Method and device for determining cutting function during adversarial sample generation in boundary black box scene

Abstract

The invention discloses a method and a device for determining a cutting function during generation of an adversarial sample in a boundary black box scene, which are applied to an end-to-end image model, and the method comprises the following steps: creating a first boundary parameter, a second boundary parameter, a third boundary parameter and a fourth boundary parameter according to an original image, constructing a first midpoint parameter and a second midpoint parameter based on the four boundary parameters; modifying the original image to obtain a first modified image and a second modified image; obtaining a first classification label of the first modified image and a second classification label of the second modified image according to an end-to-end image model, and iteratively updating the boundary parameters according to the first classification label, the second classification label and the original classification label; parameters of the cutting function are determined according to the first midpoint parameter and the second midpoint parameter of the last iteration, the parameters are specifically horizontal and vertical coordinates of the top point of the upper left corner of the cut image, the parameter cracking efficiency of the cutting function can be effectively improved, and therefore the efficiency of generating the boundary black box confrontation sample is improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and specifically relates to a method and device for determining a cutting function when generating adversarial samples in a boundary black box scenario. Background Art

[0002] An end-to-end image model is an image model that can directly output results after receiving input data. For example, external input images come in various sizes. At this time, a cutting function is needed to cut and adjust the images to the required size, and then process them through an AI model. A model composed of a cutting function and an AI model is an end-to-end image model. In recent years, neural networks have been widely used in end-to-end image models, but they are themselves susceptible to interference from adversarial samples, which causes the image model to be greatly interfered with when making classification predictions, and the prediction results are seriously deviated. Therefore, research in related fields is of great significance. Adversarial sample generation in boundary black box scenarios is to obtain information by continuously querying the final classification label of the end-to-end image model to generate adversarial samples, which can help improve the security of end-to-end image models and has high practical significance. However, the adversarial sample generation algorithm in the existing technology cannot be directly applied to boundary black box scenarios.

[0003] Therefore, how to determine the parameters of the cutting function when generating adversarial samples in the boundary black box scenario, so as to improve the efficiency of generating adversarial samples in the boundary black box scenario, is a technical problem to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of the present invention is to solve the technical problems in the prior art of slow cracking of cutting function parameters and high resource consumption when generating boundary black box adversarial samples for image models.

[0005] To achieve the above technical objectives, on the one hand, the present invention provides a method for determining a cutting function when generating adversarial samples in a boundary black box scenario, which is applied to an end-to-end image model. The method includes: Creating a first boundary parameter, a second boundary parameter, a third boundary parameter, and a fourth boundary parameter based on the original image, and constructing a first midpoint parameter based on the first boundary parameter and the second boundary parameter, and constructing a second midpoint parameter based on the third boundary parameter and the fourth boundary parameter; A first modified image is obtained by replacing a first orientation region in the original image with random noise, and a second modified image is obtained by replacing a second orientation region in the original image with random noise; Obtaining a first classification label for the first modified image and a second classification label for the second modified image according to the end-to-end image model, completing an iteration after updating the boundary parameter according to the first classification label, the second classification label, and the original classification label, and performing multiple iterations until a preset condition is satisfied and the iteration ends; The parameters of the cutting function are determined according to the first midpoint parameter and the second midpoint parameter in the last iteration process, and the parameters are specifically the horizontal and vertical coordinates of the vertex of the upper left corner of the cropped image.

[0006] Furthermore, the first boundary parameter a and the third boundary parameter c are 0, and the second boundary parameter b and the fourth boundary parameter d are determined by the following formula: , , Where, w is the width of the original image, h The height of the original image.

[0007] Furthermore, the first midpoint parameter and the second midpoint parameter are specifically determined by the following formula: , , Where, e is the first midpoint parameter, f is the second midpoint parameter.

