Adversarial sample image generation method, system, device, equipment, medium and product

Abstract

The invention discloses an adversarial sample image generation method, system, device and equipment, a computer readable storage medium and a computer program product, and the method comprises the steps: obtaining an original adversarial sample image, carrying out the local region selection of the original adversarial sample image, and obtaining a target mixed region; performing random region selection in the target mixing region to obtain a first bounding box region and a second bounding box region; performing regional image mixing processing on the first bounding box region and the second bounding box region according to a preset image mixing ratio to obtain a mixed regional image; and generating a target adversarial sample image corresponding to the original adversarial sample image according to the mixed region image and the original adversarial sample image. By applying the technical scheme provided by the invention, the semantic consistency of the generated adversarial sample image and the original sample image can be effectively ensured, and the transportability of the adversarial sample image is further improved.

Description

Technical Field

[0001] The present application relates to the field of image processing technology, and in particular to a method for generating adversarial sample images, and also to an adversarial sample image generation system, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] Adversarial attacks are a key tool for assessing the security of deep learning models. By adding carefully crafted perturbations to the original input data, adversarial images can mislead deep learning models into producing erroneous outputs, thereby revealing potential vulnerabilities. The portability of adversarial images is crucial for assessing and improving the security of deep learning models. Portability refers to the ability of adversarial images generated on a source model to mislead a target model.

[0003] Existing adversarial image generation methods primarily focus on two technical approaches: gradient optimization-based methods and input transformation-based methods. Gradient optimization-based methods update adversarial images by calculating the gradient of a loss function, gradually increasing their deviation from the original classification. Input transformation-based methods enhance the diversity of adversarial images by designing various input patterns (such as random scaling, translation, and mixing different images). However, while these methods enhance the diversity of sample images, they often introduce excessive semantic changes, resulting in a loss of semantic consistency between the adversarial images and the original images, reducing the portability of adversarial images.

[0004] Therefore, how to effectively ensure the semantic consistency between the generated adversarial sample images and the original sample images, and thus improve the portability of the adversarial sample images, is a problem that technicians in this field need to solve. Summary of the Invention

[0005] The purpose of this application is to provide an adversarial sample image generation method, which can effectively ensure the semantic consistency of the generated adversarial sample image and the original sample image, and further improve the portability of the adversarial sample image; another purpose of this application is to provide an adversarial sample image generation system, device, electronic device, computer-readable storage medium and computer program product, all of which have the above-mentioned beneficial effects.

[0006] In a first aspect, the present application discloses a method for generating adversarial sample images, comprising:

[0007] Obtain an original adversarial sample image, perform local region selection on the original adversarial sample image, and obtain a target mixed region;

[0008] Randomly selecting an area within the target mixed area to obtain a first bounding box area and a second bounding box area;

[0009] performing regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image;

[0010] A target adversarial sample image corresponding to the original adversarial sample image is generated according to the mixed region image and the original adversarial sample image.

[0011] Optionally, performing regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image includes:

[0012] When the area size of the first bounding box area is inconsistent with the area size of the second bounding box area, performing a subtraction operation on the second bounding box area to obtain a new bounding box area, so that the area size of the new bounding box area is consistent with the area size of the first bounding box area; and performing regional image blending processing on the first bounding box area and the new bounding box area according to the preset image blending ratio to obtain the blended regional image;

[0013] When the area size of the first bounding box area is consistent with the area size of the second bounding box area, regional image mixing processing is performed on the first bounding box area and the second bounding box area according to the preset image mixing ratio to obtain the mixed regional image.

[0014] Optionally, generating a target adversarial sample image corresponding to the original adversarial sample image according to the mixed region image and the original adversarial sample image includes:

[0015] Generate an initial adversarial sample image according to the mixed region image and the original adversarial sample image;

[0016] Random noise is added to the initial adversarial sample image to obtain the target adversarial sample image corresponding to the original adversarial sample image.

