Sliding window-based adversarial patch detection method and device, equipment and medium

Abstract

The invention discloses an adversarial patch detection method and device based on a sliding window, equipment and a storage medium. The method comprises the steps of obtaining an original image; generating a phase reconstruction feature map based on the contour information and the position information in the original image; segmenting the phase reconstruction feature map into a plurality of sub-block regions according to a sliding window with a set size; and determining a comparison result obtained by comparing the pixel value of each sub-block region with a preset threshold value, and determining an adversarial patch region in each sub-block region according to the comparison result. By utilizing the method, the patch attack is detected and defended on the basis of the contour information and the position information in the image by paying attention to the abnormality of the pixel level, and the method has a good defense effect and higher universality.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a sliding window-based anti-patch detection method, device, equipment and storage medium. Background Art

[0002] Adversarial patches are local patches that humans can observe but not notice, and can have a stronger attack effect in the real physical world. With the continuous development of technology, deep neural networks play an important role in image recognition, speech recognition, natural language processing and other fields. However, the classic deep neural network model is not resistant enough to adversarial patches. In order to improve the security and reliability of intelligent driving systems and other engineering applications of deep neural networks, studying how to defend against such attacks has become a hot topic in the field of deep learning. Summary of the invention

[0003] The embodiments of the present invention provide a sliding window-based adversarial patch detection method, device, equipment and storage medium, which detects and defends against adversarial patch attacks by focusing on anomalies at the pixel level and based on contour information and position information in the image. It has a good defense effect and higher versatility.

[0004] In a first aspect, an embodiment of the present invention provides an adversarial patch detection method based on a sliding window, the method comprising:

[0005] Get the original image;

[0006] Generate a phase reconstruction feature map based on the contour information and position information in the original image;

[0007] Dividing the phase reconstruction feature map into a plurality of sub-block regions according to a sliding window of a set size;

[0008] Determine a comparison result of comparing a pixel value of each of the sub-block areas with a preset threshold, and determine a countermeasure patch area in each of the sub-block areas according to the comparison result.

[0009] In a second aspect, an embodiment of the present invention further provides an anti-patch detection device based on a sliding window.

[0010] The device includes:

[0011] An original image acquisition module, used for acquiring the original image;

[0012] A feature map generation module, used to generate a phase reconstruction feature map based on the contour information and position information in the original image;

[0013] A sub-block region segmentation module, used for segmenting the phase reconstruction feature map into a plurality of sub-block regions according to a sliding window of a set size;

[0014] The antagonistic patch determination module is used to determine a comparison result of comparing a pixel value of each sub-block area with a preset threshold, and determine an antagonistic patch area in each sub-block area according to the comparison result.

[0015] In a third aspect, an embodiment of the present disclosure further provides an electronic device, the electronic device comprising:

[0016] one or more processors;

[0017] a storage device for storing one or more programs,

[0018] When the one or more programs are executed by the one or more processors, the one or more processors implement the sliding window-based adversarial patch detection method provided by the embodiment of the present disclosure.

[0019] In a fourth aspect, the embodiments of the present disclosure further provide a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to implement the sliding window-based adversarial patch detection method provided by the embodiments of the present disclosure.

[0020] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the sliding window-based adversarial patch detection method provided by an embodiment of the present disclosure.

[0021] The present invention discloses a sliding window-based adversarial patch detection method, device, equipment and storage medium, the method comprising: obtaining an original image; generating a phase reconstruction feature map based on contour information and position information in the original image; dividing the phase reconstruction feature map into multiple sub-block areas according to a sliding window of a set size; determining a comparison result of comparing the pixel value of each sub-block area with a preset threshold, and determining an adversarial patch area in each sub-block area according to the comparison result. Using this method: by focusing on abnormalities at the pixel level, based on contour information and position information in the image, detection and defense against adversarial patch attacks are achieved, which has a good defense effect and higher versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0023] Figure 1 A flowchart of a sliding window-based adversarial patch detection method provided by an embodiment of the present disclosure;

[0024] Figure 2 A schematic diagram of the structure of an adversarial patch detection device based on a sliding window provided in an embodiment of the present disclosure;

[0025] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0027] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0028] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0029] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0030] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0031] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0032] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0033] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0034] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0035] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0036] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0037] Embodiment 1

[0038] Figure 1 A flowchart of a sliding window-based adversarial patch detection method provided in an embodiment of the present disclosure is applicable to a situation where a solution is provided to the problem of detecting and defending against adversarial patch attacks. The method can be executed by a sliding window-based adversarial patch detection method device, which can be implemented in the form of software and / or hardware, and optionally, by an electronic device, which can be a mobile terminal, a PC or a server, etc.

