Image processing model anti-robustness evaluation method and related device

Abstract

The invention belongs to the field of image processing, and discloses an image processing model adversarial robustness evaluation method and a related device, and the method comprises the steps: obtaining an image processing model and an image sample; obtaining an image processing type and an attack type of the image processing model, and obtaining a corresponding adversarial sample generation algorithm from a preset adversarial sample generation algorithm library according to the image processing type and the attack type; generating identically distributed adversarial samples according to the image samples in combination with an adversarial sample generation algorithm, and obtaining an identically distributed adversarial robustness evaluation result of the image processing model according to the identically distributed adversarial samples; and generating a distribution migration sample by adopting an image transformation operation according to the image sample, and obtaining a distribution migration anti-robustness evaluation result of the image processing model according to the distribution migration sample. The anti-robustness level of the image processing model under different conditions can be revealed more comprehensively and deeply, and the reliability, safety and effectiveness of the image processing model when the image processing model is applied to the real world are ensured.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of image processing, and relates to an image processing model adversarial robustness evaluation method and related device. BACKGROUND

[0002] The mechanism research of adversarial sample attack is the main content of the mechanism research of adversarial attack. The main idea is to add carefully constructed tiny noise to the original sample without affecting human perception, so that the deep learning model makes a wrong decision. The attack method used by adversarial attack can be divided into white-box attack and black-box attack according to the knowledge available to the attacker.

[0003] Therefore, when deploying image processing models in real-world applications, it is necessary to effectively evaluate the adversarial robustness of image processing models to ensure the reliability, security and effectiveness of image processing models in real-world applications. However, there is currently a lack of unified standards and integrated methods for evaluating the adversarial robustness of image processing models, which cannot achieve comprehensive and accurate evaluation of image processing models. SUMMARY

[0004] The purpose of the present application is to overcome the shortcomings of the prior art and provide an image processing model adversarial robustness evaluation method and related device.

[0005] To achieve the above purpose, the present application adopts the following technical solutions:

[0006] In a first aspect of the present application, an image processing model adversarial robustness evaluation method is provided, comprising: obtaining an image processing model and an image sample; obtaining the image processing type and the attack type of the image processing model, and obtaining the corresponding adversarial sample generation algorithm from the preset adversarial sample generation algorithm library according to the image processing type and the attack type; generating a same-distribution adversarial sample according to the image sample and combining the adversarial sample generation algorithm, and obtaining a same-distribution adversarial robustness evaluation result of the image processing model according to the same-distribution adversarial sample; generating a distribution shift sample by using an image transformation operation according to the image sample, and obtaining a distribution shift adversarial robustness evaluation result of the image processing model according to the distribution shift sample; wherein the adversarial sample generation algorithm library includes an image classification white-box attack method, an image classification black-box attack method, a target detection white-box attack method and a target detection black-box attack method; the image classification white-box attack method includes an iterative-based white-box attack method, an optimization-based white-box attack method and an integrated-based white-box attack method; the image classification black-box attack method includes an input transformation-based black-box attack method, an intermediate layer feature-based black-box attack method of a proxy model and an optimization-based black-box attack method of a proxy model.

[0007] Optionally, the same-distribution adversarial samples generated by different adversarial sample generation algorithms have the same number.

[0008] Optionally, the white-box attack method based on iteration includes one or more of a basic iteration method, a projected gradient descent method, and a momentum iteration method; the white-box attack method based on optimization includes a Kali and Wagner attack method; the white-box attack method based on integration includes an AutoAttack method; the black-box attack method based on input transformation includes one or more of a diversity input method, a translation invariance method, and a substitute model-based attack method; the black-box attack method based on proxy model intermediate layer features includes a feature importance-aware attack method; the black-box attack method based on proxy model optimization includes a query-based adaptive attack method.

[0009] Optionally, the target detection white-box attack method includes an AdvPatch white-box attack algorithm; the target detection black-box attack method includes a T-SEA black-box transfer attack algorithm.

