A method and system for testing a video quality assessment model

Abstract

The application discloses a kind of video quality evaluation model's test method and system, the method includes: determining attack scene, if it is white box attack, then by the initial disturbance of preestablished to the original video obtained is disturbed, obtains initial countermeasure video, if it is black box attack, then each video frame in original video is video block, obtain the first video block corresponding to the original video of several, and the first video block is inquired and disturbed, and then generate the initial countermeasure video, again by the countermeasure attack model of preestablished to the initial countermeasure video is constantly optimized, generate final countermeasure video, by the video quality evaluation model to be tested, obtain the first evaluation score corresponding to the countermeasure video and the second evaluation score corresponding to the original video, and according to the first evaluation score and the second evaluation score obtain the robustness test result of the video quality evaluation model, judge the robustness of the video quality evaluation model to be tested.

Description

Technical Field

[0001] This invention relates to the field of image signal processing and perception model technology, and in particular to a testing method and system for a video quality assessment model. Background Technology

[0002] In recent years, self-media services have experienced explosive growth. It is estimated that Facebook generates approximately 4 billion video views daily. However, the storage and transmission of such massive amounts of video data pose a significant challenge to video service providers. To address this challenge, it is necessary to employ video encoding to reduce storage capacity and achieve a balance between encoding efficiency and video quality. Therefore, Video Quality Assessment (VQA) has become an important research topic. Generally, based on whether the original video is used as a reference, VQA is divided into Full-Reference Video Quality Assessment (FR-VQA), Half-Reference Video Quality Assessment (RR-VQA), and No-Reference Video Quality Assessment (NR-VQA). Recently, Convolutional Neural Networks (CNNs) and Transformers have achieved great success in the NR-VQA field. However, recent research has shown that CNNs and Transformers exhibit vulnerability to adversarial examples. To establish a reliable and practical evaluation system, it is necessary to assess the robustness of VQA models against adversarial attacks.

[0003] Currently, the robustness of IQA models to adversarial attacks is mainly evaluated by first initializing the perturbation and then further optimizing the perturbation by calculating the gradient using the square of the difference between the model's output score and the MOS (Mean of Motion). However, there is no method in the existing technology to test the robustness of VQA models. The optimized perturbation is added to the original image to form an adversarial image. Multiple adversarial images can be generated under different Lagrange multiplier constraints. The most difficult-to-detect adversarial image is selected based on human subjective experiments. The drawback of this approach is that human subjective experiments are both time-consuming and laborious, and users often use a small number of images as the test set for adversarial attacks. As a result, the results may be random due to the small number of test samples. Secondly, the existing technology only considers the results of adversarial attacks under white-box settings, while such adversarial attacks are ineffective in more realistic black-box scenarios. At the same time, the existing technology does not take into account that video is an important information carrier on the Internet, and the robustness of VQA models has never been studied. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention discloses a testing method and system for a video quality assessment model. This method reduces the consumption of manpower and resources, and can generate adversarial videos under both white-box and black-box conditions to test the robustness of the video quality assessment model.

[0005] To achieve the above objectives, this invention discloses a testing method for a video quality assessment model, comprising:

[0006] Based on the obtained model parameters of the video quality assessment model to be tested, determine the attack scenarios for adversarial attacks on the video quality assessment model.

[0007] If the attack scenario is a white-box attack, the acquired original video is perturbed by a preset initial perturbation to obtain the initial adversarial video corresponding to the original video.

[0008] If the attack scenario is a black-box attack, then each video frame in the acquired original video is divided into video blocks to obtain several first video blocks corresponding to each video frame in the original video. The several first video blocks are then queryed and perturbed to generate several second video blocks corresponding to each video frame in the original video, so that an initial adversarial video corresponding to the original video is generated based on the several second video blocks.

[0009] The initial adversarial video is continuously optimized using a preset adversarial attack model to generate an adversarial video corresponding to the original video.

[0010] The adversarial video and the original video are respectively input into the video quality assessment model to obtain a first assessment score corresponding to the adversarial video and a second assessment score corresponding to the original video. The robustness test result of the video quality assessment model is obtained based on the first assessment score and the second assessment score.

[0011] This invention discloses a testing method for a video quality assessment model. First, based on the availability of model parameters of the target model (video quality assessment model), it determines whether the adversarial attack scenario is white-box or black-box. Different adversarial video generation methods are set according to the attack scenario, solving the problem that existing technologies cannot perform adversarial attacks under black-box settings, thereby improving the accuracy of target model testing. Next, when the attack scenario is determined to be white-box, a preset initial perturbation is used to interfere with the original video, generating an initial adversarial video. Then, a preset adversarial attack model is used to optimize the initial adversarial video, improving its accuracy. This avoids the subjective human judgment in adversarial video generation found in existing technologies, significantly reducing the consumption of manpower and resources. When the attack scenario... When the scene is a black box, each video frame in the original video is divided into blocks, and each video frame is divided into several video blocks. Then, these video blocks are query-perturbed, and the second video block obtained after perturbation is input into the adversarial attack model to obtain the adversarial video corresponding to the original video. This invention's block-based random search black box method can significantly improve the query efficiency in the spatiotemporal domain, thereby improving the model's testing efficiency. Then, regardless of whether the adversarial video is obtained in a white-box or black-box environment, the adversarial video and the original video are input into the video quality evaluation model to be tested to obtain different scores. The model is tested based on the scores. This invention intelligently generates adversarial videos based on a preset adversarial attack model, eliminating the need for subjective human determination of the generated adversarial video, greatly reducing the consumption of manpower and resources. Secondly, a block-based random search black box method is proposed to query the original video divided into video blocks, which can significantly improve the query efficiency in the spatiotemporal domain, enabling adversarial attacks on the model to succeed under black-box settings, improving the efficiency and accuracy of model testing.

[0012] As a preferred example, before determining the attack scenario for an adversarial attack on the video quality assessment model, the method includes:

[0013] Based on the preset boundary loss function and perturbation distortion function based on fraction inversion, the adversarial attack model of the video quality assessment model is mathematically modeled to obtain the adversarial attack model corresponding to the video quality assessment model.

