Image classification counterattack method, device, terminal equipment and medium

Abstract

The present invention discloses a method, apparatus, terminal device, and medium for image classification against attacks. The method comprises: determining an initial pixel position matrix corresponding to an original image, and obtaining a target pixel position matrix corresponding to the initial pixel position matrix; obtaining pixels within a preset modification range of the target pixel position matrix, and modifying the color parameter values ​​of the pixels to obtain an attack-against-the-attack image; and classifying the original image and the attack-against-the-attack image using a preset image classification model to obtain corresponding performance indicators, and determining whether the attack-against-the-attack image successfully undergoes an image classification attack based on the performance indicators. The present invention can achieve comprehensive and precise defense against image attack-against-the-attack.

Description

Technical Field

[0001] The present invention relates to the field of image processing technology, and in particular to an image classification anti-attack method, device, terminal equipment and medium. Background Art

[0002] Adversarial attacks are attacks on image classification models by adding different noises or modifying certain pixel areas of the image to generate adversarial samples, thereby confusing the classification.

[0003] Therefore, in order to achieve accurate defense against adversarial attacks, adversarial attack image samples can be used to train image classification models.

[0004] However, existing adversarial attack image samples can easily be identified as having been attacked, causing the adversarial attack to fail. As a result, image classification models trained using such image samples are unable to effectively defend against higher-level adversarial attacks.

[0005] For example, Figure 1 As shown, the image on the left is the original image, and the image on the right is the image after the attack. Obviously, there are significant differences between the original image and the image after the attack. The attacked image shows that there are pixels that do not belong to the image. Summary of the Invention

[0006] The main purpose of the present invention is to provide a method, apparatus, terminal device and computer-readable storage medium for countering attacks, aiming to achieve comprehensive and accurate defense against image counterattacks.

[0007] To achieve the above object, the present invention provides a method for resisting attacks, the method comprising the following steps:

[0008] S10, determining an initial pixel position matrix corresponding to the original image, and obtaining a target pixel position matrix corresponding to the initial pixel position matrix;

[0009] S20, obtaining pixel points of the target pixel position matrix within a preset modification range, and modifying color parameter values ​​of the pixel points to obtain an anti-attack image;

[0010] S30, performing image classification on the original image and the adversarial attack image respectively through a preset image classification model to obtain corresponding performance indicators, and determining whether the image classification attack on the adversarial attack image is successful based on the performance indicators.

[0011] Optionally, the initial pixel position matrix includes a first reference position matrix and a second reference position matrix, and the step of determining the initial pixel position matrix corresponding to the original image includes:

[0012] Acquire a plurality of randomly generated matrices, and construct a random matrix based on the plurality of matrices, wherein the plurality of matrices satisfy preset matrix constraints, and the matrix constraints constrain the dimensions of the plurality of matrices and the maximum and minimum position values ​​of elements in the matrices;

[0013] According to the random matrix, a first reference position matrix and a second reference position matrix at a current moment are obtained.

[0014] Optionally, the step of obtaining a target pixel position matrix corresponding to the initial pixel position matrix includes:

[0015] Projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain corresponding performance indicators;

[0016] The target pixel position matrix at the next moment is determined according to the performance index and the random matrix.

[0017] Optionally, the step of projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain corresponding performance indicators includes:

[0018] Projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain projection functions corresponding to the first reference position matrix and the second reference position matrix, respectively;

[0019] A corresponding performance indicator is constructed according to the projection function and the random matrix.

[0020] Optionally, the color parameter value includes an RGB value, and within the preset modification range, a difference between the RGB value of the adversarial attack image and the RGB value of the original image is less than or equal to a preset RGB threshold.

[0021] Optionally, the performance indicator includes a confidence level of correct image classification, and the step of determining whether the adversarial attack image successfully undergoes an image classification attack based on the performance indicator includes:

[0022] It is determined whether the confidence of the adversarial attack image is less than the confidence of the original image to determine whether the image classification attack on the adversarial attack image is successful.

[0023] Optionally, after the step of determining whether the confidence of the adversarial attack image is less than the confidence of the original image to determine whether the adversarial attack image is successful, the method further includes:

[0024] If the confidence of the adversarial attack image is greater than the confidence of the original image, steps S10, S20 and S30 are repeated until the confidence of the adversarial attack image is less than the confidence of the original image.

