Confrontation sample detection method based on causal reasoning
Through a causal reasoning method, the image to be identified is divided into sub-region images, and inferred in combination with global and local labels, the problem of adversarial sample recognition and detection in the prior art is solved, and the adversarial sample detection with high accuracy and generalization is achieved.
Patent Information
- Application Number
- CN202411731745.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-03-21
AI Technical Summary
The prior art is difficult to effectively identify and detect adversarial samples, especially the associations in different feature layers and sub-regions have not been fully studied, and the lack of theoretical framework support is made, making it difficult to generalize in the face of different types of adversarial attacks, and requires a large amount of training data and computing resources.
Adversarial sample detection method based on causal inference is adopted, and the image to be identified is divided into sub-region images through the segmentation module. The recognition module recognizes global labels and local labels respectively. The detection module infers the presence of adversarial samples based on global and local labels and performs robust detection.
Effective identification and detection of adversarial samples is realized, the accuracy and effectiveness of adversarial samples are improved, the need for additional models or training is avoided, and the generalization of adversarial samples is improved.
Smart Images
Figure CN119672415A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a method for detecting adversarial samples based on causal reasoning. Background Art
[0002] Adversarial attacks are a type of attack in the field of deep learning, where attackers mislead the predictions of deep neural network models by adding small and carefully designed perturbations to the input data. Although these perturbations are usually imperceptible to humans, they have a significant impact on the model's decision-making. The threat of adversarial attacks has attracted widespread attention, especially in key areas that require high-precision decision-making, such as autonomous driving, financial risk control, and medical diagnosis.
[0003] The existing method is generally to obtain the adversarial effect by testing the model with adversarial samples. However, existing research lacks a detailed understanding of the working mechanism of adversarial samples within the model, especially the correlation between different feature layers and sub-regions has not been fully studied. In addition, most existing studies are data-driven, that is, adversarial training methods, which lack the support of theoretical frameworks, making them difficult to generalize when facing different types of adversarial attacks. These studies also require a large amount of training data and computing resources, and when encountering new attack methods, they often lose robustness and find it difficult to provide effective defense.
[0004] Therefore, how to effectively detect and identify adversarial samples has become a research topic that has attracted much attention. Summary of the invention
[0005] In view of this, the purpose of the present application is to provide an adversarial sample detection method based on causal reasoning, which effectively solves the problem that existing methods cannot realize the identification and detection of adversarial samples.
[0006] In a first aspect, an embodiment of the present application provides an adversarial sample detection method based on causal reasoning, which is applied to a sample identification system, wherein the sample identification system includes a segmentation module, an identification module, and a detection module. The method includes:
[0007] The segmentation module integrates a plurality of sub-region images obtained by segmenting the sample image to be identified to obtain a sub-region image set, and outputs the sub-region image set and the sample image to be identified to the recognition module;
[0008] The recognition module recognizes the sample image to be recognized and the sub-region image in the sub-region image set respectively, and obtains the global label corresponding to the sample image to be recognized and the local label corresponding to the sub-region image;
[0009] The recognition module obtains a local label set based on the local label corresponding to the sub-region image, and outputs the global label and the local label set to the detection module;
[0010] The detection module infers that an adversarial sample exists in the sample image to be identified based on the received global label and the local label set, so as to complete robust detection of the adversarial sample based on the local label corresponding to the adversarial sample.
[0011] In combination with the first aspect, an embodiment of the present application provides a first possible implementation of the first aspect, wherein the detection module infers that there is an adversarial sample in the sample image to be identified based on the received global label and the local label set, including:
[0012] The detection module classifies multiple local labels in the local label set to obtain multiple classification subsets, and confirms the quantity corresponding to each classification subset;
[0013] The detection module determines whether there is an adversarial sample in the sample image to be identified based on the number corresponding to each classification subset.
[0014] In combination with the first aspect, the embodiment of the present application provides a second possible implementation of the first aspect, wherein the inferring that there is an adversarial sample in the sample image to be identified based on the number corresponding to each classification subset includes:
[0015] The detection module confirms the first target local label based on the quantity corresponding to each classification subset to determine whether the first target local label is consistent with the global label;
[0016] If not, the detection module determines that the sub-region image corresponding to the first target local label is an adversarial sample.