[0014] The mathematical modeling formula for the adversarial attack model is as follows:

[0015]

[0016] in, and These represent the adversarial video and the original video, respectively; f e (·) represents the estimated quality score output by the video quality assessment model; fd (·) indicates the perturbation mass fraction; It is a loss function that measures the distance between the estimated quality score and the perturbation quality score; The distortion between the original video and the adversarial video; JND is the set pixel-level norm;

[0017] The boundary loss function based on fraction inversion is:

[0018]

[0019] in

[0020]

[0021] Before testing the model, this invention first constructs an adversarial attack model using a preset loss function and a perturbation distortion function. This is to maximize the misleading nature of the generated adversarial video on the test model by using the loss function in the adversarial attack model, thereby improving the accuracy of model testing. The perturbation distortion function limits the distortion between the generated adversarial video and the original video, making the perturbation imperceptible to the human eye. This solves the problem of manually judging the perturbation distortion of adversarial videos in the prior art, reduces the consumption of manpower and material resources, and improves the efficiency of model testing.

[0022] As a preferred example, the step of perturbing the acquired original video through a preset initial perturbation to obtain the initial adversarial video corresponding to the original video includes:

[0023] Based on the number of video frames in the original video and the preset number of optimized video frames in each round, the adversarial video generated through several rounds of optimization is determined, as well as several video frames contained in the original video optimized in each round of optimization.

[0024] In each of the several rounds of optimization, a number of video frames contained in the original video being optimized in each round of optimization are disturbed by a preset initial perturbation to obtain the first initial adversarial video corresponding to the number of video frames.

[0025] By combining the first initial adversarial video obtained in each round of optimization, the initial adversarial video corresponding to the original video is obtained.

[0026] In each round of generating the adversarial video corresponding to the original video, the present invention first performs initial perturbation on several video frames optimized in the current round of optimization by using a preset initial perturbation interference to generate the first initial adversarial video obtained in each round of optimization. Then, the first initial adversarial videos obtained in each round of optimization are combined to obtain the initial adversarial video, so as to attack the model under test according to the initial adversarial video, and then test the model under test.

[0027] As a preferred example, the process of dividing each video frame in the acquired original video into video blocks to obtain several first video blocks corresponding to each video frame in the original video includes:

[0028] Each video frame in the acquired original video is divided into image channels to determine the number of image channels included in each video frame;

[0029] Obtain the first area of ​​the video frame corresponding to each of the plurality of image channels, and divide the first area according to the second area of ​​the preset first video block to obtain a plurality of first video blocks corresponding to each video frame.

[0030] This invention divides each video frame according to image channels, then obtains the first area of ​​the video frames contained in each image channel, divides the first area using the area of ​​a preset video block, and obtains several first video blocks corresponding to one image channel. Based on the number of image channels divided in a video frame, the video blocks corresponding to each video frame in the original video are obtained. The video frames are then segmented to enable subsequent searching and perturbation of the video blocks, improving the efficiency of black-box search and thus improving the efficiency of adversarial video generation.

[0031] As a preferred example, the process of querying and perturbing the plurality of first video blocks to generate a plurality of second video blocks corresponding to each video frame in the original video includes:

[0032] Based on the number of video frames in the original video and the preset number of optimized video frames in each round, the initial adversarial video is generated through several rounds of optimization, and several video frames contained in the original video are optimized in each round of optimization.

[0033] In each round of optimization, several queries are performed on several first video blocks corresponding to several video frames in the optimization process, and in each query, the first video blocks located at the same position in the several video frames are randomly selected and perturbed to generate several second video blocks corresponding to the several video frames.

[0034] Based on the plurality of second video blocks, a corresponding perturbation map is generated, and the perturbation map is aggregated with the plurality of second video blocks to generate the first initial adversarial video corresponding to the plurality of video frames in each round of optimization.

[0035] By combining the first initial adversarial video obtained in each round of optimization, the initial adversarial video corresponding to the original video is obtained.

[0036] When the current attack scenario is detected as a black-box attack, this invention divides the original video into video frames, generating several video blocks corresponding to each video frame. During the perturbation of the video blocks, video blocks at the same position are selected and perturbed for the video frames selected in each round of optimization. Based on the number of queries and the number of rounds of optimization, the interference of the original video is completed. By searching for the video blocks, this invention avoids the technical problem in the prior art where the number of queries is positively correlated with the video resolution, resulting in a large number of queries and thus reducing query efficiency. This invention improves the query efficiency in both the spatial and temporal domains.

[0037] As a preferred example, the process of continuously optimizing the initial adversarial video using a preset adversarial attack model to generate an adversarial video corresponding to the original video includes:

[0038] When the attack scenario is a white-box attack, the initial perturbation in the initial adversarial video is iteratively optimized by the boundary loss function preset in the adversarial attack model, and the pixel-level norm of the generated adversarial video is limited by the perturbation distortion function preset in the adversarial attack model, so as to obtain the adversarial video corresponding to the initial adversarial video.

[0039] When the attack scenario is a black-box attack, several second video blocks in the initial adversarial video are filtered by the boundary loss function preset in the adversarial attack model. At the same time, the pixel-level norm of the generated adversarial video is limited according to the perturbation distortion function in the adversarial attack model to obtain the adversarial video corresponding to the initial adversarial video.

[0040] When optimizing the acquired initial adversarial video, this invention optimizes the initial adversarial video differently according to different attack scenarios using the adversarial attack model. It uses the loss function in the model to improve the misleading nature of the adversarial video, thereby improving the accuracy of model testing. It also uses a perturbation distortion function to determine that the distortion of the generated adversarial video is indistinguishable from that of the original video to the human eye, thereby improving the accuracy of model testing.

[0041] On the other hand, the present invention discloses a testing system for a video quality assessment model, including a scene analysis module, a white-box attack module, a black-box attack module, a video optimization module, and a model testing module;

[0042] The scenario analysis module is used to determine the attack scenarios for adversarial attacks on the video quality assessment model based on the model parameters of the video quality assessment model to be tested.

[0043] The white-box attack module is used to perturb the acquired original video by a preset initial perturbation if the attack scenario is a white-box attack, so as to obtain the initial adversarial video corresponding to the original video.

[0044] The black-box attack module is used to divide each video frame in the acquired original video into video blocks if the attack scenario is a black-box attack, to obtain several first video blocks corresponding to each video frame in the original video, and to query and perturb the several first video blocks to generate several second video blocks corresponding to each video frame in the original video, so as to generate an initial adversarial video corresponding to the original video based on the several second video blocks.

