Method, device, equipment and storage medium for generating an anti-attack image

Abstract

The present application discloses a method, apparatus, device and storage medium for generating adversarial attack images. By selecting specific adversarial noise patterns and clean samples as inputs of a generator, based on the similarity contrast loss of contrastive learning, while destroying the low-level features of the clean samples, the adversarial samples output by the trained generator acquire new features that affect the classifier's decision. The low-frequency part of the clean samples and the high-frequency part of the adversarial samples are further extracted using a Gaussian low-pass filter and fused to generate new adversarial attack samples, which further strengthens the loss of original features and the fusion of new features, thereby improving the generalization ability of the adversarial attack samples and the attack success rate.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for generating an anti-attack image. Background Art

[0002] Image adversarial attack algorithms are a technique used to attack deep learning models. They create adversarial examples by adding slight perturbations to the original image, thereby fooling deep neural network models into producing absurd predictions. Due to the transferability of adversarial examples, the vulnerability of deep neural networks has attracted widespread attention, and highly transferable adversarial attack algorithms have become a hot research area.

[0003] In recent years, deep neural network models, represented by convolutional neural networks, have been widely used, particularly in image classification tasks. With the increase in image data and computing power, deep neural networks have demonstrated significant advantages. However, research by Szegedy et al. has shown that deep neural networks are not reliable and are vulnerable to adversarial examples, which are attacks generated by slightly modifying the original images. These carefully crafted adversarial examples can easily fool state-of-the-art deep neural networks, causing them to produce almost absurd predictions. Furthermore, adversarial example attacks have evolved from theoretical research to the real world, introducing significant uncertainty into the practical application of deep models. Therefore, studying adversarial examples, and ultimately understanding the inherent flaws of deep neural networks, improving model robustness, and addressing security issues in practical applications, is a top priority in the current computer vision field.

[0004] The effectiveness of adversarial perturbations stems from the irrelevant features they contain. These irrelevant features have a more significant impact on the classifier than the features of the clean samples themselves. Ensuring that adversarial attack images have highly repetitive features that are easier for classifiers to extract and recognize is an urgent technical problem that needs to be solved. Summary of the Invention

[0005] The present application provides a method, apparatus, device and storage medium for generating an adversarial attack image, so that the adversarial attack image can have high-density repetitive features that are easier to be extracted and recognized by a classifier.

[0006] In view of this, the first aspect of the present application provides a method for generating an attack-resistant image, the method comprising:

[0007] S1. Build a generator G in the target data domain θ ;

[0008] S2, obtain clean samples and adversarial noise patterns;

[0009] S3, take the adversarial noise pattern as the positive sample and the clean sample as the negative sample, and take the similarity contrast loss value as the minimum as the goal, and perform the generator G θ Conduct training;

[0010] S4. Get the trained generator G θ A first adversarial attack image generated according to the input image;

[0011] S5. Extract low-frequency features of the clean sample and high-frequency features of the first adversarial attack image through a Gaussian low-pass filter;

[0012] S6. Fusing the low-frequency features of the clean sample and the high-frequency features of the first adversarial attack image to obtain a second adversarial attack image.

[0013] Optionally, step S3 specifically includes:

[0014] The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the similarity contrast loss value of the specific layer L of the classifier. The first calculation formula of the similarity contrast loss value is:

[0015]

[0016] Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of a specific layer, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in a specific layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern p in a specific layer L.

[0017] Optionally, step S3 specifically includes:

[0018] The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the weighted similarity contrast loss value of each feature layer L of the classifier. The second calculation formula of the weighted similarity contrast loss value is:

[0019]

[0020] Among them, α∈R+ , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of each feature layer of the classifier, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in the classifier feature layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern in the classifier feature layer L, ω L is the weight of the information in the classifier feature layer L.

[0021] Optionally, the first adversarial attack image is specifically:

[0022]

[0023] Among them, the clean sample x τ ∈X τ , ε is the preset value.

[0024] Optionally, the Gaussian low-pass filter is specifically:

[0025]

[0026] Where σ is the standard deviation of the Gaussian function, μ and v are the means of the Gaussian function in the x-axis and y-axis directions, respectively, and the size of the Gaussian low-pass filter kernel is (4σ+1)*(4σ+1).