[0017] In combination with the first aspect, an embodiment of the present application provides a third possible implementation of the first aspect, wherein the robust detection of the adversarial sample based on the local label corresponding to the adversarial sample includes:
[0018] The detection module sums up the number of local labels corresponding to the adversarial samples to obtain a second target local label;
[0019] The detection module determines the category of the adversarial sample based on the classification subset corresponding to the second target local label to complete robust detection of the adversarial sample.
[0020] In combination with the first aspect, an embodiment of the present application provides a fourth possible implementation of the first aspect, wherein the recognition module respectively recognizes the sample image to be recognized and the sub-region image in the sub-region image set, and obtains a global label corresponding to the sample image to be recognized and a local label corresponding to the sub-region image, including:
[0021] The recognition module calls a preset recognition model after receiving the sample image to be recognized and the sub-region image set;
[0022] The recognition model respectively identifies the sample image to be recognized and the sub-region images in the sub-region image set to obtain corresponding global labels and local labels.
[0023] In combination with the first aspect, an embodiment of the present application provides a fifth possible implementation of the first aspect, wherein the recognition model respectively identifies the sample image to be recognized and the sub-region image in the sub-region image set to obtain corresponding global labels and local labels, including:
[0024] The recognition model is screened based on the sub-region image set to obtain a plurality of non-empty subsets;
[0025] The recognition model recognizes sub-region images corresponding to multiple non-empty subsets to obtain local labels corresponding to the sub-region images.
[0026] In combination with the first aspect, the embodiment of the present application provides a sixth possible implementation of the first aspect, wherein the segmentation module integrates multiple sub-region images obtained by segmenting the sample image to be identified to obtain a sub-region image set, including:
[0027] The segmentation module generates a segmentation instruction after acquiring the sample image to be identified, so as to confirm a corresponding segmentation method based on the segmentation instruction;
[0028] The segmentation module segments the sample image to be identified based on a corresponding segmentation method to obtain a plurality of sub-region images.
[0029] In a second aspect, an embodiment of the present application provides an adversarial sample detection device based on causal reasoning, which is applied to a sample identification system. The sample identification system includes a segmentation module, an identification module, and a detection module. The device includes:
[0030] An integration module, used for integrating the multiple sub-region images obtained by the segmentation module based on segmenting the sample image to be identified, to obtain a sub-region image set, and outputting the sub-region image set and the sample image to be identified to the identification module;
[0031] An identification module, used for the identification module to respectively identify the sample image to be identified and the sub-region image in the sub-region image set, and obtain a global label corresponding to the sample image to be identified and a local label corresponding to the sub-region image;
[0032] An output module, used for the recognition module to obtain a local label set based on the local label corresponding to the sub-region image, and output the global label and the local label set to the detection module;
[0033] An inference module is used for the detection module to infer the existence of an adversarial sample in the sample image to be identified based on the received global label and the local label set, so as to complete robust detection of the adversarial sample based on the local label corresponding to the adversarial sample.
[0034] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, any step of a method for detecting adversarial samples based on causal reasoning is performed.
[0035] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, executes any one of the steps of a method for detecting adversarial samples based on causal reasoning.
[0036] The embodiment of the present application provides an adversarial sample detection method based on causal reasoning, which is applied to a sample recognition system. The sample recognition system includes a segmentation module, a recognition module, and a detection module. The method first integrates a plurality of sub-region images obtained by segmenting a sample image to be recognized by the segmentation module to obtain a sub-region image set, and outputs the sub-region image set and the sample image to be recognized to the recognition module; secondly, the recognition module respectively recognizes the sample image to be recognized and the sub-region images in the sub-region image set, obtains a global label corresponding to the sample image to be recognized and a local label corresponding to the sub-region image; then the recognition module detects the local label corresponding to the sub-region image based on the local label corresponding to the sub-region image The method comprises the following steps: signing a local label set, and outputting the global label and the local label set to the detection module; the detection module infers that there is an adversarial sample in the sample image to be identified based on the received global label and the local label set, so as to complete the robust detection of the adversarial sample based on the local label corresponding to the adversarial sample, thereby achieving the effect of recognition and detection of the adversarial sample, thereby avoiding the problem of lack of recognition and detection of the adversarial sample in the existing research, and then ensuring the accuracy and effectiveness of the recognition of the adversarial sample, and also achieving the effect of robust recognition of the adversarial sample without introducing additional models or training, and improving the generalization of detection and recognition of the adversarial sample. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0038] Figure 1 A schematic diagram of the process of a first adversarial sample detection method based on causal reasoning provided in an embodiment of the present application is shown;
[0039] Figure 2 A schematic diagram of a process for obtaining a sub-region image provided in an embodiment of the present application is shown;
[0040] Figure 3 A schematic diagram of a process for determining the existence of adversarial samples provided by an embodiment of the present application is shown;
[0041] Figure 4 A schematic diagram of the structure of a first adversarial sample detection device based on causal reasoning provided in an embodiment of the present application is shown;
[0042] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION
[0043] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.
