Image compliance detection method and device and related equipment

Abstract

The embodiment of the invention provides an image compliance detection method and device and related equipment, and belongs to the technical field of artificial intelligence. The method comprises the following steps: acquiring a business image and a counterfeit trace detection model for adversarial training in advance; wherein the business image is used for reflecting target portrait information; performing forgery trace detection on the service image through a forgery trace detection model to obtain forgery trace detection data corresponding to the service image; retrieving the target portrait information in a preset object verification database to obtain target retrieval data; and according to the counterfeiting trace detection data and the target retrieval data, performing compliance detection on the business image to obtain image compliance detection information. In the financial service, the user listed in the abnormal list carries out noise implantation on the picture to bypass the existing compliance detection, so that the financial activity is carried out. According to the embodiment of the invention, the accuracy of forgery detection on the service image can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an image compliance detection method, apparatus and related equipment. Background Art

[0002] Currently, image forgery detection plays an important role in many fields such as finance to ensure the authenticity of information and the security of the system. For example, credit business requires taking portrait photos. Some users who have been included in the abnormal list implant special information in their photos, such as some special continuous pixels or some noise, so that the photos bypass the existing compliance detection and can conduct financial activities.

[0003] In the related technologies, traditional image compliance detection methods mainly rely on analyzing low-level features of images, such as edges, textures, and colors. However, these methods are easily affected by factors such as noise, occlusion, and deformation, resulting in reduced detection accuracy. Therefore, how to improve the accuracy of forgery detection of business images has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose an image compliance detection method, apparatus and related equipment, aiming to improve the accuracy of forgery detection of business images.

[0005] To achieve the above object, a first aspect of an embodiment of the present application provides an image compliance detection method, the method comprising: Obtaining a business image and a forgery trace detection model that has been pre-trained for adversarial training; wherein the business image is used to reflect target portrait information; Performing forgery trace detection on the business image by using the forgery trace detection model to obtain forgery trace detection data corresponding to the business image; Retrieving the target portrait information in a preset object verification database to obtain target retrieval data; According to the forgery trace detection data and the target retrieval data, compliance detection is performed on the business image to obtain image compliance detection information.

[0006] In some embodiments, before acquiring the business image and pre-training the forgery trace detection model, it also includes pre-training the forgery trace detection model, specifically including: Acquire an original neural network model and training sample data; wherein the training sample data includes training sample images and training sample labels corresponding to each training sample image; Generate a corresponding adversarial sample image based on each of the training sample images; For each model parameter in the original neural network model, generating a corresponding initial mask; Parameterizing the original neural network model based on the initial mask and the corresponding model parameters; For each of the training sample images, based on the corresponding adversarial sample image, the corresponding training sample label and the parameterized original neural network model, calculate the adversarial loss function corresponding to each of the adversarial sample images; Obtaining a target mask corresponding to each of the model parameters by optimizing the initial mask corresponding to each of the adversarial loss functions; Performing mask processing on the corresponding model parameters based on the target mask to obtain target mask parameters; For each of the model parameters, calculating an adversarial saliency value based on the corresponding target mask parameter and the corresponding adversarial loss function; Pruning the model parameters according to the adversarial significance value and a preset adversarial significance threshold to obtain the pruned original neural network model; Based on the training sample data and the adversarial sample image, adversarial training is performed on the pruned original neural network model to obtain the forgery trace detection model.

[0007] In some embodiments, generating a corresponding adversarial sample image based on each of the training sample images includes: For each of the training sample images, the corresponding loss gradient is calculated by the original neural network model; Generating adversarial perturbation information corresponding to each of the training sample images according to the loss gradient and a preset perturbation step size; Performing a perturbation process on the training sample image based on the adversarial perturbation information to obtain an intermediate sample image; Based on the pixel value of the training sample image and a preset pixel value range, the pixel value of the intermediate sample image is normalized to obtain the adversarial sample image.

[0008] In some embodiments, for each of the model parameters, calculating the adversarial saliency value based on the corresponding target mask parameter and the corresponding adversarial loss function includes: Calculating a parameter difference between each of the model parameters and a corresponding target mask parameter; Calculating the second-order partial derivative matrix of the adversarial loss function; The adversarial saliency value corresponding to each model parameter is calculated based on the parameter difference and the second-order partial derivative matrix.

[0009] In some embodiments, the pruning of the model parameters according to the adversarial significance value and a preset adversarial significance threshold to obtain the pruned original neural network model includes: Determining target pruning parameters according to the adversarial saliency value corresponding to each model parameter and the preset adversarial saliency threshold; The target pruning parameters are pruned according to a preset pruning ratio to obtain the pruned original neural network model.

[0010] In some embodiments, the step of performing adversarial training on the pruned original neural network model based on the training sample data and the adversarial sample image to obtain the forgery trace detection model includes: Performing preliminary training on the pruned original neural network model based on the training sample data; In response to the initially trained original neural network model satisfying a preset initial training condition, performing adversarial training on the initially trained original neural network model based on the training sample data and the adversarial sample image; In response to the original neural network model of the adversarial training satisfying a preset adversarial training condition, the forgery trace detection model is obtained.

