Reprogramming attack resisting method and device, equipment, storage medium and program product
By superpixel division and disturbance information addition of carrier images, a confrontation program is generated and combined with the target image, the problem of easy exposure of traditional confrontation attacks is solved, and a more efficient and hidden confrontation attack effect is achieved.
Patent Information
- Application Number
- CN202411890846.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-20
- Publication Date
- 2025-04-11
AI Technical Summary
Traditional confrontational attack methods are easily exposed, resulting in poor attack effectiveness.
By superpixel partitioning of the carrier image, perturbation information is adaptively added, an adversarial program is generated, and the target image is added to the adversarial program to obtain an adversarial image to improve the accuracy and concealment of adversarial attacks.
The generated adversarial images are smoother and the attack methods are more concealed, which in turn improves the accuracy and effectiveness of adversarial attacks.
Smart Images
Figure CN119810542A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, computer-readable storage medium, and computer program product for countering reprogramming attacks. Background Art
[0002] With the widespread application of adversarial attack technology, adversarial samples can be designed to make the AI model originally designed to complete task A be designed to complete another task B, where the AI model is only used for adversarial attack testing. However, traditional attack methods make the attack behavior easy to expose, resulting in poor attack effects. Summary of the invention
[0003] The embodiments of the present application provide a method, apparatus, device, computer-readable storage medium, and computer program product for countering reprogramming attacks, which can adaptively add corresponding countermeasure programs based on the characteristics of a carrier image, thereby improving the accuracy of the countermeasure attacks.
[0004] In a first aspect, an embodiment of the present application provides a method for resisting reprogramming attacks, comprising:
[0005] Perform super-pixel segmentation on the carrier image, and use the obtained super-pixel segmentation image as a noise template;
[0006] Adding disturbance information to each superpixel in the noise template to obtain a first adversarial program;
[0007] Adding a target image to the first adversarial program to obtain a second adversarial program; wherein the target image is an input image of the adversarial reprogramming attack task, and the size of the target image is smaller than the carrier image;
[0008] The second adversarial program is superimposed on the carrier image to obtain an adversarial image; wherein the adversarial image is used to perform the adversarial reprogramming attack task.
[0009] In a second aspect, an embodiment of the present application provides a device for resisting reprogramming attacks, comprising:
[0010] A superpixel division module is used to divide the carrier image into superpixels and use the obtained superpixel segmentation image as a noise template;
[0011] A first adversarial program generating module, configured to add disturbance information to each superpixel in the noise template to obtain a first adversarial program;
[0012] A second adversarial program generating module, configured to add a target image to the first adversarial program to obtain a second adversarial program; wherein the target image is an input image of the adversarial reprogramming attack task, and the size of the target image is smaller than the carrier image;
[0013] An adversarial image generation module is used to superimpose the second adversarial program into the carrier image to obtain an adversarial image; wherein the adversarial image is used to perform the adversarial reprogramming attack task.
[0014] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method for resisting reprogramming attacks provided in the first aspect of the embodiment of the present application are implemented.
[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method for countering reprogramming attacks provided in the first aspect of the embodiment of the present application are implemented.
[0016] In a fifth aspect, an embodiment of the present application provides a computer program product having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method for resisting reprogramming attacks provided in the first aspect of the embodiment of the present application are implemented.