[0025] To achieve the above object, the present invention further provides an anti-attack device, comprising:

[0026] A first determining module is configured to determine an initial pixel position matrix corresponding to the original image, and obtain a target pixel position matrix corresponding to the initial pixel position matrix;

[0027] a modification module, configured to obtain pixel points of the target pixel position matrix within a preset modification range, and modify the color parameter values ​​of the pixel points to obtain an anti-attack image;

[0028] The second determination module is used to perform image classification on the original image and the adversarial attack image respectively through a preset image classification model to obtain corresponding performance indicators, and determine whether the image classification attack of the adversarial attack image is successful based on the performance indicators.

[0029] To achieve the above-mentioned purpose, the present invention also provides a terminal device, which includes a memory, a processor, and an anti-attack program stored in the memory and runnable on the processor. When the anti-attack program is executed by the processor, the steps of the anti-attack method described above are implemented.

[0030] In addition, to achieve the above-mentioned purpose, the present invention also proposes a computer-readable storage medium, on which an anti-attack program is stored. When the anti-attack program is executed by a processor, the steps of the anti-attack method described above are implemented.

[0031] To achieve the above object, the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of the anti-attack method described above are implemented.

[0032] The present invention provides an anti-attack method, apparatus, terminal device, computer-readable storage medium, and computer program product. The method comprises determining an initial pixel position matrix corresponding to an original image and obtaining a target pixel position matrix corresponding to the initial pixel position matrix; obtaining pixel points within a preset modification range of the target pixel position matrix and modifying the color parameter values ​​of the pixel points to obtain an anti-attack image; and performing image classification on the original image and the anti-attack image respectively through a preset image classification model to obtain corresponding performance indicators. Based on the performance indicators, the method determines whether the image classification attack on the anti-attack image is successful.

[0033] Compared to the modification method of the adversarial attack image in the prior art, in the present invention, the initial pixel position matrix corresponding to the original image and the target pixel position matrix corresponding to the initial pixel position matrix can be first obtained. Then, the pixel points of the target pixel position matrix within the preset modification range can be modified to obtain the corresponding adversarial attack image. Therefore, in the present invention, the adversarial attack image is obtained by modifying the pixel points within the preset modification range, so that the modified pixel points of the adversarial attack image cannot be easily identified. Then, the image can be classified by a preset image classification model to obtain performance indicators of the adversarial attack image and the original image, and based on the performance indicators, it is determined whether the above-mentioned adversarial attack image is successfully attacked to ensure that the adversarial attack image can interfere with the correctness of the preset image classification model.

[0034] On this basis, when the adversarial attack image attack is successful, the above-mentioned adversarial attack image can be used to train the preset image classification model, thereby achieving precise defense against the adversarial attack and avoiding the attacker's modification of the image, which causes the image classification model to be unable to correctly classify the image. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of the counterattack in the background technology of the present invention;

[0036] Figure 2 A schematic diagram of the hardware operating environment involved in an embodiment of the present invention;

[0037] Figure 3 This is a schematic diagram of a first flow chart of an embodiment of an anti-attack method for image classification according to the present invention;

[0038] Figure 4 This is a second flow chart of an embodiment of the image classification counterattack method of the present invention;

[0039] Figure 5-1 This is a first schematic diagram of the adversarial attack results of an embodiment of the adversarial attack method for image classification according to the present invention;

[0040] Figure 5-2 This is a second schematic diagram of the adversarial attack results of an embodiment of the adversarial attack method for image classification according to the present invention;

[0041] Figure 5-3 A third schematic diagram of the adversarial attack results of an embodiment of the adversarial attack method for image classification according to the present invention;

[0042] Figure 6 This is a schematic diagram of the functional modules of an embodiment of an apparatus for countering attacks on image classification according to the present invention.

[0043] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0044] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0045] like Figure 2 As shown, Figure 2 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present invention.

[0046] The terminal device of the embodiment of the present invention can be a smart phone, a computer, a server, or other network equipment. The terminal device in this embodiment can be used to achieve precise defense against image classification attacks.

[0047] like Figure 2 As shown, the terminal device may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may optionally be a storage device independent of the aforementioned processor 1001.