[0011] In some embodiments, the step of performing compliance detection on the business image according to the forgery trace detection data and the target retrieval data to obtain image compliance detection information includes: In response to the forgery trace detection data indicating that the business image has no forgery traces, and the target retrieval data indicating that the target portrait information has no violation record in the object verification database, the image compliance detection information is indicated as a compliant image.

[0012] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides an image compliance detection device, the device comprising: An acquisition module, used to acquire a business image and a forgery trace detection model that has been pre-trained for adversarial training; wherein the business image is used to reflect target portrait information; a forgery detection module, configured to perform forgery trace detection on the business image using the forgery trace detection model to obtain forgery trace detection data corresponding to the business image; A retrieval module, used to retrieve the target portrait information in a preset object verification database to obtain target retrieval data; The compliance detection module is used to perform compliance detection on the business image according to the forgery trace detection data and the target retrieval data to obtain image compliance detection information.

[0013] To achieve the above objectives, a third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0014] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0015] The image compliance detection method and device, electronic device and storage medium proposed in the present application obtain a business image and a forgery trace detection model that has been pre-trained for adversarial training; wherein the business image is used to reflect the target portrait information; the business image is subjected to forgery trace detection through the forgery trace detection model to obtain forgery trace detection data corresponding to the business image; the target portrait information is retrieved in a preset object verification database to obtain target retrieval data; and the business image is subjected to compliance detection based on the forgery trace detection data and the target retrieval data to obtain image compliance detection information.

[0016] First, obtain the business image and use the forgery trace detection model to perform a preliminary analysis of the image. The adversarially trained neural network model can identify possible forgery traces in the image. Next, match and retrieve the target portrait information with the object verification library to determine whether the user has a violation record. The premise of this query is that the target portrait image must first pass the forgery trace detection to confirm that there are no forgery traces. If the forgery trace detection data shows that the image is authentic and has not been tampered with or forged, then the query result in the object verification library can be trusted. If there is no violation record of the target portrait in the object verification library, then the image can be considered compliant; conversely, if there is a violation record, the image may involve fraud or other non-compliant behavior. Through the above method, the accuracy of forgery detection of business images can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a flow chart of an image compliance detection method provided in an embodiment of the present application; Figure 2 yes Figure 1 The flowchart before step S101 in FIG. Figure 3 yes Figure 2 Flow chart of step S202 in FIG. Figure 4 yes Figure 2 Flow chart of step S208 in FIG. Figure 5 yes Figure 2Flow chart of step S209 in FIG. Figure 6 yes Figure 2 Flow chart of step S210 in FIG. Figure 7 yes Figure 1 Flow chart of step S104 in FIG. Figure 8 is a schematic diagram of the structure of an image compliance detection device provided in an embodiment of the present application; Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0019] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0021] First, some nouns involved in this application are analyzed: Artificial intelligence (AI) is a new technical science that studies and develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence. AI is a branch of computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can respond in a similar way to human intelligence. Research in this field includes robots, language recognition, image recognition, natural language processing and expert systems. AI can simulate the information process of human consciousness and thinking. AI is also a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0022] Adversarial Training: In the field of artificial intelligence, adversarial training is a technique that enhances the robustness of a model against adversarial attacks by injecting adversarial samples into the training process. Adversarial samples are samples that add artificial perturbations to the input data, making it difficult for the human eye to detect and can deceive and mislead the machine learning model. The idea of ​​adversarial training is to actively generate adversarial samples during the training process and mix them into the training data, forcing the model to learn the characteristics of the adversarial samples, thereby improving the robustness of adversarial attacks.

[0023] Adversarial Pruning: It is a method of compressing deep neural networks by adding adversarial perturbations. The goal is to remove as many redundant parameters in the network as possible while maintaining model performance, thereby compressing the model size. It attacks the current model by generating adversarial perturbations, mining those parameters that have little impact on model performance, and removing them. Unlike conventional pruning methods, adversarial pruning takes adversarial samples into account, thereby improving the robustness of the pruned model to adversarial attacks.

[0024] Based on this, the embodiments of the present application provide an image compliance detection method, apparatus and related equipment, aiming to improve the accuracy of forgery detection of business images.

[0025] The image compliance detection method, apparatus, and related equipment provided in the embodiments of the present application are specifically described through the following embodiments. First, the image compliance detection method in the embodiments of the present application is described.

[0026] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0027] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0028] The image compliance detection method provided in the embodiment of the present application relates to the field of artificial intelligence technology. The image compliance detection method provided in the embodiment of the present application can be applied to a terminal, can be applied to a server side, or can be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the image compliance detection method, etc., but is not limited to the above forms.

[0029] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0030] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0031] Figure 1 is an optional flowchart of the image compliance detection method provided in an embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S104.

