Adversarial sample detection method, device, electronic device and storage medium

Abstract

The embodiments of the present application provide an adversarial sample detection method, apparatus, electronic device, and storage medium. The method includes: determining an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; extracting features from each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance; determining intermediate features and first reconstruction features of each segmentation instance based on semantic attributes and a target graph convolutional neural network, wherein the semantic attributes include an adjacency matrix and attribute features; determining global loss information based on the first reconstruction features and attribute features of all segmentation instances; determining local loss information based on the second reconstruction features and intermediate features of each segmentation instance, wherein the second reconstruction features are determined based on a target autoencoder corresponding to the prediction type of the segmentation instance; and determining whether the image to be tested is an adversarial sample based on the global loss information and the local loss information. This embodiment accurately detects adversarial samples in image segmentation tasks.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of image processing technology, and in particular to a method, device, electronic device, and storage medium for detecting adversarial samples. Background Art

[0002] Adversarial examples are maliciously designed to attack machine learning models. They are nearly indistinguishable from real examples, yet can cause the model to misjudge the outcome. The existence of adversarial examples poses a threat to the application of deep learning in security-sensitive fields.

[0003] In related technologies, all features of a test image are directly extracted to perform adversarial sample detection.

[0004] However, during the above feature extraction process, rich image semantic feature information is lost, making it difficult to accurately detect adversarial samples. Summary of the Invention

[0005] Embodiments of the present application provide an adversarial sample detection method, apparatus, electronic device, and storage medium for accurately detecting adversarial samples in image segmentation tasks.

[0006] In a first aspect, embodiments of the present application provide a first adversarial sample detection method, the method comprising:

[0007] Determining an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; and performing feature extraction on each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance;

[0008] Determining intermediate features and first reconstructed features of each segmentation instance based on semantic attributes and a target graph convolutional neural network, wherein the semantic attributes include the adjacency matrix and the attribute features;

[0009] Determining global loss information based on the first reconstructed features and the attribute features of all segmented instances; and determining local loss information based on the second reconstructed features and the intermediate features of each segmented instance; wherein the second reconstructed features of any segmented instance are determined based on the target autoencoder corresponding to the prediction type of the segmented instance;

[0010] Based on the global loss information and the local loss information, it is determined whether the image to be tested is an adversarial sample.

[0011] In the image segmentation task, the above scheme uses semantic attributes (adjacency matrix and attribute features) to represent the semantic features of the image to be tested, with less information loss; uses graph convolutional neural networks to transmit messages for semantic attributes, and better encodes the co-occurrence relationship between the segmentation instance itself and other segmentation instances; uses graph convolutional neural networks to reconstruct features from a global perspective and determine the global reconstruction error (global loss information); based on the target autoencoder corresponding to the prediction type of each segmentation instance, determines the second reconstruction feature, and further determines the local reconstruction error (local loss information) of each segmentation instance, encoding the co-occurrence and consistency of local and global semantic features; and then based on the global loss information and local loss information, combines the global and local dimensions to more accurately detect adversarial samples.

[0012] In some optional implementations, before determining the adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested, the method further includes:

[0013] The image to be tested is segmented to determine segmentation instances of the image to be tested and a prediction type of each segmentation instance.

[0014] In some optional implementations, determining an adjacency matrix based on the connectivity between all segmentation instances in the image to be tested includes:

[0015] For a main diagonal in the adjacency matrix, determining the first parameter as an element corresponding to the main diagonal;

[0016] For the non-main diagonal in the adjacency matrix, any two segmentation instances in the image to be tested are compared; if the two segmentation instances are adjacent or intersecting, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the first parameters; otherwise, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the second parameters.

[0017] In some optional implementations, determining the intermediate features and the first reconstructed features of each segmentation instance based on the semantic attributes and the target graph convolutional neural network includes:

[0018] Inputting the semantic attributes into the encoder of the target graph convolutional neural network, performing encoding processing through the encoder, and outputting intermediate features of each segmentation instance;

[0019] The intermediate features of each segmentation instance are input into the decoder of the target graph convolutional neural network, and the encoder performs decoding processing to output the first reconstructed features of each segmentation instance.

[0020] In some optional implementations, determining global loss information based on the first reconstructed features and attribute features of all segmented instances includes:

[0021] For any segmentation instance, determining the sum of squares of differences between the first reconstructed feature and the attribute feature of the segmentation instance as first loss information of the segmentation instance;

[0022] The average of the first loss information of all segmented instances is determined as the global loss information.

[0023] In some optional implementations, determining local loss information based on the second reconstructed features and the intermediate features of each segmentation instance includes:

[0024] For any segmentation instance, determining the sum of squares of differences between the second reconstructed feature and the intermediate feature of the segmentation instance as second loss information of the segmentation instance;

[0025] The maximum value of the second loss information in all segmentation instances is determined as the local loss information.