[0008] Furthermore, the parameters of the cutting function are determined according to the first midpoint parameter and the second midpoint parameter in the last iteration process, and the parameters are specifically determined by the following formula: , , Where, is the first midpoint parameter in the last iteration, is the second midpoint parameter of the last iteration process, m and n are both parameters of the cutting function, where m is the horizontal coordinate of the upper left corner vertex of the cropped image, and n is the vertical coordinate of the upper left corner vertex of the cropped image.

[0009] Furthermore, updating the boundary parameter according to the first classification label, the second classification label, and the original classification label specifically includes: If both the first classification label and the second classification label are consistent with the original classification label, the value of the first midpoint parameter is assigned to the first boundary parameter, and the value of the second midpoint parameter is assigned to the third boundary parameter, and then the update is completed; If the first classification label is consistent with the original classification label and the second classification label is inconsistent with the original classification label, the value of the first midpoint parameter is assigned to the first boundary parameter and the value of the second midpoint parameter is assigned to the fourth boundary parameter to complete the update; If the first classification label is inconsistent with the original classification label and the second classification label is consistent with the original classification label, the value of the first midpoint parameter is assigned to the second boundary parameter, and the value of the second midpoint parameter is assigned to the third boundary parameter to complete the update; If the first classification label is inconsistent with the original classification label and the second classification label is inconsistent with the original classification label, the value of the first midpoint parameter is assigned to the second boundary parameter and the value of the second midpoint parameter is assigned to the fourth boundary parameter to complete the update.

[0010] Furthermore, the preset conditions specifically include condition 1: the value of the second boundary parameter minus the first boundary parameter is 1; condition 2: the value of the fourth boundary parameter minus the third boundary parameter is 1, wherein, when condition 1 or condition 2 is met first, the corresponding boundary parameter will no longer be updated.

[0011] Furthermore, the first orientation area is a first rectangular area on the left side of the original image, the left side of the first rectangular area completely coincides with the left side of the original image, and the width of the first rectangular area is one-eighth of the width of the original image; the second orientation area is a second rectangular area on the upper side of the original image, the upper side of the second rectangular area completely coincides with the upper side of the original image, and the height of the second rectangular area is one-eighth of the height of the original image.

[0012] On the other hand, the present invention also provides a device for determining a cutting function when generating adversarial samples in a boundary black box scenario, the device comprising: a creation module, configured to create a first boundary parameter, a second boundary parameter, a third boundary parameter, and a fourth boundary parameter based on the original image, and construct a first midpoint parameter based on the first boundary parameter and the second boundary parameter, and construct a second midpoint parameter based on the third boundary parameter and the fourth boundary parameter; a modification module, configured to replace a first orientation region in the original image with random noise to obtain a first modified image, and to replace a second orientation region in the original image with random noise to obtain a second modified image; an updating module, configured to obtain a first classification label for the first modified image and a second classification label for the second modified image according to the end-to-end image model, complete an iteration after updating the boundary parameter according to the first classification label, the second classification label, and the original classification label, and perform multiple iterations until a preset condition is satisfied and the iteration ends; The determination module is used to determine the parameters of the cutting function according to the first midpoint parameter and the second midpoint parameter in the last iteration process, wherein the parameters are specifically the horizontal and vertical coordinates of the vertex of the upper left corner of the cropped image.

[0013] The present invention provides a method and device for determining a cutting function when generating adversarial samples in a boundary black box scenario. Compared with the prior art, the method creates a first boundary parameter, a second boundary parameter, a third boundary parameter and a fourth boundary parameter based on the original image, and constructs a first midpoint parameter based on the first boundary parameter and the second boundary parameter, and constructs a second midpoint parameter based on the third boundary parameter and the fourth boundary parameter; a first orientation area in the original image is replaced with random noise to obtain a first modified image, and a second orientation area in the original image is replaced with random noise to obtain a second modified image; a first classification label of the first modified image and a second classification label of the second modified image are obtained according to an end-to-end image model, and an iteration is completed after the boundary parameters are updated according to the first classification label, the second classification label and the original classification label, and multiple iterations are performed until the iteration ends after the preset conditions are met; the parameters of the cutting function are determined according to the first midpoint parameter and the second midpoint parameter in the last iteration process, and the parameters are specifically the horizontal and vertical coordinates of the vertex of the upper left corner of the cropped image, which can effectively improve the efficiency of cracking the cutting function parameters, thereby improving the efficiency of generating boundary black box adversarial samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0015] Figure 1 1 is a flow chart of a method for determining a cutting function when generating adversarial samples in a boundary black box scenario according to an embodiment of this specification; Figure 2 Schematic diagram of the structure of a device for determining a cutting function when generating adversarial samples in a boundary black box scenario provided by an embodiment of this specification; Figure 3 Shown is a schematic diagram of cropping an original image in an embodiment of this specification. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of this application.

