Smart grid deep visual detection model security evaluation method and system

Abstract

The present application relates to the field of smart grid, and provide a kind of smart grid depth vision detection model security evaluation method and system.The method comprises: based on the image of electric power scene forms test image with real target interference;With real target interference test image is input based on hybrid interference's adversarial sample generation model, generates adversarial sample set, the adversarial sample generation model is based on real target interference, fog interference and real noise interference construction, including generative adversarial network and alternative model, and generative adversarial network includes generation network and discriminant network;Adversarial sample set is used to test smart grid depth vision detection model, and the security of smart grid depth vision detection model is evaluated according to test result.The present application considers the interference of real world under electric power scene, and the defense capability of depth vision detection algorithm is evaluated using adversarial sample set with hybrid interference, to reduce the security hidden danger brought by depth network.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of smart grids, in particular to a security evaluation method of a smart grid deep visual detection model, a security evaluation system of a smart grid deep visual detection model, a smart chip, a computer device and a computer readable storage medium. BACKGROUND

[0002] As an important branch of machine learning, deep learning promotes the development of multiple fields such as computational vision, data mining and speech processing, and embeds core algorithms into industry solutions to promote digital transformation of the industry. Mature solutions based on high-performance deep networks have been applied to visual detection tasks in multiple smart grids, such as defect detection, object recognition, intruder detection, etc. Deep visual detection reduces labor costs and improves detection capabilities. With the deepening of research, researchers have found that although deep networks can improve performance with large-scale computing power and models, noise, small perturbations and other disturbances can mislead deep networks to make wrong judgments, thereby reducing the performance and robustness of deep networks. Since signal interference exists universally in natural scenes, deep network defects pose serious safety hazards to industries such as power and autonomous driving.

[0003] To address the defects of deep networks, researchers have proposed adversarial attack and defense algorithms to deal with the above defects by studying the characteristics of adversarial samples, attack strategies and defense patterns. Usually, adversarial attack algorithms are used to generate adversarial samples against specific deep networks, and adversarial samples are used to attack target networks to evaluate the performance of target networks; adversarial samples are used to train target networks to obtain defense capabilities. Adversarial samples refer to samples with global or local small perturbations based on original samples. In visual detection tasks, adversarial samples usually have global or local interference noise, causing the target model to make wrong detection results. Usually, the method used to generate adversarial samples is called an adversarial attack model. In the field of target recognition or target detection, adversarial attack models can be classified according to attack targets, prior knowledge and attack methods. According to the attack target, the adversarial attack model is divided into targetless attack and targeted attack; according to the prior knowledge, the adversarial attack model is divided into white-box attack (complete knowledge of the target model is known) and black-box attack (only the output result of the target model is known); according to the attack method, the adversarial attack model includes optimization-based method, sensitivity-based method and generation model-based method. In practical applications, due to the confidentiality of commercial technology, targetless black-box attack has practical significance and application advantages.

[0004] High-performance deep networks have been embedded in multi-task solutions of smart grids. Deep visual detection is an important branch of smart grids, which realizes the intelligentization of power grids through face recognition, target detection, target classification and other algorithms. However, deep networks are easily misled by small signals and produce false judgments, which brings major safety hazards to the power industry. In order to reduce the impact of the defects of deep networks on the power industry, it is urgent to evaluate the defense capability of deep visual detection models in smart grids. SUMMARY

[0005] In order to solve the above technical defects, the present application provides a safety evaluation method and system for a deep visual detection model of a smart grid.

[0006] One aspect of the present application provides a safety evaluation method for a deep visual detection model of a smart grid, comprising:

[0007] Forming a test image with real target interference based on a power scene image;

[0008] Inputting the test image with real target interference into a hybrid interference-based adversarial sample generation model to generate an adversarial sample set; the hybrid interference-based adversarial sample generation model is constructed based on real target interference, haze interference and real noise interference, and includes a generative adversarial network and a substitute model, wherein the generative adversarial network includes a generative network and a discriminative network;

[0009] Testing the deep visual detection model of the smart grid using the adversarial sample set, and evaluating the safety of the deep visual detection model of the smart grid according to the test results.

