Passive counter-attack method, device, equipment and medium for verification code images

Abstract

The present invention provides a passive adversarial attack method, device, equipment and medium for verification code images, and relates to the technical field of passive adversarial attack on images. This method breaks through the limitation of traditional adversarial attacks relying on original images, and generates high-quality adversarial samples based on text prompts provided by the attacker by integrating advanced language models and multimodal technologies. In target attack scenarios, with the help of optimized diffusion model technology, key variables in the image generation process are precisely controlled to generate highly realistic adversarial images; while in complex black-box attack environments, a unique dual-path optimization strategy is adopted to integrate the gradient information of multiple models, effectively breaking through the defense barriers of unknown models and achieving efficient misclassification. Not only does it significantly enhance the concealment and transferability of adversarial attacks, it also avoids the negative impact of traditional methods on user experience, and can generate natural and usable adversarial samples without relying on original images.

Description

Technical Field

[0001] The present invention relates to the technical field of passive anti-attack for images, and in particular to a passive anti-attack method, device, equipment and medium for verification code images. Background Art

[0002] In today's digital age, with the rapid development of artificial intelligence, cybersecurity faces new challenges. CAPTCHAs, or Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA), in particular, have become increasingly vulnerable due to advances in deep learning technology. Traditional CAPTCHA images were originally designed to protect against automated attacks, but breakthroughs in image recognition using deep neural networks (DNNs) have significantly weakened their defenses. DNNs can accurately identify patterns and features in images, making CAPTCHAs, once difficult for machines to crack, vulnerable.

[0003] To address this issue, researchers have begun exploring adversarial attack techniques, attempting to mislead DNN models by introducing tiny, imperceptible perturbations into images, preventing them from correctly recognizing CAPTCHA images. However, these traditional adversarial attack methods have many limitations. On the one hand, they are highly dependent on the features of the original image and require precise perturbations of the original image. Once the perturbation amplitude is too large, the image will become noticeably distorted, which not only affects the visual effect of the CAPTCHA but may also reduce the recognition success rate for normal users. On the other hand, in practical applications, due to factors such as image copyright and privacy protection, attackers often cannot directly obtain the original source file of the target CAPTCHA image, making traditional attack methods based on perturbations of the original image difficult to implement.

[0004] Furthermore, while some existing improved methods have improved the success rate and robustness of adversarial attacks to a certain extent, many issues remain. For example, some methods improve the transferability of attacks by optimizing data augmentation parameters or leveraging meta-learning methods. However, these methods often require extensive computing resources and data support, and can lead to complex and slow systems in practical applications. Other methods generate adversarial examples by constructing unconstrained adversarial examples or leveraging the denoising process of diffusion models. While these methods overcome the limitations of traditional attack methods to a certain extent, the adversarial examples generated by these methods may suffer from poor visual quality and difficulty for human users to identify, thus limiting their practical application value.

[0005] In the security field, researchers have also tried to enhance the security of verification codes by incorporating imperceptible perturbations into them. However, while these methods improve adversarial resistance, they often have a negative impact on user experience. For example, while adding image distortion, noise, or character interference can improve the defense capabilities of verification codes, it may make it difficult for normal users to recognize them. In particular, for the elderly, the visually impaired, or non-technical users, overly complex verification codes may prevent them from passing the verification smoothly, leading to user loss. In addition, some verification codes add time limits to limit the recognition of automated programs, but this may put additional pressure on real users, especially when the network conditions are poor or the user's response is slow.

[0006] In summary, existing CAPTCHA defense technologies and adversarial attack methods face numerous challenges and problems. On the one hand, traditional CAPTCHA systems are gradually losing their original protection capabilities in the face of deep learning technologies. On the other hand, while existing adversarial attack methods have improved the success rate of attacks to a certain extent, they suffer from strong dependence on the original image, poor visual quality of the generated adversarial samples, and significant impact on user experience. Therefore, a new technical solution is urgently needed that can generate high-quality adversarial samples without relying on the original image, while also ensuring the stealthiness, transferability, and user experience of the attack, in order to effectively address the challenges facing current CAPTCHA systems.

[0007] In view of this, this application is filed. Summary of the Invention

[0008] The present invention provides a method, device, equipment and medium for passive anti-attack against verification code images, which can at least partially improve the above-mentioned problems.

