Model training method, related apparatus, and storage medium

Abstract

The application relates to the technical field of artificial intelligence, and discloses a model training method, related devices and a storage medium, which comprises the following steps: selecting an attack category and attack logic; constructing a to-be-trained model according to the attack logic; inputting preset sample pictures and the attack category into the to-be-trained model to generate a candidate adversarial perturbation; obtaining an adversarial sample according to the sample pictures and the candidate adversarial perturbation; inputting the adversarial sample into at least one substitute model to obtain a target loss value; when the target loss value does not satisfy a preset condition, updating the candidate adversarial perturbation, re-determining the target loss value according to the candidate adversarial perturbation, until the target loss value satisfies the preset condition, and taking the to-be-trained model for currently generating the candidate adversarial perturbation as a trained model. The application is based on an adversarial sample generation model that meets the requirements of actual applications, can generate a large number of required adversarial samples to evaluate a target detection model, and makes the evaluation efficiency of the target detection model higher and the model evaluation more accurate.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence model training technology, and more specifically to a model training method, related apparatus and storage medium. Background Technology

[0002] Existing model attack methods can be divided into two main categories based on the attack results: the first category is targeted attacks, where the attack sample can cause the model to identify all predictions as the target category. The second category is non-targeted attacks, where the attack sample can cause the model to identify all predictions as the wrong category.

[0003] Targeted attacks are primarily used to evaluate deep learning-based object detection models. Targeted attacks require a large number of adversarial examples to evaluate the robustness of object detection models.

[0004] Currently, under adversarial attacks, adversarial examples constructed by adding small perturbations can easily cause the object detection model to make prediction errors. It is impossible to obtain enough adversarial examples that meet the requirements, resulting in low evaluation efficiency and inaccurate model evaluation of the object detection model. Summary of the Invention

[0005] This application provides a model training method, related apparatus, and storage medium, which can obtain an adversarial example generation model that meets the requirements of practical applications. Based on the adversarial example generation model that meets the requirements of practical applications, a large number of adversarial examples that meet the requirements can be generated to evaluate the target detection model, making the evaluation efficiency of the target detection model higher and the model evaluation more accurate.

[0006] In a first aspect, embodiments of this application provide a model training method, including:

[0007] Select the attack category and attack logic;

[0008] A training model is constructed based on the attack logic, wherein the attack logic includes the attack category;

[0009] Input the preset sample images and the attack categories into the model to be trained to generate candidate adversarial perturbations;

[0010] Based on the sample images and the candidate adversarial perturbations, adversarial examples are obtained;

[0011] Using the adversarial example as input to at least one alternative model, the target loss value is obtained;

[0012] When the target loss value does not meet the preset conditions, the candidate adversarial perturbation is updated, and the target loss value is redetermined based on the candidate adversarial perturbation until the target loss value meets the preset conditions. Then, the training model that currently generates the candidate adversarial perturbation is used as the trained model.

[0013] In one embodiment of this application, the selection of attack category and attack logic includes:

[0014] Select the attack category;

[0015] Obtain the initial attack logic for the model to be trained;

[0016] The optimal attack logic is obtained by solving the genetic algorithm and the initial attack logic to obtain the attack logic for the model to be trained.

[0017] In one embodiment of this application, the initial attack logic further includes an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category, and a set of category sample constraints belonging to the auxiliary semantic guidance category;

[0018] The step of obtaining the initial attack logic for the model to be trained includes:

[0019] Based on pre-defined semantic prior knowledge, an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category is determined;

[0020] The set of category sample constraints belonging to the auxiliary semantic guidance category is calculated using a pre-defined semantic information extraction network.

[0021] Based on the attack category, the auxiliary semantic guidance category, and the category sample constraint set, the initial attack logic for the model to be trained is determined.

[0022] In one embodiment of this application, constructing the model to be trained based on the attack logic includes:

[0023] The attack category is embedded into a category mapping network for category mapping, so as to embed the attack category into the model to be trained;

[0024] The step of determining auxiliary semantic guidance categories that are strongly correlated with the semantic information of the attack category through preset semantic prior knowledge includes:

[0025] The sample image is input into the category mapping network for category mapping, and an implicit vector of a preset specific target is output.

[0026] The sample images are input into the initial model to be trained to obtain sample vectors;

[0027] In the category mapping network, the implicit vector and the sample vector are expanded along the height and width directions to concatenate the feature maps of the implicit vector and the sample vector in the channel dimension, thereby obtaining an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category.

[0028] In one embodiment of this application, the step of using the adversarial example to input at least one alternative model to obtain the target loss value includes:

[0029] The adversarial sample is input into at least one alternative model to obtain the loss of the at least one alternative model;

[0030] The adversarial sample and the category sample constraint set are input into the semantic feature extraction network, which outputs the first semantic feature and the second semantic feature.

[0031] Calculate the distance between the first semantic feature and the second semantic feature, and use the distance as the loss between sample constraints;

[0032] The target loss value is determined based on the loss of the at least one alternative model and the loss between the sample constraints.

[0033] In one embodiment of this application, determining the target loss value based on the loss of the at least one alternative model and the loss between the sample constraints includes:

[0034] Obtain the first loss parameter preset for each alternative model in the at least one alternative model;

[0035] Obtain the second loss parameter preset by the semantic feature extraction network;

[0036] The target loss value is calculated based on the first loss parameter, the second loss parameter, the loss of the at least one alternative model, and the loss between the sample constraints.

[0037] Secondly, embodiments of this application provide a method for generating adversarial examples, wherein the method generates adversarial examples using a model trained by the model training method described in the first aspect.

[0038] Thirdly, embodiments of this application provide a model evaluation method, which uses the adversary sample generation method as described in the second aspect to generate multiple adversarial samples to evaluate the robustness of the target detection model.

[0039] Fourthly, embodiments of this application provide a computing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the model training method as described in the first aspect, the adversarial example generation method as described in the second aspect, and the model evaluation method as described in the third aspect.

[0040] Fifthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the model training method as described in the first aspect, the adversarial example generation method as described in the second aspect, and the model evaluation method as described in the third aspect.

[0041] In a sixth aspect, embodiments of this application provide a computer program product including instructions, the computer program product including program instructions that, when executed on a computer or processor, cause the computer or processor to perform the model training method as described in any one of the first aspects.

[0042] Seventhly, embodiments of this application provide a chip system, the chip system comprising:

[0043] A communication interface used for inputting and / or outputting information;

[0044] A processor for executing a computer-executable program, causing a device equipped with the chip system to perform the model training method as described in the first aspect, the adversarial example generation method as described in the second aspect, and the model evaluation method as described in the third aspect.

[0045] In one possible design, the aforementioned chip system also includes a memory for storing program instructions and data necessary for the terminal. The chip system can be composed of chips or may include chips and other discrete components.

[0046] Eighthly, embodiments of this application provide a model training apparatus having the function of implementing the model training method corresponding to the first aspect described above. The function can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions, and the modules can be software and / or hardware.