[0032] Step S101, obtaining a business image and a forgery trace detection model that has been pre-trained for adversarial training.

[0033] Step S102: Perform forgery trace detection on the business image using a forgery trace detection model to obtain forgery trace detection data corresponding to the business image.

[0034] Step S103, searching the target portrait information in a preset object verification database to obtain target search data.

[0035] Step S104: Perform compliance detection on the business image according to the forgery trace detection data and the target retrieval data to obtain image compliance detection information.

[0036] Steps S101 to S104 shown in the embodiment of the present application are performed by obtaining a business image and performing a preliminary analysis on the image using a forgery trace detection model. The adversarially trained neural network model can identify possible forgery traces in the image. Next, the target portrait information is matched and retrieved with the object verification library to determine whether the user has a violation record. The premise of this query is that the target portrait image must first pass the forgery trace detection to confirm that there are no forgery traces. If the forgery trace detection data indicates that the image is authentic and has not been tampered with or forged, then the query results in the object verification library can be trusted. If there is no violation record of the target portrait in the object verification library, then the image can be considered compliant; conversely, if there is a violation record, the image may involve fraud or other non-compliant behavior. Through the above method, the accuracy of forgery detection of business images can be improved.

[0037] In step S101 of some embodiments, business images are usually used to verify the identity of the user, that is, to reflect the target portrait information, such as portrait photos submitted during the credit application process. These images may come from identity documents submitted by the user, such as passports, driver's licenses or ID cards, etc., which contain personal biometric information, such as facial photos. However, for users who have been included in the abnormal list of credit services, these images may be tampered with by users to bypass existing detection systems. In response to this, the forgery trace detection model that has been adversarially trained can detect any signs that may indicate that the image has been tampered with or forged. This includes but is not limited to pixel-level anomalies, unnatural noise patterns, inconsistent image features, etc. In this way, the model can identify advanced forgery techniques that may evade traditional detection methods.

[0038] See also Figure 2 In some embodiments, before step S101, it may also include pre-training the forgery trace detection model, including but not limited to steps S201 to S210: Step S201, obtaining an original neural network model and training sample data, wherein the training sample data includes training sample images and training sample labels corresponding to each training sample image.

[0039] Step S202: Generate a corresponding adversarial sample image based on each training sample image.

[0040] Step S203, for each model parameter in the original neural network model, generate a corresponding initial mask.

[0041] Step S204, parameterizing the original neural network model based on the initial mask and the corresponding model parameters.

[0042] Step S205, for each training sample image, based on the corresponding adversarial sample image, the corresponding training sample label and the parameterized original neural network model, calculate the adversarial loss function corresponding to each adversarial sample image.

[0043] Step S206, the corresponding initial mask is optimized by each adversarial loss function to obtain the target mask corresponding to each model parameter.

[0044] Step S207: mask the corresponding model parameters based on the target mask to obtain target mask parameters.

[0045] Step S208: For each model parameter, the adversarial saliency value is calculated based on the corresponding target mask parameter and the corresponding adversarial loss function.

[0046] Step S209, pruning the model parameters according to the adversarial significance value and the preset adversarial significance threshold to obtain a pruned original neural network model.

[0047] Step S210, based on the training sample data and the adversarial sample image, the pruned original neural network model is subjected to adversarial training to obtain a forgery trace detection model.

[0048] In step S201 of some embodiments, an original neural network model is first required as the basis for subsequent training and optimization. At the same time, it is also necessary to obtain training sample data, which usually includes a large number of images and their corresponding labels. These images can come from real financial business environments, such as identity verification photos submitted by customers, and the labels indicate the real category or attribute of the image. These data are the basis for the model to learn how to correctly classify and identify images during the training process.

[0049] In step S202 of some embodiments, tiny, usually imperceptible perturbations are introduced to the original image. These perturbations are specially designed to mislead the model into making wrong predictions while keeping the image appearance almost unchanged. Generating adversarial samples is a key step in adversarial training because it forces the model to learn how to resist these carefully designed attacks.

[0050] See also Figure 3 In some embodiments, step S202 may include but is not limited to steps S301 to S304: Step S301, for each training sample image, the corresponding loss gradient is calculated through the original neural network model.

[0051] Step S302: Generate adversarial perturbation information corresponding to each training sample image according to the loss gradient and the preset perturbation step size.

[0052] Step S303: Perform disturbance processing on the training sample image based on the adversarial disturbance information to obtain an intermediate sample image.

[0053] Step S304, based on the pixel values ​​of the training sample image and a preset pixel value range, normalize the pixel values ​​of the intermediate sample image to obtain an adversarial sample image.

[0054] In step S301 of some embodiments, the loss gradient indicates the rate of change of the loss function relative to each pixel of the input image. By calculating the loss gradient, it is possible to understand which pixel changes have the greatest impact on the prediction results of the model.