[0017] The technical solution provided in the embodiment of the present application performs superpixel division on the carrier image, uses the obtained superpixel segmentation image as a noise template, adds disturbance information to each superpixel in the noise template to obtain a first adversarial program, adds the target image to the first adversarial program to obtain a second adversarial program, and superimposes the second adversarial program on the carrier image to obtain an adversarial image; that is, in the adversarial attack process, by performing superpixel division on the carrier image and adaptively adding disturbance based on the superpixel division result, the generated adversarial image is made smoother, thereby making the attack method more covert, thereby improving the accuracy of the adversarial attack. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] Figure 1 A schematic diagram of an application environment of the method for resisting reprogramming attacks provided in an embodiment of the present application;
[0019] Figure 2 A schematic diagram of a process for resisting reprogramming attacks provided in an embodiment of the present application;
[0020] Figure 3 Another flowchart of the method for resisting reprogramming attacks provided in an embodiment of the present application;
[0021] Figure 4A schematic diagram of a principle of a process for resisting reprogramming attacks provided in an embodiment of the present application;
[0022] Figure 5 A schematic diagram of a structure of a device for resisting reprogramming attacks provided in an embodiment of the present application;
[0023] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0024] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application are further described in detail through the following embodiments and in combination with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. Those skilled in the art can make adjustments to them as needed to suit specific application scenarios. It should also be noted that, for ease of description, only the parts related to the present application are shown in the accompanying drawings, rather than all structures.
[0025] Figure 1 A schematic diagram of the application environment of the method for resisting reprogramming attacks provided in an embodiment of the present application. Figure 1 , the anti-reprogramming attack method is applied to the anti-reprogramming attack system. The anti-reprogramming attack system may include a terminal 101 and a server 102. The terminal 101 and the server 102 are connected via a wireless network or a wired network. The terminal 101 may be a desktop terminal or a mobile terminal. Optionally, the mobile terminal may be at least one of a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a vehicle-mounted terminal (such as a vehicle-mounted navigation terminal), and a mobile phone. The server 102 may be an independent server or a server cluster consisting of multiple servers.
[0026] It should be noted that the method for resisting reprogramming attacks in the embodiment of the present application can be executed separately by the terminal 101 or the server 102, or can be jointly executed by the terminal 101 and the server 102. The following method embodiment is described by taking the execution subject as an electronic device (the electronic device is the terminal 101 and / or the server 102) as an example.
[0027] To facilitate the understanding of those skilled in the art, some concepts are introduced below:
[0028] Adversarial program: By making imperceptible and subtle perturbations or adding noise to the input of the AI model that performs task A, the AI model that originally performs task A is designed to complete another task B designed by the attacker. The above-mentioned perturbations or noise added to the input of the AI model can be called adversarial programs.
[0029] Adversarial reprogramming: In the white-box state, by designing adversarial input, the artificial intelligence model that originally performs task A is designed to complete another task B designed by the attacker. This type of attack is called adversarial reprogramming.
[0030] Figure 2 A flow chart of a method for resisting reprogramming attacks provided in an embodiment of the present application. Figure 2 As shown, the method may include:
[0031] S201, performing super-pixel segmentation on the carrier image, and using the obtained super-pixel segmentation image as a noise template.
[0032] The carrier image can be understood as the original image used to carry the adversarial program, which is the basis for generating adversarial samples. Adversarial samples are formed by adding small but carefully designed perturbations (i.e., perturbation programs) to the carrier image, with the aim of allowing the modified image to deceive the attacked AI model into performing another task.
[0033] In this embodiment, a superpixel segmentation algorithm can be used to perform superpixel division on the carrier image, and parts of the carrier image with similar features such as texture, color, and brightness can be divided into small sub-regions. The obtained superpixel segmentation image is used as a noise template, and superpixels are used to guide the generation of adversarial perturbations (i.e., adversarial programs).
[0034] In one example, the carrier image can be divided into superpixels by the following process:
[0035] K pixel block centers are randomly generated, and the distance between each pixel and each pixel block center is calculated in turn. Based on the calculated distance, each pixel is divided into the nearest pixel block center. Multiple adjacent pixels are combined into a superpixel through calculation, and the pixel block center and superpixel are iteratively updated until convergence. Each pixel is identified by color coordinates (L, a, b) and position coordinates (x, y). The distance D between each pixel and each pixel block center includes the color distance d c and the position distance d s . Color distance d c and the position distance d s It can be calculated by the following formula 1 and formula 2 respectively:
[0036]
[0037] Among them, i and j respectively indicate the center of the i-th pixel block and the j-th pixel;
[0038] The distance D between each pixel and the center of each pixel block can be calculated by the following formula 3:
[0039]
[0040] Among them, m and s are constant parameters for adjusting the two distances.
