Detection method and system of confrontation sample and electronic equipment

Abstract

The invention discloses an adversarial sample detection method and system and electronic equipment, and the method comprises the steps: inputting to-be-detected target images into a classifier, and obtaining classification labels corresponding to the to-be-detected target images; inputting the target images to be detected and the classification labels corresponding to the target images to be detected into a trained sequence condition variation auto-encoder to obtain reconstructed images of the target images to be detected output by the sequence condition variation auto-encoder; and determining whether the to-be-detected target image is an adversarial sample or not according to the reconstructed image. According to the method provided by the embodiment of the invention, the classification label and the to-be-detected target image are synchronously input into the trained sequence condition variation auto-encoder to improve the difference between the adversarial sample and the original sample, so that the adversarial sample can be detected more accurately, the accuracy rate, the precision rate and the recall rate of detection are improved, and the method has wide applicability.

Description

Technical Field

[0001] The present invention relates to the field of image recognition technology, and in particular to a detection method, system and electronic equipment for adversarial samples. Background Art

[0002] Adversarial samples refer to input samples formed by intentionally adding subtle interference to the data set. These interferences cause the model to give an erroneous output with high confidence. When training a machine learning model, by adding adversarial samples, the model can better adapt to adversarial sample attacks, thereby improving the model's anti-interference ability. The study of adversarial samples is of great significance in application scenarios such as autonomous driving and smart homes.

[0003] At present, the method for detecting adversarial samples is generally to input the training adversarial samples and the original images into the deep learning model, train the deep learning model, and generate an adversarial sample detector. The adversarial sample detector is used to detect adversarial samples. However, the adversarial sample detector generated by this method is only effective for adversarial samples of the same type as the training adversarial samples. If the adversarial sample to be detected is different from the training adversarial sample, it cannot give an effective detection result. If an adversarial sample detector suitable for all types is required, the deep learning model needs to be trained using all types of training adversarial samples, which makes the training process complicated and costly.

[0004] Therefore, the prior art needs to be further improved. Summary of the invention

[0005] The purpose of the present invention is to provide a method, system and electronic device for detecting adversarial samples, so as to overcome the defect of low detection accuracy of adversarial samples in the prior art.

[0006] The technical solution adopted by the present invention to solve the technical problem is as follows:

[0007] In a first aspect, the present application discloses a method for detecting adversarial samples, which includes:

[0008] Input the target image to be tested into the classifier to obtain the classification label corresponding to each target image to be tested;

[0009] Inputting the target images to be tested and the classification labels corresponding to the target images to be tested into the trained sequence conditional variational autoencoder to obtain the reconstructed images of the target images to be tested output by the sequence conditional variational autoencoder;

[0010] Determine whether the target image to be tested is an adversarial sample according to the reconstructed image.

[0011] Optionally, the step of generating the sequence conditional variational autoencoder includes:

[0012] Input the training sample data into the classifier to obtain the classification label corresponding to each training sample data output by the classifier;

[0013] The training sample data and the classification labels corresponding to the training sample data are input into the conditional variational autoencoder to obtain the variational autoencoder after training; wherein the training sample data only contains original samples.

[0014] Optionally, the structure and parameters of the classifier are the same as those of the encoder of the conditional variational autoencoder.

[0015] Optionally, the structure of the conditional variational autoencoder includes an encoder and a decoder, the encoder is composed of a convolutional neural network, and the decoder is composed of a deconvolutional neural network.

[0016] Optionally, the step of determining whether the target image to be tested is an adversarial sample according to the reconstructed image includes:

[0017] Calculate the difference between the reconstructed image and the target image to be measured;

[0018] It is determined whether the difference is greater than a preset detection threshold. If the difference is greater than the preset detection threshold, the target image to be tested is an adversarial sample.

[0019] Optionally, the specific method for calculating the difference between the reconstructed image and the target image to be measured is:

[0020] Calculate the KL divergence and reconstruction error between the target image to be tested and the reconstructed image respectively;

[0021] The difference between the target image to be measured and the reconstructed image is calculated according to the KL divergence and the reconstruction error.