[0010] In the embodiment of the present application, the test image with real target interference is formed based on the power scene image, which includes: taking the power scene image as the test image, randomly labeling a real target in the test image outside the target area to be detected, taking the labeled real target as the real target interference, and taking the position and category of the real target as the real target interference label.

[0011] In the embodiment of the present application, the test image with real target interference is formed based on the power scene image, which includes: segmenting multiple real targets from the collected multiple power scene images; placing a real target of a certain category in the test image in the form of a foreground, and the placement position of the real target does not overlap with the target to be detected in the test image, and the placement position and category of the real target are taken as the real target interference label.

[0012] In the embodiment of the present application, the method further comprises: before generating the adversarial sample set, inputting the training image with real target interference into the hybrid interference-based adversarial sample generation model to train the hybrid interference-based adversarial sample generation model.

[0013] In the embodiment of the application, the training of the mixed interference-based adversarial sample generation model comprises: taking a training image with real target interference as a first mixed image, superimposing fog interference on the first mixed image by using a fogging algorithm to generate a second mixed image; inputting the second mixed image into the generation network to generate a third mixed image; inputting the third mixed image and an image with real noise interference into the discrimination network for true and false noise discrimination; inputting the third mixed image into the substitute model for prediction; wherein the loss function of the generation network comprises: the generation and discrimination loss of the discrimination network, the color stability loss for preventing color distortion, and the mean square error loss for measuring the gap between the prediction result of the substitute model and the real target interference label.

[0014] In the embodiment of the application, the training image with real target interference is formed by the following method: taking a power scene image as a training image, randomly labeling a certain real target in the training image outside the target region to be detected, taking the labeled real target as the real target interference, and taking the position and category of the real target as the real target interference label; or, segmenting multiple real targets from the collected multiple power scene images, placing a certain real target in the multiple real targets in the training image in the form of foreground, and the placement position of the real target does not overlap with the target to be detected in the training image, and the placement position and category of the real target are taken as the real target interference label.

[0015] In the embodiment of the application, the method further comprises: in the process of training the mixed interference-based adversarial sample generation model, using a stochastic gradient ascent algorithm to update the parameters of the generation network and the parameters of the discrimination network.

[0016] In the embodiment of the application, the inputting of the test image with real target interference into the mixed interference-based adversarial sample generation model to generate an adversarial sample set comprises: inputting the test image with real target interference after superimposing fog interference into the generation network to generate a test image with mixed interference; inputting the test image with mixed interference into the substitute model for detection, judging whether the detection result of the substitute model is consistent with the real label of the target to be detected in the test image, and if not, adding the test image with mixed interference to the adversarial sample set.

[0017] Another aspect of the application provides a security evaluation system of a smart grid deep visual detection model, comprising:

[0018] A real target interference image module is configured to form a test image with real target interference based on a power scene image.

[0019] The adversarial sample generation module includes a hybrid interference-based adversarial sample generation model, which is used to generate an adversarial sample set according to an input test image with real target interference; the hybrid interference-based adversarial sample generation model is constructed based on real target interference, haze interference and real noise interference, and includes a generative adversarial network and a substitute model, the generative adversarial network includes a generative network and a discriminative network;

[0020] The security evaluation module is used to test the smart grid deep visual detection model by using the adversarial sample set, and evaluate the security of the smart grid deep visual detection model according to the test result.

[0021] In the embodiment of the application, the real target interference image module is specifically configured to: take a power scene image as a test image, randomly label a real target in the test image outside a target region to be detected in the test image, take the labeled real target as real target interference, and take the position and category of the real target as real target interference labels; or, segment multiple real targets from the collected multiple power scene images, place a real target of a certain category in the multiple real targets in the test image in a foreground form, and the placement position of the real target does not overlap with the target to be detected in the test image, and the placement position and category of the real target are taken as real target interference labels.

[0022] In the embodiment of the application, the adversarial sample generation module is further configured to train the hybrid interference-based adversarial sample generation model, and specifically includes: taking a training image with real target interference as a first hybrid image, superimposing haze interference on the first hybrid image by using a haze adding algorithm to generate a second hybrid image; inputting the second hybrid image into the generative network to generate a third hybrid image; inputting the third hybrid image and an image with real noise interference into the discriminative network to discriminate real and false noise; inputting the third hybrid image into the substitute model for prediction; wherein the loss function of the generative network includes: a generative discriminative loss of the discriminative network, a color stability loss for preventing color distortion, and a mean square error loss for measuring the gap between the prediction result of the substitute model and the real target interference label.