[0055] In step S302 of some embodiments, the perturbation step size is a hyperparameter that can control the magnitude of the perturbation introduced on the image. By combining the loss gradient and the perturbation step size, it can be determined how to add a tiny perturbation to the image to maximize the loss of the model, that is, to mislead the model to make an incorrect prediction. This step is the core of generating adversarial samples because it directly determines the effectiveness of adversarial samples.

[0056] In step S303 of some embodiments, the calculated perturbation is actually applied to the original image to generate preliminary adversarial samples. These intermediate sample images may be visually very similar to the original image, but may produce significant differences in the model's prediction.

[0057] In step S304 of some embodiments, it is necessary to perform pixel value normalization processing on the intermediate sample image to obtain the final adversarial sample image. This step is performed based on the pixel values ​​of the training sample image and a preset pixel value range. The normalization process ensures that the pixel values ​​of the adversarial sample image remain within an acceptable range, avoiding image distortion or unrecognizable problems caused by excessive disturbance.

[0058] Through steps S301 to S304, a set of effective adversarial samples can be generated, which are visually similar to the original training samples but can cause significant errors in model prediction. These adversarial samples will be used in subsequent adversarial training, which will challenge the robustness of the model and force the model to learn how to better generalize and resist potential attacks, thereby improving the application performance and security of the model in actual financial business.

[0059] In step S203 of some embodiments, in adversarial training, masking is an important technique for controlling the update of model parameters. In step S203, an initial mask is generated for each parameter in the model. These masks can be regarded as a weight matrix, which determines which parameters should be retained or updated and which should be ignored during the training process. The generation of the initial mask is the basis for model parameterization.

[0060] It is understandable that the initial mask can be set to 1, because at the beginning of training, all parameters can be considered equally important and do not need to be pruned.

[0061] In step S204 of some embodiments, after the initial mask is generated, it can be applied to the original neural network model to parameterize the model. This process involves multiplying each parameter of the model by its corresponding mask to obtain a new parameterized model, which will be updated according to the instructions of the mask during training, which helps the model focus on those parameters that have the greatest impact on the final prediction results.

[0062] In step S205 of some embodiments, for each training sample image, based on its corresponding adversarial sample image, original label and parameterized model, an adversarial loss function is calculated. The adversarial loss function is an indicator to measure the sensitivity of the model to adversarial samples, which reflects the performance of the model in the face of adversarial attacks. By minimizing this loss function, the model can be trained to recognize and resist adversarial samples, thereby improving the robustness of the model.

[0063] In step S206 of some embodiments, an adversarial loss function is used to guide the optimization of the initial mask. The purpose of this step is to minimize the adversarial loss by adjusting the mask, thereby enhancing the robustness of the model to adversarial samples. The optimization process usually uses gradient descent or other optimization algorithms to iteratively update the value of the mask until the optimal solution is found as the target mask. These target masks can minimize the sensitivity of the model to adversarial perturbations while maintaining accurate recognition of the original data.

[0064] In some embodiments, the execution of step S206 not only calculates the adversarial loss function, but also includes further optimizing the adversarial samples generated in step S202. The goal of this process is to find a way to maximize the adversarial loss function, thereby ensuring that the model can show maximum vulnerability when facing these adversarial samples. The reason for this is that by maximizing the adversarial loss, the weaknesses of the model can be more clearly identified and strengthened in a targeted manner. In the process of finding the optimal mask, the initial adversarial loss is first calculated based on the current adversarial sample, and this loss is used to update the mask. Then, the adversarial sample is regenerated using the updated mask, and the adversarial loss is calculated again. This process will be repeated until a set of masks is found that can minimize the model's loss to these samples while maximizing the adversarial loss.

[0065] In some embodiments, the formula for finding the target mask m* can be expressed as:

[0066] Among them, x represents the training sample image, y represents the label corresponding to the training sample image, represents the generated adversarial perturbation, Represented by model parameters Parameterized neural network. represents the initial mask, Represents Hession product, model parameter Size and mask The same size, In deep neural networks and The total size of is the set of continuous real numbers .

[0067] in, The model structure can adopt volume invariant flow and multi-scale convolution structure. Taking the input feature vector dimension of 512 as an example, the structure and calculation flow are described as follows: Split the 512-dimensional vector into two halves: x1 and x2. The vector value of x1 remains unchanged. Input x2 into an FC layer (a 256*256 matrix). Use the FC layer to perform a linear transformation, but the output dimension of x2 remains unchanged, still 256 dimensions. Then split the 256-dimensional layer into two halves: x3 and x4. Half of x3 remains unchanged, and the other half x4 is fed into another 128*128 matrix FC layer, which outputs a 128-dimensional vector. Repeat the above process until the other half of the dimension is reduced to 16. Then concatenate x1 in the first step, x3 in the second step, and so on until the final 16 dimensions. The concatenated vector is still a 1*512 dimensional vector. This process ensures that the volume of the dimension remains unchanged. At the same time, by scaling different dimensions at each step, the model can have different receptive fields and obtain feature information at different scales.