[0022] Optionally, the calculation formula of the reconstruction error is:

[0023]

[0024] Among them, L llike is the reconstruction error, L is the dimension of the latent variable Z, q θ is the probability distribution of the output reconstructed image; x is the input target image to be tested, y is the output reconstructed image, z (l) is a function related to x and y;

[0025] z (l) =g φ (x,y,∈ (l) );

[0026] Among them, ∈ (l) :N(0,I);g φis a differentiable function, N is the standard normal distribution, and I is the standard deviation.

[0027] Optionally, the target image to be detected contains a target object, and the target object is a face, a number or an animal.

[0028] In a second aspect, the present application also discloses a detection system for adversarial samples, which includes:

[0029] A label generation module is used to input the target image to be tested into the classifier to obtain a classification label corresponding to each target image to be tested;

[0030] A reconstruction module, used for inputting the target image to be tested and the classification label corresponding to each target image to be tested into the trained sequence conditional variational autoencoder, and obtaining the reconstructed image of each target image to be tested output by the sequence conditional variational autoencoder;

[0031] The adversarial sample determination module is used to determine whether the target image to be tested is an adversarial sample according to the reconstructed image.

[0032] In a third aspect, the present application further discloses an electronic device, wherein the electronic device implements the detection method as described above through hardware or through hardware executing corresponding software, and the hardware or the software includes one or more modules corresponding to the detection method.

[0033] Beneficial effects:

[0034] The present embodiment discloses a detection method, system and electronic device for adversarial samples, which obtains classification labels corresponding to each target image to be tested by inputting the target image to be tested into a classifier; inputting the target image to be tested and the classification labels corresponding to each target image to be tested into a trained sequential conditional variational autoencoder to obtain a reconstructed image of each target image to be tested output by the sequential conditional variational autoencoder; and determining whether the target image to be tested is an adversarial sample based on the reconstructed image. The method of the present embodiment synchronously inputs the classification label and the target image to be tested into the trained sequential conditional variational autoencoder to increase the difference between the adversarial sample and the original sample, thereby achieving more accurate detection of adversarial samples and improving the accuracy, precision and recall of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A flowchart of a method for detecting adversarial samples according to an embodiment of the present invention;

[0036] Figure 2 Schematic diagram of the principle structure of SCVAE in an embodiment of the present invention;

[0037] Figure 32 is a schematic diagram of the principle structure of the detection system for adversarial samples in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0039] Adversarial samples refer to input samples generated by intentionally adding subtle perturbations to the data, which can cause the neural network model to give an incorrect test result. They are used to evaluate the robustness and generalization ability of the neural network model, and then help improve the robustness of the neural network model.

[0040] The traditional method of adversarial sample detection is to extract the features of the sample to be tested, compare the extracted features with the features of the training sample, and determine whether it is an adversarial sample. This method is suitable for the case where there is a significant difference between the adversarial sample and the normal sample, and can achieve better detection results. If the difference between the adversarial sample and the normal sample is small, it is impossible to obtain a better detection effect. At present, there is also a model-based detection method. The model-based detection method is to determine whether the sample to be tested is an adversarial sample by constructing a detection model. The model is usually trained for a specific task, such as image classification, speech recognition, etc. This method has higher detection accuracy than the traditional adversarial sample detection method, but it has certain requirements for the category of adversarial sample detection and is limited to the detection of a certain category, so it does not have wide applicability. In addition, if a high recognition accuracy is to be achieved, a large number of training samples are required to train the model, which makes the training process complicated and the cost of training the model high.

[0041] In order to overcome the above problems, the present embodiment provides a method, system and electronic device for detecting adversarial samples, firstly obtaining the classification label of the target image to be tested, then inputting the target image to be tested and its classification label into a trained sequential conditional variational autoencoder to obtain a reconstructed image output by the sequential conditional variational autoencoder; and determining whether the target image to be tested is an adversarial sample according to the reconstructed image. The method of the present embodiment synchronously inputs the classification label and the target image to be tested into the trained sequential conditional variational autoencoder to increase the difference between the adversarial sample and the original sample, thereby achieving more accurate detection of adversarial samples and improving the accuracy, precision and recall of detection.