[0041] S202. Add disturbance information to each superpixel in the noise template to obtain a first adversarial program.
[0042] In this embodiment, disturbance information is added to each superpixel in the noise template in units of superpixels, that is, the disturbances in the same superpixel are the same, which can ensure the smoothness of the local disturbance and thus ensure the concealment of the adversarial attack.
[0043] In one embodiment, disturbance information may be added to each superpixel in the noise template based on a frequency domain method, such as converting the noise template to a Fourier transform domain and adding disturbance information by modifying frequency domain coefficients.
[0044] In one embodiment, disturbance information may also be added to each superpixel in the noise template through the following process:
[0045] Obtain a perturbation data set; based on a preset mapping function, assign each perturbation value in the perturbation data set to each superpixel in the noise template one by one to obtain a first adversarial program.
[0046] The length of the perturbation data set is equal to the number of superpixels contained in the noise template. The perturbation values in the perturbation data set can be randomly generated using a random generator or obtained after adversarial attack training.
[0047] After the perturbation data set is obtained, each perturbation value in the perturbation data set can be assigned one-to-one to each superpixel in the noise template according to a preset mapping function to obtain a first adversarial program with the same size as the carrier image.
[0048] For example, the carrier image is divided into n superpixels, that is, the number of superpixels contained in the noise template is n, and the perturbation data set is set according to n, and the perturbation data set can be set to a three-dimensional array of 1*n*3, where the value "3" corresponds to the three RGB channels of the image. Further, a random generator is used to randomly generate perturbation values in the perturbation data set, and then each superpixel in the noise template is traversed, and each perturbation value is assigned to the superpixel corresponding to the serial number of each perturbation value in the perturbation data set according to the serial number, to obtain the first adversarial program.
[0049] S203: Add the target image to the first adversarial program to obtain a second adversarial program.
[0050] The target image is the input image of the adversarial reprogramming attack task, and the size of the target image is smaller than the carrier image. For example, the artificial intelligence model used for the adversarial attack test originally classifies and recognizes the carrier image. The adversarial reprogramming attack enables the artificial intelligence model to perform classification and recognition of the target image. Therefore, it is necessary to add the input image required for the adversarial reprogramming attack task in the first adversarial program.
[0051] In order to achieve the adversarial reprogramming attack task, a target image with a size smaller than the carrier image can be selected and added to the first adversarial program. For example, an image is arbitrarily selected. If the size of the image is greater than or equal to the size of the carrier image, the image is cropped according to the size of the carrier image so that the size of the cropped image is smaller than the carrier image, and the cropped image is added to the first adversarial program as the target image. In one example, an image can also be directly selected from the minist dataset as the target image and added to the first adversarial program.
[0052] S204: superimpose the second adversarial program onto the carrier image to obtain an adversarial image.
[0053] After obtaining the second adversarial program, the second adversarial program is added to the carrier image to obtain a final adversarial image, and the adversarial reprogramming task is performed using the adversarial image.
[0054] The adversarial reprogramming attack method provided in the embodiment of the present application performs superpixel division on the carrier image, uses the obtained superpixel segmentation image as a noise template, adds disturbance information to each superpixel in the noise template to obtain a first adversarial program, adds the target image to the first adversarial program to obtain a second adversarial program, and superimposes the second adversarial program on the carrier image to obtain an adversarial image; that is, in the adversarial attack process, by performing superpixel division on the carrier image and adaptively adding disturbance based on the superpixel division result, the generated adversarial image is made smoother, thereby making the attack method more covert, thereby improving the adversarial attack effect.
[0055] Figure 3 Another flowchart of the method for resisting reprogramming attacks provided in the embodiment of the present application is shown in FIG. Figure 3 and Figure 4 As shown, the method may include:
[0056] S301, performing super-pixel segmentation on the carrier image, and using the obtained super-pixel segmentation image as a noise template.