[0026] In some optional implementations, determining whether the image to be tested is an adversarial example based on the global loss information and the local loss information includes:

[0027] Performing weighted calculation on the global loss information and the local loss information to obtain a detection value of the image to be tested;

[0028] If the detection value is greater than a preset threshold, the image to be tested is determined to be an adversarial sample; otherwise, the image to be tested is determined to be a non-adversarial sample.

[0029] In some optional implementations, the target autoencoder is trained by:

[0030] For any labeled category, using the category loss information corresponding to the labeled category of the normal white sample as a loss function, and using the segmented instances of the labeled category in the normal white sample to train the initial autoencoder to obtain a target autoencoder for the labeled category; wherein the category loss information is determined based on the second reconstructed features and intermediate features of the segmented instances of the labeled category;

[0031] The target graph convolutional neural network is trained in the following way:

[0032] The global loss information of the normal white samples is used as the loss function, and the normal white samples are used to train the initial graph convolutional neural network to obtain the target graph convolutional neural network.

[0033] In a second aspect, an embodiment of the present application provides a first adversarial sample detection device, which includes:

[0034] A semantic attribute determination module is used to determine an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; and to extract features from each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance;

[0035] A feature processing module, configured to determine intermediate features and a first reconstructed feature of each segmentation instance based on semantic attributes and a target graph convolutional neural network, wherein the semantic attributes include the adjacency matrix and the attribute features;

[0036] a loss determination module configured to determine global loss information based on first reconstructed features and attribute features of all segmented instances; and to determine local loss information based on second reconstructed features and intermediate features of each segmented instance; wherein the second reconstructed features of any segmented instance are determined based on a target autoencoder corresponding to a prediction type of the segmented instance;

[0037] An adversarial detection module is used to determine whether the image to be tested is an adversarial sample based on the global loss information and the local loss information.

[0038] In a third aspect, an embodiment of the present application provides an electronic device comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any adversarial sample detection method described in the first aspect.

[0039] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, the processor executes the adversarial sample detection method described in any one of the first aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0041] Figure 1 A flowchart of the first adversarial sample detection method provided in an embodiment of the present application;

[0042] Figure 2 A flowchart of the second adversarial sample detection method provided in an embodiment of the present application;

[0043] Figure 3 An example flow chart of the model training method provided in an embodiment of the present application;

[0044] Figure 4 A schematic diagram of the structure of an adversarial sample detection device provided in an embodiment of the present application;

[0045] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. It is obvious that the embodiments described are only some of the embodiments of this application, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0047] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature specified as "first" or "second" may explicitly or implicitly include one or more of such features. Throughout this application, unless otherwise specified, "plurality" means two or more.

[0048] In the description of this application, it should be noted that, unless otherwise specified or limited, the term "connection" should be understood in a broad sense. For example, it can mean direct connection, indirect connection through an intermediate medium, or internal communication between two devices. Those skilled in the art will understand the specific meaning of the above terms in this application based on specific circumstances.

[0049] The existence of adversarial examples threatens the application of deep learning in security-sensitive fields.

[0050] In related technologies, all features of a test image are directly extracted to perform adversarial sample detection.

[0051] However, during the above feature extraction process, rich image semantic feature information is lost, making it difficult to accurately detect adversarial samples.

[0052] In addition, the above-mentioned adversarial sample detection methods are mainly used for image classification tasks and are not suitable for image segmentation tasks.

[0053] In view of this, an embodiment of the present application proposes a method, device, electronic device and storage medium for detecting adversarial samples, the method comprising: determining an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; and, performing feature extraction on each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance; determining intermediate features and first reconstruction features of each segmentation instance based on semantic attributes and a target graph convolutional neural network; wherein the semantic attributes include the adjacency matrix and the attribute features; determining global loss information based on the first reconstruction features and attribute features of all segmentation instances; and determining local loss information based on the second reconstruction features and intermediate features of each segmentation instance; wherein the second reconstruction features of any segmentation instance are determined based on the target autoencoder corresponding to the prediction type of the segmentation instance; and determining whether the image to be tested is an adversarial sample based on the global loss information and the local loss information.

[0054] In the image segmentation task, the above scheme uses semantic attributes (adjacency matrix and attribute features) to represent the semantic features of the image to be tested, with less information loss; uses graph convolutional neural networks to transmit messages for semantic attributes, and better encodes the co-occurrence relationship between the segmentation instance itself and other segmentation instances; uses graph convolutional neural networks to reconstruct features from a global perspective and determine the global reconstruction error (global loss information); based on the target autoencoder corresponding to the prediction type of each segmentation instance, determines the second reconstruction feature, and further determines the local reconstruction error (local loss information) of each segmentation instance, encoding the co-occurrence and consistency of local and global semantic features; and then based on the global loss information and local loss information, combines the global and local dimensions to more accurately detect adversarial samples.

[0055] The following will be combined with the accompanying drawings and specific embodiments to explain in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0056] Figure 1 The flowchart of the first adversarial sample detection method provided in the embodiment of the present application is as follows: Figure 1 As shown, the following steps are included:

[0057] Step S101: determining an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; and performing feature extraction on each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance.

