A method and device for generating adversarial samples

Abstract

The present application discloses a method and device for generating adversarial samples, which are applied to the field of adversarial attack technology. The method includes: acquiring and processing user images to obtain a first image set and an adversarial sample set; determining frequency domain perturbations and fine-tuning a diffusion model according to the first image set to obtain a first diffusion model and a heat map set; updating the adversarial sample set N times in the frequency domain to obtain a first sample set, updating the first sample set M times in the spatial domain to obtain a second sample set; updating the first diffusion model, updating the second sample set M times in the spatial domain to obtain a third sample set, updating the third sample set N times in the frequency domain to obtain a fourth sample set as an adversarial sample set, iterating the above steps multiple times, thereby obtaining an adversarial sample set, wherein the frequency domain update is realized by the first diffusion model, the frequency domain perturbations and the heat map set, and the spatial domain update is realized by the first diffusion model and the heat map set. The present invention improves the effect and efficiency of adversarial attacks and ensures the image quality of adversarial samples.

Description

Technical Field

[0001] The present invention relates to the field of anti-attack technology, and in particular to an anti-attack sample generation method and device. Background Art

[0002] The text-to-image generation model is a type of diffusion model that can generate realistic images based on a given text description. Although such models have shown great potential in personalized applications, the development of such models has also raised concerns about privacy protection and information authenticity. For example, DreamBooth produces more realistic images by fine-tuning a specific facial dataset, and this capability may be used to violate user privacy or spread false information.

[0003] In this regard, related technologies add small and continuous perturbations to the image, making the model produce irrelevant outputs that are not recognizable to the human eye, in order to alleviate the privacy issues caused by the text-to-image generation model. This method is called adversarial attack. For adversarial attack methods, the quality of adversarial samples is crucial. However, related technologies have the following problems:

[0004] On the one hand, the related technologies mainly rely on reconstruction loss to generate adversarial samples, but ignore the unique properties of the text-to-image generation model. For example, the Anti-DB algorithm in the related technology is a personalized generation algorithm that uses an adversarial strategy to counter Dreambooth. It enhances the protection effect through alternating training. Although it destroys the overall texture of the input data through a two-layer optimization technique, it does not effectively clear the identity and structural details provided by the user, so it cannot fully protect user privacy.

[0005] On the other hand, for adaptive diffusion models such as DreamBooth, it is usually necessary to implement specific adversarial attack methods, the purpose of which is to mislead the adaptive diffusion model to form incorrect associations or induce overfitting. Compared with adversarial attacks on static models, this adversarial attack method is more complex and challenging, so there are few adversarial attack methods for adaptive diffusion models in related technologies. Summary of the invention

[0006] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0007] To this end, an object of the present invention is to provide a method and device for generating adversarial samples.

[0008] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0009] On the one hand, an embodiment of the present invention provides a method for generating an adversarial sample, comprising the following steps:

[0010] Acquire and process a number of user images to obtain a first image set and an adversarial sample set; wherein the first image set includes a number of clean images, and the adversarial sample set includes a number of copies of clean images;

[0011] Determine frequency domain disturbance according to the first image set, and use the first image set to fine-tune the Stable Diffusion model to obtain a first diffusion model and a thermal map set;

[0012] Using the first diffusion model, the frequency domain perturbation, and the heat map set to update the adversarial sample set N times in the frequency domain to obtain a first sample set, and using the first diffusion model and the heat map set to update the first sample set M times in the spatial domain to obtain a second sample set;

[0013] updating the first diffusion model by using the second sample set, updating the second sample set M times in the spatial domain by using the first diffusion model and the thermal map set to obtain a third sample set, and updating the third sample set N times in the frequency domain by using the first diffusion model, the frequency domain perturbation and the thermal map set to obtain a fourth sample set;

[0014] The fourth sample set is used as the adversarial sample set. When the number of iterations is not greater than the iteration threshold, the process returns to the step of updating the adversarial sample set N times in the frequency domain using the first diffusion model, the frequency domain perturbation and the heat map set until the number of iterations is greater than the iteration threshold, and the adversarial sample set is output.

[0015] On the other hand, an embodiment of the present invention provides an adversarial sample generation device, including:

[0016] An acquisition module, used to acquire a number of user images;

[0017] A processing module, configured to process a plurality of user images to obtain a first image set and an adversarial sample set; and, determine a frequency domain perturbation according to the first image set, and fine-tune a Stable Diffusion model using the first image set to obtain a first diffusion model and a thermal map set; wherein the first image set includes a plurality of clean images, and the adversarial sample set includes a plurality of copies of clean images;

[0018] A frequency domain updating module, configured to update the adversarial sample set N times in the frequency domain using the first diffusion model, the frequency domain perturbation, and the heat map set to obtain a first sample set, and to update the first sample set M times in the spatial domain using the first diffusion model and the heat map set to obtain a second sample set;

[0019] A model updating module, configured to update the first diffusion model using the second sample set;

[0020] a spatial domain updating module, configured to update the second sample set M times in the spatial domain using the first diffusion model and the thermal map set to obtain a third sample set, and to update the third sample set N times in the frequency domain using the first diffusion model, the frequency domain perturbation and the thermal map set to obtain a fourth sample set;

[0021] An iteration control module is used to use the fourth sample set as the adversarial sample set, and when the number of iterations is not greater than the iteration threshold, trigger the frequency domain update module, so that the frequency domain update module updates the adversarial sample set N times in the frequency domain using the first diffusion model, the frequency domain perturbation and the thermal map set, until the number of iterations is greater than the iteration threshold, and outputs the adversarial sample set.

[0022] The beneficial effects of the present invention are as follows: a method and device for generating an adversarial sample are provided, which updates the adversarial sample in the frequency domain and the spatial domain so that the adversarial sample is superimposed with disturbances in two dimensions, namely, the frequency domain and the spatial domain. This method can not only effectively destroy the overall texture and details of the image generated by the diffusion model, but also enhance the defense effect of the adversarial sample, improve the concealment of the disturbance noise and the attack efficiency of the adversarial attack, ensure the effectiveness of the adversarial attack, and improve the image quality of the adversarial sample, so as to better balance the relationship between the protection effect and the image quality of the adversarial sample.