[0057] S302: Add disturbance information to each superpixel in the noise template to obtain a first adversarial program.
[0058] S303: Zero-fill the target image to obtain a filled image.
[0059] The size of the padding image is the same as that of the carrier image, that is, zero pixels are padded around the target image, so that the target image is padded to the same size as the carrier image.
[0060] S304 , performing an XOR operation on the first adversarial program and the masking matrix, and combining the obtained XOR operation result with the filling image to obtain a second adversarial program.
[0061] The masking matrix has the same size as the carrier image, and the elements in the area of the masking matrix that has the same size as the target image are 0, and the elements in the remaining areas are 1.
[0062] S305. Perform attention processing on the carrier image based on the attention mechanism module to obtain a weight matrix.
[0063] S306 : Perform weighted processing on the second adversarial program based on the weight matrix to obtain a third adversarial program.
[0064] S307 , superimposing the third adversarial program onto the carrier image to obtain an adversarial image.
[0065] Specifically, the attention mechanism can use the attention scoring function to determine the attention distribution (i.e., weight matrix) of the carrier image, and use the calculated attention distribution to weight the second adversarial program, thereby increasing or decreasing the degree of disturbance in different regions. For example, for regions that are more important to the adversarial reprogramming attack task, more targeted disturbances are applied, and for non-critical regions of the adversarial reprogramming attack task, the disturbances are weakened to avoid the exposure of attack behaviors caused by excessive disturbances in non-critical regions. Among them, the attention scoring function can adopt an additive model, a dot product model, or a bilinear model, etc.
[0066] In this embodiment, superpixel segmentation is used to maintain the local consistency of the image, and perturbations are adaptively added in a superpixel-guided manner. At the same time, differentiated and targeted perturbations are achieved by introducing an attention mechanism, ensuring that even when adversarial perturbations are added, the adversarial image still maintains a certain degree of naturalness and coherence visually, reducing traces of attacks and improving the accuracy of adversarial reprogramming.
[0067] In one embodiment, optionally, a method for resisting reprogramming attacks is also provided, and the specific process is as follows:
[0068] The carrier image is divided into superpixels, and the obtained superpixel segmentation image is used as a noise template. A perturbation data set with a length equal to the number of superpixels is randomly initialized. The perturbation values in the perturbation data set are assigned one by one to each superpixel in the noise template using a preset mapping function to obtain a first adversarial program; then, the target image that needs to be processed by the adversarial reprogramming task is added to the first adversarial program to obtain a second adversarial program, and the carrier image is processed by the attention mechanism module to obtain a weight matrix. The second adversarial program is weighted by the weight matrix to obtain a third adversarial program, and the third adversarial program is superimposed on the carrier image to obtain an adversarial image, and the adversarial reprogramming task is performed using the adversarial image. Further, the adversarial execution result of the adversarial reprogramming task is obtained. If the adversarial execution result does not meet the preset threshold, the above-mentioned perturbation data set is updated, and the noise template is re-perturbed using the updated perturbation data set until the adversarial execution result meets the preset threshold, thereby completing the adversarial reprogramming task.
[0069] Figure 5 A schematic diagram of a structure of a device for resisting reprogramming attacks provided in an embodiment of the present application. Figure 5 As shown, the device may include: a superpixel division module 501, a first adversarial program generation module 502, a second adversarial program generation module 503 and an adversarial image generation module 504.
[0070] Specifically, the superpixel division module 501 is used to divide the carrier image into superpixels, and use the obtained superpixel segmented image as a noise template;
[0071] The first adversarial program generating module 502 is used to add disturbance information to each superpixel in the noise template to obtain a first adversarial program;
[0072] The second adversarial program generating module 503 is used to add the target image to the first adversarial program to obtain a second adversarial program; wherein the target image is an input image of the adversarial reprogramming attack task, and the size of the target image is smaller than the carrier image;
[0073] The adversarial image generation module 504 is used to superimpose the second adversarial program into the carrier image to obtain an adversarial image; wherein the adversarial image is used to perform the adversarial reprogramming attack task.