[0010] Optionally, the same-distribution adversarial robustness evaluation result of the image processing model according to the same-distribution adversarial samples includes: obtaining an attack success rate or a model performance attenuation amplitude of the image processing model on the same-distribution adversarial samples as the same-distribution adversarial robustness evaluation result of the image processing model; wherein the attack success rate includes a white-box attack success rate and a black-box attack success rate, and the model performance attenuation amplitude includes an average precision mean drop amplitude and a recall rate drop amplitude.

[0011] Optionally, the image transformation operation includes one or more of the following: Gaussian noise, impulse noise, motion blur, brightness transformation, contrast transformation, JPEG compression, Gaussian blur, scaling transformation, rotation transformation, translation transformation, shear transformation, color dithering, sharpening, fogging effect, and elastic deformation; when the distribution transfer samples are generated according to the image samples using the image transformation operation, the same image transformation operation is used to generate distribution transfer samples with a preset number of intensity levels.

[0012] Optionally, the distribution transfer adversarial robustness evaluation result of the image processing model according to the distribution transfer samples includes: obtaining a difference between prediction accuracies of the image processing model on the image samples and the distribution transfer samples as the distribution transfer adversarial robustness evaluation result of the image processing model.

[0013] In a second aspect, the present application provides an image processing model adversarial robustness evaluation system, comprising: a data acquisition module configured to acquire an image processing model and image samples; an algorithm acquisition module configured to acquire an image processing type and an attack type of the image processing model, and acquire a corresponding adversarial sample generation algorithm from a preset adversarial sample generation algorithm library according to the image processing type and the attack type; a same-distribution adversarial module configured to generate same-distribution adversarial samples of the image processing model according to the image samples and in combination with the adversarial sample generation algorithm, and obtain a same-distribution adversarial robustness evaluation result of the image processing model according to the same-distribution adversarial samples; a distribution transfer adversarial module configured to generate distribution transfer samples by using an image transformation operation according to the image samples, and obtain a distribution transfer adversarial robustness evaluation result of the image processing model according to the distribution transfer samples; wherein the adversarial sample generation algorithm library comprises an image classification white-box attack method, an image classification black-box attack method, a target detection white-box attack method, and a target detection black-box attack method; the image classification white-box attack method comprises an iterative-based white-box attack method, an optimization-based white-box attack method, and an integration-based white-box attack method; and the image classification black-box attack method comprises an input transformation-based black-box attack method, an intermediate layer feature-based proxy model black-box attack method, and an optimization-based proxy model black-box attack method.

[0014] In a third aspect, the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the image processing model adversarial robustness evaluation method.

[0015] In a fourth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executable on a processor to implement the steps of the image processing model adversarial robustness evaluation method.

[0016] Compared with the prior art, the present application has the following beneficial effects:

[0017] The image processing model adversarial robustness evaluation method of the present application can accurately select corresponding algorithms from a diversified adversarial sample generation algorithm library by obtaining the image processing type and attack type of the image processing model, cover white-box and black-box attack methods of image classification and target detection, ensure that the generated adversarial samples meet the requirements of different image processing models and attack scenarios, and accurately evaluate the adversarial robustness under the same distribution; at the same time, the distribution migration samples are generated by image transformation, further evaluating the performance of the image processing model when facing out-of-distribution data, and the evaluation results of the same distribution and distribution migration can more comprehensively and deeply reveal the adversarial robustness level of the image processing model under different conditions, which can be applied to different data scale task scenarios, can realize more comprehensive and systematic adversarial robustness evaluation with lower operation complexity, and does not harm the generalization and fairness of the image processing model, providing more valuable reference for image processing model optimization and application, and ensuring the reliability, security and effectiveness of the image processing model when applied to the real world. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 The image processing model adversarial robustness evaluation method flowchart of the present application embodiment.

[0019] Figure 2 The image processing model adversarial robustness evaluation system structure block diagram of the present application embodiment. DETAILED DESCRIPTION

[0020] In order for those skilled in the art to better understand the present application scheme, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0021] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0022] The application will be described in further detail below with reference to the drawings:

[0023] Referring to Figure 1 In an embodiment of the present application, a method for evaluating the adversarial robustness of an image processing model is provided, which comprehensively evaluates the adversarial robustness of the image processing model from different angles.