[0027] Optionally, the second adversarial attack image is specifically:

[0028]

[0029] Among them, * represents the convolution operation in Gaussian filtering, δ is used to balance the high-frequency and low-frequency information from different parts, and ε makes the adversarial perturbation receive l ∞ Norm constraints.

[0030] A second aspect of the present application provides a device for generating an anti-attack image, the device comprising:

[0031] Construction unit, used to build a generator G in the target data domain θ ;

[0032] A first acquisition unit, configured to acquire clean samples and adversarial noise patterns;

[0033] The training unit is used to take the adversarial noise pattern as the positive sample and the clean sample as the negative sample, with the goal of minimizing the similarity contrast loss value, to train the generator G θ Conduct training;

[0034] The second acquisition unit is used to obtain the trained generator G θ A first adversarial attack image generated according to the input image;

[0035] A filtering unit, configured to extract low-frequency features of the clean sample and high-frequency features of the first adversarial attack image through a Gaussian low-pass filter;

[0036] The fusion unit is used to fuse the low-frequency features of the clean sample and the high-frequency features of the first adversarial attack image to obtain a second adversarial attack image.

[0037] Optionally, the training unit is specifically configured to:

[0038] The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the similarity contrast loss value of the specific layer L of the classifier. The first calculation formula of the similarity contrast loss value is:

[0039]

[0040] Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of a specific layer, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in a specific layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern p in a specific layer L.

[0041] A third aspect of the present application provides a device for generating an anti-attack image, the device comprising a processor and a memory:

[0042] The memory is used to store program code and transmit the program code to the processor;

[0043] The processor is configured to execute the steps of the method for generating an anti-attack image as described in the first aspect according to the instructions in the program code.

[0044] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to execute the method described in the first aspect.

[0045] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0046] In this application, a method, apparatus, device and storage medium for generating an adversarial attack image are provided. By selecting specific adversarial noise patterns and clean samples as inputs of a generator, based on the similarity contrast loss of contrastive learning, while destroying the low-level features of the clean samples, the high-density repetitive features of the adaptive samples are learned, so that the adversarial samples output by the trained generator obtain new features that affect the classifier decision. Further, a Gaussian low-pass filter is used to extract the low-frequency part of the clean sample and the high-frequency part of the adversarial sample for fusion to generate new adversarial attack samples, which further strengthens the loss of the original features and the fusion of the new features, thereby improving the generalization ability of the adversarial attack samples and the attack success rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a flowchart of a method for generating an anti-attack image in an embodiment of the present application;

[0048] Figure 2 This is a schematic diagram of the structure of the anti-attack image generation device in an embodiment of the present application;

[0049] Figure 3 This is a schematic diagram of the structure of the anti-attack image generation device in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to help those skilled in the art better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0051] This application designs a method, device, equipment and storage medium for generating an adversarial attack image, so that the adversarial attack image can have high-density repetitive features that are easier to be extracted and recognized by a classifier.

[0052] For easier understanding, see Figure 1 , Figure 1 This is a flow chart of the method for generating an anti-attack image in an embodiment of the present application. Figure 1 As shown, specifically:

[0053] S1. Build a generator G in the target data domain θ ;

[0054] It should be noted that ImageNet has a rich variety of categories and a huge amount of data, and also has a lot of prior knowledge. Using readily available pre-trained models to attack can achieve twice the result with half the effort. We use ImageNet as the target data domain and train a generator model G on the ImageNet data domain. θ To build a cross-domain full black box threat model.

[0055] We trained a generator on ImageNet to perturb images. Compared to iterative attack methods, this generator can more fully leverage prior information from the source domain, enabling cross-domain threats. Unlike gradient iteration methods, which require multiple backpropagation steps for each attack, during inference, the generator can accept images from any domain as input and generate adversarial examples with only a single forward pass. We used a simple ResNet architecture as the generator.

