Passive attack countermeasure method and device for verification code image, equipment and medium

Abstract

The invention provides a passive adversarial attack method, device and equipment for a verification code image and a medium, relates to the technical field of passive adversarial attack of images, breaks through the limitation that the traditional adversarial attack depends on an original image, and combines an advanced language model and a multi-mode technology to realize the passive adversarial attack of the verification code image. And generating a high-quality confrontation sample according to a text prompt provided by an attacker. In a target attack scene, key variables in an image generation process are accurately regulated and controlled by virtue of an optimized diffusion model technology, so that a highly vivid confrontation image is generated; in a complex black box attack environment, a unique double-path optimization strategy is adopted, gradient information of multiple models is integrated, the defense barrier of an unknown model is effectively broken through, and efficient misclassification is achieved. The concealment and transferability of the countermeasure attack are obviously enhanced, the negative influence of the traditional method on the user experience is avoided, and the natural and available countermeasure sample can be generated without depending on the original image.

Description

Technical Field

[0001] The present invention relates to the technical field of passive anti-attack for images, and in particular to a passive anti-attack method, device, equipment and medium for verification code images. Background Art

[0002] In today's digital age, with the rapid development of artificial intelligence, the security of cyberspace faces new challenges. In particular, the CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) system, which was originally a key line of defense to distinguish between humans and machine programs, has gradually become vulnerable due to the advancement of deep learning technology. The original intention of the traditional CAPTCHA image design was to prevent automated attacks, but with the breakthrough of deep neural networks (DNN) in the field of image recognition, the defense capabilities of these CAPTCHAs have been greatly weakened. DNN can accurately identify patterns and features in images, making the CAPTCHAs that were originally difficult to be cracked by machines become precarious.

[0003] To address this problem, researchers began to explore adversarial attack techniques, attempting to mislead the DNN model by introducing tiny, imperceptible perturbations into the image, making it unable to correctly identify the CAPTCHA image. However, these traditional adversarial attack methods have many limitations. On the one hand, they are highly dependent on the features of the original image and require precise perturbations of the original image. Once the perturbation amplitude is too large, the image will be obviously distorted or distorted, which will not only affect the visual effect of the CAPTCHA, but may also reduce the recognition success rate of normal users. On the other hand, in practical applications, due to factors such as image copyright and privacy protection, attackers often cannot directly obtain the original source file of the target CAPTCHA image, which makes traditional attack methods based on perturbations of the original image difficult to implement.

[0004] In addition, although some existing improved methods have improved the success rate and robustness of adversarial attacks to a certain extent, there are still many problems. For example, some methods improve the transferability of attacks by optimizing data augmentation parameters or using meta-learning methods, but these methods often require a lot of computing resources and data support, and may cause the system to become complicated and slow in practical applications. Some methods also generate adversarial samples by constructing unconstrained adversarial samples or using the denoising process of diffusion models. Although they have broken through the limitations of traditional attack methods to a certain extent, the adversarial samples generated by these methods may have problems such as poor visual effects and difficulty in being recognized by human users, which affects their application value in practical scenarios.

[0005] In the security field, researchers have also tried to enhance the security of verification codes by incorporating imperceptible perturbations into them. However, while these methods improve adversarial resistance, they often have a negative impact on user experience. For example, while adding image distortion, noise, or character interference can improve the defense capabilities of verification codes, they may make it difficult for normal users to recognize them, especially for the elderly, the visually impaired, or non-technical users. Overly complex verification codes may prevent them from passing the verification smoothly, leading to user loss. In addition, some verification codes add time limits to limit the recognition of automated programs, but this may put additional pressure on real users, especially when the network conditions are poor or the user's response is slow.

[0006] In summary, existing CAPTCHA defense technologies and adversarial attack methods face many challenges and problems. On the one hand, traditional CAPTCHA systems have gradually lost their original defense capabilities in the face of deep learning technology; on the other hand, although existing adversarial attack methods have improved the success rate of attacks to a certain extent, they have problems such as strong dependence on the original image, poor visual effects of the generated adversarial samples, and great impact on user experience. Therefore, there is an urgent need for a new technical solution that can generate high-quality adversarial samples without relying on the original image, while taking into account the concealment, transferability, and user experience of the attack, so as to effectively respond to the challenges faced by the current CAPTCHA system.

