Adversarial sample detection method and device, electronic equipment and storage medium
By performing local histogram equalization processing and high-frequency low-frequency information extraction on adversarial samples, combined with predicted confidence gradients, the defects of the current adversarial sample detection method are solved and the detection performance is improved, especially when detecting attacks with minimal perturbation.
Patent Information
- Application Number
- CN202411667929.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-21
- Publication Date
- 2025-04-11
AI Technical Summary
The current adversarial sample detection method has certain shortcomings, and it is difficult to effectively distinguish adversarial samples from normal samples.
By performing local histogram equalization processing on the sample to be tested, high-frequency information and low-frequency information are extracted, and the predicted confidence gradient is determined based on the low-frequency information, and input it into the preset detection network to determine whether the sample is an adversarial sample.
This method improves the performance of adversarial sample detection by amplifying adversarial perturbation, enhancing the characteristic difference between adversarial sample and normal sample, and achieves state-of-the-art performance, especially when detecting attacks with minimal perturbation.
Smart Images
Figure CN119810014A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of deep neural network technology, and in particular to an adversarial sample detection method, device, electronic device and storage medium. Background Art
[0002] Deep Neural Networks (DNNs) have achieved remarkable success in various vision tasks. However, recent studies have shown that DNNs are vulnerable to adversarial examples, which are generated by adding adversarial perturbations that are imperceptible to humans. These adversarial examples can easily cause DNNs to make incorrect predictions with high confidence. These vulnerabilities pose a serious threat to the security of DNNs in real-world applications, especially in sensitive areas such as self-driving cars and medical diagnosis.
[0003] In recent years, many defense methods have been developed, which can be divided into three categories: adversarial training, adversarial purification, and adversarial detection. Adversarial training aims to enhance model robustness by incorporating adversarial examples into the training process; adversarial purification aims to remove adversarial perturbations by preprocessing input samples. Unfortunately, adversarial training and purification techniques often lead to performance degradation in DNN applications. In contrast, adversarial detection provides a more flexible solution. Before applying DNN, a detection module is added to actively distinguish adversarial samples from original samples. However, several studies have shown that current adversarial sample detection methods still have certain defects. Summary of the invention
[0004] The present application provides an adversarial sample detection method, device, electronic device and storage medium to solve the problem that current adversarial sample detection methods still have certain defects.
[0005] In a first aspect, the present application provides an adversarial sample detection method, comprising:
[0006] Perform local histogram equalization processing on the samples to be tested to obtain preprocessed samples;
[0007] Extracting high-frequency information and low-frequency information from the preprocessed samples, and determining a prediction confidence gradient based on the low-frequency information;
[0008] The high-frequency information and the prediction confidence gradient are input into a preset detection network to determine whether the sample to be tested is an adversarial sample.
[0009] Furthermore, the method of performing local histogram equalization processing on the sample to be tested to obtain a preprocessed sample includes:
[0010] Divide the sample to be tested into a plurality of pixel regions of preset size, calculate the grayscale histogram of each region, and perform histogram equalization;
[0011] The pixel values of each region are remapped based on the equalized histogram, and the processed regions are merged to obtain the preprocessed samples.
[0012] Furthermore, extracting the high-frequency information and the low-frequency information from the preprocessed sample includes:
[0013] Downsampling the preprocessed samples by a preset multiple using bicubic interpolation to remove high-frequency information and retain low-frequency information;
[0014] The downsampled samples are upsampled back to the original size by the preset multiple using bicubic interpolation, low-frequency information is subtracted, and high-frequency information is extracted.
[0015] Further, determining the prediction confidence gradient based on the low-frequency information includes:
[0016] The gradient of the low-frequency information is calculated based on a preset confidence loss function to obtain a prediction confidence gradient.
[0017] Furthermore, the step of inputting the high-frequency information and the prediction confidence gradient into a preset detection network to determine whether the sample to be tested is an adversarial sample includes:
[0018] Inputting the high frequency information and the prediction confidence gradient into two identical networks that do not share parameters;
[0019] An adversarial score from the dual network is calculated to determine whether the sample to be tested is an adversarial sample.