[0056] S2, obtain clean samples and adversarial noise patterns;

[0057] S3, take the adversarial noise pattern as the positive sample and the clean sample as the negative sample, and take the similarity contrast loss value as the minimum as the goal, and perform the generator G θ Conduct training;

[0058] Specifically:

[0059] The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the similarity contrast loss value of the specific layer L of the classifier. The first calculation formula of the similarity contrast loss value is:

[0060]

[0061] Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of a specific layer, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in a specific layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern p in a specific layer L.

[0062] or

[0063] The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the weighted similarity contrast loss value of each feature layer L of the classifier. The second calculation formula of the weighted similarity contrast loss value is:

[0064]

[0065] Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of each feature layer of the classifier, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in the classifier feature layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern in the classifier feature layer L, ω L is the weight of the information in the classifier feature layer L.

[0066] It should be noted that in order to improve the transferability of the perturbation, we inactivate the inherent features of the image and make the generator G θ Learn highly repetitive features. These features are strongly unrelated to the sample's semantics and can easily be noticed by different classifiers, thereby manipulating the deep learning model's classifier decisions. In other words, we replace the inherent features of the image with highly repetitive features to influence the classifier's judgment. In this case, the deep learning model can only extract these repetitive features that are unrelated to the sample.

[0067] To achieve the above requirements, we advocate the use of contrastive learning to meet our needs, given that it can do two tasks at the same time, namely, minimize the distance from the anchor (adversarial sample) to the positive sample, and maximize the distance between the anchor and the negative sample.

[0068] The original adversarial noise pattern is used as the positive sample, and the added perturbation has highly repetitive features that are independent of the image. To destroy the original features of the sample, we choose clean samples as negative samples. Because the purpose of the loss is to operate on the features of the image, the loss operates in the feature space, resulting in the basic structure of the loss:

[0069]

[0070] Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of a specific layer, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in a specific layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern p in a specific layer L.

[0071] The above loss can only interfere with the features of a specific layer. The complete SC loss divides the classifier feature layer into layers based on this, fully considering the information of each level of the classifier, and further determines the loss structure as follows:

[0072]

[0073] Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of each feature layer of the classifier, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in the classifier feature layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern in the classifier feature layer L, ω L is the weight of the information in the classifier feature layer L.

[0074] S4. Get the trained generator G θ A first adversarial attack image generated according to the input image;

[0075] The first adversarial attack image is:

[0076]

[0077] Among them, the clean sample x τ ∈X τ , ε is a preset value, which can be equal to 10 or limited by l∞.

[0078] It should be noted that the optimization process of the generator can be summarized as follows:

[0079]

[0080] In the forward reasoning phase, the trained generator can directly generate adversarial samples corresponding to the input image:

[0081]

[0082] Among them, the clean sample x τ ∈X τ , ε is a preset value, which can be equal to 10 or limited by l∞.

[0083] S5. Extract low-frequency features of the clean sample and high-frequency features of the first adversarial attack image through a Gaussian low-pass filter;

[0084] The Gaussian low-pass filter is specifically:

[0085]

[0086] Where σ is the standard deviation of the Gaussian function, μ and v are the means of the Gaussian function in the x-axis and y-axis directions, respectively, and the size of the Gaussian low-pass filter kernel is (4σ+1)*(4σ+1).

[0087] S6. Fusing the low-frequency features of the clean sample and the high-frequency features of the first adversarial attack image to obtain a second adversarial attack image.

[0088] See also Figure 2 , Figure 2 This is a schematic diagram of the structure of the anti-attack image generation device in the embodiment of the present application. Figure 2 As shown, specifically:

[0089] Construction unit 201, used to construct a generator G in the target data domain θ ;

[0090] A first acquisition unit 202 is configured to acquire clean samples and adversarial noise patterns;

[0091] The training unit 203 is used to use the adversarial noise pattern as a positive sample and the clean sample as a negative sample, and to train the generator G with the goal of minimizing the similarity comparison loss value. θ Conduct training;

[0092] The second acquisition unit 204 is used to obtain the trained generator G θ A first adversarial attack image generated according to the input image;

[0093] A filtering unit 205 is configured to extract low-frequency features of the clean sample and high-frequency features of the first adversarial attack image using a Gaussian low-pass filter;

[0094] The fusion unit 206 is configured to fuse the low-frequency features of the clean sample and the high-frequency features of the first adversarial attack image to obtain a second adversarial attack image.