[0044] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.
[0045] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.
[0046] Existing research lacks a detailed understanding of the working mechanism of adversarial samples within the model, especially the correlation between different feature layers and sub-regions has not been fully studied. In addition, most existing research is data-driven, that is, adversarial training methods, which lack the support of theoretical frameworks, making them difficult to generalize when facing different types of adversarial attacks. These studies also require a large amount of training data and computing resources, and when encountering new attack methods, they often lose robustness and are difficult to provide effective defense.
[0047] Based on this, an embodiment of the present application provides an adversarial sample detection method based on causal reasoning, which is described below through an embodiment.
[0048] Example 1
[0049] To facilitate understanding of this embodiment, a method for detecting adversarial samples based on causal reasoning disclosed in an embodiment of this application is first described in detail. Figure 1The flowchart of an adversarial sample detection method based on causal reasoning is shown. The present application provides an adversarial sample detection method based on causal reasoning, which is applied to a sample recognition system. The sample recognition system includes a segmentation module, a recognition module, and a detection module. The method includes:
[0050] S101, the segmentation module integrates a plurality of sub-region images obtained by segmenting the sample image to be identified to obtain a sub-region image set, and outputs the sub-region image set and the sample image to be identified to the recognition module;
[0051] S102, the recognition module recognizes the sample image to be recognized and the sub-region image in the sub-region image set respectively, and obtains a global label corresponding to the sample image to be recognized and a local label corresponding to the sub-region image;
[0052] S103, the recognition module obtains a local label set based on the local label corresponding to the sub-region image, and outputs the global label and the local label set to the detection module;
[0053] S104: The detection module infers that an adversarial sample exists in the sample image to be identified based on the received global label and the local label set, so as to complete robust detection of the adversarial sample based on the local label corresponding to the adversarial sample.
[0054] This application is implemented based on the theory that the main difference between the positive causal effect of adversarial samples and normal samples is that the positive causal effect of adversarial samples has significant sparsity.
[0055] In step S101, the segmentation module is used to segment the sample image to be identified. The sample image to be identified is a sample image mixed with normal samples and adversarial samples. Then, the segmentation module segments the sample image to be identified x into n sub-region images x n , represented by x={x1,x2,…,x nBefore segmentation, the sample image to be identified is preprocessed, such as denoising, contrast enhancement, etc., to improve the accuracy and efficiency of segmentation. The segmentation module adopts a specific segmentation algorithm to segment the sample image to be identified. These algorithms may be based on edge detection, threshold segmentation, region growing, clustering, graph cut or deep learning technology. The edge detection algorithm is such as Canny edge detector, the clustering algorithm is such as K-means clustering, the graph algorithm is such as Graph Cut, and the prime number deep learning technology is such as semantic segmentation network. Multiple sub-region images obtained by segmenting the sample image to be identified are integrated to obtain a sub-region image set. The integration process may involve sorting, numbering or storage of sub-region images for subsequent processing and analysis, and the sub-region image set and the sample image to be identified are output to the recognition module.
[0056] In the specific process of implementing step S101, there is an embodiment: Figure 2 As shown, the segmentation module integrates multiple sub-region images obtained by segmenting the sample image to be identified to obtain a sub-region image set, including:
[0057] S1011, the segmentation module generates a segmentation instruction after acquiring the sample image to be identified, and confirms a corresponding segmentation method based on the segmentation instruction;
[0058] S1012: The segmentation module segments the sample image to be identified based on a corresponding segmentation method to obtain a plurality of sub-region images.