[0045] The video optimization module is used to continuously optimize the initial adversarial video using a preset adversarial attack model to generate an adversarial video corresponding to the original video.

[0046] The model testing module is used to input the adversarial video and the original video into the video quality assessment model respectively, obtain a first assessment score corresponding to the adversarial video and a second assessment score corresponding to the original video, and obtain the robustness test result of the video quality assessment model based on the first assessment score and the second assessment score.

[0047] This invention discloses a testing system for a video quality assessment model. First, based on the availability of model parameters for the target model (video quality assessment model), it determines whether the adversarial attack scenario is white-box or black-box. Different adversarial video generation methods are set according to the attack scenario, solving the problem that existing technologies cannot perform adversarial attacks under black-box conditions, thus improving the accuracy of target model testing. Next, when the attack scenario is determined to be white-box, a preset initial perturbation is used to interfere with the original video, generating an initial adversarial video. Then, a preset adversarial attack model is used to optimize the initial adversarial video, improving its accuracy. This avoids the subjective human judgment in adversarial video generation found in existing technologies, significantly reducing the consumption of manpower and resources. When the attack scenario... When the scene is a black box, each video frame in the original video is divided into blocks, and each video frame is divided into several video blocks. Then, these video blocks are query-perturbed, and the second video block obtained after perturbation is input into the adversarial attack model to obtain the adversarial video corresponding to the original video. This invention's block-based random search black box method can significantly improve the query efficiency in the spatiotemporal domain, thereby improving the model's testing efficiency. Then, regardless of whether the adversarial video is obtained in a white-box or black-box environment, the adversarial video and the original video are input into the video quality evaluation model to be tested to obtain different scores. The model is tested based on the scores. This invention intelligently generates adversarial videos based on a preset adversarial attack model, eliminating the need for subjective human determination of the generated adversarial video, greatly reducing the consumption of manpower and resources. Secondly, a block-based random search black box method is proposed to query the original video divided into video blocks, which can significantly improve the query efficiency in the spatiotemporal domain, enabling adversarial attacks on the model to succeed under black-box settings, improving the efficiency and accuracy of model testing.

[0048] As a preferred example, the testing system for the video quality assessment model further includes:

[0049] Based on the preset boundary loss function and perturbation distortion function based on fraction inversion, the adversarial attack model of the video quality assessment model is mathematically modeled to obtain the adversarial attack model corresponding to the video quality assessment model.

[0050] The mathematical modeling formula for the adversarial attack model is as follows:

[0051]

[0052] in, and These represent the adversarial video and the original video, respectively; f e (·) represents the estimated quality score output by the video quality assessment model; f d(·) indicates the perturbation mass fraction; It is a loss function that measures the distance between the estimated quality score and the perturbation quality score; The distortion between the original video and the adversarial video; JND is the set pixel-level norm;

[0053] The boundary loss function based on fraction inversion is:

[0054]

[0055] in

[0056]

[0057] Before testing the model, this invention first constructs an adversarial attack model using a preset loss function and a perturbation distortion function. This is to maximize the misleading nature of the generated adversarial video on the test model by using the loss function in the adversarial attack model, thereby improving the accuracy of model testing. The perturbation distortion function limits the distortion between the generated adversarial video and the original video, making the perturbation imperceptible to the human eye. This solves the problem of manually judging the perturbation distortion of adversarial videos in the prior art, reduces the consumption of manpower and material resources, and improves the efficiency of model testing.

[0058] As a preferred example, the white-box attack module includes a video segmentation unit and an interference unit;

[0059] The video segmentation unit is used to determine, based on the number of video frames in the original video and the preset number of optimized video frames in each round, the adversarial video generated through several rounds of optimization, and several video frames contained in the original video optimized in each round of optimization.

[0060] The interference unit is used to interfere with several video frames contained in the original video being optimized in each round of the optimization process by means of a preset initial perturbation, thereby obtaining a first initial adversarial video corresponding to the several video frames; and to obtain an initial adversarial video corresponding to the original video by combining the first initial adversarial video obtained in each round of optimization.

[0061] In each round of generating the adversarial video corresponding to the original video, the present invention first performs initial perturbation on several video frames optimized in the current round of optimization by using a preset initial perturbation interference to generate the first initial adversarial video obtained in each round of optimization. Then, the first initial adversarial videos obtained in each round of optimization are combined to obtain the initial adversarial video, so as to attack the model under test according to the initial adversarial video, and then test the model under test.

[0062] As a preferred example, the black box attack module includes a video segmentation unit and a video block interference unit;

[0063] The video segmentation unit is used to divide each video frame in the acquired original video into image channels, determine the number of image channels included in each video frame; obtain the first area of ​​the video frame corresponding to each image channel in the number of image channels, and divide the first area according to the second area of ​​the preset first video block to obtain the number of first video blocks corresponding to each video frame.

[0064] The video block interference unit is used to determine, based on the number of video frames in the original video and the preset number of optimized video frames in each round, the initial adversarial video generated through several rounds of optimization, and several video frames contained in the original video optimized in each round of optimization; in each round of optimization, several queries are performed on several first video blocks corresponding to several video frames in the optimization process, and in each query, a first video block located at the same position in the several video frames is randomly selected for perturbation to generate several second video blocks corresponding to the several video frames; a corresponding perturbation map is generated based on the several second video blocks, and the perturbation map is aggregated with the several second video blocks to generate the first initial adversarial video corresponding to the several video frames in each round of optimization; combined with the first initial adversarial video obtained in each round of optimization, the initial adversarial video corresponding to the original video is obtained.