[0020] In a second aspect, the present application provides an adversarial sample detection device, comprising:
[0021] The local processing module is used to perform local histogram equalization processing on the sample to be tested to obtain the preprocessed sample;
[0022] An information extraction module, used to extract high-frequency information and low-frequency information from the preprocessed samples, and determine a prediction confidence gradient based on the low-frequency information;
[0023] The adversarial detection module is used to input the high-frequency information and the prediction confidence gradient into a preset detection network to determine whether the sample to be tested is an adversarial sample.
[0024] In a third aspect, the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the adversarial sample detection method as described above when executing the computer program.
[0025] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the adversarial sample detection method as described above is implemented.
[0026] The above technical solution of the present application has the following advantages:
[0027] The adversarial sample detection method provided in the first aspect of the present application can amplify adversarial perturbations and enhance the feature differences between adversarial samples and normal samples by performing local histogram equalization on the sample to be tested. By extracting high-frequency information and low-frequency information from the preprocessed sample, high-frequency information can be used to distinguish adversarial samples from normal samples, and the prediction confidence gradient generated using low-frequency information has greater convergence. By inputting high-frequency information and prediction confidence gradients into a preset detection network to determine whether the sample to be tested is an adversarial sample, the performance of adversarial sample detection is improved.
[0028] It can be understood that the beneficial effects of the second, third and fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS
[0029] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0030] Figure 1 A flowchart of the adversarial sample detection method provided in this application;
[0031] Figure 2 The local histogram equalization processing provided by this application and the visualization of the high-frequency information of the original image and the corresponding adversarial image;
[0032] Figure 3 A statistical graph of the power spectrum azimuth integration of the original image and its corresponding adversarial image provided by this application;
[0033] Figure 4 A data graph showing the predicted confidence distribution of original samples and adversarial samples generated using different attack methods provided for this application;
[0034] Figure 5 A schematic diagram of the structure of the adversarial sample detection device provided in this application;
[0035] Figure 6A schematic diagram of the structure of the electronic device provided in this application. DETAILED DESCRIPTION
[0036] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.
[0037] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.
[0038] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.
[0039] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways. "Multiple" means "two or more".
[0040] The specific implementation methods of the present application are further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present application but are not intended to limit the scope of the present application.
[0041] like Figure 1 As shown, the embodiment of the present application provides an adversarial sample detection method, which specifically includes the following steps:
[0042] Perform local histogram equalization processing on the samples to be tested to obtain preprocessed samples;
[0043] Extracting high-frequency information and low-frequency information from the preprocessed samples, and determining a prediction confidence gradient based on the low-frequency information;
[0044] The high-frequency information and the prediction confidence gradient are input into a preset detection network to determine whether the sample to be tested is an adversarial sample.
[0045] In order to improve the performance of adversarial sample detection, this application explores two aspects. First, explore amplifying the feature differences between adversarial samples and original samples instead of relying solely on their inherent features. Adversarial perturbations usually appear as subtle changes in specific areas of the image. Local histogram equalization (LHE) enhances the contrast within these local areas, thereby amplifying these subtle perturbations.
[0046] Figure 2 The following is a visualization of the high-frequency information of the LHE image (preprocessed with local histogram equalization) and the original image and the corresponding adversarial image. It can be seen that the adversarial perturbation is amplified by local histogram equalization. Next, we explore the feature differences between the adversarial and original samples in the spectral domain. Figure 2 As shown, significant differences in high-frequency information between adversarial samples and original samples are observed.
[0047] Figure 3 The statistics (mean and variance) of the power spectrum azimuth integration of 3500 randomly selected original images from ImageNet and their corresponding adversarial images. The adversarial samples are generated using the PGD algorithm with a perturbation coefficient of ε = 4 / 225. Figure 3 In , we notice that the obvious differences between the original and adversarial images are most prominent in the high-frequency bands. This may indicate that high-frequency information provides useful evidence for adversarial sample detection.