[0023] In the embodiment of the application, the adversarial sample generation module generates an adversarial sample set according to an input test image with real target interference, and specifically includes: inputting the test image with real target interference after superimposing haze interference into the generative network to generate a test image with hybrid interference; inputting the test image with hybrid interference into the substitute model for detection, and judging whether the detection result of the substitute model is consistent with the real label of the target to be detected in the test image, if not, the test image with hybrid interference is added to the adversarial sample set.

[0024] The application further provides an intelligent chip, comprising a memory, a processor and a computer program; the computer program is stored in the memory and is configured to be executed by the processor to implement the safety evaluation method of the smart grid deep visual detection model.

[0025] The application further provides a computer device, comprising a memory, a processor and a computer program; the computer program is stored in the memory and is configured to be executed by the processor to implement the safety evaluation method of the smart grid deep visual detection model.

[0026] The application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the safety evaluation method of the smart grid deep visual detection model.

[0027] The application aims at the defect that the deep network is easily interfered by small signals and invalid, and generates an adversarial sample in a power scene by using an adversarial attack model. The application considers the real-world interference in the power scene, in order to make the adversarial sample and the natural scene image have the same distribution and contain the power scene characteristics, introduces real target interference, haze interference and real noise interference, considers the real-world noise and haze condition, and collects real targets in the power scene as local interference, generates an adversarial sample set with mixed interference based on the adversarial network, evaluates the defense capability of the deep visual detection algorithm deployed in the smart grid by using the adversarial sample set with mixed interference, and thus reduces the security risks brought by the deep network.

[0028] Other features and advantages of the technical scheme of the application will be described in detail in the specific implementation part below. BRIEF DESCRIPTION OF DRAWINGS

[0029] The accompanying drawings, which are included to provide a further understanding of the application, constitute a part of this application, and the illustrative embodiments of the application and their description serve to explain the application, and do not limit the application in any way. In the drawings:

[0030] Figure 1 is a flowchart of the safety evaluation method of the smart grid deep visual detection model provided by the embodiment of the application;

[0031] Figure 2 is a schematic diagram of the adversarial sample generation model based on mixed interference provided by the embodiment of the application;

[0032] Figure 3 is a flowchart of the adversarial sample set generation provided by the embodiment of the application;

[0033] Figure 4 is a schematic diagram of the safety evaluation based on the adversarial sample set provided by the embodiment of the application;

[0034] Figure 5 is a block diagram of a security evaluation system of a smart grid deep visual detection model provided by an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the technical solutions and advantages in the embodiments of the present application clearer, the exemplary embodiments of the present application are further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0036] The present application aims at the defect that the deep network is easily disturbed by a small signal, and proposes a deep visual detection model security evaluation method and system based on mixed adversarial attack for a deep visual detection model in a smart grid. The method is based on a generative adversarial network (GAN), introduces real target interference, haze interference and real noise interference, generates an adversarial sample set for a substitute model, and tests the defense ability of the target model using the adversarial sample set. The present application introduces real target interference, haze interference and real noise interference, constructs an adversarial sample generation model based on mixed interference, generates adversarial samples for a substitute model as an attack target, tests the target model through the adversarial samples to realize security evaluation, and overcomes the defect that the deep visual detection model in the smart grid is easily disturbed by a small signal.

[0037] Figure 1 is a flowchart of a security evaluation method of a smart grid deep visual detection model provided by an embodiment of the present application. As shown in Figure 1 The security evaluation method of the smart grid deep visual detection model provided by the present embodiment includes the following steps:

[0038] S110, forming a test image with real target interference based on a power scene image;

[0039] S120, inputting the test image with real target interference into an adversarial sample generation model based on mixed interference to generate an adversarial sample set;

[0040] S130, testing the smart grid deep visual detection model using the adversarial sample set, and evaluating the security of the smart grid deep visual detection model according to the test result.