[0017] like Figure 1 The flowchart of the method for determining the cutting function when generating adversarial samples in the boundary black box scenario provided by the embodiment of this specification is shown. Although this specification provides the method operation steps or device structure shown in the following embodiments or drawings, based on routine or without creative labor, the method or device may include more or fewer operation steps or module units after partial merger. In the steps or structures where there is no necessary causal relationship logically, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure is applied in actual devices, servers or terminal products, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or drawings (for example, in a parallel processor or multi-threaded processing environment, or even in a distributed processing or server cluster implementation environment).

[0018] The method for determining the cutting function when generating adversarial samples in a boundary black box scenario provided in the embodiments of this description can be applied to terminal devices such as clients and servers.

[0019] In the process of image processing by the end-to-end image model, the input image generally does not meet the size required by the model, so it must be processed by a cutting function (crop). Generally speaking, this type of function cuts around the center of the image, such as Figure 3 The figure shows the original image being cropped. Figure 3 For example, Figure 3The racing car image shown is 800*800 pixels in size and can be cropped to 400*400 pixels (red frame) using the cutting function. The centerline of the image is shown by the yellow line, and points A and B are the parameters of the cutting function. Once these two points are determined, the cutting position is determined. Since the image center is used as the center point in practice, the location of point B can be determined simply by determining the location of point A. The key idea is to find the horizontal and vertical coordinates of point A. To find the horizontal coordinate of point A, we use a vertical purple line, perpendicular to the horizontal coordinate, to cut the image between the left edge (also known as the upper bound) and the vertical centerline (also known as the lower bound). This ultimately determines the horizontal coordinate of point A, the top left corner of the cropped image. The vertical coordinate of point A follows a similar principle: a horizontal purple line, perpendicular to the vertical coordinate, cuts the upper portion of the image. Finally, we obtain the coordinates of point A, completing parameter acquisition. In this process, the left edge and the upper edge of the image are called the upper bounds, the two center lines are called the lower bounds, and the horizontal and vertical coordinates of point A are called the left parameter and the upper parameter, respectively.

[0020] like Figure 1 As shown, the method specifically includes the following steps: Step S101: Create a first boundary parameter, a second boundary parameter, a third boundary parameter, and a fourth boundary parameter based on the original image, and construct a first midpoint parameter based on the first boundary parameter and the second boundary parameter, and construct a second midpoint parameter based on the third boundary parameter and the fourth boundary parameter.

[0021] Specifically, the first boundary parameter a and the third boundary parameter c are 0, and the second boundary parameter b and the fourth boundary parameter d are determined by the following formula: , , Where, w is the width of the original image, h The height of the original image.

[0022] The first midpoint parameter and the second midpoint parameter are specifically determined by the following formula: , , Where, e is the first midpoint parameter, f is the second midpoint parameter.

[0023] Step S102: replacing a first orientation region in the original image with random noise to obtain a first modified image, and replacing a second orientation region in the original image with random noise to obtain a second modified image.