[0048] Those skilled in the art will understand that Figure 2 The device structure shown in the figure does not constitute a limitation of the anti-attack device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0049] like Figure 2 As shown, the memory 1005 as a computer storage medium may include an operation, a network communication module, a user interface module, and an anti-attack program. The operation is a program that manages and controls the hardware and software resources of the device and supports the operation of the anti-attack program and other software or programs. Figure 1 In the device shown, the user interface 1003 is mainly used to communicate data with the client; the network interface 1004 is mainly used to establish a communication connection with the server; and the processor 1001 can be used to call the anti-attack program stored in the memory 1005 and perform the following operations:

[0050] Determine an initial pixel position matrix corresponding to the original image, and obtain a target pixel position matrix corresponding to the initial pixel position matrix;

[0051] Obtaining pixel points of the target pixel position matrix within a preset modification range, and modifying color parameter values ​​of the pixel points to obtain an anti-attack image;

[0052] By using a preset image classification model, the original image and the adversarial attack image are respectively classified to obtain corresponding performance indicators, and based on the performance indicators, it is determined whether the image classification attack of the adversarial attack image is successful.

[0053] Furthermore, the initial pixel position matrix includes a first reference position matrix and a second reference position matrix. The processor 1001 may be configured to call the anti-attack program stored in the memory 1005 and perform the following operations:

[0054] Acquire a plurality of randomly generated matrices, and construct a random matrix based on the plurality of matrices, wherein the plurality of matrices satisfy preset matrix constraints, and the matrix constraints constrain the dimensions of the plurality of matrices and the maximum and minimum position values ​​of elements in the matrices;

[0055] According to the random matrix, a first reference position matrix and a second reference position matrix at a current moment are acquired.

[0056] Furthermore, the processor 1001 may be configured to call the anti-attack program stored in the memory 1005 and perform the following operations:

[0057] Projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain corresponding performance indicators;

[0058] The target pixel position matrix at the next moment is determined according to the performance index and the random matrix.

[0059] Furthermore, the processor 1001 may be configured to call the anti-attack program stored in the memory 1005 and perform the following operations:

[0060] Projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain projection functions corresponding to the first reference position matrix and the second reference position matrix, respectively;

[0061] A corresponding performance indicator is constructed according to the projection function and the random matrix.

[0062] Furthermore, the color parameter value includes an RGB value, and within the preset modification range, a difference between the RGB value of the adversarial attack image and the RGB value of the original image is less than or equal to a preset RGB threshold.

[0063] Furthermore, the processor 1001 may be configured to call the anti-attack program stored in the memory 1005 and perform the following operations:

[0064] It is determined whether the confidence of the adversarial attack image is less than the confidence of the original image to determine whether the image classification attack on the adversarial attack image is successful.

[0065] Furthermore, the processor 1001 may be configured to call the anti-attack program stored in the memory 1005 and perform the following operations:

[0066] If the confidence of the adversarial attack image is greater than the confidence of the original image, the following steps are repeated: determining the initial pixel position matrix corresponding to the original image, and obtaining the target pixel position matrix corresponding to the initial pixel position matrix; obtaining the pixel points of the target pixel position matrix within a preset modification range, and modifying the color parameter values ​​of the pixel points to obtain the adversarial attack image; performing image classification on the original image and the adversarial attack image respectively through a preset image classification model to obtain corresponding performance indicators, and determining whether the image classification attack of the adversarial attack image is successful based on the performance indicators, until the confidence of the adversarial attack image is less than the confidence of the original image.

[0067] In the present invention, according to the above background technology, deep neural networks are widely used in tasks such as image classification. However, there are security issues in deep neural networks. For example, deliberately adding some perturbations to the input samples will cause the model to misclassify the samples. Even if the model parameters of the target network are unknown, adding some carefully selected perturbations to the correctly classified natural images can still cause the classifier to misclassify the images. Existing adversarial attack methods require the gradient of the target function, or it is easy for the human eye to detect that the image has been attacked, such as Figure 1 As shown in the figure, the first row shows the original image, and the second row shows the image after the attack. There are significant differences between the original image and the image after the attack. The attacked image shows pixels that do not belong to the image and there are significant differences in color.

[0068] If such images are used to train deep neural networks, the deep neural networks will not be able to effectively defend against attacks. For example, once the attacker makes subtle modifications to the image that are invisible to the naked eye, the deep neural network will not be able to correctly classify the image (it may misclassify images in the "animal" category as other categories).

[0069] In order to solve the above problems, the present invention proposes an adversarial attack method for deep neural network image classification systems, which uses a search algorithm to implement adversarial attacks that are imperceptible to the human eye and obtain corresponding adversarial attack images. The adversarial attack images can then be used in the model of the deep neural network image classification model to achieve precise defense of the deep neural network image classification model against adversarial attacks.

[0070] Reference Figure 2 , Figure 2 2 is a flow chart of the first embodiment of the anti-attack method of the present invention.

[0071] The embodiments of the present invention provide embodiments of the method for resisting attacks. It should be noted that although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than here.