[0041] In the step S110, the test image with the real target interference is formed in the following manner: taking the power scene image as the test image, randomly labeling a real target in the test image outside the target region to be detected, taking the labeled real target as the real target interference, and taking the position and category of the real target as the real target interference label; or segmenting multiple real targets (for example, a person, a foreign object, a vehicle, a house, an animal, and a power accessory) from the collected multiple power scene images, placing a real target of a certain category in the test image in the foreground, and the placement position of the real target does not overlap with the target to be detected in the test image, and taking the placement position and category of the real target as the real target interference label.

[0042] In the step S120, an adversarial sample generation model based on mixed interference is first constructed, and then the adversarial sample generation model based on mixed interference is trained. The test image with the real target interference is input into the trained adversarial sample generation model to generate an adversarial sample set. As shown in Figure 2 The adversarial sample generation model based on mixed interference includes a generative adversarial network and a substitute model, and the generative adversarial network includes a generative network and a discriminative network. The adversarial sample generation model is based on the generative adversarial network and includes three interference superposition stages: real target interference, haze interference, and real noise interference. The discriminative network discriminates between real and false noise images based on real-world noise images. The substitute model is used as a substitute attack target to detect the original sample and the sample generated by the generative network, that is, to detect whether the sample generated by the generative network is attackable. In order to make the adversarial sample and the real sample in the natural scene have the same distribution and simulate various natural scene conditions, the adversarial sample generation model based on mixed interference is constructed to realize the security evaluation of the deep visual detection algorithm using the adversarial sample. In the visual detection task, the adversarial attack model can be described as trying to find a sample closest to the original sample, which is on the manifold of the natural scene sample, and the substitute model fails to detect the sample, that is, the target to be detected in the sample is not detected.

[0043] In an embodiment, before generating the adversarial sample set, the training image with the real target interference is input into the adversarial sample generation model based on mixed interference to train the adversarial sample generation model based on mixed interference. Specifically, referring to Figure 2The training image with the real target interference is taken as a first mixed image, a haze interference is superimposed on the first mixed image by using a haze adding algorithm to generate a second mixed image; the second mixed image is input into a generation network to generate a third mixed image, and a network loss here is a color stability loss. The third mixed image and an image with real noise interference are input into a discrimination network to discriminate the real and false noises, and a network loss here is a generation discrimination loss. The third mixed image is input into a substitute model to obtain a detection mean square error loss. A loss function for training the adversarial sample generation model includes the generation discrimination loss of the discrimination network, the color stability loss for preventing color distortion, and a mean square error loss for measuring a gap between a prediction result of the substitute model and a real target interference label. In the process of training the adversarial sample generation model, a random gradient ascent algorithm is used to update parameters of the generation network and the discrimination network. The training image with the real target interference is formed by the following manner: taking a power scene image as a training image, randomly labeling a certain real target in the training image outside a target region to be detected, taking the labeled real target as a real target interference, and taking a position and a category of the real target as a real target interference label; or segmenting multiple real targets from collected multiple power scene images, placing a certain real target in the multiple real targets in a foreground form in the training image, and the placed position of the real target does not overlap with the target to be detected in the training image, and taking the placed position and the category of the real target as the real target interference label.

[0044] In the step S120, the test image with the real target interference is input into the trained adversarial sample generation model to generate an adversarial sample set, specifically: as shown in Figure 3 the real target interference is placed in the test image in a foreground form, the test image with the real target interference is superimposed with the haze interference, and then input into the generation network to generate a test image with mixed interference, the test image with the mixed interference is input into the substitute model for detection, and it is judged whether the detection result of the substitute model is consistent with the real label of the target to be detected in the test image. If not, the test image with the mixed interference is successful in attack, and the test image with the mixed interference is added to the adversarial sample set.

[0045] In the step S130, the intelligent power grid deep visual detection algorithm is evaluated for security, as shown in Figure 4 the adversarial sample set is used to test multiple target models to evaluate the detection accuracy of the target models on the target to be detected. The higher the detection accuracy is, the stronger the algorithm is in defending the adversarial sample, and the higher the security of the algorithm is. In addition, the target model can also be trained on the adversarial sample set to form a defense capability.

[0046] The application provides a security evaluation method of a smart grid-oriented deep visual detection algorithm, and aims at the defect that a deep network is easily disturbed by a small signal and fails, and generates an adversarial sample in a power scene by using an adversarial attack model.