[0048] In order to improve the detection performance, this application continues to explore the prediction confidence gradient. Figure 4 The predicted confidence distribution data of the original samples and adversarial samples generated by different attack methods are 3500 images randomly selected from ImageNet, considering two cases: low-frequency information after local histogram equalization and unprocessed original images. Figure 4 As shown, the prediction confidence gradient generated using low-frequency information has greater convergence, which is conducive to a clearer classification decision boundary of the model.
[0049] This application uses local histogram equalization to amplify subtle adversarial perturbations and can distinguish adversarial samples from normal samples. In addition, high-frequency and low-frequency information are extracted and analyzed from the image, and the high-frequency information and the predicted confidence gradient based on the low-frequency information are simultaneously fed into the detection network to determine whether the input image is an adversarial sample. Experimental results show that this application outperforms existing detection methods, especially for attacks with minimal perturbations, and achieves state-of-the-art performance on benchmark datasets.
[0050] In some embodiments, the performing of local histogram equalization processing on the sample to be tested to obtain a preprocessed sample includes:
[0051] Divide the sample to be tested into a plurality of pixel regions of preset size, calculate the grayscale histogram of each region, and perform histogram equalization;
[0052] The pixel values of each region are remapped based on the equalized histogram, and the processed regions are merged to obtain the preprocessed samples.
[0053] Current work on adversarial sample attacks is dedicated to generating less perturbed but highly aggressive adversarial samples, where the original image and its corresponding adversarial image are usually very similar. Detecting adversarial samples based solely on the inherent feature differences between the adversarial image and the original image is a major challenge. Therefore, feature differences can be actively amplified to detect whether the input image is an adversarial sample. In this application, feature differences are enhanced by amplifying adversarial perturbations using local histogram equalization (LHE).
[0054] In digital image processing, global histogram equalization (GHE) is used to achieve grayscale equalization. This method achieves a balanced distribution by adjusting the histogram and grayscale probability distribution of the original image. In contrast, LHE enhances the contrast in local areas of the image by applying GHE.
[0055] The process involves dividing the image into smaller 8x8 pixel regions, calculating the grayscale histogram of each region, performing histogram equalization, and then remapping the pixel values based on the equalized histogram. Finally, the processed regions are merged to form a complete image. Since adversarial perturbations are usually local and random, LHE is used to amplify these local adversarial perturbations. This method enhances the feature differences between adversarial samples and original samples, which can improve the performance of the classifier.
[0056] In some embodiments, extracting high-frequency information and low-frequency information from the preprocessed sample includes:
[0057] Downsampling the preprocessed samples by a preset multiple using bicubic interpolation to remove high-frequency information and retain low-frequency information;
[0058] The downsampled samples are upsampled back to the original size by the preset multiple using bicubic interpolation, low-frequency information is subtracted, and high-frequency information is extracted.
[0059] Bicubic interpolation is an algorithm that interpolates by considering the grayscale values of 16 surrounding points around the target point. The algorithm fully considers the grayscale effect of the 4 directly adjacent points and the rate of change of the grayscale value between each adjacent point. Bicubic interpolation can effectively preserve details and textures.
[0060] This application selects the bicubic interpolation method to separate high-frequency and low-frequency information in the image. First, the image is downsampled by a factor of k using bicubic interpolation, which effectively removes high-frequency details while retaining low-frequency information by reducing the image size. Next, the downsampled image is upsampled back to its original size by the same factor of k using bicubic interpolation.
[0061] Bicubic interpolation is used to ensure smooth transitions between pixel values, thereby preserving the low-frequency information obtained during downsampling. This process accurately maintains the level of detail in the image while effectively capturing the overall low-frequency characteristics of the image. Finally, the low-frequency information is subtracted from the image, effectively extracting the high-frequency information.
[0062] The k factor directly affects the accuracy of high-frequency and low-frequency information extraction. When k is too large, low-frequency information will be distorted. On the contrary, when k is too small, high-frequency information will be distorted. This information distortion will have an adverse effect on the performance of adversarial sample detection. This application conducts a large number of experiments to determine the optimal k value, considering three datasets (i.e., SVHN, CIFAR-10, and ImageNet) and four attack methods (i.e., PGD, DI-FGSM, DeepFool, and C&W).