[0059] In steps S1011-S1012, after the segmentation module obtains the sample image to be identified, it performs a preliminary judgment based on the sample image to be identified to obtain a preliminary judgment result, and determines the segmentation method to be adopted based on the preliminary judgment result. Different algorithms are suitable for different types of images and segmentation requirements. For images with clear edges, edge detection algorithms may be more effective, so the segmentation instructions contain commands for using edge detection algorithms. For complex scenes, deep learning technology may provide more accurate segmentation results, so the segmentation instructions contain commands for using deep learning technology algorithms. After the segmentation module determines the segmentation method, it segments the sample image to be identified based on the segmentation method to obtain multiple sub-region images, which may correspond to different objects, parts or features in the sample image to be identified.
[0060] In step S102, after receiving the sample image to be identified and the sub-region image set, the recognition module calls a preset recognition model to respectively identify the sample image to be identified and the sub-region images in the sub-region image set. The recognition module obtains the global label by identifying the sample image to be identified, and obtains the local label corresponding to the sub-region image by identifying the sub-region image in the sub-region image set. The global label is the type of the sample image to be identified by the recognition model. For example, the global label of the sample image to be identified is animal or plant, and it can be more detailed such as apple, orange, grape, monkey, dog, etc.; and the local label can be apple stalk, eye, ear, etc., which are not listed one by one here. The type of the sub-region image can be obtained by combining all the local labels.
[0061] In the specific process of implementing step S102, there is an embodiment in which the recognition module recognizes the sample image to be recognized and the sub-region image in the sub-region image set respectively, and obtains the global label corresponding to the sample image to be recognized and the local label corresponding to the sub-region image, including:
[0062] S1021, the recognition module calls a preset recognition model after receiving the sample image to be recognized and the sub-region image set;
[0063] S1022: The recognition model respectively identifies the sample image to be recognized and the sub-region images in the sub-region image set to obtain corresponding global labels and local labels.
[0064] In steps S10221-S10222, after receiving the sample image to be identified and the sub-region image set, the recognition module generates a call instruction, and calls a preset recognition model based on the call instruction. The recognition model recognizes the sample image to be identified and the sub-region image set in response to the call instruction. The recognition model F, the non-empty subset x s The recognition result is expressed as formula (1):
[0065] y=F(x s ) (1);
[0066] The Vision Transformer model is used to construct the recognition model F. The recognition result y includes a global label and a local label. When the recognition model recognizes the sample image to be recognized, the recognition result is a global label. When the recognition model recognizes the sub-region image in the sub-region image set, that is, the non-empty subset, the recognition result is a local label. The non-empty subset x s If there are multiple local labels, the recognition model performs multiple recognitions to obtain multiple local labels.
[0067] In the specific process of implementing step S1022, there is an embodiment in which the recognition model respectively recognizes the sample image to be recognized and the sub-region image in the sub-region image set to obtain corresponding global labels and local labels, including:
[0068] S10221, the recognition model is screened based on the sub-region image set to obtain a plurality of non-empty subsets;
[0069] S10222. The recognition model identifies sub-region images corresponding to multiple non-empty subsets to obtain local labels corresponding to the sub-region images.
[0070] In steps S10221-S10222, in order to avoid the situation where the recognition model is the sub-region image without the input of the remaining sub-region images, thereby avoiding the phenomenon of useless work, the recognition model is screened based on the sub-region image set to obtain multiple non-empty subsets x s , where x s For x = {x1, x2, …, x n Any non-empty subset of} is to delete the empty set in the sub-region image set and only retain the existence of the non-empty subsets, and the non-empty subsets all correspond to the existence of the sub-region image. The recognition model identifies the sub-region images corresponding to multiple non-empty subsets to obtain the local labels corresponding to the sub-region images, thereby avoiding the existence of blank local labels, and further avoiding affecting the recognition and detection of the adversarial samples, and also ensuring the accuracy and effectiveness of the recognition and detection of the adversarial samples.
[0071] In step S103, after obtaining multiple local labels, the recognition module organizes the local labels corresponding to the sub-region image to obtain a local label set for the convenience of storing the multiple local labels, that is, each element in the local label set is a local label of a sub-region image, and outputs the global label and the local label set to the detection module. The recognition module provides rich information to the detection module by outputting the global label and the local label set. This information transmission method enables the detection module to perform more complex image analysis tasks and improve the overall performance and accuracy of the sample recognition system. In practical applications, it is necessary to design the recognition module and the detection module according to the requirements of specific tasks, and optimize the information transmission method between them to achieve the best effect.