[0047] In a specific example, the overall implementation steps of the above method are as follows:

[0048] Step one, construct a real target interference template in a power scene, including the following two ways:

[0049] a) outside the target area to be detected, randomly label a real target in the training image, and take the target as the real target interference of the training image, and the position and category of the target are taken as the real target interference label.

[0050] b) collect a plurality of power scene images, and segment a plurality of real targets, which can include people, foreign objects, vehicles, houses, animals and power accessories, to form a real target interference library. A real target is placed in a training image in the form of a foreground, and the placement position cannot overlap with the target to be detected. The placement position and category of the real target are taken as the real target interference label.

[0051] Step two, establish an adversarial sample generation model based on mixed interference:

[0052] The adversarial sample generation model includes three levels of interference: real target interference as local interference, fog weather interference and real noise interference as global interference. Among them, the image fogging of the fog weather interference is realized by the following algorithm:

[0053] I(w,h)'=I(w,h)*t(w,h)+A(1-t(w,h)) (1)

[0054]

[0055] Wherein, A is the brightness, d is the fog concentration, and A and d are adjustable parameters. (w c ,h c ) is the center point of the image, I(w,h) is the original image, and I(w,h)' is the fogging image; wherein H is the length of the image, and W is the width of the image.

[0056] The real noise interference is implemented by a generative adversarial network, and a discriminant network is learned by using a real-world noise image as a benchmark. Optionally, the structure of the generative adversarial network can refer to C2N (Practical Generative Noise Modeling for Real-World Denoising). In addition, any known complete information algorithm can be selected as a substitute model for attack experiments, such as Yolo, Fast-RCNN. The above-mentioned mixed interference-based adversarial sample generation model contains three kinds of losses: generative adversarial loss, color stability loss, and detection mean square error loss.

[0057] Step three, training of the mixed interference-based adversarial sample generation model:

[0058] a) input: training set X, training iteration number T, discriminant network training iteration number K, sample number M, real noise image set X r ;

[0059] b) initialization: initialize the parameters of the generative network G and the discriminant network D, t = 1, k = 1;

[0060] c) select M training samples from the training set X select M noise images from the real noise image set X r

[0061] d) place the real target interference in or label the real target interference in , and set the real target interference label as the with the real target interference placed is

[0062] e) randomly select M groups of fogging parameters A and d, and obtain the fogging image by using formula (1)

[0063] f) input into the generative network G, and output the generated noise image

[0064] g) input and into the discriminant network D for discrimination, and update the parameters using stochastic gradient ascent, and the loss function of the discriminant network D is the generative adversarial loss:

[0065] ​

[0066] h) If k < K, then k = k + 1, return to step c; otherwise, k = 1, go to step i;

[0067] i) Select M training samples from the training set X

[0068] j) Place real target interference in or label real target interference in , let the real target interference label be

[0069] k) Randomly select M groups of fogging parameters A and d, and obtain the fogging image using formula (1)

[0070] l) Input into the generation network G to output the generated noise image

[0071] m) Input into the discriminant network D for discrimination;

[0072] n) Input into the substitute model F for detection, and output the detection result

[0073] o) Update the parameters of the generation network G and the real target interference using stochastic gradient ascent, and the loss function includes the generative adversarial loss, the color stability loss, and the detection mean square error loss:

[0074]

[0075] wherein, is the generative adversarial loss term, is the detection mean square error loss term, is the color stability loss, c ∈ C is the index of the color channel, N p = H × W × C × M.

[0076] p) If t < T, then t = t + 1, return to step c; otherwise, the training is completed.

[0077] Step four, generate an adversarial sample set:

[0078] a) Input: N test images and their real labels the trained generation network G, and the real target interference library;

[0079] b) Initialization: i = 1;

[0080] ​​c) placing real target interference in the test image The real target interference label is The test image with real target interference placed is

[0081] d) randomly selecting fogging parameters A and d, and generating a fogging test image according to formula (1)

[0082] e) inputting the into the generation network G to output a generated noise image

[0083] f) inputting the into the substitute model F for detection, and outputting a detection result

[0084] g) if Explain the test sample If the attack is successful, the sample can be added to the adversarial sample set.

