Computed imaging model robustness testing method and apparatus

Abstract

The application relates to the technical field of artificial intelligence security, and provides a method and device for testing the robustness of a calculation imaging model. The preprocessed data is segmented to obtain a target region mask, and the disturbance is limited to act on the target region. The difference between the reconstruction result of the calculation imaging model for the adversarial sample and the adversarial sample is calculated by using an MSE loss function, so that the reconstruction ability of the calculation imaging model for the adversarial sample is completely disabled, the attack target is more accurate, and the loss calculation is more suitable for the task scenario. The adversarial disturbance is optimized by using an ADAM optimizer, and the advantages of the momentum method and the adaptive learning rate are used to optimize the high-dimensional adversarial disturbance. The optimized adversarial disturbance is combined with the target region mask to generate an optimized adversarial sample, so as to calculate the robustness of the calculation imaging model. Through the processes of initializing the disturbance, constructing the adversarial sample and optimizing the disturbance, it is ensured that the generated adversarial sample is an adversarial sample with maximum attack strength, and the robustness of the model can be accurately measured.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence security technology, and in particular to a method and apparatus for testing the robustness of computational imaging models. Background Technology

[0002] In recent years, computational imaging, deeply empowered by artificial intelligence, has further disrupted traditional imaging systems, achieving significant application progress in multiple fields such as mobile phone photography, optical remote sensing, and autonomous driving. However, existing research mostly focuses on improving image reconstruction quality under ideal conditions, neglecting its vulnerability in complex application scenarios. This knowledge gap seriously affects the reliability of this technology in practical applications.

[0003] Currently, adversarial examples are an important means of testing the robustness of models in the field of AI security, and have been validated on multiple computer vision tasks, including classification and object detection. However, existing adversarial example generation methods do not consider the characteristics of computational imaging tasks, and have the following shortcomings:

[0004] Computational imaging aims to reconstruct signals in a high-dimensional continuous space, making it impossible to directly apply existing adversarial losses. In classification tasks, adversarial examples typically change the model's output category by minimizing the classification loss (e.g., cross-entropy), which is defined in a discrete label space. However, in computational imaging tasks, there is no explicit discrete decision boundary, and its optimization objective is the accurate recovery of continuous variables rather than the discrimination of discrete semantic labels. Therefore, existing adversarial losses cannot be directly applied to the reconstruction space.

[0005] Computational imaging tasks focus on the reconstruction of specific targets, and existing methods typically perturb the entire target area. In computational imaging, the main target of the input data is usually concentrated in a specific region, while the remaining regions usually constitute background information. However, existing adversarial perturbation methods often employ a global perturbation strategy, that is, introducing uniform perturbation across the entire input domain or optical field to maximize the overall error. Global perturbation not only incurs unnecessary computational overhead but may also lead to meaningless noise amplification, making it difficult to target key regions.

[0006] Therefore, a technical solution is urgently needed to solve the above problems. Summary of the Invention

[0007] Therefore, it is necessary to provide a method and apparatus for testing the robustness of computational imaging models to address the aforementioned technical problems.

[0008] A method for robustness testing of computational imaging models includes the following steps:

[0009] Acquire the data to be processed and preprocess it.

[0010] The preprocessed data is segmented to obtain the target region mask;

[0011] Initialize adversarial perturbations and generate adversarial examples by combining them with the target region mask;

[0012] The difference between the reconstruction results of the computational imaging model for adversarial examples and those for adversarial examples is calculated using the MSE loss function, and the adversarial perturbation is optimized using the ADAM optimizer based on the MSE loss function.

[0013] Optimized adversarial samples are generated by combining optimized adversarial perturbations with target region masks, and the robustness of the computational imaging model is calculated based on the optimized adversarial samples.

[0014] In one embodiment, the data to be processed is acquired and preprocessed, including:

[0015] Obtain the data to be processed and adjust its size to 256×256.

[0016] In one embodiment, acquiring the data to be processed and preprocessing the data to be processed further includes:

[0017] If the data to be processed is an RGB color image, then convert the data to grayscale image format:

[0018] ;

[0019] in, Data to be processed X The corresponding grayscale image; R Data to be processed X of R Channel value; G Data to be processed X of G Channel value; B Data to be processed X of B Channel value.

[0020] In one embodiment, the preprocessed data is segmented to obtain a target region mask, including:

[0021] The preprocessed data is segmented to obtain the target region mask:

[0022] ;

[0023] in, M For the target region mask; This is the preprocessed data; P Enter prompt words for the user; For mask decoder; For image encoders; This is for the encoder.