[0065] This invention divides each video frame according to image channels, then obtains the first area of ​​the video frames contained in each image channel, and divides the first area using the area of ​​a preset video block to obtain several first video blocks corresponding to one image channel. Based on the number of image channels divided in a video frame, the video blocks corresponding to each video frame in the original video are obtained. The video frames are then segmented to improve the efficiency of black-box search and thus the efficiency of adversarial video generation. The original video is divided according to video frames, generating several video blocks corresponding to each video frame. During the perturbation of the video blocks, video blocks at the same position are selected and perturbed for each video frame selected in each round of optimization. The interference with the original video is completed based on the number of queries and the number of rounds of optimization. By searching the video blocks, this invention avoids the technical problem in existing technologies where the number of queries is positively correlated with video resolution, leading to a large number of queries and reduced query efficiency. This improves the query efficiency in both the spatial and temporal domains. Attached Figure Description

[0066] Figure 1: A schematic flowchart of a testing method for a video quality assessment model provided in an embodiment of the present invention;

[0067] Figure 2 : A schematic diagram of the structure of a test system for a video quality assessment model provided in an embodiment of the present invention;

[0068] Figure 3 : A flowchart illustrating a testing method for a video quality assessment model provided in another embodiment of the present invention;

[0069] Figure 4 : A schematic diagram of an algorithm for generating attack videos based on white-box mapping, provided in another embodiment of the present invention;

[0070] Figure 5 : A schematic diagram of a block-based random search black-box method provided in another embodiment of the present invention;

[0071] Figure 6 : A schematic diagram of an algorithm for generating attack videos based on black boxes, provided as another embodiment of the present invention. Detailed Implementation

[0072] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0073] Example 1

[0074] This invention provides a testing method for a video quality assessment model. The specific implementation process of the testing method is described in the following embodiment. Figure 1 It mainly includes steps 101 to 105, wherein the steps include:

[0075] Step 101: Based on the model parameters of the video quality assessment model to be tested, determine the attack scenario for adversarial attacks on the video quality assessment model.

[0076] Step 102: If the attack scenario is a white-box attack, the acquired original video is perturbed by a preset initial perturbation to obtain the initial adversarial video corresponding to the original video.

[0077] In this embodiment, before performing this step: mathematical modeling of the adversarial attack on the video quality assessment model is performed based on a preset boundary loss function and perturbation distortion function to obtain the adversarial attack model corresponding to the video quality assessment model;

[0078] The mathematical modeling formula for the adversarial attack model is as follows:

[0079]

[0080] in, and These represent the adversarial video and the original video, respectively; f e (·) represents the estimated quality score output by the video quality assessment model; f d (·) indicates the perturbation mass fraction; It is a loss function that measures the distance between the estimated quality score and the perturbation quality score; The distortion between the original video and the adversarial video; JND is the set pixel-level norm;

[0081] The boundary loss function based on fraction inversion is:

[0082]

[0083] in

[0084]

[0085] This step mainly includes: determining, based on the number of video frames in the original video and the preset number of optimized video frames in each round, the adversarial video generated through several rounds of optimization, and several video frames contained in the original video optimized in each round of optimization; in each round of optimization, interfering with several video frames contained in the original video optimized in each round of optimization by a preset initial perturbation to obtain a first initial adversarial video corresponding to the several video frames; and combining the first initial adversarial video obtained in each round of optimization to obtain the initial adversarial video corresponding to the original video.

[0086] Step 103: If the attack scenario is a black-box attack, then each video frame in the acquired original video is divided into video blocks to obtain several first video blocks corresponding to each video frame in the original video. The several first video blocks are then queryed and perturbed to generate several second video blocks corresponding to each video frame in the original video, so as to generate an initial adversarial video corresponding to the original video based on the several second video blocks.

[0087] In this embodiment, the step mainly includes: dividing each video frame in the acquired original video into image channels to determine the plurality of image channels included in each video frame; obtaining the first area of ​​the video frame corresponding to each image channel in the plurality of image channels, and dividing the first area according to the second area of ​​the preset first video block to obtain a plurality of first video blocks corresponding to each video frame; determining, based on the number of video frames in the original video and the preset number of optimized video frames in each round, the initial adversarial video generated through a plurality of rounds of optimization process, and the plurality of video channels included in the original video optimized in each round of optimization process. In each round of optimization, several first video blocks corresponding to several video frames in the optimization process are queried several times, and in each query, a first video block located at the same position in the several video frames is randomly selected and perturbed to generate several second video blocks corresponding to the several video frames; a corresponding perturbation map is generated based on the several second video blocks, and the perturbation map is aggregated with the several second video blocks to generate the first initial adversarial video corresponding to the several video frames in each round of optimization; combined with the first initial adversarial video obtained in each round of optimization, the initial adversarial video corresponding to the original video is obtained.

[0088] Step 104: Continuously optimize the initial adversarial video using a preset adversarial attack model to generate an adversarial video corresponding to the original video.

[0089] In this embodiment, the step mainly includes: when the attack scenario is a white-box attack, iteratively optimizing the initial perturbation in the initial adversarial video using a boundary loss function preset in the adversarial attack model, and limiting the pixel-level norm of the generated adversarial video using a perturbation distortion function preset in the adversarial attack model to obtain the adversarial video corresponding to the initial adversarial video; when the attack scenario is a black-box attack, filtering several second video blocks in the initial adversarial video using a boundary loss function preset in the adversarial attack model, and simultaneously limiting the pixel-level norm of the generated adversarial video according to the perturbation distortion function in the adversarial attack model to obtain the adversarial video corresponding to the initial adversarial video.

[0090] Step 105: Input the adversarial video and the original video into the video quality assessment model to obtain the first assessment score corresponding to the adversarial video and the second assessment score corresponding to the original video, and obtain the robustness test result of the video quality assessment model based on the first assessment score and the second assessment score.

[0091] On the other hand, embodiments of the present invention disclose a testing system for a video quality assessment model, the specific structural composition of which can be referred to... Figure 2 It includes a scene analysis module 201, a white-box attack module 202, a black-box attack module 203, a video optimization module 204, and a model testing module 205;

[0092] The scenario analysis module 201 is used to determine the attack scenario for adversarial attacks on the video quality assessment model based on the model parameters of the video quality assessment model to be tested.

[0093] The white-box attack module 202 is used to perturb the acquired original video by a preset initial perturbation if the attack scenario is a white-box attack, so as to obtain the initial adversarial video corresponding to the original video.

[0094] The black-box attack module 203 is used to, if the attack scenario is a black-box attack, divide each video frame in the acquired original video into video blocks to obtain several first video blocks corresponding to each video frame in the original video, and query and perturb the several first video blocks to generate several second video blocks corresponding to each video frame in the original video, so as to generate an initial adversarial video corresponding to the original video based on the several second video blocks.

[0095] The video optimization module 204 is used to continuously optimize the initial adversarial video using a preset adversarial attack model to generate an adversarial video corresponding to the original video.