[0024] Specifically, the first orientation area is a first rectangular area on the left side of the original image, the left side of the first rectangular area completely coincides with the left side of the original image, and the width of the first rectangular area is one eighth of the width of the original image. In other words, Figure 3 As shown, make a line parallel to the left edge of the original image and with the same value of the first midpoint parameter, The straight line, that is Figure 3 The vertical purple line in the image is used to replace the pixel values ​​between the left edge of the original image and the vertical purple line with random noise. After the replacement, it is equivalent to cutting off the pixels. The second orientation area is the second rectangular area on the upper side of the original image. The upper side of the second rectangular area completely coincides with the upper side of the original image. The height of the second rectangular area is one eighth of the height of the original image. In other words, a line is made that is parallel to the upper edge of the image and has the same value of the second key parameter, the same distance from the upper edge and the center of the image. The value of the pixels between the upper edge and the straight line, that is, the straight line perpendicular to the ordinate, is replaced with random noise. After the replacement, it is equivalent to cutting off this part of the pixels.

[0025] Step S103: obtain a first classification label for the first modified image and a second classification label for the second modified image according to the end-to-end image model, and complete an iteration after updating the boundary parameters according to the first classification label, the second classification label and the original classification label. Perform multiple iterations until a preset condition is met and the iteration ends.

[0026] Specifically, updating the boundary parameter according to the first classification label, the second classification label, and the original classification label includes: If both the first classification label and the second classification label are consistent with the original classification label, the value of the first midpoint parameter is assigned to the first boundary parameter, and the value of the second midpoint parameter is assigned to the third boundary parameter, and then the update is completed; If the first classification label is consistent with the original classification label and the second classification label is inconsistent with the original classification label, the value of the first midpoint parameter is assigned to the first boundary parameter and the value of the second midpoint parameter is assigned to the fourth boundary parameter to complete the update; If the first classification label is inconsistent with the original classification label and the second classification label is consistent with the original classification label, the value of the first midpoint parameter is assigned to the second boundary parameter, and the value of the second midpoint parameter is assigned to the third boundary parameter to complete the update; If the first classification label is inconsistent with the original classification label and the second classification label is inconsistent with the original classification label, the value of the first midpoint parameter is assigned to the second boundary parameter and the value of the second midpoint parameter is assigned to the fourth boundary parameter to complete the update.

[0027] Specifically, that is to say, if the first classification label is equal to the original classification label, it indicates that the pixels replaced by random noise on the left do not affect the classification of the end-to-end image model. If necessary, the value of the first midpoint parameter is assigned to the first boundary parameter, thereby improving the lower bound; otherwise, it indicates that the pixels replaced by random noise on the left affect the classification of the end-to-end model, then the value of the first midpoint parameter is assigned to the second boundary parameter, thereby lowering the upper bound. The same applies to the second classification label. In the above, the preset conditions specifically include condition 1: the value of the second boundary parameter minus the first boundary parameter is 1; condition 2: the value of the fourth boundary parameter minus the third boundary parameter is 1, wherein, when condition 1 or condition 2 is met first, the corresponding boundary parameter will no longer be updated.

[0028] Step S104: determining parameters of a cutting function according to the first midpoint parameter and the second midpoint parameter in the last iteration process, wherein the parameters are specifically the horizontal and vertical coordinates of the vertex of the upper left corner of the cropped image.

[0029] Specifically, the parameters of the cutting function are determined according to the first midpoint parameter and the second midpoint parameter in the last iteration process, and the parameters are determined specifically by the following formula: , , Where, is the first midpoint parameter in the last iteration, is the second midpoint parameter of the last iteration process, m and n are both parameters of the cutting function, where m is the horizontal coordinate of the upper left corner vertex of the cropped image, and n is the vertical coordinate of the upper left corner vertex of the cropped image.

[0030] After the above processing, the parameters of the cutting function can be quickly cracked, and the efficiency of adversarial sample generation can be improved.