[0042] The adversarial sample detection method, system, and electronic device disclosed in this embodiment are further described below in conjunction with the accompanying drawings.

[0043] like Figure 1As shown, this embodiment discloses a method for detecting adversarial samples, and the method for detecting adversarial samples specifically includes:

[0044] Step S1: input the target image to be tested into a classifier to obtain a classification label corresponding to each target image to be tested.

[0045] In this step, the target image to be tested can be a face image, an animal image or an image with numbers, and the target object contained in the target image to be tested can be a face, a number or an animal. When the target image to be tested is a face, the adversarial sample is a face image. This method is to implement adversarial sample testing in face image recognition in order to enhance the accuracy of face recognition by the face recognition model. When the image to be tested is a number, it can be used to identify digital images with numbers to enhance the accuracy of numbers recognized by the trained digital recognition model. When the target image to be tested is an animal, the target image to be tested may be an adversarial sample of an animal image generated to train an image recognition model for accurately identifying animals in the image to improve the accuracy of animal recognition in the image recognition model.

[0046] Before inputting the target image to be tested into the classifier to obtain the classification label, this step also includes: using a variational autoencoder (VAE) to generate adversarial samples.

[0047] Since VAE can obtain the latent variables of samples after encoding them, these latent variables can be used to generate new samples that obey the distribution of training samples. After data dimensionality reduction, the encoding is obtained and then decoded, only the unimportant part of the data is lost, so VAE can be used to resist the attack of adversarial samples.

[0048] Combination Figure 2 As shown, in this step, the target image to be tested is first input into the classifier, and the classification label of the target image to be tested is obtained by the classifier. The classification label is the category identification output by the classifier after analyzing the target image to be tested. The category identification varies according to the characteristics of the image. For example, when performing an image classification task, the classification labels output by the classifier can be different animals. When the classifier receives an image, it may determine which category the image is most likely to belong to based on the color, shape or texture of the image, and output the corresponding classification label.

[0049] Step S2: input the target image to be tested and the classification label corresponding to each target image to be tested into the trained sequential conditional variational autoencoder to obtain the reconstructed image of each target image to be tested output by the sequential conditional variational autoencoder.

[0050] The target image to be tested and the classification label corresponding to the target image to be tested are input into the trained sequential conditional variational autoencoder together, thereby obtaining a reconstructed image output by the sequential conditional variational autoencoder.

[0051] Specifically, the classification label is the classification label obtained by the classifier in the above step. For the original sample, the classification label is the correct classification label, but for the adversarial sample, the classification label may be an incorrect classification label. For example: if the number on the adversarial sample is 2, then the adversarial sample is input into the classifier, and the classifier may misidentify the adversarial sample, and the output classification label may be 0. In this step, the adversarial sample is input into the sequence conditional variational autoencoder as the target image to be tested and the classification label 0, thereby obtaining the reconstructed image of the adversarial sample.

[0052] An autoencoder is a neural network with encoding and decoding functions. It can reconstruct the high-dimensional features of input data by learning the compressed representation of input data. An autoencoder is usually composed of two parts: an encoder and a decoder. The encoder compresses the input data into a low-dimensional representation, and the decoder restores the original input data from the low-dimensional representation.

[0053] Variational Autoencoder (VAE) introduces a probability model based on the autoencoder, interprets the encoder output as a probability distribution, and uses variational inference to estimate the posterior distribution of latent variables.

[0054] Conditional Variational Autoencoder (CVAE) is a variant of VAE, which introduces additional conditional variables in the encoding and decoding process so that the generated samples can be controlled by external conditions. These conditional variables can be category labels, attribute descriptions, etc.

[0055] Sequential Conditional Variational Autoencoder (SCVAE) is a model that applies the concept of CVAE to sequence data. It can not only process the temporal characteristics of sequence data, but also introduce conditional variables in the generation process to achieve conditional generation. SCVAE also consists of two parts: encoder and decoder. The encoder is responsible for mapping sequence data to a sequence of latent variables in the latent space. The decoder reconstructs or generates sequence data based on these latent variable sequences and conditional variables.