[0096] The model testing module 205 is used to input the adversarial video and the original video into the video quality assessment model respectively, obtain a first assessment score corresponding to the adversarial video and a second assessment score corresponding to the original video, and obtain the robustness test result of the video quality assessment model based on the first assessment score and the second assessment score.

[0097] In this embodiment, the testing system further includes:

[0098] Based on the preset boundary loss function and perturbation distortion function based on fraction inversion, the adversarial attack model of the video quality assessment model is mathematically modeled to obtain the adversarial attack model corresponding to the video quality assessment model.

[0099] The mathematical modeling formula for the adversarial attack model is as follows:

[0100]

[0101] in, and These represent the adversarial video and the original video, respectively; f e (·) represents the estimated quality score output by the video quality assessment model; f d(·) indicates the perturbation mass fraction; It is a loss function that measures the distance between the estimated quality score and the perturbation quality score; The distortion between the original video and the adversarial video; JND is the set pixel-level norm;

[0102] The boundary loss function based on fraction inversion is:

[0103]

[0104] in

[0105]

[0106] In this embodiment, the white-box attack module 202 includes a video segmentation unit and an interference unit;

[0107] The video segmentation unit is used to determine, based on the number of video frames in the original video and the preset number of optimized video frames in each round, the adversarial video generated through several rounds of optimization, and several video frames contained in the original video optimized in each round of optimization.

[0108] The interference unit is used to interfere with several video frames contained in the original video being optimized in each round of the optimization process by means of a preset initial perturbation, thereby obtaining a first initial adversarial video corresponding to the several video frames; and to obtain an initial adversarial video corresponding to the original video by combining the first initial adversarial video obtained in each round of optimization.

[0109] In this embodiment, the black box attack module 203 includes a video segmentation unit and a video block interference unit;

[0110] The video segmentation unit is used to divide each video frame in the acquired original video into image channels, determine the number of image channels included in each video frame; obtain the first area of ​​the video frame corresponding to each image channel in the number of image channels, and divide the first area according to the second area of ​​the preset first video block to obtain the number of first video blocks corresponding to each video frame.

[0111] The video block interference unit is used to determine, based on the number of video frames in the original video and the preset number of optimized video frames in each round, the initial adversarial video generated through several rounds of optimization, and several video frames contained in the original video optimized in each round of optimization; in each round of optimization, several queries are performed on several first video blocks corresponding to several video frames in the optimization process, and in each query, a first video block located at the same position in the several video frames is randomly selected for perturbation to generate several second video blocks corresponding to the several video frames; a corresponding perturbation map is generated based on the several second video blocks, and the perturbation map is aggregated with the several second video blocks to generate the first initial adversarial video corresponding to the several video frames in each round of optimization; combined with the first initial adversarial video obtained in each round of optimization, the initial adversarial video corresponding to the original video is obtained.

[0112] Example 2

[0113] This embodiment provides another testing method for video quality assessment models. For the specific implementation process of this testing method, please refer to [reference needed]. Figure 3 It mainly includes steps 301 to 303, wherein the steps include:

[0114] Step 301: Model an adversarial attack on the video quality assessment model to be tested, obtain the adversarial attack model corresponding to the video quality assessment model, obtain the model parameters of the video quality assessment model, and determine the attack scenario.

[0115] In this embodiment, the step includes: mathematically modeling the adversarial attack on the video quality assessment model based on a preset boundary loss function and perturbation distortion function, to obtain the adversarial attack model corresponding to the video quality assessment model.

[0116] The mathematical modeling formula for the adversarial attack model is as follows:

[0117]

[0118] in, and These represent the adversarial video and the original video, respectively; f e (·) represents the estimated quality score output by the video quality assessment model; f d (·) indicates the perturbation mass fraction; It is a loss function that measures the distance between the estimated quality score and the perturbation quality score; The distortion between the original video and the adversarial video; JND is the set pixel-level norm;

[0119] The boundary loss function based on fraction inversion is:

[0120]

[0121] in

[0122]

[0123] For example, in this embodiment, adversarial attack modeling based on the video quality assessment model is used to obtain the adversarial attack model corresponding to the target model to be tested. In this embodiment, the NR-VQA model is used as an example. In this part, the adversarial attack of the NR-VQA model is mathematically modeled to obtain the adversarial attack model. The mathematical modeling formula of the adversarial attack model is as follows:

[0124]

[0125] in, and These represent the adversarial video and the original video, respectively. e (·) represents the estimated quality score output by the target NR-VQA model, f d (·) indicates the perturbation mass fraction that deviates from its MOS in a specific direction. This is the loss function, which measures the distance between the estimated quality score and the perturbation quality score. The closer the estimated quality score is to the perturbation quality score, and the farther the estimated quality score is from its MOS (Mean Orientation), the stronger the misleading effect of adversarial attacks on the NR-VQA model. Let represent the distortion between the original video and the adversarial video. Limiting the distortion to below the JND threshold indicates that the perturbation is imperceptible to the human eye. The loss function is minimized under the JND constraint. Adversarial attacks on the NR-VQA model can be carried out in an efficient and imperceptible manner. To achieve an adversarial attack on the NR-VQA model according to Equation (1), a loss function needs to be designed. While mean squared error loss is widely used in regression problems, it is not suitable for adversarial attacks on NR-VQA models. This is because a well-executed adversarial attack on an NR-VQA model should have the ability to cause the estimated quality score to deviate from the mean squared error (MOS) in a specific direction—that is, to mislead the NR-VQA model into assigning high-quality scores to low-quality videos, and vice versa. Although applying mean squared error loss might cause the estimated quality score to deviate from the MOS, it cannot control the direction of deviation. Based on this, we propose a boundary loss function called score inversion. Represented as

[0126]

[0127] in

[0128]

[0129] In formula (3), the video quality can be determined by its MOS, with boundaries 0 and 1 serving as perturbation quality scores. Furthermore, the perturbation distortion between the original video and the adversarial video... This is also a problem that needs to be solved. Generally speaking, Limiting the distortion below the JND threshold indicates that the perturbation is invisible to the human eye. Using subjective human experiments to determine whether the perturbation distortion is below the JND threshold is a feasible approach. However, such subjective experiments are time-consuming and laborious. We reference work in the adversarial example domain to construct a JND constraint. Considering a pair of original and adversarial videos, the problem of limiting their distortion below the JND threshold can be transformed into limiting their pixel-level L2 norm below a fairly strict threshold.