[0017] In a second aspect, the present application also discloses an adversarial sample image generation system, in which a target adversarial sample image generation model is deployed, and the target adversarial sample image generation model is used to implement the steps of any of the adversarial sample image generation methods described above.

[0018] Optionally, the target adversarial sample image generation model is deployed in a preset model pool of the adversarial sample image generation system, and the preset model pool also has other adversarial sample image generation models deployed in addition to the target adversarial sample image generation model;

[0019] The target adversarial sample image generation model can also be used to obtain the first image gradient corresponding to each of the other adversarial sample image generation models and the second image gradient corresponding to the target adversarial sample image generation model, and calculate the target image gradient based on each of the first image gradients and the second image gradient, so as to use the target image gradient to achieve model optimization of the target adversarial sample image generation model.

[0020] Optionally, the target adversarial sample image generation model is specifically used to perform weighted average calculation on each of the first image gradients and the second image gradients according to preset model weights to obtain the target image gradient.

[0021] In a third aspect, the present application further discloses a device for generating adversarial sample images, comprising:

[0022] An acquisition module is used to acquire an original adversarial sample image, perform local area selection on the original adversarial sample image, and obtain a target mixed area;

[0023] A selection module is configured to perform random area selection within the target mixed area to obtain a first bounding box area and a second bounding box area;

[0024] a mixing module, configured to perform regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image;

[0025] A generation module is used to generate a target adversarial sample image corresponding to the original adversarial sample image based on the mixed region image and the original adversarial sample image.

[0026] In a fourth aspect, the present application further discloses an electronic device, comprising:

[0027] memory for storing computer programs;

[0028] A processor is configured to implement the steps of any one of the adversarial sample image generation methods described above when executing the computer program.

[0029] In a fifth aspect, the present application further discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the adversarial sample image generation methods described above are implemented.

[0030] In a sixth aspect, the present invention further discloses a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the adversarial sample image generation methods described above.

[0031] The present application provides an adversarial sample image generation method, including: obtaining an original adversarial sample image, performing local area selection on the original adversarial sample image to obtain a target mixed area; performing random area selection within the target mixed area to obtain a first bounding box area and a second bounding box area; performing regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image; and generating a target adversarial sample image corresponding to the original adversarial sample image based on the mixed regional image and the original adversarial sample image.

[0032] By applying the technical solution provided in this application, a local area is selected as the target mixing area for the original adversarial sample image, and two bounding box areas are randomly selected within the target mixing area for regional image mixing to achieve the generation of the target adversarial sample image. It can be understood that by randomly selecting different areas of the original adversarial sample image (the first bounding box area and the second bounding box area) for mixing, the global semantic structure of the image can be effectively maintained, ensuring the semantic consistency of the generated adversarial sample image with the original sample image; at the same time, limiting the two bounding box areas for regional image mixing to the local area of ​​the original adversarial sample image can not only ensure the integrity of the image features, but also avoid the introduction of other irrelevant information, further improving the semantic consistency of the generated adversarial sample image with the original sample image, and greatly improving the portability of the adversarial sample image.

[0033] The adversarial sample image generation system, device, electronic device, computer-readable storage medium and computer program product provided in this application also have the above-mentioned technical effects, and this application will not repeat them here. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following is a brief introduction to the drawings required for describing the embodiments of the present application. Of course, the drawings described below in connection with the embodiments of the present application are only part of the embodiments of the present application. For those skilled in the art, other drawings can be obtained based on the provided drawings without inventive work, and the obtained other drawings also fall within the scope of protection of the present application.

[0035] Figure 1 A flowchart of a method for generating adversarial sample images provided in this application;

[0036] Figure 2 A schematic diagram of the structure of an adversarial sample image generation device provided in this application;

[0037] Figure 3 This is a schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0038] The core of this application is to provide an adversarial sample image generation method, which can effectively ensure the semantic consistency between the generated adversarial sample image and the original sample image, and further improve the portability of the adversarial sample image; another core of this application is to provide an adversarial sample image generation system, device, electronic device, computer-readable storage medium and computer program product, all of which have the above-mentioned beneficial effects.

