Target recognition model test method and device, equipment and program product

Abstract

The invention provides a test method, device, equipment and program product of a target recognition model, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic and auxiliary driving. The method comprises the following steps: acquiring an attacked person image and an attacker image; performing iterative training on the first target recognition model for multiple times, training a second target recognition model based on multiple iterated first adversarial noise, an attacker image and an attacked person image obtained by multiple times of iterative processing, and determining a second updated attacker image based on an output result obtained by training; and obtaining a test result of the third target recognition model based on the attacked person image and the second updated attacker image. According to the invention, the safety performance of the target recognition model can be accurately and efficiently tested.

Description

Technical Field

[0001] The present application relates to artificial intelligence technology, and in particular, to a method, device, equipment, and program product for testing a target recognition model. Background Art

[0002] Computer vision technology based on artificial intelligence (AI) has been widely used, and typical applications include image-based target recognition. To evaluate the security of a target recognition model, existing technologies adopt white-box adversarial methods and black-box adversarial methods. However, the white-box adversarial attack method has poor transferability and is easily detected by a denoising model or a defense model, and the black-box attack method requires a large number of query times. Therefore, both adversarial methods are not applicable to efficiently testing the target recognition model in an actual scenario.

[0003] The prior art lacks an effective solution for testing the security performance of a target recognition model. Summary of the Invention

[0004] Embodiments of the present application provide a method, device, electronic device, computer-readable storage medium, and computer program product for testing a target recognition model, which can accurately and efficiently test the security of the target recognition model.

[0005] The technical solution of the embodiments of the present application is implemented as follows:

[0006] Embodiments of the present application provide a method for testing a target recognition model, the method including:

[0007] Obtain an image of the attacked object and an attacker image;

[0008] Perform multiple iterative processes based on a first target recognition model. Among them, the two input images of the first iterative process include the image of the attacked object and the attacker image, and the two input images of the iterative processes starting from the second time include the image of the attacked object and the attacker image added with the first adversarial noise of the previous iteration. One iterative process includes: inputting the two input images into the first target recognition model, and determining a first gradient of the first target recognition model according to the output of the first target recognition model, where the first gradient of the first target recognition model is used to determine the first adversarial noise of the current iterative process;

[0009] Superimpose the first adversarial noises of the multiple iterations on the attacker image to obtain multiple first updated attacker images;

[0010] Train a second target recognition model based on the multiple first updated attacker images and the attacked image to obtain multiple second gradients of the multiple second target recognition models, where the multiple second gradients of the second target recognition model are obtained according to the multiple outputs of the second target recognition model;

[0011] Fuse the multiple second gradients to obtain a second adversarial noise;

[0012] Superimpose the second adversarial noise on the attacker image to obtain a second updated attacker image;

[0013] Based on the attacked image and the second updated attacker image, obtain the test result of the third target recognition model.

[0014] An embodiment of the present application provides a test device for a target recognition model, including:

[0015] A data acquisition module for acquiring an attacked image and an attacker image;

[0016] A first data processing module for performing multiple iterative processes based on a first target recognition model.

[0017] Among them, the two input images of the first iterative process include the attacked image and the attacker image, and the two input images of the iterative processes starting from the second time include the attacked image and the attacker image added with the first adversarial noise of the previous iteration. One iterative process includes: inputting the two input images into the first target recognition model, and determining the first gradient of the first target recognition model according to the output of the first target recognition model, and the first gradient of the first target recognition model is used to determine the first adversarial noise of the current iterative process;

[0018] The first data processing module is further configured to superimpose the multiple first adversarial noises of the multiple iterations on the attacker image to obtain multiple first updated attacker images;

[0019] A second data processing module for training a second target recognition model based on the multiple first updated attacker images and the attacked image to obtain multiple second gradients of the multiple second target recognition models, where the multiple second gradients of the second target recognition model are obtained according to the multiple outputs of the second target recognition model; fusing the multiple second gradients to obtain a second adversarial noise; superimposing the second adversarial noise on the attacker image to obtain a second updated attacker image;

[0020] A model test module for obtaining the test result of the third target recognition model based on the attacked image and the second updated attacker image.

[0021] An embodiment of the present application provides an electronic device, including:

[0022] A memory for storing computer-executable instructions;

[0023] A processor, when executing the computer-executable instructions stored in the memory, implements the test method of the target recognition model provided by the embodiment of the present application.

[0024] An embodiment of the present application provides a computer-readable storage medium storing a computer program or computer-executable instructions, which, when executed by a processor, implement the test method of the target recognition model provided by the embodiment of the present application.

[0025] An embodiment of the present application provides a computer program product including a computer program or computer-executable instructions, which, when executed by a processor, implement the test method of the target recognition model provided by the embodiment of the present application.

[0026] The embodiment of the present application has the following beneficial effects:

[0027] Multiple first adversarial noises obtained by performing multiple iterative processes based on the first target recognition model generate multiple second gradients of the second target recognition model in the second target recognition model. By using the historical accumulated gradients of different target recognition models, the training process of adversarial samples is stabilized, training jitter is reduced, and thus a second updated attacker image with stronger attack transferability and generalization is generated to alleviate the problem of adversarial samples "overfitting" to the white-box model. The generated second updated attacker image is used as a test attacker image, and based on the attacked image and the test attacker image, the test result of the third target recognition model is obtained, so that the weak points of the target recognition model can be better discovered and repaired, achieving the effect of improving the security of the target recognition model. Description of the Drawings

[0028] Figure 1 is a schematic structural diagram of the test system architecture of the target recognition model provided by the embodiment of the present application;

[0029] Figure 2 is a schematic structural diagram of the electronic device provided by the embodiment of the present application;

[0030] Figure 3A is a first flowchart of the test method of the target recognition model provided by the embodiment of the present application;

[0031] Figure 3B is a second flowchart of the test method of the target recognition model provided by the embodiment of the present application;

[0032] Figure 3CIt is the schematic diagram of the third process of the test method for the target recognition model provided by the embodiments of the present application;

[0033] Figure 3D It is the schematic diagram of the fourth process of the test method for the target recognition model provided by the embodiments of the present application;

[0034] Figure 3E It is the schematic diagram of the fifth process of the test method for the target recognition model provided by the embodiments of the present application;

[0035] Figure 3F It is the schematic diagram of the sixth process of the test method for the target recognition model provided by the embodiments of the present application;

[0036] Figure 3G It is the schematic diagram of the seventh process of the test method for the target recognition model provided by the embodiments of the present application;

[0037] Figure 3H It is the schematic diagram of the eighth process of the test method for the target recognition model provided by the embodiments of the present application;

[0038] Figure 3I It is the schematic diagram of the ninth process of the test method for the target recognition model provided by the embodiments of the present application;

[0039] Figure 3J It is the schematic diagram of the tenth process of the test method for the target recognition model provided by the embodiments of the present application;

[0040] Figure 3K It is the schematic diagram of the eleventh process of the test method for the target recognition model provided by the embodiments of the present application;

[0041] Figure 4 It is the schematic diagram of the test principle of the face recognition model provided by the embodiments of the present application;

[0042] Figure 5 It is the schematic diagram of the unified size of the input face provided by the embodiments of the present application. Detailed implementation manners

[0043] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on the present application. All other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the scope of protection of the present application.

[0044] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments. However, it can be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict.

[0045] In the following description, the terms "first", "second", and "third" only distinguish similar objects and do not represent a specific order for the objects. It can be understood that "first", "second", and "third" can be interchanged in a specific order or sequence when permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0046] In the embodiments of the present application, the term "module" or "unit" refers to a computer program with a predetermined function or a part of a computer program, which works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as a processing circuit or a memory), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an overall module or unit that includes the function of that module or unit.

[0047] In the practical application of the relevant data collection and processing in the embodiments of the present application, the informed consent or separate consent of the personal information subject should be obtained strictly in accordance with the requirements of relevant national laws and regulations, and subsequent data use and processing behaviors should be carried out within the scope authorized by laws and regulations and the personal information subject.

[0048] Unless otherwise defined, all technical and scientific terms used in the embodiments of the present application have the same meaning as commonly understood by those skilled in the technical field to which the present application belongs. The terms used in the embodiments of the present application are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0049] Before further elaborating on the embodiments of the present application, the nouns and terms involved in the embodiments of the present application are described, and the nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0050] 1) Image of the attacked party. In the test scenario of the target recognition model, it is the party that needs to be correctly recognized and classified by the target recognition model. Taking the target recognition model as a face recognition model as an example, a secure face recognition model can accurately identify the distinguishable features of the attacked party from the image of the attacked party, that is, the features that can be distinguished from the attacker, so as not to cause confusion.

[0051] 2) Image of the attacker. In the test scenario of the target recognition model, it is the party used to mislead the target recognition model to misidentify the attacked party from the image of the attacker. Taking the target recognition model as a face recognition model as an example, an insecure face recognition model cannot extract the distinguishable features of the attacked party from the image, that is, the features that can be distinguished from other users, resulting in confusion.