[0024] Specifically, the method for evaluating the adversarial robustness of the image processing model comprises the following steps:

[0025] S1: obtaining an image processing model and an image sample.

[0026] S2: obtaining the image processing type and the attack type of the image processing model, and obtaining the corresponding adversarial sample generation algorithm from the preset adversarial sample generation algorithm library according to the image processing type and the attack type.

[0027] S3: generating the same-distribution adversarial sample according to the image sample and combining the adversarial sample generation algorithm, and obtaining the same-distribution adversarial robustness evaluation result of the image processing model according to the same-distribution adversarial sample.

[0028] S4: generating the distribution transfer sample by using the image transformation operation according to the image sample, and obtaining the distribution transfer adversarial robustness evaluation result of the image processing model according to the distribution transfer sample.

[0029] The adversarial sample generation algorithm library comprises an image classification white-box attack method, an image classification black-box attack method, a target detection white-box attack method and a target detection black-box attack method; the image classification white-box attack method comprises an iterative-based white-box attack method, an optimization-based white-box attack method and an integration-based white-box attack method; the image classification black-box attack method comprises an input transformation-based black-box attack method, an intermediate layer feature-based proxy model black-box attack method and an optimization-based proxy model black-box attack method.

[0030] The image processing model adversarial robustness evaluation method can accurately select corresponding algorithms from a diversified adversarial sample generation algorithm library by obtaining the image processing type and attack type of the image processing model, covers white-box and black-box attack methods of image classification and target detection, ensures that the generated adversarial samples meet the requirements of different image processing models and attack scenarios, thereby accurately evaluating the adversarial robustness under the same distribution; at the same time, the distribution migration samples are generated by image transformation, further evaluating the performance of the image processing model when facing out-of-distribution data, and the evaluation results of the same distribution and distribution migration can more comprehensively and deeply reveal the adversarial robustness level of the image processing model under different conditions, which can be applied to different data scale task scenarios, can realize more comprehensive and systematic adversarial robustness evaluation with lower operation complexity, and does not harm the generalization and fairness of the image processing model, provides a more valuable reference basis for image processing model optimization and application, and ensures the reliability, security and effectiveness of the image processing model applied to the real world.

[0031] In a possible implementation, when the same-distribution adversarial samples are generated according to the image samples and in combination with the adversarial sample generation algorithms, the same-distribution adversarial samples generated by different adversarial sample generation algorithms have the same number.

[0032] Explanatorily, when the same-distribution adversarial samples are generated, the same-distribution adversarial samples generated by different adversarial sample generation algorithms are designed to have the same number, first, to ensure that different adversarial sample generation algorithms are evaluated under the same sample amount, avoiding the interference of quantity difference on performance comparison (such as attack success rate and robustness). Secondly, to prevent some algorithms from generating sample-dominated data sets, maintain the consistency of adversarial sample diversity and original data distribution, and improve the stability of model defense training. Finally, to balance the calculation cost and efficiency, avoid resource waste caused by too many samples of complex algorithms, and avoid the influence of too few samples of simple algorithms on statistical significance.

[0033] In a possible implementation, the iterative-based white-box attack method includes one or more of a basic iteration method, a projected gradient descent method and a momentum iteration method; the optimization-based white-box attack method includes a Carlini and Wagner attack method; the integration-based white-box attack method includes an AutoAttack method; the input transformation-based black-box attack method includes one or more of a diversity input method, a translation invariance method and a substitute model-based attack method; the proxy model intermediate layer feature-based black-box attack method includes a feature importance perception attack method; and the proxy model optimization-based black-box attack method includes a query-based adaptive attack method.