[0058] In the implementation, in order to combine the co-occurrence and adjacent relationships between different segmentation instances in the image to be tested, an adjacency matrix is ​​generated based on the connection relationship between all segmentation instances in the image to be tested, and the adjacency matrix represents the co-occurrence and adjacent relationships between different segmentation instances;

[0059] In order to combine the pixel information of the segmentation instance of the image to be tested, feature extraction is also performed on each segmentation instance to obtain the attribute features of each segmentation instance, and the attribute features represent the pixel information of the corresponding segmentation instance.

[0060] Step S102: Based on semantic attributes and a target graph convolutional neural network, determine the intermediate features and the first reconstructed features of each segmentation instance; wherein the semantic attributes include the adjacency matrix and the attribute features.

[0061] In practice, the pixel information of the segmented instance itself, as well as the co-occurrence and adjacency relationship of the segmented instance as a whole, contain rich semantics. Based on this, this embodiment combines the adjacency matrix and attribute features as semantic attributes;

[0062] A graph convolutional neural network is used to transmit semantic attributes, fuse the features of the segmentation instance itself and its adjacent segmentation instances, and better encode the co-occurrence relationship between the segmentation instance itself and other segmentation instances; further, a graph convolutional neural network is used to reconstruct features from a global perspective to determine the globally reconstructed features.

[0063] Step S103: determining global loss information based on the first reconstructed features and attribute features of all segmented instances; and determining local loss information based on the second reconstructed features and intermediate features of each segmented instance.

[0064] The second reconstructed feature of any segmentation instance is determined based on the target autoencoder corresponding to the prediction type of the segmentation instance.

[0065] In this embodiment, a graph convolutional neural network is used to perform feature reconstruction from a global perspective, and a global reconstruction error (global loss information) is determined based on the first reconstruction feature and the attribute feature.

[0066] During implementation, in order to detect adversarial samples more accurately, the second reconstruction features of each segmentation instance are determined based on the target autoencoder corresponding to the prediction type of each segmentation instance; further, based on the second reconstruction features and intermediate features of each segmentation instance, the local reconstruction error (local loss information) of each segmentation instance is determined.

[0067] For example, in, is the second reconstructed feature of segmentation instance i, z i is the intermediate feature of segmentation instance i; N kis the target autoencoder corresponding to the prediction type k of segmentation instance i.

[0068] Step S104: Based on the global loss information and the local loss information, determine whether the image to be tested is an adversarial sample.

[0069] In the image segmentation task, the above scheme uses semantic attributes (adjacency matrix and attribute features) to represent the semantic features of the image to be tested, with less information loss; uses graph convolutional neural networks to transmit messages for semantic attributes, and better encodes the co-occurrence relationship between the segmentation instance itself and other segmentation instances; uses graph convolutional neural networks to reconstruct features from a global perspective and determine the global reconstruction error (global loss information); based on the target autoencoder corresponding to the prediction type of each segmentation instance, determines the second reconstruction feature, and further determines the local reconstruction error (local loss information) of each segmentation instance, encoding the co-occurrence and consistency of local and global semantic features; and then based on the global loss information and local loss information, combines the global and local dimensions to more accurately detect adversarial samples.

[0070] Figure 2 A flow chart of the second adversarial sample detection method provided in the embodiment of the present application is shown as follows: Figure 2 As shown, the following steps are included:

[0071] Step S201: Segment the image to be tested, determine the segmentation instances of the image to be tested and the prediction type of each segmentation instance.

[0072] Exemplarily, a trained image segmentation system is used, and the image to be tested is input into the image segmentation system. The image segmentation system performs instance segmentation to determine the segmentation instances of the image to be tested, that is, which pixel areas of the image to be tested each segmentation instance corresponds to; in addition, the image segmentation system can also be used to determine the prediction type of each segmentation instance.

[0073] Step S202: determining an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; and performing feature extraction on each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance.

[0074] Step S203: Determine the intermediate features and the first reconstructed features of each segmentation instance based on the semantic attributes and the target graph convolutional neural network; wherein the semantic attributes include the adjacency matrix and the attribute features.

[0075] Step S204: determining global loss information based on the first reconstructed features and attribute features of all segmented instances; and determining local loss information based on the second reconstructed features and intermediate features of each segmented instance.

[0076] Step S205: Based on the global loss information and the local loss information, determine whether the image to be tested is an adversarial sample.

[0077] The specific implementation of steps S202 to S205 can refer to other embodiments and will not be repeated here.

[0078] The above scheme segments the image to be tested to determine the segmentation instance and its prediction type, so as to subsequently determine the connection relationship and feature extraction based on the segmentation instance, and determine the corresponding target autoencoder based on the prediction type for local reconstruction.