[0007] In view of this, this application is filed. Summary of the invention

[0008] The present invention provides a passive anti-attack method, device, equipment and medium for verification code images, which can at least partially improve the above-mentioned problems.

[0009] To achieve the above object, the present invention adopts the following technical solutions: A passive counterattack method for a verification code image, comprising: Obtain a short text prompt, and use the LLM model to transform the short text prompt to generate an extended prompt; Inputting the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt; The initial image is optimized based on the gradient information of the target model, the gradient information is used to adjust the latent variables of the initial image through a back-propagation process to obtain an optimized latent variable pair, and the optimized latent variable pair is merged into one latent variable; The combined latent variables are optimized to obtain adversarial samples, and the adversarial samples are input into a preset diffusion generation model to generate a final target adversarial sample.

[0010] The present invention also provides a passive anti-attack device for verification code images, which includes: A conversion unit, used for obtaining a short text prompt, and using the LLM model to convert the short text prompt to generate an extended prompt; A diffusion unit, used for inputting the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt; An optimization unit, configured to optimize the initial image based on the gradient information of the target model, wherein the gradient information is used to adjust the latent variables of the initial image through a back-propagation process to obtain an optimized latent variable pair, and the optimized latent variable pair is merged into one latent variable; The target adversarial sample generation unit is used to optimize the merged latent variables to obtain adversarial samples, and input the adversarial samples into a preset diffusion generation model to generate a final target adversarial sample.

[0011] The present invention also provides a passive anti-attack device for verification code images, which includes: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the passive anti-attack method for verification code images as described in any one of the above.

[0012] The present invention also provides a readable storage medium, comprising: a computer program stored therein, wherein the computer program can be executed by a processor of a device where the storage medium is located to implement the passive counter-attack method for a verification code image as described in any one of the above items.

[0013] In summary, the passive adversarial attack method for verification code images solves many problems existing in the prior art through innovative technical means. Traditional methods often rely on original images when generating adversarial samples, which not only limits the flexibility of the attack, but also may cause the generated samples to be visually distorted or distorted, thereby affecting the user experience.

[0014] It cleverly combines advanced language models and multimodal technologies, and can independently generate high-quality adversarial samples based on text prompts provided by the attacker, without relying on the original image of the target verification code. In the specific implementation process, a unique diffusion model optimization technology is used in the target attack scenario. By fine-tuning the key variables in the image generation process, the generated adversarial samples are more realistic in visual effects, thereby significantly improving the success rate of the attack. In the more challenging black-box attack scenario, the proposed dual-path optimization strategy has played a huge advantage. By integrating the gradient information of multiple proxy models, this strategy effectively breaks through the defense barriers of unknown models and achieves a high success rate of misclassification attacks. This innovative strategy not only improves the concealment of the attack, but also enhances the transferability of adversarial samples, enabling it to maintain efficient attack performance in different deep neural network architectures and black-box environments. In addition, this method always pays attention to the protection of user experience in the process of generating adversarial samples. By precisely controlling the amplitude and method of the perturbation, the generated samples are ensured to be visually natural and readable, avoiding the common image distortion or distortion problems in traditional methods, thereby achieving an effective attack on the verification code system without affecting the normal user recognition experience. In general, this method not only solves the problems existing in the existing technology through a series of innovative technical means, but also provides a new idea and method for the development of security protection and adversarial technology of verification code system, which has important practical application value and broad development prospects. It aims to solve the problems of traditional adversarial attack methods' dependence on original images when generating adversarial samples, and the resulting decline in user experience and limited attack success rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a flowchart of a passive counterattack method for verification code images provided by the first embodiment of the present invention; Figure 2 It is an overall flow chart of BP-UAC (Bi-Path UAC, dual-path passive countermeasure against CAPTCHA) provided by an embodiment of the present invention; Figure 3 is an example diagram of an algorithm of a UAC method provided by an embodiment of the present invention; Figure 4 is an algorithm example diagram of the BP-UAC method provided in an embodiment of the present invention; Figure 5 is a verification code image generated by an embodiment of the present invention; Figure 6 It is a module diagram of a passive anti-attack device for verification code images provided by the second embodiment of the present invention. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0017] refer to Figures 1 to 4 As shown, the first embodiment of the present invention discloses a passive anti-attack method for a verification code image, which can be executed by a passive anti-attack device for a verification code image (hereinafter referred to as a passive anti-attack device), and in particular, executed by one or more processors in the passive anti-attack device to implement the following method: S1, obtaining a short text prompt, and using the LLM model to transform the short text prompt to generate an extended prompt; Specifically, step S1 includes: obtaining a short text prompt P related to the attack target input by the user; The LLM model is used to expand and parse the short text prompt P to generate a detailed extended prompt. ,in, is the output function of the LLM model, indicating the input prompt The expansion and parsing process, the expansion prompt Used to ensure that the generated CAPTCHA image matches the attacker's intention.