[0068] In step S207 of some embodiments, after obtaining the target mask, step S207 applies it to the model parameters for masking. This means that each model parameter will be adjusted according to its corresponding mask value. Parameters with mask values ​​close to 1 will remain unchanged, while parameters with mask values ​​close to 0 will be weakened or ignored. This step is essentially a structural compression of the model, retaining parameters that are critical to model performance, while removing those parameters that have little impact on model output or introduce overfitting.

[0069] In step S208 of some embodiments, the adversarial significance value of each model parameter can be calculated based on the target mask parameter and the adversarial loss function. This step is a quantitative assessment of the importance of the model parameters. Parameters with high adversarial significance values ​​have a greater impact on the prediction results of the model under adversarial attacks. Through this assessment, parameters that are critical to the robustness of the model can be identified.

[0070] See also Figure 4 In some embodiments, step S208 may include but is not limited to steps S401 to S403: Step S401, calculating the parameter difference between each model parameter and the corresponding target mask parameter.

[0071] Step S402, calculating the second-order partial derivative matrix of the adversarial loss function.

[0072] Step S403, calculating the adversarial saliency value corresponding to each model parameter based on the parameter difference and the second-order partial derivative matrix.

[0073] In step S401 of some embodiments, the target mask parameters are obtained through optimization processing, and they represent the ideal state of adjusting the model parameters during adversarial training. The parameter difference reflects the deviation between the original model parameters and these ideal states.

[0074] In step S402 of some embodiments, it is necessary to calculate the second-order partial derivative matrix of the adversarial loss function. The second-order partial derivative matrix, also known as the Hessian matrix, is a matrix containing the second-order partial derivatives of the loss function with respect to each model parameter. This matrix provides information about the curvature of the loss function, so that it is possible to evaluate how small changes in the model parameters affect the loss function. In adversarial training, the Hessian matrix helps to evaluate how model parameters interact with each other and how these interactions affect the robustness of the model to adversarial samples.

[0075] In step S403 of some embodiments, the adversarial saliency value corresponding to each model parameter may be calculated based on the calculated parameter difference and the second-order partial derivative matrix. The adversarial saliency value is a quantitative indicator used to measure the impact of each model parameter on the performance of the model under adversarial attacks. By analyzing these saliency values, parameters that are critical to the robustness of the model and those that may need further adjustment or pruning can be identified. It can be expressed as:

[0076] in, represents the generated adversarial sample, represents the generated adversarial perturbation, represents the parameter difference between the model parameters and the target mask parameters, and H represents the second-order partial derivative matrix.

[0077] In some embodiments, in order to obtain accurate adversarial saliency, it is necessary to consider the non-diagonal terms in the Hessian, but using the full Hessian will bring a huge burden. The Hessian matrix is ​​the Kronecker factor approximate curvature (K-FAC) corresponding to the machine learning model. Among them, the Kronecker factor approximate curvature can utilize the structural characteristics of the neural network weight matrix, especially the independence and linear properties between layers, to decompose the Hessian matrix of the entire machine learning model into multiple smaller, manageable Kronecker products. That is, K-FAC can combine the gradient statistics of the input and output of each layer in the machine learning model to form a matrix in the form of a Kronecker product, and use it as an approximation of the original Hessian matrix. By using the Kronecker factor to approximate the curvature, the computational cost can be greatly reduced, while providing sufficiently accurate curvature information to improve the performance of the optimization algorithm.

[0078] Through steps S401 to S403, it can be ensured that the model can maintain optimal performance when facing adversarial attacks. By identifying and strengthening these key parameters, the model's ability to detect forgery traces can be improved, while reducing dependence on unimportant parameters, which helps to improve the generalization ability of the model and reduce the risk of overfitting.

[0079] In step S209 of some embodiments, according to the adversarial significance value calculated in step S208, step S209 prunes the model parameters. This process involves removing parameters whose adversarial significance values ​​are lower than a preset threshold. The purpose of pruning is to further enhance the generalization ability of the model and reduce the sensitivity of the model to noise and adversarial disturbances. Through pruning, a more streamlined and robust model can be obtained, which can maintain a high accuracy rate in the face of adversarial attacks.

[0080] The constraint equation for trimming multiple parameters simultaneously can be written as:

[0081] In the extreme case, the kth mask is close to zero value, so that , then the above formula satisfies , the kth mask parameter is deleted to 0. When it approaches a certain value, At this time, the constraint equation satisfies , which means that at this time It is not a value to be deleted. If there is a value greater than 0 within 1, a smoothing parameter will be generated. This means that It has not been strictly deleted, but some parts are retained.

[0082] In some embodiments, the pruned model parameters are overfitted to certain specific adversarial examples and therefore cannot be generalized to other adversarial examples. Therefore, after calculating the adversarial saliency values ​​of all model parameters, the average of all adversarial saliency values ​​can be calculated to generalize across all data samples.