[0047] In one embodiment of this application, the model training device includes:

[0048] Select a module to choose the attack type and attack logic;

[0049] A construction module is used to construct a model to be trained based on the attack logic, wherein the attack logic includes the attack category;

[0050] The first generation module is used to input the preset sample images and the attack category into the model to be trained to generate candidate adversarial perturbations;

[0051] The second generation module is used to generate adversarial samples based on the sample images and the candidate adversarial perturbations;

[0052] A loss calculation module is used to input at least one alternative model using the adversarial example to obtain a target loss value;

[0053] The determination module is used to update the candidate adversarial perturbation when the target loss value does not meet the preset conditions, redetermine the target loss value based on the candidate adversarial perturbation, and use the training model that currently generates the candidate adversarial perturbation as the trained model when the target loss value meets the preset conditions.

[0054] In one embodiment of this application, the selected module is specifically used for:

[0055] Select the attack category;

[0056] Obtain the initial attack logic for the model to be trained; solve for the optimal attack logic using a genetic algorithm and the initial attack logic to obtain the attack logic for the model to be trained.

[0057] In one embodiment of this application, the initial attack logic further includes an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category, and a set of category sample constraints belonging to the auxiliary semantic guidance category;

[0058] The selected module is specifically used for:

[0059] Based on pre-defined semantic prior knowledge, an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category is determined;

[0060] The set of category sample constraints belonging to the auxiliary semantic guidance category is calculated using a pre-defined semantic information extraction network.

[0061] Based on the attack category, the auxiliary semantic guidance category, and the category sample constraint set, the initial attack logic for the model to be trained is determined.

[0062] In one embodiment of this application, the building module is specifically used for:

[0063] The attack category is embedded into a category mapping network for category mapping, so as to embed the attack category into the model to be trained;

[0064] The selected module is specifically used for:

[0065] The sample image is input into the category mapping network for category mapping, and an implicit vector of a preset specific target is output.

[0066] The sample images are input into the initial model to be trained to obtain sample vectors;

[0067] In the category mapping network, the implicit vector and the sample vector are expanded along the height and width directions to concatenate the feature maps of the implicit vector and the sample vector in the channel dimension, thereby obtaining an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category.

[0068] In one embodiment of this application, the loss calculation module is specifically used for:

[0069] The adversarial sample is input into at least one alternative model to obtain the loss of the at least one alternative model;

[0070] The adversarial sample and the category sample constraint set are input into the semantic feature extraction network, which outputs the first semantic feature and the second semantic feature.

[0071] Calculate the distance between the first semantic feature and the second semantic feature, and use the distance as the loss between sample constraints;

[0072] The loss calculation module is specifically used for:

[0073] The target loss value is determined based on the loss of the at least one alternative model and the loss between the sample constraints.

[0074] In one embodiment of this application, the loss calculation module is further configured to:

[0075] Obtain the first loss parameter preset for each alternative model in the at least one alternative model;

[0076] Obtain the second loss parameter preset by the semantic feature extraction network;

[0077] The target loss value is calculated based on the first loss parameter, the second loss parameter, the loss of the at least one alternative model, and the loss between the sample constraints.

[0078] Compared to existing technologies, this application's embodiments calculate the target loss value based on at least one alternative model, and use the target loss value to verify whether the current adversarial sample meets the requirements. If it does not meet the requirements, the candidate adversarial perturbation is updated. After the adversarial sample meets the requirements, the model that currently generates the adversarial sample becomes the trained model. Therefore, this application's embodiments introduce at least one alternative model from a third party to verify whether the adversarial sample meets the requirements, thereby indirectly detecting whether the model that currently generates the adversarial sample has been trained to the point where it can generate adversarial samples that meet the requirements. This can result in an adversarial sample generation model that meets the requirements of practical applications. Furthermore, based on the adversarial sample generation model that meets the requirements of practical applications, a large number of adversarial samples that meet the requirements can be generated to evaluate the target detection model, making the evaluation efficiency of the target detection model higher and the model evaluation more accurate. Attached Figure Description

[0079] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0080] Figure 1 This is a schematic diagram of a model training system provided in an embodiment of this application;

[0081] Figure 2 This is a schematic flowchart of an embodiment of the model training method provided in this application;

[0082] Figure 3 This is a schematic diagram of an algorithm for the model training method provided in the embodiments of this application;

[0083] Figure 4 This is a schematic diagram of the structure of the model training device according to an embodiment of this application;

[0084] Figure 5 This is a schematic diagram of a model training computing device according to an embodiment of this application;

[0085] Figure 6 This is a schematic diagram of the structure of a mobile phone in one embodiment of this application;

[0086] Figure 7 This is a schematic diagram of a server structure in one embodiment of this application.

[0087] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0088] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0089] In the following description, specific embodiments of this application will be illustrated with reference to steps and symbols performed by one or more computers, unless otherwise stated. Therefore, these steps and operations will be referred to several times as being performed by a computer, and computer execution as referred to herein includes operations by a computer processing unit representing electronic signals of data in a structured format. This operation transforms the data or maintains it at a location in the computer's memory system, which can be reconfigured or otherwise alter the operation of the computer in a manner well known to those skilled in the art. The data structure maintained by the data is the physical location of the memory, which has specific characteristics defined by the data format. However, the principles of this application are described in the foregoing text, which is not intended to be limiting, and those skilled in the art will understand that many of the steps and operations described below can also be implemented in hardware.

[0090] The terms "module" or "unit" as used herein can be considered as software objects executing on the computing system. The different components, modules, engines, and services described herein can be considered as implementation objects on the computing system. The apparatus and methods described herein are preferably implemented in software, but can also be implemented in hardware, both of which are within the scope of this application.

[0091] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this application means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or wireless coupling. The term “and / or” as used herein includes all or any units and all combinations of one or more associated listed items.

[0092] This application provides a model training method, related apparatus, and storage medium.

[0093] Please see Figure 1 , Figure 1 This is a schematic diagram of a model training system provided in an embodiment of this application. The model training system may include a computing device 100 connected via a network, and the computing device 100 integrates a model training apparatus. In this embodiment, the computing device 100 may be a terminal device or a server.

[0094] In this embodiment, when the computing device 100 is a server, the server can be an independent server, a server network, or a server cluster. For example, the server described in this embodiment includes, but is not limited to, a computer, a network host, a single network server, a set of multiple network servers, or a cloud server composed of multiple servers. The cloud server is composed of a large number of computers or network servers based on cloud computing. In this embodiment, communication between the server and the client can be achieved through any communication method, including but not limited to mobile communication based on the 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), and Worldwide Interoperability for Microwave Access (WiMAX), or computer network communication based on the TCP / IP Protocol Suite (TCP / IP) and User Datagram Protocol (UDP).

