A data processing method, device, and readable storage medium

Abstract

The application discloses a data processing method, equipment and readable storage medium. The method comprises the following steps: obtaining a first adversarial sample image and a sample category label corresponding to the first adversarial sample image; determining a first domain gradient for a first type domain according to the first adversarial sample image and the sample category label; the first type domain is a null domain or a frequency domain; generating an intermediate adversarial sample image according to the first domain gradient and the first adversarial sample image; determining a second domain gradient for a second type domain according to the intermediate adversarial sample image and the sample category label; the second type domain is different from the first type domain, and there is a conversion relationship between the first type domain and the second type domain; generating a second adversarial sample image according to the second domain gradient and the intermediate adversarial sample image, and evaluating a target image model based on the second adversarial sample image. By using the application, the attack and effectiveness of the adversarial sample can be improved, and the efficiency and accuracy of model detection can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data processing method, apparatus, and readable storage medium. Background Technology

[0002] With the continuous development of computer technology, deep learning has been widely applied in various technical fields, such as image classification, object detection, and machine translation.

[0003] In deep learning, adversarial examples exist. Machine learning methods are highly sensitive to these adversarial examples, which are very similar to clean examples. However, trained models (such as image classification models, object detection models, etc.) can easily misclassify these adversarial examples. For example, a model might initially classify an image as a panda with 60% confidence, but after adding a small perturbation to the image to obtain an adversarial example, the model might classify it as a monkey with 99% confidence. Due to the aggressive nature of adversarial examples, they are often used to test models and determine their safety and reliability.

[0004] As discussed above, the aggressiveness and stealth of adversarial examples are crucial to the model detection process. However, existing solutions typically use raw adversarial examples without added interference, or adversarial examples with simple added interference, for model detection. These either lack sufficient interference or aggressiveness, resulting in inaccurate detection results and potentially leading to repeated detections, making model detection inefficient. Summary of the Invention

[0005] This application provides a data processing method, apparatus, and readable storage medium that can improve the offensiveness and effectiveness of adversarial examples, thereby improving the efficiency and accuracy of model detection.

[0006] One embodiment of this application provides a data processing method, including:

[0007] Obtain the first adversarial sample image and the corresponding sample category label; the sample category label is the opposite of the true category label of the first adversarial sample image.

[0008] Based on the first adversarial sample image and the sample category label, determine the first domain gradient for the first type domain; the first type domain is either the spatial domain or the frequency domain.

[0009] Based on the gradient of the first domain and the first adversarial sample image, generate intermediate adversarial sample images;

[0010] Based on the intermediate adversarial sample images and sample category labels, determine the second domain gradient for the second type domain; the second type domain is different from the first type domain, and there is a transformation relationship between the first type domain and the second type domain;

[0011] Based on the gradient of the second domain and the intermediate adversarial sample image, a second adversarial sample image is generated, and the target image model is evaluated based on the second adversarial sample image.

[0012] One embodiment of this application provides a data processing apparatus, including:

[0013] The sample acquisition module is used to acquire a first adversarial sample image and the corresponding sample category label; the sample category label is the opposite of the true category label of the first adversarial sample image.

[0014] The first gradient determination module is used to determine the first domain gradient for the first type domain based on the first adversarial sample image and the sample category label; the first type domain is either the spatial domain or the frequency domain.

[0015] The intermediate sample generation module is used to generate intermediate adversarial sample images based on the first domain gradient and the first adversarial sample image;

[0016] The second gradient determination module is used to determine the second domain gradient for the second type domain based on the intermediate adversarial sample image and the sample category label; the second type domain is different from the first type domain, and there is a transformation relationship between the first type domain and the second type domain;

[0017] The adversarial example generation module is used to generate a second adversarial example image based on the second domain gradient and the intermediate adversarial example image;

[0018] The model evaluation module is used to evaluate the target image model based on the second adversarial sample image.

[0019] In one embodiment, the first gradient determination module includes:

[0020] A frequency domain transformation unit is used to obtain the initial adversarial noise when the first type domain is the frequency domain;

[0021] The frequency domain transformation unit is also used to perform frequency domain transformation on the first adversarial sample image based on the initial adversarial noise to obtain a frequency domain transformed image;

[0022] The first category output unit is used to input the frequency domain transformed image into the target image model and output the first predicted image category corresponding to the frequency domain transformed image through the target image model;

[0023] The first gradient determination unit is used to determine the first domain gradient for the first type domain based on the first predicted image category and the sample category label.

[0024] In one embodiment, the frequency domain conversion unit includes:

[0025] The image transformation subunit is used to perform discrete cosine transform on the first adversarial sample image to obtain the transformed sample image.

[0026] A noise addition subunit is used to add initial adversarial noise to the first transformed sample image to obtain a noisy sample image;

[0027] The image inverse transform subunit is used to perform discrete cosine inverse transform on the noisy sample image to obtain the frequency domain transformed image.

[0028] In one embodiment, the noise-adding sub-unit is also specifically used to obtain the mask matrix corresponding to the initial adversarial noise;

[0029] The noise addition sub-unit is also specifically used to perform matrix operations on the initial adversarial noise and the mask matrix to obtain the first operational adversarial noise;

[0030] The noise addition sub-unit is also specifically used to fuse the first operational adversarial noise with the transformed sample image to obtain a noise sample image.

[0031] In one embodiment, the first gradient determination unit includes:

[0032] The first loss value determination subunit is used to obtain the first loss function corresponding to the frequency domain, and determine the first loss value corresponding to the first predicted image category based on the first loss function, the first predicted image category, and the sample category label.

[0033] The first domain gradient determination subunit is used to determine the first gradient value for the first adversarial sample image based on the first loss value and the first adversarial sample image, and to determine the first gradient value as the first domain gradient.

[0034] In one embodiment, the intermediate sample generation module includes:

[0035] The noise update unit is used to update the initial adversarial noise according to the gradient of the first domain to obtain the updated adversarial noise;

[0036] The matrix operation unit is used to obtain the mask matrix corresponding to the updated adversarial noise, and to perform matrix operations on the updated adversarial noise and the mask matrix to obtain the second operational adversarial noise;

[0037] The transformed image acquisition unit is used to acquire the transformed sample image obtained by performing discrete cosine transform on the first adversarial sample image during the frequency domain transformation of the first adversarial sample image based on the initial adversarial noise.

[0038] The image noise fusion unit is used to fuse the second operational adversarial noise with the transformed sample image, and determine the intermediate adversarial sample image based on the fused image.

[0039] In one embodiment, the second gradient determination module includes:

[0040] The image input unit is used to input the intermediate adversarial sample image into the target image model when the first type domain is the frequency domain and the second type domain is the spatial domain, and output the second predicted image category corresponding to the intermediate adversarial sample image through the target image model;

[0041] The second loss value determination unit is used to obtain the second loss function corresponding to the spatial domain, and determine the second loss value corresponding to the second predicted image category based on the second loss function, the second predicted image category, and the sample category label.

[0042] The second gradient determination unit is used to determine the second gradient value for the intermediate adversarial sample image based on the second loss value and the intermediate adversarial sample image, and to determine the second gradient value as the second domain gradient.

[0043] In one embodiment, the adversarial example generation module includes:

[0044] The function acquisition unit is used to acquire the gradient image update function indicated by the spatial domain, and to acquire the gradient transformation function based on the gradient image update function;

[0045] The gradient transformation unit is used to perform gradient transformation on the gradient of the second domain through the gradient transformation function to obtain the gradient transformation value corresponding to the gradient of the second domain.

[0046] The sample generation unit is used to calculate the perturbation coefficient and the gradient transformation value in the gradient image update function to obtain the perturbation gradient value.

[0047] The sample generation unit is also used to fuse intermediate adversarial sample images with perturbation gradient values ​​to obtain gradient fused sample images;

[0048] The image adjustment unit is used to adjust the gradient fusion sample image to obtain the second adversarial sample image.

[0049] In one embodiment, the image adjustment unit includes:

[0050] The standard acquisition subunit is used to acquire image standard rules; the image standard rules include the standard image size corresponding to the model evaluation image, which is the image used to evaluate the target image model.

[0051] The size adjustment subunit is used to adjust the image size of the gradient fusion sample image to the standard image size according to the standard image size;

[0052] The image determination subunit is used to determine the gradient fusion sample image with the image size being the standard image size as the second adversarial sample image.

[0053] In one embodiment, the data processing apparatus further includes:

[0054] The iteration count acquisition module is used to obtain the number of image iterations corresponding to the second adversarial sample image;

[0055] The step execution module is used to perform the step of evaluating the target image model based on the second adversarial sample image if the number of image iterations is greater than the number of iterations threshold.

[0056] The domain switching module is used to switch the first type domain to the second type domain and vice versa if the number of image iterations is less than the iteration threshold.

[0057] The image iteration module is used to determine the first domain update gradient for the second type domain based on the second adversarial sample image and the sample category label, and to generate an intermediate updated adversarial sample image based on the first domain update gradient and the second adversarial sample image.

[0058] The image iteration module is also used to determine the second domain update gradient for the first type domain based on the intermediate updated adversarial sample image and the sample category label, generate the third adversarial sample image based on the second domain update gradient and the intermediate updated adversarial sample image, and evaluate the target image model based on the third adversarial sample image.

[0059] In one embodiment, the adversarial sample images used to evaluate the target image model include a set of target adversarial sample images, which includes N adversarial sample images, and the N adversarial sample images include a second adversarial sample image; N is a positive integer;

[0060] The model evaluation module includes:

[0061] The category output unit is used to input the second adversarial sample image into the target image model and output the target predicted image category corresponding to the second adversarial sample image through the target image model;

[0062] The prediction result determination unit is used to obtain the true class label corresponding to the second adversarial sample image;

[0063] The prediction result determination unit is also used to determine the model prediction result of the target image model for the second adversarial example image based on the true category label and the target predicted image category;

[0064] The evaluation result determination unit is used to determine the evaluation result of the target image model based on the model prediction results corresponding to N adversarial sample images.

[0065] In one embodiment, the prediction result determination unit is further specifically used to determine the model prediction result of the target image model for the second adversarial sample image as a prediction failure result if the true category label is different from the target predicted image category.

[0066] The prediction result determination unit is also specifically used to determine the model prediction result of the target image model for the second adversarial sample image as a successful prediction result if the true category label is the same as the target predicted image category.

[0067] In one embodiment, the evaluation result determination unit includes:

[0068] The statistical subunit is used to identify the prediction failures among the prediction results of N models as failures to be counted.

[0069] The quantity statistics subunit is also used to count the number of failed results to be counted, as well as the total number of results predicted by N models;

[0070] The ratio determination subunit is used to determine the ratio between the number of failed results and the total number of results.

[0071] The result determines the sub-unit, which is used to obtain an evaluation result indicating that the target image model is an unreliable model if the quantity ratio is greater than the ratio threshold;

[0072] The result determines the sub-unit and is also used to obtain an evaluation result indicating that the target image model is a reliable model if the quantity ratio is less than the ratio threshold.