[0009] To achieve the above object, the present invention adopts the following technical solutions:

[0010] A passive counter-attack method for verification code images, comprising:

[0011] Obtain a short text prompt, and transform the short text prompt using the LLM model to generate an extended prompt;

[0012] Inputting the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt;

[0013] Optimizing the initial image based on gradient information of the target model, adjusting the latent variables of the initial image through a back-propagation process to obtain optimized latent variable pairs, and merging the optimized latent variable pairs into one latent variable;

[0014] The combined latent variables are optimized to obtain adversarial samples, and the adversarial samples are input into a preset diffusion generation model to generate the final target adversarial samples.

[0015] The present invention also provides a passive anti-attack device for verification code images, which includes:

[0016] A conversion unit, configured to obtain a short text prompt and convert the short text prompt using an LLM model to generate an extended prompt;

[0017] a diffusion unit, configured to input the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt;

[0018] an optimization unit, configured to optimize the initial image based on gradient information of a target model, wherein the gradient information is used to adjust the latent variables of the initial image through a back-propagation process to obtain optimized latent variable pairs, and merge the optimized latent variable pairs into one latent variable;

[0019] The target adversarial sample generation unit is used to optimize the merged latent variables to obtain adversarial samples, and input the adversarial samples into a preset diffusion generation model to generate the final target adversarial samples.

[0020] The present invention also provides a passive anti-attack device for verification code images, which includes: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the passive anti-attack method for verification code images as described in any one of the above.

[0021] The present invention also provides a readable storage medium, comprising: storing a computer program, wherein the computer program can be executed by a processor of a device where the storage medium is located to implement any one of the above-described passive counter-attack methods for verification code images.

[0022] In summary, this passive adversarial attack method against CAPTCHA images addresses many issues with existing technologies through innovative technical means. Traditional methods often rely on the original image when generating adversarial samples, which not only limits the flexibility of the attack but can also cause the generated samples to appear visually distorted or distorted, thereby affecting the user experience.

[0023] This method cleverly combines advanced language models and multimodal techniques to independently generate high-quality adversarial examples based on textual prompts provided by the attacker, without relying on the original image of the target CAPTCHA. In its implementation, it employs a unique diffusion model optimization technique in targeted attack scenarios. By fine-tuning key variables in the image generation process, the generated adversarial examples are visually more realistic, significantly improving the attack success rate. In the more challenging black-box attack scenario, the proposed dual-path optimization strategy demonstrates significant advantages. By integrating gradient information from multiple proxy models, this strategy effectively overcomes the defense barriers of unknown models and achieves a high success rate of misclassification attacks. This innovative strategy not only improves the stealthiness of the attack but also enhances the transferability of adversarial examples, enabling them to maintain effective attack performance across different deep neural network architectures and black-box environments. Furthermore, this method maintains a strong focus on user experience during adversarial example generation. By precisely controlling the amplitude and method of the perturbations, the generated examples are visually natural and readable, avoiding the image distortion or distortion common in traditional methods. This allows for effective attacks against CAPTCHA systems without impacting the normal user experience. In summary, this method, through a series of innovative technical means, not only solves existing problems but also provides new ideas and methods for the security protection and adversarial technology of CAPTCHA systems. It has important practical application value and broad development prospects. It aims to address the problems of traditional adversarial attack methods, such as their reliance on original images when generating adversarial samples, which leads to a reduced user experience and limited attack success rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 1 is a flow chart of a passive counter-attack method for verification code images provided by the first embodiment of the present invention;

[0025] Figure 2 This is an overall flow chart of BP-UAC (Bi-Path UAC, dual-path passive countermeasure against CAPTCHA) provided by an embodiment of the present invention;

[0026] Figure 3 1 is an example diagram of an algorithm of a UAC method provided by an embodiment of the present invention;

[0027] Figure 4 is an example diagram of an algorithm of the BP-UAC method provided in an embodiment of the present invention;

[0028] Figure 5 is a verification code image generated by an embodiment of the present invention;

[0029] Figure 6 1 is a schematic diagram of a module of a passive anti-attack device for verification code images provided by a second embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0031] refer to Figures 1 to 4 As shown, the first embodiment of the present invention discloses a passive anti-attack method for verification code images, which can be executed by a passive anti-attack device for verification code images (hereinafter referred to as the passive anti-attack device). In particular, the method is executed by one or more processors in the passive anti-attack device to implement the following method:

[0032] S1, obtaining a short text prompt, and using the LLM model to transform the short text prompt to generate an extended prompt;

[0033] Specifically, step S1 includes: obtaining a short text prompt P related to the attack target input by the user;

[0034] The LLM model is used to expand and parse the short text prompt P to generate a detailed extended prompt ,in, is the output function of the LLM model, indicating the input prompt The expansion and parsing process, the expansion prompt Used to ensure that the generated CAPTCHA image matches the attacker's intention.