[0056] Specifically, the generation step of the sequence conditional variational autoencoder includes:

[0057] Step S21: input the training sample data into the classifier to obtain the classification label corresponding to each training sample data output by the classifier, wherein the training sample data only contains the original sample.

[0058] First, collect the training sample data and input the training sample data into the classifier to obtain the classification label output by the classifier. Specifically, the training sample data only contains the original samples and does not contain adversarial samples. Therefore, when the training sample data is input into the classifier, the classification labels corresponding to the original samples are obtained.

[0059] Step S22: input the training sample data and the classification labels corresponding to the training sample data into the conditional variational autoencoder to obtain the trained sequence conditional variational autoencoder.

[0060] The training sample data and its corresponding classification labels are then input into the conditional variational autoencoder, which extracts the implicit feature space of the original sample. After the conditional variational autoencoder is trained using the training sample data and its classification labels, a trained sequence conditional variational autoencoder is obtained.

[0061] In order to achieve a greater difference between the reconstructed image generated by the adversarial sample and the adversarial sample during the detection process, in one implementation, the structure and parameters of the classifier model are the same as those of the encoder of the conditional variational autoencoder.

[0062] Specifically, the structure of the conditional variational autoencoder includes an encoder and a decoder, the encoder is composed of a convolutional neural network, and the decoder is composed of a deconvolutional neural network.

[0063] Step S3: Determine whether the target image to be tested is an adversarial sample according to the reconstructed image.

[0064] When the sequence conditional variational autoencoder in the above steps outputs a reconstructed image, it can be determined whether the target image to be tested is an adversarial sample based on the reconstructed image.

[0065] Specifically, the step of determining whether the target sample image to be tested is an adversarial sample according to the reconstructed image includes:

[0066] Calculate the difference between the reconstructed image and the target image to be tested; determine whether the difference is greater than a preset detection threshold, if the difference is greater than the preset detection threshold, the target image to be tested is an adversarial sample.

[0067] In this step, the difference between the reconstructed image and the target image to be tested is calculated, and whether the target image to be tested is an adversarial sample is determined according to the size of the difference. Specifically, there are many ways to calculate the difference between the two images, such as the mean square error (MSE) method, by calculating the average value of the square difference between the pixels of the two images, according to the pixel values ​​of the target image to be tested and the reconstructed image at different positions, as well as the width and height of the image. The smaller the value of the mean square error, the more similar the two images are, and the smaller the difference. The error between the two images can also be calculated by calculating the structural similarity index (SSIM). The structural similarity index evaluates the quality of the image by comparing the similarity of the brightness, contrast and structural information of the image. A higher structural similarity index indicates a higher similarity. The difference between the two images can also be compared by calculating the normalized mean square error. The normalized mean square error is normalized by dividing the MSE by the sum of the pixel values ​​of the original image.

[0068] In one embodiment, the specific method for calculating the difference between the reconstructed image and the target image to be measured is: respectively calculating the KL divergence and reconstruction error between the target image to be measured and the reconstructed image; and calculating the difference between the target image to be measured and the reconstructed image based on the KL divergence and reconstruction error.

[0069] The difference between the two images can be accurately calculated by calculating the KL divergence and reconstruction error between the two images. KL divergence is a concept in vector analysis that describes the strength of the "source" or "sink" of a vector field at a certain point. The reconstruction error is a concept used to measure the difference between the reconstructed image and the target image to be measured. The reconstruction difference includes but is not limited to pixel-level error, feature-level error, and structure-level error.

[0070] In this step, the KL divergence and reconstruction error between the two images are comprehensively considered to determine the difference between the reconstructed image and the target image to be tested, thereby identifying adversarial samples.

[0071] Specifically, the calculation formula of the reconstruction error is:

[0072]

[0073] Among them, L llike is the reconstruction error, L is the dimension of the latent variable Z, q θ is the probability distribution of the output reconstructed image; x is the input target image to be tested, y is the output reconstructed image, z (l) is a function related to x and y;

[0074] z (l) =g φ (x,y,∈ (l) );

[0075] Among them, ∈ (l) :N(0,I);g φ is a differentiable function whose purpose is to back propagate (reparameterize) the error of the latent variable. N is the standard normal distribution and I is the standard deviation.