[0079] In some optional implementations, determining the adjacency matrix in step S101 may be implemented by, but not limited to, the following methods:

[0080] For a main diagonal in the adjacency matrix, determining the first parameter as an element corresponding to the main diagonal;

[0081] For the non-main diagonal in the adjacency matrix, any two segmentation instances in the image to be tested are compared; if the two segmentation instances are adjacent or intersecting, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the first parameters; otherwise, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the second parameters.

[0082] In the implementation, there are n segmentation instances, an adjacency matrix of a specific format is constructed, and element values ​​in the adjacency matrix are determined based on the connection relationship between the segmentation instances.

[0083] For example, the adjacency matrix may be in the following format:

[0084]

[0085] Among them, on the main diagonal, a 1,1 、a 2,2 、……、a n,n The corresponding elements are all first parameters;

[0086] a i,j For segmentation instance I i and segmentation instance I j The corresponding elements between them, if I i with I j Adjacent or intersecting, then I i with I j The corresponding element is the first parameter; otherwise, the corresponding element is the second parameter;

[0087] Take the first parameter as 1 and the second parameter as 0 as an example.

[0088] The above-mentioned adjacency matrix, first parameter, and second parameter are merely exemplary descriptions, and the present embodiment is not limited thereto.

[0089] The above scheme accurately sets the values ​​of the corresponding elements of the adjacency matrix according to the connection relationship between the segmentation instances, so that the adjacency matrix accurately expresses the co-occurrence and adjacent relationship between the segmentation instances.

[0090] In some optional implementations, obtaining the attribute features of each segmentation instance in step S101 may be achieved by, but not limited to, the following methods:

[0091] Each segmentation instance in the image to be tested is input into a convolutional feature extraction network, and the convolutional feature extraction network is used to extract features of each segmentation instance to obtain attribute features of each segmentation instance.

[0092] In the implementation, a trained convolutional feature extraction network is used to input each segmentation instance in the image to be tested into the convolutional feature extraction network, and the convolutional feature extraction network is used to extract features of each segmentation instance to obtain the attribute features of each segmentation instance;

[0093] For example, X=N feat ([I1, I2, ..., I n ])=[x1, x2, ..., x n ];

[0094] Among them, N feat is a convolutional feature extraction network, X is the attribute feature of all segmentation instances; I i is the segmentation instance i, x i is the attribute feature of segmentation instance i, i = 1, 2, ..., n, and n is the number of segmentation instances in the image to be tested.

[0095] This embodiment does not specifically limit the convolutional feature extraction network, such as ResNet (residual network) and MobileNet (lightweight convolutional neural network) pre-trained on large data sets such as ImageNet (a computer vision system recognition project).

[0096] In some optional implementations, the above step S102 may be implemented by, but not limited to, the following methods:

[0097] Inputting the semantic attributes into the encoder of the target graph convolutional neural network, performing encoding processing through the encoder, and outputting intermediate features of each segmentation instance;

[0098] The intermediate features of each segmentation instance are input into the decoder of the target graph convolutional neural network, and the encoder performs decoding processing to output the first reconstructed features of each segmentation instance.

[0099] In this embodiment, the target graph convolutional neural network includes an encoder and a decoder. The encoder encodes semantic attributes, and the decoder decodes and reconstructs intermediate features.

[0100] For example, the intermediate feature Z = GCN (A, X, W1) = [z1, z2, ..., z n ]; where A is the adjacency matrix of the image to be tested, X is the attribute feature of the segmentation instance, W1 is the encoder parameter (trained), Z is the intermediate feature of all segmentation instances, z i is the intermediate feature of segmentation instance i, i = 1, 2, ..., n, n is the number of segmentation instances in the image to be tested; GCN is the Laplacian graph convolution operation;

[0101] First reconstruction feature Among them, W2 is the decoder parameter (obtained by training), is the first reconstructed feature of all segmented instances, is the first reconstructed feature of segmentation instance i.

[0102] This embodiment does not specifically limit the graph convolution kernels of the encoder and decoder. In some optional implementations, the graph convolution kernel GCN of the encoder is GCN=D -1 / 2 AD -1 / 2 XW1; Decoder's graph convolution kernel GCN = D -1 / 2 AD -1 / 2 XW2; where D is the degree matrix of A. For other parameters, see the above example.

[0103] In the above scheme, the encoder of the target graph convolutional neural network fuses the features of the segmentation instance and its adjacent segmentation instances to better encode the co-occurrence relationship between the segmentation instance itself and other segmentation instances; the decoder of the target graph convolutional neural network performs feature reconstruction to accurately determine the globally reconstructed features (first reconstructed features) after encoding and decoding.

[0104] In some optional implementations, the above step S103 of determining the global loss information may be implemented by, but not limited to, the following methods:

[0105] For any segmentation instance, determining the sum of squares of differences between the first reconstructed feature and the attribute feature of the segmentation instance as first loss information of the segmentation instance;

[0106] The average of the first loss information of all segmented instances is determined as the global loss information.