[0039] In order to describe the technical solutions in the embodiments of the present application more clearly and completely, the technical solutions in the embodiments of the present application will be introduced below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0040] An embodiment of the present application provides a method for generating adversarial sample images.

[0041] Please refer to Figure 1 , Figure 1 This is a flowchart of an adversarial sample image generation method provided in the present application. The adversarial sample image generation method may include the following S101 to S104.

[0042] S101: Obtain an original adversarial sample image, perform local region selection on the original adversarial sample image, and obtain a target mixed region.

[0043] This step aims to obtain the original adversarial sample image and select a local region within it. Specifically, the original adversarial sample image is the original sample image used to generate the adversarial sample image. It can be directly input by a technician or directly downloaded from an existing image library. This application does not limit its acquisition method. Further, a local region selection is performed on the original adversarial sample image to obtain a local region within it as the target mixed region.

[0044] It should be noted that the target mixing region demarcates the image mixable region of the original adversarial sample image. As described later, two bounding box regions are randomly selected within this target mixing region to achieve regional image mixing to achieve the corresponding target adversarial sample image generation. It can be understood that limiting the two bounding box regions for regional image mixing to the local region of the original adversarial sample image can minimize the significant visual differences in the generated target adversarial sample image and improve the utilization of the inherent information within the original adversarial sample image. Therefore, it can not only ensure the integrity of image features, but also avoid the introduction of other irrelevant information, further improving the semantic consistency of the generated adversarial sample image and the original sample image, thereby effectively improving the portability of the adversarial sample image.

[0045] Furthermore, when selecting local regions, relevant configuration parameters can be used. For example, the minimum size of the target mixed region, i.e., the minimum width and minimum height, can be pre-set to effectively ensure that the target mixed region is not too small to lose the meaning of generating the adversarial sample image. Specifically, the target mixed region is selected in the original adversarial sample image as follows:

[0046] Target mixed area coordinates A=(R i , R j , W w , H h );

[0047] R i ~Unif(0,WW w ), R i Indicates the upper left corner coordinate (horizontal coordinate) of the target blending area in the width direction, and its value range is from 0 to WW w , ensuring that the target mixed area does not exceed the width boundary of the original adversarial sample image; W represents the width of the original adversarial sample image, W w Indicates the width of the target blending area;

[0048] R j ~Unif(0,HH w ), R j Indicates the upper left corner coordinate (ordinate) of the target mixing area in the height direction, and its value range is from 0 to HH w , ensuring that the target mixed area does not exceed the height boundary of the original adversarial sample image; H represents the height of the original adversarial sample image, H w Indicates the height of the target mixing area;

[0049] W w ~Unif(w,W),W wIndicates the width of the target mixed area, and its value range is from w to W, where w represents the minimum set width of the target mixed area and W represents the width of the original adversarial sample image;

[0050] H h ~Unif(h,H),H h The height of the target mixed area is in the range of h to H, where h represents the minimum set height of the target mixed area and H represents the height of the original adversarial sample image.

[0051] Unif means uniform distribution.

[0052] S102: Randomly select an area in the target mixed area to obtain a first bounding box area and a second bounding box area.

[0053] This step aims to randomly select two bounding box regions (i.e., the first bounding box region and the second bounding box region) within the target mixed region. It should be noted that both the first bounding box region and the second bounding box region must be located within the target mixed region and cannot completely overlap. Furthermore, the first bounding box region and the second bounding box region may or may not be the same size, which is not limited in this application.

[0054] S103: performing regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image.

[0055] This step aims to achieve regional image mixing processing of the two bounding box areas. By mixing the regional image of the first bounding box area with the regional image of the second bounding box area, a mixed regional image can be obtained. Obviously, the mixed regional image retains the global semantic structure of the regional images of the first bounding box area and the second bounding box area in the target mixed area, which can effectively ensure the semantic consistency of the generated adversarial sample image and the original sample image.