[0023] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is a flow chart of a method for generating adversarial samples provided by the present invention;

[0025] Figure 2 is a flow chart of processing user images provided by the present invention;

[0026] Figure 3 is a flow chart of determining frequency domain disturbance provided by the present invention;

[0027] Figure 4 is a flow chart for determining a first diffusion model and a set of thermal maps provided by the present invention;

[0028] Figure 5 It is a schematic diagram of a method for generating adversarial samples provided by the present invention;

[0029] Figure 6 It is a principle diagram of frequency domain updating provided by the present invention;

[0030] Figure 7 is a flow chart of frequency domain updating provided by the present invention;

[0031] Figure 8 It is a schematic diagram of the spatial domain update provided by the present invention;

[0032] Fig. 9 is a flow chart of spatial domain updating provided by the present invention;

[0033] Fig.10 It is a structural diagram of an adversarial sample generating device provided by the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0035] The present application is further described below in conjunction with the accompanying drawings and specific embodiments. The described embodiments should not be regarded as limiting the present application, and all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0036] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0037] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0038] The text-to-image generation model is a type of diffusion model that can generate realistic images based on a given text description. This type of model shows great potential in personalized applications. Users only need to provide a few subject images to customize and generate countless high-quality images with specified themes. Although this type of model has improved the ability to create visual content, its development has raised concerns about privacy protection and information authenticity. For example, DreamBooth and TextualInversion produce more realistic images by fine-tuning specific facial datasets. This ability may be used to violate user privacy or spread false information. In addition, this type of model may also be used to imitate the artistic style of others and create unauthorized works of art, thereby infringing on the rights of others. It can be seen that there is an urgent need to formulate effective measures to prevent the malicious application of such models.

[0039] In this regard, related technologies add small and continuous perturbations to the image, making the model produce irrelevant outputs when it is not recognizable to the human eye, in order to alleviate the privacy issues caused by the text-to-image generation model (i.e., the diffusion model). This method is called an adversarial attack method. For example, Photoguard prevents the diffusion model from simulating user-provided images by attacking the encoder of the potential diffusion model; based on Photoguard, AdvDM prevents user images from being absorbed by the diffusion model by generating adversarial samples. For another example, Anti-DB is a personalized generation algorithm that uses an adversarial strategy to counter Dreambooth, which enhances the protection effect through alternating training; based on Anti-DB, SimAC uses an adaptive greedy search method to search for the best time step, thereby improving the effect of adversarial training and the protection effect, while MetaCloak uses a meta-learning framework to deal with the double-layer poisoning problem in Anti-DB and creates perturbations that are both transferable and robust.

[0040] For adversarial attack methods, the quality of adversarial samples is crucial. However, related technologies have the following problems:

[0041] On the one hand, related technologies mainly rely on reconstruction loss to generate adversarial samples, but ignore the unique properties of text-to-image generation models. For example, Anti-DB destroys the overall texture of the input data through a two-layer optimization technique, but it does not effectively clear the identity and structural details provided by the user, so it cannot fully protect user privacy.

[0042] On the other hand, adaptive diffusion models such as DreamBooth can actively adapt to and learn concepts of specific topics by fine-tuning the parameters of the background diffusion model or adjusting the embeddings related to the concepts, thereby ensuring the synthesis of high-quality images. Attacking such adaptive diffusion models often requires the implementation of specific adversarial attack methods, the purpose of which is to mislead the adaptive diffusion model to form incorrect associations or induce overfitting. However, compared with adversarial attacks on static models, this adversarial attack method is more complex and challenging, so there are few adversarial attack methods for adaptive diffusion models in related technologies.

[0043] On the other hand, more significant perturbations can provide better protection for adversarial samples, but this also means that they are easily detected by the human eye, and related technologies find it difficult to balance the relationship between protection effect and image quality of adversarial samples.

[0044] In view of this, the present invention provides an adversarial sample generation method and device, designs a frequency domain perturbation method (Frequency Perturbation Learning, FPL) for the characteristics of the diffusion model in the frequency domain, designs a spatial domain perturbation method (Spatial Perturbation Learning, SPL) for the fixedness and sensitivity to perturbation of the image encoder of the diffusion model in personalized generation, and iteratively adds frequency domain perturbation and spatial domain perturbation to the adversarial sample by alternating between the frequency domain perturbation method and the spatial domain perturbation method to update the adversarial sample, effectively destroying the overall and detailed information of the image generated by the diffusion model, and improving the defense effect of the adversarial sample. In addition, the present invention avoids unnecessary interference in the background by filtering out the redundant background perturbations of the updated adversarial sample, thereby ensuring the effectiveness of the adversarial attack.

[0045] It should be noted that the diffusion models in the present invention are all personalized generated diffusion models.

[0046] The embodiments of the present application will be further described below with reference to the accompanying drawings.

[0047] First, the implementation steps of an adversarial sample generation method provided by an embodiment of the present invention will be described in detail below with reference to the accompanying drawings.

[0048] The adversarial sample generation method provided by the present invention can be applied to a terminal, a server, or software running in a terminal or a server. The terminal can be a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms.

[0049] Reference Figure 1 , Figure 1 It is a flowchart of an adversarial sample generation method provided by the present invention, and the method mainly includes the following steps S101-S105.

[0050] S101, acquiring and processing a number of user images to obtain a first image set and an adversarial sample set.

[0051] It should be noted that the first image set may include but is not limited to several clean images, and the adversarial sample set may include but is not limited to several copied images of clean images, where the copied images refer to images obtained by copying the clean images.

[0052] In this step, first, a number of user images that need to be protected are obtained; then, image processing is performed on these user images that need to be protected to obtain a first image set; then, each image in the first image set is copied to obtain an adversarial sample set.

[0053] S102, determining frequency domain disturbance according to the first image set, and fine-tuning the Stable Diffusion model using the first image set to obtain a first diffusion model and a thermal map set.

[0054] It should be noted that the Stable Diffusion model is a potential diffusion model, which is mainly used to generate detailed images according to the description of the text. Optionally, the version number of the Stable Diffusion model used in this application is 2.1.

[0055] In this step, after obtaining the first image set, the first image set is processed by discrete cosine transform (DCT) and tensor operations to obtain frequency domain perturbations. At the same time, a specific text instruction is used to guide the Stable Diffusion model to generate a number of images to form a second image set. The first image set and the second image set are fine-tuned for multiple steps on the pre-trained Stable Diffusion model and the inversion process of the Denoising Diffusion Implicit Models (DDIM) is performed to obtain a heat map set of the attack area mask for adding perturbations, and the first diffusion model is obtained by fine-tuning the first image set and the second image set for a few steps on the pre-trained Stable Diffusion model.

[0056] S103, using the first diffusion model, frequency domain perturbation and heat map set to update the adversarial sample set N times in the frequency domain to obtain a first sample set, and using the first diffusion model and heat map set to update the first sample set M times in the spatial domain to obtain a second sample set.

[0057] Optionally, N and M can be set according to actual conditions, and the present invention does not specifically limit this. Exemplarily, N and M are both 9.