[0024] In one embodiment, segmenting the preprocessed data to obtain a target region mask further includes:

[0025] Binarize the target region mask:

[0026] ;

[0027] in, target area mask Location The value at; The threshold value is used.

[0028] In one embodiment, initializing adversarial perturbations and generating adversarial samples in conjunction with a target region mask includes:

[0029] Gaussian noise initialization is used to combat disturbances. And generate adversarial examples by combining the target region mask:

[0030] ;

[0031] in, For adversarial examples; For element-wise multiplication; This is the preprocessed data; M For the target region mask; To counteract disturbances.

[0032] In one embodiment, the difference between the reconstruction result of the computational imaging model for adversarial examples and the adversarial examples is calculated using the MSE loss function, and the adversarial perturbation is optimized using the ADAM optimizer based on the MSE loss function, including:

[0033] The difference between the reconstruction results of the computational imaging model for adversarial examples and those for adversarial examples was calculated using the MSE loss function:

[0034] ;

[0035] in, The MSE loss function; For adversarial examples; For computational imaging models; To calculate the parameters of the imaging model;

[0036] Based on the MSE loss function, the ADAM optimizer is used to optimize the anti-perturbation mechanism.

[0037] In one embodiment, based on the MSE loss function, the ADAM optimizer is used to optimize against perturbations, including:

[0038] initialization , , ,in, t This represents the number of iterations. m It is a first-order moment; v To estimate the second moment;

[0039] conduct t During the next iteration:

[0040] ;

[0041] ;

[0042] ;

[0043] in, For the first t The gradient of the next iteration; For the first t The first moment of the next iteration; For the first t -1 iterations of the first moment; For the first t The estimated second moment in the next iteration; For the first t The estimated second moment after -1 iterations; For the first t -1 iterations of adversarial perturbation; To counteract the disturbance, partial derivatives are required; The momentum decay coefficient; The attenuation coefficient of the squared gradient;

[0044] Correct the first-order moments and estimated second-order moments after iteration:

[0045] ;

[0046] ;

[0047] in, For the corrected first t The first moment of the next iteration; For the corrected first t The estimated second moment in the next iteration; For the first t The momentum decay coefficient of the next iteration; For the first t The decay coefficient of the squared gradient in the next iteration;

[0048] Update counter-perturbation:

[0049] ;

[0050] in, For the first t The next iteration's counter-perturbation; The preset learning rate; To prevent division by zero of constants.

[0051] In one embodiment, optimized adversarial examples are generated by combining optimized adversarial perturbations with target region masks, and the robustness of the computational imaging model is calculated based on the optimized adversarial examples, including:

[0052] Optimized adversarial examples are generated by combining optimized adversarial perturbations with target region masks;

[0053] The optimized adversarial examples are input into the computational imaging model, and the peak signal-to-noise ratio and structural similarity index between the reconstruction results of the adversarial examples and the input optimized adversarial examples are analyzed.

[0054] The data to be processed is input into a computational imaging model, and the peak signal-to-noise ratio and structural similarity index between the reconstruction results of the computational imaging model and the input data to be processed are analyzed.

[0055] Based on the analysis results of the input optimized adversarial examples and the data to be processed, the robustness of the computational imaging model to the optimized adversarial examples is calculated.

[0056] A computational imaging model robustness testing device, comprising:

[0057] The preprocessing module is used to acquire the data to be processed and to preprocess the data.

[0058] The mask module is used to segment the preprocessed data to obtain the target region mask;

[0059] The adversarial example generation module is used to initialize adversarial perturbations and generate adversarial examples by combining them with the target region mask;

[0060] The adversarial perturbation optimization module is used to calculate the difference between the reconstruction results of the computational imaging model and the adversarial sample using the MSE loss function, and to optimize the adversarial perturbation using the ADAM optimizer based on the MSE loss function.

[0061] The robustness calculation module is used to generate optimized adversarial examples by combining optimized adversarial perturbations with target region masks, and to calculate the robustness of the imaging model based on the optimized adversarial examples.

[0062] The aforementioned computational imaging model robustness testing method and apparatus segment preprocessed data to obtain a target region mask, thereby limiting the perturbation to only affect the target region. The difference between the computational imaging model's reconstruction result of the adversarial example and the adversarial example itself is calculated using the MSE loss function, thus completely disabling the computational imaging model's ability to reconstruct adversarial examples, resulting in more accurate target attack and loss calculation more closely aligned with the task scenario. The adversarial perturbation is then optimized using the ADAM optimizer, leveraging its momentum method and adaptive learning rate advantages for optimizing high-dimensional adversarial perturbations. Finally, the optimized adversarial perturbation is combined with the target region mask to generate optimized adversarial examples, thereby calculating the robustness of the computational imaging model.