[0052] 3) A target recognition model, which is an artificial intelligence model used to extract features or classify targets in the input image, such as a neural network model; the extracted features are used to associate with specific information (such as identity information); the classification dimensions vary according to specific application scenarios. Taking the target recognition model as a face recognition model as an example, the classification dimensions can be classifications in dimensions such as identity, gender, age group, etc.; the target can be any object that needs to be recognized or classified in a specific application scenario, such as a face, a human body, a vehicle, etc.

[0053] 4) Gradients are used to reduce the similarity loss after iterative processing by the target recognition model, so that the target model tends to output incorrect test results; among them, the first gradient is the gradient calculated during the training process of the first target recognition model, and the second gradient is the gradient calculated during the training process of the second target recognition model. To distinguish from the gradient calculated by the second target recognition model, the first gradient does not specifically refer to the gradient obtained in a certain iteration; for the first target recognition model, the gradient obtained in the first iteration and the gradient obtained in the second iteration are both the first gradient, described as the first gradient of the first iteration and the first gradient of the second iteration.

[0054] 5) Adversarial noise is used to be superimposed on the attacker's image to generate an attacker's image with stronger attack transferability and generalization; the noise is a random change in the brightness or color information in the image, such as Gaussian noise, Rayleigh noise, etc.

[0055] In the related art, the white-box based adversarial attack method has very poor transferability when testing the target recognition model, that is, the attack success rate of the trained attack samples on other unknown recognition models is very low, and such attack samples are easily defended by existing defense methods. In addition, the white-box based adversarial attack method only uses the information of a single task, and the generated adversarial samples have very limited transferability and are not applicable to model evaluation of current face recognition products, so it is difficult to further improve the security of these products.

[0056] In the related art, the black-box attack method based on query optimization cannot obtain the internal gradient of any recognition model to be attacked. Updating the adversarial samples through the query optimization iteration strategy requires a huge number of query times, with a high time cost and is not applicable to the test of the target recognition model.

[0057] Based on the above analysis, the applicant found that the adversarial attack methods in the prior art cannot improve the test transferability and attack efficiency of the target recognition model. In view of the above problems, the embodiments of the present application provide a test method, device, equipment, computer-readable storage medium and computer program product for the target recognition model, which can accurately and efficiently test the security of the target recognition model.

[0058] The following describes the exemplary applications of the electronic device provided in the embodiments of the present application. The device provided in the embodiments of the present application can be implemented as a terminal or as a server. Below, the exemplary applications when the device is implemented as a server will be described.

[0059] Refer to Figure 1 , Figure 1 FIG. is a schematic diagram of the test system architecture of the target recognition model provided in the embodiments of the present application. To support the test application of a target recognition model, the terminal (exemplarily shows the terminal 400) is connected to the server 200 through the network 300. The network 300 can be a wide area network, a local area network, or a combination of the two.

[0060] The terminal 400 is used to input the initial attacked image and the initial attacker image and send them to the server 200 through the network 300. The server 200 is used to generate the attack success rate of the target recognition model to be tested and return it to the terminal 400. Among them, the attack success rate is used to characterize the security performance of the target recognition model to be tested; the attack success rate of the target recognition model to be tested is displayed on the graphical interface (exemplarily shows the graphical interface 410).

[0061] The following describes an example of the terminal 400 testing the target recognition model.

[0062] In some embodiments, the terminal 400 can independently complete the test task of the target recognition model. For example, the terminal 400 is used to obtain the initial attacked image and the initial attacker image, and generate the attack success rate of the target recognition model to be tested relying on the computing resources of the terminal 400 itself; the attack success rate of the target recognition model to be tested is displayed on the graphical interface (exemplarily shows the graphical interface 410).

[0063] In some embodiments, the test scenarios of the face recognition model include test scenarios such as mobile phone face unlocking, APP face login, remote face verification, face recognition access control system, offline face payment, and automatic face clearance. In the test scenarios of the face recognition model, the terminal 400 is used to obtain the attacker's face image and the attacked person's face image, obtain the updated attacker's face image based on the test method of the face recognition model, and test the attack success rate of the face recognition model to be tested based on the updated attacker's face image. At this time, the terminal 400 or the server 200 obtains the attack success rate of the face recognition model to be tested.

[0064] In some embodiments, in the test scenario of the vehicle recognition model, the terminal 400 is used to obtain the attacker's vehicle image and the attacked vehicle image, and then the terminal 400 obtains the updated attacker's vehicle image based on the test method of the vehicle recognition model, and tests the attack success rate of the vehicle recognition model to be tested based on the updated attacker's vehicle image.

[0065] In some embodiments, the server 200 may be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.

[0066] The terminal 400 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a smart voice interaction device, a smart home appliance, a vehicle-mounted terminal, an aircraft, etc., but is not limited thereto. The terminal and the server may be directly or indirectly connected through wired or wireless communication means, and are not limited in the embodiments of the present application.

[0067] The embodiments of the present application may also be implemented through cloud technology. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model, which can form a resource pool, be used on demand, and be flexible and convenient. Cloud computing technology will become an important support. The background services of the technical network system require a large amount of computing and storage resources, such as video websites, picture websites, and more portal websites. With the high development and application of the Internet industry, and the promotion of demands such as search services, social networks, mobile commerce, and open collaboration, in the future, each item may have its own hash code identification mark and needs to be transmitted to the background system for logical processing. Data at different levels will be processed separately, and various types of industry data require a powerful system background support, which can only be achieved through cloud computing.

[0068] The embodiments of the present application can be applied to the testing of target recognition models in various scenarios, such as the security testing of face recognition models in the security field, the security testing of road element recognition models in the field of autonomous driving, etc.

[0069] The embodiments of the present application can be implemented through artificial intelligence technology. Artificial Intelligence (AI) is a theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a way similar to human intelligence. Artificial intelligence also studies the design principles and implementation methods of various intelligent machines, enabling the machines to have the functions of perception, reasoning, and decision-making.

[0070] Artificial intelligence technology is an interdisciplinary subject that involves a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, pre-trained model technology, operating / interactive systems, mechatronics, etc. Among them, the pre-trained model, also known as the large model or the basic model, can be widely applied to downstream tasks in various directions of artificial intelligence after fine-tuning. The software technologies of artificial intelligence mainly include several major directions such as computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0071] See Figure 2 , Figure 2 is a schematic structural diagram of an electronic device provided by an embodiment of the present application. Figure 2 The electronic device 500 shown can be Figure 1 the terminal 400 or the server 200 in Figure 2 . The electronic device 500 includes: at least one processor 510, a memory 550, and at least one network interface 520. Each component in the server 200 is coupled together through a bus system 540. It can be understood that the bus system 440 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 540 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clear illustration, in

[0072] all kinds of buses are labeled as the bus system 540.

[0073] The user interface 530 includes one or more output devices 531 that enable the presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 530 also includes one or more input devices 532, including user interface components that assist the user in input, such as a keyboard, a mouse, a microphone, a touch screen display, a camera, and other input buttons and controls;

[0074] In some embodiments, when the embodiment independently completes the test task of the target recognition model by the terminal 400, the server 200 provided by the embodiment of the present application does not include the user interface 530.

[0075] The memory 550 can be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disc drives, etc. The memory 550 optionally includes one or more storage devices that are physically remote from the processor 510.

[0076] The memory 550 includes volatile memory or non-volatile memory, and may also include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), and the volatile memory can be random access memory (RAM). The memory 550 described in the embodiments of the present application is intended to include any suitable type of memory.

[0077] In some embodiments, the memory 550 is capable of storing data to support various operations. Examples of such data include programs, modules, and data structures, or subsets or supersets thereof, which are illustratively described below.

[0078] The operating system 551 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic services and handling hardware-based tasks;

[0079] The network communication module 552 is used to reach other computing devices via one or more (wired or wireless) network interfaces 520. Exemplary network interfaces 520 include: Bluetooth, Wi-Fi (Wireless Fidelity), and USB (Universal Serial Bus), etc.;

[0080] The presentation module 553 is used to enable the presentation of information (such as a user interface for operating peripheral devices and displaying content and information) via one or more output devices 531 associated with the user interface 530 (such as a display screen, speaker, etc.);

[0081] In some embodiments, when the terminal 400 independently completes the test task of the target recognition model, the server 200 provided by the embodiments of the present application may not include the presentation module 553;

[0082] The input processing module 554 is used to detect and translate one or more user inputs or interactions from one of one or more input devices 532; In some embodiments, when the terminal 400 independently completes the test task of the target recognition model, the server 200 provided by the embodiments of the present application may not include the presentation module 553.

[0083] In some embodiments, the device provided by the embodiments of the present application can be implemented in software.Figure 2 A test device 555 for the target recognition model stored in the memory 550 is shown, which can be software in the form of programs and plugins, etc., and includes the following software modules: a data acquisition module 5551, a first data processing module 5552, a second data processing module 5553, and a model test module 5554. These modules are logical, so they can be combined arbitrarily or further split according to the functions implemented. The functions of each module will be described below.

[0084] In some other embodiments, the device provided in the embodiments of the present application can be implemented in a hardware manner. As an example, the device provided in the embodiments of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the image processing method provided in the embodiments of the present application. For example, a processor in the form of a hardware decoding processor can adopt one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), or other electronic components.