[0072] Specifically, the anti-attack method in this embodiment includes the following steps:

[0073] Step S10, during the image classification process, determining an initial pixel position matrix corresponding to the original image, and obtaining a target pixel position matrix corresponding to the initial pixel position matrix;

[0074] It should be noted that, in this embodiment, the terminal device can pre-acquire an original image, wherein the method of acquiring the original image is not specifically limited. For example, it can be obtained by the user through terminal device input, or extracted from a preset image database, etc.

[0075] On this basis, the terminal device can obtain an initial pixel position matrix of the original image, wherein the initial pixel position matrix is ​​determined based on the randomly generated pixel modification positions.

[0076] Furthermore, the terminal device may use a preset search algorithm to search for the target pixel position matrix corresponding to the initial pixel position matrix. In this embodiment, the search algorithm is not specifically limited. For example, the search algorithm may be a hash algorithm.

[0077] In this embodiment, the terminal device first starts from a randomly generated initial pixel position matrix and searches for a target pixel position matrix to modify the color parameter values ​​of the pixels in the target pixel position matrix.

[0078] Step S20, obtaining pixel points of the target pixel position matrix within a preset modification range, and modifying color parameter values ​​of the pixel points to obtain an anti-attack image;

[0079] It should be noted that, in this embodiment, in order to ensure that the counterattack is not detected by the human eye, that is, the image generated by the attack has no obvious signs of being attacked, and there is no pixel point that obviously does not belong to the image, it is necessary to modify the pixels within the preset modification range so that there is no obvious difference between the image after the attack and the original image.

[0080] Specifically, for example, after determining the above-mentioned target pixel position matrix, the terminal device can first obtain the pixel points of the target pixel position matrix within a preset modification range, and modify the color parameter values ​​of the pixel points (i.e., attack the original image) to obtain an adversarial attack image.

[0081] Step S30 , performing image classification on the original image and the adversarial attack image respectively through a preset image classification model to obtain corresponding performance indicators, and determining whether the image classification attack on the adversarial attack image is successful based on the performance indicators.

[0082] It should be noted that, in this embodiment, according to the above description, after modifying the pixel points of the target pixel position matrix within the preset modification range to obtain the adversarial attack image, it is necessary to verify whether the neural network image classification model (that is, the preset image classification model in this embodiment) can correctly classify the adversarial attack image. For example, if the image classification is incorrectly classified, it can be considered that the adversarial attack is effective, that is, the modification of the pixel points interferes with the classification of the image by the neural network image classification model.

[0083] The terminal device can determine whether the adversarial attack image is successful based on the performance indicators of the adversarial attack image and the original image, that is, the preset image classification model incorrectly classifies the adversarial attack image (for example, identifying an airplane as a bird).

[0084] The above performance indicators may include the confidence level of the correct classification of the image. It is understandable that the smaller the confidence level, the greater the possibility that the image is misclassified, that is, the more likely the adversarial attack is to succeed.

[0085] In this embodiment, the terminal device can obtain the initial pixel position matrix of the original image, wherein the initial pixel position matrix is ​​determined based on the randomly generated pixel modification position. Furthermore, the terminal device can obtain the target pixel position matrix corresponding to the above-mentioned initial pixel position matrix. After determining the above-mentioned target pixel position matrix, the terminal device can first obtain the pixel points of the target pixel position matrix within a preset modification range, and modify the color parameter values ​​of the pixel points (i.e., attack the original image) to obtain an adversarial attack image. The terminal device can determine whether to use the adversarial attack image as an adversarial attack image based on the performance indicators of the adversarial attack image and the original image, that is, if the adversarial attack image can be used as an adversarial attack image, then the adversarial attack is successful.

[0086] Compared to the modification method of the adversarial attack image in the prior art, in the present invention, the initial pixel position matrix corresponding to the original image and the target pixel position matrix corresponding to the initial pixel position matrix can be first obtained. Then, the pixel points of the target pixel position matrix within the preset modification range can be modified to obtain the corresponding adversarial attack image. Therefore, in the present invention, the adversarial attack image is obtained by modifying the pixel points within the preset modification range, so that the modified pixel points of the adversarial attack image cannot be easily identified. Then, the image can be classified by a preset image classification model to obtain performance indicators of the adversarial attack image and the original image, and based on the performance indicators, it is determined whether the above-mentioned adversarial attack image is successfully attacked to ensure that the adversarial attack image can interfere with the correctness of the preset image classification model.