[0074] On the basis of the above embodiment, optionally, it further includes: a weight matrix acquisition module.
[0075] The weight matrix acquisition module is used to perform attention processing on the carrier image based on the attention mechanism module to obtain a weight matrix;
[0076] Correspondingly, the adversarial image generation module 504 is further used to perform weighted processing on the second adversarial program based on the weight matrix to obtain a third adversarial program; and superimpose the third adversarial program on the carrier image to obtain an adversarial image.
[0077] On the basis of the above embodiment, optionally, the first adversarial program generation module 502 is also used to obtain a perturbation data set; based on a preset mapping function, each perturbation value in the perturbation data set is assigned one-to-one to each superpixel in the noise template to obtain a first adversarial program; wherein the length of the perturbation data set is equal to the number of superpixels contained in the noise template.
[0078] On the basis of the above embodiment, optionally, the second adversarial program generation module 503 is also used to zero-fill the target image to obtain a filled image; perform an XOR operation on the first adversarial program and the masking matrix, and merge the obtained XOR operation result with the filled image to obtain the second adversarial program; wherein, the masking matrix is the same size as the carrier image, and the elements in the masking matrix that are in the same size as the target image are 0, and the elements in the remaining areas are 1; wherein, the size of the filled image is the same as the size of the carrier image.
[0079] On the basis of the above embodiment, optionally, the superpixel division module 501 is also used to randomly generate K pixel block centers, calculate the distance between each pixel and the center of each pixel block in turn, and divide each pixel to the nearest pixel block center based on the calculated distance, and combine multiple adjacent pixels into a superpixel through calculation, and iteratively update the pixel block center and the superpixel until final convergence.
[0080] Optionally, the perturbation information within each superpixel is the same.
[0081] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 6 As shown, the device includes a processor 60, a memory 61, an input device 62 and an output device 63; the number of the processor 60 in the device can be one or more. Figure 6 A processor 60 is taken as an example; the processor 60, memory 61, input device 62 and output device 63 in the device can be connected by a bus or other means. Figure 6 The example of connecting through bus is taken in the following.
[0082] The memory 61, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the method for resisting reprogramming attacks in the embodiments of the present application (for example, the superpixel division module 501, the first adversarial program generation module 502, the second adversarial program generation module 503 and the adversarial image generation module 504 in the device for resisting reprogramming attacks). The processor 60 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 61, that is, implements the method for resisting reprogramming attacks provided in any of the above embodiments.
[0083] The memory 61 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created during the process of countering reprogramming attacks, etc. In addition, the memory 61 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 61 may further include a memory remotely arranged relative to the processor 60, and these remote memories may be connected to the device / terminal / server via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0084] The input device 62 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the electronic device. The output device 63 may include a display device such as a display screen.
[0085] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:
[0086] Perform super-pixel segmentation on the carrier image, and use the obtained super-pixel segmentation image as a noise template;
[0087] Adding disturbance information to each superpixel in the noise template to obtain a first adversarial program;
[0088] Adding a target image to the first adversarial program to obtain a second adversarial program; wherein the target image is an input image of the adversarial reprogramming attack task, and the size of the target image is smaller than the carrier image;
[0089] The second adversarial program is superimposed on the carrier image to obtain an adversarial image; wherein the adversarial image is used to perform the adversarial reprogramming attack task.
[0090] In one embodiment, a computer program product is further provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:
[0091] Perform super-pixel segmentation on the carrier image, and use the obtained super-pixel segmentation image as a noise template;
[0092] Adding disturbance information to each superpixel in the noise template to obtain a first adversarial program;
[0093] Adding a target image to the first adversarial program to obtain a second adversarial program; wherein the target image is an input image of the adversarial reprogramming attack task, and the size of the target image is smaller than the carrier image;
[0094] The second adversarial program is superimposed on the carrier image to obtain an adversarial image; wherein the adversarial image is used to perform the adversarial reprogramming attack task.