[0018] In this embodiment, a short text prompt is taken, and the LLM model (Large Language Model) is used to transform the short text prompt to generate an extended prompt. Specifically, this process starts with collecting information input by the user, and the user will provide a short text prompt P related to the attack target. This prompt P is a preliminary description given by the user based on his attack intention, which is usually concise and may only contain basic key information. Subsequently, this short text prompt P is input into the LLM model. The LLM model uses its powerful language understanding and generation capabilities to expand and parse the prompt P. In this process, the LLM model will deeply understand the semantic information in the prompt P, dig out the richer content and details implied therein, and transform it into a more detailed and specific extended prompt. This extended prompt not only contains the core intention of the original prompt P, but also adds more relevant information, so that the CAPTCHA image generated subsequently can more accurately meet the attacker's intentions.

[0019] For example, suppose the short text prompt P entered by the user is "Generate a verification code image containing letters and numbers". After being processed by the LLM model, the generated extended prompt may be "Generate a verification code image containing uppercase letters, lowercase letters and numbers, the font of the letters and numbers is Times New Roman, the image background is light gray, the character color is dark blue, there is a certain distance between characters, and the image resolution is 300dpi". Through such extended processing, more precise guidance can be provided for the subsequent image generation process to ensure that the generated verification code image is highly consistent with the attacker's expectations in terms of content and form.

[0020] S2, inputting the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt; Specifically, step S2 includes: using a preset diffusion generation model G to generate the extended prompt Perform conditional generative processing based on latent variables and extended prompts At each time step Generate the corresponding intermediate latent variables , and according to the intermediate latent variable Get the initial image; Its mathematical expression is: ,in, is the initial image, It is the noise term introduced in the generation process to ensure the diversity of generated images.

[0021] In this embodiment, the core of this step is to input the carefully extended prompt into the preset diffusion generation model to generate an initial image that is highly matched with the extended prompt. This process is not only directly related to the quality of subsequent adversarial samples, but also reflects the unique advantages of the present invention in the generation process.

[0022] Specifically, the generated detailed extension prompt is used as a conditional input and sent to the preset diffusion generation model G. The diffusion generation model G is a generation model based on deep learning, which generates images by gradually eliminating noise. During the generation process, the model generates corresponding intermediate latent variables at each time step based on the semantic information of the extension prompt and the latent variables. These intermediate latent variables are gradually refined and finally converge into a complete initial image. Among them, the role of the noise term is to ensure the diversity of the generated images and avoid the generated images being too single, thereby enhancing the generalization ability and generation effect of the model.

[0023] In actual operation, assuming that the processed extended prompt is "generate a verification code image containing uppercase letters, lowercase letters and numbers, with Times New Roman font, light gray background and dark blue character color", then in step S2, the diffusion generation model G will gradually generate an initial verification code image that meets the description based on these detailed semantic information. The model will consider these semantic details at each time step and adjust the latent variables to make the generated image gradually approach the target description.