[0087] On this basis, when the adversarial attack image attack is successful, the above-mentioned adversarial attack image can be used to train the preset image classification model, thereby achieving precise defense against the adversarial attack and avoiding the attacker's modification of the image, which causes the image classification model to be unable to correctly classify the image.

[0088] Furthermore, based on the first embodiment of the anti-attack method of the present invention, a second embodiment of the anti-attack method of the present invention is proposed.

[0089] In this embodiment, the initial pixel position matrix includes a first reference position matrix and a second reference position matrix. On this basis, in the above step S10, "determining the initial pixel position matrix corresponding to the original image" may include:

[0090] Step S101: Acquire a plurality of randomly generated matrices, and construct a random matrix based on the plurality of matrices, wherein the plurality of matrices satisfy preset matrix constraints, and the matrix constraints constrain the dimensions of the plurality of matrices, and the maximum and minimum position values ​​of elements in the matrices;

[0091] Step S102: Acquire a first reference position matrix and a second reference position matrix at a moment before the current moment according to the random matrix.

[0092] It should be noted that, in this embodiment, the above-mentioned randomly generated multiple matrices include and in, and Represents the row and column values ​​of the pixel points, Represents the RGB value of the pixel (ie, the color parameter value in this embodiment).

[0093] Furthermore, the above and The following matrix constraints are satisfied:

[0094]

[0095]

[0096]

[0097] Among them, the above constraint function bound(dim,min,max,type), dim is the dimension of the random matrix, min and max are the minimum and maximum values ​​of the row and column positions of the elements in the matrix, k is the number of pixels to be modified, and the number of pixels of the input original image is m×n.

[0098] Furthermore, a random matrix can be constructed based on the above three matrices

[0099]

[0100] On this basis, the random matrix Combined with randomly generated pixel modification positions Get the left reference position matrix (i.e., the first reference position matrix in this embodiment) and the right reference position matrix (ie, the second reference position matrix in this embodiment.) Wherein, t≥1, and d is the size of the area searched by the search algorithm.

[0101] Furthermore, in the above step S10, “obtaining a target pixel position matrix corresponding to the initial pixel position matrix” may include:

[0102] Step S103: Projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain corresponding performance indicators;

[0103] Step S104: determining the target pixel position matrix at the current moment according to the performance index and the random matrix.

[0104] It should be noted that, in this embodiment, due to the randomly generated matrix May cause Exceeding the following limits:

[0105]

[0106] Among them, X min and X max Respectively represent the minimum and maximum values ​​of the position matrix. This embodiment does not min and X max The value of is specifically limited and can be flexibly adjusted according to the acquired image; f(.) represents the performance index function.

[0107] therefore, The following constraints must be met:

[0108] ψ={X|X min ≤X≤X max}

[0109] P ψ (X) = max{X min , min{X, X max}}

[0110] Where ψ is the preset constraint set in this embodiment, P ψ (.) is the projection function in this embodiment.

[0111] On this basis, the terminal device can project the left reference position matrix and the right reference position matrix onto the above constraint set respectively to obtain the corresponding performance index, which is specifically the confidence of the image corresponding to the left reference position matrix and the right reference position matrix. as well as

[0112] Furthermore, according to the above as well as And the random matrix in the above embodiment Get the target pixel position matrix at the next moment

[0113]

[0114] Furthermore, the above step S103 may include:

[0115] Step S1031: Projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain projection functions corresponding to the first reference position matrix and the second reference position matrix, respectively;

[0116] Step S1032: Construct corresponding performance indicators based on the projection function and the random matrix. The following constraints must be met:

[0117] ψ={X|X min ≤X≤X max}

[0118] P ψ (X) = max{X min , min{X, X max}}

[0119] Where ψ is the preset constraint set in this embodiment, P ψ (.) is the projection function in this embodiment.

[0120] On this basis, the terminal device can use the left reference position matrix and the right reference position matrix Project them onto the above constraint sets respectively to obtain the corresponding projection functions:

[0121]

[0122]

[0123] In another embodiment, to ensure that the attack is not visible to the human eye, that is, the image produced by the attack has no obvious signs of being attacked and no pixel is clearly not part of the image, its RGB value needs to be modified within the following range:

[0124] The RGB value of the point. and Represent the row and column values ​​of the pixel points respectively, so and and represent the row and column values ​​of the pixel points respectively, so X clean [.][.] represents the RGB value of the pixel in the original image corresponding to the row and column values. For example, the original RGB value of a pixel in the image is [76, 201, 124]. The search algorithm calculates that the RGB value of this pixel should be modified to [76, 201, 124]. Assuming δ = 10, to ensure that the attack is not noticeable to the human eye, the RGB value of this pixel should be modified to [68, 191, 134].