[0031] Based on the above-mentioned method for determining the cutting function when generating adversarial samples in a boundary black box scenario, one or more embodiments of this specification also provide a platform and terminal for determining the cutting function when generating adversarial samples in a boundary black box scenario. The platform or terminal may include devices, software, modules, plug-ins, servers, clients, etc. that use the methods described in the embodiments of this specification and are combined with necessary implementation hardware devices. Based on the same innovative concept, the systems in one or more embodiments provided in the embodiments of this specification are as described in the following embodiments. Since the implementation scheme and method for solving the problem of the system are similar, the implementation of the specific system in the embodiments of this specification can refer to the implementation of the aforementioned method, and the repetitions will not be repeated. The terms "unit" or "module" used below can implement a combination of software and / or hardware with predetermined functions. Although the system described in the following embodiments is preferably implemented in software, hardware and a combination of software and hardware are also possible and conceived.

[0032] Specifically, Figure 2 This is a schematic diagram of the module structure of an embodiment of the device for determining the cutting function when generating adversarial samples in the boundary black box scenario provided in this specification, such as Figure 2 As shown, the device for determining the cutting function when generating adversarial samples in the boundary black box scenario provided in this specification includes: a creation module, configured to create a first boundary parameter, a second boundary parameter, a third boundary parameter, and a fourth boundary parameter based on the original image, and construct a first midpoint parameter based on the first boundary parameter and the second boundary parameter, and construct a second midpoint parameter based on the third boundary parameter and the fourth boundary parameter; a modification module, configured to replace a first orientation region in the original image with random noise to obtain a first modified image, and to replace a second orientation region in the original image with random noise to obtain a second modified image; an updating module, configured to obtain a first classification label for the first modified image and a second classification label for the second modified image according to the end-to-end image model, complete an iteration after updating the boundary parameter according to the first classification label, the second classification label, and the original classification label, and perform multiple iterations until a preset condition is satisfied and the iteration ends; The determination module is used to determine the parameters of the cutting function according to the first midpoint parameter and the second midpoint parameter in the last iteration process, wherein the parameters are specifically the horizontal and vertical coordinates of the vertex of the upper left corner of the cropped image.

[0033] It should be noted that the above-mentioned system may also include other implementation methods according to the description of the corresponding method embodiment. The specific implementation methods can refer to the description of the above-mentioned corresponding method embodiment, and will not be described one by one here.

[0034] An embodiment of the present application further provides an electronic device, including: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the method provided in the above embodiment.

[0035] The electronic device provided by the embodiment of the present application stores executable instructions of the processor in a memory. When the processor executes the executable instructions, it can create a first boundary parameter, a second boundary parameter, a third boundary parameter and a fourth boundary parameter based on the original image, and construct a first midpoint parameter based on the first boundary parameter and the second boundary parameter, and construct a second midpoint parameter based on the third boundary parameter and the fourth boundary parameter; a first modified image is obtained by replacing the first orientation area in the original image with random noise, and a second modified image is obtained by replacing the second orientation area in the original image with random noise; a first classification label of the first modified image and a second classification label of the second modified image are obtained according to the end-to-end image model, and an iteration is completed after updating the boundary parameters according to the first classification label, the second classification label and the original classification label, and multiple iterations are performed until the iteration ends after the preset conditions are met; the parameters of the cutting function are determined according to the first midpoint parameter and the second midpoint parameter in the last iteration process, and the parameters are specifically the horizontal and vertical coordinates of the vertex of the upper left corner of the cropped image, which can effectively improve the efficiency of cracking the cutting function parameters, thereby improving the efficiency of generating boundary black box adversarial samples.

[0036] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0037] The methods or devices described in the above embodiments of this specification can implement business logic through computer programs and record them on storage media. The storage media can be read and executed by a computer to achieve the effects of the solutions described in the embodiments of this specification, such as: Creating a first boundary parameter, a second boundary parameter, a third boundary parameter, and a fourth boundary parameter based on the original image, and constructing a first midpoint parameter based on the first boundary parameter and the second boundary parameter, and constructing a second midpoint parameter based on the third boundary parameter and the fourth boundary parameter; A first modified image is obtained by replacing a first orientation region in the original image with random noise, and a second modified image is obtained by replacing a second orientation region in the original image with random noise; Obtaining a first classification label for the first modified image and a second classification label for the second modified image according to the end-to-end image model, completing an iteration after updating the boundary parameter according to the first classification label, the second classification label, and the original classification label, and performing multiple iterations until a preset condition is satisfied and the iteration ends; The parameters of the cutting function are determined according to the first midpoint parameter and the second midpoint parameter in the last iteration process, and the parameters are specifically the horizontal and vertical coordinates of the vertex of the upper left corner of the cropped image.