[0083] See also Figure 5 In some embodiments, step S209 may include but is not limited to steps S501 to S502: Step S501, determining target pruning parameters according to the adversarial saliency value corresponding to each model parameter and a preset adversarial saliency threshold.

[0084] Step S502, pruning the target pruning parameters according to a preset pruning ratio to obtain a pruned original neural network model.

[0085] In step S501 of some embodiments, the preset adversarial significant threshold is a hyperparameter used to determine which parameters have adversarial significant values ​​high enough to contribute significantly to the robustness of the model, and which are relatively low and may not have much impact on the performance of the model. By comparing the adversarial significant value of each parameter with the significant threshold, parameters whose adversarial significant values ​​are lower than the threshold can be identified. These parameters are considered to be target pruning parameters, which may contribute less to the prediction results of the model or easily introduce noise and instability under adversarial attacks.

[0086] In some embodiments, after step S208 is completed, the adversarial significant value of each model parameter is obtained. These significant values ​​quantify the impact of each parameter on the performance of the model under adversarial attack. By sorting these significant values, the parameters that contribute the least to the robustness of the model can be clearly identified, and the K model parameters with the least contribution can be determined as target pruning parameters.

[0087] In step S502 of some embodiments, the pruning ratio is another hyperparameter that defines the percentage of parameters that are desired to be removed from the model. This ratio can be set based on the size, complexity, or expected robustness level of the model. The pruning operation essentially sets the value of the target pruning parameter to zero or ignores it in other forms, thereby reducing the complexity of the model and focusing on those parameters that have a significant impact on performance.

[0088] Through step S501 to step S502, a pruned original neural network model can be obtained. This model has fewer parameters, but these parameters are crucial to the performance and robustness of the model. The pruned model can not only process input data more efficiently and reduce the consumption of computing resources, but also improve resistance to adversarial attacks because it removes parameters that are vulnerable to attacks.

[0089] In step S210 of some embodiments, the pruned model is subjected to adversarial training using the original training sample data and adversarial sample images. This step is to perform a final fine-tuning on the model to ensure that it can effectively identify and resist adversarial attacks in practical applications. During the adversarial training process, the model will continue to learn how to minimize adversarial losses while maintaining a high accuracy rate for the original data. After completing this step, a forgery trace detection model that has been adversarially trained can be obtained, which has the ability to identify and resist potential forgery in financial services.

[0090] See also Figure 6 In some embodiments, step S210 may include but is not limited to steps S601 to S603: Step S601, performing preliminary training on the pruned original neural network model based on training sample data.

[0091] Step S602, in response to the initial trained original neural network model satisfying a preset initial training condition, adversarial training is performed on the initial trained original neural network model based on training sample data and adversarial sample images.

[0092] Step S603, in response to the original neural network model of the adversarial training satisfying the preset adversarial training conditions, a forgery trace detection model is obtained.

[0093] In step S601 of some embodiments, only the training sample data is used to perform standard supervised learning on the pruned original neural network model. The goal of this stage is to allow the model to learn the basic patterns and distribution of the data, laying the foundation for subsequent adversarial training. The initial training does not directly involve adversarial samples, so fewer computing resources can be used and the training speed is faster.

[0094] In step S602 of some embodiments, unlike the traditional method of introducing adversarial samples from the beginning of training, the adversarial training here is introduced after the model has completed a certain period of preliminary training. This means that the model will not be disturbed by adversarial samples in the initial training stage, so that the basic characteristics of the data can be learned more quickly. When the model meets the preset preliminary training conditions, adversarial samples are introduced in the later stage of training. This training method allows the model to further learn how to resist adversarial attacks on the basis of being relatively stable.

[0095] In some embodiments, during the adversarial training phase, adversarial training can be performed periodically within a time interval t. This means that adversarial training is not performed continuously, but at certain time intervals, thereby reducing the overall time of adversarial training. This method allows the model to alternate between adversarial training and normal training, which helps to balance the performance of the model on normal samples and adversarial samples.

[0096] In step S603 of some embodiments, when the model meets preset conditions in adversarial training, such as reaching a certain accuracy or robustness standard on adversarial samples, the final forgery trace detection model is obtained.

[0097] Through the delayed adversarial training strategy of step S601 to step S603, the robustness of the model on adversarial samples can be improved without sacrificing the performance of the model on normal samples. At the same time, since adversarial training is introduced in the later stage of the training process and is performed in a periodic manner, the time required for adversarial training can be significantly reduced, thereby improving the efficiency of the training process. This method is particularly suitable for scenarios where models need to be deployed quickly, or where the model still needs to have a certain degree of adversarial robustness when computing resources are limited. In the financial field, this training method can effectively improve the performance of the forgery trace detection model while controlling training costs and time.

[0098] Through the above steps S201 to S210, the obtained forgery trace detection model has been significantly improved in terms of accuracy, robustness, generalization ability, security and efficiency.