[0063] This invention ensures that the generated adversarial samples are adversarial samples with maximized attack strength through the process of initializing perturbation, constructing adversarial samples, and optimizing perturbation. This enables accurate measurement of the model's robustness and avoids misjudgment of the model's robustness due to insufficient perturbation strength. Attached Figure Description

[0064] Figure 1 This is a flowchart illustrating a method for testing the robustness of a computational imaging model in one embodiment.

[0065] Figure 2 This is a structural block diagram of a computational imaging model robustness testing device in one embodiment. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0067] In one embodiment, such as Figure 1 As shown, a robustness testing method for computational imaging models is provided, including the following steps:

[0068] Step 201: Obtain the data to be processed and preprocess the data.

[0069] It should be noted that the data to be processed is the input data of the computational imaging model, including but not limited to medical image data, remote sensing and satellite impact data, and daily visual imaging data.

[0070] Step 202: Segment the preprocessed data to obtain the target region mask.

[0071] Step 203: Initialize adversarial perturbations and generate adversarial samples by combining them with the target region mask.

[0072] Step 204: Calculate the difference between the reconstruction results of the imaging model and the adversarial sample using the MSE loss function, and optimize the adversarial perturbation using the ADAM optimizer based on the MSE loss function.

[0073] Step 205: Optimize adversarial samples by combining the optimized adversarial perturbation with the target region mask, and calculate the robustness of the imaging model based on the optimized adversarial samples.

[0074] In the aforementioned robustness testing method for computational imaging models, the preprocessed data is segmented to obtain a target region mask, thus limiting the perturbation to only the target region. The difference between the computational imaging model's reconstruction of adversarial examples and the actual adversarial examples is calculated using the MSE loss function, effectively rendering the computational imaging model's ability to reconstruct adversarial examples completely ineffective, resulting in more precise attack targets and loss calculations more closely aligned with the task scenario. The adversarial perturbation is then optimized using the ADAM optimizer, leveraging its momentum method and adaptive learning rate to optimize high-dimensional adversarial perturbations. The optimized adversarial perturbation is then combined with the target region mask to generate optimized adversarial examples, thereby calculating the robustness of the computational imaging model. This process of initializing perturbations, constructing adversarial examples, and optimizing perturbations ensures that the generated adversarial examples maximize attack strength, accurately measuring the model's robustness and avoiding misjudgments of model robustness due to insufficient perturbation strength.

[0075] In one embodiment, step 201 involves acquiring the data to be processed and preprocessing it, including:

[0076] Obtain the data to be processed and adjust its size to 256×256.

[0077] In this embodiment, the size of the data to be processed is adjusted so that the data meets the input requirements of the computational imaging model.

[0078] In one embodiment, step 201, obtaining the data to be processed and preprocessing the data to be processed, further includes:

[0079] If the data to be processed is an RGB color image, then convert the data to grayscale image format:

[0080] ;

[0081] in, Data to be processed X The corresponding grayscale image; R Data to be processed X of R Channel value; G Data to be processed X of G Channel value;B Data to be processed X of B Channel value.

[0082] In this embodiment, the data to be processed, which is an RGB color image, is converted into a grayscale image format to meet the input requirements of the computational imaging model.

[0083] In one embodiment, step 202, segmenting the preprocessed data to obtain a target region mask, includes:

[0084] The preprocessed data is segmented to obtain the target region mask:

[0085] ;

[0086] in, M For the target region mask; This is the preprocessed data; P Enter prompt words for the user; For mask decoder; For image encoders; This is for the encoder.

[0087] It should be noted that the segmentation of the preprocessed data was performed using the Segment Anything Model (SAM).

[0088] In this embodiment, the foreground and background of the preprocessed data are extracted by segmentation, and then the target region mask is obtained, so that the perturbation only acts on the target region.

[0089] In one embodiment, step 202, which involves segmenting the preprocessed data to obtain a target region mask, further includes:

[0090] Binarize the target region mask:

[0091] ;

[0092] in, target area mask Location The value at; The threshold value is used.

[0093] In this embodiment, by binarizing the target area mask, the strength of the adversarial perturbation is made consistent within the target area, ensuring that the perturbation energy is concentrated on the core area and maximizing the impact of the attack on the imaging model.