[0056] The regional image blending of the first bounding box region and the second bounding box region may be achieved by referring to a preset image blending ratio and using a blending transformation formula T(·), namely:

[0057] T(x, γ)=γ×B1(x)+(1-γ)×B2(x);

[0058] Where x represents the original adversarial sample image, γ represents the preset image mixing ratio, B1(x) and B2(x) represent the first bounding box area and the second bounding box area in the original adversarial sample image x, respectively.

[0059] In one embodiment of the present application, performing regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image may include: when the area size of the first bounding box area is inconsistent with the area size of the second bounding box area, performing a difference operation on the second bounding box area to obtain a new bounding box area, so that the area size of the new bounding box area is consistent with the area size of the first bounding box; performing regional image mixing processing on the first bounding box area and the new bounding box area according to the preset image mixing ratio to obtain a mixed regional image; when the area size of the first bounding box area is consistent with the area size of the second bounding box area, performing regional image mixing processing on the first bounding box area and the second bounding box area according to the preset image mixing ratio to obtain a mixed regional image.

[0060] As described above, within the target blending region, the first bounding box region and the second bounding box region may or may not be the same size. In the case of inconsistent sizes, interpolation can be performed on one of the bounding box regions to achieve matching of the sizes of the two regions. More specifically, interpolation can be performed on the smaller bounding box region to achieve matching of the sizes of the first and second bounding box regions. Of course, in the case of consistent sizes, the first and second bounding box regions can be directly subjected to regional image blending.

[0061] S104: Generate a target adversarial sample image corresponding to the original adversarial sample image according to the mixed region image and the original adversarial sample image.

[0062] This step aims to achieve the generation of adversarial sample images. Specifically, after obtaining the mixed area image, the mixed area image is a local image obtained by performing image area mixing on the target mixed area. At this time, the target adversarial sample image corresponding to the original adversarial sample image can be generated by combining the original adversarial sample image. It can be understood that since the above-mentioned target mixed area, the first bounding box area, and the second bounding box area can all be randomly selected, multiple target adversarial sample images can be generated based on one original adversarial sample image, and a large number of target adversarial sample images can be generated based on multiple original adversarial sample images, which has a high adversarial sample image generation efficiency.

[0063] In one embodiment of the present application, generating a target adversarial sample image corresponding to the original adversarial sample image based on the mixed region image and the original adversarial sample image may include:

[0064] Generate an initial adversarial sample image based on the mixed region image and the original adversarial sample image;

[0065] Add random noise to the initial adversarial sample image to obtain the target adversarial sample image corresponding to the original adversarial sample image.

[0066] In order to further improve the portability of the generated target adversarial sample image, after completing the local region hybrid transformation of the original adversarial sample image, random noise can be further added to it, for example, random noise r~μ[-(β×ε) d , (β×ε) d ], where μ represents uniform distribution, d represents the dimension of noise in space, ε represents the anti-disturbance amplitude, β is a hyperparameter and β>0.

[0067] It can be seen that the adversarial sample image generation method provided in the embodiment of the present application selects a local area as the target mixing area for the original adversarial sample image, and randomly selects two bounding box areas within the target mixing area to perform regional image mixing processing to achieve the generation of the target adversarial sample image. It can be understood that by randomly selecting different areas of the original adversarial sample image (the first bounding box area and the second bounding box area) for mixing, the global semantic structure of the image can be effectively maintained, ensuring the semantic consistency of the generated adversarial sample image and the original sample image; at the same time, limiting the two bounding box areas for regional image mixing to the local area of ​​the original adversarial sample image can not only ensure the integrity of the image features, but also avoid introducing other irrelevant information, thereby further improving the semantic consistency between the generated adversarial sample image and the original sample image, and greatly improving the portability of the adversarial sample image.