[0073] One embodiment of this application provides a computer device, including: a processor and a memory;

[0074] The memory stores a computer program, which, when executed by a processor, causes the processor to perform the methods described in the embodiments of this application.

[0075] One aspect of this application provides a computer-readable storage medium storing a computer program, which includes program instructions. When executed by a processor, the program instructions perform the methods described in this application.

[0076] One aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method provided in one aspect of the embodiments of this application.

[0077] In this embodiment, for a certain adversarial sample image (such as a first adversarial sample image), this application can first determine the first domain gradient (the first type domain is the spatial domain or the frequency domain) for a first type domain based on its sample category label; then generate an intermediate adversarial sample image based on the first domain gradient and the first adversarial sample image; subsequently, a second domain gradient for a second type domain can be determined based on the intermediate adversarial sample image and its sample category label; a second adversarial sample image can be generated based on the second domain gradient and the intermediate adversarial sample image, and the generated second adversarial sample image can be used to evaluate the target image model. It should be understood that the sample class label is the opposite of the true class label of the adversarial sample image. In training adversarial sample images, this application can calculate the domain gradients (such as spatial and frequency domains) of different types of domains using the opposite labels of the adversarial sample images. Based on these domain gradients, the adversarial sample images are updated sequentially. This makes the gradient-updated images increasingly closer to the opposite label category, effectively improving the aggressiveness and stealth of the adversarial sample images in multiple types of domains (such as spatial and frequency domains). When the adversarial sample image possesses high aggressiveness and stealth, its attack effect is more effective. When using adversarial sample images with high aggressiveness to evaluate the model, the accuracy of the model's evaluation results can be improved, and multiple model evaluations are unnecessary, thus improving the efficiency of model evaluation. In summary, by combining different types of domains (such as spatial and frequency domains) for training and updating adversarial sample images, this application can add interference information from different types of domains to the adversarial sample images, thereby improving the aggressiveness and effectiveness of the adversarial sample images, and consequently improving the accuracy and efficiency of model evaluation. Attached Figure Description

[0078] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0079] Figure 1 This is a network architecture diagram provided in an embodiment of this application;

[0080] Figure 2 This is a schematic diagram of a scenario provided in an embodiment of this application;

[0081] Figure 3 This is a flowchart illustrating a data processing method provided in an embodiment of this application;

[0082] Figure 4This is a schematic diagram illustrating a frequency domain conversion of an image according to an embodiment of this application;

[0083] Figure 5 This is an architecture diagram of image iteration provided in an embodiment of this application;

[0084] Figure 6 This is a schematic diagram of a model detection process provided in an embodiment of this application;

[0085] Figure 7 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0086] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0087] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0088] This application incorporates concepts related to artificial intelligence. For ease of understanding, artificial intelligence and its related concepts will be explained below.

[0089] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0090] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0091] With the development of artificial intelligence technology, applications of automatic classification and recognition based on AI are becoming increasingly widespread, such as image recognition and classification, speech classification, and text recognition and classification. Image classification and recognition includes identifying key parts of an object in an image (such as a face) and classifying an object in an image (such as classifying animals, plants, buildings, etc.); text recognition and classification includes automatically classifying the content of text into topics, etc.

[0092] Specifically, AI-based automatic classification and recognition is achieved through a neural network model. The neural network model is first trained using samples, and then the trained neural network model is used for classification and recognition.

[0093] For neural network models used for classification, adversarial training using adversarial examples is generally necessary to improve their robustness and resistance to interference. Adversarial examples are samples that intentionally introduce subtle perturbations into normal samples, creating samples that can mislead the neural network model's decision-making. Adversarial training involves training the neural network model with adversarial examples so that it can learn to resist local perturbations and improve its resistance to interference.

[0094] The solutions provided in this application belong to the fields of computer vision (CV) and machine learning (ML) within the field of artificial intelligence.

[0095] Computer vision (CV) is the science that studies how to enable machines to "see." More specifically, it refers to the use of cameras and computers to identify and measure targets using machine vision, and then to perform image processing to create images more suitable for observation or transmission to instruments for detection. As a scientific discipline, computer vision studies related theories and technologies, attempting to build artificial intelligence systems capable of extracting information from images or multi-dimensional data. Computer vision technologies typically include image processing, image recognition, image semantic understanding, image retrieval, OCR, video processing, video semantic understanding, video content / behavior recognition, 3D object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping (SLAM), and other technologies.

[0096] Machine Learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0097] The solution proposed in this application can generate adversarial examples for the model, making the generated adversarial examples more aggressive and disruptive, thereby enabling more efficient and accurate adversarial training or testing and evaluation of the model, and thus improving the model's anti-interference ability.

[0098] Please see Figure 1 , Figure 1 This is a schematic diagram of a network architecture provided in an embodiment of this application. Figure 1 As shown, this network architecture may include a service server 1000 and a terminal device cluster (i.e., a terminal device cluster). This terminal device cluster may include one or more terminal devices; the number of terminal devices is not limited here. Figure 1 As shown, the multiple terminal devices may specifically include terminal device 100a, terminal device 100b, terminal device 100c, ..., terminal device 100n. For example... Figure 1 As shown, terminal devices 100a, 100b, 100c, ..., 100n can each connect to the aforementioned service server 1000 via a network, enabling each terminal device to interact with the service server 1000 through this network connection. The network connection method is not limited; it can be a direct or indirect connection via wired communication, a direct or indirect connection via wireless communication, or other methods. This application does not impose any restrictions on this method.

[0099] like Figure 1 Each terminal device shown can integrate and install the target application. When the target application runs on each terminal device, the backend server corresponding to each terminal device can store the business data in the application and connect it with the aforementioned... Figure 1The business servers 1000 shown interact with each other. The target application can include applications with the ability to display text, images, audio, and video data. For example, the application can be a multimedia application (such as a video application), used for users to upload pictures or videos, or for users to play and view images or videos uploaded by others; the application can also be an entertainment application (such as a game application), used for users to play games. The application can also be other applications with data processing capabilities, such as browser applications, social applications, image enhancement applications, etc., which will not be listed here. The target application can also be a mini-program, that is, a standalone program that only needs to be downloaded to a browser environment to run. Of course, the target application can be a standalone application or a sub-application (such as a mini-program) embedded in an application, which can be controlled by the user to run or close. In short, the target application can be any form of application, module, or plugin, without limitation.

[0100] This application embodiment can select one terminal device from multiple terminal devices as the target terminal device. This terminal device may include: smartphones, tablets, laptops, desktop computers, smart TVs, smart speakers, desktop computers, smartwatches, smart vehicles, and other smart terminals with data processing functions (such as image data processing functions), but is not limited to these. For example, this application embodiment can... Figure 1 The terminal device 100a shown is the target terminal device. The target terminal device can integrate the above-mentioned target application. At this time, the target terminal device can interact with the business server 1000.

[0101] For example, when a user uses a target application (such as an image enhancement application) on a terminal device, the business server 1000 can detect and collect a target image uploaded by the user that contains a target object (such as the user or other objects such as an animal). The business server 1000 can identify the region to which the target object belongs in the target image and extract that region from the target image to obtain an image that only contains the target object and not the background (which can be called the target region image). Subsequently, the business server 1000 can perform further processing on the target region image that only contains the target object (such as adding special effects or beautification processing, etc.) to obtain a target region image with special effects or beautification effects (such as makeup effects, etc.). Then, the business server 1000 can put the target region image with special effects or beautification effects back into the region to which the target object belongs in the target image to obtain the target processed image with special effects or beautification effects corresponding to the target image. Subsequently, the business server 1000 can return the processed target image to the terminal device, so that the user can view the processed target image (the target object with special effects or beautification effects) on the display page of the terminal device.

[0102] Specifically, the method for business server 1000 to identify the region to which the target object belongs in the target image can be handled by a target image model (such as a target image recognition model). To improve the accuracy of image recognition, the image model can be trained to achieve its optimal state. Based on this trained target image model, image recognition processing (such as identifying the region to which the target object belongs in the target image) can be performed. Furthermore, to further improve the recognition accuracy of the image model, it can be tested and evaluated based on adversarial examples before being deployed. Only after the target image model passes the detection can it be deployed.

[0103] In one embodiment of this application, the service server 1000 can obtain adversarial samples uploaded by a terminal device (such as a target terminal device). For example, for an image model, the adversarial sample can be an adversarial sample image, referred to as a first adversarial sample image. The service server 1000 can use the method provided in this application to perform sample training and adjustment on the first adversarial sample image to generate an adversarial sample image with higher offensiveness and interference (such as a second adversarial sample image). Subsequently, the service server 1000 can return the second adversarial sample image to the terminal device, so that the terminal device can use the second adversarial sample image to detect and evaluate the target image model, or to further adversarially train the target image model (e.g., when the detection and evaluation fail, adversarial training of the target image model is performed using the second adversarial sample image to improve the anti-interference ability and recognition accuracy of the target image model). In some embodiments of this application, after generating the second adversarial sample image, the service server can also use the second adversarial sample image to detect and evaluate the target image model, or to perform adversarial training of the target image model.

[0104] It should be understood that when adversarial sample images are more aggressive and disruptive, the detection results evaluated through such adversarial sample images can be more accurate.

[0105] It should be noted that the method for training adversarial examples provided in this application embodiment is generally executed by the service server 1000, and correspondingly, the apparatus for training adversarial examples is generally located in the service server 1000. However, in other embodiments, the terminal device may also have similar functions to the service server, thereby executing the method for training adversarial examples provided in this application embodiment.

[0106] It is understood that the methods provided in this application embodiment can be executed by computer devices, including but not limited to terminal devices or business servers. The business server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0107] The terminal equipment and the business server can be connected directly or indirectly through wired or wireless communication, and this application does not impose any restrictions on this.

[0108] Optionally, and understandably, the aforementioned computer devices (such as the aforementioned business server 1000, terminal device 100a, terminal device 100b, etc.) can be nodes in a distributed system. This distributed system can be a blockchain system, formed by connecting multiple nodes through network communication. The nodes can form a peer-to-peer (P2P) network, where the P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP). In this distributed system, any type of computer device, such as a business server or terminal device, can become a node in the blockchain system by joining this peer-to-peer network. For ease of understanding, the concept of blockchain is explained below: Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. It is mainly used to organize data in chronological order and encrypt it into a ledger, making it tamper-proof and forgery-proof, while also enabling data verification, storage, and updating. When a computer device is a blockchain node, the immutability and anti-counterfeiting characteristics of the blockchain can ensure the authenticity and security of the data in this application (such as uploaded image data like target images, adversarial sample images, adversarial sample images after training and adjustment, etc.), thereby making the results obtained after processing the data more reliable.