[0076] The calculation formula of KL divergence is:

[0077] L prior =-KL(p φ (z|x,y)||q θ (z|x));

[0078] Among them, KL represents the overall divergence, p φ (z|x,y) represents the prior probability, q θ (z|x) represents the distribution probability.

[0079] The total difference is calculated as:

[0080]

[0081] Among them, L G It represents the total difference between the target image to be measured and the reconstructed image.

[0082] Furthermore, assuming that p φ (z|x,y) and q θ (z|x) are all obedient and The probability density function of a random variable, then the KL divergence from p to q is defined as:

[0083] KL(q||p)=∫[log p(x)-log q(x)]p(x)dx

[0084] =∫[p(x)log p(x)-p(x)log q(x)]dx;

[0085] in,

[0086]

[0087]

[0088] The method of this embodiment is further described in more detail below by taking the target image to be tested disclosed in this embodiment as the target animal image.

[0089] Based on VAE's excellent sample generation ability, VAE can obtain the latent variables of the samples after encoding them, which is the manifold representation of high-dimensional data in low-micro space. These latent variables can be used to generate new samples that obey the distribution of training samples. After data dimensionality reduction, the encoding is obtained, and then decoding will lose unimportant data. Therefore, VAE can be used to defend against adversarial samples, because the adversarial perturbation in the image will be partially "denoised" after encoding and decoding. This is why VAE can be used to defend against adversarial samples.

[0090] In the specific implementation, taking the CIFAR-10 dataset as an example, a VAE was trained. In the encoding stage, the size of the input digital image is 32×32×3, the convolution kernel size used in the convolution operation is 3×3, the convolution step is 2, the filter depth is 128, the activation function is ReLU, and the image edge zero padding is in the form of "SAME". In the decoding stage, the latent variable is first subjected to a 4×4×256 Dense operation, then a Reshape operation is performed to obtain the features of the latent variable, and finally a deconvolution operation is performed to obtain a reconstructed image of the 32×32×3 digital image.

[0091] First, use the adversarial attack algorithm DeepFooL to generate adversarial samples of digital images generated by VAE using the above steps, and then use the method obtained in the above steps to detect the adversarial samples of digital images generated in the above steps.

[0092] Furthermore, when using the sequence conditional variational autoencoder to detect adversarial samples, the training data is first trained based on the conditional variational autoencoder to obtain the sequence conditional variational autoencoder generated by the training. When training the sequence conditional variational autoencoder, first select the sequence data as input. In one implementation, the type of training data is selected to be the same type of data as the adversarial sample to be detected, so the sequence data corresponding to the digital image can be selected as the training data for training the sequence conditional variational autoencoder. During the training process, the reconstruction loss and KL divergence are used as loss functions. By calculating the total loss corresponding to the loss function of each iterative training, the loss is back-propagated to each layer of the conditional variational autoencoder through optimization algorithms such as gradient descent, and the parameters are updated. The training steps are repeated until the performance of the conditional variational autoencoder on the validation set reaches stability or the preset number of iterations is completed.

[0093] Before using the trained sequence conditional variational autoencoder to detect the adversarial samples of the digital images generated in the above steps, it is necessary to input the digital images into the classifier to obtain the classification labels output by the classifier. For example: after inputting digital image 1 into the classifier, the classification label output by the classifier is 1, and after inputting digital image 2 (adversarial sample) into the classifier, the classification label output by the classifier is 0.

[0094] Then, the digital image and the corresponding classification label output by the classifier are input into the trained sequential conditional variational autoencoder. That is, the digital image 1 and its corresponding classification label 1, and the digital image 2 and its corresponding classification label 0 are input into the sequential conditional variational autoencoder in sequence. Then, the sequential conditional variational autoencoder reconstructs the digital image 1 and obtains a reconstructed image of 1, while the sequential conditional variational autoencoder reconstructs the digital image 2 and obtains a reconstructed image of 0.

[0095] The difference between each digital image and its corresponding reconstructed image bracket is calculated respectively, and the difference is compared with the preset detection threshold. If the difference is greater than the preset detection threshold, the digital image is an adversarial sample, otherwise it is a normal sample.