[0130] After obtaining the adversarial attack model, the attacker can determine whether the current attack is a white-box attack or a black-box attack by accessing the parameters of the target model to be tested, i.e., the video quality assessment model. In the case of a white-box attack, the attacker can access the parameters of the target model. Compared with a white-box attack, a black-box attack is a more realistic attack scenario because it can only query the final output of the model. Therefore, the attacker can determine whether the current attack scenario is a white-box attack or a black-box attack by obtaining the model parameters.

[0131] Step 302: When the attack scenario is a white-box attack, the preset initial perturbation is used to interfere with the preset original video to obtain the corresponding initial adversarial video, and the initial adversarial video is optimized by the adversarial attack model to generate an adversarial video.

[0132] In this embodiment, the step mainly includes: if the attack scenario is a white-box attack, the acquired original video is perturbed by a preset initial perturbation to obtain an initial adversarial video corresponding to the original video; the initial adversarial video is continuously optimized by a preset adversarial attack model to generate an adversarial video corresponding to the original video.

[0133] For example, in this embodiment, in the case of a white-box attack, the attacker can access the parameters of the target model. Therefore, the steepest descent method can be used to minimize the boundary loss function of score inversion in formula (2). The process of generating adversarial videos includes... The rounds are defined as follows: X represents the number of frames in the video, and T represents the number of frames optimized in a round. At the beginning of each round, an adversarial video is obtained by adding an initial perturbation to the original video. The initial perturbation is denoted as... Each pixel is independently sampled from the discrete set {-1 / 255, 0, 1 / 255}. Then, a round consists of K iterations to optimize the perturbation, with one iteration comprising the following steps: First, the obtained adversarial video is input into the target NR-VQA model, and calculations are performed. The steepest descent direction is used to optimize the perturbation; secondly, the pixel-level L2 norm is limited to within 1 / 255 using the projected gradient descent method, which can be seen as a strict JND constraint; following these steps, adversarial videos with X frames can be generated under white-box conditions. For a detailed process of generating adversarial videos from the NR-VQA model in a white-box environment, please refer to [link to relevant documentation]. Figure 4 The Figure 4 This is an example diagram of a white-box attack algorithm provided in an embodiment of the present invention.

[0134] Step 303: When the attack scenario is a black-box attack, the acquired original video is divided into video blocks to obtain several video blocks corresponding to the original video. The several video blocks are query-perturbed, and an initial adversarial video is generated based on the query-perturbed video blocks. The initial adversarial video is then optimized using the adversarial attack model to generate an adversarial video.

[0135] In this embodiment, this step mainly includes: if the attack scenario is a black-box attack, then each video frame in the acquired original video is divided into video blocks to obtain several first video blocks corresponding to each video frame in the original video, and the several first video blocks are query-perturbed to generate several second video blocks corresponding to each video frame in the original video, so as to generate an initial adversarial video corresponding to the original video based on the several second video blocks; the initial adversarial video is continuously optimized through a preset adversarial attack model to generate an adversarial video corresponding to the original video.

[0136] For example, in this embodiment, black-box attacks are a more practical attack scenario compared to white-box attacks because adversarial examples can only be optimized by querying the final output of the model. In black-box attacks, the number of queries is an important evaluation metric. To reduce the spatiotemporal query resources under black-box attacks, this invention designs a block-based random search black-box method, such as... Figure 5 The diagram illustrates a block-based random search black-box method according to an embodiment of the present invention. In this section, the height and width of the video frame are denoted as H and W, respectively. The height and width of the block are denoted as h and w, respectively. We divide each frame image into three channels: red, green, and blue, and then further subdivide each channel into non-overlapping blocks. Each frame contains blocks. Each block; the process of generating adversarial videos includes... The term "round" refers to a sequence of N queries, where X represents the number of frames in the video and T represents the number of frames optimized in one round. Specifically, N queries are executed in one round. The detailed steps of the optimization process in the nth query are as follows: First, for each frame in T frames, Z blocks located at the same position in T frames are randomly selected for perturbation; note that in each round of attack, each block is selected exactly once, and in N queries, all blocks are selected. Therefore, we can obtain... For ease of explanation, the position information of the selected block is encoded into a vector, denoted as . in p n Each element in the array corresponds to a specific block within a frame. If that block is perturbed, the element is assigned a value of 1; otherwise, it is assigned a value of 0. Note that T frames optimized in a round share the same p... n Secondly, for these T×Z blocks, a general perturbation map m is generated. n The m n Since each block in T×Z has the same dimension as the smaller blocks, and each block has a dimension of h×w, then m n The dimension is also h×w, and each pixel is m. n A small pixel in, m n If the dimension is h×w, then it has h×w pixels. The discrete set {-γ, +γ} means that the values ​​of all h×w pixels are either -γ or +γ, and the value of each pixel is randomly selected from these two values. Generate a general perturbation map m. n Then, they are all assigned to T×Z blocks. Their dimensions are the same as the block dimensions, and each pixel is independently sampled from a discrete set {-γ, +γ}. Then, the selected T×Z blocks are subtracted from or added to the general perturbation map to obtain the corresponding initial adversarial video, and the generated adversarial video is input into the adversarial attack model. If the boundary loss function of fraction inversion in formula (2) decreases, the selected perturbation block will be retained; otherwise, it will be discarded. Following the above three steps, an adversarial video with X frames can be generated under black-box conditions. This invention also provides an algorithm for generating adversarial videos for NR-VQA models under black-box conditions. The algorithm can be referred to Figure 6 .

[0137] In this embodiment, the block-based random search black-box method is used as a black-box attack, and the constraints of JND can be represented as L∞ or pixel-level L2 norm. First, the L∞ norm between the original video and the adversarial video is γ, because the maximum modification level of each pixel in the adversarial video is γ; second, the frame-level L2 norm between the original video and the adversarial video can be represented as...

[0138]

[0139] The last inequality holds because different blocks are selected only once in different rounds, and the last inequality is equal if all blocks are preserved. In the black-box attack, γ is set to 5 / 255. Therefore, the pixel-level L2 norm can be derived as follows:

[0140]

[0141] Experimental results show that only about 3 / 5 of the blocks are retained as added perturbations, so the actual pixel-level L2 norm is around 3 / 255.