[0085] h) if i < N, i = i + 1, return to step c; otherwise, end the test.

[0086] Step five, security evaluation for deep visual detection algorithm:

[0087] The adversarial sample set is used to test multiple target models, and the detection accuracy of the target model on the adversarial sample set for the to-be-tested target is evaluated. The higher the detection accuracy, the stronger the algorithm's ability to defend against adversarial samples, and the higher the security of the algorithm. In addition, the target model can be trained on the adversarial sample set to form a defense capability.

[0088] Figure 5 is the block diagram of the security evaluation system of the smart grid deep visual detection model provided by the embodiment of the application. As shown in Figure 5 The security evaluation system of the smart grid deep visual detection model of the embodiment includes a real target interference image module, an adversarial sample generation module, and a security evaluation module. The real target interference image module is used to form a test image with real target interference based on a power scene image. The adversarial sample generation module includes an adversarial sample generation model based on mixed interference, which is used to generate an adversarial sample set according to the input test image with real target interference. The security evaluation module is used to test the smart grid deep visual detection model using the adversarial sample set, and evaluate the security of the smart grid deep visual detection model according to the test result.

[0089] In specific embodiments, the real target interference image module forms a test image with real target interference in the following two ways: taking a power scene image as a test image, randomly labeling a real target in the test image outside the target region to be detected in the test image, taking the labeled real target as real target interference, and taking the position and category of the real target as real target interference labels; or segmenting multiple real targets (for example: people, foreign objects, vehicles, houses, animals, and power accessories) from the collected multiple power scene images, placing a real target of a certain category in the multiple real targets in the test image in the form of a foreground, and the placement position of the real target does not overlap with the target to be detected in the test image, and taking the placement position and category of the real target as real target interference labels.

[0090] In the present embodiment, the adversarial sample generation module constructs an adversarial sample generation model based on mixed interference based on real target interference, haze interference, and real noise interference. The adversarial sample generation model includes a generative adversarial network and a substitute model, and the generative adversarial network includes a generative network and a discriminative network. The adversarial sample generation model is based on the generative adversarial network and includes three interference superposition stages: real target interference, haze interference, and real noise interference. The discriminative network discriminates between real and false noise images based on real-world noise images. The substitute model is used as a substitute attack target to detect original samples and samples generated by the generative network, i.e., to detect whether the samples generated by the generative network are attackable. The adversarial sample generation model based on mixed interference provided by the present application can make the adversarial sample and the real sample in the natural scene have the same distribution, and simulate various natural scene conditions to achieve security evaluation of the deep visual detection algorithm using the adversarial sample. In the visual detection task, the adversarial attack model can be described as trying to find a sample closest to the original sample, which is on the manifold of natural scene samples, and the substitute model fails to detect the sample, i.e., does not detect the target to be detected in the sample.

[0091] In an embodiment, the adversarial sample generation module is further configured to train the adversarial sample generation model based on mixed interference, and the training process comprises: taking a training image with real target interference as a first mixed image, superimposing fog interference on the first mixed image by using a fogging algorithm to generate a second mixed image; inputting the second mixed image into a generation network to generate a third mixed image, wherein the network loss is a color stability loss. Inputting the third mixed image and an image with real noise interference into a discrimination network to discriminate between real and false noise, wherein the network loss is a generation discrimination loss. Inputting the third mixed image into a substitute model to obtain a detection mean square error loss. The loss function for training the adversarial sample generation model comprises: the generation discrimination loss of the discrimination network, the color stability loss for preventing color distortion, and the mean square error loss for measuring the gap between the prediction result of the substitute model and the real target interference label. The training image with real target interference is formed by: taking a power scene image as a training image, randomly labeling a real target in the training image outside the target region to be detected, taking the labeled real target as real target interference, and taking the position and category of the real target as real target interference labels; or segmenting multiple real targets from multiple collected power scene images, placing a real target of a certain category in the training image in the form of a foreground, and the placement position of the real target does not overlap with the target to be detected in the training image, and taking the placement position and category of the real target as real target interference labels.