[0125] Furthermore, the projection function can be and random matrices Construct the corresponding performance indicator, that is, the confidence of the image and

[0126] Furthermore, the color parameter value includes an RGB value, and within the preset modification range, a difference between the RGB value of the adversarial attack image and the RGB value of the original image is less than or equal to a preset RGB threshold.

[0127] In this implementation, to ensure that the attack is not visible to the human eye, that is, the image produced by the attack has no obvious signs of being attacked and no pixels are clearly not part of the image, the RGB values ​​of the pixels in the pixel position matrix need to be modified within the following range:

[0128]

[0129] According to the above description, Represents the RGB value of the pixel in the adversarial attack image. clean [.][.] represents the RGB value of the pixel point of the original image corresponding to the row and column values, and the difference between the RGB value of the adversarial attack image and the RGB value of the original image is less than or equal to the preset RGB threshold δ.

[0130] By modifying the RGB of the pixel within the above preset modification range, the modified pixel can be made invisible to the human eye.

[0131] Furthermore, the performance indicator includes a confidence level of correct classification of the image. On this basis, the above step S30, "determining whether the image classification attack on the adversarial attack image is successful based on the performance indicator," may include:

[0132] Step S301 : Determine whether the confidence of the adversarial attack image is less than the confidence of the original image, so as to determine whether the image classification attack on the adversarial attack image is successful.

[0133] Step S302: If the confidence of the adversarial attack image is greater than the confidence of the original image, steps S10, S20 and S30 are repeated until the confidence of the adversarial attack image is less than the confidence of the original image.

[0134] In this embodiment, after obtaining the adversarial attack image, the terminal device can classify the above-mentioned original image and the adversarial attack image through the image classification model to obtain the confidence of the adversarial attack image output by the image classification model and the confidence of the original image.

[0135] Furthermore, it can be determined whether the confidence of the adversarial attack image is less than the confidence of the original image to determine whether the image classification attack on the adversarial attack image is successful.

[0136] If the confidence of the adversarial attack image is determined to be lower than that of the original image, it means that the confidence of the modified adversarial attack image is even lower. That is, the pixel modification interferes with the image classification of the preset image classification model, causing the preset image classification model to misclassify the modified image.

[0137] On this basis, the adversarial attack image can be used to train the preset image classification model, so that the trained preset image classification model can also correctly classify the modified image, thereby achieving comprehensive and accurate defense against adversarial attacks.

[0138] If it is determined that the confidence of the adversarial attack image is greater than the confidence of the original image, it means that the pixel modification did not interfere with the image classification of the preset image classification model, and the adversarial attack on the preset image classification model was not successful. At this time, the steps of the above-mentioned first embodiment can be repeated until the confidence of the adversarial attack image is less than the confidence of the original image.

[0139] For example, Figure 3 As shown, if the performance index, that is, the confidence of the correct classification of the image, decreases at time t compared to time t-1, then stay at the current reference position matrix At time t+1, from the reference position matrix The attack is continued until the attack is successful, that is, until the preset image classification model misidentifies the category of the adversarial attack image.

[0140] If the confidence of the correct classification of the image increases at time t compared to time t-1, then return Re-execute the steps in the first embodiment until the attack is successful.

[0141] Right now,

[0142] Specifically, for example, the LeNet-5 image classification neural network is used to attack the CIFAR-10 test set, such as Figures 5-1 to 5-3As shown, the original image is on the left and the adversarial attack image obtained in this embodiment is on the right. When the original image is an airplane, the confidence level for classification as an airplane is 54.4%, and the confidence level for classification as a bird after pixel modification is 48.9%. When the original image is a cat, the confidence level for classification as a cat is 42.9%, and the confidence level for classification as a dog after pixel modification is 39.6%. When the original image is a bird, the confidence level for classification as a bird is 53.2%, and the confidence level for classification as an airplane after pixel modification is 48.4%.

[0143] When this adversarial attack is successful, the obtained adversarial attack image can be used to train the subsequent preset image classification model, so that the preset image classification model can accurately defend against various adversarial attacks.