[0099] In step S102 of some embodiments, the business image is detected for forgery traces by a forgery trace detection model. This step is the core of the detection process. The model will analyze various features in the image, including pixel changes, noise patterns, etc., to identify any signs that may indicate that the image has been tampered with or forged. The detection results will be presented in the form of forgery trace detection data for subsequent compliance assessment.

[0100] In step S103 of some embodiments, it is first necessary to extract the target portrait information from the business image. This may involve image preprocessing, such as cropping, scaling, rotation correction, etc., to ensure the accuracy and consistency of the portrait information. The extracted portrait information may include facial feature points, contours, textures, etc., which will be used to compare with the records in the database.

[0101] In some embodiments, the object verification database can be an exception list database, which is a database containing known bad actors or high-risk customers. These records can be based on historical transaction data and publicly available bad credit records, etc. When the target portrait information is compared with the records in the exception list, if a match is found, that is, the portrait in the image matches the portrait in the exception list database, then the corresponding target retrieval data needs to output the matching result for subsequent compliance testing.

[0102] In step S104 of some embodiments, step S104 is to perform compliance detection on the business image based on the forgery trace detection data and the target retrieval data. This step combines the results of the first two steps to comprehensively evaluate the compliance of the image. If the forgery trace detection data indicates that there are suspicious traces in the image, or the target retrieval data does not match the information in the database, then the image may be judged as non-compliant. On the contrary, if the results of both steps indicate that there is no problem with the image, then the image will be judged as compliant and the subsequent financial business process can continue.

[0103] See also Figure 7 In some embodiments, step S104 may include but is not limited to step S701: Step S701, in response to the forgery trace detection data indicating that the business image has no forgery traces, and the target retrieval data indicating that the target portrait information has no violation record in the object verification database, indicating that the image compliance detection information is a compliant image.

[0104] In step S701 of some embodiments, the forgery trace detection data needs to be analyzed first. If the detection data indicates that the business image does not have forgery traces, that is, the model does not find any abnormality or signs of tampering in the image, it means that the image has passed the preliminary screening of forgery traces.

[0105] Next, the target retrieval data needs to be analyzed. If the target retrieval data indicates that there is no violation record in the object verification database for the target portrait information, such as no entries matching the abnormal list or suspicious behavior, this further confirms that the portrait information in the image is real and credible.

[0106] Combining these two pieces of information, step S701 ultimately indicates that the image compliance detection information is a compliant image. This means that the business image not only shows no signs of forgery at the technical level, but also no signs of violation or fraud at the database verification level. Therefore, the image is deemed to meet the compliance standards set by the financial institution and can be used to support related financial transactions and business processes.

[0107] See also Figure 8The present application also provides an image compliance detection device, which can implement the above-mentioned image compliance detection method, and the device includes: The acquisition module is used to acquire business images and a forgery trace detection model that has been pre-trained for adversarial training; wherein the business images are used to reflect the target portrait information.

[0108] The forgery detection module is used to perform forgery trace detection on the business image through a forgery trace detection model to obtain forgery trace detection data corresponding to the business image.

[0109] The retrieval module is used to retrieve the target portrait information in a preset object verification database to obtain target retrieval data.

[0110] The compliance detection module is used to perform compliance detection on business images based on forgery trace detection data and target retrieval data to obtain image compliance detection information.

[0111] The specific implementation of the image compliance detection device is basically the same as the specific implementation of the above-mentioned image compliance detection method, and will not be repeated here.

[0112] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned image compliance detection method when executing the computer program. The electronic device can be any smart terminal including a tablet computer, a car computer, etc.

[0113] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes: The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application; The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the image compliance detection method of the embodiment of this application; Input / output interface 903, used to implement information input and output; Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.); A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904); The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0114] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned image compliance detection method is implemented.

[0115] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0116] The image compliance detection method, device, electronic device and storage medium provided in the embodiments of the present application obtain a business image and a forgery trace detection model that has been pre-trained for adversarial training; wherein the business image is used to reflect the target portrait information; the business image is subjected to forgery trace detection by the forgery trace detection model to obtain forgery trace detection data corresponding to the business image; the target portrait information is retrieved in a preset object verification database to obtain target retrieval data; and the business image is subjected to compliance detection based on the forgery trace detection data and the target retrieval data to obtain image compliance detection information.

[0117] First, obtain the business image and use the forgery trace detection model to perform a preliminary analysis of the image. The adversarially trained neural network model can identify possible forgery traces in the image. Next, match and retrieve the target portrait information with the object verification library to determine whether the user has a violation record. The premise of this query is that the target portrait image must first pass the forgery trace detection to confirm that there are no forgery traces. If the forgery trace detection data shows that the image is authentic and has not been tampered with or forged, then the query result in the object verification library can be trusted. If there is no violation record of the target portrait in the object verification library, then the image can be considered compliant; conversely, if there is a violation record, the image may involve fraud or other non-compliant behavior. Through the above method, the accuracy of forgery detection of business images can be improved.