[0038] The storage medium may include a physical device for storing information, typically digitizing the information and then storing it in a medium utilizing electrical, magnetic, or optical means. Examples of such storage media include: devices that store information electrically, such as various types of memory devices like RAM and ROM; devices that store information magnetically, such as hard disks, floppy disks, magnetic tapes, magnetic core memories, bubble memories, and USB flash drives; and devices that store information optically, such as CDs and DVDs. Of course, other types of readable storage media exist, such as quantum memories and graphene memories.

[0039] The embodiments of this specification are not limited to those that must comply with industry communication standards, standard computer resource data update and data storage rules, or the situations described in one or more embodiments of this specification. Certain industry standards or slightly modified implementation plans based on the implementation described in the embodiments using custom methods or embodiments can also achieve the same, equivalent, or similar implementation effects as the above embodiments, or the expected implementation effects after deformation. The embodiments obtained by applying these modified or deformed data acquisition, storage, judgment, processing methods, etc. can still fall within the scope of the optional implementation plans of the embodiments of this specification.

[0040] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel ATMEL AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller in pure computer-readable program code, the controller can also be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the means for implementing various functions included therein can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0041] The device embodiments described above are merely illustrative. For example, the division of units described is merely a logical functional division. Actual implementations may employ alternative divisions, such as combining or integrating multiple units or plug-ins into another system, or omitting or disabling certain features. Furthermore, the coupling or direct coupling or communication connection shown or discussed between devices or units may be through interfaces, or indirect coupling or communication connection between devices or units may be electrical, mechanical, or otherwise.

[0042] These computer program instructions can also be loaded onto a computer or other programmable resource data updating device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0043] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referenced to the partial description of the method embodiment. In the description of this specification, reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in an appropriate manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification, as well as the features of different embodiments or examples, unless they are mutually inconsistent.

[0044] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and it should be understood that the scope of protection of the present invention is not limited to such specific descriptions and embodiments. Those skilled in the art can make various other specific variations and combinations based on the technical teachings disclosed in the present invention without departing from the essence of the present invention, and such variations and combinations are still within the scope of protection of the present invention.

Claims

1. A method for determining a cutting function when generating adversarial samples in a boundary black box scenario, characterized by: Applied to an end-to-end image model, the method includes: Creating a first boundary parameter, a second boundary parameter, a third boundary parameter, and a fourth boundary parameter based on the original image, and constructing a first midpoint parameter based on the first boundary parameter and the second boundary parameter, and constructing a second midpoint parameter based on the third boundary parameter and the fourth boundary parameter; A first modified image is obtained by replacing a first orientation region in the original image with random noise, and a second modified image is obtained by replacing a second orientation region in the original image with random noise; Obtaining a first classification label for the first modified image and a second classification label for the second modified image according to the end-to-end image model, completing an iteration after updating the boundary parameter according to the first classification label, the second classification label, and the original classification label, and performing multiple iterations until a preset condition is satisfied and the iteration ends; The parameters of the cutting function are determined according to the first midpoint parameter and the second midpoint parameter in the last iteration process, and the parameters are specifically the horizontal and vertical coordinates of the vertex of the upper left corner of the cropped image.

2. The method for determining a cutting function when generating adversarial samples in a boundary black box scenario according to claim 1, characterized in that: The first boundary parameter a and the third boundary parameter c are 0, and the second boundary parameter b and the fourth boundary parameter d are determined by the following formula: ， ， Where, w is the width of the original image, h The height of the original image.