[0039] like Figure 1 As shown, an adversarial patch detection method based on a sliding window provided in an embodiment of the present disclosure may specifically include the following steps:

[0040] S110: Acquire an original image.

[0041] In this embodiment, the original image may be a natural image. Among them, the natural image may be attached with an adversarial patch. The adversarial patch attack is an attack method against image classification models in the field of deep learning and computer vision. This attack adds a specific patch to the image so that the image classification model misclassifies the image with the adversarial patch attack as the category specified by the attacker.

[0042] S120, generating a phase reconstruction feature map based on contour information and position information in the original image.

[0043] In this embodiment, the phase reconstruction feature map can be an image obtained after Fourier transformation with the amplitude of the image all set to a fixed value and the phase unchanged. The amplitude of the original image contains brightness and detail information, and the phase of the original image contains contour and position information.

[0044] Specifically, the original image is subjected to Fourier transformation to obtain the frequency domain information of the image, the amplitude information in the frequency domain information is modified to a set value, and the phase information of the original image is retained, and the phase information at least corresponds to the contour information and position information of the original image. The modified frequency domain information is subjected to inverse Fourier transformation to obtain a phase reconstruction feature map.

[0045] On the basis of the above embodiment, generating a phase reconstruction feature map based on the contour information and position information in the original image includes the following steps:

[0046] a1) Performing Fourier transform on the original image to obtain first frequency domain information of the original image.

[0047] b1) modifying the amplitude information in the first frequency domain information to a set value as the second frequency domain information;

[0048] The second frequency domain information at least includes phase information of the original image, and the phase information at least corresponds to contour information and position information of the original image.

[0049] c1) performing an inverse Fourier transform on the second frequency domain information to obtain a phase reconstruction feature map.

[0050] In this embodiment, the set value may be a fixed value, which is set according to actual conditions and is not specifically limited in the embodiment.

[0051] Specifically, the original image is subjected to Fourier transformation to obtain the frequency domain information of the image, the amplitude information in the frequency domain information is modified to a set value, and the phase information of the original image is retained, and the phase information at least corresponds to the contour information and position information of the original image. The modified frequency domain information is subjected to inverse Fourier transformation to obtain a phase reconstruction feature map.

[0052] On the basis of the above embodiment, after generating the phase reconstruction feature map based on the contour information and position information in the original image, the method further includes:

[0053] a2) Determine the mean and standard deviation of the pixels in the phase reconstruction feature map.

[0054] b2) Determine the normal pixels and outlier pixels in the phase reconstruction feature map based on the mean and standard deviation.

[0055] c2) removing normal pixels of the phase reconstruction feature map and amplifying the pixel values ​​of the outlier pixels by a set multiple to obtain an optimized phase reconstruction feature map.

[0056] Determining normal pixels and outlier pixels in the phase reconstruction feature map according to the mean and standard deviation specifically includes the following steps:

[0057] b21) Pixels whose standard deviation from the phase reconstruction feature map and the mean is less than a first set multiple are regarded as normal pixels.

[0058] b22) Pixels whose standard deviation of the phase reconstruction feature map and the mean is greater than or equal to the first set multiple and whose standard deviation of the mean is less than the second set multiple are regarded as outlier pixels.

[0059] In this embodiment, the first set multiple and the second set multiple can be set multiples, which are set according to actual conditions and are not specifically limited in the embodiment. For example, the first set multiple can be 2, and the second set multiple can be 3.

[0060] Specifically, determine the mean and standard deviation of the pixels in the phase reconstruction feature map. Pixels whose difference between the phase reconstruction feature map and the mean is less than the standard deviation of the first set multiple are regarded as normal pixels, and pixels whose difference between the phase reconstruction feature map and the mean is greater than or equal to the standard deviation of the first set multiple and whose difference between the mean is less than the standard deviation of the second set multiple are regarded as outlier pixels. Remove the normal pixels of the phase reconstruction feature map and magnify the pixel values ​​of the outlier pixels by the set multiple to obtain an optimized phase reconstruction feature map.

[0061] For example, let the mean of the pixels be μ and the standard deviation be σ, crop the normal pixels in the interval (μ-2σ,μ+2σ), and appropriately amplify the outliers whose values ​​are distributed in the interval (μ-3σ,μ-2σ)∪(μ+2σ,μ+3σ).

[0062] Using this method, we will not rely on brightness features that are easily bypassed to detect adversarial patches. According to the 3σ criterion, the adversarial patches in the phase-reconstructed image have significant anomalies, which further highlights the difference between the adversarial patches and normal images, and can effectively distinguish natural images from adversarial patches.

[0063] S130, dividing the phase reconstruction feature map into a plurality of sub-block areas according to a sliding window of a set size.