[0109] It should be noted that, in the specific embodiments of this application, data related to user information and user data (such as uploaded images and videos) requires user authorization before it can be obtained. In other words, when the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0110] The embodiments of this application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving. For ease of understanding, please refer to [link to relevant documentation]. Figure 2 , Figure 2 This is a schematic diagram of a scenario provided in an embodiment of this application. Wherein, as... Figure 2 The business server 200 shown can be the one described above. Figure 1 The business server 1000 shown, and as Figure 2 The terminal device 100a shown can be used in the above-mentioned Figure 1 Any terminal device selected in the terminal device cluster of the corresponding embodiment, for example, the terminal device can be the aforementioned terminal device 100b.

[0111] like Figure 2 As shown, user A can be the target user. User A uploads an image 20a through terminal device 100a. This image 20a includes the target object B, and can be considered a target image. The business server can receive this target image 20a through the backend server of terminal device A. Subsequently, the business server can input the target image 20a into a target image model (such as a target image recognition model). The target image recognition model can then identify the region where the target object B is located in the target image 20a. Figure 2 The target image recognition model identifies the region where the target object B is located in the target image 20a as region P (i.e., the region contained by the boundary of the target object B). The target image recognition model can extract the region P containing the target object B. Subsequently, the business server can disregard other regions in the target image 20a except for region P and only perform special effects processing on the target object B in region P.

[0112] like Figure 2 As shown, the service server adds a "cat effect" to target object B in region P. Furthermore, the service server can place this target object B with the "cat effect" back into region P of target image 20a, thus obtaining target image 20a with the "cat effect". This target image 20a with the "cat effect" is shown below. Figure 2 As shown, the business server can then return the target image 20a with the "cat effect" to the terminal device A, and user A can view the target image 20a with the "cat effect" on the display page of the terminal device A.

[0113] It should be noted that any object in the target image in this application can be used as the target object. For example, the other objects included in the target image 20a besides the target object B (such as the convenience store) can also be used as the target object. The target image recognition model can also perform image recognition processing on other target objects besides the target object B at the same time.

[0114] Understandably, to improve the accuracy of image recognition, image models can be trained to optimize the target image model. Based on this trained model, image recognition processing (such as identifying the region to which a target object belongs) can be performed. To further improve the recognition accuracy, the target image model can be evaluated using adversarial examples before being applied (e.g., in image recognition processing). Only after passing the adversarial example test can the model be applied. This application provides a training method for adversarial examples to enhance their aggressiveness and interference. When the adversarial examples are more aggressive and interference-prone, the detection results obtained through these adversarial example images are more accurate, thereby further improving the accuracy of the target image model. For specific methods on training and adjusting adversarial examples to obtain more aggressive and interference-prone examples, please refer to the following sections. Figure 3 The description in the corresponding embodiments.

[0115] Furthermore, for ease of understanding, please refer to Figure 3 , Figure 3 This is a flowchart illustrating a data processing method provided in an embodiment of this application. The method can be implemented by a terminal device (e.g., the one described above). Figure 1 The execution can be performed by any terminal device in the terminal device cluster shown, such as terminal device 100a, or by a terminal device and a service server (as described above). Figure 1 The corresponding business server 1000 in the embodiment executes the method together. For ease of understanding, this embodiment uses the execution of the method by the aforementioned terminal device as an example. The image processing method may include at least the following steps S101-S105:

[0116] Step S101: Obtain the first adversarial sample image and the sample category label corresponding to the first adversarial sample image; the sample category label is the opposite of the true category label of the first adversarial sample image.

[0117] In this application, the first adversarial sample image can refer to the original image without added interference information (or the original image with added interference information). This first adversarial sample image can contain a target object (such as an animal, plant, building, etc.). For the adversarial sample image (such as the first adversarial sample image), image recognition can be performed. For example, image recognition can be performed using a trained target image model to identify the object category to which the target object belongs (such as animal category, plant category, building category; or subcategories within animal category, plant category, and building category, such as bird subcategories, avian subcategories, etc. within the animal category). It can also identify the category to which key parts of the target object belong. These key parts can be defined according to the object category of the target object. For example, when the object category of the target object is animal, the key part can be a hand, neck, head, leg, foot, etc.; while when the object category of the target object is plant, the key part can refer to stems and leaves, roots, etc. In other words, the key parts can be flexibly defined according to different target objects. Examples of each key part will not be provided here. Of course, image recognition of adversarial sample images (such as the first adversarial sample image) can also be performed in other ways. For example, image recognition can be performed using a target image model to identify the location of the key parts of the target object in the target image. Alternatively, image recognition can be performed using a target image model to identify whether the key parts of the target object are post-composite parts (i.e., the key parts of the target object in the image have undergone post-processing or editing. When the key parts are post-composite parts, the target object can be a post-composite object, and its corresponding image can also be a post-composite image).

[0118] It is understandable that after performing image recognition on the first adversarial sample image through the target image model, the model can output the predicted data (such as the predicted object category, the predicted object region, etc.). This application can detect the performance of the model and determine whether the target image model has sufficient prediction accuracy based on the predicted data output by the model and the original category label (also known as the true category label) corresponding to the first adversarial sample image. The original category label can be determined based on the image recognition function of the target image model. For example, when the image recognition function of the target image model is to predict the object category of a target object in an image (such as the first adversarial sample image), the predicted data output by the model is the predicted object category of the target object in the image (such as gibbon), and the original category label can be the real object category of the target object (such as gorilla). As another example, when the image recognition function of the target image model is to predict whether an image (such as the first adversarial sample image) is a post-synthesized image, the predicted data output by the model can be a true or false category (a true category can indicate that the image is not a post-synthesized image, which can be represented by the value 1, and a false category can indicate that the image is a post-synthesized image, which can be represented by the value 0), and the original category label can be a false category (that is, the image is actually a post-synthesized image).

[0119] It should be understood that adversarial example images can be used to detect and evaluate target image models to assess model performance. To more efficiently and accurately evaluate the model, adversarial example images can be used for training to increase their interference and offensiveness, making it difficult for the target image model to accurately recognize them (i.e., the predicted data output by the target image model is highly prone to errors). If the target image model can still accurately recognize an adversarial example image despite its high offensiveness and interference, then the target image model has high accuracy and performance, making it suitable for application. In this application, taking the first adversarial example image as an example, to improve its offensiveness and interference, the opposite label corresponding to the true category label of the first adversarial example image can be obtained. This opposite label can be used as the category label (referred to as the sample category label) for training the first adversarial example image. For example, if the true category label is "hand," then the sample category label could be any other body part other than the hand (such as the foot, neck, etc.). Conversely, if the true category label is a false category (e.g., the first adversarial sample image is a post-synthesized image), then the sample category label could be the true category (the first adversarial sample image is not a post-synthesized image). Therefore, by using the opposite label as the training target, the first adversarial sample image can be made to increasingly resemble the opposite category of the true category, thereby significantly improving the interference and aggressiveness of the adversarial sample image.

[0120] As can be seen from the above, if this application wishes to improve the aggressiveness and interference of the first adversarial sample image after obtaining it, thereby enhancing its effectiveness, it can obtain the sample category label of the first adversarial sample image and train and adjust the first adversarial sample image using the sample category label.

[0121] Step S102: Determine the first domain gradient for the first type domain based on the first adversarial sample image and the sample category label; the first type domain is either the spatial domain or the frequency domain.

[0122] In this application, the type domain can refer to the space composed of a certain feature of an image, that is, the type domain can be used to describe the image features of an image (such as the first adversarial sample image). The spatial domain can be the space composed of the pixels of an image, and the spatial domain can be used to describe the features of the image at the pixels. For example, the spatial domain can include the RGB color space, which can be used to describe the pixel features of the image in the red, green, and blue channels. The frequency domain can be the space composed of the frequencies of an image, and can be used to describe the features of the image at the frequency. The frequency domain can characterize the index of the degree of gray-level change in the image, which can be the gradient of the image in the planar space. The first type domain in this application can be the spatial domain or the frequency domain. Of course, in addition to the spatial domain or the frequency domain, the first type domain can also be other image domains used to describe image features (such as the time domain, etc.), and there is no limitation on this.

[0123] In this application, the domain gradient (referred to as the first domain gradient) for a first type domain can be determined based on the first adversarial sample image and the sample category label. When the first type domain is the frequency domain, the first domain gradient here can refer to the frequency domain gradient; when the first type domain is the spatial domain, the first domain gradient here can refer to the spatial domain gradient. For the frequency domain gradient, this application can perform a frequency domain transformation on the first adversarial sample image based on the initial adversarial noise, obtain a frequency domain transformed image, and then input the frequency domain transformed image into the target image model. The frequency domain gradient can be determined by the predicted image category (referred to as the first predicted image category) output by the target image model and the sample category label. For the spatial domain gradient, this application can input the first adversarial sample image into the target image model, and determine the spatial domain gradient by the predicted image category (referred to as the spatial domain predicted image category) output by the target image model and the sample category label.

[0124] When the first type domain is the frequency domain, the specific implementation of determining the first domain gradient for the first type domain based on the first adversarial sample image and the sample category label can be as follows: When the first type domain is the frequency domain, initial adversarial noise can be obtained, and the first adversarial sample image can be frequency-converted based on the initial adversarial noise to obtain a frequency-converted image; subsequently, the frequency-converted image can be input into the target image model, and the target image model can output the first predicted image category corresponding to the frequency-converted image; based on the first predicted image category and the sample category label, the first domain gradient (i.e., the frequency domain gradient) for the first type domain can be determined.

[0125] Specifically, the method for performing frequency domain transformation on the first adversarial sample image based on initial adversarial noise to obtain a frequency domain transformed image can be as follows: the first adversarial sample image can be subjected to discrete cosine transform to obtain a transformed sample image; then, initial adversarial noise can be added to the first transformed sample image to obtain a noisy sample image; then, the noisy sample image can be subjected to inverse discrete cosine transform to obtain the frequency domain transformed image.

[0126] Specifically, the method for adding initial adversarial noise to the first transformed sample image to obtain a noisy sample image can be as follows: A mask matrix corresponding to the initial adversarial noise can be obtained; subsequently, matrix operations can be performed on the initial adversarial noise and the mask matrix to obtain the first operational adversarial noise; the first operational adversarial noise can be fused with the transformed sample image to obtain the noisy sample image. Based on this, the method for determining the first domain gradient for the first type domain based on the first predicted image category and sample labels can be as follows: A first loss function corresponding to the frequency domain can be obtained; based on the first loss function, the first predicted image category, and the sample category label, the first loss value corresponding to the first predicted image category can be determined; subsequently, based on the first loss value and the first adversarial sample image, the first gradient value for the first adversarial sample image can be determined, and the first gradient value can be defined as the first domain gradient.