[0096] The method disclosed in this embodiment proposes a sequence conditional variational autoencoder to detect adversarial samples. When training the sequence conditional variational autoencoder, only the original data is trained. Therefore, the trained sequence conditional variational autoencoder only has the characteristic of accurately identifying the implicit feature space of the original data. When the input data is an adversarial sample, the error between the obtained output reconstructed image and the input adversarial sample is much larger than that of the normal sample, and then the optimal threshold is set to determine whether the input sample is an adversarial sample, thereby achieving accurate detection of the adversarial sample.

[0097] In addition to the above detection method, this embodiment also discloses a detection system for adversarial samples. Figure 3 As shown, including:

[0098] The label generation module 310 is used to input the target images to be tested into the classifier to obtain classification labels corresponding to each target image to be tested; its function is as described in step S1.

[0099] The reconstruction module 320 is used to input the target image to be tested and the classification label corresponding to each target image to be tested into the trained sequential conditional variational autoencoder to obtain the reconstructed image of each target image to be tested output by the sequential conditional variational autoencoder; its function is as described in step S2.

[0100] The adversarial sample determination module 330 is used to determine whether the target image to be tested is an adversarial sample according to the reconstructed image, and its function is as described in step S3.

[0101] Furthermore, the system also includes: a model generation module.

[0102] The model generation module is used to input the training sample data into the classifier to obtain the classification label corresponding to each training sample data output by the classifier; input the training sample data and the classification label corresponding to the training sample data into the conditional variational autoencoder to obtain the variational autoencoder that has been trained; wherein the training sample data only contains original samples.

[0103] Furthermore, the structure and parameters of the classifier model are the same as those of the encoder of the conditional variational autoencoder.

[0104] Furthermore, the structure of the conditional variational autoencoder includes an encoder and a decoder, the encoder is composed of a convolutional neural network, and the decoder is composed of a deconvolutional neural network.

[0105] Specifically, the adversarial sample determination module includes: a difference calculation unit and a difference determination unit.

[0106] A difference calculation unit, used for calculating the difference between the reconstructed image and the target image to be measured;

[0107] The difference determination unit is used to determine whether the difference is greater than a preset detection threshold. If the difference is greater than the preset detection threshold, the target image to be tested is an adversarial sample.

[0108] Furthermore, the specific method for calculating the difference between the reconstructed image and the target image to be measured is:

[0109] Calculate the KL divergence and reconstruction error between the target image to be tested and the reconstructed image respectively;

[0110] The difference between the target image to be measured and the reconstructed image is calculated according to the KL divergence and the reconstruction error.

[0111] Specifically, the calculation formula of the reconstruction error is:

[0112]

[0113] Among them, L llike is the reconstruction error, L is the dimension of the latent variable Z, q θ is the probability distribution of the output reconstructed image; x is the input target image to be tested, y is the output reconstructed image, z (l) is a function related to x and y;

[0114] z (l) =g φ (x,y,∈ (l) );

[0115] Among them, ∈ (l) :N(0,I);g φ is a differentiable function, N is the standard normal distribution, and I is the standard deviation.

[0116] In a specific application embodiment, the target image to be tested contains a target object, and the target object is a human face, a number or an animal. The method and system provided in this embodiment can be used to detect adversarial samples of different types of images to improve the accuracy and precision of adversarial samples.

[0117] This embodiment also discloses an electronic device, which implements the detection method as described above through hardware or through hardware executing corresponding software, and the hardware or the software includes one or more modules corresponding to the detection method.

[0118] The adversarial samples generated by four mechanisms such as FGSM are tested in the MNIST, Fashion-MNIST, and CIFAR-10 datasets respectively. The obtained data are shown in Table 1.

[0119] Table 1 is a comparison of the classification accuracy of four adversarial attack algorithms (CIFAR-10)

[0120]

[0121]

[0122] From the above experimental data, we can see that SCVAE sequence variational autoencoder improves the accuracy, precision and recall of detecting adversarial samples, and has better detection accuracy, precision and recall for adversarial samples with low perturbations.