[0107] During implementation, since the first reconstructed feature is a feature that is globally reconstructed after encoding and decoding the attribute feature, the sum of the squares of the differences between the first reconstructed feature and the attribute feature of the segmentation instance represents the degree of difference between the first reconstructed feature and the original attribute feature, which is determined as the first loss information of the segmentation instance; then, all the first loss information of all the segmentation instances are combined to determine the global loss information that represents the degree of global difference between the first reconstructed feature and the attribute feature.

[0108] Exemplary, global loss information in, is the first reconstructed feature of segmentation instance i, x i is the attribute feature of segmentation instance i, and n is the number of segmentation instances in the image to be tested.

[0109] In some optional implementations, the above step S103 of determining the local loss information may be implemented by, but not limited to, the following methods:

[0110] For any segmentation instance, determining the sum of squares of differences between the second reconstructed feature and the intermediate feature of the segmentation instance as second loss information of the segmentation instance;

[0111] The maximum value of the second loss information in all segmentation instances is determined as the local loss information.

[0112] During implementation, since the second reconstructed feature is a feature locally reconstructed after the intermediate feature is encoded and decoded by the autoencoder, the sum of the squares of the differences between the second reconstructed feature and the intermediate feature of the segmentation instance characterizes the degree of difference between the second reconstructed feature and the original intermediate feature, and is determined as the second loss information of the segmentation instance; since there are multiple second loss information, and the greater the degree of difference, the more it can reflect the local error, the maximum value of the second loss information of all segmentation instances is taken to determine the local loss information characterizing the degree of local difference between the second reconstructed feature and the intermediate feature.

[0113] Exemplary, local loss information in, is the second reconstructed feature of segmentation instance i, z i is the intermediate feature of segmentation instance i, and n is the number of segmentation instances in the image to be tested.

[0114] In some optional implementations, the above step S104 may be implemented by, but not limited to, the following methods:

[0115] Performing weighted calculation on the global loss information and the local loss information to obtain a detection value of the image to be tested;

[0116] If the detection value is greater than a preset threshold, the image to be tested is determined to be an adversarial sample; otherwise, the image to be tested is determined to be a non-adversarial sample.

[0117] During implementation, the weighting coefficient and the preset threshold corresponding to the application scenario can be set according to the application scenario of the image to be tested;

[0118] By performing weighted calculation on the global loss information and the local loss information, a detection value representing the comprehensive error in both global and local dimensions is obtained; the detection value is then compared with the preset threshold. If the detection value is greater than the preset threshold, it means that the comprehensive error is large and exceeds a reasonable range, and the image to be tested is determined to be a malicious adversarial sample; conversely, if the detection value is not greater than the preset threshold, it means that the comprehensive error is small and within a reasonable range, and the image to be tested is determined to be a non-adversarial sample (normal sample).

[0119] In some optional implementations, the target autoencoder is trained by:

[0120] For any labeled category, the category loss information corresponding to the labeled category of the normal white sample is used as the loss function, and the segmentation instance of the labeled category in the normal white sample is used to train the initial autoencoder to obtain the target autoencoder of the labeled category;

[0121] The category loss information is determined based on the second reconstructed features and the intermediate features of the segmented instance of the labeled category;

[0122] The target graph convolutional neural network is trained in the following way:

[0123] The global loss information of the normal white samples is used as the loss function, and the normal white samples are used to train the initial graph convolutional neural network to obtain the target graph convolutional neural network.

[0124] In this embodiment, normal white samples are used to train the target autoencoder and the target graph convolutional neural network used, and the segmentation instances in the normal white samples are labeled with corresponding categories.

[0125] See Figure 3 The figure is a flow chart of the model training method provided in the embodiment of the present application, which includes the following steps:

[0126] Step S301: for any normal white sample, determine a sample adjacency matrix based on the connection relationship between all segmentation instances in the normal white sample; and perform feature extraction on each segmentation instance in the normal white sample to obtain sample attribute features of each segmentation instance.

[0127] During implementation, the corresponding categories of the segmentation instances in the normal white sample can be labeled; the normal white sample is input into the image segmentation system, and the image segmentation system performs instance segmentation to determine the segmentation instances of the normal white sample, that is, which pixel areas of the normal white sample each segmentation instance corresponds to;

[0128] That is to say, in order to train the model more accurately, the category of each segmentation instance in the normal white sample can be manually added (ie, the label category).

[0129] The process of determining the sample adjacency matrix and the sample attribute characteristics of the normal white sample can refer to the above-mentioned process of determining the adjacency matrix and attribute characteristics of the image to be tested, and will not be repeated here.

[0130] Step S302: Construct an initial graph convolutional neural network and initial autoencoders corresponding to each annotation type.

[0131] The input of the encoder in the initial graph convolutional neural network is the sample semantic attributes, which include the sample adjacency matrix and sample attribute features of the normal white sample; the output of the encoder in the initial graph convolutional neural network is the intermediate features of the normal white sample;

[0132] The input of the decoder in the initial graph convolutional neural network is the intermediate features of the normal white sample and the sample adjacency matrix; the output of the decoder in the initial graph convolutional neural network is the first reconstructed features of the normal white sample;

[0133] The input to the initial autoencoder is the intermediate features of the segmented instances corresponding to the labeled categories;

[0134] The output of the initial autoencoder is the second reconstructed features of the segmented instances corresponding to the labeled categories.