[0127] To facilitate understanding of the specific method for performing frequency domain transformation on the first adversarial sample image based on adversarial noise to obtain the frequency domain transformed image, please refer to [link to relevant documentation]. Figure 4 , Figure 4 This is a schematic diagram illustrating a frequency domain conversion of an image according to an embodiment of this application. Figure 4As shown, for a specific adversarial sample image (such as the first adversarial sample image), it can be input into the DCT transform module. This module performs a Discrete Cosine Transform (DCT) on the image, resulting in a transformed sample image. Subsequently, the transformed sample image can be input into the noise addition module, which adds adversarial noise (such as initial adversarial noise) to obtain a noisy sample image. Then, the noisy sample image can be input into the inverse DCT transform module, which performs an inverse Discrete Cosine Transform (IDCT) on the image, ultimately yielding the frequency domain transformed image corresponding to the adversarial sample image.

[0128] It is understandable that, for the DCT transform, we can divide the adversarial sample image (such as the first adversarial sample image) into many k×k square regions, and then apply the transform as shown in formula (1) to each region:

[0129]

[0130] in, It can be used to characterize the transformed image obtained after DCT transformation processing. X(i,j) can be used to characterize the pixel point with coordinate position (i,j) in the image. N can be used to characterize the size of each square region.

[0131] Furthermore, after determining the transformed sample image after DCT transformation, in order to improve the realism of the adversarial sample image (enhance the interference of the adversarial sample image), this application can add adversarial noise (such as initial adversarial noise) to the transformed sample image after DCT transformation using a mask matrix (map). For ease of understanding, the specific implementation of adding adversarial noise (such as initial adversarial noise) to the transformed sample image to obtain the noise sample image can be shown in formula (2):

[0132]

[0133] Among them, as shown in formula (2) It can be used to characterize an adversarial sample image (such as the first adversarial sample image); It can be used to characterize noisy sample images after adding adversarial noise; It can be used to characterize transformed sample images after DCT transformation; It can be used to characterize a mask matrix map. It can be used to characterize adversarial noise (such as initial adversarial noise). It can be used to characterize and The Hadamard product operation is performed between them.

[0134] Therefore, according to the above formula (2), the first operational adversarial noise can be obtained by performing matrix operations on the initial adversarial noise and the mask matrix, and the first operational adversarial noise can be obtained by performing Hadamard product operations on the initial adversarial noise and the mask matrix. The first operational adversarial noise can be fused with the transformed sample image to obtain the noise sample image. The noise sample image can be obtained by adding the first operational adversarial noise to the transformed sample image. After performing IDCT transformation on the noise sample image, the final frequency domain transformed image can be obtained.

[0135] Furthermore, after inputting the frequency domain transformed image into the target image model, the target image model can output a predicted image category (which can be called the first predicted image category). Based on the first predicted image category, the sample category label, and the loss function corresponding to the frequency domain (which can be any loss function that calculates the loss, such as the cross-entropy loss function), the frequency domain loss value (which can be called the first loss value) can be determined. The gradient of this frequency domain loss value with respect to the first adversarial sample image is calculated (for computer devices, each image can be understood as a parameter (such as a matrix) that the computer device can understand, so after determining the frequency domain loss value, the gradient value can be obtained by taking the derivative with respect to the first adversarial sample image), thereby determining the frequency domain gradient (first domain gradient).

[0136] Taking the first type domain as an example of the spatial domain, the gradient of the first domain can be the spatial gradient. The specific implementation of determining the gradient of the first domain for the first type domain based on the first adversarial sample image and sample category labels can be as follows: The first adversarial sample image can be input into the target image model. The target image model can output the predicted image category (which can be called the spatial domain predicted image category). Based on this spatial domain predicted image category, the sample category label, and the corresponding loss function (which can be any loss function that calculates the loss, such as the cross-entropy loss function), the spatial domain loss value (which can be called the spatial domain loss value) can be determined. The gradient of this spatial domain loss value with respect to the first adversarial sample image can be calculated (for computer devices, each image can be understood as a parameter (such as a matrix) that the computer device can understand; therefore, after determining the spatial domain loss value, the gradient value can be obtained by taking the derivative with respect to the first adversarial sample image), thus determining the spatial gradient.

[0137] Step S103: Generate intermediate adversarial sample images based on the gradient of the first domain and the first adversarial sample image.

[0138] In this application, after determining the first domain gradient as described above, an intermediate adversarial sample image can be generated based on the first domain gradient and the first adversarial sample image. Taking the first type domain as the frequency domain and the first domain gradient as the frequency domain gradient as an example, the specific implementation of generating an intermediate adversarial sample image based on the first domain gradient and the first adversarial sample image can be as follows: the initial adversarial noise can be updated according to the first domain gradient to obtain updated adversarial noise; subsequently, the mask matrix corresponding to the updated adversarial noise can be obtained, and matrix operations can be performed between the updated adversarial noise and the mask matrix to obtain second operational adversarial noise; subsequently, the transformed sample image obtained by performing discrete cosine transform on the first adversarial sample image during the frequency domain transformation of the first adversarial sample image based on the initial adversarial noise can be obtained; the second operational adversarial noise and the transformed sample image can be fused, and the intermediate adversarial sample image can be determined based on the fused image.

[0139] It is understandable that after obtaining the first adversarial sample image, it can be frequency-domain transformed based on the initial adversarial noise to obtain the frequency-domain transformed image corresponding to the first adversarial sample image. During the frequency-domain transformation based on the initial adversarial noise, there is a step of performing a Discrete Cosine Transform (DCT) on the first adversarial sample image. By performing the DCT, the transformed image (which can be called the transformed sample image) can be obtained. Figure 4 As can be seen from the corresponding embodiments, the process of frequency domain transformation of the first adversarial sample image based on the initial adversarial noise actually includes adding noise to the transformed sample image obtained after DCT transformation based on the initial adversarial noise, and performing IDCT transformation. Therefore, after calculating the frequency domain gradient, this application can update the initial adversarial noise based on the frequency domain gradient to obtain updated adversarial noise; and based on the updated adversarial noise, the transformed sample image obtained after DCT transformation can be noise-added again, and then subjected to another IDCT transformation, thereby obtaining a new frequency domain transformed image, which can be used as the intermediate adversarial sample image. In other words, the process of transforming the transformed sample image obtained after DCT transformation based on the updated adversarial noise includes: performing calculations on the updated adversarial noise and the mask matrix corresponding to the updated adversarial noise to obtain operational adversarial noise (which can be called second operational adversarial noise); then fusing the second operational adversarial noise and the transformed sample image obtained after DCT transformation; and determining the new frequency domain transformed image (i.e., the intermediate adversarial sample image) based on the fused image. The specific process can be found above. Figure 4 The descriptions in the corresponding embodiments will not be repeated here.

[0140] Furthermore, for ease of understanding, please refer to Equation (3), which is the specific implementation of updating adversarial noise (such as initial adversarial noise) based on frequency domain gradient:

[0141]

[0142] Among them, as shown in formula (3) It can be used to characterize a specific adversarial noise (such as initial adversarial noise); It can be used to characterize and update adversarial noise; It can be used to characterize an adversarial sample image (such as the first adversarial sample image); It can be used to characterize noisy sample images after adding adversarial noise; Available

[0143] Domain loss value (such as the first loss value); It can be used to characterize the gradient value by differentiating the adversarial noise (such as the initial adversarial noise) with respect to the frequency domain loss value; y gt It can be used to characterize the sample category label corresponding to a certain adversarial sample image (such as an intermediate adversarial sample image); sign() can be used to characterize the sign function.

[0144] Taking the first type domain as a spatial domain and the first domain gradient as a spatial gradient as an example, the specific implementation of generating an intermediate adversarial sample image based on the first domain gradient and the first adversarial sample image can be as follows: the gradient image update function indicated by the spatial domain can be obtained, and the first adversarial sample image can be updated according to the gradient image update function to obtain the intermediate adversarial sample image. For a detailed description of the implementation, please refer to step S105 below.

[0145] Step S104: Determine the gradient of the second domain for the second type domain based on the intermediate adversarial sample image and the sample category label; the second type domain is different from the first type domain, and there is a transformation relationship between the first type domain and the second type domain.

[0146] In this application, when the first type domain is the spatial domain, the second type domain can be the frequency domain; and when the first type domain is the frequency domain, the second type domain can be the spatial domain. When the first type domain is the frequency domain, the first domain gradient is the frequency domain gradient. The intermediate adversarial sample image is a new frequency domain transformed image determined based on the frequency domain gradient and the first adversarial sample image. Based on the intermediate adversarial sample image and the sample category label, the spatial domain gradient (i.e., the second domain gradient) can be determined for the spatial domain. The specific implementation method for determining the spatial domain gradient based on the intermediate adversarial sample image and the sample category label is the same as the implementation method for determining the spatial domain gradient based on the first adversarial sample image and the sample category label in step S102 above. For ease of understanding, the specific implementation method for determining the spatial domain gradient based on the intermediate adversarial sample image and the sample category label will be described here. When the first type domain is the frequency domain and the second type domain is the spatial domain, the intermediate adversarial sample image can be input into the target image model. The target image model can output the second predicted image category corresponding to the intermediate adversarial sample image. Subsequently, the second loss function corresponding to the spatial domain can be obtained. Based on the second loss function, the second predicted image category, and the sample category label, the second loss value corresponding to the second predicted image category can be determined. Based on the second loss value and the intermediate adversarial sample image, the second gradient value for the intermediate adversarial sample image can be determined, and the second gradient value can be determined as the gradient of the second domain.

[0147] In other words, for intermediate adversarial sample images, this application inputs them into the target image model, which can output a predicted image category (referred to as the second predicted image category). Based on the second predicted image category, the sample category label, and the spatial loss function (which can be any loss function that calculates the loss, such as the cross-entropy loss function), the spatial loss value (referred to as the second loss value) can be determined. The gradient of this spatial loss value with respect to the intermediate adversarial sample image can be calculated (for computer devices, each image can be understood as a parameter (such as a matrix) that the computer device can understand; therefore, after determining the spatial loss value, the gradient value can be obtained by taking the derivative with respect to the intermediate adversarial sample image), thus determining the spatial gradient.

[0148] When the first type domain is the spatial domain, the first domain gradient is the spatial domain gradient. The intermediate adversarial sample image can be an image updated and determined based on the spatial domain gradient and the first adversarial sample image. Based on the intermediate adversarial sample image and the sample category label, the frequency domain gradient (i.e., the second domain gradient) can be determined for the frequency domain. The specific implementation method for determining the frequency domain gradient based on the intermediate adversarial sample image and the sample category label is the same as the implementation method for determining the frequency domain gradient based on the first adversarial sample image and the sample category label in step S102 above, and will not be repeated here.

[0149] Step S105: Generate a second adversarial sample image based on the second domain gradient and the intermediate adversarial sample image, and evaluate the target image model based on the second adversarial sample image.