[0072] In step S104, since the main difference between the positive causal effect of the adversarial sample and the normal sample is that the positive causal effect of the adversarial sample has significant sparsity, the detection module infers that there are adversarial samples and normal samples in the sample image to be identified based on the received global label and the local label set after receiving the global label and the local label set, that is, the adversarial sample and the normal sample are identified in the sample image to be identified, and the adversarial sample is the image in the sample image to be identified that has been attacked by adversarial noise, thereby realizing the detection of the adversarial sample, and on the basis of detecting the adversarial sample, further identifying the adversarial sample to complete the robust detection of the adversarial sample based on the local label corresponding to the adversarial sample, thereby achieving the purpose of the sample recognition system of the present application and ensuring the effect of the sample recognition system of the present application.
[0073] In the specific process of implementing step S104, there is an embodiment: Figure 3 As shown, the detection module infers that there is an adversarial sample in the sample image to be identified based on the received global label and the local label set, including:
[0074] S10411, the detection module classifies multiple local labels in the local label set to obtain multiple classification subsets, and confirms the quantity corresponding to each classification subset;
[0075] S10412. The detection module determines whether there is an adversarial sample in the sample image to be identified based on the number corresponding to each classification subset.
[0076] In steps S10411-S10412, the detection module classifies multiple local labels in the local label set to obtain multiple classification subsets, that is, based on the multiple local labels in the local label set, they are classified according to their categories. For example, the local labels include two categories: animals and plants. Based on the multiple local labels in the local label set, they are classified according to animals and plants, and the number of local labels corresponding to the animal classification subset and the number of local labels corresponding to the plant classification subset are confirmed. The detection module determines the existence of adversarial samples in the sample image to be identified based on the number corresponding to each classification subset, and correspondingly, normal samples are also detected, thereby realizing the detection of the adversarial samples and normal samples in the sample to be identified, thereby ensuring the detection of the adversarial samples.
[0077] In the specific process of implementing step S10412, there is an embodiment in which the detection module determines whether there is an adversarial sample in the sample image to be identified based on the number corresponding to each classification subset, including:
[0078] S104121, the detection module confirms the first target local label based on the quantity corresponding to each classification subset to determine whether the first target local label is consistent with the global label;
[0079] S104122: If not, the detection module determines that the sub-region image corresponding to the first target local label is an adversarial sample.
[0080] In steps S104121-S104122, the detection module identifies the first target local label based on the number of local labels corresponding to each classification subset, that is, the local label with a larger number is the first target local label, and judges the category corresponding to the first target local label to determine whether the first target local label is consistent with the category corresponding to the global label. If so, that is, consistent, the sub-region image corresponding to the first target local label is a normal sample. If not, it is inconsistent, then the detection module determines that the sub-region image corresponding to the first target local label is an adversarial sample, that is, if the category corresponding to the global label is apple, and the category corresponding to the first target local label is orange, then the sub-region image corresponding to the local label is an adversarial sample. If there are two categories with the same number of local labels and the largest number, namely orange and peach, and it cannot be confirmed that one of them is the first target local label, then the two classification subsets with the same number of local labels and the largest number are orange and peach, and the sub-region images corresponding to these two classification subsets are both adversarial samples.
[0081] In the specific process of implementing step S104, there is another embodiment: the robust detection of the adversarial sample based on the local label corresponding to the adversarial sample includes:
[0082] S10421, the detection module sums up the number of local labels corresponding to the adversarial samples to obtain a second target local label;
[0083] S10422. The detection module determines the category of the adversarial sample based on the classification subset corresponding to the second target local label to complete robust detection of the adversarial sample.
[0084] In steps S10421-S10422, since the positive causal effect of the adversarial sample has significant sparsity, the detection module, after detecting the existence of the adversarial sample, totals the number of local labels corresponding to the adversarial sample, that is, counts the number of local labels in the adversarial sample, and counts the number of specific categories in the category to which the local labels belong. For example, the category corresponding to the global label is apple, and the category corresponding to the normal sample is apple. If there are layout labels such as orange, grape, and pear in the adversarial sample, but there are more local labels belonging to orange, and fewer local labels corresponding to grape and pear, then the local label of orange is the second target local label. The detection module determines the category of the adversarial sample based on the classification subset corresponding to the second target local label, and determines that the adversarial sample is orange, thereby completing the robust detection of the adversarial sample and ensuring the robustness and accuracy of identifying the adversarial sample.