[0092] In an embodiment, the adversarial sample generation module generates an adversarial sample set by using the trained adversarial sample generation model, specifically: placing a real target interference in the form of a foreground in a test image, superimposing fog interference on the test image with real target interference, and inputting the test image with mixed interference into a generation network to generate a test image with mixed interference, inputting the test image with mixed interference into a substitute model for detection, and determining whether the detection result of the substitute model is consistent with the real label of the target to be detected in the test image. If not, the test image with mixed interference is successful in attack, and the test image with mixed interference is added to the adversarial sample set. The security evaluation module tests multiple target models by using the adversarial sample set generated by the adversarial sample generation module to evaluate the detection accuracy of the target model on the target to be detected. The higher the detection accuracy, the stronger the algorithm's ability to defend against adversarial samples, and the higher the security of the algorithm. In addition, the target model can also be trained on the adversarial sample set to form a defense capability.

[0093] The application provides a security evaluation system of a smart grid-oriented deep visual detection algorithm, and the system generates power scene adversarial samples by using an adversarial attack model in view of the defect that a deep network is easily interfered by small signals and fails.

[0094] The application also provides an intelligent chip, which comprises a memory, a processor and a computer program; the computer program is stored in the memory and is configured to be executed by the processor to realize the security evaluation method of the smart grid deep visual detection model.

[0095] The application also provides a computer device, which comprises a memory, a processor and a computer program; the computer program is stored in the memory and is configured to be executed by the processor to realize the security evaluation method of the smart grid deep visual detection model.

[0096] The application also provides a computer readable storage medium, which stores a computer program; the computer program is executed by a processor to realize the security evaluation method of the smart grid deep visual detection model.

[0097] Those skilled in the art should understand that the embodiments of the application can be provided as a method, a system or a computer program product. Therefore, the application can adopt a completely hardware embodiment, a completely software embodiment or an embodiment combining software and hardware aspects. Moreover, the application can adopt a computer program product in the form of being implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes. The solutions in the embodiments of the application can be implemented in various computer languages, for example, an object-oriented programming language Java and a direct script language JavaScript.

[0098] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0099] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flowchart illustrations and / or block diagrams block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart illustrations and / or block diagrams block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0101] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the embodiments by those of skill in the art once they have the benefit of the present disclosure without departing from the spirit and scope of the application. Accordingly, the attached claims are intended to embrace all such variations and modifications as fall within the scope of the present application.