[0095] It is understood that when the computing device 100 used in the embodiments of this application is a terminal device, the terminal device can be a device that includes both receiving hardware and transmitting hardware, that is, a device with receiving and transmitting hardware capable of performing bidirectional communication on a bidirectional communication link. Such a terminal device may include: cellular or other communication devices, which have a single-line display or a multi-line display or a cellular or other communication device without a multi-line display. Specifically, the computing device 100 may be a desktop terminal or a mobile terminal, and may specifically be one of a mobile phone, tablet computer, laptop computer, etc.

[0096] The terminal devices involved in the embodiments of this application can also be devices that provide voice and / or data connectivity to users, handheld devices with wireless connectivity, or other processing devices connected to a wireless modem. Examples include mobile phones (or "cellular" phones) and computers with mobile terminals, such as portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted mobile devices that exchange voice and / or data with a wireless access network. Examples include Personal Communication Service (PCS) phones, cordless phones, Session Initiation Protocol (SIP) phones, Wireless Local Loop (WLL) stations, Personal Digital Assistants (PDAs), and other devices.

[0097] Those skilled in the art will understand that Figure 1 The application environment shown is merely one application scenario of the solution in this application and does not constitute a limitation on the application scenario of the solution in this application. Other application environments may include those that are more specific to this application. Figure 1 The number of computing devices shown, or the network connectivity of computing devices, for example... Figure 1 Only one computing device is shown in the diagram. It is understood that the model training system may also include one or more other computing devices, and / or one or more other computing devices that are networked with computing device 100, without being limited here.

[0098] In addition, such as Figure 1 As shown, the model training system may also include a memory 300 for storing data, such as sample images, adversarial perturbation data, and adversarial sample data.

[0099] It should be noted that, Figure 1 The schematic diagram of the model training system shown is merely an example. The model training system and scenario described in this application are for the purpose of more clearly illustrating the technical solutions of this application and do not constitute a limitation on the technical solutions provided in this application. As those skilled in the art will know, with the evolution of model training systems and the emergence of new business scenarios, the technical solutions provided in this application are also applicable to similar technical problems.

[0100] The solutions provided in this application involve technologies such as Artificial Intelligence (AI), Computer Vision (CV), and Machine Learning (ML), which are specifically illustrated through the following embodiments:

[0101] AI, or Artificial Intelligence, refers to the theories, methods, technologies, and application systems that utilize digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, Artificial Intelligence is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine capable of reacting in a manner similar to human intelligence. Artificial Intelligence studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0102] AI technology is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0103] Currently, AI technology is widely used in human-computer interaction, security protection, and many other fields. However, because the input form of machine learning algorithms is a numerical vector, attackers can design a targeted numerical vector to cause the machine learning model to make misjudgments; this is the process of adversarial attacks.

[0104] Attack methods can be divided into two main categories based on their results: the first is targeted attacks, where the attack sample can cause the model to identify all possible categories as the target class during prediction. The second is non-targeted attacks, where the attack sample can cause the model to identify all possible categories as incorrect during prediction.

[0105] In contrast, targeted attacks are more challenging, requiring the detector to identify the target object as a specific attack category, making them more targeted. Object detection is a multi-task learning problem, encompassing foreground-background differentiation, multiple object differentiation, and object location identification. Object detection has demonstrated its ability to solve practical problems. While there is considerable research on adversarial examples in object detection scenarios, most studies remain focused on the non-targeted domain.

[0106] In one related technique, the existing Directed Acyclic Graph (DAG) is the earliest proposed attack detection model algorithm. It attacks the model by manipulating a Region Proposal Network (RPN) to generate a large number of erroneous proposed regions. For a two-stage object detection model, this algorithm employs a two-stage attack strategy. In the first stage, the RPN network is used to generate candidate regions that may contain the target. In the second stage, the set of candidate regions obtained in the first stage is used to train and generate adversarial perturbations. This method assigns a randomly selected label to each candidate region and then performs an iterative gradient attack.

[0107] The aforementioned algorithms are time-consuming and resource-intensive. Furthermore, algorithms using gradient optimization attacks heavily rely on alternative models, and they all neglect the consideration and design of ensemble methods, resulting in poor transferability and insufficient attack capabilities.

[0108] The embodiments of this application are based on an adversarial sample generation model that meets the requirements of practical applications. It can generate a large number of adversarial samples that meet the requirements for evaluating the target detection model, making the evaluation efficiency of the target detection model higher and the model evaluation more accurate, so as to solve the problem of insufficient attack capability in the prior art.

[0109] The following detailed description is based on specific embodiments.

[0110] In this embodiment, the description will be from the perspective of the model training method, which can be integrated into the computing device 100.

[0111] This application provides a model training method, which includes: selecting an attack category and attack logic; constructing a model to be trained based on the attack logic, wherein the attack logic includes the attack category; inputting preset sample images and the attack category into the model to be trained to generate candidate adversarial perturbations; obtaining adversarial samples based on the sample images and the candidate adversarial perturbations; inputting the adversarial samples into at least one alternative model to obtain a target loss value; when the target loss value does not meet a preset condition, updating the candidate adversarial perturbations, redetermining the target loss value based on the candidate adversarial perturbations, until the target loss value meets the preset condition, and then using the model to be trained that currently generates candidate adversarial perturbations as the trained model.

[0112] Please see Figure 2 The diagram below illustrates a flowchart of an embodiment of the model training method in this application, which includes the following steps 201-206:

[0113] 201. Select the attack category and attack logic.

[0114] The attack category can be the category that the target object being attacked by the model is identified as a targeted attack category. For example, if the red light category is attacked as the green light category, then the green light category is the selected attack category.

[0115] Specifically, the attack category can be selected based on the sample image category and actual needs. For example, when this method is applied to a video surveillance system, if the sample image is a human, the attack category could be a cat to interfere with monitoring.

[0116] The attack logic is selected based on the attack category. The attack logic is an attack plan to attack the model to be trained. The attack logic may include the attack category, as well as the auxiliary semantic guidance category that is strongly related to the semantic information of the attack category, and the category sample constraint set belonging to the auxiliary semantic guidance category.

[0117] 202. Construct the model to be trained based on the attack logic.

[0118] Here, the model to be trained is a model that generates adversarial examples, and the model to be trained can be a generative network. 。

[0119] 203. Input the preset sample images and the attack categories into the model to be trained to generate candidate adversarial perturbations.

[0120] The sample images can be represented using pixel-based vectors. Specifically, the sample images can come from video frames; for example, a sample image could be a portrait image from video surveillance. The specific source of the sample images is not limited here.

[0121] When the adversarial perturbation is added to the sample image, the neural network will identify the sample image as an attack category. However, the attack category and the sample image should belong to different categories. In other words, adding the adversarial perturbation to the sample image will cause the neural network to make a misjudgment.

[0122] Specifically, adversarial perturbations can be added to every pixel unit of the sample image, or to only a few pixel units; the specific method of adding adversarial perturbations is not limited here. Furthermore, candidate adversarial perturbations are not the final adversarial perturbations.

[0123] 204. Based on the sample images and the candidate adversarial perturbations, adversarial samples are obtained.