[0085] It should be noted that in the examples of the test of the target recognition model below, an image sample including a face is taken as an example for illustration. Those skilled in the art can apply the test method of the target recognition model provided in the embodiments of the present application to the processing of the test of the target recognition model including other types of objects according to the understanding of the following text, such as an item recognition model.

[0086] See Figure 3A , Figure 3A is the first process schematic diagram of the test method of the target recognition model provided in the embodiments of the present application, and will be described in combination with Figure 3A the steps shown.

[0087] In step 101, multiple iterative processes are performed based on the first target recognition model.

[0088] Among them, the two input images processed in the first iteration include the attacked image and the attacker image. The two input images processed in the iteration starting from the second time include the attacked image and the attacker image added with the first adversarial noise of the previous iteration. One iteration process includes: inputting the two input images into the first target recognition model, and determining the first gradient of the first target recognition model according to the output of the first target recognition model. The first gradient of the first target recognition model is used to determine the first adversarial noise of the current iteration process.

[0089] In some embodiments, referring to Figure 3B , Figure 3B is the second process schematic diagram of the test method of the target recognition model provided by the embodiments of the present application. Figure 3A The step 101 shown can be implemented by Figure 3B steps 1011 to 1013 below, which will be specifically described.

[0090] In step 1011, the first target recognition model is called based on the two input images of the nth iteration, and the features of the two input images of the nth iteration output by the first target recognition model are obtained.

[0091] Among them, the value of n is incremented and satisfies 1 ≤ n ≤ N, where N is the total number of iterations of the iteration process.

[0092] In some embodiments, the features of the input image may be obvious features of the target in the input image. For example, when the first target recognition model is a face recognition model and the input image is a face image, the features of the face image may be wearing glasses, short hair, etc.

[0093] Exemplarily, the first target recognition model includes an input layer, an intermediate layer, and an output layer; the input layer is used to convert the input image into an initial vector; the intermediate layer is used to perform mapping based on the vector to obtain the features of the input image. For example, the intermediate layer may include a convolutional layer and a fully connected layer; the output layer is used to form a classification result based on the features, specifically corresponding to the probabilities of different categories. For example, the output layer may be a Softmax layer.

[0094] In some embodiments, the features of the two input images may be preset and used to represent relevant information or image clarity characterizing the image sample features. For example, if the input image sample information is a smiling boy wearing glasses, the obtained features may be the glasses feature and the smiling feature. The glasses feature is used to characterize the face feature of wearing glasses, and the smiling feature is used to represent the face feature of the smiling action.

[0095] Exemplarily, the types of features include: smile feature, which is used to characterize the facial features of a smiling action; glasses feature, which is used to characterize the facial features of a person wearing glasses; blur feature, which is used to characterize the clarity of a target feature. For example, when the target is a face, the blur feature can characterize the clarity of the facial features.

[0096] In step 1012, based on the features of the two input images in the nth iteration, determine the first gradient in the nth iteration.

[0097] In some embodiments, the first gradient is the gradient calculated during the training process of the first target recognition model for the two input images.

[0098] In some embodiments, refer to Figure 3C , Figure 3C is the third process schematic diagram of the test method for the target recognition model provided by the embodiments of the present application. For Figure 3B in step 1012 of, determining the first gradient in the nth iteration based on the features of the two input images in the nth iteration can be implemented through Figure 3C steps 10121 to 10123 of.

[0099] In step 10121, determine the similarity between the two input images based on their features.

[0100] In some embodiments, the similarity between the two input images is used to characterize the degree of similarity of the features of the two input images. The closer the two input images are, the greater the similarity between them; the more distant the two input images are, the smaller the similarity between them.

[0101] Exemplarily, the similarity between the two input images can be determined by using a similarity algorithm (such as Euclidean distance) to confirm the cosine similarity between vectors, and the cosine similarity between the two input images can be determined.

[0102] In some embodiments, the features of the attacker image are: female, black pupils, smiling, and the features of the attacked image are: male, blue pupils, expressionless. Confirm the similarity of the features of the two input images as the similarity between the two input images, where the value of the similarity between the two input images is a real number greater than or equal to 0 and less than or equal to 1.

[0103] In step 10122, determine the difference between the preset value and the similarity between the two input images, and use the difference as the similarity loss between the two input images.

[0104] In some embodiments, determine the difference between 1 and the similarity between the two input images, and use the difference as the similarity loss between the two input images, where the similarity loss is used to characterize the degree of similarity between the two input images.

[0105] In step 10123, the similarity loss of two input images is backpropagated in the first target recognition model to obtain the first gradient of the nth iteration.

[0106] In some embodiments, while keeping the parameters of the first target recognition model unchanged, based on the similarity loss of two input images, backpropagation processing is performed in the first target recognition model to obtain the first gradient.

[0107] Exemplarily, the backpropagation processing is implemented by the backpropagation algorithm, and the gradient of the similarity loss with respect to the parameters in the first target recognition model is calculated through the derivative chain rule as the first gradient.

[0108] In step 1013, the first adversarial noise of the nth iteration is determined based on the first gradient of the nth iteration.

[0109] In some embodiments, the first adversarial noise of the nth iteration is the first adversarial noise of the (n - 1)th iteration updated through the nth iteration.

[0110] Exemplarily, the product of the first gradient of the nth iteration and the corresponding first gradient coefficient is determined, and the product is used to characterize the offset of the first adversarial noise of the (n - 1)th iteration. The difference between the first adversarial noise of the (n - 1)th iteration and the obtained result of the product is determined, and the updated first adversarial noise is obtained as the first adversarial noise of the nth iteration. By updating the first adversarial noise, the concealment and adversarial nature of the attacker's image are enhanced, where the first gradient coefficient is a real number greater than 0 and less than or equal to 1.

[0111] In some embodiments, see Figure 3D , Figure 3D is the fourth process schematic diagram of the test method for the target recognition model provided by the embodiments of the present application. For Figure 3B the step 1013 of determining the first adversarial noise of the nth iteration based on the first gradient of the nth iteration in, it can be implemented through Figure 3D steps 10131 to 10132 in.

[0112] In step 10131, the first gradient of the nth iteration and the product of the first gradient coefficient of the nth iteration are determined.

[0113] In some embodiments, the first gradient of the nth iteration is used to characterize the offset direction of the first adversarial noise after the (n - 1)th iteration; the value of the first gradient coefficient is a real number greater than or equal to 0 and less than or equal to 1.

[0114] In step 10132, the difference between the first adversarial noise of the (n - 1)th iteration and the product is determined, and the difference is used as the first adversarial noise of the nth iteration.

[0115] Wherein, when n is 1, the first adversarial noise of the (n - 1)-th iteration is 0.

[0116] In some embodiments, in order to satisfy that the first adversarial noise of each iteration is greater than 0, the product value of the n-th iteration is less than the first adversarial noise of the (n - 1)-th iteration, and the first adversarial noise of each iteration is less than a preset maximum perturbation.

[0117] Exemplarily, it is determined that the first adversarial noise of each iteration is less than the upper bound of the P-norm, and the upper bound of the P-norm is used to constrain the first adversarial noise of each iteration to avoid that the updated first updated attacker image is too different from the attacked image due to excessive change of the attacker image.

[0118] Through the embodiments of the present application, the noise offset of the first adversarial noise of the (n - 1)-th iteration can be determined based on the first gradient of the n-th iteration. Through the noise offset of the n-th iteration and the first adversarial noise of the (n - 1)-th iteration, the first adversarial noise of the n-th iteration for superimposing on the attacker image can be generated to improve the concealment and adversarial property of the attacker image.

[0119] In step 102, the first adversarial noises of multiple iterations are superimposed on the attacker image to obtain multiple first updated attacker images.

[0120] In some embodiments, the first adversarial noises of multiple iterations correspond to multiple first updated attacker images.

[0121] In some embodiments, each pixel of the attacker image is traversed, and the noise component corresponding to each pixel in the first adversarial noise is superimposed on each pixel. Each pixel after superimposing the noise components is combined into the first updated attacker image, and the first adversarial noise contains the noise components corresponding to the pixel positions.

[0122] Exemplarily, the pixels of the attacker image are traversed. The noise component with the same position index (0, 0) corresponding to the pixel with index (0, 0) in the attacker image in the first adversarial noise is superimposed on the pixel with index (0, 0) in the attacker image, and the noise component with the same position index (0, 1) corresponding to the pixel with index (0, 1) in the attacker image in the first adversarial noise is superimposed on the pixel with index (0, 1) in the attacker image, and so on, to obtain each pixel in the attacker image after superimposing the noise components.

[0123] In some embodiments, the tensor of the noise is the same as the tensor of the attacker image, and each pixel in the attacker image corresponds to the noise component at the corresponding position in the noise.

[0124] Continue to refer to Figure 3A, in step 103, based on multiple first updated attacker images and the attacked image, train a second target recognition model to obtain multiple second gradients of the second target recognition model.

[0125] Among them, the multiple second gradients of the second target recognition model are obtained according to the multiple outputs of the second target recognition model.

[0126] In some embodiments, refer to Figure 3E , Figure 3E is the fifth process schematic diagram of the test method of the target recognition model provided by the embodiments of the present application. Figure 3A The step 103 shown can be implemented through Figure 3E steps 1031 to 1034 below, which will be specifically described.