[0068] An embodiment of the present application provides an adversarial sample image generation system.

[0069] The adversarial sample image generation system provided in the embodiments of the present application deploys a target adversarial sample image generation model, which is used to implement the steps of any of the above adversarial sample image generation methods.

[0070] Specifically, the adversarial sample image generation method provided in this application can be applied to a target adversarial sample image generation model, which can be pre-trained using a large amount of sample image data. After obtaining the original adversarial sample image, the adversarial sample image generation system can input it into the target adversarial sample image generation model for processing. The processing flow is as shown in S101~S104 above, that is, S101~S104 above can be implemented based on the target adversarial sample image generation model, and the output of the target adversarial sample image generation model is the target adversarial sample image corresponding to the original adversarial sample image.

[0071] It can be seen that the adversarial sample image generation system provided in the embodiment of the present application selects a local area as the target mixing area for the original adversarial sample image, and randomly selects two bounding box areas within the target mixing area to perform regional image mixing processing to achieve the generation of the target adversarial sample image. It can be understood that by randomly selecting different areas of the original adversarial sample image (the first bounding box area and the second bounding box area) for mixing, the global semantic structure of the image can be effectively maintained, ensuring the semantic consistency of the generated adversarial sample image and the original sample image; at the same time, limiting the two bounding box areas for regional image mixing to the local area of ​​the original adversarial sample image can not only ensure the integrity of the image features, but also avoid introducing other irrelevant information, thereby further improving the semantic consistency between the generated adversarial sample image and the original sample image, and greatly improving the portability of the adversarial sample image.

[0072] As mentioned above, the adversarial sample image generation method provided by this application can be applied to the target adversarial sample image generation model. For the target adversarial sample image generation model, given an input image x (i.e., the original adversarial sample image) with a true label y and a classifier f with model parameters θ, θ (·), whose goal is to generate an adversarial sample image x * (represents the model output), when ‖x * -x‖ p ≤ε, misleading the classifier so that f θ (x * )≠f θ (x), where ε represents the anti-disturbance amplitude, ‖·‖ p represents the p-norm. Therefore, the generation of adversarial sample images based on the target adversarial sample image generation model can be expressed as a constrained optimization problem, and its mathematical expression can be summarized as: argmax J (x * ,y;θ);‖x * -x‖ p ≤ε; where J(x * , y; θ) is the loss function, which can be cross entropy loss. Argmax means optimizing the variables and finding the variable x that maximizes the loss function. * . It is worth noting that when performing a black-box attack, the parameters of the target model (such as the classifier described above) are unknown, so direct optimization of the formula is not feasible. To address this limitation and generate adversarial sample images with better transferability, the embodiments of this application introduce several other different types of adversarial sample image generation models and propose an adversarial sample image generation method based on a dynamic heterogeneous redundant architecture.

[0073] Based on this, in one embodiment of the present application, the target adversarial sample image generation model is deployed in a preset model pool of the adversarial sample image generation system, and other adversarial sample image generation models other than the target adversarial sample image generation model are also deployed in the preset model pool;

[0074] The target adversarial sample image generation model can also be used to obtain the first image gradient corresponding to each other adversarial sample image generation model and the second image gradient corresponding to the target adversarial sample image generation model, and calculate the target image gradient based on each first image gradient and the second image gradient, so as to use the target image gradient to achieve model optimization of the target adversarial sample image generation model.

[0075] Specifically, a model pool can be deployed within the sample image generation system to store multiple different types of adversarial image generation models, including the target adversarial image generation model described above. Based on this, the target adversarial image generation model can obtain the image gradients (first image gradients) corresponding to other adversarial image generation models within the preset model pool and combine them with its own corresponding image gradients (second image gradients) to calculate a comprehensive image gradient (target image gradient). Based on this calculation result, the target adversarial image is generated, essentially achieving its own optimization and update. Clearly, the target adversarial image generated at this point integrates the advantages of multiple different adversarial image generation models, offering greater portability.