[0124] Specifically, adversarial examples are obtained using a Contrastive Language–Image Pre-training (CLIP) model and a mapping network. Using CLIP to process the category mapping network helps eliminate illegal values ​​in adversarial perturbations, thus improving the success rate of adversarial example attacks.

[0125] 205. Using the adversarial sample as input to at least one alternative model, the target loss value is obtained.

[0126] The alternative model can be one or more. In one specific embodiment, the alternative model can include model M1, model M2 and / or model M3, where M1 = YOLOv3, M2 = Faster R-CNN, M3 = DETR, one or more of them, or a combination thereof, which is not limited here.

[0127] 206. When the target loss value does not meet the preset conditions, update the candidate adversarial perturbation, redetermine the target loss value based on the candidate adversarial perturbation, until the target loss value meets the preset conditions, and then use the currently generated candidate adversarial perturbation model as the trained model.

[0128] Specifically, when calculating the target loss value, the target loss value is compared with the preset loss value. If the target loss value does not meet the preset conditions, the sample image and attack category are input again, and the candidate adversarial perturbation is iteratively updated. The target loss value is recalculated based on the updated candidate adversarial perturbation, and then compared with the preset loss value again. When the target loss value meets the preset conditions, the training model with the currently generated candidate adversarial perturbation is used as the trained model.

[0129] In this embodiment, the target loss value is calculated based on at least one alternative model. The target loss value is used to verify whether the current adversarial sample meets the requirements. If the requirements are not met, the candidate adversarial perturbation is updated. After the adversarial sample meets the requirements, the model that currently generates the adversarial sample becomes the trained model. Therefore, this embodiment introduces at least one alternative model from a third party to verify whether the adversarial sample meets the requirements, thereby indirectly detecting whether the model that currently generates the adversarial sample has been trained to the point that it can generate adversarial samples that meet the requirements. This can result in an adversarial sample generation model that meets the requirements of practical applications. Furthermore, based on the adversarial sample generation model that meets the requirements of practical applications, a large number of adversarial samples that meet the requirements can be generated to evaluate the target detection model, making the evaluation efficiency of the target detection model higher and the model evaluation more accurate.

[0130] This application embodiment is based on an adversarial sample generation model that meets the requirements of practical applications. By continuously iterating and updating candidate adversarial perturbations, adversarial samples that meet preset standards can be updated and generated. A training model that can generate adversarial samples that meet the requirements can be obtained. This training model can improve the success rate of adversarial sample attacks, thereby evaluating the robustness of the model.

[0131] In one embodiment of this application, step 201, selecting the attack category and attack logic, includes:

[0132] An attack category is selected, and an initial attack logic is obtained for the model to be trained. An optimal attack logic is then solved using a genetic algorithm and the initial attack logic to obtain the final attack logic for the model to be trained. The initial attack logic is determined based on the attack category, which includes the attack category itself.

[0133] Genetic algorithms (GA) are based on the principle of simulating the heredity and mutation of organisms. They have a wide range of applications, including accelerating algorithms for finding maximum or minimum values.

[0134] The embodiments of this application solve for the optimal attack logic through a genetic algorithm and initial attack logic, which can obtain the optimal attack logic for the training model and enhance the attack power.

[0135] In one embodiment of this application, the initial attack logic further includes an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category, and a set of category sample constraints belonging to the auxiliary semantic guidance category.

[0136] Specifically, the initial attack logic includes an attack category, an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category, and a set of category sample constraints belonging to the auxiliary semantic guidance category.

[0137] At this point, obtaining the initial attack logic for the model to be trained includes:

[0138] Using pre-defined semantic prior knowledge, an auxiliary semantic guidance category strongly correlated with the semantic information of the attack category is determined. A pre-defined semantic information extraction network is used to calculate a category sample constraint set belonging to the auxiliary semantic guidance category. Based on the attack category, the auxiliary semantic guidance category, and the category sample constraint set, the initial attack logic for the model to be trained is determined.

[0139] Semantic prior knowledge refers to information obtained by integrating generalized datasets and human prior information. Using the semantic prior knowledge to guide adversarial perturbations can attack information at the semantic level.

[0140] Specifically, the auxiliary semantic guidance category strongly correlated with the semantic information of the attack category is obtained by analyzing the scenarios in which the attack category appears and the scenario category information. That is, by analyzing the scenarios in which the attack category appears, combined with pre-defined semantic prior knowledge, the auxiliary semantic guidance category strongly correlated with the semantic information of the attack category is obtained. For example, when the attack category is the tree category, by analyzing the scenarios in which the tree category appears using semantic prior knowledge, since trees are usually rooted in the soil, the auxiliary semantic guidance category strongly correlated with the semantic information of the attack category could be the soil category.

[0141] The auxiliary semantic guidance category and the category sample constraint set are complementary knowledge of different dimensions, and together they provide category-level guidance and semantic-level guidance.

[0142] In this embodiment of the application, an attack plan is first initialized. For example, attack plan P contains predefined attack categories. and auxiliary semantic guidance categories and category sample constraint set

[0143] Before launching an attack, it is necessary to first define the attack category. By using the attack category as input to construct a semantic prior information-guided algorithm, the algorithm will output three categories with strong semantic correlation. Therefore, it is classified as an attack category. The auxiliary semantic guidance category is then implemented through a pre-defined high-level semantic information extraction network. Calculation belongs to High-confidence sample set of categories and and It is a complementary and mutually constraining knowledge system across different dimensions. and Together, they provide category-level guidance and semantic-level guidance.

[0144] This application embodiment enhances semantic attack power by using semantic prior knowledge and auxiliary semantic guidance categories that are strongly correlated with the semantic information of the attack category.

[0145] In one embodiment of this application, step 202, which constructs a model to be trained based on the attack logic, includes: embedding the attack category into a category mapping network to perform category mapping, thereby embedding the attack category into the model to be trained. The category mapping network is embedded in the training method.

[0146] Furthermore, determining the auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category through preset semantic prior knowledge includes: inputting the sample image into the category mapping network for category mapping, and outputting an implicit vector of a preset specific target.

[0147] Specifically, before the sample image flows from the encoder to the decoder, the category mapping network introduces the attack category of the targeted attack at the encoder and embeds the attack category information into the sample image through the category mapping network. The sample image is input into the initial model to be trained to obtain a sample vector; in the category mapping network, the implicit vector and the sample vector are expanded along the height and width directions to concatenate the feature maps of the implicit vector and the sample vector in the channel dimension, thereby obtaining an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category.

[0148] Specifically, advanced convolutional operations are used in class mapping networks to move the image in small increments.

[0149] This application embodiment improves the success rate of attacks by embedding semantic information into subsequent feature maps through category embedding.

[0150] In one embodiment of this application, step 205, which uses the adversarial sample to input at least one alternative model to obtain a target loss value, includes: inputting the adversarial sample into at least one alternative model to obtain the loss of the at least one alternative model.