[0058] In this step, first, the adversarial sample set is updated in the frequency domain through the first diffusion model and frequency domain perturbation, and the background perturbation of the updated adversarial sample set is filtered out using the heat map set to obtain the first sample set; then, it is determined whether the number of frequency domain updates is greater than N. If so, the first sample set is output, otherwise the first sample set is used as the adversarial sample set, and the step of updating the adversarial sample set in the frequency domain is returned to for iterative updating.

[0059] After obtaining the first sample set, the first sample set is updated in the spatial domain through the first diffusion model, and the background disturbance of the updated first sample set is filtered out using the heat map set to obtain the second sample set, and then it is determined whether the number of spatial domain updates is greater than M. If so, the second sample set is output, otherwise the second sample set is used as the first sample set, and the process returns to the step of updating the first sample set in the spatial domain for iterative updating.

[0060] S104, updating the first diffusion model through the second sample set, updating the second sample set M times in the spatial domain using the first diffusion model and the thermal map set to obtain a third sample set, and updating the third sample set N times in the frequency domain using the first diffusion model, frequency domain perturbation and the thermal map set to obtain a fourth sample set.

[0061] In this step, before updating the second sample set, the first diffusion model is fine-tuned by the second sample set for a few steps to update the first diffusion model. After updating the first diffusion model, first, the second sample set is updated in the spatial domain by the first diffusion model, and the background disturbance of the updated second sample set is filtered out by the thermal map set to obtain the third sample set; then, it is determined whether the number of spatial domain updates is greater than M. If so, the third sample set is output, otherwise the third sample set is used as the second sample set, and the step of updating the second sample set in the spatial domain is returned to iteratively update.

[0062] After obtaining the third sample set, the third sample set is updated in the frequency domain through the first diffusion model and the frequency domain disturbance, and the background disturbance of the updated third sample set is filtered out using the heat map set to obtain the fourth sample set, and then it is determined whether the number of frequency domain updates is greater than N. If so, the fourth sample set is output, otherwise the fourth sample set is used as the third sample set, and the process returns to the step of updating the third sample set in the frequency domain for iterative updating.

[0063] S105, taking the fourth sample set as an adversarial sample set, and determining whether the number of iterations is greater than the iteration threshold; if not, returning to step S103; if yes, outputting the adversarial sample set.

[0064] Optionally, the iteration threshold can be set according to actual conditions, which is not specifically limited in the present invention.

[0065] In this step, when the number of iterations is not greater than the iteration threshold, the fourth sample set is used as the adversarial sample set, and the process returns to the step of updating the adversarial sample set N times in the frequency domain using the first diffusion model, frequency domain perturbation, and heat map set for iterative updating; when the number of iterations is greater than the iteration threshold, the update is terminated and the adversarial sample set is output.

[0066] In some embodiments of the present invention, reference Figure 2 In step S101, a plurality of user images are acquired and processed to obtain a first image set and an adversarial sample set. The implementation process mainly includes the following steps S201-S202.

[0067] S201, obtaining a plurality of user images and scaling the sizes of all the user images to a first value, thereby constructing a first image set.

[0068] In this step, first, a number of user images that need to be protected are obtained; then, the sizes of the user images that need to be protected are unified into a first value, and a number of clean images are obtained, thereby forming a first image set. The first value can be set according to actual conditions, and the present invention does not specifically limit this. For example, the first value is .

[0069] S202, copy the first image set to obtain an adversarial sample set.

[0070] In some embodiments of the present invention, reference Figure 3 In step S102, the implementation process of determining the frequency domain disturbance according to the first image set mainly includes the following steps S301-S302.

[0071] S301 , for each clean image in the first image set, evenly divide the clean image into a plurality of blocks and perform discrete cosine transform on each block to obtain frequency domain information of the clean image.

[0072] S302, obtaining a frequency domain image set through the frequency domain information of each clean image in the first image set, and constructing a tensor with the same size as the frequency domain image set as the frequency domain perturbation.

[0073] In the above steps, for each clean image in the first image set, there are the following steps: First, the clean image is divided into multiple Then, a discrete cosine transform is performed on each block to convert the information in the spatial domain into information in the frequency domain, thereby obtaining the frequency domain information of the clean image. By traversing each clean image in the first image set, the frequency domain information of each clean image in the first image set is obtained, thereby constructing a frequency domain image set. After that, a tensor with the same size as the frequency domain image set is constructed as the frequency domain perturbation .

[0074] Optionally, R can be set according to actual conditions, and the present invention does not specifically limit this.

[0075] In some embodiments of the present invention, reference Figure 4 In step S102, the StableDiffusion model is fine-tuned using the first image set to obtain the first diffusion model and the thermal map set. The implementation process mainly includes the following steps S303-S306.

[0076] S303: Acquire a first text instruction and a second text instruction.

[0077] It should be noted that the first text instruction is a text instruction describing the user image, and the second text instruction is a text instruction adding a learning noun based on the first text instruction. It should be understood that the learning noun is a new concept for the diffusion model to learn. When a learning noun appears in a text instruction, the diffusion model will generate an image containing the learning noun.

[0078] In this step, a first text instruction and a second text instruction are obtained, the first text instruction is used to guide the Stable Diffusion model to generate images to construct a second image set, and the second text instruction is used to fine-tune the Stable Diffusion model.

[0079] Optionally, the first text instruction, the second text instruction and the learning noun can be set according to actual conditions, and the present invention does not specifically limit this. For example, the learning noun is "sks", the first text instruction is "a photo of aperson", and the second text instruction is "a photo of a sks person".

[0080] S304, using the first text instruction and the Stable Diffusion model to generate an image, obtaining a plurality of generated images, and forming a second image set through the plurality of generated images.

[0081] In this step, the pre-trained Stable Diffusion model is guided by a text instruction describing the user image, i.e., a first text instruction, to generate a plurality of generated images, each of which has a size of the first value, thereby forming a second image set. For example, the pre-trained Stable Diffusion model is guided by "a photo of a person" to generate 200 images of size The 200 images are integrated into the second image set. The pre-training process of the StableDiffusion model is a prior art, and the present invention will not repeat it.

[0082] S305, fine-tuning the Stable Diffusion model using the first image set and the second image set Step 1, obtain the first diffusion model and its model parameters.

[0083] Optionally, It can be set according to actual conditions, and the present invention does not make any specific limitation on this. For example, is 3.

[0084] In this step, the first and second image sets are used to fine-tune the pre-trained Stable Diffusion model through the Dreambooth training method. Step 1, get the first diffusion model and its model parameters .