[0076] Among them, the target adversarial sample image generation model can be specifically used to perform weighted average calculation on each first image gradient and the second image gradient according to the preset model weight to obtain the target image gradient. The embodiment of the present application provides a method for calculating the comprehensive image gradient, that is, an implementation method based on weighted average calculation. During the implementation process, for the various types of adversarial sample image generation models in the preset model pool, different weight values ​​can be added for them according to the model performance, and then the weighted average calculation of all image gradients is implemented according to each weight value, so as to obtain a more accurate target image gradient, so as to effectively ensure the portability of the final generated adversarial sample image.

[0077] Specifically, the target adversarial image generation model can be used to calculate the average image gradient as the second image gradient based on the image gradients corresponding to multiple target adversarial images. In other words, in order to obtain a more stable update direction, the average image gradient of multiple target adversarial images can be obtained as the second image gradient corresponding to the target adversarial image generation model. The average image gradient calculation formula is as follows:

[0078] ;

[0079] in, represents the average image gradient, N represents the number of target adversarial sample images, Represents the target adversarial sample image The gradient operator, when i=0, .

[0080] In one possible implementation, the adversarial image generation models deployed in the preset model pool, in addition to the target adversarial image generation model, may include adversarial image generation models based on gradient optimization and adversarial image generation models based on input transformation, such as the Admix model, the SSA model, and the BSR model. It is worth noting that this application has tested each adversarial image generation model in the preset model pool, and the target adversarial image generation model proposed in this application has the best performance in all test indicators and has better transferability.

[0081] It can be understood that in actual application scenarios, there are many ways to achieve the generation of adversarial sample images. It can be to directly use the target adversarial sample image generation model proposed in this application to achieve adversarial sample image generation, or to directly randomly select any adversarial sample image generation model in the preset model pool to achieve adversarial sample image generation, or to integrate the image gradients of multiple adversarial sample image generation models in the preset model pool to achieve adversarial sample image generation. The specific settings can be customized by technical personnel according to actual needs.

[0082] Thus, the adversarial image generation system provided by the embodiments of this application proposes a dynamic heterogeneous redundant architecture that seamlessly integrates multiple reconstruction-based and prediction-based adversarial image generation algorithms, while enabling them to work collaboratively to capture different features and patterns of the input data. Thus, by combining multiple model architectures, it demonstrates portability to different deep networks, further enhancing the flexibility and stability of deep learning models and ensuring the efficiency and robustness of adversarial image generation.

[0083] An embodiment of the present application provides a device for generating adversarial sample images.

[0084] Please refer to Figure 2 , Figure 2 This is a schematic diagram of the structure of an adversarial sample image generation device provided by this application. The adversarial sample image generation device may include:

[0085] Acquisition module 1 is used to obtain the original adversarial sample image, perform local area selection on the original adversarial sample image, and obtain the target mixed area;

[0086] A selection module 2 is used to randomly select an area in the target mixed area to obtain a first bounding box area and a second bounding box area;

[0087] A mixing module 3 is configured to perform regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image;

[0088] The generating module 4 is configured to generate a target adversarial sample image corresponding to the original adversarial sample image based on the mixed region image and the original adversarial sample image.

[0089] It can be seen that the adversarial sample image generation device provided in the embodiment of the present application selects a local area as the target mixing area for the original adversarial sample image, and randomly selects two bounding box areas within the target mixing area to perform regional image mixing processing to achieve the generation of the target adversarial sample image. It can be understood that by randomly selecting different areas of the original adversarial sample image (the first bounding box area and the second bounding box area) for mixing, the global semantic structure of the image can be effectively maintained, ensuring the semantic consistency of the generated adversarial sample image and the original sample image; at the same time, limiting the two bounding box areas for regional image mixing to the local area of ​​the original adversarial sample image can not only ensure the integrity of the image features, but also avoid introducing other irrelevant information, thereby further improving the semantic consistency between the generated adversarial sample image and the original sample image, and greatly improving the portability of the adversarial sample image.