[0034] Explanatory, the gradient ascent iteration formula is constructed by the iterative-based white-box attack method to realize the generation of the adversarial sample; the adversarial sample problem is modeled as an optimization problem with inequality constraints by the optimization-based white-box attack, and the Lagrange relaxation method is used for calculation and solution; the integrated attack fuses several different basic attack algorithms to realize integrated attack. Using multiple white-box attack methods helps to avoid the gradient masking problem and comprehensively evaluate the white-box robustness of the image processing model. The input transformation-based attack improves the transferability of the adversarial sample by introducing various image transformation operations in the attack process; the intermediate layer feature-based attack improves the transferability of the adversarial sample by extracting the invariant intermediate layer features of the proxy model; the proxy model optimization-based attack improves the gradient smoothness of the proxy model to improve the transferability of the adversarial sample. Using multiple black-box attack algorithms is conducive to more comprehensive and comprehensive evaluation of the black-box robustness of the intelligent model.

[0035] For white-box attacks on image processing models of image classification type, after the selection of the adversarial sample generation algorithm is completed, the established algorithm is directly applied to the gradient calculation of the image processing model to be tested to realize the generation of the adversarial sample, and then the obtained adversarial sample is input into the white-box image processing model to obtain the evaluation result. For black-box attacks on image processing models of image classification type, after the selection of the adversarial sample generation algorithm is completed, the generation of the local proxy model needs to be completed, and the local proxy model is used for gradient calculation to realize the generation of the adversarial sample, which is the same as the processing method of the white-box attack for adversarial robustness evaluation.

[0036] Explanatory, when the corresponding adversarial sample generation algorithm is obtained from the preset adversarial sample generation algorithm library, multiple adversarial sample generation algorithms are designed for the same image processing type and attack type. By using multiple adversarial sample generation algorithms to generate adversarial samples, the diversity and comprehensiveness of the adversarial samples can be ensured, the evaluation results can be prevented from being too one-sided, and relatively objective results of robustness evaluation can be provided.

[0037] Explanatorily, in the image classification white-box attack method, BIM (Basic Iterative Method) is an iterative-based white-box attack method that gradually generates adversarial samples by adding small perturbations in the gradient direction of the target model, suitable for quickly evaluating the adversarial robustness of the model; PGD (Projected Gradient Descent) is a powerful white-box attack method that iteratively optimizes the perturbation of adversarial samples in multiple directions and projects the perturbation constraint in each iteration to ensure that the perturbation is within the specified range, which can effectively test the robustness of the model; MIM (Momentum Iterative Method) is an iterative attack method combined with momentum mechanism, which uses momentum to accelerate the generation process of adversarial samples, improves the attack success rate, and reduces the distortion degree of adversarial samples; C&W (Carlini & Wagner) is an optimization-based white-box attack method that generates high-quality adversarial samples by solving optimization problems, which can mislead the model with minimal perturbation, and is commonly used to evaluate the strong robustness of the model; AutoAttack is a white-box attack method that integrates multiple attack algorithms, which automatically selects the optimal attack strategy combination (such as PGD, FAB, and SquareAttack, etc.) to achieve comprehensive attack on the model, and is used to comprehensively evaluate the robustness of the model.

[0038] Explanatorily, in the image classification black-box attack method, DIM (Diverse Inputs Method) is a black-box transfer attack method that generates adversarial samples by applying various image transformations (such as rotation, scaling, cropping, etc.) on input images to enhance the transferability of adversarial samples, which is suitable for attacks in a black-box scenario; TIM (Transform Invariant Method) is a black-box attack method based on input transformation, which introduces various image transformation operations during the attack process to make the generated adversarial samples have higher transferability to the target model, which is suitable for attacks in a black-box environment; FIA (Feature Invariant Attack) is a black-box attack method based on the intermediate features of the proxy model, which extracts the invariant intermediate features of the proxy model to generate adversarial samples and improve the transferability of adversarial samples between different models; SSA (Subspace Attack) is a black-box attack method based on subspace, which searches for the optimal adversarial perturbation in the specific subspace of the input image to generate adversarial samples that can effectively attack the target model, which is suitable for black-box scenarios; QAA (Query-based Attack Algorithm) is a query-based black-box attack method that optimizes the query strategy and perturbation generation process to reduce the number of queries required for attacks while improving the attack success rate of adversarial samples, which is suitable for efficient attacks on black-box models.