[0085] Example 2
[0086] This application also provides an adversarial sample detection device based on causal reasoning, such as Figure 4 The block diagram of an adversarial sample detection device based on causal reasoning is shown. The functions implemented by the adversarial sample detection device based on causal reasoning correspond to the steps of executing an adversarial sample detection method based on causal reasoning on the terminal device. The device can be understood as a component of a server including a processor, which is applied to a sample identification system. The sample identification system includes a segmentation module, an identification module, and a detection module. The device includes:
[0087] An integration module 401 is used for integrating the multiple sub-region images obtained by the segmentation module based on segmenting the sample image to be identified to obtain a sub-region image set, and outputting the sub-region image set and the sample image to be identified to the identification module;
[0088] An identification module 402 is used for the identification module to respectively identify the sample image to be identified and the sub-region image in the sub-region image set, and obtain a global label corresponding to the sample image to be identified and a local label corresponding to the sub-region image;
[0089] An output module 403, used for the recognition module to obtain a local label set based on the local label corresponding to the sub-region image, and output the global label and the local label set to the detection module;
[0090] The inference module 404 is used for the detection module to infer the existence of adversarial samples in the sample image to be identified based on the received global label and the local label set, so as to complete the robust detection of the adversarial samples based on the local labels corresponding to the adversarial samples.
[0091] In a feasible implementation, the inference module includes:
[0092] A classification module, used for the detection module to classify multiple local labels in the local label set to obtain multiple classification subsets, and confirm the quantity corresponding to each classification subset;
[0093] A determination module is used for the detection module to determine whether there is an adversarial sample in the sample image to be identified based on the number corresponding to each classification subset.
[0094] In a feasible implementation manner, the inference module further includes:
[0095] A confirmation module, used for the detection module to confirm the first target local label based on the quantity corresponding to each classification subset to determine whether the first target local label is consistent with the global label;
[0096] A determination module is used for determining, if no, that the detection module determines that the sub-region image corresponding to the first target local label is an adversarial sample.
[0097] In a feasible implementation, the inference module further includes:
[0098] A summing module, used for the detection module to sum the number of local labels corresponding to the adversarial samples to obtain a second target local label;
[0099] A determination module is used for the detection module to determine the category of the adversarial sample based on the classification subset corresponding to the second target local label to complete robust detection of the adversarial sample.
[0100] In a feasible implementation, the identification module includes:
[0101] A calling module, used for the recognition module to call a preset recognition model after receiving the sample image to be recognized and the sub-region image set;
[0102] The first recognition module is used for the recognition model to respectively recognize the sample image to be recognized and the sub-region images in the sub-region image set to obtain corresponding global labels and local labels.
[0103] In a feasible implementation manner, the identification module further includes:
[0104] A screening module, used for the recognition model to screen based on the sub-region image set to obtain a plurality of non-empty subsets;
[0105] The second recognition module is used for the recognition model to recognize sub-region images corresponding to multiple non-empty subsets to obtain local labels corresponding to the sub-region images.
[0106] In a feasible implementation, the integration module includes:
[0107] A generating module, used for the segmentation module to generate a segmentation instruction after acquiring the sample image to be identified, so as to confirm a corresponding segmentation method based on the segmentation instruction;
[0108] The segmentation module is used for segmenting the sample image to be identified based on the corresponding segmentation method to obtain multiple sub-region images.
[0109] Example 3
[0110] The present application also provides an electronic device, such as Figure 5 As shown, it includes: a processor 501, a memory 502 and a bus 503, the memory 502 stores machine-readable instructions executable by the processor 501, when the electronic device is running, the processor 501 and the memory 502 communicate through the bus 503, and when the machine-readable instructions are executed by the processor 501, any step of the adversarial sample detection method based on causal reasoning is performed.
[0111] Example 4
[0112] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program executes any one of the steps of the adversarial sample detection method based on causal reasoning.
[0113] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.
[0114] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0115] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
[0116] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.