[0035] In this embodiment, a short text prompt is taken and transformed using the Large Language Model (LLM) model to generate an extended prompt. Specifically, this process begins by collecting user input. The user provides a short text prompt P related to the attack target. This prompt P is a preliminary description of the user's attack intent and is typically concise, perhaps containing only basic key information. This short text prompt P is then input into the LLM model. Leveraging its powerful language understanding and generation capabilities, the LLM model expands and parses prompt P. During this process, the LLM model deeply understands the semantic information within prompt P, extracting the richer content and details implicit within it, and transforming it into a more detailed and specific extended prompt. This extended prompt not only captures the core intent of the original prompt P but also adds more relevant information, ensuring that the subsequently generated CAPTCHA image more accurately reflects the attacker's intent.

[0036] For example, suppose the user enters a short text prompt P, "Generate a verification code image containing letters and numbers." After processing by the LLM model, the generated extended prompt might be "Generate a verification code image containing uppercase letters, lowercase letters, and numbers, with the letters and numbers in Times New Roman font, a light gray background, dark blue characters, a certain amount of spacing between characters, and an image resolution of 300 dpi." This extended processing can provide more precise guidance for the subsequent image generation process, ensuring that the generated verification code image is highly consistent with the attacker's expectations in both content and form.

[0037] S2, inputting the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt;

[0038] Specifically, step S2 includes: using the preset diffusion generation model G to generate the extended prompt Perform conditional generative processing based on latent variables and extended prompts At each time step Generate the corresponding intermediate latent variables , and according to the intermediate latent variable Get the initial image;

[0039] Its mathematical expression is: ,in, is the initial image, It is a noise term introduced in the generation process to ensure the diversity of generated images.

[0040] In this embodiment, the core of this step is to input the carefully expanded prompt into a pre-set diffusion generation model to generate an initial image that closely matches the expanded prompt. This process not only directly affects the quality of subsequent adversarial examples but also demonstrates the unique advantages of this invention in the generation process.

[0041] Specifically, the generated detailed expansion prompts are used as conditional inputs and fed into the pre-set diffusion generative model G. This model, based on deep learning, generates images by gradually eliminating noise. During the generation process, the model combines the semantic information of the expansion prompts with latent variables to generate corresponding intermediate latent variables at each time step. These intermediate latent variables are gradually refined and ultimately converge into a complete initial image. The noise term ensures diversity in the generated images, preventing them from being too monotonous, thereby enhancing the model's generalization and generation performance.

[0042] In practice, suppose the processed extended prompt is "Generate a CAPTCHA image containing uppercase letters, lowercase letters, and numbers, in Times New Roman font, on a light gray background, and dark blue characters." In step S2, the diffusion generation model G gradually generates an initial CAPTCHA image that matches the description based on this detailed semantic information. The model considers these semantic details at each time step and adjusts the latent variables to gradually bring the generated image closer to the target description.

[0043] S3, optimizing the initial image based on the gradient information of the target model, adjusting the latent variables of the initial image through a back-propagation process to obtain an optimized latent variable pair, and merging the optimized latent variable pair into one latent variable;

[0044] Specifically, step S3 includes: based on the gradient information of the target model, by calculating the loss function, back-propagating the gradient, and gradually adjusting the latent variables of the initial image using the gradient descent method, and updating the latent variable pair , so that the image features are optimized towards the target category;

[0045] Until the optimized image features mislead the model in its judgment, the optimized latent variable pair is obtained. , its mathematical expression is , ,in, is the loss function, For latent variable pair The gradient, For latent variable pair The gradient, The target label assigned to the attacker. For latent variable pair The learning rate, For latent variable pair The learning rate.