[0039] In a possible implementation, the target detection white-box attack method includes the AdvPatch white-box attack algorithm; and the target detection black-box attack method includes the T-SEA black-box transfer attack algorithm.

[0040] Explanatorily, for image processing models of the image processing type of target detection, white-box attacks and black-box attacks are designed. In terms of white-box attacks, the generation of adversarial samples mainly relies on the gradient information of the image processing model, including an AdvPatch attack algorithm; in terms of black-box attacks, transferable adversarial samples are mainly generated by black-box transfer attacks, including a T-SEA attack algorithm.

[0041] Specifically, the target detection white-box attack method selects the AdvPatch white-box attack algorithm to generate the adversarial sample. First, the input and automatic processing of the image processing model and the image sample are completed. The AdvPatch attack method pastes the adversarial patch on the object, minimizes the object appearance probability in the output of the target detector by using an optimizer to achieve the target disappearance attack, and enhances the robustness of the adversarial sample by rotating, scaling, adding noise, bright contrast and other transformations on the adversarial patch, and generates a printable adversarial patch in the physical world through the printable loss and the total variation loss. By using the AdvPatch algorithm to directly calculate the gradient of the image processing model, the generation of the adversarial sample is realized. The obtained adversarial sample is input into the image processing model to obtain the evaluation result. The target detection black-box attack method selects the T-SEA black-box transfer attack algorithm to generate the adversarial sample. The T-SEA attack method uses a series of self-integrated methods to generate adversarial samples to enhance the transferability of the adversarial samples on different image processing models, including limited data augmentation on the data level, linear combination of the output of the stacked layer and the identity of the residual block by using Shake Drop to generate a large number of variants of the white-box model, and avoiding the over-reliance of the adversarial patch on a certain area by using cutout on the adversarial patch level. The adversarial samples are generated on different models by the T-SEA attack, and the adversarial samples are transferred to different black-box models to evaluate the adversarial robustness of the image processing model.

[0042] In a possible implementation, the evaluation result of the image processing model according to the same-distribution adversarial sample includes: obtaining the attack success rate or the model performance attenuation amplitude of the image processing model on the same-distribution adversarial sample as the evaluation result of the same-distribution adversarial robustness of the image processing model; wherein the attack success rate includes a white-box attack success rate and a black-box attack success rate, and the model performance attenuation amplitude includes an average precision mean drop amplitude and a recall rate drop amplitude.

[0043] Illustratively, the attack success rate is the proportion of the image processing model that is missed or misdetected, that is, the proportion of the target that is correctly detected in the original image and disappears in the adversarial sample.

[0044] In addition, the perturbation constraint of the same-distribution adversarial sample is also considered, that is, the pixel difference (such as L2 or L ∞ norm) between the adversarial sample and the original sample, to ensure that the perturbation is imperceptible.

[0045] Illustratively, for an image classification model, the attack success rate is generally used as the evaluation result of the same-distribution adversarial robustness of the image processing model. For a target detection model, the model performance attenuation amplitude is generally used as the evaluation result of the same-distribution adversarial robustness of the image processing model.

[0046] In a possible implementation, the image transformation operation includes one or more of the following: Gaussian noise, impulse noise, motion blur, brightness transformation, contrast transformation, JPEG compression, Gaussian blur, scaling transformation, rotation transformation, translation transformation, shear transformation, color dithering, sharpening, fogging effect, and elastic deformation; and the distribution shift sample is generated by applying the image transformation operation to the image sample with a preset number of intensity levels.

[0047] Explanatorily, the distribution shift adversarial robustness evaluation mainly tests the generalization ability of the image processing model under distribution shift. Based on normal in-distribution image samples, out-of-distribution image samples, i.e., distribution shift samples, are generated by applying various image transformation operations to evaluate the out-of-distribution shift generalization ability of the image processing model.