[0127] In step 1031, based on multiple first updated attacker images and the attacked image, call the second target recognition model to obtain the features of the multiple first updated attacker images and the features of the attacked image.

[0128] In some embodiments, call the second target recognition model to extract features from the first updated attacker images and the attacked image to obtain the features of the first updated attacker images and the attacked image. The intermediate layer of the second target recognition model is used to map based on vectors to obtain the features of the image. For example, the intermediate layer may include a convolutional layer and a fully connected layer.

[0129] In step 1032, determine the similarity between the multiple first updated attacker images and the attacked image based on the features of the multiple first updated attacker images and the features of the attacked image.

[0130] In some embodiments, determine the similarity between the multiple first updated attacker images and the attacked image by confirming the cosine similarity of the features of the multiple first updated attacker images and the attacked image.

[0131] Exemplarily, the value of the similarity between the multiple first updated attacker images and the attacked image is a real number greater than or equal to 0 and less than or equal to 1.

[0132] In step 1033, determine the difference between the preset value and the similarity between the multiple first updated attacker images and the attacked image, and use the difference as the similarity loss between the multiple first updated attacker images and the attacked image.

[0133] In some embodiments, determine the difference between 1 and the similarity between the multiple first updated attacker images and the attacked image, and use the difference as the similarity loss between the multiple first updated attacker images and the attacked image.

[0134] In step 1034, the similarity losses between multiple first updated attacker images and the attacked image are backpropagated in the second target recognition model to obtain multiple second gradients of the second target recognition model.

[0135] In some embodiments, while keeping the parameters of the second target recognition model unchanged, based on the similarity losses between multiple first updated attacker images and the attacked image, backpropagation processing is performed in the second target recognition model to obtain multiple second gradients of the second target recognition model.

[0136] Exemplarily, backpropagation calculates the gradient of the similarity loss with respect to the parameters in the second target recognition model through the derivative chain rule as the second gradient.

[0137] Through the embodiments of the present application, multiple second gradients are generated in the second target recognition model. By using the historical accumulated gradients of different target recognition models, the training process of adversarial samples is further stabilized and training jitter is reduced.

[0138] Continue to refer to Figure 3A , in step 104, multiple second gradients are fused to obtain second adversarial noise.

[0139] In some embodiments, referring to Figure 3F , Figure 3F is the sixth process schematic diagram of the test method for the target recognition model provided by the embodiments of the present application. Figure 3A The steps shown in step 104 can be implemented through Figure 3F steps 1041 to 1043, which are specifically described below.

[0140] In step 1041, multiple second gradients are fused to obtain a fused gradient.

[0141] In some embodiments, the cumulative value of the second gradients of the previous n - 1 iterations is determined, and the product of the sign gradient of the cumulative value and the fusion coefficient is added to the sign gradient of the gradient of the nth iteration to obtain the fused gradient.

[0142] Exemplarily, the sign gradient is used to represent the sign of the gradient. When the gradient is greater than 0, the sign gradient is equal to 1; when the gradient is equal to 0, the sign gradient is equal to 0; when the gradient is less than 0, the sign gradient is equal to -1.

[0143] Exemplarily, the fusion coefficient is used to represent the importance degree of the second gradients of the previous n - 1 iterations, and the fusion coefficient is a real number greater than 0 and less than or equal to 1.

[0144] Exemplarily, to increase the influence of the gradient obtained in the last iteration on the update noise, the fusion coefficient corresponding to the second adversarial fusion gradient obtained in the previous n - 1 iterations can be set to 0.3, determine the product of the sign gradient of the cumulative value and the fusion coefficient, and use the result of adding the product to the gradient sign of the nth iteration as the fusion gradient.

[0145] Exemplarily, the fusion coefficients corresponding to the second adversarial fusion gradients obtained through multiple iterations can all be set to 0.3, and determine the sum of the products of multiple second gradients and the fusion coefficient, and use the result of the sum of the products as the fusion gradient.

[0146] In step 1042, determine the product of the fusion gradient and a preset learning rate.

[0147] In some embodiments, the preset learning rate is used to characterize the offset of the noise.

[0148] Exemplarily, the preset learning rate is a real number greater than 0 and less than or equal to 1. When the preset learning rate is 0.3, use the product of the fusion gradient and the preset learning rate as the noise offset, which is used to characterize that the current noise offsets by the length of the noise offset in the direction of the fusion gradient.

[0149] In step 1043, determine the difference between the first adversarial noise in the last iteration in the first target recognition model and the product, and use the difference as the second adversarial noise.

[0150] In some embodiments, the difference is the noise offset obtained by training the first adversarial noise in the last iteration in the first target recognition model through the second target recognition model.

[0151] Continue to refer to Figure 3A , in step 105, superimpose the second adversarial noise on the attacker image to obtain a second updated attacker image.

[0152] In some embodiments, perform the following processing on each pixel of the attacker image. Refer to Figure 3G , Figure 3G is the seventh process schematic diagram of the method for testing a target recognition model provided by an embodiment of the present application. Figure 3A The step 105 shown can be implemented through Figure 3G steps 1051 to 1052, which will be specifically described below.

[0153] In step 1051, superimpose the noise component corresponding to the pixel in the second adversarial noise on the pixel.

[0154] In some embodiments, the second adversarial noise has the same tensor as the attacker image, and the noise components at the same positions corresponding to the pixels are superimposed on the pixels. For example, the second adversarial noise contains the noise components at the positions corresponding to the pixels. The noise component at the position corresponding to the pixel with the subscript (0, 0) in the attacker image is superimposed on the pixel with the subscript (0, 0) in the attacker image, and the noise component at the position corresponding to the pixel with the subscript (0, 1) in the attacker image is superimposed on the pixel with the subscript (0, 1) in the attacker image, and so on, to obtain each pixel in the attacker image after superimposing the noise components.

[0155] In step 1052, each pixel with the superimposed noise components is combined into a second updated attacker image.

[0156] In some embodiments, the pixel combination order of the second updated attacker image is the same as the order of superimposing the noise components corresponding to each pixel.

[0157] Through the embodiments of the present application, a second updated attacker image with stronger attack transferability and generalization is generated to alleviate the problem that the adversarial samples "overfit" to the white-box model and improve the transferability of the second updated attacker image.

[0158] Continue to refer to Figure 3A , in step 106, based on the image of the attacked person and the second updated attacker image, the test result of the third target recognition model is obtained.

[0159] In some embodiments, refer to Figure 3H , Figure 3H is the eighth process schematic diagram of the test method of the target recognition model provided by the embodiments of the present application, Figure 3A The step 106 shown can be implemented through Figure 3H steps 1061A to 1063A below, which will be specifically described.

[0160] In some embodiments, the similarity between the image of the attacked person and the second updated attacker image is obtained based on the third target recognition model, and the test result of the third target recognition model is obtained based on the similarity.

[0161] In step 1061A, based on the image of the attacked person and the second updated attacker image, the third target recognition model is called to obtain the features of the image of the attacked person and the features of the second updated attacker image.

[0162] In some embodiments, the third target recognition model is called to extract the features of the image of the attacked person and the second updated attacker image to obtain the features of the image of the attacked person and the features of the second updated attacker image.

[0163] Exemplarily, the middle layer of the third target recognition model is used to map based on vectors to obtain the features of the image. For example, the middle layer may include a convolutional layer and a fully connected layer.

[0164] In step 1062A, the similarity between the attacked image and the second updated attacker image is determined based on the features of the attacked image and the features of the second updated attacker image.

[0165] In some embodiments, the similarity between the attacked image and the second updated attacker image can be determined by confirming the cosine similarity between the vectors of the features of the attacked image and the features of the second updated attacker image.

[0166] Exemplarily, the value of the similarity between the attacked image and the second updated attacker image is a real number greater than or equal to 0 and less than or equal to 1.

[0167] In step 1063A, when the similarity between the attacked image and the second updated attacker image is greater than or equal to the similarity threshold, it is determined that the test result of the third target recognition model is an attack success.

[0168] In some embodiments, the similarity threshold is used to characterize the similarity degree between two images.

[0169] Exemplarily, the similarity threshold is set to 0.8. When the similarity between the attacked image and the second updated attacker image is greater than or equal to 0.8, the third target recognition model cannot distinguish between the attacked image and the second updated attacker image. The second updated attacker image can be used to mislead the third target recognition model, causing the third target recognition model to determine the second updated attacker image as the attacked image, and setting the test result of the third target recognition model as an attack success.

[0170] Through the embodiments of the present application, the generated second updated attacker image is used as the test attacker image, and based on the attacked image and the test attacker image, the test result of the third target recognition model is obtained, so that the weak points of the current target recognition system based on the deep model can be better discovered and repaired, and further the security of the current target recognition system based on the deep model can be improved. In some embodiments, when the test method includes multiple stages, each stage includes multiple iterative processes. The first target recognition model and the second target recognition model are selected from the target recognition model set, and the two target recognition models selected in different stages are different. See Figure 3I , Figure 3I is the ninth process schematic diagram of the test method for the target recognition model provided by the embodiments of the present application, Figure 3A The steps shown in 106 can be passed through Figure 3IIt is implemented from step 1061B to step 1062B, which will be specifically described below.