[0095] Furthermore, the training unit 203 is specifically configured to:

[0096] The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the similarity contrast loss value of the specific layer L of the classifier. The first calculation formula of the similarity contrast loss value is:

[0097]

[0098] Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of a specific layer, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in a specific layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern p in a specific layer L.

[0099] Furthermore, the training unit 203 is specifically configured to:

[0100] The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the weighted similarity contrast loss value of each feature layer L of the classifier. The second calculation formula of the weighted similarity contrast loss value is:

[0101]

[0102] Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f iL is a classifier trained in the target data domain, L represents the feature map of each feature layer of the classifier, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in the classifier feature layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern in the classifier feature layer L, ω L is the weight of the information in the classifier feature layer L.

[0103] Optionally, the generator after training generates the adversarial attack image corresponding to the input image as follows:

[0104]

[0105] Among them, the clean sample x τ ∈X τ , ε is a preset value, which can be equal to 10 or limited by l∞.

[0106] The present application also provides another anti-attack image generation device, such as Figure 3 For ease of explanation, only the parts related to the embodiments of the present application are shown. For specific technical details not disclosed, please refer to the method part of the embodiments of the present application. The terminal can be any terminal device including a mobile phone, a tablet computer, a personal digital assistant (English full name: Personal Digital Assistant, English abbreviation: PDA), a sales terminal (English full name: Point of Sales, English abbreviation: POS), a car computer, etc., taking the mobile phone as an example:

[0107] Figure 3 The block diagram shows a partial structure of a mobile phone related to the terminal provided in the embodiment of the present application. Figure 3 The mobile phone includes components such as a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a processor 1080, and a power supply 1090. Those skilled in the art will appreciate that Figure 3 The mobile phone structure shown in the figure does not constitute a limitation to the mobile phone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0108] The following combination Figure 3 A detailed introduction to the various components of a mobile phone:

[0109] RF circuitry 1010 can be used to receive and transmit signals during information transmission or calls. Specifically, it receives downlink information from the base station and transmits it to processor 1080 for processing. It also transmits uplink data to the base station. Typically, RF circuitry 1010 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, and more. RF circuitry 1010 can also communicate with the network and other devices via wireless communications. The above-mentioned wireless communications may use any communication standard or protocol, including but not limited to Global System of Mobile Communications (Global System of Mobile communication, English abbreviation: GSM), General Packet Radio Service (English full name: General Packet Radio Service, GPRS), Code Division Multiple Access (English full name: Code Division Multiple Access, English abbreviation: CDMA), Wideband Code Division Multiple Access (English full name: Wideband Code Division Multiple Access, English abbreviation: WCDMA), Long Term Evolution (English full name: Long Term Evolution, English abbreviation: LTE), email, Short Messaging Service (English full name: Short Messaging Service, SMS), etc.

[0110] The memory 1020 can be used to store software programs and modules. The processor 1080 executes the various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 1020. The memory 1020 may mainly include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.); the data storage area may store data created based on the use of the mobile phone (such as audio data, a phone book, etc.). In addition, the memory 1020 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state memory device.

[0111] The input unit 1030 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the mobile phone. Specifically, the input unit 1030 may include a touch panel 1031 and other input devices 1032. The touch panel 1031, also known as a touch screen, can collect user touch operations on or near it (such as operations performed by the user using any suitable object or accessory such as a finger, stylus, etc. on or near the touch panel 1031) and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 1031 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch direction and detects the signal caused by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device and converts it into touch point coordinates, which are then sent to the processor 1080. It can also receive commands sent by the processor 1080 and execute them. In addition, the touch panel 1031 can be implemented using various types such as resistive, capacitive, infrared and surface acoustic wave. In addition to the touch panel 1031, the input unit 1030 may further include other input devices 1032. Specifically, the other input devices 1032 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick.