[0151] The surrogate model is the model used to output the prediction result. That is, after inputting an adversarial example, the surrogate model outputs the predicted category. For example, if the attack category is selected as "cat" and the sample image is classified as "human," then the adversarial example should be a sample that causes the target detection model to output "cat." The adversarial example is input into the surrogate model, which outputs the target detection result. By obtaining the prediction result of the surrogate model, the difference between the prediction result and the preset output result is calculated. This difference is the loss value. After calculating the loss value, iterative methods such as gradient descent can be used to minimize the loss value, thereby continuously optimizing the attack logic.

[0152] The prediction results of the alternative model include the category and coordinates of the adversarial example.

[0153] The adversarial examples and the set of class sample constraints are input into the semantic feature extraction network, which outputs a first semantic feature and a second semantic feature. The distance between the first semantic feature and the second semantic feature is calculated and used as the loss between sample constraints. The target loss value is determined based on the loss of the at least one alternative model and the loss between sample constraints.

[0154] Specifically, the semantic features output by the semantic feature extraction network of the adversarial sample input semantic features are designated as the first semantic features, and the semantic features output by the semantic feature extraction network of the category sample constraint set input semantic features are designated as the second semantic features.

[0155] Specifically, for example, if the alternative models are M1 = YOLOv3, M2 = Faster R-CNN, and M3 = DETR, then the formula for calculating the overall loss value of the alternative models is:

[0156]

[0157] in, All α i The values ​​are all greater than 0, where α1 is the weight of model M1, α2 is the weight of model M2, α3 is the weight of model M3, and δ is the perturbation of the targeted attack. These are model M1, model M2, model M3, and the semantic feature extraction network. The loss value.

[0158] This application embodiment constrains the loss value of the substitution model by calculating the loss value at the semantic level and constraining the loss value at the semantic level. This allows for attacks on semantic level information. By constraining the loss value to be as small as possible, the success rate of the attack can be improved, thus enhancing the attack.

[0159] In one embodiment of this application, determining the target loss value based on the loss of the at least one alternative model and the loss between the sample constraints includes: obtaining a first loss parameter preset for each of the at least one alternative model; obtaining a second loss parameter preset for the semantic feature extraction network; and calculating the target loss value based on the first loss parameter, the second loss parameter, the loss of the at least one alternative model, and the loss between the sample constraints. The obtained first and second loss parameters can be used to obtain formula parameters for adversarial example generation.

[0160] This application embodiment can obtain the formula parameters for generating adversarial examples by acquiring loss parameters, thereby obtaining the specific generation formula for adversarial examples and improving the efficiency of adversarial example generation.

[0161] This application employs a target detection targeted attack method utilizing semantic prior information. This method leverages semantic prior knowledge integrated from generalized datasets and human prior information to guide perturbations that attack semantic-level information. The attack method primarily targets the target category, supplemented by other scene-related categories. It performs targeted attacks based on scene information. Instead of a simple generative adversarial approach, it considers different categories of attack perturbations and uses a generative adversarial network with conditional embedding of multi-class vectors to generate targeted perturbations, enabling the victim model to identify the attacked target as belonging to the targeted attack category. This method significantly improves the number of attack categories and increases the speed and efficiency of the attack. Using category embedding allows attackers to select different categories for attacks. Furthermore, the ensemble training method using multiple models during training enhances the transferability of perturbations across different models.

[0162] The focus of this application's embodiments is on how to find the optimal attack plan. Since current detection models place more emphasis on overall semantic composition, if the categories in the dataset are to be... Target attack is categorized as This requires category analysis. The analysis of scene information, including its category, allows for the construction of perturbation attack category combinations. Attack categories include targeted attack categories and scenario-related auxiliary attack categories. At this point, semantic prior information is needed to specify the attack plan. Different attack plans are used to find a set of category sample constraints. This constraint set provides high-level semantic guidance, ensuring that the generated perturbations closely resemble the semantics of the targeted attack category. This semantic guidance method uses a semantic extraction network to constrain the semantic differences between adversarial examples and the auxiliary attack categories of the attack category.

[0163] In this embodiment of the application, semantic information constraints are not applied before determining the final attack plan P; semantic-level sample constraints are only applied after the optimal attack plan is determined. Input: Original image Targeted attack categories Attack plan P. Original image Flow from the encoding end to the decoding end of the generating network. Targeted attack categories. First, the class is mapped into the embedded class mapping network W. This network can... Embedded into the generative network. At the encoding end, the target category of the targeted attack is first introduced. Use a mapping network W to output an implicit vector for a specific target. In the mapping network W, the vectors are expanded along the height and width directions. By concatenating the feature maps along the channel dimension, strongly correlated category information can be obtained. This method embeds category information into the feature map by concatenating the image feature vector and the target label feature vector. The feature map containing category information is then input into the subsequent network. The generator network uses the decoder to recover the resolution of the feature map and utilizes... Perform a process on the output of the generator network. This operation helps to eliminate illegal values ​​from the perturbation. Using Gaussian convolution, the image is moved in small increments, increasing the success rate of the attack.

[0164]

[0165] in, For the output result, n and m represent the number of pixel rows and columns, ∈ is a preset value, m ij For the pixel value in the i-th row and j-th column, This is a Gaussian convolution operation.

[0166] Through the above process, the adversarial examples generated by the generative network are represented as follows:

[0167]

[0168] Adversarial examples will be obtained. Input the alternative model M, and the alternative model will output the prediction results, including the category of each foreground object. and coordinate information At this point, the loss function of the alternative model in the plan is calculated, and the optimal attack plan is obtained through a genetic algorithm.

[0169] Through multiple iterations, an attack plan P that minimizes the loss function of the alternative model can be obtained, resulting in adversarial examples. Input semantic feature extraction network Output semantic features (As shown in the first semantic feature above). The sample constraint set defined in the attack plan P. Input semantic feature extraction network Output semantic features (As shown in the second semantic feature above). Algorithm-constrained semantic features and semantic features The distance between them can be used to guide semantic understanding and enhance the attack.

[0170]

[0171] This application solves for the parameters of the generative model by addressing the following optimization problem:

[0172]

[0173] in A set representing categories of targeted attacks. This represents the category information predicted by the alternative model. In the generative network... During inference, the input image and the targeted attack category The perturbation δ of a network output-directed attack, and The desired targeted attack result can be obtained by adding them together.

[0174] For details, please refer to Figure 3 , Figure 3 This is a flowchart of the specific algorithm for the model training method.

[0175] This application also provides an adversarial example generation method based on the above-described model training method, the method comprising: generating adversarial examples using a model trained by the model training method in any of the above embodiments.

[0176] The embodiments of this application generate adversarial examples based on practical application requirements through trained models, which can improve the actual application rate of adversarial examples and enhance their offensive capabilities.

[0177] This application also provides a model evaluation method, which includes evaluating the robustness of an object detection model by generating multiple adversarial samples using the adversarial sample generation method described above.

[0178] The embodiments of this application can generate a large number of qualified adversarial examples through the trained model to evaluate the target detection model, making the evaluation of the target detection model more efficient and the model evaluation more accurate, thereby improving the robustness of the model.