[0144] In this embodiment, a plurality of randomly generated matrices include and Constructing a random matrix According to the above random matrix Combined with randomly generated pixel modification positions Get the left reference position matrix and the right reference position matrix The terminal device can project the left reference position matrix and the right reference position matrix onto the above constraint set to obtain the corresponding projection function and According to the above projection function and random matrices Construct the corresponding performance indicator, that is, the confidence of the image and Then, according to the above as well as And the random matrix in the above embodiment Get the target pixel position matrix at the next moment After acquiring the adversarial attack image, the terminal device can classify the original image and the adversarial attack image using the image classification model, obtaining the confidence level of the adversarial attack image and the confidence level of the original image output by the image classification model. If the confidence level of the adversarial attack image is determined to be lower than that of the original image, the adversarial attack image can be used as the adversarial attack image.

[0145] Therefore, in the present invention, the original image can be modified to obtain an adversarial attack image, and then, whether the attack is successful can be determined based on the confidence of the correct classification of the images corresponding to the original image and the adversarial attack image. If the attack is successful, the corresponding adversarial attack image can be obtained, and the adversarial attack image can be used to train the preset image classification model. The trained preset image classification model can also correctly classify the modified image, thereby achieving comprehensive and accurate defense against adversarial attacks.

[0146] In addition, the embodiment of the present invention also proposes an anti-attack device, referring to Figure 6 , the anti-attack device includes:

[0147] A first determining module 10 is configured to determine an initial pixel position matrix corresponding to the original image and obtain a target pixel position matrix corresponding to the initial pixel position matrix;

[0148] A modification module 20 is configured to obtain pixel points of the target pixel position matrix within a preset modification range and modify the color parameter values ​​of the pixel points to obtain an anti-attack image;

[0149] The second determination module 30 is used to perform image classification on the original image and the adversarial attack image respectively through a preset image classification model to obtain corresponding performance indicators, and determine whether the image classification attack of the adversarial attack image is successful based on the performance indicators.

[0150] Furthermore, the initial pixel position matrix includes a first reference position matrix and a second reference position matrix, and the first determining module includes:

[0151] a construction unit, configured to obtain a plurality of randomly generated matrices and construct a random matrix based on the plurality of matrices, wherein the plurality of matrices satisfy preset matrix constraints, and the matrix constraints constrain the dimensions of the plurality of matrices and the maximum and minimum position values ​​of elements in the matrices;

[0152] The first acquisition unit is configured to acquire a first reference position matrix and a second reference position matrix at a current moment according to the random matrix.

[0153] Furthermore, the first determining module includes:

[0154] a projection unit, configured to project the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain corresponding performance indicators;

[0155] A determination unit is used to determine the target pixel position matrix at the next moment according to the performance indicator and the random matrix.

[0156] Furthermore, the projection unit includes:

[0157] a projection subunit, configured to project the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain projection functions corresponding to the first reference position matrix and the second reference position matrix, respectively;

[0158] A construction subunit is used to construct a corresponding performance indicator according to the projection function and the random matrix.

[0159] Furthermore, the color parameter value includes an RGB value, and within the preset modification range, a difference between the RGB value of the adversarial attack image and the RGB value of the original image is less than or equal to a preset RGB threshold.

[0160] Furthermore, the performance indicator includes confidence that the image is correctly classified, and the second determination module includes:

[0161] A second acquisition unit is configured to acquire the confidence of the adversarial attack image and the confidence of the original image through the preset image classification model;

[0162] A judging unit is configured to judge whether the confidence of the adversarial attack image is less than the confidence of the original image, so as to determine whether the adversarial attack image has successfully attacked.

[0163] Furthermore, the second determining module includes:

[0164] An execution unit is configured to repeatedly determine an initial pixel position matrix corresponding to the original image and obtain a target pixel position matrix corresponding to the initial pixel position matrix if the confidence of the adversarial attack image is greater than the confidence of the original image; obtain pixel points of the target pixel position matrix within a preset modification range, and modify the color parameter values ​​of the pixel points to obtain an adversarial attack image; obtain performance indicators of the adversarial attack image and the original image through a preset image classification model, and determine whether the adversarial attack image is successful based on the performance indicators, until the confidence of the adversarial attack image is less than the confidence of the original image.

[0165] The expanded content of the specific implementation of the anti-attack device for image classification of the present invention is basically the same as the above-mentioned anti-attack method embodiments, and will not be repeated here.

[0166] In addition, an embodiment of the present invention further provides a computer-readable storage medium, on which an anti-attack program is stored. When the anti-attack program is executed by a processor, the steps of the anti-attack method described below are implemented.

[0167] The various embodiments of the anti-attack device and the computer-readable storage medium of the present invention can refer to the various embodiments of the anti-attack method of the present invention, and will not be repeated here.