[0046] Use the weighted average formula to calculate the optimized latent variables Merge into a unified latent variable , and continue to diffuse the generation process of the target model;

[0047] Unified latent variables The mathematical expression is: , .

[0048] In this embodiment, the initial image is optimized using the gradient information of the target model. The target model is a pretrained deep neural network used to evaluate whether the generated image matches the attack target. During the optimization process, a loss function is calculated to measure the difference between the generated image and the attack target. Using gradient descent, the latent variable pairs are gradually adjusted based on this gradient information. By continuously adjusting the latent variable pairs, the features of the generated image are gradually optimized towards the target category until the optimized image features mislead the target model, successfully deceiving the target model into misclassifying the optimized image as belonging to the target category.

[0049] Next, to further improve the quality and stability of the generated images, the optimized latent variable pairs are merged into a unified latent variable using a weighted average formula. This approach creates a final latent variable that combines the strengths of both optimized latent variables, ensuring the generated images achieve an optimal balance between attack effectiveness and visual quality.

[0050] S4, optimizing the merged latent variables to obtain adversarial samples, and inputting the adversarial samples into a preset diffusion generation model to generate a final target adversarial sample.

[0051] Specifically, step S4 includes: using the EDICT diffusion inversion model as a reversible time series diffusion framework, based on the merged latent variables , get the adversarial sample ;

[0052] The adversarial sample Input into the preset diffusion generation model G to generate the final target adversarial sample .

[0053] In this embodiment, the merged latent variables are further optimized and the optimized latent variables are used to generate the final target adversarial samples. This process not only ensures the high quality and high attack success rate of the adversarial samples, but also reflects the efficiency and flexibility of the present invention in generating adversarial samples. First, the EDICT (Exact Diffusion Inversion via Coupled Transformations) diffusion inversion model is used as a reversible time-series diffusion framework. The EDICT model can further optimize the merged latent variables through an accurate diffusion inversion process. The model uses coupled transformation technology to ensure that the characteristic information of the latent variables is retained and enhanced during the optimization process, thereby generating more realistic adversarial samples.

[0054] Next, the optimized adversarial sample latent variables are fed into the pre-set diffusion generation model G. Based on the optimized latent variables, the diffusion generation model G generates the final target adversarial sample. This process eliminates the need for original images, further enhancing the security and flexibility of the system. Attackers can generate high-quality adversarial samples without the original image, which not only broadens the application scenarios of the attack but also makes the attack more covert and difficult to detect. In this way, this method ensures the effectiveness of the attack while also taking into account user experience and system practicality, providing new ideas and methods for the security protection of CAPTCHA systems and the development of adversarial technologies.

[0055] Preferably, before the attack process, the gradient of the multimodal model is used for preliminary optimization. Based on the multimodal model, the semantic features of the target prompt word are embedded in the generation process to ensure that the generated image is semantically consistent with the input prompt word. Specifically:

[0056] Assume that there are three known proxy models, whose predicted probability distributions are , and their corresponding parameters are , the mathematical expression process of updating the latent variables according to the surrogate model is: , , , , ,in, For the first classifier The probability distribution of categories, is the probability distribution of the first classifier for the predicted first category, For the second classifier The probability distribution of categories, is the probability distribution of the second classifier for the predicted first category, For the third classifier The probability distribution of categories, is the probability distribution of the first category predicted by the third classifier;

[0057] According to the collective gradient information of the proxy model, the generated adversarial samples are guided towards the second highest probability class and the target class probability class by minimizing the loss associated with the second highest and target class probability classes, as follows: ： , ,in, is the loss associated with the second most probable category, is the loss associated with the target class;

[0058] Aggregate the losses of multiple direction targets to obtain a new loss function, and calculate the gradient information based on the new loss function , wherein the new loss function is used to balance the guidance effects of the target class and the secondary class during the optimization process to break through the attack barrier of the black box model. The new loss function formula is: .

[0059] In this example, to further improve the quality of adversarial example generation and attack success rate, particularly in black-box attack scenarios, this method introduces a preliminary optimization of the gradient of a multimodal model before the attack process. This optimization step not only enhances the semantic consistency of the generated images but also significantly improves the stealth and transferability of adversarial examples.