[0117] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
Claims
1. A method for detecting adversarial samples based on causal reasoning, characterized in that: Applied to a sample identification system, the sample identification system includes a segmentation module, an identification module, and a detection module, and the method includes: The segmentation module integrates a plurality of sub-region images obtained by segmenting the sample image to be identified to obtain a sub-region image set, and outputs the sub-region image set and the sample image to be identified to the recognition module; The recognition module recognizes the sample image to be recognized and the sub-region image in the sub-region image set respectively, and obtains the global label corresponding to the sample image to be recognized and the local label corresponding to the sub-region image; The recognition module obtains a local label set based on the local label corresponding to the sub-region image, and outputs the global label and the local label set to the detection module; The detection module infers that an adversarial sample exists in the sample image to be identified based on the received global label and the local label set, so as to complete robust detection of the adversarial sample based on the local label corresponding to the adversarial sample.
2. The method according to claim 1, characterized in that The detection module infers that there is an adversarial sample in the sample image to be identified based on the received global label and the local label set, including: The detection module classifies multiple local labels in the local label set to obtain multiple classification subsets, and confirms the quantity corresponding to each classification subset; The detection module determines whether there is an adversarial sample in the sample image to be identified based on the number corresponding to each classification subset.
3. The method according to claim 2, characterized in that The detection module determines whether there is an adversarial sample in the sample image to be identified based on the number corresponding to each classification subset, including: The detection module confirms the first target local label based on the quantity corresponding to each classification subset to determine whether the first target local label is consistent with the global label; If not, the detection module determines that the sub-region image corresponding to the first target local label is an adversarial sample.
4. The method according to claim 1, characterized in that: The robust detection of the adversarial sample based on the local label corresponding to the adversarial sample includes: The detection module sums up the number of local labels corresponding to the adversarial samples to obtain a second target local label; The detection module determines the category of the adversarial sample based on the classification subset corresponding to the second target local label to complete robust detection of the adversarial sample.
5. The method according to claim 1, characterized in that The recognition module recognizes the sample image to be recognized and the sub-region image in the sub-region image set respectively, and obtains the global label corresponding to the sample image to be recognized and the local label corresponding to the sub-region image, including: The recognition module calls a preset recognition model after receiving the sample image to be recognized and the sub-region image set; The recognition model respectively identifies the sample image to be recognized and the sub-region images in the sub-region image set to obtain corresponding global labels and local labels.
6. The method according to claim 5, characterized in that The recognition model respectively recognizes the sample image to be recognized and the sub-region image in the sub-region image set to obtain corresponding global labels and local labels, including: The recognition model is screened based on the sub-region image set to obtain a plurality of non-empty subsets; The recognition model recognizes sub-region images corresponding to multiple non-empty subsets to obtain local labels corresponding to the sub-region images.
7. The method according to claim 1, characterized in that The segmentation module integrates multiple sub-region images obtained by segmenting the sample image to be identified to obtain a sub-region image set, including: The segmentation module generates a segmentation instruction after acquiring the sample image to be identified, so as to confirm a corresponding segmentation method based on the segmentation instruction; The segmentation module segments the sample image to be identified based on a corresponding segmentation method to obtain a plurality of sub-region images.
8. A device for detecting adversarial samples based on causal reasoning, characterized in that: Applied to a sample identification system, the sample identification system includes a segmentation module, an identification module, and a detection module, and the device includes: An integration module, used for integrating the multiple sub-region images obtained by the segmentation module based on segmenting the sample image to be identified, to obtain a sub-region image set, and outputting the sub-region image set and the sample image to be identified to the identification module; An identification module, used for the identification module to respectively identify the sample image to be identified and the sub-region image in the sub-region image set, and obtain a global label corresponding to the sample image to be identified and a local label corresponding to the sub-region image; An output module, used for the recognition module to obtain a local label set based on the local label corresponding to the sub-region image, and output the global label and the local label set to the detection module; An inference module is used for the detection module to infer the existence of an adversarial sample in the sample image to be identified based on the received global label and the local label set, so as to complete robust detection of the adversarial sample based on the local label corresponding to the adversarial sample.
9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of a method for detecting adversarial samples based on causal reasoning are performed.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of a method for detecting adversarial samples based on causal reasoning as described in any one of claims 1 to 7.
Citation Information
Cited By
Red date image detection method and system
CN121095684A