[0085] S306, fine-tuning the Stable Diffusion model according to the first image set and the second image set in combination with the second text instruction Step 1, the second diffusion model is obtained, and the inversion process of the denoised diffusion implicit model is performed on the second diffusion model to obtain the thermal atlas.

[0086] It should be noted that the heat map set may include but is not limited to a Diffusion Attentive Attribution Map (DAAM) of a learning noun.

[0087] Optionally, It can be set according to actual conditions, and the present invention does not make any specific limitation on this. For example, is 500.

[0088] In this step, when fine-tuning the Stable Diffusion model, both text and images need to be provided, where the text refers to the second text instruction, such as "a photo of a sks person", and the image refers to the first image set and the second image set. The process of fine-tuning the Stable Diffusion model is as follows: First, the first image set and the second image set and the second text instruction are used to fine-tune the pre-trained Stable Diffusion model through the Dreambooth training method. step, and obtain the fine-tuned Stable Diffusion model as the second diffusion model; then, the inversion process of DDIM is performed on the second diffusion model to obtain the area that the second diffusion model focuses on when learning the first image set, that is, the diffusion attention attribution map of the learning noun, thereby forming a heat map set, which is used to add the perturbed attack area mask.

[0089] Furthermore, the heat map set can be represented by a binary matrix as shown in the following formula (1):

[0090] (1);

[0091] In the formula, represents a heat map set, Heatmap showing the performance of the second diffusion model trained by Dreambooth relative to the learned nouns, is a threshold value, which can be set according to actual conditions, and the present invention does not specifically limit this. For example, is 0.9.

[0092] In some embodiments of the present invention, reference Figure 5 , Figure 5This is a schematic diagram of an adversarial sample generation method provided by the present invention, which describes the generation process of adversarial samples. FPL refers to the frequency domain perturbation method, SPL refers to the spatial domain perturbation method, and the positioning module is used to filter out the redundant background perturbations of the updated adversarial samples. During the generation process, the user image to be protected is input. And resize and copy to get the first image set and adversarial sample set. In a certain iteration, the sample The frequency domain is updated by FPL and the redundant background disturbance is filtered out by the positioning module. Then the spatial domain is updated by SPL and the redundant background disturbance is filtered out by the positioning module to obtain the sample. , then the sample The update in the spatial domain is realized by SPL, and the redundant background disturbance is filtered out by the positioning module. The update in the frequency domain is realized by FPL, and the redundant background disturbance is filtered out by the positioning module to obtain the sample. , this iteration ends, and the sample Assign to , to proceed to the next iteration, and obtain the final adversarial sample through multiple iterations .

[0093] Furthermore, the implementation process of FPL will be further described and explained below.

[0094] Reference Figure 6 and Figure 7 In step S103, the adversarial sample set is updated N times in the frequency domain using the first diffusion model, frequency domain perturbation and heat map set to obtain the implementation process of the first sample set, and in step S104, the third sample set is updated N times in the frequency domain using the first diffusion model, frequency domain perturbation and heat map set to obtain the implementation process of the fourth sample set may include but are not limited to the following steps S401-S404.

[0095] S401, performing frequency domain transformation on the adversarial sample set or the third sample set by discrete cosine transform to obtain a first frequency domain sample set.

[0096] In this step, for each image in the adversarial sample set or the third sample set , there are the following steps: First, the image is divided into multiple Then, DCT is performed on each block to convert the information in the spatial domain into the information in the frequency domain, thereby obtaining the frequency domain information of the image. By traversing each image in the adversarial sample set or the third sample set, the frequency domain information of each image in the adversarial sample set or the third sample set is obtained, that is, , thereby obtaining the first frequency domain sample set.

[0097] S402, adding the frequency domain disturbance to the first frequency domain sample set to obtain the disturbance sample set as the input of the first diffusion model, and updating the second frequency domain sample set and the frequency domain disturbance through the first diffusion model.

[0098] In this step, for each frequency domain sample in the first frequency domain sample set , calculate the sum of the first parameter and the frequency domain sample as the disturbance sample corresponding to the frequency domain sample, that is, . The first parameter is the Hadamard product of the frequency domain perturbation and a preset weight matrix. In addition, in this process, the perturbation of the clean image in the frequency domain is constrained by the Lp-norm. Specifically, the Lp-norm of the frequency domain information of the frequency domain sample and its corresponding clean image is controlled to be less than the second value.

[0099] Among them, the disturbance samples corresponding to the frequency domain samples satisfy the following formula (2):

[0100] (2);

[0101] In the formula, Represents the perturbation sample corresponding to the frequency domain sample; Represents an image in the adversarial sample set or the third sample set; express The discrete cosine transform value of , i.e., the frequency domain sample; It means Hadamard Merit; represents frequency domain disturbance; Represents the frequency domain information of the clean image corresponding to the frequency domain samples; Represents a preset weight matrix, which is dynamically adjusted according to the energy distribution of the image spectrum, and can assign greater weights to high-frequency components and smaller weights to low-frequency components; represents the second value, which can be set according to actual conditions, and the present invention does not specifically limit this. For example, is 15; Represents the operation of Lp-norm.

[0102] By traversing each frequency domain sample in the first frequency domain sample set, the perturbation sample corresponding to each frequency domain sample in the first frequency domain sample set can be obtained, thereby obtaining the perturbation sample set. After obtaining the perturbation sample set, firstly, the perturbation sample set is used as the input data of the first diffusion model, and the perturbation sample set is subjected to noise injection processing and image reconstruction through the first diffusion model to obtain the second frequency domain sample set, and the gradient value of the reconstruction loss function of the first diffusion model relative to the frequency domain perturbation is calculated, and then the frequency domain perturbation is updated using the gradient value.

[0103] The process of updating the frequency domain disturbance is shown in the following formula (3):

[0104] (3);

[0105] In the formula, represents the frequency domain disturbance, Represents the reconstruction loss function of the first diffusion model Relative to frequency domain disturbance The gradient of Represents the gradient Function value; Indicates the update intensity, which can be set according to actual conditions. The present invention does not make any specific limitation on this. Its example value is 0.1; Represents inverse discrete cosine transform.

[0106] Optionally, in the first diffusion model, for a given , after the image encoder Convert to latent variables , the forward process will be at each time step Add noise to generate a series of noisy latent variables , reverse process training model The noise added by the predictive forward process to infer In the denoising process (i.e., the reverse process), the training loss is the L2 distance. Based on this, the reconstruction loss function of the first diffusion model satisfies the following formula (4):

[0107] (4);

[0108] In the formula, represents the reconstruction loss function; represents model parameters of the first diffusion model; Represents the image encoder, input image After the image encoder Encoded as ; Represents a text instruction; is the number of denoising steps; Representing images After the image encoder The latent codes obtained (i.e. latent variables); Represents the L2 distance operation.