[0118] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0119] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0120] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0121] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0122] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0123] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0124] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0125] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0126] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0127] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store programs.

[0128] The preferred embodiments of the present application are described above with reference to the accompanying drawings, but the scope of the rights of the present application is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present application should be within the scope of the rights of the present application.

Claims

1. A method for image compliance detection, characterized in that: The method comprises: Obtaining a business image and a forgery trace detection model that has been pre-trained for adversarial training; wherein the business image is used to reflect target portrait information; Performing forgery trace detection on the business image by using the forgery trace detection model to obtain forgery trace detection data corresponding to the business image; Retrieving the target portrait information in a preset object verification database to obtain target retrieval data; According to the forgery trace detection data and the target retrieval data, compliance detection is performed on the business image to obtain image compliance detection information.

2. The method according to claim 1, characterized in that Before acquiring the business image and the forgery trace detection model that has been pre-trained for adversarial training, the forgery trace detection model is also pre-trained for adversarial training, specifically including: Acquire an original neural network model and training sample data; wherein the training sample data includes training sample images and training sample labels corresponding to each training sample image; Generate a corresponding adversarial sample image based on each of the training sample images; For each model parameter in the original neural network model, generating a corresponding initial mask; Parameterizing the original neural network model based on the initial mask and the corresponding model parameters; For each of the training sample images, based on the corresponding adversarial sample image, the corresponding training sample label and the parameterized original neural network model, calculate the adversarial loss function corresponding to each of the adversarial sample images; Obtaining a target mask corresponding to each of the model parameters by optimizing the initial mask corresponding to each of the adversarial loss functions; Performing mask processing on the corresponding model parameters based on the target mask to obtain target mask parameters; For each of the model parameters, calculating an adversarial saliency value based on the corresponding target mask parameter and the corresponding adversarial loss function; Pruning the model parameters according to the adversarial significance value and a preset adversarial significance threshold to obtain the pruned original neural network model; Based on the training sample data and the adversarial sample image, adversarial training is performed on the pruned original neural network model to obtain the forgery trace detection model.

3. The method according to claim 2, characterized in that The generating a corresponding adversarial sample image based on each of the training sample images comprises: For each of the training sample images, the corresponding loss gradient is calculated by the original neural network model; Generating adversarial perturbation information corresponding to each of the training sample images according to the loss gradient and a preset perturbation step size; Performing a perturbation process on the training sample image based on the adversarial perturbation information to obtain an intermediate sample image; Based on the pixel value of the training sample image and a preset pixel value range, the pixel value of the intermediate sample image is normalized to obtain the adversarial sample image.

4. The method according to claim 2, characterized in that: For each of the model parameters, calculating the adversarial saliency value based on the corresponding target mask parameter and the corresponding adversarial loss function includes: Calculating a parameter difference between each of the model parameters and a corresponding target mask parameter; Calculating the second-order partial derivative matrix of the adversarial loss function; The adversarial saliency value corresponding to each model parameter is calculated based on the parameter difference and the second-order partial derivative matrix.

5. The method according to claim 2, characterized in that: The step of pruning the model parameters according to the adversarial significant value and a preset adversarial significant threshold to obtain the pruned original neural network model includes: Determining target pruning parameters according to the adversarial saliency value corresponding to each model parameter and the preset adversarial saliency threshold; The target pruning parameters are pruned according to a preset pruning ratio to obtain the pruned original neural network model.

6. The method according to claim 2, characterized in that The method of performing adversarial training on the pruned original neural network model based on the training sample data and the adversarial sample image to obtain the forgery trace detection model includes: Performing preliminary training on the pruned original neural network model based on the training sample data; In response to the initially trained original neural network model satisfying a preset initial training condition, performing adversarial training on the initially trained original neural network model based on the training sample data and the adversarial sample image; In response to the original neural network model of the adversarial training satisfying a preset adversarial training condition, the forgery trace detection model is obtained.

7. The method according to claim 1, characterized in that The step of performing compliance detection on the business image according to the forgery trace detection data and the target retrieval data to obtain image compliance detection information includes: In response to the forgery trace detection data indicating that the business image has no forgery traces, and the target retrieval data indicating that the target portrait information has no violation record in the object verification database, the image compliance detection information is indicated as a compliant image.

8. An image compliance detection device, characterized in that: The device comprises: An acquisition module, used to acquire a business image and a forgery trace detection model that has been pre-trained for adversarial training; wherein the business image is used to reflect target portrait information; a forgery detection module, configured to perform forgery trace detection on the business image using the forgery trace detection model to obtain forgery trace detection data corresponding to the business image; A retrieval module, used to retrieve the target portrait information in a preset object verification database to obtain target retrieval data; The compliance detection module is used to perform compliance detection on the business image according to the forgery trace detection data and the target retrieval data to obtain image compliance detection information.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the image compliance detection method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the image compliance detection method according to any one of claims 1 to 7 is implemented.

Images