[0094] In one embodiment, step 203, initializing adversarial perturbations and generating adversarial samples in conjunction with the target region mask, includes:

[0095] Gaussian noise initialization is used to combat disturbances. And generate adversarial examples by combining the target region mask:

[0096] ;

[0097] in, For adversarial examples; For element-wise multiplication; This is the preprocessed data; M For the target region mask; To counteract disturbances.

[0098] In one embodiment, step 204 involves calculating the difference between the reconstruction result of the imaging model for the adversarial example and the adversarial example using the MSE loss function, and optimizing the adversarial perturbation using the ADAM optimizer based on the MSE loss function, including:

[0099] The difference between the reconstruction results of the computational imaging model for adversarial examples and those for adversarial examples was calculated using the MSE loss function:

[0100] ;

[0101] in, The MSE loss function; For adversarial examples; For computational imaging models; To calculate the parameters of the imaging model;

[0102] Based on the MSE loss function, the ADAM optimizer is used to optimize the anti-perturbation mechanism.

[0103] In one embodiment, based on the MSE loss function, the ADAM optimizer is used to optimize against perturbations, including:

[0104] initialization , , ,in, t This represents the number of iterations. m It is a first-order moment; v To estimate the second moment;

[0105] conduct t During the next iteration:

[0106] ;

[0107] ;

[0108] ;

[0109] in, For the first t The gradient of the next iteration; For the first t The first moment of the next iteration; For the first t -1 iterations of the first moment; For the first t The estimated second moment in the next iteration; For the first t The estimated second moment after -1 iterations; For the first t -1 iterations of adversarial perturbation; To counteract the disturbance, partial derivatives are required; The momentum decay coefficient; The attenuation coefficient of the squared gradient;

[0110] Correct the first-order moments and estimated second-order moments after iteration:

[0111] ;

[0112] ;

[0113] in, For the corrected first t The first moment of the next iteration; For the corrected first t The estimated second moment in the next iteration; For the first t The momentum decay coefficient of the next iteration; For the first t The decay coefficient of the squared gradient in the next iteration;

[0114] Update counter-perturbation:

[0115] ;

[0116] in, For the first t The next iteration's counter-perturbation; The preset learning rate; To prevent division by zero of constants.

[0117] In this embodiment, the deviation caused by initialization is avoided by correcting the iterated first moment and the estimated second moment.

[0118] In one embodiment, step 205, generating optimized adversarial examples by combining the optimized adversarial perturbation with the target region mask, and calculating the robustness of the imaging model based on the optimized adversarial examples, includes:

[0119] Optimized adversarial examples are generated by combining optimized adversarial perturbations with target region masks;

[0120] The optimized adversarial examples are input into the computational imaging model, and the peak signal-to-noise ratio and structural similarity index between the reconstruction results of the adversarial examples and the input optimized adversarial examples are analyzed.

[0121] The data to be processed is input into a computational imaging model, and the peak signal-to-noise ratio and structural similarity index between the reconstruction results of the computational imaging model and the input data to be processed are analyzed.

[0122] Based on the analysis results of the input optimized adversarial examples and the data to be processed, the robustness of the computational imaging model to the optimized adversarial examples is calculated.

[0123] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0124] To verify the effectiveness of the present invention, robustness tests were conducted on the video compression imaging model and the single-pixel imaging model.

[0125] Robustness evaluation of video compressed imaging models: Three video compressed sensing imaging models were tested on six benchmark grayscale datasets (Kobe, Traffic, Runner, Drop, Crash, and Aerial, size 256×256×8) and a self-constructed large-scale standardized video dataset. These included end-to-end compressed sensing reconstruction networks such as BIRNAT and EfficientSCI++, and a depth-unfolded iterative compressed sensing reconstruction network, ELP-Unfolding. Table 1 shows the comparison of benchmark grayscale dataset metrics, demonstrating the comparison results of PSNR (Peak Signal-to-Noise Ratio) and SSIM (Structural Similarity Index) metrics for the three video compressed sensing imaging models (BIRNAT, EfficientSCI++, and ELP-Unfolding) on ​​adversarial examples and clean samples generated in this invention. The adversarial examples generated by this invention on the benchmark grayscale dataset can reduce the PSNR value of the BIRNAT model by 59.2% and the SSIM value by 42.7%; reduce the PSNR value of the EfficientSCI++ model by 63.8% and the SSIM value by 42.8%; and reduce the PSNR value of the ELP-Unfolding model by 68.4% and the SSIM value by 44.3%. As shown in Table 2, on a large-scale normalized dataset, the adversarial examples generated by this attack algorithm can reduce the PSNR value of the BIRNAT model by 49.4% and the SSIM value by 22.1%; reduce the PSNR value of the EfficientSCI++ model by 49.4% and the SSIM value by 22.0%; and reduce the PSNR value of the ELP-Unfolding model by 54.9% and the SSIM value by 22.5%. This fully demonstrates that the adversarial examples generated by this invention can interfere with video compression sensing imaging models, revealing the vulnerability of the models. VSCI (Video Snapshot Compression Imaging) is a video snapshot compression imaging technology.

