apparatus for generating adversarial sample images includes: The second generation module is used to add a mask for the first target region and an initial perturbation amount to the first target region to the target sample image to be identified according to the target mask request, thereby generating an initial adversarial sample image of the first target region, wherein the target mask request includes the location information of the first target region; The second determining module is used to determine the initial recognition classification corresponding to the initial adversarial sample image based on the initial adversarial sample image and the trained target image recognition model; The third determining module is used to determine the iterative gradient of the initial adversarial sample image based on the difference between the initial identification classification and the true classification corresponding to the initial adversarial sample image; The fourth determining module is used to determine the target adversarial sample image corresponding to the target sample image based on the gradient accumulation algorithm of the iterative gradient and the preset momentum parameter, wherein the target adversarial sample image is an adversarial sample image with added momentum balance parameter and target perturbation amount.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus, and the machine-readable instructions are executed by the processor to perform the steps of the method for generating adversarial sample images as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the method for generating adversarial sample images as described in any one of claims 1 to 7.

Images