[0048] Explanatorily, the input and automatic processing of the image processing model and the image sample are first completed, and then the shift test is performed. The distribution shift selects multiple image transformations to generate out-of-distribution data, including Gaussian noise, impulse noise, motion blur, brightness transformation, contrast transformation, JPEG compression, Gaussian blur, scaling transformation, rotation transformation, translation transformation, shear transformation, color dithering, sharpening, fogging effect, and elastic deformation. Each image transformation can be divided into 1-5 levels according to the intensity, and the higher the level, the higher the intensity of the image transformation.

[0049] In a possible implementation, the distribution shift adversarial robustness evaluation result of the image processing model obtained from the distribution shift sample includes: obtaining the difference between the prediction accuracy of the image processing model on the image sample and the prediction accuracy of the image processing model on the distribution shift sample as the distribution shift adversarial robustness evaluation result of the image processing model.

[0050] Explanatorily, the prediction accuracy of the image processing model on the distribution shift sample is obtained, and the difference between the prediction accuracy of the image processing model on the image sample and the prediction accuracy of the image processing model on the distribution shift sample is obtained as the distribution shift ability evaluation index of the image processing model, and as the distribution shift adversarial robustness evaluation result of the image processing model. The smaller the distribution shift ability evaluation index, the higher the distribution shift ability of the image processing model.

[0051] Exemplarily, six indexes of white-box attack success rate, black-box attack success rate, perturbation constraint, perturbation quality, attack iteration number, and attack running time overhead are designed.

[0052] For the image classification model, the image classification model is adjusted based on the adversarial robustness evaluation result to achieve a white-box attack success rate of not less than 98% and a black-box attack success rate of not less than 90% on the ImageNet subset. Among them, the perturbation constraint is to limit the pixel change range (such as L ∞≤ 16 / 255).

[0053] For the target detection model, the target detection model is adjusted based on the adversarial robustness evaluation result to reduce the average precision mean of the white-box attack on the Inria Person dataset by not less than 0.75, and the average precision mean of the black-box attack by not less than 0.4. Wherein, the perturbation constraint is to limit the pixel change range (such as L ∞ ≤ 16 / 255). Wherein, the average precision mean of the white-box attack directly measures the sensitivity of the detection model to gradient attack, and reflects the defense ability of the model to the patch, the average precision mean of the black-box attack evaluates the cross-model migration ability of the adversarial patch, and monitors the common security defects between models.

[0054] The image processing model adversarial robustness evaluation method of the application establishes a complete adversarial robustness quantitative evaluation system for image classification and target detection tasks respectively, innovatively combines the core indicators to form a multi-dimensional evaluation framework, and sets different evaluation standards according to the characteristics of different tasks, which constitutes a systematic, quantifiable and practical adversarial robustness evaluation scheme.

[0055] The following is an embodiment of the device of the application, which can be used to execute the method embodiment of the application. For details not disclosed in the device embodiment, please refer to the method embodiment of the application.

[0056] Referring to Figure 2 In another embodiment of the application, an image processing model adversarial robustness evaluation system is provided, which can be used to implement the image processing model adversarial robustness evaluation method described above. Specifically, the image processing model adversarial robustness evaluation system comprises a data acquisition module, an algorithm acquisition module, a same distribution adversarial module and a distribution migration adversarial module.

[0057] The data acquisition module is configured to acquire an image processing model and an image sample; the algorithm acquisition module is configured to acquire an image processing type and an attack type of the image processing model, and acquire a corresponding adversarial sample generation algorithm from a preset adversarial sample generation algorithm library according to the image processing type and the attack type; the same-distribution adversarial module is configured to generate a same-distribution adversarial sample of the image processing model according to the image sample and in combination with the adversarial sample generation algorithm, and obtain a same-distribution adversarial robustness evaluation result of the image processing model according to the same-distribution adversarial sample; and the distribution migration adversarial module is configured to generate a distribution migration sample by using an image transformation operation according to the image sample, and obtain a distribution migration adversarial robustness evaluation result of the image processing model according to the distribution migration sample. The adversarial sample generation algorithm library includes an image classification white-box attack method, an image classification black-box attack method, a target detection white-box attack method and a target detection black-box attack method; the image classification white-box attack method includes an iterative-based white-box attack method, an optimization-based white-box attack method and an integration-based white-box attack method; and the image classification black-box attack method includes an input transformation-based black-box attack method, an intermediate layer feature-based black-box attack method of a proxy model and an optimization-based black-box attack method of a proxy model.