[0109] S403, using the heat map set to filter out the background disturbance of the second frequency domain sample set to obtain a third frequency domain sample set.

[0110] In this step, for each sample image in the second frequency domain sample set , there are the following steps: calculate the difference between the sample image and the clean image corresponding to the sample image as the second parameter, calculate the Hadamard product of the second parameter and the thermal atlas as the third parameter, and calculate the sum of the third parameter and the clean image corresponding to the sample image as the sample image after filtering out the background disturbance, that is, By traversing each sample image in the second frequency domain sample set, each sample image after filtering out background disturbance in the second frequency domain sample set can be obtained, thereby constructing a third frequency domain sample set. Among them, the sample image after filtering out background disturbance is shown in the following formula (5):

[0111] (5);

[0112] In the formula, represents the sample image in the second frequency domain sample set, represents a heat map set, represents the clean image corresponding to the sample image, Represents the sample image after filtering out background disturbance.

[0113] S404, determine whether the number of frequency domain updates is greater than N; if so, output the third frequency domain sample set as the first sample set or the fourth sample set; if not, output the third frequency domain sample set as the adversarial sample set or the third sample set, and return to step S401.

[0114] In this step, when the number of frequency domain updates is not greater than N, the adversarial sample set or the third sample set is replaced by the third frequency domain sample set, that is, , and returns to step S401 to iteratively update until the number of frequency domain updates is greater than N, and the third frequency domain sample set is output as the first sample set or the fourth sample set.

[0115] Furthermore, the implementation process of SPL will be further described and explained below.

[0116] Reference Figure 8 and Fig. 9 In step S103, the first sample set is updated M times in the spatial domain using the first diffusion model and the heat map set, and in step S104, the implementation process of updating the second sample set M times in the spatial domain using the first diffusion model and the heat map set may include but is not limited to the following steps S501-S502.

[0117] S501 , for each sample image in the first sample set or the second sample set, the following updating steps S01 - S08 are performed.

[0118] S01, determining a clean image corresponding to the sample image.

[0119] In this step, for a given sample image, its corresponding clean image is determined.

[0120] S02, using the image encoder of the first diffusion model to encode the sample image to obtain a first latent variable, and at the same time using the image encoder to encode the clean image corresponding to the sample image to obtain a second latent variable.

[0121] In this step, an image encoder is provided in the first diffusion model, and the sample image is encoded by the image encoder of the first diffusion model to obtain a first latent variable, and at the same time, a clean image corresponding to the sample image is encoded by the image encoder of the first diffusion model to obtain a second latent variable.

[0122] S03: Calculate a potential loss function of the first diffusion model according to the first latent variable and the second latent variable.

[0123] It should be noted that the potential loss function of the first diffusion model satisfies the following formula (6):

[0124] (6);

[0125] In the formula, represents the potential loss function of the first diffusion model; Represents a sample image After the image encoder The latent variable obtained after encoding is the first latent variable; Represents a sample image The corresponding clean image The latent variable is the second latent variable.

[0126] S04, injecting noise into the first latent variable, and using the predictor of the first diffusion model to predict the noise injected into the first latent variable to obtain a first predicted noise, and injecting noise into the second latent variable at the same time, and using the predictor of the first diffusion model to predict the noise injected into the second latent variable to obtain a second predicted noise.

[0127] In this step, a predictor is provided in the first diffusion model for predicting the injected noise. Usually, the predictor is U-Net. Based on this, the noise is injected into the first latent variable using the forward process of the first diffusion model, and the noise injected into the first latent variable is predicted using the predictor of the first diffusion model to obtain the first predicted noise. At the same time, the noise is injected into the second latent variable using the forward process of the first diffusion model, and the noise injected into the second latent variable is predicted using the predictor of the first diffusion model to obtain the second predicted noise.

[0128] S05: Calculate a reconstruction loss function of the first diffusion model according to the first predicted noise and the second predicted noise.

[0129] In this step, the reconstruction loss function of the first diffusion model is calculated based on the first predicted noise and the second predicted noise. It should be understood that the reconstruction loss function is recorded in the previous embodiment. The calculation formula of is shown in formula (4), which will not be repeated here.

[0130] S06, determining a spatial domain disturbance according to the reconstruction loss function and the potential loss function, and adding the spatial domain disturbance to the sample image to obtain a first disturbed image.

[0131] In this step, first, the total loss function value of the first diffusion model is calculated according to the reconstruction loss function and the potential loss function, as shown in the following formula (7):

[0132] (7);

[0133] In the formula, represents the total loss function value of the first diffusion model; represents the reconstruction loss function of the first diffusion model; is a hyperparameter that represents the attack image encoder The degree can be set according to the actual situation, and the present invention does not make any specific limitation on this. For example, for ; represents the potential loss function of the first diffusion model.

[0134] Then, according to the total loss function value, the spatial domain perturbation is determined as shown in the following formula (8):

[0135] (8);

[0136] In the formula, represents the spatial domain disturbance; Represents the total loss function of the first diffusion model Relative to the sample image The gradient of Indicates the update intensity, which can be set according to actual conditions, and the present invention does not make any specific limitation to this. For example, is 0.1.

[0137] After determining the spatial domain perturbation, the spatial domain perturbation is added to the sample image by the following formula (9): The first perturbation image is obtained :

[0138] (9);

[0139] In the formula, To ensure that the first perturbation image Still within a certain numerical range, the numerical range can be set according to actual conditions, the present invention does not make specific limitations on this, exemplary, the numerical range is [0, 255]. In addition, the perturbation of the clean image in the frequency domain is constrained by the Lp-norm, specifically, the Lp-norm of the sample image and its corresponding clean image is less than the third value . Optionally, It can be set according to actual conditions, and the present invention does not make any specific limitation on this. For example, is 12 / 255.

[0140] S07, filtering out background disturbance of the first disturbance image through the thermal atlas to obtain a second disturbance image.

[0141] In this step, first, the difference between the first disturbed image and the clean image corresponding to the first disturbed image is calculated as the second parameter; then, the Hadamard product of the second parameter and the thermal atlas is calculated as the third parameter; then, the sum of the third parameter and the clean image corresponding to the first disturbed image is calculated as the second disturbed image. The second disturbed image satisfies the following formula (10):

[0142] (10);

[0143] In the formula, represents the second perturbed image.

[0144] S08, determining whether the number of spatial domain updates is greater than M; if so, outputting a second disturbed image; if not, taking the second disturbed image as a sample image and returning to step S01.