[0171] In some embodiments, the second updated attacker image is generated in the testing method of the t-th stage. The second updated attacker image generated in the t-th stage is used as the updated attacker image, and the updated attacker image is used as the input image of the testing method of the (t + 1)-th stage. t is an incrementing integer variable, and satisfies 1 ≤ t ≤ T, where T is the preset number of testing stages.

[0172] In some embodiments, when in different stages of the testing method, a first target recognition model and a second target recognition model corresponding to the testing method stage are selected from the target recognition model set. Among them, the target recognition models in the target recognition model set can be pre-trained based on a publicly available training set. Different target recognition models can have the same network structure, and the training sets can be different. Different target recognition models are obtained by pre-training based on different training sets.

[0173] In some embodiments, whenever the testing method enters the next stage from the current stage, two target recognition models are selected from the target recognition set as the first target recognition model and the second target recognition model.

[0174] Exemplarily, in the first stage of the testing method, the first target recognition model is the target recognition model with the subscript 0 in the target recognition model set, and the second target recognition model is the target recognition model with the subscript 1 in the target recognition model set.

[0175] Exemplarily, in the second stage of the testing method, the first target recognition model is the target recognition model with the subscript 1 in the target recognition model set, and the second target recognition model is the target recognition model with the subscript 2 in the target recognition model set.

[0176] Exemplarily, when the subscript of the first target recognition model in the target recognition model set is the number of target recognition models - 1, the target recognition model with the subscript 0 in the target recognition model set is used as the second target recognition model, and the second target recognition model in the current stage is used as the first target recognition model in the next stage.

[0177] Exemplarily, by analogy, in the t-th stage of the testing method, the first target recognition model and the second target recognition model selected from the target recognition model set are obtained.

[0178] Exemplarily, in the last stage of the testing method, the first target recognition model and the second target recognition model selected from the target recognition model set are obtained, and the second adversarial noise obtained in the last stage is obtained based on the testing method.

[0179] In step 1061B, the second adversarial noise obtained in the last stage is superimposed on the attacker image in the last stage to obtain the second updated attacker image in the last stage as the test attacker image.

[0180] In some embodiments, the attacker image in the last stage is the attacker image in the last iteration in the last stage.

[0181] In step 1062B, based on the attacked image and the test attacker image, the test result of the third target recognition model is obtained.

[0182] In some embodiments, the similarity in the third target recognition model is determined based on the attacked image and the test attacker image. When the similarity is greater than or equal to a preset similarity threshold, a test result of successful attack is obtained. When the similarity is less than the preset similarity threshold, a test result of failed attack is obtained.

[0183] Exemplarily, the similarity between the attacked image and the test attacker image is obtained based on the features of the attacked image and the test attacker image in the third target recognition model.

[0184] Through the embodiments of the present application, the second updated attacker image in the last stage is obtained as the test attacker image, and based on the attacked image and the test attacker image, the test result of the third target recognition model is obtained, so that the weaknesses of the current target recognition system based on the deep model can be better discovered and repaired, and further the effect of improving the security of the current target recognition system based on the deep model can be achieved.

[0185] In some embodiments, refer to Figure 3J , Figure 3J is the tenth process schematic diagram of the test method of the target recognition model provided by the embodiments of the present application. Before step 101, perform Figure 3J steps 201 to 203, which are specifically described below.

[0186] In step 201, an initial attacked image and an initial attacker image are obtained.

[0187] In some embodiments, the initial attacker image is selected from the set of attacker images, and the initial attacked image is selected from the set of attacked images.

[0188] In step 202, the initial attacked image and the initial attacker image are subjected to registration processing to obtain the target region of the attacked image and the target region of the initial attacker image.

[0189] In some embodiments, the registration processing is used to detect the target region of the target to be recognized.

[0190] Exemplarily, when the target to be recognized is a human face, the coordinate points of the five sense organs of the face (face feature points) are detected, and the target area of the face is obtained by cropping according to the coordinate points of the five sense organs of the face.

[0191] Exemplarily, methods such as a geometric feature algorithm and a connected component extraction algorithm can be used to mark the face feature points in the face image, and the method for obtaining the face feature points is not limited in the embodiments of the present application.

[0192] In step 203, the target areas of the initial attacked image and the initial attacker image are adjusted to a unified size, and the attacked image and the attacker image are correspondingly obtained.

[0193] In some embodiments, when the target to be recognized is human face information, the target area size of the face obtained by cropping is uniformly adjusted to 112*112*3 to obtain the attacked image and the attacker image with a unified size.

[0194] Through the embodiments of the present application, the face area is obtained according to the feature points of the face, so as to extract the image features in the subsequent face recognition model and obtain the features for distinguishing the attacker image from the attacked image.

[0195] In some embodiments, refer to Figure 3K , Figure 3K is the eleventh process schematic diagram of the test method of the target recognition model provided by the embodiments of the present application. After step 107, perform Figure 3K steps 301 to 302 below, which will be specifically described.

[0196] In step 301, the number of successful attacks is obtained.

[0197] In some embodiments, the number of successful attacks is the number of attacker images with successful attack test results in the attacker image set.

[0198] In some embodiments, the attacker images in the attacker image set are traversed to obtain the test results of each attacker image, and the number of attacker images with successful attack test results is obtained.

[0199] In some embodiments, the attacker images in the attacker image set are traversed to obtain the second updated attacker image of each attacker image after being trained in multiple stages of the test method, and multiple test results are obtained based on the multiple second updated attacker images on the third target recognition model.

[0200] Exemplarily, the multiple second updated attacker images are obtained in the last iteration training process of the last stage of the test method by multiple attacker images.

[0201] In step 302, determine the ratio of the number of successful attacks to the number of samples in the attacker image set, and use the ratio as the attack success rate.

[0202] In some embodiments, the attack success rate is used to characterize the security performance of the third target recognition model. The higher the attack success rate, the worse the security of the target recognition model (the third target recognition model) being tested; the lower the attack success rate, the better the security of the target recognition model being tested.

[0203] Exemplarily, when the number of samples in the attacker image set is 100 attacker images, and the number of samples with a test result of successful attack obtained by the test method is 70, then the ratio of 70% of the number of successful attacks to the number of samples in the attacker image set is used as the attack success rate of the target recognition model being tested.

[0204] Through the embodiments of the present application, using multiple attacker images to determine the attack success rate can accurately and efficiently test the security performance of the target recognition model.

[0205] Next, an exemplary application of the test method for the target recognition model provided by the embodiments of the present application in an actual application scenario will be described.

[0206] In the scenario where face recognition technology is widely applied nowadays, deep neural networks are commonly used as the core algorithm of face recognition products. However, deep neural networks inherently have vulnerabilities and loopholes, that is, they will output incorrect prediction results when facing noise samples generated by some special means, resulting in misrecognition of face recognition products. Once criminals take advantage of this loophole to steal others' accounts, it will have a huge negative impact on face recognition-related services. To promote the defense against such loopholes, the embodiments of the present application specifically design corresponding model security test methods. Specifically, the adversarial attack method is used to actively detect the loopholes of the deep neural network model by probing the deep neural network model, and the success rate returned by the adversarial attack algorithm can be used as an indicator to test the vulnerability of the neural network, thereby promoting the research on the defense of the neural network model.

[0207] The adversarial attack methods on neural network models in the related art are mainly divided into the following two types: white-box attacks and query-iteration-based black-box attacks. Traditional white-box adversarial attack methods attack by obtaining the internal gradients of a single recognition model, and have good attack effects on this model. However, the transferability of this method is very poor, that is, the attack success rate of the trained attack samples on other unknown recognition models is very low and is easily defended by existing defense methods. Traditional black-box attack methods cannot obtain the internal gradients of any recognition model to be attacked, but update adversarial samples through a certain query optimization iteration strategy. Although this method has good transferability, it requires a huge number of query times. Therefore, neither of the above two types of methods is applicable to efficiently testing existing face recognition models in actual scenarios.

[0208] Therefore, in the embodiments of the present application, based on the gradients obtained by iteratively training a face recognition model multiple times, a test method for a new object recognition model is proposed to update and superimpose the noise on the adversarial samples, reduce the jitter of the update, so that the adversarial samples can obtain a "globally better solution", thereby improving the transferability and test efficiency of efficiently testing the face recognition model.

[0209] Through the test method for the object recognition model provided by the embodiments of the present application, an attacker (i.e., an attacker image) and an attacked object (i.e., an attacked object image) are obtained, and an updated attacker (a second updated attacker image) is obtained based on multiple face recognition models (object recognition models), and the updated attacker (the second updated attacker image) is used as a test attacker image to obtain the test result of the face recognition model to be tested (a third object recognition model).

[0210] Taking the test of the face recognition model as an example, see Figure 4 , Figure 4 which is the test principle diagram of the face recognition model provided by the embodiments of the present application.