[0090] In one embodiment of the present application, the above-mentioned mixing module 3 can be specifically used to, when the area size of the first bounding box area is inconsistent with the area size of the second bounding box area, perform a difference operation on the second bounding box area to obtain a new bounding box area, so that the area size of the new bounding box area is consistent with the area size of the first bounding box area; according to a preset image mixing ratio, perform regional image mixing processing on the first bounding box area and the new bounding box area to obtain a mixed regional image; when the area size of the first bounding box area is consistent with the area size of the second bounding box area, perform regional image mixing processing on the first bounding box area and the second bounding box area according to the preset image mixing ratio to obtain a mixed regional image.

[0091] In one embodiment of the present application, the above-mentioned generation module 4 can be specifically used to generate an initial adversarial sample image based on the mixed region image and the original adversarial sample image; add random noise to the initial adversarial sample image to obtain a target adversarial sample image corresponding to the original adversarial sample image.

[0092] For an introduction to the apparatus provided in the embodiments of this application, please refer to the above method embodiments, which will not be elaborated in this application.

[0093] An embodiment of the present application provides an electronic device.

[0094] Please refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of an electronic device provided in this application, which may include:

[0095] Memory 11, for storing computer programs;

[0096] The processor 10 can implement the steps of any of the above adversarial sample image generation methods when executing the computer program.

[0097] like Figure 3 FIG. 1 is a schematic diagram of the structure of an electronic device, which may include a processor 10, a memory 11, a communication interface 12, and a communication bus 13. The processor 10, the memory 11, and the communication interface 12 communicate with each other via the communication bus 13.

[0098] In the embodiment of the present application, the processor 10 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field programmable gate array, or other programmable logic devices.

[0099] The processor 10 may call a program stored in the memory 11 . Specifically, the processor 10 may execute operations in an embodiment of the adversarial sample image generation method.

[0100] The memory 11 is used to store one or more programs. The program may include program code, and the program code includes computer operating instructions. In the embodiment of the present application, the memory 11 stores at least a program for implementing the following functions:

[0101] Obtain the original adversarial sample image, perform local area selection on the original adversarial sample image, and obtain the target mixed area;

[0102] Randomly select an area within the target mixed area to obtain a first bounding box area and a second bounding box area;

[0103] Performing regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image;

[0104] A target adversarial sample image corresponding to the original adversarial sample image is generated based on the mixed region image and the original adversarial sample image.

[0105] In one possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0106] In addition, the memory 11 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0107] The communication interface 12 may be an interface of a communication module, and is used to connect to other devices or systems.

[0108] Of course, it needs to be explained that Figure 3 The structure shown does not constitute a limitation on the electronic device in the embodiment of the present application. In actual applications, the electronic device may include Figure 3 More or fewer components, or combinations of certain components, may be shown.

[0109] An embodiment of the present application provides a computer-readable storage medium.

[0110] The computer-readable storage medium provided in the embodiment of the present application stores a computer program, and when the computer program is executed by a processor, the steps of any one of the adversarial sample image generation methods described above can be implemented.

[0111] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program codes.

[0112] For an introduction to the computer-readable storage medium provided in the embodiments of the present application, please refer to the above method embodiments, and this application will not elaborate on them here.

[0113] An embodiment of the present application provides a computer program product.

[0114] The computer program product provided in the embodiments of the present application includes a computer program, which, when executed by a processor, can implement the steps of any of the above-described adversarial sample image generation methods.

[0115] Specifically, in each of the above embodiments, all or part of the embodiments may be implemented through software, hardware, firmware, or any combination thereof. When implemented through software, all or part of the embodiments may be implemented in the form of a computer program product.