[0064] In this embodiment, the sliding window algorithm is an algorithmic technique for processing array problems. The sliding window can be achieved by defining a window of a variable or fixed size on a data sequence and sliding it on the sequence at a certain step size. The image can be considered as a three-dimensional array.

[0065] Specifically, a sliding window of a set size is used to move sequentially between small regions of the phase reconstruction feature map, so as to divide the phase reconstruction feature map into a plurality of sub-block regions.

[0066] Exemplarily, the set size may be a sliding window of size 10×10 and a step size of 5.

[0067] S140: Determine a comparison result between a pixel value of each sub-block area and a preset threshold, and determine an adversarial patch area in each sub-block area according to the comparison result.

[0068] In this embodiment, the preset threshold value can be set according to actual experience and is not specifically limited in the embodiments of the invention.

[0069] Specifically, the sum of the values ​​of the pixels in each sub-block area is compared with a preset threshold. If the sum is greater than the preset threshold, it is considered that there is an adversarial patch area in the sub-block area.

[0070] On the basis of the above embodiment, determining the comparison result of comparing the pixel value of each sub-block area with the preset threshold, and determining the adversarial patch area in each sub-block area according to the comparison result specifically includes the following steps:

[0071] a3) The sum of the values ​​of the pixels in each sub-block area is taken as the pixel value of the sub-block area.

[0072] b3) determining, in each sub-block area, a target sub-block area whose pixel value is greater than a preset threshold.

[0073] c3) Each target sub-block area is used as an adversarial patch area.

[0074] On the basis of the above embodiment, after determining the antagonistic patch region in each sub-block region according to the comparison result, the method further includes: marking the antagonistic patch region and deleting the antagonistic patch region.

[0075] Specifically, for the sub-block area where the adversarial patch area exists, a pure gray pixel value is used to cover the corresponding area in the original image.

[0076] Using this method, for windows with abnormal features, pure gray pixel values ​​are used to cover the corresponding areas in the original image, which is convenient for comparing the defense effect with other studies and the prediction of subsequent neural networks.

[0077] The present invention discloses an adversarial patch detection method based on a sliding window, comprising: obtaining an original image; generating a phase reconstruction feature map based on contour information and position information in the original image; dividing the phase reconstruction feature map into a plurality of sub-block regions according to a sliding window of a set size; determining a comparison result of comparing a pixel value of each sub-block region with a preset threshold, and determining an adversarial patch region in each sub-block region according to the comparison result. Using this method: by focusing on abnormalities at the pixel level, based on contour information and position information in the image, detection and defense against adversarial patch attacks are achieved, which has a good defense effect and higher versatility.

[0078] Figure 2 The present invention also provides a schematic diagram of a device structure of an anti-patch detection method based on a sliding window, as shown in FIG. Figure 2 As shown, an original image acquisition module 210, a feature map generation module 220, a transmission module 230 and an adversarial patch determination module 240.

[0079] The original image acquisition module 210 is used to acquire the original image;

[0080] A feature map generation module 220, configured to generate a phase reconstruction feature map based on the contour information and position information in the original image;

[0081] A sub-block region segmentation module 230, configured to segment the phase reconstruction feature map into a plurality of sub-block regions according to a sliding window of a set size;

[0082] The antagonistic patch determination module 240 is used to determine a comparison result between a pixel value of each of the sub-block regions and a preset threshold, and determine an antagonistic patch region in each of the sub-block regions according to the comparison result.

[0083] The technical solution provided by the embodiment of the present disclosure utilizes this method: by focusing on anomalies at the pixel level, based on the contour information and position information in the image, it realizes detection and defense against patch attacks, has a good defense effect, and has higher versatility.

[0084] Furthermore, the feature map generation module 220 may be used to:

[0085] Performing Fourier transform on the original image to obtain first frequency domain information of the original image;

[0086] Modify the amplitude information in the first frequency domain information to a set value as the second frequency domain information; wherein the second frequency domain information at least includes the phase information of the original image, and the phase information at least corresponds to the contour information and the position information of the original image;

[0087] Perform an inverse Fourier transform on the second frequency domain information to obtain the phase reconstruction feature map.

[0088] Furthermore, the countermeasure patch determination module 240 may also be used to:

[0089] Taking the sum of the values ​​of the pixels in each of the sub-block areas as the pixel value of the sub-block area;

[0090] Determine, in each of the sub-block areas, a target sub-block area whose pixel value is greater than the preset threshold;

[0091] Each of the target sub-block regions is used as the adversarial patch region.