[0060] Specifically, assuming the existence of three known proxy models, the gradient information of these proxy models is used during the generation process to initially optimize the latent variables, ensuring that the generated image is highly semantically consistent with the input prompt word. This semantic consistency not only makes the generated image more natural but also avoids the distribution drift problem that occurs during the generation process, significantly improving visual quality. Importantly, the introduction of CLIP (Contrastive Language-Image Pre-Training) gradients significantly enhances the concealment of adversarial examples. Secondly, based on the collective gradient information of these proxy models, adversarial example generation is guided by minimizing the loss associated with the second-highest probability class and the target class. To balance the guidance effect of the target class and secondary classes during the optimization process, a new loss function is derived by aggregating the losses of multiple direction objectives.

[0061] Briefly, first, by introducing the gradient of the multimodal model for preliminary optimization, the generated image is ensured to be highly semantically consistent with the input prompt word. This semantic consistency not only makes the generated image more natural but also avoids the distribution drift problem that occurs during the generation process, significantly improving visual quality. Secondly, by minimizing the loss associated with the second-highest probability class and the target class probability class to guide the generation of adversarial examples, the stealth and transferability of the adversarial examples are further enhanced. This optimization strategy enables the generated adversarial examples to not only effectively deceive the target model but also maintain efficient attack performance across different deep neural network architectures and black-box environments. In addition, the new loss function balances the guidance effect of the target class and the secondary class during the optimization process, breaking through the limitations of traditional methods in black-box model attacks and significantly improving the success rate of the attack. In short, in the black-box scenario of non-targeted attacks, this paper proposes BP-UAC, which combines multi-model gradients and a dual-path optimization strategy to break through the unknown search space and successfully achieve effective misclassification of unknown black-box models. Among them, BP-UAC achieved a high attack success rate in various unknown recognition models, and the generated images were natural and realistic, which were difficult for human observers to recognize and difficult for DNN to distinguish.

[0062] See also Figure 5 In summary, this paper proposes an innovative method for adversarial attacks against CAPTCHA images, aiming to improve the security of CAPTCHA systems and the effectiveness of attacks through advanced technical means. It proposes UAC (Unsourced Adversarial CAPTCHA), a novel attack framework that generates noise-free adversarial samples based on attacker-specified text input. UAC utilizes LLM and multimodal models to enhance image quality and diversity, and is capable of operating in both targeted and non-targeted attack modes. Specifically, the core of this method lies in generating high-quality adversarial samples without relying on the original image, while ensuring that the generated images are visually natural and have a high attack success rate.

[0063] The system first obtains a brief text prompt from the user and expands it using a large language model (LLM) to generate a detailed extended prompt. This process not only ensures that the generated CAPTCHA image accurately reflects the attacker's intent but also, leveraging the LLM's powerful language processing capabilities, provides rich semantic information for subsequent image generation. This text-based generation approach significantly improves the system's flexibility and adaptability, allowing attackers to generate adversarial examples tailored to different attack targets. The extended prompt is then fed into a pre-defined diffusion generation model to generate an initial image corresponding to the prompt. The diffusion generation model generates images by gradually eliminating noise. This process not only ensures the diversity of the generated images but also avoids the limitations of traditional methods, which generate a single, lacking image diversity. Furthermore, the introduction of a noise term further enhances the generalization of the generated images, making the generated adversarial examples more adaptable and more successful against different deep neural network models.

[0064] After generating the initial image, the initial image is further optimized using the gradient information of the target model. By calculating the loss function and backpropagating the gradient, the gradient descent method is used to gradually adjust the latent variables of the initial image. The optimized latent variable pairs are then merged into a unified latent variable. This optimization process not only ensures that the features of the generated image are optimized towards the target class, but also merges the latent variable pairs through a weighted average formula, further improving the quality and stability of the generated image. This optimization strategy significantly improves the stealth and transferability of the attack, making the generated adversarial examples more visually natural and avoiding the image distortion or distortion that may occur in traditional methods. In addition, the gradient of the multimodal model is introduced for preliminary optimization before the attack process. By embedding the semantic features of the target cue word, the generated image is ensured to be highly semantically consistent with the input cue word. This process not only enhances the semantic consistency of the generated image but also guides the generation of adversarial examples by minimizing the loss associated with the second-highest probability class and the target class probability class, further improving the stealth and transferability of adversarial examples. In this way, the present invention overcomes the limitations of traditional methods in black-box model attacks and significantly improves the success rate of attacks.