[0145] In this step, when the number of spatial domain updates is not greater than M, the sample image is replaced by the second perturbation image, that is, , and returns to step S01 to iteratively update until the number of spatial domain updates is greater than M, and the second perturbation image is output.

[0146] S502, when the updating step is performed on all sample images in the first sample set or the second sample set, a second sample set or a third sample set is obtained through all second disturbance images corresponding to the first sample set or the second sample set.

[0147] In this step, if all sample images in the first sample set have completed the updating step, all second perturbed images corresponding to the first sample set are integrated into the second sample set; or, if all sample images in the second sample set have completed the updating step, all second perturbed images corresponding to the second sample set are integrated into the third sample set.

[0148] In some embodiments of the present invention, in step S104, the implementation process of updating the first diffusion model by using the second sample set mainly includes the following steps S601.

[0149] S601, fine-tuning the first diffusion model using the second sample set and the second image set step, obtaining the third diffusion model as the first diffusion model, and using the model parameters of the third diffusion model as the model parameters of the first diffusion model.

[0150] In this step, the second sample set and the second image set are used to fine-tune the first diffusion model through the Dreambooth training method. Step 1, obtain a new first diffusion model and new model parameters.

[0151] Secondly, an implementation of an adversarial sample generating device provided by an embodiment of the present invention will be described in detail below with reference to the accompanying drawings.

[0152] Reference Fig.10 , an adversarial sample generation device provided by an embodiment of the present invention mainly comprises the following steps:

[0153] The acquisition module 701 is mainly used to acquire a number of user images.

[0154] The processing module 702 is mainly used to process a number of user images to obtain a first image set and an adversarial sample set; and to determine the frequency domain perturbation according to the first image set, and to fine-tune the Stable Diffusion model using the first image set to obtain a first diffusion model and a heat map set.

[0155] The frequency domain update module 703 is used to update the adversarial sample set N times in the frequency domain using the first diffusion model, frequency domain perturbation and heat map set to obtain the first sample set, and to update the first sample set M times in the spatial domain using the first diffusion model and heat map set to obtain the second sample set.

[0156] The model updating module 704 is configured to update the first diffusion model using the second sample set.

[0157] The spatial domain updating module 705 is used to update the second sample set M times in the spatial domain using the first diffusion model and the thermal map set to obtain a third sample set, and to update the third sample set N times in the frequency domain using the first diffusion model, frequency domain perturbation and the thermal map set to obtain a fourth sample set.

[0158] The iteration control module 706 is used to use the fourth sample set as the adversarial sample set and trigger the frequency domain update module when the number of iterations is not greater than the iteration threshold, so that the frequency domain update module uses the first diffusion model, frequency domain perturbation and heat map set to update the adversarial sample set N times in the frequency domain until the number of iterations is greater than the iteration threshold, and output the adversarial sample set.

[0159] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0160] Based on the above embodiments, the implementation principle of an adversarial sample generation method and device provided by the present invention will be described below with reference to the accompanying drawings.

[0161] Reference Figure 5 In the present invention, firstly, the fixedness and sensitivity to disturbance of the image encoder of the diffusion model are utilized to provide a spatial domain perturbation method, namely, SPL; secondly, according to the characteristics of the diffusion model in the frequency domain, a frequency domain perturbation method, namely, FPL, is provided; furthermore, by alternately using the two methods of FPL and SPL, the adversarial sample accumulates the gradients in the spatial domain and the frequency domain, realizes the dual-domain perturbation learning of the adversarial sample, and effectively destroys the overall texture and details of the generated image; finally, the present invention provides a positioning module for filtering out redundant background perturbations in the adversarial sample and improving the concealment of the adversarial sample.

[0162] Furthermore, the diffusion model adopted by the present invention is Stable Diffusion 2.1. The implementation principle of the adversarial sample generation method and device provided by the present invention is as follows:

[0163] Step 1: Obtain and preprocess several user images that need to be protected, and uniformly scale the size of each user image to , forming the first image set, and then copying the first image set to obtain the adversarial sample set.

[0164] Step 2: Divide each image in the first image set into multiple The DCT is performed on each block to convert the information in the spatial domain into the information in the frequency domain, thereby obtaining the frequency domain information of each clean image in the first image set, forming a frequency domain image set, and then constructing a tensor with the same size as the frequency domain image set as the frequency domain perturbation .

[0165] Step 3: Use the text instruction "a photo of a person" to guide the pre-trained Stable Diffusion model to generate 200 images of size images, and integrate these 200 images into the second image set.

[0166] Step 4: Use the first image set and the second image set to fine-tune the pre-trained Stable Diffusion model through the Dreambooth training method for 500 steps to obtain the fine-tuned Stable Diffusion model, i.e., the second diffusion model. Then, the DDIM inversion process is performed on the second diffusion model to obtain the area that the second diffusion model focuses on when learning the first image set, i.e., the diffusion attention attribution map of "sks", thereby forming a heat map set, which is used to add the perturbed attack area mask, satisfying the aforementioned formula (1).

[0167] Step 5: Use the first image set and the second image set to fine-tune the pre-trained Stable Diffusion model for 3 steps through the Dreambooth training method to obtain the first diffusion model and its model parameters .

[0168] Step 6: Implement FPL on the first diffusion model to update the adversarial sample set in the frequency domain and obtain the second frequency domain sample set, such as Figure 6 As shown, the background disturbance of the second frequency domain sample set is then filtered out using the heat map set to obtain the third frequency domain sample set as the adversarial sample set.

[0169] Specifically, the adversarial sample set is first converted to the frequency domain using the method in step 2 above, and the frequency domain perturbation is added to the adversarial sample set in the frequency domain, thereby obtaining a perturbed sample set, wherein the method of adding the frequency domain perturbation is as shown in the aforementioned formula (2). Then, the perturbed sample set is used as the input data of the first diffusion model, and the perturbed sample set is subjected to noise injection processing and image reconstruction through the first diffusion model to obtain a second frequency domain sample set, and the gradient value of the reconstruction loss function of the first diffusion model relative to the frequency domain perturbation is calculated. Afterwards, the frequency domain perturbation is updated using the gradient value. The above process is shown in the aforementioned formulas (3)-(4).

[0170] Finally, the background disturbance of the second frequency domain sample set is filtered out using the heat map set to obtain the third frequency domain sample set. This process is shown in the formula (5) described above.

[0171] Step 7: Iterate step 6 for 9 times to obtain the first sample set.

[0172] Step 8: Implement SPL on the first diffusion model to update the first sample set in the spatial domain, such as Figure 8 Specifically, for each sample image in the first sample set, the following steps are performed:

[0173] First, the sample image is encoded using the image encoder of the first diffusion model to obtain the first latent variable. At the same time, the clean image corresponding to the sample image is encoded using the image encoder to obtain the second latent variable, and the potential loss function of the first diffusion model is calculated using the aforementioned formula (6).