[0135] For example, in, is the second reconstructed feature of the segmentation instance l, z l is the intermediate feature of the segmentation instance l in the normal white sample; n k is the initial autoencoder corresponding to the annotation type k of the segmentation instance l;

[0136] GCN(A,X,w1)=[z1,z2,…,z m ]; where A is the adjacency matrix of the image to be tested, X is the sample attribute feature, w1 is the encoder parameter of the initial graph convolutional neural network, z l is the intermediate feature of the segmentation instance l, l = 1, 2, ..., m; GCN is the Laplacian graph convolution operation;

[0137] Among them, w2 is the decoder parameter of the initial graph convolutional neural network, is the first reconstructed feature of the segmentation instance l, l = 1, 2, ..., m.

[0138] Step S303: Using the global loss information of the normal white sample as the loss function, the initial graph convolutional neural network is trained to obtain the target graph convolutional neural network; and, for any labeled category, using the category loss information corresponding to the labeled category of the normal white sample as the loss function, the initial autoencoder is trained using the segmentation instance of the labeled category in the normal white sample to obtain the target autoencoder of the labeled category.

[0139] The category loss information is determined based on the second reconstructed features and the intermediate features of the segmented instance of the labeled category.

[0140] Exemplary, global loss information of normal white samples is the first reconstructed feature of the segmentation instance l in the normal white sample, x l is the attribute feature of the segmentation instance l;

[0141] Category loss information corresponding to the labeled category K of the normal white sample is the second reconstructed feature of the segmentation instance o in the normal white sample, z o is the intermediate feature of the segmentation instance o; O is the number of segmentation instances corresponding to the annotation type k.

[0142] Using L1 and L2 as loss functions, the initial graph convolutional neural network and the initial autoencoder are trained to obtain the target graph convolutional neural network and the target autoencoder.

[0143] like Figure 4 As shown, an embodiment of the present application provides an adversarial sample detection device 400, which includes:

[0144] The semantic attribute determination module 401 is used to determine an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; and to extract features from each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance;

[0145] A feature processing module 402 is configured to determine intermediate features and first reconstructed features of each segmentation instance based on semantic attributes and a target graph convolutional neural network, wherein the semantic attributes include the adjacency matrix and the attribute features;

[0146] a loss determination module 403 for determining global loss information based on the first reconstructed features and attribute features of all segmented instances; and determining local loss information based on the second reconstructed features and intermediate features of each segmented instance; wherein the second reconstructed features of any segmented instance are determined based on a target autoencoder corresponding to a prediction type of the segmented instance;

[0147] The adversarial detection module 404 is configured to determine whether the image to be tested is an adversarial sample based on the global loss information and the local loss information.

[0148] Some optional implementations further include a segmentation module 405, which is used to segment the image to be tested and determine the segmentation instances of the image to be tested and the predicted type of each segmentation instance before the semantic attribute determination module 401 determines the adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested.

[0149] In some optional implementations, the semantic attribute determination module 401 is specifically configured to:

[0150] For a main diagonal in the adjacency matrix, determining the first parameter as an element corresponding to the main diagonal;

[0151] For the non-main diagonal in the adjacency matrix, any two segmentation instances in the image to be tested are compared; if the two segmentation instances are adjacent or intersecting, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the first parameters; otherwise, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the second parameters.

[0152] In some optional implementations, the feature processing module 402 is specifically configured to:

[0153] Inputting the semantic attributes into the encoder of the target graph convolutional neural network, performing encoding processing through the encoder, and outputting intermediate features of each segmentation instance;

[0154] The intermediate features of each segmentation instance are input into the decoder of the target graph convolutional neural network, and the encoder performs decoding processing to output the first reconstructed features of each segmentation instance.

[0155] In some optional implementations, the loss determination module 403 is specifically configured to:

[0156] For any segmentation instance, determining the sum of squares of differences between the first reconstructed feature and the attribute feature of the segmentation instance as first loss information of the segmentation instance;

[0157] The average of the first loss information of all segmented instances is determined as the global loss information.

[0158] In some optional implementations, the loss determination module 403 is specifically configured to:

[0159] For any segmentation instance, determining the sum of squares of differences between the second reconstructed feature and the intermediate feature of the segmentation instance as second loss information of the segmentation instance;

[0160] The maximum value of the second loss information in all segmentation instances is determined as the local loss information.

[0161] In some optional implementations, the adversarial detection module 404 is specifically configured to:

[0162] Performing weighted calculation on the global loss information and the local loss information to obtain a detection value of the image to be tested;

[0163] If the detection value is greater than a preset threshold, the image to be tested is determined to be an adversarial sample; otherwise, the image to be tested is determined to be a non-adversarial sample.