[0065] In summary, this invention, through a series of innovative technical approaches, not only addresses existing issues but also provides new insights and methods for the security and countermeasures of CAPTCHA systems. High-quality adversarial samples can be generated without relying on the original image, significantly improving the stealth and transferability of the attack while ensuring that the generated images are visually natural and have a high attack success rate. These innovations not only enhance the security and flexibility of the system but also provide important insights and references for future CAPTCHA security protection.

[0066] See also Figure 6 A second embodiment of the present invention provides a passive anti-attack device for verification code images, comprising:

[0067] The conversion unit 201 is used to obtain a short text prompt and convert the short text prompt using the LLM model to generate an extended prompt;

[0068] a diffusion unit 202, configured to input the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt;

[0069] An optimization unit 203 is configured to optimize the initial image based on the gradient information of the target model, wherein the gradient information is used to adjust the latent variables of the initial image through a back-propagation process to obtain an optimized latent variable pair, and merge the optimized latent variable pair into one latent variable;

[0070] The target adversarial sample generation unit 20.4 is used to optimize the merged latent variables to obtain adversarial samples, and input the adversarial samples into a preset diffusion generation model to generate the final target adversarial samples.

[0071] A third embodiment of the present invention provides a passive anti-attack device for verification code images, which includes: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the passive anti-attack method for verification code images as described in any one of the above items.

[0072] A fourth embodiment of the present invention provides a readable storage medium, comprising: storing a computer program, wherein the computer program can be executed by a processor of a device where the storage medium is located to implement any one of the above methods for passive countermeasures against verification code images.

[0073] Illustratively, the above-mentioned various devices and various process steps can be implemented by a computer program. The computer program can be divided into one or more units. The one or more units are stored in the memory and executed by the processor to complete the present invention.

[0074] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0075] The memory can be used to store the computer programs and / or modules. The processor implements the various functions of the present invention by running or executing the computer programs and / or modules stored in the memory and accessing the data stored in the memory. The memory may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.); the data storage area may store data generated based on the use of the mobile phone (such as audio data, a phone book, etc.). Furthermore, the memory may include high-speed random access memory and non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0076] If the integrated unit of the electronic device or printer is implemented as a software functional unit and sold or used as a standalone product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention can implement all or part of the process steps in the above-mentioned method embodiments by using a computer program to instruct the relevant hardware. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. It should be noted that the content of the computer-readable medium can be appropriately increased or decreased based on the requirements of legislation and patent practice in a jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media does not include electric carrier signals and telecommunication signals.

[0077] It should be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement the present invention without inventive effort.

[0078] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A passive counter-attack method for verification code images, characterized in that: include: Obtain a short text prompt, and transform the short text prompt using the LLM model to generate an extended prompt; Inputting the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt; The gradient of the multimodal model is used for preliminary optimization. Based on the multimodal model, the semantic features of the target prompt word are embedded in the generation process to ensure that the generated image is semantically consistent with the input prompt word. Optimizing the initial image based on gradient information of the target model, adjusting the latent variables of the initial image through a back-propagation process to obtain optimized latent variable pairs, and merging the optimized latent variable pairs into one latent variable; Optimize the merged latent variables to obtain adversarial samples, and input the adversarial samples into the preset diffusion generation model to generate the final target adversarial samples; The combined latent variables are optimized to obtain adversarial samples, which are then input into the preset diffusion generation model to generate the final target adversarial samples. Specifically: The EDICT diffusion inversion model is used as a reversible time series diffusion framework based on the merged latent variables. , get the adversarial sample ,in, The target label assigned to the attacker. For short text prompts, is the time step; The adversarial sample Input into the preset diffusion generation model G to generate the final target adversarial sample .

2. The passive counter-attack method for verification code images according to claim 1, characterized in that: Obtain a short text prompt and use the LLM model to transform the short text prompt to generate an extended prompt, specifically: Obtain a short text prompt P related to the attack target input by the user; The LLM model is used to expand and parse the short text prompt P to generate a detailed extended prompt ,in, is the output function of the LLM model, which represents the expansion and parsing process of the input prompt P. Used to ensure that the generated CAPTCHA image matches the attacker's intention.