[0024] S3, optimizing the initial image based on the gradient information of the target model, wherein the gradient information is used to adjust the latent variables of the initial image through a back propagation process to obtain an optimized latent variable pair, and the optimized latent variable pair is merged into one latent variable; Specifically, step S3 includes: based on the gradient information of the target model, by calculating the loss function, back-propagating the gradient, using the gradient descent method to gradually adjust the latent variables of the initial image, and updating the latent variable pair , so that the image features are optimized towards the target category; Until the optimized image features mislead the model's judgment, the optimized latent variable pair is obtained. , its mathematical expression is , ,in, is the loss function, For latent variable pair The gradient of For latent variable pair The gradient of The target label assigned to the attacker. For latent variable pair The learning rate, For latent variable pair The learning rate.

[0025] Use the weighted average formula to convert the optimized latent variables into Merge into a unified latent variable , and continue to diffuse the generation process of the target model; Unified latent variables The mathematical expression is: , .

[0026] In this embodiment, the initial image is optimized using the gradient information of the target model. The target model is a pre-trained deep neural network used to evaluate whether the generated image meets the attack target. During the optimization process, the difference between the generated image and the attack target is measured by calculating the loss function. The latent variable pairs are gradually adjusted according to these gradient information using the gradient descent method. By continuously adjusting the latent variable pairs, the features of the generated image are gradually optimized toward the target category until the optimized image features are misleading in the judgment of the target model, that is, the target model is successfully deceived so that it misjudges the optimized image as the target category.

[0027] Next, in order to further improve the quality and stability of the generated images, the optimized latent variable pairs are merged into a unified latent variable; the merging process adopts a weighted average formula. In this way, the final latent variable generated can combine the advantages of the two optimized latent variables to ensure that the generated image achieves the best balance between attack effect and visual quality.

[0028] S4, optimizing the merged latent variables to obtain adversarial samples, and inputting the adversarial samples into a preset diffusion generation model to generate a final target adversarial sample.

[0029] Specifically, step S4 includes: using the EDICT diffusion inversion model as a reversible time series diffusion framework, based on the merged latent variables , get adversarial samples ; The adversarial sample Input into the preset diffusion generation model G to generate the final target adversarial sample .

[0030] In this embodiment, the merged latent variables are further optimized, and the optimized latent variables are used to generate the final target adversarial samples. This process not only ensures the high quality and high attack success rate of the adversarial samples, but also reflects the efficiency and flexibility of the present invention in generating adversarial samples. First, the EDICT (Exact Diffusion Inversion via Coupled Transformations) diffusion inversion model is used as a reversible time-series diffusion framework. The EDICT model can further optimize the merged latent variables through an accurate diffusion inversion process. The model uses coupled transformation technology to ensure that the characteristic information of the latent variables is retained and enhanced during the optimization process, thereby generating more realistic adversarial samples.

[0031] Next, the optimized adversarial sample latent variables are input into the preset diffusion generation model G. The diffusion generation model G generates the final target adversarial sample based on the optimized latent variables. This process does not rely on the original image, which further improves the security and flexibility of the system. Attackers can generate high-quality adversarial samples without the original image, which not only broadens the application scenarios of the attack, but also makes the attack more covert and difficult to detect. In this way, this method not only ensures the attack effect, but also takes into account the user experience and the practicality of the system, providing new ideas and methods for the security protection of the verification code system and the development of adversarial technology.

[0032] Preferably, before the attack process, the gradient of the multimodal model is used for preliminary optimization. Based on the multimodal model, the semantic features of the target prompt word are embedded in the generation process to ensure that the generated image is semantically consistent with the input prompt word, specifically: Assume that there are three known proxy models, whose predicted probability distributions are , and their corresponding parameters are , the mathematical expression process of updating the latent variables according to the surrogate model is: , , , , ,in, For the first classifier The probability distribution of the categories, is the probability distribution of the first classifier for the predicted first category, For the second classifier The probability distribution of the categories, is the probability distribution of the second classifier for the predicted first category, For the third classifier The probability distribution of the categories, is the probability distribution of the first category predicted by the third classifier; According to the collective gradient information of the proxy model, the generated adversarial samples are guided towards the second highest probability class and the target class probability class by minimizing the loss associated with the second highest and target class probability classes, as follows: ： , ,in, is the loss associated with the second highest probability category, is the loss associated with the target class; Aggregate the losses of multiple direction targets to obtain a new loss function, and calculate the gradient information based on the new loss function , where the new loss function is used to balance the guiding effects of the target class and the secondary class during the optimization process to break through the attack barrier of the black box model. The new loss function formula is: .