[0150] In this application, when the gradient of the second domain is the gradient of the spatial domain, the specific implementation of generating the second adversarial sample image based on the gradient of the second domain and the intermediate adversarial sample image can be as follows: the gradient image update function indicated by the spatial domain can be obtained, and the gradient transformation function can be obtained based on the gradient image update function; then, the gradient transformation function can be used to perform gradient transformation on the gradient of the second domain to obtain the gradient transformation value corresponding to the gradient of the second domain; then, the perturbation coefficient in the gradient image update function can be calculated with the gradient transformation value to obtain the perturbation gradient value; the intermediate adversarial sample image and the perturbation gradient value can be fused to obtain the gradient fused sample image; the gradient fused sample image can be adjusted to obtain the second adversarial sample image.

[0151] The specific implementation of adjusting the gradient fusion sample image to obtain the second adversarial sample image can be as follows: image standard rules can be obtained; wherein, the image standard rules include the image standard size corresponding to the model evaluation image, the model evaluation image refers to the image used to evaluate the target image model; according to the image standard size, the image size of the gradient fusion sample image can be adjusted to the image standard size; the gradient fusion sample image with the image size of the image standard size can be determined as the second adversarial sample image.

[0152] However, when the gradient of the second domain is the gradient of the spatial domain, the specific implementation of generating the second adversarial sample image based on the gradient of the second domain and the intermediate adversarial sample image can be shown in formula (4):

[0153]

[0154] Among them, as shown in formula (4) It can be used to characterize a certain adversarial example image based on spatial gradient. The new adversarial sample image (e.g., the second adversarial sample image) obtained after updating (e.g., the intermediate adversarial sample image); y gt It can be used to characterize the sample category label corresponding to a certain adversarial sample image (such as an intermediate adversarial sample image); It can be used to characterize the spatial loss value between adversarial sample images and sample category labels; It can be used to characterize the gradient (i.e., derivative) of spatial loss value (such as the second loss value) with respect to X (such as the intermediate adversarial sample image); sign() can be used to characterize the sign function, which can be used as the gradient transformation function. According to the sign function, the gradient value obtained above can be transformed to obtain the gradient transformation value; α can be used to characterize the perturbation coefficient; The `Clip{}` property can be used to characterize gradient fusion sample images; `Clip{}` can be used to characterize cropping operations on gradient fusion sample images. It should be understood that, typically, the RGB values ​​of an image (such as an intermediate adversarial sample image) are between 0 and 255. After adding adversarial gradients (such as spatial gradients) to an image, the final generated adversarial sample image (such as a second adversarial sample image) needs to be within a reasonable range of RGB values. Therefore, the image standard rule here can be a standard size rule for the image dimensions, which may include the standard image size. After adding a spatial gradient to the intermediate adversarial sample image to obtain the gradient fusion sample image, it can be cropped according to this standard image size to make its image size match the standard image size. It should be understood that when the first type domain is the spatial domain, for the specific implementation of determining the gradient of the first domain based on the first adversarial sample image and the sample category label, please refer to the description of determining the gradient of the second domain based on the intermediate adversarial sample image and the sample category label in this step; at the same time, for the specific implementation of generating the intermediate adversarial sample image based on the gradient of the first domain (i.e., the spatial domain gradient) and the first adversarial sample image, please refer to the description of generating the second adversarial sample image based on the gradient of the second domain (i.e., the spatial domain gradient) and the intermediate adversarial sample image (the new frequency domain transformed image) in this step.

[0155] When the second domain gradient is the frequency domain gradient, the intermediate adversarial sample image is the image updated from the first adversarial sample image based on the spatial domain gradient. For the specific implementation of generating the second adversarial sample image based on the second domain gradient and the intermediate adversarial sample image, please refer to the above description of generating the intermediate adversarial sample image based on the first domain gradient (frequency domain gradient) and the first adversarial sample image. Specifically, the intermediate adversarial sample image can first be frequency-domain transformed based on the adversarial noise to obtain the frequency-domain transformed image. This transformed image is then input into the target image model. Using the target image model, the frequency-domain transformed image, the sample category labels, and the frequency-domain loss function, the frequency-domain loss value can be determined. Based on this frequency-domain loss value, the frequency-domain gradient can be determined. Based on this frequency-domain gradient, the adversarial noise can be updated to obtain the updated adversarial noise. Based on this updated adversarial noise, the transformed image after the DCT transformation during the frequency-domain transformation process can be transformed again, thus obtaining a new frequency-domain transformed image, which can then be used as the second adversarial sample image.

[0156] Furthermore, after identifying the second adversarial sample image, the target image model can be detected and evaluated based on this second adversarial sample image. Before detecting and evaluating the target image model based on the second adversarial sample image, the number of image iterations corresponding to the second adversarial sample image can be determined to see if it meets the iteration requirements. If it meets the iteration requirements, the target image model is evaluated based on the second adversarial sample image. If it does not meet the iteration requirements, a new round of iteration can be continued to obtain a new round of adversarial sample image (which can be called the third adversarial sample image). Then, the number of image iterations corresponding to the third adversarial sample image is checked to see if it meets the iteration requirements, until an adversarial sample image meets the iteration requirements. Finally, the target image model is evaluated based on this adversarial sample image that meets the iteration requirements.

[0157] For ease of understanding, taking the second adversarial sample image as an example, the specific implementation of detecting whether the iteration requirement is met based on the number of image iterations can be as follows: The number of image iterations corresponding to the second adversarial sample image can be obtained; if the number of image iterations is greater than the iteration threshold, the step of evaluating the target image model based on the second adversarial sample image can be performed; if the number of image iterations is less than the iteration threshold, the first type domain can be switched to the second type domain, and the second type domain can be switched to the first type domain; then, based on the second adversarial sample image and the sample category label, the first domain update gradient for the second type domain is determined, and then, based on the first domain update gradient and the second adversarial sample image, an intermediate updated adversarial sample image is generated; subsequently, based on the intermediate updated adversarial sample image and the sample category label, the second domain update gradient for the first type domain is determined, and based on the second domain update gradient and the intermediate updated adversarial sample image, a third adversarial sample image is generated, and the target image model is evaluated based on the third adversarial sample image.

[0158] It is understandable that for a given adversarial sample image (such as the first adversarial sample image), the process of updating the image based on the gradient of the first domain of the first type domain (i.e., generating an intermediate adversarial sample image) and then updating the intermediate adversarial sample image based on the gradient of the second domain of the second type domain (i.e., generating the second adversarial sample image) constitutes one image iteration. In other words, when the first adversarial sample image is an original sample image that has not undergone image iteration (which may contain some interference noise or be a clean image without any interference noise), updating the image based on the gradient of the first domain of the first type domain and then updating the image based on the gradient of the second domain of the second type domain constitutes the first image iteration, and the number of image iterations corresponding to the generated second adversarial sample image is 1. However, if the first adversarial sample image has already undergone one image iteration, updating the image based on the gradient of the first domain of the first type domain and then updating the image based on the gradient of the second domain of the second type domain constitutes the second image iteration, and the number of image iterations corresponding to the generated second adversarial sample image is 2.

[0159] Furthermore, after obtaining the number of image iterations corresponding to the second adversarial sample image, if the number of image iterations is greater than the iteration number threshold (which can be a manually defined value), it can be determined that the number of image iterations meets the iteration requirements, and the target image model can be detected and evaluated based on the second adversarial sample image; if the number of image iterations is less than or equal to the iteration number threshold, it can be determined that the number of image iterations does not meet the iteration requirements, and the second adversarial sample image can be iterated again. In order to better integrate the frequency domain and the spatial domain, the gradient calculation order of the two domains can be swapped when performing the next image iteration. That is, if in the current iteration, the first type domain is the frequency domain and the second type domain is the spatial domain, and the frequency domain gradient (first domain gradient) is calculated first, an intermediate adversarial sample image is generated based on the frequency domain gradient (first domain gradient), and then the spatial domain gradient (second domain gradient) is calculated based on the intermediate adversarial sample image, and a second adversarial sample image is generated based on the spatial domain gradient, then in the next image iteration, the first type domain can be the spatial domain and the second type domain can be the frequency domain. The spatial domain gradient (first update domain gradient) can be calculated first based on the second adversarial sample image, a new intermediate adversarial sample image (intermediate update adversarial sample image) can be generated based on the spatial domain gradient, and then the frequency domain gradient (second update domain gradient) can be calculated based on the intermediate update adversarial sample image, and a third adversarial sample image can be generated based on the frequency domain gradient. Subsequently, it can be determined again whether the number of iterations for the third adversarial sample image meets the iteration requirements. If it still does not meet the iteration requirements, the next image iteration can continue (requiring the swapping of the gradient calculation order between the two domains) until the generated adversarial sample image meets the iteration requirements, and then the target image model is detected and evaluated based on it.

[0160] For ease of understanding, please refer to the following: Figure 5 , Figure 5 This is an architecture diagram of image iteration provided in an embodiment of this application. For example... Figure 5 As shown, for an untrained original sample image (with an image iteration count of 0), image iteration can be performed using the image iteration module. In the first image iteration, assuming we determine the gradient calculation order as calculating the frequency domain gradient first and then the spatial domain gradient, then in the first image iteration, we can first calculate the adversarial gradient in the frequency domain (i.e., the frequency domain gradient) based on the original sample image; subsequently, we can use this frequency domain gradient to update the original sample image, obtaining an intermediate adversarial sample image; then, we can calculate the adversarial gradient in the spatial domain (i.e., the spatial domain gradient) based on this intermediate adversarial sample image, and use this spatial domain gradient to update the intermediate adversarial sample image again, obtaining adversarial sample image 1 (at this time, the image iteration count corresponding to adversarial sample image 1 is 1).

[0161] Furthermore, a second image iteration can be performed on adversarial sample image 1. In the second image iteration, the gradient calculation order from the first image iteration needs to be swapped. That is, in the second image iteration, the spatial gradient needs to be calculated first, followed by the frequency gradient. Specifically, in the second image iteration, the spatial adversarial gradient (i.e., the spatial gradient) can be calculated sequentially based on adversarial sample image 1. Subsequently, this spatial gradient can be used to update adversarial sample image 1, resulting in a new intermediate adversarial sample image. Then, the frequency domain adversarial gradient (i.e., the frequency gradient) can be calculated based on this new intermediate adversarial sample image. This frequency domain gradient can then be used to update the new intermediate adversarial sample image again, resulting in adversarial sample image 2 (at this point, the image iteration number corresponding to adversarial sample image 2 is 2).

[0162] In each new image iteration, the order of frequency domain and spatial domain gradient calculations from the previous iteration is swapped until the number of image iterations is M (M can be a threshold for the number of iterations). Finally, we obtain the adversarial sample image M, which can be used to detect and evaluate the target image model. It should be understood that any of the above adversarial sample images (such as the original sample image, adversarial sample image 1, ..., adversarial sample image M-1) can be used as the first adversarial sample image, and the adversarial sample image obtained by performing one image iteration on the first adversarial sample image can be used as the second adversarial sample image.