3. The passive counter-attack method for verification code images according to claim 2, characterized in that: The extended prompt is input into a preset diffusion generation model to generate an initial image corresponding to the extended prompt, specifically: Use the preset diffusion generation model G to extend the prompt Perform conditional generative processing based on latent variables and extended prompts At each time step Generate the corresponding intermediate latent variables , and according to the intermediate latent variable Get the initial image; Its mathematical expression is: ,in, is the initial image, It is a noise term introduced in the generation process to ensure the diversity of generated images.

4. The passive counter-attack method for verification code images according to claim 1, characterized in that: The initial image is optimized based on the gradient information of the target model. The gradient information is used to adjust the latent variables of the initial image through a back-propagation process to obtain an optimized latent variable pair, specifically: Based on the gradient information of the target model, by calculating the loss function, back-propagating the gradient, and gradually adjusting the latent variables of the initial image using the gradient descent method, the latent variables are updated. , so that the image features are optimized towards the target category; Until the optimized image features mislead the model in its judgment, the optimized latent variable pair is obtained. , its mathematical expression is: , ,in, is the loss function, For latent variable pair The gradient, For latent variable pair The gradient, For latent variable pair The learning rate, For latent variable pair The learning rate.

5. The passive counter-attack method for verification code images according to claim 4, characterized in that: The optimized latent variable pairs are merged into one latent variable, specifically: Use the weighted average formula to calculate the optimized latent variables Merge into a unified latent variable , and continue to diffuse the generation process of the target model; Unified latent variables The mathematical expression is: , .

6. The passive counterattack method for verification code images according to claim 5, characterized in that: The gradient of the multimodal model is used for preliminary optimization. Based on the multimodal model, the semantic features of the target prompt word are embedded in the generation process to ensure that the generated image is semantically consistent with the input prompt word. Specifically: Assume that there are three known proxy models, whose predicted probability distributions are , and their corresponding parameters are , the mathematical expression process of updating the latent variables according to the surrogate model is: , , , , ,in, For the first classifier The probability distribution of categories, is the probability distribution of the first classifier for the predicted first category, For the second classifier The probability distribution of categories, is the probability distribution of the second classifier for the predicted first category, For the third classifier The probability distribution of categories, is the probability distribution of the first category predicted by the third classifier; According to the collective gradient information of the proxy model, the generated adversarial samples are guided towards the second highest probability class and the target class probability class by minimizing the loss associated with the second highest and target class probability classes, as follows: ： , ,in, is the loss associated with the second most probable category, is the loss associated with the target class; Aggregate the losses of multiple direction targets to obtain a new loss function, and calculate the potential variable pair according to the new loss function Gradient , wherein the new loss function is used to balance the guidance effects of the target class and the secondary class during the optimization process to break through the attack barrier of the black box model. The new loss function formula is: .

7. A passive anti-attack device for verification code images, characterized in that: include: A conversion unit, configured to obtain a short text prompt and convert the short text prompt using an LLM model to generate an extended prompt; a diffusion unit, configured to input the extended prompt into a preset diffusion generation model to generate an initial image corresponding to the extended prompt; an optimization unit, configured to optimize the initial image based on gradient information of a target model, wherein the gradient information is used to adjust the latent variables of the initial image through a back-propagation process to obtain optimized latent variable pairs, and merge the optimized latent variable pairs into one latent variable; The target adversarial sample generation unit is used to optimize the merged latent variables to obtain adversarial samples, and input the adversarial samples into the preset diffusion generation model to generate the final target adversarial samples; The combined latent variables are optimized to obtain adversarial samples, which are then input into the preset diffusion generation model to generate the final target adversarial samples. Specifically: The EDICT diffusion inversion model is used as a reversible time series diffusion framework based on the merged latent variables. , get the adversarial sample ,in, The target label assigned to the attacker. For short text prompts, is the time step; The adversarial sample Input into the preset diffusion generation model G to generate the final target adversarial sample .

8. A passive anti-attack device for verification code images, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the passive counter-attack method for verification code images according to any one of claims 1 to 6 is implemented.

9. A readable storage medium, characterized in that A computer program is stored, and the computer program can be executed by a processor of the device where the storage medium is located to implement the passive counter-attack method for verification code images according to any one of claims 1 to 6.

Images