[0112] The display unit 1040 can be used to display information input by the user or information provided to the user and various menus of the mobile phone. The display unit 1040 may include a display panel 1041. Optionally, the display panel 1041 may be configured in the form of a liquid crystal display (English full name: Liquid Crystal Display, English abbreviation: LCD), an organic light-emitting diode (English full name: Organic Light-Emitting Diode, English abbreviation: OLED), etc. Further, the touch panel 1031 may cover the display panel 1041. When the touch panel 1031 detects a touch operation on or near it, it is transmitted to the processor 1080 to determine the type of touch event. Subsequently, the processor 1080 provides corresponding visual output on the display panel 1041 according to the type of touch event. Although in Figure 3 In the embodiment, the touch panel 1031 and the display panel 1041 are used as two independent components to realize the input and output functions of the mobile phone, but in some embodiments, the touch panel 1031 and the display panel 1041 can be integrated to realize the input and output functions of the mobile phone.

[0113] The mobile phone may also include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1041 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 1041 and / or the backlight when the mobile phone is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that the mobile phone can also be configured with, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be described here.

[0114] Audio circuit 1060, speaker 1061, and microphone 1062 provide an audio interface between the user and the phone. Audio circuit 1060 converts received audio data into electrical signals and transmits them to speaker 1061, which then converts them into sound signals for output. Microphone 1062, on the other hand, converts collected sound signals into electrical signals, which are then received by audio circuit 1060 and converted into audio data. The audio data is then processed by processor 1080 and transmitted to, for example, another phone via RF circuit 1010, or stored in memory 1020 for further processing.

[0115] WiFi is a short-range wireless transmission technology. The mobile phone can help users send and receive emails, browse the web and access streaming media through the WiFi module 1070. It provides users with wireless broadband Internet access. Figure 3 A WiFi module 1070 is shown, but it is understandable that it is not an essential component of the mobile phone and can be omitted as needed without changing the essence of the invention.

[0116] Processor 1080 is the control center of the mobile phone, connecting all parts of the mobile phone using various interfaces and circuits. By running or executing software programs and / or modules stored in memory 1020 and accessing data stored in memory 1020, it performs various functions of the mobile phone and processes data, thereby providing overall monitoring of the mobile phone. Optionally, processor 1080 may include one or more processing units; preferably, processor 1080 may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 1080.

[0117] The mobile phone also includes a power supply 1090 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 1080 through a power management system, thereby managing charging, discharging, and power consumption through the power management system.

[0118] Although not shown, the mobile phone may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0119] In the embodiment of the present application, the processor 1080 included in the terminal further has the following functions:

[0120] S1. Build a generator G in the target data domain θ ;

[0121] S2, obtain clean samples and adversarial noise patterns;

[0122] S3, take the adversarial noise pattern as the positive sample and the clean sample as the negative sample, and take the similarity contrast loss value as the minimum as the goal, and perform the generator G θ Conduct training;

[0123] S4. Get the trained generator G θ A first adversarial attack image generated according to the input image;

[0124] S5. Extract low-frequency features of the clean sample and high-frequency features of the first adversarial attack image through a Gaussian low-pass filter;

[0125] S6. Fusing the low-frequency features of the clean sample and the high-frequency features of the first adversarial attack image to obtain a second adversarial attack image.

[0126] An embodiment of the present application also provides a computer-readable storage medium for storing program code, which is used to execute any implementation of the anti-attack image generation method described in the aforementioned embodiments.

[0127] In an embodiment of the present application, a method, apparatus, device and storage medium for generating an adversarial attack image are provided. By selecting a specific adversarial noise pattern and a clean sample as the input of a generator, based on the similarity contrast loss of contrastive learning, the high-density repetitive features of the sample are learned while destroying the low-level features of the clean sample, so that the adversarial sample output by the trained generator obtains new features that affect the classifier decision. Further, a Gaussian low-pass filter is used to extract the low-frequency part of the clean sample and the high-frequency part of the adversarial sample for fusion to generate a new adversarial attack sample, which further strengthens the loss of the original features and the fusion of the new features, thereby improving the generalization ability of the adversarial attack sample and the attack success rate.

[0128] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0129] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0130] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0131] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0132] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0133] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0134] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English full name: Read-Only Memory, English abbreviation: ROM), random access memory (English full name: Random Access Memory, English abbreviation: RAM), disk or optical disk and other media that can store program code.