[0163] It should be understood that, typically, when a target image model performs image recognition (such as identifying whether an image is a post-synthesized image), the difference between images synthesized through algorithms or other means and real, unsynthesized images is significant at the image edges. Therefore, high-frequency information in the image is a good clue for image recognition, and target image models usually utilize some high-frequency information in the frequency domain of the input image for image recognition. This application can enhance the offensiveness of adversarial examples based on the spatial and frequency domains, effectively increasing the aggressiveness and interference of adversarial example images. This makes adversarial example images more covert and effective, making it more difficult for target image models to identify adversarial examples. Therefore, the detection results based on these highly aggressive and covert adversarial examples can have higher accuracy.

[0164] In this embodiment, for a certain adversarial sample image (such as a first adversarial sample image), this application can first determine the first domain gradient (the first type domain is the spatial domain or the frequency domain) for a first type domain based on its sample category label; then generate an intermediate adversarial sample image based on the first domain gradient and the first adversarial sample image; subsequently, a second domain gradient for a second type domain can be determined based on the intermediate adversarial sample image and its sample category label; a second adversarial sample image can be generated based on the second domain gradient and the intermediate adversarial sample image, and the generated second adversarial sample image can be used to evaluate the target image model. It should be understood that the sample class label is the opposite of the true class label of the adversarial sample image. In training adversarial sample images, this application can calculate the domain gradients (such as spatial and frequency domains) of different types of domains using the opposite labels of the adversarial sample images. Based on these domain gradients, the adversarial sample images are updated sequentially. This makes the gradient-updated images increasingly closer to the opposite label category, effectively improving the aggressiveness and stealth of the adversarial sample images in multiple types of domains (such as spatial and frequency domains). When the adversarial sample image possesses high aggressiveness and stealth, its attack effect is more effective. When using adversarial sample images with high aggressiveness to evaluate the model, the accuracy of the model's evaluation results can be improved, and multiple model evaluations are unnecessary, thus improving the efficiency of model evaluation. In summary, by combining different types of domains (such as spatial and frequency domains) for training and updating adversarial sample images, this application can add interference information from different types of domains to the adversarial sample images, thereby improving the aggressiveness and effectiveness of the adversarial sample images, and consequently improving the accuracy and efficiency of model evaluation.

[0165] Furthermore, as described above, after identifying the adversarial example images used for detecting and evaluating the target image model, the target image model can be detected and evaluated based on these images. Taking the evaluation of the target image model based on the second adversarial example image as an example, if the original class label is 0, and after training with the adversarial example, the second adversarial example image is input into the target image model, and the predicted image class becomes 1 (e.g., the predicted data output by the target image model is that the second adversarial example image is a real, unsynthesized image), then the sample attack can be considered successful (a successful adversarial example attack corresponds to a failure of the target image model's prediction). Similarly, if the original class label is 1, and after training with the adversarial example, the second adversarial example image is input into the target image model, and the predicted image class becomes 0 (e.g., the predicted data output by the target image model is that the second adversarial example image is a post-synthesized image), then the sample attack can also be considered successful (a successful adversarial example attack corresponds to a failure of the target image model's prediction). Therefore, assuming there are a total of N (N is a positive integer) adversarial sample images, the attack success rate can be expressed as FPR + FNR. Here, FPR can be represented by FalsePositiveRate (the proportion of images originally labeled 0 but misclassified as class 1 by the target image model after training with the sample) and FalseNegativeRate (the proportion of images originally labeled 1 but misclassified as class 0 by the target image model after training with the sample). A higher attack success rate indicates a lower level of security for the evaluated target image model (insufficient model performance, low prediction accuracy); a lower attack success rate indicates a higher level of security for the evaluated target image model (better model performance, higher prediction accuracy).

[0166] For ease of understanding, please refer to the following: Figure 6 , Figure 6 This is a schematic diagram of a model detection process provided in an embodiment of this application. The process can be an example of a model detection process where the adversarial sample images used to evaluate the target image model include a set of target adversarial sample images, and the set of target adversarial sample images includes N (N is a positive integer) adversarial sample images, with the N adversarial sample images including a second adversarial sample image. This process can correspond to the above-mentioned... Figure 3 In the corresponding embodiment, the process of evaluating the target image model based on the second adversarial example image is as follows. Figure 6 As shown, the process may include at least the following steps S201-S203:

[0167] Step S201: Input the second adversarial sample image into the target image model, and output the target predicted image category corresponding to the second adversarial sample image through the target image model.

[0168] Specifically, the second adversarial sample image can be input into the target image model, which can then output the predicted image category corresponding to the second adversarial sample image (for clarity, this can be referred to as the target predicted image category).

[0169] Step S202: Obtain the real class label corresponding to the second adversarial sample image, and determine the model prediction result of the target image model for the second adversarial sample image based on the real class label and the target predicted image class.

[0170] Specifically, the method for determining the model prediction result of the target image model for the second adversarial sample image based on the real class label and the target predicted image class can be as follows: The real class label and the target predicted image class can be compared. If they are different, the model prediction result of the target image model for the second adversarial sample image can be considered a prediction failure. Conversely, if they are the same, the model prediction result can be considered a successful prediction. In other words, when the real class label and the target predicted image class are different (e.g., the original class label is 0 and the target image model predicts a class of 1; or the original class label is 1 and the target image model predicts a class of 0), the attack on the sample is considered successful, and the target image model's prediction fails. When the real class label and the target predicted image class are the same, the attack on the sample is considered successful, and the target image model's prediction succeeds.

[0171] Step S203: When the model prediction results corresponding to the N adversarial sample images are determined, the evaluation result of the target image model is determined based on the N model prediction results.

[0172] Specifically, after determining the model prediction results corresponding to N adversarial sample images, N model prediction results are obtained. The specific implementation method for determining the evaluation result of the target image model based on these N model prediction results is as follows: The prediction failures among the N model prediction results can be identified as failures to be counted. Subsequently, the number of failures among these failures and the total number of prediction results from the N models can be counted. The ratio between the number of failures and the total number of prediction results can be determined. If the ratio is greater than a threshold, an evaluation result indicating that the target image model is an unreliable model can be obtained; conversely, if the ratio is less than the threshold, an evaluation result indicating that the target image model is a reliable model can be obtained. It is understood that the ratio threshold can be an artificially defined value (such as 2 / 3, 80%, 90%, etc., which will not be elaborated further). When the prediction failures exceed a certain ratio, the target image model can be considered an unreliable model.

[0173] Optionally, and understandably, when the target image model is determined to be unreliable, adversarial training can be performed on the target image model based on the aforementioned set of adversarial sample images (N adversarial sample images obtained after training and attacking the samples, i.e., N adversarial sample images obtained after iterative image training). This (i.e., retraining the model based on the N adversarial sample images after the initial training) to improve the image recognition accuracy of the target image model. For example, the model loss value can be determined using the N adversarial sample images. Based on this model loss value, the model parameters of the target image model can be adjusted, thereby obtaining a new target image model. After training to obtain the new target image model, this new target image model can then be applied.

[0174] In this embodiment, the offensiveness of adversarial samples can be enhanced by combining spatial and frequency domains (iterative training of adversarial samples), which can effectively improve the offensiveness and interference of adversarial sample images. This makes adversarial sample images more covert and effective, and makes it more difficult for target image models to identify adversarial samples. Therefore, the detection results based on these highly offensive and covert adversarial samples can have higher accuracy.

[0175] Further, please see Figure 7 , Figure 7 This is a schematic diagram of the structure of a data processing apparatus provided in an embodiment of this application. The data processing apparatus can be a computer program (including program code) running on a computer device; for example, the data processing apparatus is an application software. The data processing apparatus can be used to execute... Figure 3 The method shown. (As illustrated) Figure 7 As shown, the data processing device 1 may include: a sample acquisition module 11, a first gradient determination module 12, an intermediate sample generation module 13, a second gradient determination module 14, an adversarial sample generation module 15, and a model evaluation module 16.

[0176] The sample acquisition module 11 is used to acquire a first adversarial sample image and the sample category label corresponding to the first adversarial sample image; the sample category label is the opposite of the true category label of the first adversarial sample image.

[0177] The first gradient determination module 12 is used to determine the first domain gradient for the first type domain based on the first adversarial sample image and the sample category label; the first type domain is either the spatial domain or the frequency domain.

[0178] The intermediate sample generation module 13 is used to generate intermediate adversarial sample images based on the first domain gradient and the first adversarial sample image;

[0179] The second gradient determination module 14 is used to determine the second domain gradient for the second type domain based on the intermediate adversarial sample image and the sample category label; the second type domain is different from the first type domain, and there is a transformation relationship between the first type domain and the second type domain.

[0180] The adversarial example generation module 15 is used to generate a second adversarial example image based on the second domain gradient and the intermediate adversarial example image;

[0181] Model evaluation module 16 is used to evaluate the target image model based on the second adversarial sample image.

[0182] The specific implementation methods of the sample acquisition module 11, the first gradient determination module 12, the intermediate sample generation module 13, the second gradient determination module 14, the adversarial sample generation module 15, and the model evaluation module 16 can be found above. Figure 3 The descriptions of steps S101-S105 in the corresponding embodiments will not be repeated here.

[0183] In one embodiment, the first gradient determination module 12 may include: a frequency domain conversion unit 121, a first category output unit 122, and a first gradient determination unit 123.

[0184] Frequency domain conversion unit 121 is used to obtain initial adversarial noise when the first type domain is the frequency domain;

[0185] The frequency domain conversion unit 121 is also used to perform frequency domain conversion on the first adversarial sample image based on the initial adversarial noise to obtain a frequency domain converted image;

[0186] The first category output unit 122 is used to input the frequency domain transformed image into the target image model and output the first predicted image category corresponding to the frequency domain transformed image through the target image model;

[0187] The first gradient determination unit 123 is used to determine the first domain gradient for the first type domain based on the first predicted image category and the sample category label.

[0188] The specific implementation methods of the frequency domain conversion unit 121, the first category output unit 122, and the first gradient determination unit 123 can be found in the above description. Figure 3 The description of step S102 in the corresponding embodiment will not be repeated here.

[0189] In one embodiment, the frequency domain conversion unit 121 may include: an image transformation subunit 1211, a noise addition subunit 1212, and an image inverse transformation subunit 1213.

[0190] The image transformation subunit 1211 is used to perform discrete cosine transform on the first adversarial sample image to obtain the transformed sample image.

[0191] Noise addition subunit 1212 is used to add initial adversarial noise to the first transformed sample image to obtain a noise sample image;

[0192] Image inverse transform subunit 1213 is used to perform discrete cosine inverse transform on the noisy sample image to obtain a frequency domain transformed image.

[0193] The specific implementation methods of the image transformation subunit 1211, the noise addition subunit 1212, and the image inverse transformation subunit 1213 can be found in the above description. Figure 3 The description of step S102 in the corresponding embodiment will not be repeated here.

[0194] In one embodiment, the noise addition subunit 1212 is also specifically used to obtain the mask matrix corresponding to the initial adversarial noise;

[0195] The noise addition subunit 1212 is also specifically used to perform matrix operations on the initial adversarial noise and the mask matrix to obtain the first operational adversarial noise.