3. The method for determining a cutting function when generating adversarial samples in a boundary black box scenario according to claim 2, characterized in that: The first midpoint parameter and the second midpoint parameter are specifically determined by the following formula: ， ， Where, e is the first midpoint parameter, f is the second midpoint parameter.

4. The method for determining a cutting function when generating adversarial samples in a boundary black box scenario according to claim 3, characterized in that: The parameters of the cutting function are determined according to the first midpoint parameter and the second midpoint parameter in the last iteration process, and the parameters are determined specifically by the following formula: ， ， Where, is the first midpoint parameter in the last iteration, is the second midpoint parameter of the last iteration process, m and n are both parameters of the cutting function, where m is the horizontal coordinate of the upper left corner vertex of the cropped image, and n is the vertical coordinate of the upper left corner vertex of the cropped image.

5. The method for determining a cutting function when generating adversarial samples in a boundary black box scenario according to claim 1, wherein: Updating the boundary parameter according to the first classification label, the second classification label, and the original classification label specifically includes: If both the first classification label and the second classification label are consistent with the original classification label, the value of the first midpoint parameter is assigned to the first boundary parameter, and the value of the second midpoint parameter is assigned to the third boundary parameter, and then the update is completed; If the first classification label is consistent with the original classification label and the second classification label is inconsistent with the original classification label, the value of the first midpoint parameter is assigned to the first boundary parameter and the value of the second midpoint parameter is assigned to the fourth boundary parameter to complete the update; If the first classification label is inconsistent with the original classification label and the second classification label is consistent with the original classification label, the value of the first midpoint parameter is assigned to the second boundary parameter, and the value of the second midpoint parameter is assigned to the third boundary parameter to complete the update; If the first classification label is inconsistent with the original classification label and the second classification label is inconsistent with the original classification label, the value of the first midpoint parameter is assigned to the second boundary parameter and the value of the second midpoint parameter is assigned to the fourth boundary parameter to complete the update.

6. The method for determining a cutting function when generating adversarial samples in a boundary black box scenario according to claim 1, characterized in that: The preset conditions specifically include condition 1: the value of the second boundary parameter minus the first boundary parameter is 1; condition 2: the value of the fourth boundary parameter minus the third boundary parameter is 1, wherein, when condition 1 or condition 2 is met first, the corresponding boundary parameter will no longer be updated.

7. The method for determining a cutting function when generating adversarial samples in a boundary black box scenario according to claim 3, wherein: The first orientation area is a first rectangular area on the left side of the original image, the left side of the first rectangular area completely overlaps with the left side of the original image, and the width of the first rectangular area is one-eighth of the width of the original image; the second orientation area is a second rectangular area on the upper side of the original image, the upper side of the second rectangular area completely overlaps with the upper side of the original image, and the height of the second rectangular area is one-eighth of the height of the original image.

8. A device for determining a cutting function when generating adversarial samples in a boundary black box scenario, characterized in that: The device comprises: a creation module, configured to create a first boundary parameter, a second boundary parameter, a third boundary parameter, and a fourth boundary parameter based on the original image, and construct a first midpoint parameter based on the first boundary parameter and the second boundary parameter, and construct a second midpoint parameter based on the third boundary parameter and the fourth boundary parameter; a modification module, configured to replace a first orientation region in the original image with random noise to obtain a first modified image, and to replace a second orientation region in the original image with random noise to obtain a second modified image; an updating module, configured to obtain a first classification label for the first modified image and a second classification label for the second modified image according to the end-to-end image model, complete an iteration after updating the boundary parameter according to the first classification label, the second classification label, and the original classification label, and perform multiple iterations until a preset condition is satisfied and the iteration ends; The determination module is used to determine the parameters of the cutting function according to the first midpoint parameter and the second midpoint parameter in the last iteration process, wherein the parameters are specifically the horizontal and vertical coordinates of the vertex of the upper left corner of the cropped image.

Images