[0164] In some optional implementations, the target autoencoder is trained by:

[0165] For any labeled category, using the category loss information corresponding to the labeled category of the normal white sample as a loss function, and using the segmented instances of the labeled category in the normal white sample to train the initial autoencoder to obtain a target autoencoder for the labeled category; wherein the category loss information is determined based on the second reconstructed features and intermediate features of the segmented instances of the labeled category;

[0166] The target graph convolutional neural network is trained in the following way:

[0167] The global loss information of the normal white samples is used as the loss function, and the normal white samples are used to train the initial graph convolutional neural network to obtain the target graph convolutional neural network.

[0168] Since the device is the device in the method in the embodiment of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0169] Based on the same technical concept, the embodiment of the present application further provides an electronic device 500, such as Figure 5 As shown, it includes at least one processor 501 and a memory 502 connected to the at least one processor. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present application. Figure 5 For example, the processor 501 and the memory 502 are connected via a bus 503. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0170] Among them, the processor 501 is the control center of the electronic device, which can use various interfaces and lines to connect various parts of the electronic device, and realize data processing by running or executing instructions stored in the memory 502 and calling data stored in the memory 502. Optionally, the processor 501 may include one or more processing units. The processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip. In some embodiments, they may also be implemented separately on independent chips.

[0171] The processor 501 can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiment of the adversarial sample detection method can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0172] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0173] In the embodiment of the present application, the memory 502 stores a computer program. When the program is executed by the processor 501, the processor 501 executes:

[0174] Determining an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; and performing feature extraction on each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance;

[0175] Determining intermediate features and first reconstructed features of each segmentation instance based on semantic attributes and a target graph convolutional neural network, wherein the semantic attributes include the adjacency matrix and the attribute features;

[0176] Determining global loss information based on the first reconstructed features and the attribute features of all segmented instances; and determining local loss information based on the second reconstructed features and the intermediate features of each segmented instance; wherein the second reconstructed features of any segmented instance are determined based on the target autoencoder corresponding to the prediction type of the segmented instance;

[0177] Based on the global loss information and the local loss information, it is determined whether the image to be tested is an adversarial sample.

[0178] In some optional implementations, before determining the adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested, the processor 501 further executes:

[0179] The image to be tested is segmented to determine segmentation instances of the image to be tested and a prediction type of each segmentation instance.

[0180] In some optional implementations, the processor 501 specifically performs:

[0181] For a main diagonal in the adjacency matrix, determining the first parameter as an element corresponding to the main diagonal;

[0182] For the non-main diagonal in the adjacency matrix, any two segmentation instances in the image to be tested are compared; if the two segmentation instances are adjacent or intersecting, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the first parameters; otherwise, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the second parameters.

[0183] In some optional implementations, the processor 501 specifically performs:

[0184] Inputting the semantic attributes into the encoder of the target graph convolutional neural network, performing encoding processing through the encoder, and outputting intermediate features of each segmentation instance;

[0185] The intermediate features of each segmentation instance are input into the decoder of the target graph convolutional neural network, and the encoder performs decoding processing to output the first reconstructed features of each segmentation instance.

[0186] In some optional implementations, the processor 501 specifically performs:

[0187] For any segmentation instance, determining the sum of squares of differences between the first reconstructed feature and the attribute feature of the segmentation instance as first loss information of the segmentation instance;

[0188] The average of the first loss information of all segmented instances is determined as the global loss information.

[0189] In some optional implementations, the processor 501 specifically performs:

[0190] For any segmentation instance, determining the sum of squares of differences between the second reconstructed feature and the intermediate feature of the segmentation instance as second loss information of the segmentation instance;

[0191] The maximum value of the second loss information in all segmentation instances is determined as the local loss information.

[0192] In some optional implementations, the processor 501 specifically performs:

[0193] Performing weighted calculation on the global loss information and the local loss information to obtain a detection value of the image to be tested;

[0194] If the detection value is greater than a preset threshold, the image to be tested is determined to be an adversarial sample; otherwise, the image to be tested is determined to be a non-adversarial sample.

[0195] In some optional implementations, the target autoencoder is trained by:

[0196] For any labeled category, using the category loss information corresponding to the labeled category of the normal white sample as a loss function, and using the segmented instances of the labeled category in the normal white sample to train the initial autoencoder to obtain a target autoencoder for the labeled category; wherein the category loss information is determined based on the second reconstructed features and intermediate features of the segmented instances of the labeled category;

[0197] The target graph convolutional neural network is trained in the following way:

[0198] The global loss information of the normal white samples is used as the loss function, and the normal white samples are used to train the initial graph convolutional neural network to obtain the target graph convolutional neural network.

[0199] Since the electronic device is the electronic device in the method in the embodiment of the present application, and the principle of solving the problem by the electronic device is similar to that of the method, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0200] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program executable by a processor. When the program runs on the processor, the processor executes the steps of the above-mentioned adversarial sample detection method.