[0033] In this embodiment, in order to further improve the generation quality of adversarial samples and the success rate of attacks, especially in black-box attack scenarios, this method introduces the gradient of the multimodal model for preliminary optimization before the attack process. This optimization step not only enhances the semantic consistency of the generated images, but also significantly improves the concealment and transferability of adversarial samples.

[0034] Specifically, assuming that there are three known proxy models, during the generation process, the gradient information of these proxy models is used to preliminarily optimize the latent variables to ensure that the generated images are highly consistent with the input prompt words in semantics. This semantic consistency makes the generated images not only more natural, but also avoids the distribution drift problem that occurs during the generation process, significantly improving the visual quality. More importantly, the introduction of CLIP (Contrastive Language-Image Pre-Training) gradients also significantly enhances the concealment of adversarial samples. Secondly, based on the collective gradient information of these proxy models, the generation of adversarial samples is guided by minimizing the losses associated with the second highest probability class and the target class probability class. In order to balance the guiding effects of the target class and the secondary class during the optimization process, the losses of multiple directional targets are summarized to obtain a new loss function.

[0035] In short, firstly, by introducing the gradient of the multimodal model for preliminary optimization, it can ensure that the generated image is highly consistent with the input prompt word in semantics. This semantic consistency not only makes the generated image more natural, but also avoids the distribution drift problem that occurs during the generation process, significantly improving the visual quality. Secondly, by minimizing the loss associated with the second highest probability class and the target class probability class to guide the generation of adversarial samples, the concealment and transferability of adversarial samples are further enhanced. This optimization strategy enables the generated adversarial samples to not only effectively deceive the target model, but also maintain efficient attack performance in different deep neural network architectures and black box environments. In addition, the new loss function balances the guiding effect of the target class and the secondary class during the optimization process, breaking through the limitations of traditional methods in black box model attacks and significantly improving the success rate of the attack. In short, in the black box scenario of non-target attack, the present invention proposes BP-UAC, which combines multi-model gradients and dual-path optimization strategies, breaks through the unknown search space, and successfully achieves effective misclassification of unknown black box models. Among them, BP-UAC achieved a high attack success rate in various unknown recognition models, and the generated images were natural and realistic, which were difficult to be recognized by human observers and difficult to be distinguished by DNN.

[0036] See also Figure 5 In summary, the present invention proposes an innovative CAPTCHA image adversarial attack method, which aims to improve the security of the CAPTCHA system and the effectiveness of the attack through advanced technical means. It proposes UAC (Unsourced Adversarial CAPTCHA), a new attack framework that can generate noise-free adversarial samples based on text input specified by the attacker. UAC uses LLM and multimodal models to enhance image quality and diversity, and can work in both targeted and non-targeted attack modes. Specifically, the core of this method is to generate high-quality adversarial samples without relying on the original image, while ensuring that the generated image is visually natural and has a high attack success rate.

[0037] It first obtains a short text prompt input by the user and uses a large language model (LLM) to expand it and generate a detailed extended prompt. This process not only ensures that the generated verification code image can accurately reflect the attacker's intention, but also provides rich semantic information for subsequent image generation through the powerful language processing capabilities of the LLM. This generation method based on text prompts significantly improves the flexibility and adaptability of the system, allowing attackers to generate corresponding adversarial samples according to different attack targets. Subsequently, the extended prompt is input into the preset diffusion generation model to generate an initial image corresponding to the prompt. The diffusion generation model generates images by gradually eliminating noise. This process not only ensures the diversity of generated images, but also avoids the limitations of single generated images and lack of diversity in traditional methods. In addition, by introducing the noise term, the generalization ability of the generated image is further enhanced, so that the generated adversarial samples have stronger adaptability and attack success rate when facing different deep neural network models.