[0179] To facilitate better implementation of the model training method provided in the embodiments of this application, the embodiments of this application also provide an apparatus based on the above-described model training method. The meanings of the terms used are the same as in the above-described model training method, and specific implementation details can be found in the descriptions of the model training method embodiments.

[0180] The model training apparatus in this application embodiment has the function of implementing the model training method corresponding to the above embodiment. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above function, and the modules can be software and / or hardware.

[0181] Please see Figure 4 , Figure 4This is a schematic diagram of the structure of the model training device provided in the embodiments of this application. The model training device can be applied to computing devices in scenarios requiring model training. Specifically, the model training device 400 may include a selection module 401, a construction module 402, a first generation module 403, a second generation module 404, a loss calculation module 405, and a determination module 406, as detailed below:

[0182] Select module 401 to select the attack type and attack logic.

[0183] The construction module 402 is used to construct a model to be trained according to the attack logic, wherein the attack logic includes the attack category.

[0184] The first generation module 403 is used to input the preset sample images and the attack category into the model to be trained to generate candidate adversarial perturbations.

[0185] The second generation module 404 is used to obtain adversarial samples based on the sample images and the candidate adversarial perturbations.

[0186] The loss calculation module 405 is used to obtain the target loss value by using the adversarial example input to at least one alternative model.

[0187] The determination module 406 is used to update the candidate adversarial perturbation when the target loss value does not meet the preset conditions, redetermine the target loss value according to the candidate adversarial perturbation, and use the training model that currently generates the candidate adversarial perturbation as the trained model when the target loss value meets the preset conditions.

[0188] In one embodiment of this application, the selected module 401 is specifically used for:

[0189] Select the attack category;

[0190] Obtain the initial attack logic for the model to be trained; solve for the optimal attack logic using a genetic algorithm and the initial attack logic to obtain the attack logic for the model to be trained.

[0191] In one embodiment of this application, the initial attack logic further includes an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category, and a set of category sample constraints belonging to the auxiliary semantic guidance category;

[0192] The selected module 401 is specifically used for:

[0193] Based on pre-defined semantic prior knowledge, an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category is determined;

[0194] The set of category sample constraints belonging to the auxiliary semantic guidance category is calculated using a pre-defined semantic information extraction network.

[0195] Based on the attack category, the auxiliary semantic guidance category, and the category sample constraint set, the initial attack logic for the model to be trained is determined.

[0196] In one embodiment of this application, the construction module 402 is specifically used for:

[0197] The attack category is embedded into a category mapping network for category mapping, so as to embed the attack category into the model to be trained;

[0198] The selected module 401 is specifically used for:

[0199] The sample image is input into the category mapping network for category mapping, and an implicit vector of a preset specific target is output.

[0200] The sample images are input into the initial model to be trained to obtain sample vectors;

[0201] In the category mapping network, the implicit vector and the sample vector are expanded along the height and width directions to concatenate the feature maps of the implicit vector and the sample vector in the channel dimension, thereby obtaining an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category.

[0202] In one embodiment of this application, the loss calculation module 405 is specifically used for:

[0203] The adversarial sample is input into at least one alternative model to obtain the loss of the at least one alternative model;

[0204] The adversarial sample and the category sample constraint set are input into the semantic feature extraction network, which outputs the first semantic feature and the second semantic feature.

[0205] Calculate the distance between the first semantic feature and the second semantic feature, and use the distance as the loss between sample constraints;

[0206] The loss calculation module 405 is specifically used for:

[0207] The target loss value is determined based on the loss of the at least one alternative model and the loss between the sample constraints.

[0208] In one embodiment of this application, the loss calculation module 405 is further configured to:

[0209] Obtain the first loss parameter preset for each alternative model in the at least one alternative model;

[0210] Obtain the second loss parameter preset by the semantic feature extraction network;

[0211] The target loss value is calculated based on the first loss parameter, the second loss parameter, the loss of the at least one alternative model, and the loss between the sample constraints.

[0212] In this embodiment, the attack category and attack logic are selected by the selection module 401; the model to be trained is constructed by the construction module 402 according to the attack logic, the attack logic including the attack category; the preset sample image and the attack category are input into the model to be trained by the first generation module 403 to generate candidate adversarial perturbations; the adversarial sample is obtained by the second generation module 404 according to the sample image and the candidate adversarial perturbations; the target loss value is obtained by the loss calculation module 405 using the adversarial sample to input at least one alternative model; and the candidate adversarial perturbation is updated by the determination module 406 when the target loss value does not meet the preset conditions, and the target loss value is re-determined according to the candidate adversarial perturbation until the target loss value meets the preset conditions, at which point the model to be trained with the currently generated candidate adversarial perturbation is used as the trained model. Since the target loss value is calculated based on at least one alternative model in this application embodiment, and the current adversarial sample is checked based on the target loss value to verify whether it meets the requirements, if it does not meet the requirements, the candidate adversarial perturbation is updated. After the adversarial sample meets the requirements, the model that currently generates the adversarial sample is the trained model. Therefore, this application embodiment introduces at least one alternative model from a third party to verify whether the adversarial sample meets the requirements, thereby indirectly detecting whether the current adversarial sample generating model has been trained to the point that it can generate adversarial samples that meet the requirements. This can result in an adversarial sample generation model that meets the requirements of practical applications. Furthermore, based on the adversarial sample generation model that meets the requirements of practical applications, a large number of adversarial samples that meet the requirements can be generated to evaluate the target detection model, making the evaluation efficiency of the target detection model higher and the model evaluation more accurate.

[0213] The model training device in the embodiments of this application has been described above from the perspective of modular functional entities. The model training device in the embodiments of this application will be described below from the perspective of hardware processing.

[0214] It should be noted that, Figure 4 The physical devices corresponding to the first generation module 403 and the second generation module 404 shown can be transceivers, radio frequency circuits, communication modules and input / output (I / O) interfaces, etc., and the physical device corresponding to the determination module 406 can be a processor.

[0215] Figure 4 The devices shown can all have the following characteristics: Figure 5 The structure shown, when Figure 5 The model training device shown has the following characteristics: Figure 5 When the structure shown is used, Figure 5The processor and transceiver in the device can perform the same or similar functions as the determination module 406, the first generation module 403, and the second generation module 404 provided in the aforementioned device embodiments. Figure 5 The memory in the processor stores the computer programs that need to be called when executing the above model training method.