[0095] The anti-reprogramming attack device, electronic device, computer-readable storage medium, and computer program product provided in the above embodiments can execute the anti-reprogramming attack method provided in any embodiment of the present application, and have the corresponding functional modules and beneficial effects of executing the method. For technical details not described in detail in the above embodiments, please refer to the anti-reprogramming attack method provided in any embodiment of the present application.
[0096] Through the above description of the implementation method, the technicians in the relevant field can clearly understand that the present application can be implemented with the help of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.
[0097] It is worth noting that the various units and modules included in the above embodiments are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application.
[0098] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.
Claims
1. A method for resisting reprogramming attacks, characterized in that: include: Perform super-pixel segmentation on the carrier image, and use the obtained super-pixel segmentation image as a noise template; Adding disturbance information to each superpixel in the noise template to obtain a first adversarial program; Adding a target image to the first adversarial program to obtain a second adversarial program; wherein the target image is an input image of the adversarial reprogramming attack task, and the size of the target image is smaller than the carrier image; The second adversarial program is superimposed on the carrier image to obtain an adversarial image; wherein the adversarial image is used to perform the adversarial reprogramming attack task.
2. The method according to claim 1, characterized in that Before superimposing the second adversarial program onto the carrier image to obtain the adversarial image, the method further includes: Performing attention processing on the carrier image based on the attention mechanism module to obtain a weight matrix; Correspondingly, superimposing the second adversarial program onto the carrier image to obtain an adversarial image includes: Performing weighted processing on the second adversarial program based on the weight matrix to obtain a third adversarial program; The third adversarial program is superimposed on the carrier image to obtain an adversarial image.
3. The method according to claim 1, characterized in that The step of adding disturbance information to each superpixel in the noise template to obtain a first adversarial program includes: Acquire a perturbation data set; wherein the length of the perturbation data set is equal to the number of superpixels included in the noise template; Based on a preset mapping function, each disturbance value in the disturbance data set is assigned one-to-one to each superpixel in the noise template to obtain a first adversarial program.
4. The method according to claim 1, characterized in that: The step of adding the target image to the first adversarial program to obtain a second adversarial program includes: Zero-filling the target image to obtain a filled image; wherein the size of the filled image is the same as the size of the carrier image; The first adversarial program is subjected to an XOR operation with a masking matrix, and the XOR operation result is combined with the filled image to obtain the second adversarial program; wherein the masking matrix is the same size as the carrier image, and the elements in the area of the masking matrix that is the same size as the target image are 0, and the elements in the remaining areas are 1.
5. The method according to claim 1, characterized in that The step of dividing the carrier image into superpixels comprises: K pixel block centers are randomly generated, and the distance between each pixel and each pixel block center is calculated in turn. Based on the calculated distance, each pixel is divided into the nearest pixel block center. Multiple adjacent pixels are combined into a superpixel through calculation, and the pixel block center and superpixel are iteratively updated until final convergence.
6. The method according to claim 1, characterized in that The perturbation information within each superpixel is the same.
7. A device for resisting reprogramming attacks, characterized in that: include: A superpixel division module is used to divide the carrier image into superpixels and use the obtained superpixel segmentation image as a noise template; A first adversarial program generating module, configured to add disturbance information to each superpixel in the noise template to obtain a first adversarial program; A second adversarial program generating module, configured to add a target image to the first adversarial program to obtain a second adversarial program; wherein the target image is an input image of the adversarial reprogramming attack task, and the size of the target image is smaller than the carrier image; An adversarial image generation module is used to superimpose the second adversarial program into the carrier image to obtain an adversarial image; wherein the adversarial image is used to perform the adversarial reprogramming attack task.
8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.
10. A computer program product having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.