[0038] After the initial image is generated, the initial image is further optimized by the gradient information of the target model. By calculating the loss function and back-propagating the gradient, the latent variables of the initial image are gradually adjusted by the gradient descent method, and the optimized latent variable pairs are merged into a unified latent variable. This optimization process not only ensures that the features of the generated image are optimized toward the target category, but also merges the latent variable pairs by the weighted average formula, further improving the quality and stability of the generated image. This optimization strategy significantly improves the concealment and transferability of the attack, making the generated adversarial samples more visually natural, and avoiding the image distortion or distortion problems that may occur in traditional methods. In addition, the gradient of the multimodal model is introduced for preliminary optimization before the attack process, and the semantic features of the target prompt word are embedded to ensure that the generated image is highly consistent with the input prompt word in semantics. This process not only enhances the semantic consistency of the generated image, but also guides the generation of adversarial samples by minimizing the losses associated with the second highest probability class and the target class probability class, further improving the concealment and transferability of the adversarial samples. In this way, the present invention breaks through the limitations of traditional methods in black box model attacks and significantly improves the success rate of attacks.

[0039] In summary, the present invention not only solves the problems existing in the prior art through a series of innovative technical means, but also provides new ideas and methods for the development of security protection and adversarial technology of verification code systems. High-quality adversarial samples can be generated without relying on original images, which significantly improves the concealment and transferability of attacks, while ensuring that the generated images are visually natural and have a high attack success rate. These innovations not only improve the security and flexibility of the system, but also provide important references and lessons for the security protection of future verification code systems.

[0040] See also Figure 6 The second embodiment of the present invention provides a passive anti-attack device for verification code images, which includes: The conversion unit 201 is used to obtain a short text prompt and use the LLM model to convert the short text prompt to generate an extended prompt; A diffusion unit 202, configured to input the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt; An optimization unit 203 is used to optimize the initial image based on the gradient information of the target model, wherein the gradient information is used to adjust the latent variables of the initial image through a back propagation process to obtain an optimized latent variable pair, and the optimized latent variable pair is merged into one latent variable; The target adversarial sample generation unit 20.4 is used to optimize the merged latent variables to obtain adversarial samples, and input the adversarial samples into a preset diffusion generation model to generate a final target adversarial sample.

[0041] A third embodiment of the present invention provides a passive anti-attack device for verification code images, which includes: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the passive anti-attack method for verification code images as described in any one of the above.

[0042] A fourth embodiment of the present invention provides a readable storage medium, comprising: a computer program stored therein, wherein the computer program can be executed by a processor of a device where the storage medium is located, so as to implement any of the above-described passive countermeasure attack methods for verification code images.

[0043] Exemplarily, the above-mentioned devices and process steps can be implemented by a computer program. The computer program can be divided into one or more units. The one or more units are stored in the memory and executed by the processor to complete the present invention.

[0044] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0045] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the present invention by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0046] Wherein, if the electronic device or printer integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0047] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0048] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A passive counterattack method for verification code images, characterized in that: include: Obtain a short text prompt, and use the LLM model to transform the short text prompt to generate an extended prompt; Inputting the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt; The initial image is optimized based on the gradient information of the target model, the gradient information is used to adjust the latent variables of the initial image through a back-propagation process to obtain an optimized latent variable pair, and the optimized latent variable pair is merged into one latent variable; The combined latent variables are optimized to obtain adversarial samples, and the adversarial samples are input into a preset diffusion generation model to generate a final target adversarial sample.

2. The passive counterattack method for verification code images according to claim 1, characterized in that: Obtain a short text prompt, and use the LLM model to transform the short text prompt to generate an extended prompt, specifically: Obtain a short text prompt P related to the attack target input by the user; The LLM model is used to expand and parse the short text prompt P to generate a detailed extended prompt. ,in, is the output function of the LLM model, which represents the input prompt P P The expansion and parsing process. Used to ensure that the generated CAPTCHA image matches the attacker's intention.