[0063] For PGD, DI-FGSM, let ε = 4 / 255, and factor k take values of 2, 4, and 8. Then, different k values are applied to extract high-frequency and low-frequency information for detecting adversarial samples. In some scenarios, the defense performance of k = 2 is equal to that of k = 4 or k = 8. In most cases, the defense performance is optimal when k = 2. Taking all factors into consideration, k = 2 is finally determined.
[0064] In some embodiments, determining the prediction confidence gradient based on the low-frequency information includes:
[0065] The gradient of the low-frequency information is calculated based on a preset confidence loss function to obtain a prediction confidence gradient.
[0066] Calculate the prediction confidence gradient, which can be expressed as:
[0067]
[0068] Where x is the input image, x l Refers to the low-frequency information of the image after local histogram equalization. L is the confidence loss function, which can be calculated as:
[0069]
[0070] Where n represents the label category in the experimental dataset, p represents the one-hot vector of the predicted logits z, and the one-hot vector p represents the predicted label of the input image, not the true label. i yes:
[0071]
[0072] In this application, the gradient g is taken as an absolute value.
[0073] In some embodiments, inputting the high-frequency information and the prediction confidence gradient into a preset detection network to determine whether the sample to be tested is an adversarial sample includes:
[0074] Inputting the high frequency information and the prediction confidence gradient into two identical networks that do not share parameters;
[0075] An adversarial score from the dual network is calculated to determine whether the sample to be tested is an adversarial sample.
[0076] Use the above method to obtain high-frequency and gradient information, and input it into two identical networks that do not share parameters. Finally, determine whether the input sample is adversarial by calculating the adversarial score from the dual network.
[0077] Since the detection network will directly affect the performance of defending against different attacks, this application conducts a large number of experiments to determine the optimal detection network. This application considers three datasets (i.e., SVHN, CIFAR-10, and ImageNet) and four attack methods (i.e., PGD, DI-FGSM, DeepFool, and C&W). For PGD and DI-FGSM, let ε = 4 / 255. For the detection network, three different networks are considered: VGG16, VGG19, and VGG19 bn.
[0078] VGG16, VGG19, and VGG19 bn have similar detection performance on the SVHN and CIFAR-10 datasets. However, VGG19 bn has the best detection performance in most scenarios. For the ImageNet dataset, there is little difference in the performance of VGG16 and VGG19 in detecting PGD and DIFGSM. VGG16 and VGG19 cannot detect C&W. VGG19 bn is still significantly better than VGG16 and VGG19 in detecting different attacks. Taking all factors into consideration, this application determines the VGG19 bn model as the detection network.
[0079] The adversarial sample detection method provided in the embodiment of the present application first uses local histogram equalization to amplify adversarial perturbations, which can enhance the feature differences between adversarial and normal samples. Subsequently, high-frequency and low-frequency information are extracted from the image. Since adversarial perturbations destroy high-frequency information in the image, these high-frequency information are used to distinguish adversarial samples from normal samples. The prediction confidence gradient generated using low-frequency information has greater convergence. Next, the low-frequency information is used to generate prediction confidence.
[0080] The high-frequency information and gradient confidence are fed into the VGG19_bn detection network, and the outputs are then merged to determine whether the input image is an adversarial sample. The performance of this method is evaluated in five key scenarios: defense against various attacks, detection performance under different perturbation strengths, protection of different models, cross-defense against different attack methods, and ablation studies. The results show that this method has strong defense capabilities and outperforms existing baseline methods in detection. In summary, this method provides an effective and superior new method for adversarial sample detection.
[0081] Corresponding to the adversarial sample detection method described in the above embodiment, Figure 5 As shown, the embodiment of the present application further provides an adversarial sample detection device, and the adversarial sample detection device 500 includes:
[0082] The local processing module 501 is used to perform local histogram equalization processing on the sample to be tested to obtain a pre-processed sample;
[0083] An information extraction module 502, configured to extract high-frequency information and low-frequency information from the preprocessed sample, and determine a prediction confidence gradient based on the low-frequency information;
[0084] The adversarial detection module 503 is used to input the high-frequency information and the prediction confidence gradient into a preset detection network to determine whether the sample to be tested is an adversarial sample.