[0174] Secondly, noise is injected into the first latent variable, and the noise injected into the first latent variable is predicted using the predictor of the first diffusion model to obtain the first predicted noise. At the same time, noise is injected into the second latent variable, and the noise injected into the second latent variable is predicted using the predictor of the first diffusion model to obtain the second predicted noise. The reconstruction loss function of the first diffusion model is calculated using the formula (4) described above.

[0175] Then, according to the reconstruction loss function and the potential loss function, the total loss function value of the first diffusion model is calculated by the aforementioned formula (7), and the spatial domain perturbation is determined by the total loss function value of the first diffusion model by formula (8).

[0176] Furthermore, the spatial domain disturbance is added to the sample image by the aforementioned formula (9) to obtain a first disturbed image, and the background disturbance of the first disturbed image is filtered out by using the thermal atlas to obtain a second disturbed image.

[0177] Finally, the above steps are iterated 9 times, and the second perturbation image is output as a sample image, thereby obtaining a second sample set.

[0178] Step 9: Using the second sample set and the second image set, the first diffusion model is updated using the method in step 5 above.

[0179] Step 10: Implement SPL on the first diffusion model to update the second sample set in the spatial domain to obtain a third sample set, such as Figure 8 This step is the same as the above step 8, except that the first sample set in step 9 is changed to the second sample set, which will not be described in detail.

[0180] Step 11: Implement FPL on the first diffusion model to update the third sample set in the frequency domain and filter out its background disturbance, thereby obtaining the fourth sample set, such as Figure 6 This step is the same as the above steps 6-7, except that the adversarial sample set in step 6 is changed to the third sample set, which will not be described in detail.

[0181] Step 12: Iterate step 6-step 11 for 50 times. After the 50th iteration, the fourth sample set is output as the adversarial sample set, thereby completing the update of the adversarial sample.

[0182] In summary, the present invention can provide the following technical effects:

[0183] Firstly, the present invention provides a spatial domain perturbation method (i.e., SPL), which updates adversarial samples by adding spatial domain perturbations, so that adversarial samples can be targeted at personalized generative diffusion models based on optimization, and introduces a new loss function in the spatial domain perturbation method to narrow the difference between the alternative model and the actual model, thereby significantly improving the defense effect of adversarial samples.

[0184] Secondly, the present invention fully considers the sensitivity of the diffusion model to the frequency domain of the image, and provides a frequency domain perturbation method (i.e., FPL). By adding frequency domain perturbations to update adversarial samples, the adversarial samples can focus on attacking detail areas, thereby improving the efficiency of adversarial attacks and minimizing irrelevant interference during adversarial attacks.

[0185] Thirdly, the present invention iteratively adds spatial domain perturbations and frequency domain perturbations to adversarial samples by alternatingly using FPL and SPL, so that the adversarial samples accumulate gradients in the spatial domain and frequency domain, realizing dual-domain perturbation learning of adversarial samples. At the same time, the characteristics of the spatial domain and frequency domain are utilized to destroy the detail information and overall information of the image generated by the personalized generative diffusion model trained based on adversarial samples, thereby improving the defense effect of adversarial samples.

[0186] Fourthly, the present invention introduces a diffuse attention attribution map and provides a positioning module, which can accurately identify the position of the new concept (i.e., learning noun) learned by the personalized generative diffusion model in the image. Through this module, redundant background disturbances in the adversarial sample can be filtered out. On the one hand, unnecessary disturbances are avoided and the visual quality of the adversarial sample is improved. On the other hand, the adversarial sample is more focused on attacking these key areas, ensuring the attack effectiveness and destructive effectiveness of the adversarial sample, that is, while improving the concealment of the disturbance noise, the image quality of the adversarial sample is also improved, which can better balance the relationship between the protection effect and the image quality of the adversarial sample.

[0187] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0188] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0189] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several programs to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., various media that can store program codes.

[0190] The logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable programs for implementing logical functions, and may be embodied in any computer-readable medium for use by a program execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch and execute a program from a program execution system, device or apparatus), or in conjunction with such program execution system, device or apparatus. For purposes of this specification, a "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by a program execution system, device or apparatus, or in conjunction with such program execution system, device or apparatus.

[0191] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0192] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable program execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0193] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0194] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0195] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A method for generating adversarial samples, characterized in that: The following steps are involved: Acquire and process a number of user images to obtain a first image set and an adversarial sample set; wherein the first image set includes a number of clean images, and the adversarial sample set includes a number of copies of clean images; Determine frequency domain disturbance according to the first image set, and use the first image set to fine-tune the Stable Diffusion model to obtain a first diffusion model and a thermal map set; Using the first diffusion model, the frequency domain perturbation, and the heat map set to update the adversarial sample set N times in the frequency domain to obtain a first sample set, and using the first diffusion model and the heat map set to update the first sample set M times in the spatial domain to obtain a second sample set; updating the first diffusion model by using the second sample set, updating the second sample set M times in the spatial domain by using the first diffusion model and the thermal map set to obtain a third sample set, and updating the third sample set N times in the frequency domain by using the first diffusion model, the frequency domain perturbation and the thermal map set to obtain a fourth sample set; Using the fourth sample set as the adversarial sample set, when the number of iterations is not greater than the iteration threshold, returning to the step of updating the adversarial sample set N times in the frequency domain by using the first diffusion model, the frequency domain perturbation, and the heat map set, until the number of iterations is greater than the iteration threshold, and outputting the adversarial sample set; The determining of the frequency domain disturbance according to the first image set and fine-tuning the StableDiffusion model using the first image set to obtain a first diffusion model and a thermal map set include: For each clean image in the first image set, evenly divide the clean image into a plurality of blocks and perform discrete cosine transform on each block to obtain frequency domain information of the clean image; Obtain a frequency domain image set through frequency domain information of each clean image in the first image set, and construct a tensor with the same size as the frequency domain image set as the frequency domain perturbation; Obtaining a first text instruction and a second text instruction; wherein the first text instruction is a text instruction describing the user image, and the second text instruction is a text instruction adding a learning noun based on the first text instruction; Using the first text instruction and the Stable Diffusion model to generate images, obtaining a plurality of generated images, and forming a second image set through the plurality of generated images; Using the first image set and the second image set, fine-tuning the Stable Diffusion model Step 1, obtaining the first diffusion model and its model parameters; According to the first image set and the second image set, in combination with the second text instruction, the StableDiffusion model is fine-tuned Step 1, obtain a second diffusion model, and perform a denoising diffusion implicit model inversion process on the second diffusion model to obtain a heat map set; wherein the heat map set includes a diffusion attention attribution map of the learning noun.