[0116] Among them, the computer program product may include one or more computer programs, which, when loaded and executed on a computer, may generate in whole or in part the processes or functions described in the embodiments of the present application. The computer may be a general-purpose computer, a special-purpose computer, a network computer, or other programmable device. Computer instructions may be stored in a non-volatile storage medium or transmitted from one non-volatile storage medium to another non-volatile storage medium. For example, a computer program may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line, etc.) or wireless (e.g., infrared, wireless, microwave, etc.) method.

[0117] For the characteristics of the computer program product provided in the embodiments of the present application, please refer to the above method embodiments, and this application will not elaborate on them here.

[0118] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0119] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each embodiment according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0120] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be stored in a random access memory (RAM), a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0121] The technical solution provided by the present application is described in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only intended to help understand the method and core ideas of the present application. It should be noted that, for those skilled in the art, without departing from the principles of the present application, several improvements and modifications may be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A method for generating adversarial sample images, characterized in that: include: Obtain an original adversarial sample image, perform local region selection on the original adversarial sample image, and obtain a target mixed region; Randomly selecting an area within the target mixed area to obtain a first bounding box area and a second bounding box area; performing regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image; A target adversarial sample image corresponding to the original adversarial sample image is generated according to the mixed region image and the original adversarial sample image.

2. The adversarial sample image generation method according to claim 1, characterized in that Performing regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image, including: When the area size of the first bounding box area is inconsistent with the area size of the second bounding box area, performing a subtraction operation on the second bounding box area to obtain a new bounding box area, so that the area size of the new bounding box area is consistent with the area size of the first bounding box area; and performing regional image blending processing on the first bounding box area and the new bounding box area according to the preset image blending ratio to obtain the blended regional image; When the area size of the first bounding box area is consistent with the area size of the second bounding box area, regional image mixing processing is performed on the first bounding box area and the second bounding box area according to the preset image mixing ratio to obtain the mixed regional image.

3. The adversarial sample image generation method according to claim 1, characterized in that Generating a target adversarial sample image corresponding to the original adversarial sample image according to the mixed region image and the original adversarial sample image includes: Generate an initial adversarial sample image according to the mixed region image and the original adversarial sample image; Random noise is added to the initial adversarial sample image to obtain the target adversarial sample image corresponding to the original adversarial sample image.

4. A system for generating adversarial sample images, characterized in that: A target adversarial image generation model is deployed in the adversarial image generation system, and the target adversarial image generation model is used to implement the steps of the adversarial image generation method according to any one of claims 1 to 3.

5. The adversarial sample image generation system according to claim 4, characterized in that The target adversarial sample image generation model is deployed in a preset model pool of the adversarial sample image generation system, and other adversarial sample image generation models other than the target adversarial sample image generation model are also deployed in the preset model pool; The target adversarial sample image generation model is further used to obtain the first image gradient corresponding to each of the other adversarial sample image generation models and the second image gradient corresponding to the target adversarial sample image generation model, and calculate the target image gradient based on each of the first image gradients and the second image gradient, so as to use the target image gradient to achieve model optimization of the target adversarial sample image generation model.

6. The adversarial sample image generation system according to claim 5, characterized in that The target adversarial sample image generation model is specifically used to perform weighted average calculation on each of the first image gradients and the second image gradients according to a preset model weight to obtain the target image gradient.

7. A device for generating adversarial sample images, characterized in that: include: An acquisition module is used to acquire an original adversarial sample image, perform local area selection on the original adversarial sample image, and obtain a target mixed area; A selection module is configured to perform random area selection within the target mixed area to obtain a first bounding box area and a second bounding box area; a mixing module, configured to perform regional image mixing processing on the first bounding box area and the second bounding box area according to a preset image mixing ratio to obtain a mixed regional image; A generation module is used to generate a target adversarial sample image corresponding to the original adversarial sample image based on the mixed region image and the original adversarial sample image.

8. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the adversarial sample image generation method according to any one of claims 1 to 3 when executing the computer program.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the adversarial sample image generation method according to any one of claims 1 to 3 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the adversarial sample image generation method according to any one of claims 1 to 3 are implemented.

Images