[0085] It should be noted that the information interaction, execution process, etc. between the above-mentioned modules / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.
[0086] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.
[0087] The present application embodiment also provides an electronic device 600, such as Figure 6 As shown, it includes a memory 601, a processor 602, and a computer program 603 stored in the memory 601 and executable on the processor 602. When the processor 602 executes the computer program 603, the steps of the adversarial sample detection method provided in the first aspect are implemented.
[0088] In applications, the electronic device may include, but is not limited to, a processor and a memory. Figure 6 This is only an example of an electronic device and does not constitute a limitation on the electronic device. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input and output devices, network access devices, etc. Input and output devices may include cameras, audio acquisition / playback devices, display screens, etc. Network access devices may include a network module for wirelessly communicating with external devices.
[0089] In applications, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
[0090] In application, the memory may be an internal storage unit of an electronic device in some embodiments, such as a hard disk or memory of the electronic device. The memory may also be an external storage device of the electronic device in other embodiments, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. The memory may also include both an internal storage unit and an external storage device of the electronic device. The memory is used to store operating systems, applications, boot loaders (BootLoader), data, and other programs, such as program codes of computer programs, etc. The memory may also be used to temporarily store data that has been output or is to be output.
[0091] The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.
[0092] The present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.
[0093] Those of ordinary skill in the art will appreciate that the devices and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0094] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of devices, which can be electrical, mechanical or other forms.
[0095] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.
Claims
1. A method for detecting adversarial samples, characterized in that: include: Perform local histogram equalization processing on the samples to be tested to obtain preprocessed samples; Extracting high-frequency information and low-frequency information from the preprocessed samples, and determining a prediction confidence gradient based on the low-frequency information; The high-frequency information and the prediction confidence gradient are input into a preset detection network to determine whether the sample to be tested is an adversarial sample.
2. The adversarial sample detection method according to claim 1, characterized in that: The method of performing local histogram equalization processing on the sample to be tested to obtain a preprocessed sample includes: Divide the sample to be tested into a plurality of pixel regions of preset size, calculate the grayscale histogram of each region, and perform histogram equalization; The pixel values of each region are remapped based on the equalized histogram, and the processed regions are merged to obtain the preprocessed samples.
3. The adversarial sample detection method according to claim 1, characterized in that: The extracting high-frequency information and low-frequency information from the preprocessed sample includes: Downsampling the preprocessed samples by a preset multiple using bicubic interpolation to remove high-frequency information and retain low-frequency information; The downsampled samples are upsampled back to the original size by the preset multiple using bicubic interpolation, low-frequency information is subtracted, and high-frequency information is extracted.
4. The adversarial sample detection method according to claim 1, characterized in that: The determining the prediction confidence gradient based on the low-frequency information comprises: The gradient of the low-frequency information is calculated based on a preset confidence loss function to obtain a prediction confidence gradient.
5. The adversarial sample detection method according to claim 1, characterized in that: The step of inputting the high-frequency information and the prediction confidence gradient into a preset detection network to determine whether the sample to be tested is an adversarial sample includes: Inputting the high frequency information and the prediction confidence gradient into two identical networks that do not share parameters; An adversarial score from the dual network is calculated to determine whether the sample to be tested is an adversarial sample.
6. An adversarial sample detection device, characterized in that: include: The local processing module is used to perform local histogram equalization processing on the sample to be tested to obtain the preprocessed sample; An information extraction module, used to extract high-frequency information and low-frequency information from the preprocessed samples, and determine a prediction confidence gradient based on the low-frequency information; The adversarial detection module is used to input the high-frequency information and the prediction confidence gradient into a preset detection network to determine whether the sample to be tested is an adversarial sample.
7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the adversarial sample detection method according to any one of claims 1 to 5 is implemented.
8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the adversarial sample detection method according to any one of claims 1 to 5 is implemented.