[0211] In Figure 4 , first, an input image is obtained, and a certain number of real human face photos are prepared. The coordinates of the facial features of the face are marked in the face image based on registration methods such as geometric feature algorithms and connected component extraction algorithms, and then the face part is cropped out from the whole image using the coordinates of the facial features returned by the algorithm. See Figure 5 , Figure 5 which is the schematic diagram of the unified size of the input face provided by the embodiments of the present application. As shown in Figure 5As shown, all input images are adjusted to a unified size. Among them, the picture 610 is an image, and within the bounding boxes 620 and 630 are two face regions obtained according to the facial feature coordinates. The two face regions are unified to a size of 112*112*3, that is, the length and width of the face are 112, and the face image is an RGB face image with 3 channels. The bounding box 640 is the face region after unifying the size.

[0212] Obtain the initial attacked image and the initial attacker image from the attacked image set and the attacker image set, and mark the coordinates of the facial features in the face image based on registration methods such as geometric feature algorithms and connected component extraction algorithms. Among them, the coordinates of the facial features can be used as the feature points of the face. Obtain the face regions of the corresponding two input images according to the coordinates of the facial features, and based on Figure 5 the input face unified size method shown, obtain the input images, where the input images include the attacked image and the attacker image after unifying the size.

[0213] In the embodiment of the present application, the face recognition model set F includes M face recognition models, where F represents the face recognition model set, M is the number of face recognition models in the face recognition model set, and M is a real number greater than or equal to 2.

[0214] The attacker image is trained in t stages, and the attacker image is updated in each stage, where t is an increasing integer variable and satisfies 1≤t≤T, and T is the preset number of test stages.

[0215] When training the attacker image in the t-th stage, select the face recognition models with subscripts i and j from the face recognition model set F and where is used as the first face recognition model (the first target recognition model), is used as the second face recognition model (the second target recognition model).

[0216] For example, in the first stage of the test method, that is, when t = 1, if M = 2, that is, the face recognition model set only includes two face recognition models, then the subscript i = 0, the subscript j = 1, that is, select the face recognition model with subscript 0 as the first face recognition model, and the face recognition model with subscript 1 as the second face recognition model.

[0217] For example, in the second stage of the test method, that is, when t = 2, if M = 2, then the subscript i = 1, the subscript j = 0, that is, select the face recognition model with subscript 1 as the first face recognition model, and the face recognition model with subscript 0 as the second face recognition model.

[0218] And so on, the first face recognition model and the second face recognition model at each stage of the test method are obtained.

[0219] Referring to the meta-learning strategy, the flow of the gradient alternates between the face recognition model with subscript i = 0 and the face recognition model with subscript i = 1. After the attacker image is updated in the face recognition model with subscript i = 0, it will continue to be updated on the face recognition model with subscript i = 1, and vice versa.

[0220] Exemplarily, in the first stage of the test method, that is, when t = 1, if M > 2, that is, the face recognition model set contains more than two face recognition models, then the subscript i = 0 and the subscript j = 1. That is, the face recognition model with subscript 0 is selected as the first face recognition model, and the face recognition model with subscript 1 is selected as the second face recognition model.

[0221] Exemplarily, in the second stage of the test method, that is, when t = 2, if M > 2, then the subscript i = 1 and the subscript j = 2. That is, the face recognition model with subscript 1 is selected as the first face recognition model, and the face recognition model with subscript 2 is selected as the second face recognition model.

[0222] In the test method, if the subscript i = M - 1, that is, the first face recognition model is the last face recognition model in the face recognition model set, the face recognition model with subscript 0 is selected as the second face recognition model, and the face recognition model with subscript 0 is used as the first face recognition model for the next training, and the face recognition model with subscript 1 is used as the second face recognition model for the next training.

[0223] And so on, the first face recognition model and the second face recognition model at each stage of the test method are obtained.

[0224] Continue to refer to Figure 4 , taking the middle t-th stage as an example, based on the first face recognition model Perform the nth iteration process, where n is an increasing integer variable and satisfies 1 ≤ n ≤ N, and N is the total number of iterations of the preset iteration process. Through multiple iteration processes, the training process of the attacker image is further stabilized.

[0225] Input x a and x v into the first face recognition model and confirm the face recognition features corresponding to x a and x v , where x a is the attacker image, x v is the attacked image, and the face recognition feature corresponding to the attacker image x a is the attacker image x a after passing through the first face recognition model The features obtained through training, the attacker's image x v The corresponding face recognition features are the attacker's image x v For the first face recognition model The features obtained through training, the first face recognition model Includes an input layer, an intermediate layer, and an output layer. The intermediate layer is used to perform mapping based on vectors to obtain the features of the image.

[0226] Confirm the attacker's image x a The cosine similarity between the face recognition features of the attacker's image x v And the face recognition features of the attacked person's image x is used as the similarity between the attacker's image x a And the attacked person's image x v Between them.

[0227] Based on the attacker's image x a And the attacked person's image x v The similarity loss between the attacker's image x a And the attacked person's image x v Among them, the similarity loss is 1 - the difference obtained from the similarity between the attacker's image x a And the attacked person's image x v Between them.

[0228]

[0229]

[0230] Among them, Is the first gradient updated at the nth step on the first face recognition model 1 ≤ n ≤ N, Used to represent the similarity loss of the attacker's image x a And the attacked person's image x v After being trained by the first face recognition model ε ′ Is the first adversarial noise obtained when the first face recognition model Performs the nth iteration processing, Used to represent the gradient operation performed on the similarity loss through the first face recognition model The gradient operation method can be the backpropagation algorithm.

[0231] While keeping the parameters of the first face recognition model Unchanged, based on the similarity loss of the attacker's image x a And the attacked person's image x v In the first face recognition model Perform backpropagation processing in it, and calculate the gradient of the similarity loss with respect to the parameters in the first face recognition model through the chain rule of derivatives to obtain the first gradient for the nth iteration wherein,

[0232]

[0233] wherein, is the first adversarial noise for the nth iteration, is the first adversarial noise for the (n - 1)th iteration, and a1 is the first gradient coefficient, where the first gradient coefficient is a real number greater than 0 and less than or equal to 1.

[0234] Determine the product of the first gradient for the nth iteration and the corresponding first gradient coefficient a1. The result obtained by the product is used to represent the offset of the first adversarial noise for the (n - 1)th iteration, and determine the first adversarial noise for the (n - 1)th iteration Calculate the difference between the first adversarial noise for the (n - 1)th iteration and the result obtained by the product to get the updated first adversarial noise as the first adversarial noise for the nth iteration When n = 1, determine that the first adversarial noise for the (n - 1)th iteration is 0, and update the first adversarial noise to enhance the concealment and adversarial nature of the attacker's image.

[0235] Determine that the first adversarial noise for each iteration is less than the P - norm upper bound, which is used to constrain the first adversarial noise for each iteration to prevent the attacker's image from changing too much, resulting in too large a difference between the updated attacker's image and the target image.

[0236] Superimpose the first adversarial noise obtained for each iteration on the attacker's image to get the first updated attacker's image, and forward - iterate the multiple first updated attacker's images one step on the second face recognition model to obtain multiple second gradients, where forward - iterating one step means making one call to the face recognition model.

[0237]

[0238] wherein, is used to represent the gradient obtained after training the first updated attacker's image for the nth iteration on the second face recognition model , L adv (F j ) is used to represent the similarity loss obtained after training the first updated attacker's image and the target image x v through the second face recognition model , is used to represent the similarity loss after passing through the second face recognition model The gradient operation performed in

[0239] Input the first updated attacker image and x v Into the second face recognition model And confirm the first updated attacker image and x v Corresponding face recognition features, where the face recognition feature corresponding to the first updated attacker image is the feature obtained by the first updated attacker image passing through the second face recognition model The trained feature, and the face recognition feature corresponding to the attacked image x v Is the face recognition feature corresponding to the attacked image x v Obtained by passing through the second face recognition model The trained feature, and the second face recognition model Includes an input layer, an intermediate layer, and an output layer. The intermediate layer is used to map based on vectors to obtain the features of the image.

[0240] Confirm the cosine similarity between the face recognition feature of the first updated attacker image and the face recognition feature of the attacked image x v As the similarity between the first updated attacker image and the attacked image x v Between.

[0241] Based on the similarity between the first updated attacker image and the attacked image x v Obtain the similarity loss between the first updated attacker image and the attacked image x v Among them, the similarity loss is the difference obtained by 1 - the similarity between the first updated attacker image and the attacked image x v Between.

[0242] While keeping the parameters of the second face recognition model Unchanged, based on the similarity loss between the first updated attacker image and the attacked image x v Perform backpropagation processing in the second face recognition model Calculate the gradient of the similarity loss with respect to the parameters in the second face recognition model through the derivative chain rule To obtain multiple second gradients.

[0243]

[0244] Among them, a2 represents a preset learning rate, and γ represents the fusion coefficient of the first N - 1 iterations, which is used to update the weight of the fusion gradient obtained by accumulating the first N - 1 iterations. sign() is used to obtain the sign of the gradient. Is the second adversarial noise obtained by passing through the second face recognition model Trained, Is the first face recognition model The first adversarial noise in the last stage.