2. The adversarial sample generation method according to claim 1, characterized in that: The updating of the first diffusion model by using the second sample set includes: Using the second sample set and the second image set, fine-tuning the first diffusion model step, obtaining a third diffusion model as the first diffusion model, and using model parameters of the third diffusion model as model parameters of the first diffusion model.

3. The adversarial sample generation method according to claim 1, characterized in that: The step of updating the adversarial sample set or the third sample set N times in the frequency domain by using the first diffusion model, the frequency domain perturbation and the heat map set to obtain the first sample set or the fourth sample set includes: Performing frequency domain transformation on the adversarial sample set or the third sample set by discrete cosine transform to obtain a first frequency domain sample set; Adding the frequency domain disturbance to the first frequency domain sample set to obtain a disturbance sample set as an input of the first diffusion model, and updating the second frequency domain sample set and the frequency domain disturbance through the first diffusion model; Using the thermal map set to filter out background disturbances of the second frequency domain sample set, to obtain a third frequency domain sample set; Determine whether the number of frequency domain updates is greater than N; if so, output the third frequency domain sample set as the first sample set or the fourth sample set; if not, output the third frequency domain sample set as the adversarial sample set or the third sample set, and return to the step of performing frequency domain transformation on the adversarial sample set or the third sample set through discrete cosine transform.

4. The adversarial sample generation method according to claim 3, characterized in that: The step of adding the frequency domain disturbance to the first frequency domain sample set to obtain a disturbance sample set includes: For each frequency domain sample in the first frequency domain sample set, calculating the sum of a first parameter and the frequency domain sample as a perturbation sample corresponding to the frequency domain sample; wherein the first parameter is a Hadamard product of the frequency domain perturbation and a preset weight matrix, and an Lp-norm of frequency domain information of the frequency domain sample and its corresponding clean image is less than a second value; The disturbance sample set is obtained through the disturbance sample corresponding to each frequency domain sample in the first frequency domain sample set.

5. The adversarial sample generation method according to claim 3, characterized in that: The updating of the second frequency domain sample set and the frequency domain disturbance by using the first diffusion model includes: Performing noise injection processing and image reconstruction on the disturbance sample set through the first diffusion model to obtain a second frequency domain sample set, and calculating a gradient value of a reconstruction loss function of the first diffusion model relative to the frequency domain disturbance; The frequency domain disturbance is updated using the gradient value.

6. The method for generating adversarial samples according to claim 3, characterized in that: The step of filtering out background disturbances of the second frequency domain sample set by using the thermal map set to obtain a third frequency domain sample set includes: For each sample image in the second frequency domain sample set, a difference between the sample image and a clean image corresponding to the sample image is calculated as a second parameter, a Hadamard product between the second parameter and the thermal atlas is calculated as a third parameter, and a sum of the third parameter and the clean image corresponding to the sample image is calculated as the sample image after background disturbance is filtered out; A third frequency domain sample set is obtained by filtering out multiple sample images after background disturbance.

7. The adversarial sample generation method according to claim 1, characterized in that: The step of updating the first sample set or the second sample set M times in the spatial domain by using the first diffusion model and the thermal map set to obtain the second sample set or the third sample set includes: For each sample image in the first sample set or the second sample set, the following updating steps are performed: Determine a clean image corresponding to the sample image; Encoding the sample image using the image encoder of the first diffusion model to obtain a first latent variable, and encoding a clean image corresponding to the sample image using the image encoder to obtain a second latent variable; Calculating a potential loss function of the first diffusion model according to the first latent variable and the second latent variable; Injecting noise into the first latent variable and using the predictor of the first diffusion model to predict the noise injected into the first latent variable to obtain a first predicted noise, and injecting noise into the second latent variable and using the predictor of the first diffusion model to predict the noise injected into the second latent variable to obtain a second predicted noise; Calculating a reconstruction loss function of the first diffusion model according to the first predicted noise and the second predicted noise; Determining the spatial domain perturbation according to the reconstruction loss function and the potential loss function, and adding the spatial domain perturbation to the sample image to obtain a first perturbed image; filtering the background disturbance of the first disturbance image by using the thermal atlas to obtain a second disturbance image; Determine whether the number of spatial domain updates is greater than M; if so, output the second perturbed image; if not, use the second perturbed image as the sample image, and return to the step of determining the clean image corresponding to the sample image; When the updating step is performed on all sample images in the first sample set or the second sample set, the second sample set or the third sample set is obtained through all second disturbance images corresponding to the first sample set or the second sample set.

8. The method for generating adversarial samples according to claim 7, characterized in that: The filtering out the background disturbance of the first disturbance image by using the thermal atlas to obtain the second disturbance image includes: calculating a difference between the first disturbed image and a clean image corresponding to the first disturbed image as a second parameter; calculating a Hadamard product of the second parameter and the thermal atlas as a third parameter; A sum of the third parameter and a clean image corresponding to the first disturbed image is calculated as a second disturbed image.

9. An adversarial sample generation device, characterized in that: Applied to a method for generating an adversarial sample according to any one of claims 1 to 8, the device comprising: An acquisition module, used to acquire a number of user images; A processing module, configured to process a plurality of user images to obtain a first image set and an adversarial sample set; and, determine a frequency domain perturbation according to the first image set, and fine-tune a Stable Diffusion model using the first image set to obtain a first diffusion model and a thermal map set; wherein the first image set includes a plurality of clean images, and the adversarial sample set includes a plurality of copies of clean images; A frequency domain updating module, configured to update the adversarial sample set N times in the frequency domain using the first diffusion model, the frequency domain perturbation, and the heat map set to obtain a first sample set, and to update the first sample set M times in the spatial domain using the first diffusion model and the heat map set to obtain a second sample set; A model updating module, configured to update the first diffusion model using the second sample set; a spatial domain updating module, configured to update the second sample set M times in the spatial domain using the first diffusion model and the thermal map set to obtain a third sample set, and to update the third sample set N times in the frequency domain using the first diffusion model, the frequency domain perturbation and the thermal map set to obtain a fourth sample set; An iteration control module is used to use the fourth sample set as the adversarial sample set, and when the number of iterations is not greater than the iteration threshold, trigger the frequency domain update module, so that the frequency domain update module updates the adversarial sample set N times in the frequency domain using the first diffusion model, the frequency domain perturbation and the thermal map set, until the number of iterations is greater than the iteration threshold, and outputs the adversarial sample set.

Images