[0168] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0169] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0170] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a smart phone, computer, server and other network equipment, etc.) to execute the methods described in each embodiment of the present invention.

[0171] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for image classification against an attack, characterized in that: The anti-attack method includes: S10, determining an initial pixel position matrix corresponding to the original image, and obtaining a target pixel position matrix corresponding to the initial pixel position matrix; S20, obtaining pixel points of the target pixel position matrix within a preset modification range, and modifying color parameter values ​​of the pixel points to obtain an anti-attack image; S30, performing image classification on the original image and the adversarial attack image respectively using a preset image classification model to obtain corresponding performance indicators, and determining whether the image classification attack on the adversarial attack image is successful based on the performance indicators; The initial pixel position matrix includes pixel values ​​and row and column position information of pixel points, specifically including a first reference position matrix and a second reference position matrix. The step of determining the initial pixel position matrix corresponding to the original image includes: Acquire a plurality of randomly generated matrices, and construct a random matrix based on the plurality of matrices, wherein the plurality of matrices satisfy preset matrix constraints, and the matrix constraints constrain the dimensions of the plurality of matrices and the maximum and minimum position values ​​of elements in the matrices; Obtaining a first reference position matrix and a second reference position matrix at a current moment according to the random matrix; The step of obtaining the target pixel position matrix corresponding to the initial pixel position matrix includes: Projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain corresponding performance indicators; The target pixel position matrix at the next moment is determined according to the performance index and the random matrix.

2. The anti-attack method according to claim 1, wherein: The step of projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain corresponding performance indicators includes: Projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain projection functions corresponding to the first reference position matrix and the second reference position matrix, respectively; A corresponding performance indicator is constructed according to the projection function and the random matrix.

3. The anti-attack method according to any one of claims 1 to 2, characterized in that: The color parameter value includes an RGB value. Within the preset modification range, a difference between the RGB value of the adversarial attack image and the RGB value of the original image is less than or equal to a preset RGB threshold.

4. The anti-attack method according to claim 1, wherein: The performance indicator includes a confidence level of correct classification of the image. The step of determining whether the image classification attack on the adversarial attack image is successful based on the performance indicator includes: It is determined whether the confidence of the adversarial attack image is less than the confidence of the original image to determine whether the image classification attack on the adversarial attack image is successful.

5. The anti-attack method according to claim 4, wherein: After the step of determining whether the confidence of the adversarial attack image is less than the confidence of the original image to determine whether the image classification attack on the adversarial attack image is successful, the method further includes: If the confidence of the adversarial attack image is greater than the confidence of the original image, steps S10, S20 and S30 are repeated until the confidence of the adversarial attack image is less than the confidence of the original image.

6. An anti-attack device for image classification, characterized in that: The anti-attack device includes: A first determination module is configured to determine an initial pixel position matrix corresponding to an original image and obtain a target pixel position matrix corresponding to the initial pixel position matrix; wherein the initial pixel position matrix includes pixel values ​​and row and column position information of pixel points, specifically including a first reference position matrix and a second reference position matrix; the step of determining the initial pixel position matrix corresponding to the original image comprises: obtaining a plurality of randomly generated matrices, and constructing a random matrix based on the plurality of matrices, wherein the plurality of matrices satisfy preset matrix constraints, and the matrix constraints constrain the dimensions of the plurality of matrices, and the position maximum and position minimum values ​​of the elements in the matrices; obtaining a first reference position matrix and a second reference position matrix at a current moment based on the random matrix; the step of obtaining a target pixel position matrix corresponding to the initial pixel position matrix comprises: projecting the first reference position matrix and the second reference position matrix onto a preset constraint set to obtain corresponding performance indicators; and determining a target pixel position matrix at a next moment based on the performance indicators and the random matrix; A modification module, configured to obtain pixel points of the target pixel position matrix within a preset modification range and modify the color parameter values ​​of the pixel points to obtain an anti-attack image; The second determination module is used to perform image classification on the original image and the adversarial attack image respectively through a preset image classification model to obtain corresponding performance indicators, and determine whether the image classification attack of the adversarial attack image is successful based on the performance indicators.

7. A terminal device, characterized in that: The terminal device includes a memory, a processor, and an image classification anti-attack program stored in the memory and runnable on the processor. When the image classification anti-attack program is executed by the processor, the steps of the image classification anti-attack method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores an image classification adversarial attack program, which, when executed by a processor, implements the steps of the image classification adversarial attack method according to any one of claims 1 to 5.

Images