[0092] Furthermore, the device can also be used for:

[0093] Determine the mean and standard deviation of pixels in the phase reconstruction feature map;

[0094] Determine normal pixel points and outlier pixel points in the phase reconstruction feature map according to the mean value and the standard deviation;

[0095] The normal pixels of the phase reconstruction feature map are removed and the pixel values ​​of the outlier pixels are amplified by a set multiple to obtain an optimized phase reconstruction feature map.

[0096] Furthermore, the device can also be used for:

[0097] The pixel points whose difference between the phase reconstruction feature map and the mean value is less than the standard deviation of the first set multiple are taken as the normal pixel points;

[0098] Pixels whose difference between the phase reconstruction feature map and the mean is greater than or equal to the standard deviation of a first set multiple and whose difference between the mean is less than the standard deviation of a second set multiple are taken as outlier pixels.

[0099] Furthermore, the device can also be used for:

[0100] After determining the adversarial patch area in each of the sub-block areas according to the comparison result, the method further includes:

[0101] The adversarial patch region is marked and deleted.

[0102] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not described in detail in this embodiment, please refer to the methods provided by all the above embodiments of the present invention.

[0103] Figure 3 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is given. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0104] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0105] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0106] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the sliding window-based adversarial patch detection method.

[0107] In some embodiments, the sliding window-based adversarial patch detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the sliding window-based adversarial patch detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the sliding window-based adversarial patch detection method in any other appropriate manner (e.g., by means of firmware).

[0108] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0109] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0110] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0111] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0112] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0113] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0114] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0115] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A sliding window-based adversarial patch detection method, characterized in that: include: Get the original image; Based on the contour information and position information in the original image, generating a phase reconstruction feature map; Dividing the phase reconstruction feature map into a plurality of sub-block regions according to a sliding window of a set size; Determine a comparison result of comparing a pixel value of each of the sub-block areas with a preset threshold, and determine a countermeasure patch area in each of the sub-block areas according to the comparison result.

2. The method according to claim 1, characterized in that The step of generating a phase reconstruction feature map based on the contour information and the position information in the original image comprises: Performing Fourier transform on the original image to obtain first frequency domain information of the original image; Modify the amplitude information in the first frequency domain information to a set value as the second frequency domain information; wherein the second frequency domain information at least includes the phase information of the original image, and the phase information at least corresponds to the contour information and the position information of the original image; Perform an inverse Fourier transform on the second frequency domain information to obtain the phase reconstruction feature map.

3. The method according to claim 1, characterized in that The determining a comparison result of comparing a pixel value of each of the sub-block regions with a preset threshold, and determining a countermeasure patch region in each of the sub-block regions according to the comparison result, comprises: Taking the sum of the values ​​of the pixels in each of the sub-block areas as the pixel value of the sub-block area; Determine, in each of the sub-block areas, a target sub-block area whose pixel value is greater than the preset threshold; Each of the target sub-block regions is used as the adversarial patch region.

4. The method according to claim 1, characterized in that: After generating the phase reconstruction feature map based on the contour information and position information in the original image, the method further includes: Determine the mean and standard deviation of pixels in the phase reconstruction feature map; Determine normal pixel points and outlier pixel points in the phase reconstruction feature map according to the mean value and the standard deviation; The normal pixels of the phase reconstruction feature map are removed and the pixel values ​​of the outlier pixels are amplified by a set multiple to obtain an optimized phase reconstruction feature map.

5. The method according to claim 4, characterized in that The determining of normal pixels and outlier pixels in the phase reconstruction feature map according to the mean and the standard deviation includes: The pixel points whose difference between the phase reconstruction feature map and the mean value is less than the standard deviation of the first set multiple are taken as the normal pixel points; Pixels whose difference between the phase reconstruction feature map and the mean is greater than or equal to the standard deviation of a first set multiple and whose difference between the mean is less than the standard deviation of a second set multiple are taken as outlier pixels.

6. The method according to claim 1, characterized in that After determining the adversarial patch area in each of the sub-block areas according to the comparison result, the method further includes: The adversarial patch region is marked and deleted.

7. A sliding window-based adversarial patch detection device, characterized in that: include: An original image acquisition module, used for acquiring the original image; A feature map generation module, used to generate a phase reconstruction feature map based on the contour information and position information in the original image; A sub-block region segmentation module, used for segmenting the phase reconstruction feature map into a plurality of sub-block regions according to a sliding window of a set size; The antagonistic patch determination module is used to determine a comparison result of comparing a pixel value of each sub-block area with a preset threshold, and determine an antagonistic patch area in each sub-block area according to the comparison result.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the sliding window-based adversarial patch detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the sliding window-based adversarial patch detection method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the sliding window-based adversarial patch detection method according to any one of claims 1 to 6.

Images