[0216] When the computing device in this application embodiment is a terminal device, this application embodiment also provides a terminal device, such as... Figure 6 As shown, for ease of explanation, only the parts related to the embodiments of this application are shown. For specific technical details not disclosed, please refer to the method section of the embodiments of this application. The terminal device can be any terminal device including mobile phones, tablets, personal digital assistants (PDAs), point-of-sale (POS) terminals, in-vehicle computers, etc. Taking a mobile phone as an example:

[0217] Figure 6 This diagram illustrates a partial structural representation of a mobile phone related to the terminal device provided in this embodiment. (Reference) Figure 6 The mobile phone includes components such as a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a processor 1080, and a power supply 1090. Those skilled in the art will understand that... Figure 6 The mobile phone structure shown does not constitute a limitation on the mobile phone and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0218] The following is combined with Figure 6 A detailed introduction to each component of a mobile phone:

[0219] The RF circuit 1010 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and processes it with the processor 1080; additionally, it transmits uplink data to the base station. Typically, the RF circuit 1010 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, etc. Furthermore, the RF circuit 1010 can also communicate wirelessly with networks and other devices. The aforementioned wireless communication can use any communication standard or protocol, including but not limited to Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, and Short Messaging Service (SMS).

[0220] The memory 1020 can be used to store software programs and modules. The processor 1080 executes various mobile phone functions and data processing by running the software programs and modules stored in the memory 1020. The memory 1020 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 1020 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0221] The input unit 1030 can be used to receive input numerical or character information, and to generate key signal inputs related to user settings and function control of the mobile phone. Specifically, the input unit 1030 may include a touch panel 1031 and other input devices 1032. The touch panel 1031, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch panel 1031), and drive the corresponding connection devices according to a pre-set program. Optionally, the touch panel 1031 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 1080, and can also receive and execute commands sent by the processor 1080. In addition, the touch panel 1031 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1031, the input unit 1030 may also include other input devices 1032. Specifically, other input devices 1032 may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0222] The display unit 1040 can be used to display information input by the user or information provided to the user, as well as various menus of the mobile phone. The display unit 1040 may include a display panel 1041, which may optionally be configured as a liquid crystal display (LCD), organic light-emitting diode (OLED), or similar display. Further, a touch panel 1031 may cover the display panel 1041. When the touch panel 1031 detects a touch operation on or near it, it transmits the information to the processor 1080 to determine the type of touch event. Subsequently, the processor 1080 provides corresponding visual output on the display panel 1041 based on the type of touch event. Although in Figure 6 In this embodiment, the touch panel 1031 and the display panel 1041 are two separate components to realize the input and output functions of the mobile phone. However, in some embodiments, the touch panel 1031 and the display panel 1041 can be integrated to realize the input and output functions of the mobile phone.

[0223] The mobile phone may also include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 1041 according to the ambient light level, and the proximity sensor can turn off the display panel 1041 and / or the backlight when the phone is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used for applications that recognize the phone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition-related functions (such as pedometer, taps), etc. Other sensors that may be configured in the mobile phone, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, will not be described in detail here.

[0224] The audio circuit 1060, speaker 1061, and microphone 1062 provide an audio interface between the user and the mobile phone. The audio circuit 1060 converts the received audio data into electrical signals and transmits them to the speaker 1061, where the speaker 1061 converts them into sound signals for output. On the other hand, the microphone 1062 converts the collected sound signals into electrical signals, which are then received by the audio circuit 1060, converted into audio data, and then processed by the processor 1080 before being transmitted via the RF circuit 1010 to, for example, another mobile phone, or the audio data can be output to the memory 1020 for further processing.

[0225] Wi-Fi is a short-range wireless transmission technology. Through the Wi-Fi module 1070, mobile phones can help users send and receive emails, browse web pages, and access streaming media, providing users with wireless broadband internet access. Although Figure 6 The Wi-Fi module 1070 is shown, but it is understood that it is not an essential component of a mobile phone and can be omitted as needed without changing the essence of the invention.

[0226] The processor 1080 is the control center of the mobile phone, connecting various parts of the phone through various interfaces and lines. It executes software programs and / or modules stored in the memory 1020 and calls data stored in the memory 1020 to perform various functions and process data, thereby providing overall monitoring of the phone. Optionally, the processor 1080 may include one or more processing units; optionally, the processor 1080 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the aforementioned modem processor may also not be integrated into the processor 1080.

[0227] The mobile phone also includes a power supply 1090 (such as a battery) that supplies power to various components. Optionally, the power supply can be logically connected to the processor 1080 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system.

[0228] Although not shown, mobile phones may also include a camera, Bluetooth module, etc., which will not be described in detail here.

[0229] In this embodiment of the application, the processor 1080 included in the mobile phone also has the function of controlling the execution of the model training method flow executed by the model training device.

[0230] This application also provides a server; please refer to [link / reference]. Figure 7 , Figure 7 This is a schematic diagram of a server structure provided in an embodiment of this application. The server 1100 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 1122 (e.g., one or more processors) and memory 1132, and one or more storage media 1130 (e.g., one or more mass storage devices) for storing application programs 1142 or data 1144. The memory 1132 and storage media 1130 may be temporary or persistent storage. The program stored in the storage media 1130 may include one or more modules (not shown in the figure), each module may include a series of instruction operations on the server. Furthermore, the CPU 1122 may be configured to communicate with the storage media 1130 and execute the series of instruction operations in the storage media 1130 on the server 1100.

[0231] Server 1100 may also include one or more power supplies 1126, one or more wired or wireless network interfaces 1150, one or more input / output interfaces 1158, and / or one or more operating systems 1141, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.

[0232] The steps in the model training method in the above embodiments can be based on this. Figure 7 The structure of server 1100 is shown. For example, the central processing unit 1122 performs the following operations by calling instructions from memory 1132:

[0233] Select an attack category and attack logic; construct a model to be trained based on the attack logic, the attack logic including the attack category; input a preset sample image and the attack category into the model to be trained through input / output interface 1158 to generate candidate adversarial perturbations; obtain adversarial samples based on the sample image and the candidate adversarial perturbations; input at least one alternative model using the adversarial samples to obtain a target loss value; when the target loss value does not meet a preset condition, update the candidate adversarial perturbations, redetermine the target loss value based on the candidate adversarial perturbations, until the target loss value meets the preset condition, and use the model to be trained that currently generates candidate adversarial perturbations as the trained model.

[0234] In one embodiment, the selection of attack category and attack logic can also be achieved by the central processing unit 1122 selecting the attack category; obtaining the initial attack logic for the model to be trained; and solving for the optimal attack logic using a genetic algorithm and the initial attack logic to obtain the attack logic for the model to be trained.

[0235] In one embodiment, the initial attack logic further includes an auxiliary semantic guidance category strongly correlated with the semantic information of the attack category, and a set of category sample constraints belonging to the auxiliary semantic guidance category; the acquisition of the initial attack logic for the model to be trained can also be achieved by the central processing unit 1122 determining the auxiliary semantic guidance category strongly correlated with the semantic information of the attack category through preset semantic prior knowledge; calculating the set of category sample constraints belonging to the auxiliary semantic guidance category through a preset semantic information extraction network; and determining the initial attack logic for the model to be trained based on the attack category, the auxiliary semantic guidance category, and the set of category sample constraints.