[0142] Step 304: Input the adversarial video and the original video into the video quality assessment model respectively, and obtain the robustness test result of the video quality assessment model based on the output assessment score.

[0143] In this embodiment, the target NR-VQA model outputs a score for the video. A robust NR-VQA model should output a score consistent with a human's score for the video. Adversarial videos involve adding perturbations imperceptible to the human eye to the original video, so to the human eye, the scores for the original video and the adversarial video are almost indistinguishable. The original video and the generated adversarial video are input into the target NR-VQA model. If the target NR-VQA model outputs a significantly different score for the adversarial video (which is imperceptibly different to the human eye), then the NR-VQA model is not robust. Conversely, if the score does not change significantly, then the NR-VQA model is robust.

[0144] Based on the testing method for a video quality assessment model provided in this invention, four representative NR-VQA models, including VSFA, MDTVSFA, TiVQA, and BVQA-2022, were tested under both white-box and black-box settings. Simultaneously, our method was validated on four mainstream video datasets: KoNViD-1k, LIVE-VQC, YouTube-UGC, and LSVQ. Furthermore, ablation experiments demonstrated the effectiveness of our proposed score-inverted boundary loss function and block-based random search black-box method.

[0145] Our method uses two mainstream metrics to validate performance: SRCC and PLCC. SRCC is used to evaluate the monotonicity between MOS and prediction quality, while PLCC is used to evaluate the accuracy of the prediction results. If the SRCC and PLCC of the target NR-VQA model do not change significantly with respect to the original and adversarial videos being evaluated, the NR-VQA model is robust. Conversely, if the SRCC and PLCC of the target NR-VQA model change drastically with respect to the original and adversarial videos being evaluated, the NR-VQA model is poorly robust.

[0146] Under a white-box setup, the experimental results are shown in the table below. It can be observed that the state-of-the-art NR-VQA model completely fails under adversarial attacks.

[0147]

[0148] Specifically, this attack caused an average performance drop of 190% and 194% for SRCC and PLCC, respectively, demonstrating the vulnerability of these NR-VQA models.

[0149] Under black-box settings, the experimental results are shown in the table below. It can be observed that the SRCC and PLCC of the attacked VSFA, MDTVSFA and TiVQA are all around 0, indicating that the attack effect on these models is quite significant.

[0150]

[0151]

[0152] Although adversarial attacks on BVQA-2022 are not very significant, they still lead to a significant performance drop on the KoNVi D-1k dataset, specifically 0.6449 on SRCC and 0.6254 on PLCC. These results indicate that current VQA models are not robust to adversarial attacks and can be severely compromised even in black-box settings.

[0153] In ablation experiments, the effectiveness of our proposed score-inverted boundary loss function and block-based random search black-box method was demonstrated. Impact graphs were obtained on the estimated quality score ((a) and (b)) and query efficiency ((c) and (d)) with increasing iterations and query counts under both white-box and black-box attack scenarios. The impact graphs show that minimizing the score-inverted boundary loss function achieves satisfactory attack results. Specifically, in the white-box setting, the estimated quality score output by the NR-VQA model essentially reaches the target boundary. Furthermore, the impact graphs show that the score-inverted boundary loss function exhibits a significant advantage in query efficiency compared to the mean squared error loss function.

[0154] As can be seen from the table below, compared with pixel-based methods, block-based methods show significant improvements in both attack effectiveness and query efficiency.

[0155]

[0156]

[0157] Specifically, the block-based method only requires 300 queries to completely disable the NR-VQA model, while the pixel-based method has almost no attack effect after 1000 queries.

[0158] This invention provides a testing method for a video quality assessment model that mathematically models adversarial attacks on the NR-VQA model. It misleads the NR-VQA model by limiting the perturbation below the JND threshold to widen the distance between the estimated quality score and the perturbation quality score. This is the first work to apply adversarial attacks to study the robustness of the NR-VQA model. A novel loss function, called the score-inverted boundary loss function, is then proposed to push the estimated quality score of the adversarial video towards a specific boundary from its MOS. By minimizing this loss function, the generated adversarial video can effectively invalidate state-of-the-art NR-VQA models. Furthermore, a block-based random search black-box method is proposed to address adversarial attacks on the NR-VQA model, which significantly improves query efficiency in the spatiotemporal domain.

[0159] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A method for testing a video quality assessment model, characterized in that, The method comprises the steps of: determining an attack scenario of performing an adversarial attack on the video quality evaluation model according to the obtained model parameters of the video quality evaluation model to be tested; if the attack scenario is a white-box attack, performing perturbation on the obtained original video through a preset initial perturbation to obtain an initial adversarial video corresponding to the original video; if the attack scenario is a black-box attack, performing video blocking on each video frame in the obtained original video respectively to obtain a plurality of first video blocks corresponding to each video frame in the original video, and performing query perturbation on the plurality of first video blocks to generate a plurality of second video blocks corresponding to each video frame in the original video, so as to generate an initial adversarial video corresponding to the original video according to the plurality of second video blocks; wherein the division of the image channel of each video frame in the obtained original video is performed to determine a plurality of image channels included in each video frame; the first area of the video frame corresponding to each image channel in the plurality of image channels is obtained, and the first area is divided according to the second area of the preset first video block to obtain a plurality of first video blocks corresponding to each video frame; continuously optimizing the initial adversarial video through a preset adversarial attack model to generate an adversarial video corresponding to the original video; inputting the adversarial video and the original video into the video quality evaluation model respectively to obtain a first evaluation score corresponding to the adversarial video and a second evaluation score corresponding to the original video, and obtaining a robustness test result of the video quality evaluation model according to the first evaluation score and the second evaluation score.