3. The passive counterattack method for verification code images according to claim 2, characterized in that: The extended prompt is input into a preset diffusion generation model to generate an initial image corresponding to the extended prompt, specifically: Use the preset diffusion generation model G to extend the prompt Perform conditional generative processing based on latent variables and extended prompts At each time step Generate the corresponding intermediate latent variables , and according to the intermediate latent variable Get the initial image; Its mathematical expression is: ,in, is the initial image, It is the noise term introduced in the generation process to ensure the diversity of generated images.

4. The passive counterattack method for verification code images according to claim 1, characterized in that: The initial image is optimized based on the gradient information of the target model. The gradient information is used to adjust the latent variables of the initial image through a back-propagation process to obtain an optimized latent variable pair, specifically: Based on the gradient information of the target model, the loss function is calculated, the gradient is back-propagated, and the latent variables of the initial image are gradually adjusted using the gradient descent method to update the latent variables. , so that the image features are optimized towards the target category; Until the optimized image features mislead the model's judgment, the optimized latent variable pair is obtained. , its mathematical expression is: , ,in, is the loss function, For latent variable pair The gradient of For latent variable pair The gradient of The target label assigned to the attacker. For latent variable pair The learning rate, For latent variable pair The learning rate.

5. The passive counterattack method for verification code images according to claim 4 is characterized in that: The optimized latent variable pairs are merged into one latent variable, specifically: Use the weighted average formula to convert the optimized latent variables into Merge into a unified latent variable , and continue to diffuse the generation process of the target model; Unified latent variables The mathematical expression is: , .

6. The passive counterattack method for verification code images according to claim 5, characterized in that: The combined latent variables are optimized to obtain adversarial samples, and the adversarial samples are input into a preset diffusion generation model to generate the final target adversarial samples, specifically: Using the EDICT diffusion inversion model as a reversible time-series diffusion framework, based on the merged latent variables , get adversarial samples ; The adversarial sample Input into the preset diffusion generation model G to generate the final target adversarial sample .

7. The passive counterattack method for verification code images according to claim 6, characterized in that: Before the attack process, the gradient of the multimodal model is used for preliminary optimization. Based on the multimodal model, the semantic features of the target prompt word are embedded in the generation process to ensure that the generated image is semantically consistent with the input prompt word. Specifically: Assume that there are three known proxy models, whose predicted probability distributions are , and their corresponding parameters are , the mathematical expression process of updating the latent variables according to the surrogate model is: , , , , ,in, For the first classifier The probability distribution of the categories, is the probability distribution of the first classifier for the predicted first category, For the second classifier The probability distribution of the categories, is the probability distribution of the second classifier for the predicted first category, For the third classifier The probability distribution of the categories, is the probability distribution of the first category predicted by the third classifier; According to the collective gradient information of the proxy model, the generated adversarial samples are guided towards the second highest probability class and the target class probability class by minimizing the loss associated with the second highest and target class probability classes, as follows: ： , ,in, is the loss associated with the second highest probability category, is the loss associated with the target class; Aggregate the losses of multiple direction targets to obtain a new loss function, and calculate the gradient information based on the new loss function , where the new loss function is used to balance the guiding effects of the target class and the secondary class during the optimization process to break through the attack barrier of the black box model. The new loss function formula is: .

8. A passive anti-attack device for verification code images, characterized in that: include: A conversion unit, used for obtaining a short text prompt, and using the LLM model to convert the short text prompt to generate an extended prompt; A diffusion unit, used for inputting the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt; An optimization unit, configured to optimize the initial image based on the gradient information of the target model, wherein the gradient information is used to adjust the latent variables of the initial image through a back-propagation process to obtain an optimized latent variable pair, and the optimized latent variable pair is merged into one latent variable; The target adversarial sample generation unit is used to optimize the merged latent variables to obtain adversarial samples, and input the adversarial samples into a preset diffusion generation model to generate the final target adversarial samples.

9. A passive anti-attack device for verification code images, characterized in that: The invention comprises a processor, a memory and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the passive counter-attack method for verification code images according to any one of claims 1 to 7 is implemented.

10. A readable storage medium, characterized in that: A computer program is stored, and the computer program can be executed by a processor of the device where the storage medium is located to implement the passive counterattack method for verification code images as described in any one of claims 1 to 7.

Images