[0196] The noise addition subunit 1212 is also specifically used to fuse the first operational adversarial noise with the transformed sample image to obtain a noise sample image.

[0197] In one embodiment, the first gradient determination unit 123 may include a first loss value determination subunit 1231 and a first domain gradient determination subunit 1232.

[0198] The first loss value determination subunit 1231 is used to obtain the first loss function corresponding to the frequency domain, and determine the first loss value corresponding to the first predicted image category based on the first loss function, the first predicted image category and the sample category label.

[0199] The first domain gradient determination subunit 1232 is used to determine the first gradient value for the first adversarial sample image based on the first loss value and the first adversarial sample image, and to determine the first gradient value as the first domain gradient.

[0200] The specific implementation methods of the first loss value determination subunit 1231 and the first domain gradient determination subunit 1232 can be found in the above. Figure 3 The description of step S102 in the corresponding embodiment will not be repeated here.

[0201] In one embodiment, the intermediate sample generation module 13 may include: a noise update unit 131, a matrix operation unit 132, a transformed image acquisition unit 133, and an image noise fusion unit 134.

[0202] The noise update unit 131 is used to update the initial adversarial noise according to the gradient of the first domain to obtain the updated adversarial noise;

[0203] The matrix operation unit 132 is used to obtain the mask matrix corresponding to the updated adversarial noise, and to perform matrix operations on the updated adversarial noise and the mask matrix to obtain the second operational adversarial noise.

[0204] The transformed image acquisition unit 133 is used to acquire the transformed sample image obtained by performing discrete cosine transform on the first adversarial sample image during the frequency domain transformation of the first adversarial sample image based on the initial adversarial noise.

[0205] The image noise fusion unit 134 is used to fuse the second operational adversarial noise with the transformed sample image, and determine the intermediate adversarial sample image based on the fused image.

[0206] The specific implementation methods of the noise update unit 131, matrix operation unit 132, transformed image acquisition unit 133, and image noise fusion unit 134 can be found in the above description. Figure 3 The description of step S103 in the corresponding embodiment will not be repeated here.

[0207] In one embodiment, the second gradient determination module 14 may include: an image input unit 141, a second loss value determination unit 142, and a second gradient determination unit 143.

[0208] The image input unit 141 is used to input the intermediate adversarial sample image into the target image model when the first type domain is the frequency domain and the second type domain is the spatial domain, and output the second predicted image category corresponding to the intermediate adversarial sample image through the target image model.

[0209] The second loss value determination unit 142 is used to obtain the second loss function corresponding to the spatial domain, and determine the second loss value corresponding to the second predicted image category based on the second loss function, the second predicted image category, and the sample category label.

[0210] The second gradient determination unit 143 is used to determine the second gradient value for the intermediate adversarial sample image based on the second loss value and the intermediate adversarial sample image, and to determine the second gradient value as the second domain gradient.

[0211] The specific implementation methods of the image input unit 141, the second loss value determination unit 142, and the second gradient determination unit 143 can be found in the above description. Figure 3 The description of step S104 in the corresponding embodiment will not be repeated here.

[0212] In one embodiment, the adversarial example generation module 15 may include: a function acquisition unit 151, a gradient transformation unit 152, a sample generation unit 153, and an image adjustment unit 154.

[0213] The function acquisition unit 151 is used to acquire the gradient image update function indicated by the spatial domain, and to acquire the gradient transformation function based on the gradient image update function;

[0214] Gradient transformation unit 152 is used to perform gradient transformation on the gradient of the second domain through a gradient transformation function to obtain the gradient transformation value corresponding to the gradient of the second domain.

[0215] The sample generation unit 153 is used to calculate the perturbation coefficient and the gradient transformation value in the gradient image update function to obtain the perturbation gradient value.

[0216] The sample generation unit 153 is also used to fuse the intermediate adversarial sample image with the perturbation gradient value to obtain the gradient fused sample image.

[0217] Image adjustment unit 154 is used to adjust the gradient fusion sample image to obtain the second adversarial sample image.

[0218] The specific implementation methods of the function acquisition unit 151, gradient transformation unit 152, sample generation unit 153, and image adjustment unit 154 can be found in the above description. Figure 3 The description of step S105 in the corresponding embodiment will not be repeated here.

[0219] In one embodiment, the image adjustment unit 154 may include a standard acquisition subunit 1541, a size adjustment subunit 1542, and an image determination subunit 1543.

[0220] The standard acquisition subunit 1541 is used to acquire image standard rules; the image standard rules include the standard image size corresponding to the model evaluation image, and the model evaluation image refers to the image used to evaluate the target image model;

[0221] The size adjustment subunit 1542 is used to adjust the image size of the gradient fusion sample image to the standard image size according to the standard image size;

[0222] Image determination subunit 1543 is used to determine a gradient fusion sample image with an image size equal to the standard image size as a second adversarial sample image.

[0223] The specific implementation methods of the standard acquisition subunit 1541, the size adjustment subunit 1542, and the image determination subunit 1543 can be found in the above description. Figure 3 The description of step S105 in the corresponding embodiment will not be repeated here.

[0224] In one embodiment, the data processing device 1 may further include: an iteration count acquisition module 17, a step execution module 18, a domain switching module 19, and an image iteration module 21.

[0225] The iteration count acquisition module 17 is used to acquire the image iteration count corresponding to the second adversarial sample image;

[0226] The step execution module 18 is used to perform the step of evaluating the target image model based on the second adversarial sample image if the number of image iterations is greater than the iteration number threshold.

[0227] The domain switching module 19 is used to switch the first type domain to the second type domain and the second type domain to the first type domain if the number of image iterations is less than the number of iterations threshold.

[0228] Image iteration module 21 is used to determine the first domain update gradient for the second type domain based on the second adversarial sample image and the sample category label, and generate an intermediate updated adversarial sample image based on the first domain update gradient and the second adversarial sample image.

[0229] The image iteration module 21 is also used to determine the second domain update gradient for the first type domain based on the intermediate updated adversarial sample image and the sample category label, generate a third adversarial sample image based on the second domain update gradient and the intermediate updated adversarial sample image, and evaluate the target image model based on the third adversarial sample image.

[0230] The specific implementation methods of the iteration count acquisition module 17, the step execution module 18, the domain switching module 19, and the image iteration module 21 can be found in the above description. Figure 3 The description of step S105 in the corresponding embodiment will not be repeated here.

[0231] In one embodiment, the adversarial sample images used to evaluate the target image model include a set of target adversarial sample images, which includes N adversarial sample images, and the N adversarial sample images include a second adversarial sample image; N is a positive integer;

[0232] The model evaluation module 16 may include: a category output unit 161, a prediction result determination unit 162, and an evaluation result determination unit 163.

[0233] The category output unit 161 is used to input the second adversarial sample image into the target image model and output the target predicted image category corresponding to the second adversarial sample image through the target image model;

[0234] The prediction result determination unit 162 is used to obtain the true class label corresponding to the second adversarial sample image;

[0235] The prediction result determination unit 162 is also used to determine the model prediction result of the target image model for the second adversarial sample image based on the true category label and the target predicted image category;

[0236] The evaluation result determination unit 163 is used to determine the evaluation result of the target image model based on the model prediction results corresponding to the N adversarial sample images.

[0237] The specific implementation methods of the category output unit 161, the prediction result determination unit 162, and the evaluation result determination unit 163 can be found in the above description. Figure 6 The descriptions of steps S201-S203 in the corresponding embodiments will not be repeated here.

[0238] In one embodiment, the prediction result determination unit 162 is further specifically used to determine the model prediction result of the target image model for the second adversarial sample image as a prediction failure result if the true category label is different from the target predicted image category.

[0239] The prediction result determination unit 162 is also specifically used to determine the model prediction result of the target image model for the second adversarial sample image as a successful prediction result if the true category label is the same as the target predicted image category.

[0240] In one embodiment, the evaluation result determination unit 163 may include: a quantity statistics subunit 1631, a ratio determination subunit 1632, and a result determination subunit 1633.

[0241] The quantitative statistics subunit 1631 is used to identify the prediction failure results among the N model prediction results as failure results to be counted.

[0242] The quantity statistics subunit 1631 is also used to count the number of failed results to be counted, as well as the total number of results predicted by N models;

[0243] The ratio determination subunit 1632 is used to determine the ratio between the number of failed results and the total number of results.

[0244] The result determines subunit 1633, which is used to obtain an evaluation result indicating that the target image model is an unreliable model if the quantity ratio is greater than the ratio threshold;

[0245] The result determines subunit 1633, and is also used to obtain an evaluation result indicating that the target image model is a reliable model if the quantity ratio is less than the ratio threshold.

[0246] The specific implementation methods of the quantity statistics subunit 1631, the ratio determination subunit 1632, and the result determination subunit 1633 can be found in the above description. Figure 6 The description of step S203 in the corresponding embodiment will not be repeated here.

[0247] In this embodiment, the sample category label is the opposite of the true category label of the adversarial sample image. When training the adversarial sample image, this application can calculate the domain gradients (such as spatial and frequency domains) of different types of domains using the opposite labels of the adversarial sample image. Based on these domain gradients, the adversarial sample image is updated sequentially. This makes the gradient-updated image increasingly closer to the category of the opposite label, effectively improving the aggressiveness and stealth of the adversarial sample image in multiple types of domains (such as spatial and frequency domains). When the adversarial sample image possesses high aggressiveness and stealth, its attack effect is more effective. When using adversarial sample images with higher aggressiveness to evaluate the model, the accuracy of the model evaluation results can be improved, and multiple model evaluations are unnecessary, thus improving the efficiency of model evaluation. In summary, by combining different types of domains (such as spatial and frequency domains) for training and updating adversarial sample images, this application can add interference information from different types of domains to the adversarial sample image, thereby improving the aggressiveness and effectiveness of the adversarial sample image, and consequently improving the accuracy and efficiency of model evaluation.

[0248] Further, please see Figure 8 , Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 8 As shown above, Figure 7 The data processing device 1 in the corresponding embodiment can be applied to the aforementioned computer device 8000. The computer device 8000 may include a processor 8001, a network interface 8004, and a memory 8005. Furthermore, the computer device 8000 also includes a user interface 8003 and at least one communication bus 8002. The communication bus 8002 is used to enable communication between these components. The user interface 8003 may include a display screen and a keyboard; optionally, the user interface 8003 may also include a standard wired interface or a wireless interface. The network interface 8004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 8005 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 8005 may also be at least one storage device located remotely from the aforementioned processor 8001. Figure 8As shown, the memory 8005, which is a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device control application program.

[0249] exist Figure 8 In the computer device 8000 shown, the network interface 8004 provides network communication functionality; the user interface 8003 is mainly used to provide an input interface for the user; and the processor 8001 can be used to call the device control application program stored in the memory 8005 to achieve:

[0250] Obtain the first adversarial sample image and the corresponding sample category label; the sample category label is the opposite of the true category label of the first adversarial sample image.