2. The method of claim 1, wherein, Before the step of determining the attack scenario of performing an adversarial attack on the video quality evaluation model, the method further comprises the steps of: mathematically modeling the adversarial attack on the video quality evaluation model according to a preset score inversion-based boundary loss function and a perturbation distortion function to obtain an adversarial attack model corresponding to the video quality evaluation model; wherein the mathematical modeling formula of the adversarial attack model is: wherein, and represent the adversarial video and the original video, respectively; denotes the estimated quality score output by the video quality assessment model; denotes the perturbed quality score; is a loss function that measures the distance between the estimated quality score and the perturbed quality score; is the distortion degree between the original video and the adversarial video; the JND is a pixel-level norm set. wherein the score inversion-based boundary loss function is: wherein 。 3. The testing method for a video quality assessment model as described in claim 1, characterized in that, The step of performing perturbation on the obtained original video through a preset initial perturbation to obtain an initial adversarial video corresponding to the original video comprises the steps of: determining that the adversarial video is generated through a plurality of rounds of optimization processes and a plurality of video frames included in the original video optimized in each round of optimization processes according to the video frame number of the original video and the preset video frame number optimized in each round; in each round of optimization process in the plurality of rounds of optimization processes, interfering a plurality of video frames included in the original video optimized in each round of optimization process through a preset initial perturbation to obtain a first initial adversarial video corresponding to the plurality of video frames; obtaining the initial adversarial video corresponding to the original video in combination with the first initial adversarial video obtained in each round of optimization process.

4. The method of claim 1, wherein, The step of performing query perturbation on the plurality of first video blocks to generate a plurality of second video blocks corresponding to each video frame in the original video comprises the steps of: According to the video frame number of the original video and the preset video frame number optimized in each round, the initial adversarial video generated by the several rounds of optimization process and the several video frames contained in the original video optimized in each round of optimization process are determined; In each round of optimization process, the several first video blocks corresponding to the several video frames in the optimization process are queried for several times, and in each query process, the first video block located at the same position in the several video frames is randomly selected for disturbance to generate the several second video blocks corresponding to the several video frames; According to the several second video blocks, the corresponding disturbance map is generated, and the disturbance map and the several second video blocks are aggregated to generate the first initial adversarial video corresponding to the several video frames in each round of optimization process; The initial adversarial video corresponding to the original video is obtained by combining the first initial adversarial video obtained in each round of optimization process.

5. The method of claim 1, wherein, The initial adversarial video is continuously optimized by the preset adversarial attack model to generate the adversarial video corresponding to the original video, including: When the attack scene is white-box attack, the initial disturbance in the initial adversarial video is iteratively optimized by the boundary loss function preset in the adversarial attack model, and the pixel level norm of the generated adversarial video is limited by the disturbance distortion function preset in the adversarial attack model, to obtain the adversarial video corresponding to the initial adversarial video; When the attack scene is black-box attack, the several second video blocks in the initial adversarial video are screened by the boundary loss function preset in the adversarial attack model, and the pixel level norm of the generated adversarial video is limited according to the disturbance distortion function in the adversarial attack model, to obtain the adversarial video corresponding to the initial adversarial video.

6. A test system for a video quality assessment model, characterized in that, The scene analysis module, the white-box attack module, the black-box attack module, the video optimization module and the model test module are included; The scene analysis module is used to determine the attack scene of the adversarial attack on the video quality evaluation model according to the model parameters of the video quality evaluation model to be tested; The white-box attack module is used to disturb the original video obtained by the preset initial disturbance if the attack scene is white-box attack, to obtain the initial adversarial video corresponding to the original video; The black-box attack module is configured to, if the attack scenario is a black-box attack, perform video blocking on each video frame in the obtained original video respectively to obtain a plurality of first video blocks corresponding to each video frame in the original video, and perform query disturbance on the plurality of first video blocks to generate a plurality of second video blocks corresponding to each video frame in the original video, so as to generate an initial adversarial video corresponding to the original video according to the plurality of second video blocks; wherein the black-box attack module comprises a video blocking unit configured to divide image channels of each video frame in the obtained original video to determine a plurality of image channels included in the each video frame; obtain a first area of a video frame corresponding to each image channel in the plurality of image channels, and divide the first area according to a second area of a preset first video block to obtain a plurality of first video blocks corresponding to the each video frame; The video optimization module is configured to continuously optimize the initial adversarial video by using a preset adversarial attack model to generate an adversarial video corresponding to the original video; The model test module is configured to input the adversarial video and the original video into the video quality evaluation model respectively to obtain a first evaluation score corresponding to the adversarial video and a second evaluation score corresponding to the original video, and obtain a robustness test result of the video quality evaluation model according to the first evaluation score and the second evaluation score.

7. The test system of a video quality assessment model of claim 6, wherein, Further comprising: mathematically modeling adversarial attacks on the video quality evaluation model according to a score inversion-based boundary loss function and a disturbance distortion function to obtain an adversarial attack model corresponding to the video quality evaluation model; wherein the mathematical modeling formula of the adversarial attack model is: wherein, and respectively represent the adversarial video and the original video; denotes the estimated quality score output by the video quality assessment model; denotes the perturbed quality score; is a loss function measuring the distance between the estimated quality score and the perturbed quality score; is the distortion degree between the original video and the adversarial video; the JND is a pixel-level norm set. wherein the score inversion-based boundary loss function is: wherein 。 8. The test system of a video quality assessment model of claim 6, wherein, The white-box attack module comprises a video division unit and a disturbance unit. The video division unit is configured to determine, according to the number of video frames of the original video and the number of video frames optimized in each round, that the adversarial video is generated through a plurality of rounds of optimization processes, and that a plurality of video frames included in the original video are optimized in each round of optimization process. The disturbance unit is configured to, in each round of optimization process in the plurality of rounds of optimization processes, disturb a plurality of video frames included in the original video optimized in each round of optimization process by using a preset initial disturbance to obtain a first initial adversarial video corresponding to the plurality of video frames; and combine the first initial adversarial video obtained in each round of optimization process to obtain an initial adversarial video corresponding to the original video.

9. The test system of a video quality assessment model of claim 6, wherein, The black-box attack module further comprises a video block disturbance unit; The video block interference unit is configured to determine, according to a video frame number of the original video and a preset video frame number optimized in each round, a plurality of rounds of optimization processes for generating the initial adversarial video and a plurality of video frames contained in the original video optimized in each round of optimization process; in each round of optimization process, a plurality of first video blocks corresponding to the plurality of video frames in the optimization process are queried a plurality of times, and in each query process, a first video block located at a same position in the plurality of video frames is randomly selected for disturbance to generate a plurality of second video blocks corresponding to the plurality of video frames; a corresponding disturbance map is generated according to the plurality of second video blocks, and the disturbance map and the plurality of second video blocks are aggregated to generate a first initial adversarial video corresponding to the plurality of video frames in each round of optimization process; and the initial adversarial video corresponding to the original video is obtained by combining the first initial adversarial video obtained in each round of optimization process.

Images