[0058] For example, the data acquisition module defines a standard model and data interface, realizes reading, storage, preprocessing of the image processing model and definition of a training rule, supports two deep learning frameworks of PyTorch and TensorFlow, supports data formats of VOC and COCO, provides a conversion script between image samples, and supports integration of a plurality of adversarial sample generation algorithms and integration of an evaluation index plug-in.

[0059] All related contents of the steps involved in the foregoing embodiment of the image processing model adversarial robustness evaluation method can be cited to the function description of the function modules corresponding to the image processing model adversarial robustness evaluation system in the embodiment of the present application, and will not be repeated here.

[0060] The division of the modules in the embodiment of the present application is illustrative, and is only a logical function division. In actual implementation, another division mode can be used. In addition, the function modules in each embodiment of the present application can be integrated in one processor, or can be physically separated, or two or more modules can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of a software function module.

[0061] In still another embodiment of the present application, a computer device is provided, which comprises a processor and a memory, the memory being configured to store a computer program, the computer program comprising program instructions, and the processor being configured to execute the program instructions stored in the computer storage medium. The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, etc., which are the computing core and control core of the terminal, and are suitable for implementing one or more instructions, and are particularly suitable for loading and executing one or more instructions in the computer storage medium to implement a corresponding method flow or a corresponding function; the processor in the embodiments of the present application can be used for the operation of the image processing model adversarial robustness evaluation method.

[0062] In still another embodiment of the present application, the present application further provides a storage medium, specifically a computer readable storage medium (Memory), which is a memory device in a computer device, and is configured to store programs and data. It can be understood that the computer readable storage medium herein can include an internal storage medium in the computer device, and of course can also include an expansion storage medium supported by the computer device. The computer readable storage medium provides a storage space, which stores an operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer readable storage medium herein can be a high-speed RAM memory, or a non-volatile memory such as at least one disk memory. One or more instructions stored in the computer readable storage medium can be loaded and executed by the processor to implement the corresponding steps of the image processing model adversarial robustness evaluation method in the above embodiments.

[0063] Those skilled in the art will appreciate that embodiments of the application can be devised for a method, a system, or a computer program product. Accordingly, the present application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0064] The present application is described in reference to the flowchart and / or block diagrams of the method, apparatus (system) and computer program product according to embodiments of the application. It will be understood that each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing device or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0065] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0066] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0067] Finally, it should be noted that the above-mentioned embodiments are merely intended for describing the technical solutions of the present application, but not for limiting it. Although the present application is described in detail with reference to the above embodiments, those skilled in the field should understand that the specific embodiments of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and any modification or equivalent replacement without departing from the spirit and scope of the present application should be covered in the protection scope of the claims of the present application.

Claims

1. A method for evaluating the adversarial robustness of an image processing model, characterized in that, include: Acquire image processing models and image samples; Obtain the image processing type and attack type of the image processing model, and retrieve the corresponding adversarial sample generation algorithm from the preset adversarial sample generation algorithm library based on the image processing type and attack type; Based on image samples and adversarial sample generation algorithms, generate identically distributed adversarial samples, and obtain the identically distributed adversarial robustness evaluation results of the image processing model based on the identically distributed adversarial samples. Based on image samples, image transformation operations are used to generate distribution transfer samples, and the distribution transfer adversarial robustness evaluation results of the image processing model are obtained based on the distribution transfer samples. The adversarial example generation algorithm library includes white-box attack methods for image classification, black-box attack methods for image classification, white-box attack methods for object detection, and black-box attack methods for object detection. The white-box attack methods for image classification include iterative white-box attack methods, optimization-based white-box attack methods, and ensemble-based white-box attack methods. The black-box attack methods for image classification include black-box attack methods based on input transformation, black-box attack methods based on intermediate layer features of surrogate models, and black-box attack methods based on surrogate model optimization.