[0251] Based on the first adversarial sample image and the sample category label, determine the first domain gradient for the first type domain; the first type domain is either the spatial domain or the frequency domain.

[0252] Based on the gradient of the first domain and the first adversarial sample image, generate intermediate adversarial sample images;

[0253] Based on the intermediate adversarial sample images and sample category labels, determine the second domain gradient for the second type domain; the second type domain is different from the first type domain, and there is a transformation relationship between the first type domain and the second type domain;

[0254] Based on the gradient of the second domain and the intermediate adversarial sample image, a second adversarial sample image is generated, and the target image model is evaluated based on the second adversarial sample image.

[0255] It should be understood that the computer device 8000 described in the embodiments of this application can execute the foregoing text. Figures 3 to 6 The description of the data processing method in the corresponding embodiment can also be performed as described above. Figure 7 The description of the data processing apparatus 1 in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated here.

[0256] Furthermore, it should be noted that this application embodiment also provides a computer-readable storage medium, which stores a computer program executed by the aforementioned data processing computer device 8000. The computer program includes program instructions, and when the processor executes the program instructions, it can execute the aforementioned... Figures 3 to 6 The description of the data processing method in the corresponding embodiments is already provided and will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the computer-readable storage medium embodiments related to this application, please refer to the description of the method embodiments of this application.

[0257] The aforementioned computer-readable storage medium can be an internal storage unit of the data processing apparatus or computer device provided in any of the foregoing embodiments, such as a hard disk or memory of the computer device. The computer-readable storage medium can also be an external storage device of the computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on the computer device. Furthermore, the computer-readable storage medium can include both internal and external storage units of the computer device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0258] One aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method provided in one aspect of the embodiments of this application.

[0259] The terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatuses, products, or devices.

[0260] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0261] The methods and related apparatuses provided in this application are described with reference to the method flowcharts and / or structural diagrams provided in this application. Specifically, each block of the method flowchart and / or structural diagram, as well as combinations of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to create a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 A process or multiple processes and / or structures illustrate the steps of the functions specified in one or more boxes.

[0262] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A data processing method, characterized in that, include: Obtain the first adversarial sample image and the sample category label corresponding to the first adversarial sample image; The sample category label is the opposite of the true category label of the first adversarial sample image; Based on the first adversarial sample image and the sample category label, a first domain gradient is determined for a first type domain; the first type domain is either spatial or frequency domain, and the first domain gradient includes a spatial gradient for the spatial domain and a frequency gradient for the frequency domain. The spatial gradient is determined by the difference between the spatial domain predicted image category and the sample category label, where the spatial domain predicted image category is the category output by the target image model after inputting the first adversarial sample image; the frequency domain gradient is determined by the difference between the first predicted image category and the sample category label, where the first predicted image category is the category output by the target image model after inputting the frequency domain transformed image; the frequency domain transformed image is obtained by performing a frequency domain transformation on the first adversarial sample image based on initial adversarial noise. An intermediate adversarial sample image is generated based on the first domain gradient and the first adversarial sample image. When the first domain gradient is the frequency domain gradient, the intermediate adversarial sample image is generated based on updated adversarial noise and a transformed sample image. The updated adversarial noise refers to the noise after updating the initial adversarial noise using the frequency domain gradient, and the transformed sample image refers to the transformed sample image obtained by performing a discrete cosine transform on the first adversarial sample image during the frequency domain transformation based on the initial adversarial noise. When the first domain gradient is the spatial domain gradient, the intermediate adversarial sample image is the image obtained by updating the first adversarial sample image according to the gradient image update function indicated by the spatial domain. Based on the intermediate adversarial sample image and the sample category label, a second domain gradient for the second type domain is determined; the second type domain is different from the first type domain, and there is a transformation relationship between the first type domain and the second type domain; A second adversarial sample image is generated based on the second domain gradient and the intermediate adversarial sample image, and the target image model is evaluated based on the second adversarial sample image.

2. The method according to claim 1, characterized in that, The step of determining the first domain gradient for the first type domain based on the first adversarial sample image and the sample category label includes: When the first type domain is the frequency domain, initial adversarial noise is obtained, and the first adversarial sample image is frequency domain transformed based on the initial adversarial noise to obtain a frequency domain transformed image. The frequency domain transformed image is input into the target image model, and the target image model outputs the first predicted image category corresponding to the frequency domain transformed image; Based on the first predicted image category and the sample category label, a first domain gradient is determined for the first type domain.

3. The method according to claim 2, characterized in that, The step of performing frequency domain transformation on the first adversarial sample image based on the initial adversarial noise to obtain a frequency domain transformed image includes: Perform a discrete cosine transform on the first adversarial sample image to obtain the transformed sample image; The initial adversarial noise is added to the transformed sample image to obtain a noisy sample image; The noise sample image is subjected to discrete cosine inverse transform to obtain the frequency domain transformed image.

4. The method according to claim 3, characterized in that, The step of adding the initial adversarial noise to the transformed sample image to obtain a noise sample image includes: Obtain the mask matrix corresponding to the initial adversarial noise; Perform matrix operations on the initial adversarial noise and the mask matrix to obtain the first operational adversarial noise; The first operation to combat noise is fused with the transformed sample image to obtain the noise sample image.

5. The method according to claim 2, characterized in that, Determining the first domain gradient for the first type domain based on the first predicted image category and the sample category label includes: Obtain the first loss function corresponding to the frequency domain, and determine the first loss value corresponding to the first predicted image category based on the first loss function, the first predicted image category, and the sample category label; Based on the first loss value and the first adversarial sample image, a first gradient value for the first adversarial sample image is determined, and the first gradient value is determined as the first domain gradient.

6. The method according to claim 2, characterized in that, The step of generating intermediate adversarial sample images based on the first domain gradient and the first adversarial sample image includes: The initial adversarial noise is updated based on the gradient of the first domain to obtain the updated adversarial noise; Obtain the mask matrix corresponding to the updated adversarial noise, and perform matrix operations between the updated adversarial noise and the mask matrix to obtain the second operational adversarial noise; The transformed sample image is obtained by performing discrete cosine transform on the first adversarial sample image during the frequency domain transformation of the first adversarial sample image based on the initial adversarial noise. The second operational adversarial noise is fused with the transformed sample image, and the intermediate adversarial sample image is determined based on the fused image.

7. The method according to claim 1, characterized in that, The step of determining the second domain gradient for the second type domain based on the intermediate adversarial sample image and the sample category label includes: When the first type domain is the frequency domain and the second type domain is the spatial domain, the intermediate adversarial sample image is input into the target image model, and the target image model outputs the second predicted image category corresponding to the intermediate adversarial sample image. Obtain the second loss function corresponding to the spatial domain, and determine the second loss value corresponding to the second predicted image category based on the second loss function, the second predicted image category, and the sample category label; Based on the second loss value and the intermediate adversarial sample image, a second gradient value for the intermediate adversarial sample image is determined, and the second gradient value is determined as the second domain gradient.

8. The method according to claim 7, characterized in that, The step of generating a second adversarial sample image based on the second domain gradient and the intermediate adversarial sample image includes: Obtain the gradient image update function indicated by the spatial domain, and obtain the gradient transformation function based on the gradient image update function; The gradient transformation function is used to transform the gradient of the second domain to obtain the gradient transformation value corresponding to the gradient of the second domain. The perturbation coefficient in the gradient image update function is used in conjunction with the gradient transformation value to obtain the perturbation gradient value; The intermediate adversarial sample image is fused with the perturbation gradient value to obtain a gradient fused sample image. The gradient fused sample image is then adjusted to obtain the second adversarial sample image.

9. The method according to claim 8, characterized in that, The step of adjusting the gradient fusion sample image to obtain the second adversarial sample image includes: Obtain image standard rules; the image standard rules include the standard image size corresponding to the model evaluation image, where the model evaluation image refers to the image used to evaluate the target image model; The image size of the gradient fusion sample image is adjusted to the standard image size according to the standard image size; The gradient fusion sample image with an image size equal to the standard image size is determined as the second adversarial sample image.

10. The method according to claim 1, characterized in that, The method further includes: Obtain the number of image iterations corresponding to the second adversarial sample image; If the number of image iterations is greater than the iteration threshold, then the step of evaluating the target image model based on the second adversarial example image is executed; If the number of image iterations is less than the iteration threshold, then the first type domain is switched to the second type domain, and the second type domain is switched to the first type domain. Based on the second adversarial sample image and the sample category label, determine the first domain update gradient for the second type domain, and generate an intermediate update adversarial sample image based on the first domain update gradient and the second adversarial sample image. Based on the intermediate updated adversarial sample image and the sample category label, a second domain update gradient for the first type domain is determined. Based on the second domain update gradient and the intermediate updated adversarial sample image, a third adversarial sample image is generated. The target image model is evaluated based on the third adversarial sample image.

11. The method according to claim 1, characterized in that, The adversarial sample images used to evaluate the target image model include a set of target adversarial sample images, which includes N adversarial sample images, and the N adversarial sample images include the second adversarial sample image; N is a positive integer; The evaluation of the target image model based on the second adversarial example image includes: The second adversarial example image is input into the target image model, and the target image model outputs the target predicted image category corresponding to the second adversarial example image. Obtain the real class label corresponding to the second adversarial example image, and determine the model prediction result of the target image model for the second adversarial example image based on the real class label and the target predicted image category; When determining the model prediction results corresponding to the N adversarial sample images, the evaluation result of the target image model is determined based on the N model prediction results.

12. The method according to claim 11, characterized in that, The step of determining the model prediction result of the target image model for the second adversarial example image based on the true category label and the target predicted image category includes: If the true category label is different from the target predicted image category, then the model prediction result of the target image model for the second adversarial example image is determined as a prediction failure result; If the true category label is the same as the target predicted image category, then the model prediction result of the target image model for the second adversarial example image is determined as a successful prediction result.

13. The method according to claim 11, characterized in that, The step of determining the evaluation result of the target image model based on the prediction results of N models includes: The prediction failure results among the N model prediction results are identified as failure results to be statistically analyzed. Count the number of failed results to be counted, and the total number of results predicted by the N models; Determine the ratio between the number of failed results and the total number of results; If the ratio of the number is greater than the ratio threshold, an evaluation result is obtained to indicate that the target image model is an unreliable model; If the ratio of the number is less than the ratio threshold, an evaluation result is obtained to indicate that the target image model is a reliable model.

14. A computer device, characterized in that, include: Processor, memory, and network interface; The processor is connected to the memory and the network interface, wherein the network interface is used to provide network communication functions, the memory is used to store program code, and the processor is used to call the program code to cause the computer device to execute the method according to any one of claims 1-13.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and to execute the method of any one of claims 1-13.

16. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium, the computer instructions being adapted to be read and executed by a processor to cause a computer device having the processor to perform the method of any one of claims 1-13.

Images