[0245] Determine the first face recognition model The cumulative value of the gradients in the first n - 1 iterations, determine the product of the sign gradient of the cumulative value and the fusion coefficient, and add the result of the product to the sign gradient of the gradient in the nth iteration of the first face recognition model to obtain a fused gradient, where the sign gradient is used to represent the sign of the gradient. When the gradient is greater than 0, the sign gradient is equal to 1; when the gradient is equal to 0, the sign gradient is equal to 0; when the gradient is less than 0, the sign gradient is equal to -1.

[0246] Multiply the obtained fused gradient by a preset learning rate a2 to determine the difference between the first adversarial noise in the last stage of the first face recognition model and the product result, and use the difference as the second adversarial noise where the preset learning rate a2 is used to represent the noise offset of the first adversarial noise in the last stage of the first face recognition model in the direction of the fused gradient. where is the second updated attacker image obtained by adding noise σ to the attacker image x

[0247]

[0248] When the noise σ is equal to the second adversarial noise obtained by training with the face recognition model with subscript j when the noise superimposed on the attacker image x is obtained through training with the face recognition model with subscript j. a is obtained through training with the face recognition model with subscript j. a is equal to the second adversarial noise obtained by training with the face recognition model with subscript j.

[0249] Use the second updated attacker image as the attacker image x a to perform the training in the next stage to generate an attacker image with high transferability.

[0250] Use the second updated attacker image after T rounds of iterative updates as the test attacker image, which can be used for testing the face recognition model to be tested. The face recognition model to be tested can be either a white - box face recognition model or a black - box face recognition model, and the embodiments of the present application are not limited.

[0251] Input the test attacker image and the attacked image x v into the face recognition model to be tested and confirm the test attacker image and x vThe corresponding face recognition features, where the face recognition features corresponding to the test attacker image are the features obtained by training the test attacker image through the face recognition model to be tested, and the image x of the attacked person v The corresponding face recognition features are the image x of the attacked person v The features obtained by training through the face recognition model to be tested. The face recognition model to be tested includes an input layer, an intermediate layer, and an output layer. The intermediate layer is used to perform mapping based on vectors to obtain the features of the image.

[0252] Confirm the cosine similarity between the face recognition features of the test attacker image and the face recognition features of the image x of the attacked person v As the similarity between the test attacker image and the image x of the attacked person v Between them.

[0253] Judge whether the similarity between the test attacker image and the image x of the attacked person v Exceeds a preset similarity threshold to determine whether the test attacker image and the image x of the attacked person v Are the same person. If they are the same person, it means that the test attacker image successfully attacks the face recognition model to be tested, and the attack success is used as the test result of the face recognition model to be tested. Among them, the preset similarity threshold is a real number greater than 0 and less than or equal to 1.

[0254] Obtain the number of attacker images with successful attack test results in the attacker image set, determine the ratio of the number of successful attacks to the sample number of the attacker image set, and use the ratio as the attack success rate. The higher the attack success rate, the worse the security of the face recognition model being tested; the lower the attack success rate, the better the security of the face recognition model being tested.

[0255] Next, continue to describe the exemplary structure of the software module for the implementation of the image processing device 555 provided in the embodiments of the present application. In some embodiments, as Figure 2 Shown, the software module stored in the image processing device 555 in the memory 550 may include:

[0256] The data acquisition module 5551 is used to obtain the image of the attacked person and the attacker image.

[0257] The first data processing module 5552 is configured to perform multiple iterative processes based on the first target recognition model. Among them, the two input images for the first iterative process include the image of the attacked person and the image of the attacker. Starting from the second iterative process, the two input images for each iterative process include the image of the attacked person and the image of the attacker added with the first adversarial noise of the previous iteration. One iterative process includes: inputting the two input images into the first target recognition model, and determining the first gradient of the first target recognition model according to the output of the first target recognition model. The first gradient of the first target recognition model is used to determine the first adversarial noise of the current iterative process; superimposing the first adversarial noises of multiple iterations on the image of the attacker to obtain multiple first updated attacker images.

[0258] The second data processing module 5553 is configured to train the second target recognition model based on multiple first updated attacker images and the image of the attacked person to obtain multiple second gradients of the second target recognition model, where the multiple second gradients of the second target recognition model are obtained according to the multiple outputs of the second target recognition model; performing a fusion process on the multiple second gradients to obtain a second adversarial noise; superimposing the second adversarial noise on the image of the attacker to obtain a second updated attacker image.

[0259] The model testing module 5554 is configured to obtain the test result of the third target recognition model based on the image of the attacked person and the second updated attacker image.

[0260] In some embodiments, the data acquisition module 5551 is further configured to obtain the initial image of the attacked person and the initial image of the attacker; perform a registration process on the initial image of the attacked person and the initial image of the attacker to obtain the target area of the image of the attacked person and the target area of the initial image of the attacker; adjust the target areas of the initial image of the attacked person and the target area of the initial image of the attacker to a unified size, and correspondingly obtain the image of the attacked person and the image of the attacker.

[0261] In some embodiments, the first data processing module 5552 is further configured to call the first target recognition model based on the two input images of the nth iteration to obtain the features of the two input images of the nth iteration output by the first target recognition model, where the value of n is incremented and satisfies 1 ≤ n ≤ N, and N is the total number of iterative processes; determining the first gradient of the nth iteration based on the features of the two input images of the nth iteration; determining the first adversarial noise of the nth iteration based on the first gradient of the nth iteration.

[0262] In some embodiments, the first data processing module 5552 is further configured to determine the similarity between two input images based on the features of the two input images; determine the difference between a preset value and the similarity between the two input images, and use the difference as the similarity loss between the two input images; perform backpropagation on the similarity loss between the two input images in the first target recognition model to obtain the first gradient of the nth iteration.

[0263] In some embodiments, the first data processing module 5552 is further configured to determine the product of the first gradient of the nth iteration and the first gradient coefficient of the nth iteration; determine the difference between the first adversarial noise of the (n - 1)th iteration and the product, and use the difference as the first adversarial noise of the nth iteration, where when n is 1, the first adversarial noise of the (n - 1)th iteration is 0.

[0264] In some embodiments, the second data processing module 5553 is further configured to, based on a plurality of first updated attacker images and the attacked image, call the second target recognition model to obtain the features of the plurality of first updated attacker images and the features of the attacked image; determine the similarity between the plurality of first updated attacker images and the attacked image based on the features of the plurality of first updated attacker images and the features of the attacked image; determine the difference between a preset value and the similarity between the plurality of first updated attacker images and the attacked image, and use the difference as the similarity loss between the plurality of first updated attacker images and the attacked image; perform backpropagation on the similarity loss between the plurality of first updated attacker images and the attacked image in the second target recognition model to obtain a plurality of second gradients of the second target recognition model.

[0265] In some embodiments, the second data processing module 5553 is further configured to perform a fusion process on the plurality of second gradients to obtain a fusion gradient; determine the product of the fusion gradient and a preset learning rate; determine the difference between the first adversarial noise of the last iteration in the first target recognition model and the product, and use the difference as the second adversarial noise.

[0266] In some embodiments, for each pixel of the attacker image, the second data processing module 5553 is further configured to superimpose the noise component corresponding to the pixel in the second adversarial noise; combine each pixel with the superimposed noise component into a second updated attacker image.

[0267] In some embodiments, the model testing module 5554 is further configured to call a third target recognition model based on the image of the attacked person and the second updated attacker image, to obtain the features of the image of the attacked person and the features of the second updated attacker image; determine the similarity between the image of the attacked person and the second updated attacker image based on the features of the image of the attacked person and the features of the second updated attacker image; and when the similarity between the image of the attacked person and the second updated attacker image is greater than or equal to the similarity threshold, determine that the test result of the third target recognition model is an attack success.

[0268] In some embodiments, when the testing method includes multiple stages, each stage includes multiple iterative processes. The first target recognition model and the second target recognition model are selected from a set of target recognition models, and the two target recognition models selected in different stages are different. The model testing module 5554 is further configured to superimpose the second adversarial noise obtained in the last stage on the attacker image in the last stage to obtain the second updated attacker image in the last stage as the test attacker image; and obtain the test result of the third target recognition model based on the image of the attacked person and the test attacker image.

[0269] In some embodiments, the model testing module 5554 is further configured to obtain the number of successful attacks, where the number of successful attacks is the number of attacker images in the attacker image set that have a successful attack test result; determine the ratio of the number of successful attacks to the number of samples in the attacker image set, and use the ratio as the attack success rate.

[0270] An embodiment of the present application provides a computer program product, which includes computer-executable instructions stored in a computer-readable storage medium. The processor of the electronic device reads the computer-executable instructions from the computer-readable storage medium, and the processor executes the computer-executable instructions, so that the electronic device executes the above-mentioned test method for the target recognition model in the embodiments of the present application.

[0271] An embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, where computer-executable instructions or a computer program are stored. When the computer-executable instructions or the computer program are executed by a processor, the processor will be caused to execute the test method for the target recognition model provided in the embodiments of the present application. For example, Figures 3A to 3K as shown in the test method for the target recognition model.

[0272] In some embodiments, the computer-readable storage medium may be a memory such as RAM, ROM, flash memory, magnetic surface memory, optical disc, or CD-ROM; or may be various devices including one or any combination of the above memories.