2. The image processing model adversarial robustness evaluation method according to claim 1, characterized in that, When generating identically distributed adversarial samples based on image samples and adversarial sample generation algorithms, the number of identically distributed adversarial samples generated by different adversarial sample generation algorithms is the same.

3. The image processing model adversarial robustness evaluation method according to claim 1, characterized in that, The iterative white-box attack methods include one or more of the basic iterative method, the projected gradient descent method, and the momentum iterative method; the optimization-based white-box attack methods include the Carrinini and Wagner attack methods; the ensemble-based white-box attack methods include the AutoAttack method; and the input transformation-based black-box attack methods include one or more of the diverse input methods, the translation invariance method, and the alternative model-based attack methods. Black-box attack methods based on the intermediate layer features of the proxy model include feature importance-aware attacks; Black-box attack methods based on proxy model optimization include query-based adaptive attack methods.

4. The image processing model adversarial robustness evaluation method according to claim 1, characterized in that, The target detection white-box attack method includes the AdvPatch white-box attack algorithm; the target detection black-box attack method includes the T-SEA black-box migration attack algorithm.

5. The image processing model adversarial robustness evaluation method according to claim 1, characterized in that, The evaluation results of the image processing model's adversarial robustness obtained from the identically distributed adversarial examples include: Obtain the attack success rate or performance degradation of the image processing model on the same-distribution adversarial examples, as the evaluation result of the image processing model's same-distribution adversarial robustness. The attack success rate includes the white-box attack success rate and the black-box attack success rate, and the model performance degradation includes the decrease in average precision and the decrease in recall.

6. The image processing model adversarial robustness evaluation method according to claim 1, characterized in that, The image transformation operations include one or more of the following: Gaussian noise, impulse noise, motion blur, brightness transformation, contrast transformation, JPEG compression, Gaussian blur, scaling transformation, rotation transformation, translation transformation, shearing transformation, color dithering, sharpening, fogging effect, and elastic deformation; When generating distribution migration samples using image transformation operations based on image samples, the same image transformation operation generates distribution migration samples using a preset number of intensity levels.

7. The image processing model adversarial robustness evaluation method according to claim 1, characterized in that, The evaluation results of the distribution transfer robustness of the image processing model obtained from the distribution transfer samples include: The difference in prediction accuracy of the image processing model on image samples and distribution-transferred samples is used as the evaluation result of the distribution-transfer robustness of the image processing model.

8. A system for evaluating the adversarial robustness of an image processing model, characterized in that, include: The data acquisition module is used to acquire image processing models and image samples; The algorithm acquisition module is used to acquire the image processing type and attack type of the image processing model, and to acquire the corresponding adversarial sample generation algorithm from the preset adversarial sample generation algorithm library according to the image processing type and attack type. The same-distribution adversarial module is used to generate same-distribution adversarial samples for the image processing model based on image samples and in combination with adversarial sample generation algorithms, and to obtain the same-distribution adversarial robustness evaluation results of the image processing model based on the same-distribution adversarial samples. The distributed migration adversarial module is used to generate distributed migration samples by performing image transformation operations on image samples, and to obtain the distributed migration adversarial robustness evaluation results of the image processing model based on the distributed migration samples. The adversarial example generation algorithm library includes white-box attack methods for image classification, black-box attack methods for image classification, white-box attack methods for object detection, and black-box attack methods for object detection. The white-box attack methods for image classification include iterative white-box attack methods, optimization-based white-box attack methods, and ensemble-based white-box attack methods. The black-box attack methods for image classification include black-box attack methods based on input transformation, black-box attack methods based on intermediate layer features of surrogate models, and black-box attack methods based on surrogate model optimization.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the image processing model adversarial robustness evaluation method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the image processing model adversarial robustness evaluation method as described in any one of claims 1 to 7.

Images