[0236] In one implementation, the step of constructing the training model based on the attack logic can also involve embedding the attack category into a category mapping network via a central processing unit 1122 to perform category mapping, thereby embedding the attack category into the training model. The step of determining an auxiliary semantic guidance category strongly correlated with the semantic information of the attack category using preset semantic prior knowledge can also involve inputting the sample image into the category mapping network via an input / output interface 1158 to perform category mapping, outputting an implicit vector of a preset specific target. The sample image is then input into the initial training model to obtain a sample vector. In the category mapping network, the implicit vector and the sample vector are expanded along the height and width directions to concatenate the feature maps of the implicit vector and the sample vector in the channel dimension, thereby obtaining an auxiliary semantic guidance category strongly correlated with the semantic information of the attack category.

[0237] In one implementation, the method of using the adversarial sample to input at least one alternative model to obtain a target loss value can also involve inputting the adversarial sample into at least one alternative model via input / output interface 1158 to obtain the loss of the at least one alternative model; inputting the adversarial sample and the set of category sample constraints into the semantic feature extraction network to output a first semantic feature and a second semantic feature; calculating the distance between the first semantic feature and the second semantic feature and using the distance as the loss between sample constraints; and determining the target loss value based on the loss of the at least one alternative model and the loss between the sample constraints.

[0238] In one implementation, the step of determining the target loss value based on the loss of the at least one alternative model and the loss between the sample constraints can also involve obtaining a first loss parameter preset for each of the at least one alternative model through the input / output interface 1158; obtaining a second loss parameter preset for the semantic feature extraction network; and calculating the target loss value based on the first loss parameter, the second loss parameter, the loss of the at least one alternative model, and the loss between the sample constraints.

[0239] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0240] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0241] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, apparatuses, or modules, and may be electrical, mechanical, or other forms.

[0242] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0243] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0244] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0245] The computer program product includes one or more computer instructions. When the computer program is loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0246] The technical solutions provided in the embodiments of this application have been described in detail above. Specific examples have been used in the embodiments of this application to illustrate the principles and implementation methods of the embodiments of this application. The description of the above embodiments is only for the purpose of helping to understand the methods and core ideas of the embodiments of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the embodiments of this application. Therefore, the content of this specification should not be construed as a limitation on the embodiments of this application.

Claims

1. A model training method, characterized in that, The method includes: Select the attack category and attack logic; A training model is constructed based on the attack logic, wherein the attack logic includes the attack category; Input the preset sample images and the attack categories into the model to be trained to generate candidate adversarial perturbations; Based on the sample images and the candidate adversarial perturbations, adversarial examples are obtained; Using the adversarial example as input to at least one alternative model, the target loss value is obtained; When the target loss value does not meet the preset conditions, the candidate adversarial perturbation is updated, and the target loss value is redetermined based on the candidate adversarial perturbation until the target loss value meets the preset conditions. The training model that currently generates the candidate adversarial perturbation is then used as the trained model. The steps for determining the attack logic include: Obtaining auxiliary semantic guidance categories that are strongly correlated with the semantic information of the attack category, and a set of category sample constraints belonging to the auxiliary semantic guidance categories, specifically includes: determining auxiliary semantic guidance categories that are strongly correlated with the semantic information of the attack category through preset semantic prior knowledge; and calculating a set of category sample constraints belonging to the auxiliary semantic guidance categories through a preset semantic information extraction network. The initial attack logic is determined based on the attack category, the auxiliary semantic guidance category, and the category sample constraint set; The initial attack logic is iteratively optimized using a genetic algorithm to obtain the final attack logic.

2. The model training method according to claim 1, characterized in that, The selected attack category and attack logic include: Select the attack category; Obtain the initial attack logic for the model to be trained; The optimal attack logic is obtained by solving the genetic algorithm and the initial attack logic to obtain the attack logic for the model to be trained.

3. The model training method according to claim 1, characterized in that, The step of constructing the model to be trained based on the attack logic includes: The attack category is embedded into a category mapping network for category mapping, so as to embed the attack category into the model to be trained; The step of determining auxiliary semantic guidance categories that are strongly correlated with the semantic information of the attack category through preset semantic prior knowledge includes: The sample image is input into the category mapping network for category mapping, and an implicit vector of a preset specific target is output. The sample images are input into the initial model to be trained to obtain sample vectors; In the category mapping network, the implicit vector and the sample vector are expanded along the height and width directions to concatenate the feature maps of the implicit vector and the sample vector in the channel dimension, thereby obtaining an auxiliary semantic guidance category that is strongly correlated with the semantic information of the attack category.

4. The model training method according to claim 1, characterized in that, The step of using the adversarial example as input to at least one alternative model to obtain the target loss value includes: The adversarial sample is input into at least one alternative model to obtain the loss of the at least one alternative model; The adversarial sample and the category sample constraint set are input into the semantic feature extraction network, which outputs the first semantic feature and the second semantic feature. Calculate the distance between the first semantic feature and the second semantic feature, and use the distance as the loss between sample constraints; The target loss value is determined based on the loss of the at least one alternative model and the loss between the sample constraints.

5. The model training method according to claim 4, characterized in that, Determining the target loss value based on the loss of the at least one alternative model and the loss between the sample constraints includes: Obtain the first loss parameter preset for each alternative model in the at least one alternative model; Obtain the second loss parameter preset by the semantic feature extraction network; The target loss value is calculated based on the first loss parameter, the second loss parameter, the loss of the at least one alternative model, and the loss between the sample constraints.

6. A method for generating adversarial examples, characterized in that, The method includes: Adversarial examples are generated using a model trained by any one of the model training methods described in claims 1 to 5.

7. A model evaluation method, characterized in that, The method includes: The robustness of the target detection model is evaluated using multiple adversarial samples generated by the adversarial sample generation method as described in claim 6.

8. A model training device, characterized in that, The device includes: Select a module to choose the attack type and attack logic; A construction module is used to construct a model to be trained based on the attack logic, wherein the attack logic includes the attack category; The first generation module is used to input the preset sample images and the attack category into the model to be trained to generate candidate adversarial perturbations; The second generation module is used to generate adversarial samples based on the sample images and the candidate adversarial perturbations; A loss calculation module is used to input at least one alternative model using the adversarial example to obtain a target loss value; The determination module is used to update the candidate adversarial perturbation when the target loss value does not meet the preset conditions, redetermine the target loss value according to the candidate adversarial perturbation, and use the training model that currently generates the candidate adversarial perturbation as the trained model when the target loss value meets the preset conditions. The steps for determining the attack logic include: Obtaining auxiliary semantic guidance categories that are strongly correlated with the semantic information of the attack category, and a set of category sample constraints belonging to the auxiliary semantic guidance categories, specifically includes: determining auxiliary semantic guidance categories that are strongly correlated with the semantic information of the attack category through preset semantic prior knowledge; and calculating a set of category sample constraints belonging to the auxiliary semantic guidance categories through a preset semantic information extraction network. The initial attack logic is determined based on the attack category, the auxiliary semantic guidance category, and the category sample constraint set; The initial attack logic is iteratively optimized using a genetic algorithm to obtain the final attack logic.

9. A computer-readable storage medium, characterized in that, It includes instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1 to 7.

Images