[0123] The present embodiment discloses a detection method, system and electronic device for adversarial samples, which obtains classification labels corresponding to each target image to be tested by inputting the target image to be tested into a classifier; inputting the target image to be tested and the classification labels corresponding to each target image to be tested into a trained sequential conditional variational autoencoder to obtain a reconstructed image of each target image to be tested output by the sequential conditional variational autoencoder; and determining whether the target image to be tested is an adversarial sample based on the reconstructed image. The method of the present embodiment synchronously inputs the classification label and the target image to be tested into the trained sequential conditional variational autoencoder to increase the difference between the adversarial sample and the original sample, thereby achieving more accurate detection of adversarial samples and improving the accuracy, precision and recall of detection.

[0124] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed in this application. The description and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

[0125] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0126] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable storage medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or used in combination with these instruction execution systems, devices or apparatuses.

[0127] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0128] It is understandable that the above embodiments are exemplary and cannot be construed as limitations on the present application. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for detecting adversarial samples, characterized in that: include: Input the target image to be tested into the classifier to obtain the classification label corresponding to each target image to be tested; Inputting the target images to be tested and the classification labels corresponding to the target images to be tested into the trained sequence conditional variational autoencoder to obtain the reconstructed images of the target images to be tested output by the sequence conditional variational autoencoder; Determine whether the target image to be tested is an adversarial sample according to the reconstructed image.

2. The method for detecting adversarial samples according to claim 1, characterized in that: The generation step of the sequence conditional variational autoencoder includes: Input the training sample data into the classifier to obtain the classification label corresponding to each training sample data output by the classifier; The training sample data and the classification labels corresponding to the training sample data are input into a preset conditional variational autoencoder to obtain the trained sequence conditional variational autoencoder; wherein the training sample data only contains original samples.

3. The method for detecting adversarial samples according to claim 2, characterized in that: The structure and parameters of the classifier are the same as those of the encoder of the preset conditional variational autoencoder.

4. The method for detecting adversarial samples according to claim 2, characterized in that: The structure of the preset conditional variational autoencoder includes an encoder and a decoder, the encoder is composed of a convolutional neural network, and the decoder is composed of a deconvolutional neural network.

5. The method for detecting adversarial samples according to claim 1, characterized in that: The step of determining whether the target image to be tested is an adversarial sample according to the reconstructed image comprises: Calculate the difference between the reconstructed image and the target image to be measured; It is determined whether the difference is greater than a preset detection threshold. If the difference is greater than the preset detection threshold, the target image to be tested is an adversarial sample.

6. The method for detecting adversarial samples according to claim 5, characterized in that: The specific method for calculating the difference between the reconstructed image and the target image to be measured is: Calculate the KL divergence and reconstruction error between the target image to be tested and the reconstructed image respectively; The difference between the target image to be measured and the reconstructed image is calculated according to the KL divergence and the reconstruction error.

7. The method for detecting adversarial samples according to claim 6, characterized in that: The calculation formula of the reconstruction error is: Among them, L llike is the reconstruction error, L is the dimension of the latent variable Z, q θ is the probability distribution of the output reconstructed image; x is the input target image to be tested, y is the output reconstructed image, z (l) is a function related to x and y; z (l) =g φ (x,y,∈ (l) ); Among them, ∈ (l) :N(0,I);g φ is a differentiable function, N is the standard normal distribution, and I is the standard deviation.

8. The method for detecting adversarial samples according to any one of claims 1 to 7, characterized in that: The target image to be detected contains a target object, and the target object is a human face, a number or an animal.

9. A detection system for adversarial samples, characterized in that: include: A label generation module is used to input the target image to be tested into the classifier to obtain a classification label corresponding to each target image to be tested; A reconstruction module, used for inputting the target image to be tested and the classification label corresponding to each target image to be tested into the trained sequence conditional variational autoencoder, and obtaining the reconstructed image of each target image to be tested output by the sequence conditional variational autoencoder; The adversarial sample determination module is used to determine whether the target image to be tested is an adversarial sample according to the reconstructed image.

10. An electronic device, characterized in that: The electronic device implements the detection method according to any one of claims 1 to 8 through hardware or through hardware executing corresponding software, and the hardware or the software includes one or more modules corresponding to the detection method according to any one of claims 1 to 8.

Images