[0135] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for generating an anti-attack image, characterized in that: include: S1. Build a generator G in the target data domain θ ; S2, obtain clean samples and adversarial noise patterns; S3, take the adversarial noise pattern as the positive sample and the clean sample as the negative sample, and take the similarity contrast loss value as the minimum as the goal, and perform the generator G θ Conduct training; S4. Get the trained generator G θ A first adversarial attack image generated according to the input image; S5. Extract low-frequency features of the clean sample and high-frequency features of the first adversarial attack image through a Gaussian low-pass filter; S6. Fusing the low-frequency features of the clean sample and the high-frequency features of the first adversarial attack image to obtain a second adversarial attack image; The step S3 specifically includes: The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the similarity contrast loss value of the specific layer L of the classifier. The first calculation formula of the similarity contrast loss value is: Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of a specific layer, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in a specific layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern p in a specific layer L; or The step S3 specifically includes: The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the weighted similarity contrast loss value of each feature layer L of the classifier. The second calculation formula of the weighted similarity contrast loss value is: Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of each feature layer of the classifier, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in the classifier feature layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern in the classifier feature layer L, ω L is the weight of the information in the classifier feature layer L.

2. The method for generating an anti-attack image according to claim 1, wherein: The first adversarial attack image is specifically: Among them, the clean sample x τ ∈X τ , X τ is the clean sample set of the target data domain, and ε is the preset value.

3. The method for generating an anti-attack image according to claim 2, wherein: The Gaussian low-pass filter is specifically: Where σ is the standard deviation of the Gaussian function, μ and v are the means of the Gaussian function in the x-axis and y-axis directions, respectively, and the size of the Gaussian low-pass filter kernel is (4σ+1)*(4σ+1).

4. The method for generating an anti-attack image according to claim 3, wherein: The second adversarial attack image is specifically: Among them, * represents the convolution operation in Gaussian filtering, δ is used to balance the high-frequency and low-frequency information from different parts, and ε makes the adversarial perturbation receive l ∞ Norm constraints.

5. A device for generating an anti-attack image, characterized in that: include: Construction unit, used to build a generator G in the target data domain θ ; A first acquisition unit, configured to acquire clean samples and adversarial noise patterns; The training unit is used to take the adversarial noise pattern as the positive sample and the clean sample as the negative sample, with the goal of minimizing the similarity contrast loss value, to train the generator G θ Conduct training; The second acquisition unit is used to obtain the trained generator G θ A first adversarial attack image generated according to the input image; A filtering unit, configured to extract low-frequency features of the clean sample and high-frequency features of the first adversarial attack image through a Gaussian low-pass filter; A fusion unit, configured to fuse the low-frequency features of the clean sample with the high-frequency features of the first adversarial attack image to obtain a second adversarial attack image; The training unit is specifically used for: The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the similarity contrast loss value of the specific layer L of the classifier. The first calculation formula of the similarity contrast loss value is: Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of a specific layer, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in a specific layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern p in a specific layer L; or The training unit is specifically used for: The adversarial noise pattern is used as a positive sample and the clean sample is used as a negative sample. The generator is trained with the goal of minimizing the weighted similarity contrast loss value of each feature layer L of the classifier. The second calculation formula of the weighted similarity contrast loss value is: Among them, α∈R + , x i is a clean sample, the superscript i indicates that the clean sample comes from the target data domain, f i L is a classifier trained in the target data domain, L represents the feature map of each feature layer of the classifier, p represents the adversarial noise pattern, For the generator G θ Generated adversarial examples With clean sample x i Cosine similarity in the classifier feature layer L, For the generator G θ Generated adversarial examples Cosine similarity with the adversarial noise pattern in the classifier feature layer L, ω L is the weight of the information in the classifier feature layer L.

6. A device for generating an image capable of resisting an attack, characterized in that: The device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the anti-attack image generation method according to any one of claims 1 to 4 according to the instructions in the program code.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store program code, and the program code is used to execute the anti-attack image generation method according to any one of claims 1 to 4.

Images