[0201] In some optional embodiments, various aspects of the adversarial sample detection method provided in the present application can also be implemented in the form of a program product, which contains computer-executable instructions. When the program product is run on a computer device, the computer-executable instructions are used to enable the computer device to execute the steps of the adversarial sample detection method according to various exemplary embodiments of the present application described above in this specification.

[0202] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0203] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0204] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0205] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0206] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0207] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for detecting adversarial samples, characterized in that: The method includes: Determining an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; and performing feature extraction on each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance; Determining intermediate features and first reconstructed features of each segmentation instance based on semantic attributes and a target graph convolutional neural network, wherein the semantic attributes include the adjacency matrix and the attribute features; Determining global loss information based on the first reconstructed features and the attribute features of all segmented instances; and determining local loss information based on the second reconstructed features and the intermediate features of each segmented instance; wherein the second reconstructed features of any segmented instance are determined based on the target autoencoder corresponding to the prediction type of the segmented instance; Based on the global loss information and the local loss information, it is determined whether the image to be tested is an adversarial sample.

2. The method according to claim 1, wherein Before determining the adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested, the following steps are also included: The image to be tested is segmented to determine segmentation instances of the image to be tested and a prediction type of each segmentation instance.

3. The method according to claim 1, wherein Based on the connectivity between all segmentation instances in the image to be tested, the adjacency matrix is ​​determined, including: For a main diagonal in the adjacency matrix, determining the first parameter as an element corresponding to the main diagonal; For the non-main diagonal in the adjacency matrix, any two segmentation instances in the image to be tested are compared; if the two segmentation instances are adjacent or intersecting, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the first parameters; otherwise, the elements corresponding to the two segmentation instances in the adjacency matrix are determined as the second parameters.

4. The method according to claim 1, wherein Based on the semantic attributes and the target graph convolutional neural network, the intermediate features and the first reconstruction features of each segmentation instance are determined, including: Inputting the semantic attributes into the encoder of the target graph convolutional neural network, performing encoding processing through the encoder, and outputting intermediate features of each segmentation instance; The intermediate features of each segmentation instance are input into the decoder of the target graph convolutional neural network, and the encoder performs decoding processing to output the first reconstructed features of each segmentation instance.

5. The method according to claim 1, wherein Based on the first reconstructed features and attribute features of all segmented instances, global loss information is determined, including: For any segmentation instance, determining the sum of squares of differences between the first reconstructed feature and the attribute feature of the segmentation instance as first loss information of the segmentation instance; The average of the first loss information of all segmented instances is determined as the global loss information.

6. The method according to claim 1, wherein Based on the second reconstructed features and intermediate features of each segmentation instance, local loss information is determined, including: For any segmentation instance, determining the sum of squares of differences between the second reconstructed feature and the intermediate feature of the segmentation instance as second loss information of the segmentation instance; The maximum value of the second loss information in all segmentation instances is determined as the local loss information.

7. The method according to claim 1, wherein Determining whether the image to be tested is an adversarial sample based on the global loss information and the local loss information includes: Performing weighted calculation on the global loss information and the local loss information to obtain a detection value of the image to be tested; If the detection value is greater than a preset threshold, the image to be tested is determined to be an adversarial sample; otherwise, the image to be tested is determined to be a non-adversarial sample.

8. The method according to any one of claims 1 to 7, wherein: The target autoencoder is trained by the following method: For any labeled category, using the category loss information corresponding to the labeled category of the normal white sample as a loss function, and using the segmented instances of the labeled category in the normal white sample to train the initial autoencoder to obtain a target autoencoder for the labeled category; wherein the category loss information is determined based on the second reconstructed features and intermediate features of the segmented instances of the labeled category; The target graph convolutional neural network is trained in the following way: The global loss information of the normal white samples is used as the loss function, and the normal white samples are used to train the initial graph convolutional neural network to obtain the target graph convolutional neural network.

9. An adversarial sample detection device, characterized in that: The device includes: A semantic attribute determination module is used to determine an adjacency matrix based on the connection relationship between all segmentation instances in the image to be tested; and to extract features from each segmentation instance in the image to be tested to obtain attribute features of each segmentation instance; A feature processing module, configured to determine intermediate features and a first reconstructed feature of each segmentation instance based on semantic attributes and a target graph convolutional neural network, wherein the semantic attributes include the adjacency matrix and the attribute features; a loss determination module configured to determine global loss information based on first reconstructed features and attribute features of all segmented instances; and to determine local loss information based on second reconstructed features and intermediate features of each segmented instance; wherein the second reconstructed features of any segmented instance are determined based on a target autoencoder corresponding to a prediction type of the segmented instance; An adversarial detection module is used to determine whether the image to be tested is an adversarial sample based on the global loss information and the local loss information.

10. An electronic device, characterized in that: The system comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that It stores a computer program executable by a computer, and when the program is run on the computer, the computer is enabled to execute the method according to any one of claims 1 to 8.

Images