[0273] In some embodiments, the computer-executable instructions may be in the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including being deployed as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0274] As an example, the computer-executable instructions may or may not correspond to a file in a file system, may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, stored in a single file dedicated to the program in question, or, stored in multiple cooperating files (e.g., files that store one or more modules, subroutines, or portions of code).

[0275] As an example, the computer-executable instructions may be deployed to execute on one electronic device, or on multiple electronic devices located at one location, or, on multiple electronic devices distributed across multiple locations and interconnected via a communication network.

[0276] In summary, through the embodiments of the present application, by training the attacker image and the attacked image on multiple target recognition models, using the first updated attacker image with the first adversarial noise superimposed on the first target recognition model as the input to the second target recognition model, generating multiple second gradients of the second target recognition model in the second target recognition model, and using the historical accumulated gradients of different target recognition models, the training process of the adversarial samples is further stabilized and the training jitter is reduced; during the testing process of multiple stages, using the second updated attacker image of the last stage as the test attacker image, and based on the attacked image and the test attacker image, obtaining the test result of the third target recognition model, so that the weaknesses of the current target recognition system based on the deep model can be better discovered and repaired, thereby achieving the effect of improving the security of the current target recognition system based on the deep model; using multiple attacker images to determine the attack success rate of the third target recognition model can accurately and efficiently test the security performance of the target recognition model.

[0277] The above is only the embodiments of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent replacements, and improvements made within the spirit and scope of the present application are all included in the protection scope of the present application.

Claims

1. A test method for a target recognition model, characterized in that The method includes: Obtaining an image of the attacked person and an image of the attacker; Performing multiple iterative processes based on a first target recognition model. Among them, the two input images for the first iterative process include the image of the attacked person and the image of the attacker. The two input images for iterative processes starting from the second time include the image of the attacked person and the image of the attacker added with the first adversarial noise of the previous iteration. One iterative process includes: inputting the two input images into the first target recognition model, and determining a first gradient of the first target recognition model according to the output of the first target recognition model. The first gradient of the first target recognition model is used to determine the first adversarial noise of this iterative process; Superimposing the first adversarial noises of the multiple iterations on the image of the attacker to obtain multiple first updated attacker images; Training a second target recognition model based on the multiple first updated attacker images and the image of the attacked person to obtain multiple second gradients of the second target recognition model, where the multiple second gradients of the second target recognition model are obtained according to multiple outputs of the second target recognition model; Performing a fusion process on the multiple second gradients to obtain a second adversarial noise; Superimposing the second adversarial noise on the image of the attacker to obtain a second updated attacker image; Based on the image of the attacked person and the second updated attacker image, obtaining a test result of a third target recognition model.

2. The method according to claim 1, characterized in that, The performing multiple iterative processes based on the first target recognition model includes: Invoking the first target recognition model based on the two input images of the nth iteration to obtain features of the two input images of the nth iteration output by the first target recognition model, where the value of n is incremented and satisfies 1 ≤ n ≤ N, and N is the total number of iterative processes; Determining a first gradient of the nth iteration based on the features of the two input images of the nth iteration; Determining a first adversarial noise of the nth iteration based on the first gradient of the nth iteration.

3. The method according to claim 2, wherein The determining a first gradient of the nth iteration based on the features of the two input images of the nth iteration includes: Determining the similarity of the two input images based on the features of the two input images; Determining the difference between a preset value and the similarity of the two input images, and taking the difference as the similarity loss of the two input images; Performing backpropagation of the similarity loss of the two input images in the first target recognition model to obtain a first gradient of the nth iteration.

4. The method according to claim 2, wherein The determining a first adversarial noise of the nth iteration based on the first gradient of the nth iteration includes: Determining the product of the first gradient of the nth iteration and the first gradient coefficient of the nth iteration; Determining the difference between the first adversarial noise of the (n - 1)th iteration and the product, and taking the difference as the first adversarial noise of the nth iteration, where when n is 1, the first adversarial noise of the (n - 1)th iteration is 0.

5. The method according to claim 1, characterized in that, The training a second target recognition model based on the multiple first updated attacker images and the image of the attacked person to obtain multiple second gradients of the second target recognition model includes: Based on the multiple first updated attacker images and the attacked image, call a second target recognition model to obtain the features of the multiple first updated attacker images and the features of the attacked image; Determine the similarity between the multiple first updated attacker images and the attacked image based on the features of the multiple first updated attacker images and the features of the attacked image; Determine the difference between a preset value and the similarity between the multiple first updated attacker images and the attacked image, and use the difference as the similarity loss between the multiple first updated attacker images and the attacked image; Backpropagate the similarity loss between the multiple first updated attacker images and the attacked image in the second target recognition model to obtain multiple second gradients of the second target recognition model.

6. The method according to any one of claims 1 to 5, characterized in that, The step of fusing the multiple second gradients to obtain a second adversarial noise includes: Fuse the multiple second gradients to obtain a fused gradient; Determine the product of the fused gradient and a preset learning rate; Determine the difference between the first adversarial noise in the last iteration of the first target recognition model and the product, and use the difference as the second adversarial noise.

7. The method according to any one of claims 1 to 5, characterized in that The step of adding the second adversarial noise to the attacker image to obtain a second updated attacker image includes: Perform the following processing on each pixel of the attacker image; Add the noise component corresponding to the pixel in the second adversarial noise to the pixel; Combine each pixel with the added noise component into a second updated attacker image.

8. The method according to any one of claims 1 to 5, characterized in that, The step of obtaining the test result of a third target recognition model based on the attacked image and the second updated attacker image includes: Based on the attacked image and the second updated attacker image, call a third target recognition model to obtain the features of the attacked image and the features of the second updated attacker image; Determine the similarity between the attacked image and the second updated attacker image based on the features of the attacked image and the features of the second updated attacker image; When the similarity between the attacked image and the second updated attacker image is greater than or equal to a similarity threshold, determine that the test result of the third target recognition model is an attack success.

9. The method according to any one of claims 1 to 5, characterized in that When the test method includes multiple stages, each stage includes multiple times of the iterative processing, the first target recognition model and the second target recognition model are selected from a set of target recognition models, and the two target recognition models selected in different stages are different; The step of obtaining the test result of a third target recognition model based on the attacked image and the second updated attacker image includes: Add the second adversarial noise obtained in the last stage to the attacker image in the last stage to obtain the second updated attacker image in the last stage as a test attacker image. Based on the image of the attacked person and the image of the test attacker, obtain the test result of the third target recognition model.

10. The method according to any one of claims 1 to 5, characterized in that, Before obtaining the image of the attacked person and the image of the attacker, the method further includes: Obtain the initial image of the attacked person and the initial image of the attacker; Perform registration processing on the initial image of the attacked person and the initial image of the attacker to obtain the target area of the image of the attacked person and the target area of the initial image of the attacker; Adjust the target areas of the initial image of the attacked person and the target area of the initial image of the attacker to a unified size to correspondingly obtain the image of the attacked person and the image of the attacker.

11. The method according to any one of claims 1 to 5, characterized in that, After obtaining the test result of the third target recognition model based on the image of the attacked person and the second updated image of the attacker, the method further includes: Obtain the number of successful attacks, where the number of successful attacks is the number of attacker images in the attacker image set that have the test result of successful attacks; Determine the ratio of the number of successful attacks to the number of samples in the attacker image set, and use the ratio as the attack success rate.

12. A test device for a target recognition model, characterized in that, The test device includes: A data acquisition module for obtaining the image of the attacked person and the image of the attacker; A first data processing module for performing multiple iterative processes based on a first target recognition model. The two input images for the first iterative process include the image of the attacked person and the image of the attacker. The two input images for iterative processes starting from the second time include the image of the attacked person and the image of the attacker added with the first adversarial noise of the previous iteration. One iterative process includes: inputting the two input images into the first target recognition model, and determining the first gradient of the first target recognition model according to the output of the first target recognition model. The first gradient of the first target recognition model is used to determine the first adversarial noise of the current iterative process; The first data processing module is further used to superimpose the first adversarial noises of the multiple iterations on the image of the attacker to obtain multiple first updated images of the attacker; A second data processing module for training a second target recognition model based on the multiple first updated images of the attacker and the image of the attacked person to obtain multiple second gradients of the second target recognition model, where the multiple second gradients of the second target recognition model are obtained according to the multiple outputs of the second target recognition model; perform fusion processing on the multiple second gradients to obtain a second adversarial noise; superimpose the second adversarial noise on the image of the attacker to obtain a second updated image of the attacker; A model test module for obtaining the test result of the third target recognition model based on the image of the attacked person and the second updated image of the attacker.

13. An electronic device, characterized in that, The electronic device includes: A memory for storing computer-executable instructions; A processor for implementing the test method of the target recognition model according to any one of claims 1 to 11 when executing the computer-executable instructions or computer programs stored in the memory.

14. A computer-readable storage medium storing computer-executable instructions or a computer program, characterized in that, When the computer-executable instructions or the computer program are executed by a processor, a test method for the target recognition model according to any one of claims 1 to 11 is implemented.

15. A computer program product, comprising computer-executable instructions or a computer program, characterized in that, When the computer-executable instructions or the computer program are executed by a processor, a test method for the target recognition model according to any one of claims 1 to 11 is implemented.

Images