[0102] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A method for security evaluation of a smart grid deep visual inspection model, characterized in that, The method comprises the following steps: forming a test image with real target interference based on a power scene image; inputting the test image with real target interference into a hybrid interference-based adversarial sample generation model to generate an adversarial sample set; the hybrid interference-based adversarial sample generation model is constructed based on real target interference, haze interference and real noise interference, and comprises a generative adversarial network and a substitute model, wherein the generative adversarial network comprises a generative network and a discriminative network; testing an intelligent power grid deep visual detection model by using the adversarial sample set, and evaluating the security of the intelligent power grid deep visual detection model according to a test result; the method further comprises the following steps: before generating the adversarial sample set, inputting a training image with real target interference into the hybrid interference-based adversarial sample generation model to train the hybrid interference-based adversarial sample generation model, comprising the following steps: taking the training image with real target interference as a first hybrid image, superimposing haze interference on the first hybrid image by using a haze adding algorithm to generate a second hybrid image; inputting the second hybrid image into the generative network to generate a third hybrid image; inputting the third hybrid image and an image with real noise interference into the discriminative network to distinguish real and false noises; inputting the third hybrid image into the substitute model for prediction; wherein the loss function of the generative network comprises a generative discriminative loss of the discriminative network, a color stability loss for preventing color distortion, and a mean square error loss for measuring the gap between the prediction result of the substitute model and the real target interference label. 2.The method of claim 1, wherein, The method of forming a test image with real target interference based on a power scene image comprises the following steps: taking a power scene image as a test image, randomly labeling a real target in the test image outside a target region to be detected, taking the labeled real target as real target interference, and taking the position and category of the real target as a real target interference label. 3.The method of claim 1, wherein, The method of forming a test image with real target interference based on a power scene image comprises the following steps: segmenting multiple real targets from multiple collected power scene images; placing a real target in a test image in a foreground form, and the placement position of the real target does not overlap with a target to be detected in the test image, and taking the placement position and category of the real target as a real target interference label. 4.The method of claim 1, wherein, The training image with real target interference is formed by the following method: taking a power scene image as a training image, randomly labeling a real target in the training image outside a target region to be detected, taking the labeled real target as real target interference, and taking the position and category of the real target as a real target interference label; or segmenting multiple real targets from multiple collected power scene images, placing a real target in a training image in a foreground form, and the placement position of the real target does not overlap with a target to be detected in the training image, and taking the placement position and category of the real target as a real target interference label. 5.The method of claim 1, wherein, The method further comprises the following steps: In the process of training the hybrid interference-based adversarial sample generation model, the parameters of the generation network and the parameters of the discrimination network are updated using a stochastic gradient ascent algorithm. 6.The method of claim 1, wherein, The hybrid interference-based adversarial sample generation model is used to input the test image with real target interference, and an adversarial sample set is generated, including: The test image with real target interference is input into the generation network after superimposing the fog interference, and a test image with hybrid interference is generated; The test image with hybrid interference is input into the substitute model for detection, and it is judged whether the detection result of the substitute model is consistent with the real label of the target to be detected in the test image. If not, the test image with hybrid interference is added to the adversarial sample set. 7.A security evaluation system of a smart grid deep visual detection model, characterized in that, Including: The real target interference image module is used to form a test image with real target interference based on a power scene image; The adversarial sample generation module includes a hybrid interference-based adversarial sample generation model, which is used to generate an adversarial sample set according to the input test image with real target interference; The hybrid interference-based adversarial sample generation model is constructed based on real target interference, fog interference and real noise interference, and includes a generative adversarial network and a substitute model. The generative adversarial network includes a generation network and a discrimination network; The security evaluation module is used to test the smart grid deep visual detection model using the adversarial sample set, and evaluate the security of the smart grid deep visual detection model according to the test result; The adversarial sample generation module is also used to train the hybrid interference-based adversarial sample generation model using the training image with real target interference, including: The training image with real target interference is used as a first hybrid image, and a fog interference is superimposed on the first hybrid image using a fogging algorithm to generate a second hybrid image; The second hybrid image is input into the generation network to generate a third hybrid image; The third hybrid image and the image with real noise interference are input into the discrimination network for real and false noise discrimination; The third hybrid image is input into the substitute model for prediction; The loss function of the generation network includes the generation and discrimination loss of the discrimination network, the color stability loss for preventing color distortion, and the mean square error loss for measuring the gap between the prediction result of the substitute model and the real target interference label. 8.The system for security evaluation of smart grid deep visual inspection model according to claim 7, wherein, The real target interference image module is specifically used for: The power scene image is used as a test image, a real target in the test image is randomly labeled outside the target to be detected region of the test image, the labeled real target is used as a real target interference, and the position and category of the real target are used as a real target interference label. Or A plurality of real targets are segmented from a plurality of collected power scene images, a real target of a category is placed in the test image in the form of a foreground, and the placement position of the real target does not overlap with the target to be detected in the test image. The placement position and category of the real target are used as a real target interference label. 9.The system for security evaluation of smart grid deep visual inspection model according to claim 7, wherein, The adversarial sample generation module generates an adversarial sample set according to the input test image with real target interference, specifically including: The test image with the real target interference is superimposed with the fog interference and input into the generation network to generate a test image with mixed interference; The test image with mixed interference is input into the substitute model for detection, and it is judged whether the detection result of the substitute model is consistent with the real label of the target to be detected in the test image. If not, the test image with mixed interference is added to the set of adversarial samples.

10. An intelligent chip, characterized by Comprising: a memory; a processor; and a computer program; wherein the computer program is stored in the memory and configured to be executed by the processor to implement the safety evaluation method of the smart grid deep visual detection model as claimed in any one of claims 1 to 6.

11. A computer device, comprising: Comprising: a memory; a processor; and a computer program; wherein the computer program is stored in the memory and configured to be executed by the processor to implement the safety evaluation method of the smart grid deep visual detection model as claimed in any one of claims 1 to 6.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the safety evaluation method of the smart grid deep visual detection model as claimed in any one of claims 1 to 6.

Images