[0126] Table 1 Comparison of benchmark grayscale dataset metrics

[0127]

[0128] Table 2 Comparison of metrics for large-scale standardized datasets

[0129]

[0130] Robustness evaluation of single-pixel imaging models: Twelve representative categories were selected from the ImageNet-1K dataset (as shown in Table 3). For each category, 40-50 sample images were randomly selected, resulting in a dataset of 500 experimental samples. The adversarial robustness of three single-pixel imaging models was tested: the end-to-end network MRCCSNet, the deep unfolded network MADUN, and OCTUBF. As shown in Table 3, the adversarial examples designed in this invention can significantly affect the reconstruction performance of existing computational imaging models, effectively revealing the vulnerability of existing models in complex adversarial environments.

[0131] Table 3 Comparison of Single-Pixel Imaging Dataset Indicators

[0132]

[0133] In one embodiment, such as Figure 2 As shown, a robustness testing device for computational imaging models is provided, comprising:

[0134] The preprocessing module 901 is used to acquire the data to be processed and to preprocess the data.

[0135] The mask module 902 is used to segment the preprocessed data to obtain the target region mask.

[0136] The adversarial sample generation module 903 is used to initialize adversarial perturbations and generate adversarial samples in combination with the target region mask.

[0137] The adversarial perturbation optimization module 904 is used to calculate the difference between the reconstruction result of the computational imaging model on the adversarial sample and the adversarial sample using the MSE loss function, and to optimize the adversarial perturbation using the ADAM optimizer based on the MSE loss function.

[0138] The robustness calculation module 905 is used to generate optimized adversarial samples by combining optimized adversarial perturbations with target region masks, and to calculate the robustness of the imaging model based on the optimized adversarial samples.

[0139] Specific limitations regarding the computational imaging model robustness testing apparatus can be found in the limitations of the computational imaging model robustness testing method described above, and will not be repeated here. Each module in the aforementioned computational imaging model robustness testing apparatus can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0140] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0141] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for testing the robustness of a computational imaging model, characterized in that, Includes the following steps: Acquire the data to be processed and preprocess it. The preprocessed data is segmented to obtain the target region mask; Initialize adversarial perturbations and generate adversarial examples by combining them with the target region mask; The difference between the reconstruction results of the computational imaging model based on adversarial examples and those based on the adversarial examples is calculated using the MSE loss function. Based on the MSE loss function, the ADAM optimizer is used to optimize the adversarial perturbations, including: The difference between the reconstruction results of the computational imaging model for adversarial examples and those for adversarial examples was calculated using the MSE loss function: wherein, is the MSE loss function; is the adversarial sample; is the computed imaging model; is the parameter of the computed imaging model; Based on the MSE loss function, the ADAM optimizer is used to optimize adversarial perturbations, including: Initialization , , wherein, t is the number of iterations; m is the first moment; v is the estimated second moment; Proceeding t At the next iteration: in, For the first t The gradient of the next iteration; For the first t The first moment of the next iteration; For the first t -1 iterations of the first moment; For the first t The estimated second moment in the next iteration; For the first t The estimated second moment after -1 iterations; For the first t -1 iterations of adversarial perturbation; To counteract the disturbance, partial derivatives are required; The momentum decay coefficient; The attenuation coefficient of the squared gradient; Correct the first-order moments and estimated second-order moments after iteration: in, For the corrected first t The first moment of the next iteration; For the corrected first t The estimated second moment in the next iteration; For the first t The momentum decay coefficient of the next iteration; For the first t The decay coefficient of the squared gradient in the next iteration; Update counter-perturbation: wherein, is the t adversarial perturbation of the is a preset learning rate; is a constant to prevent division by zero; Optimized adversarial samples are generated by combining optimized adversarial perturbations with target region masks, and the robustness of the computational imaging model is calculated based on the optimized adversarial samples.

2. The method of claim 1, wherein, Acquire the data to be processed and preprocess it, including: Obtain the data to be processed and adjust its size to 256×256.

3. The robustness testing method for computational imaging models according to claim 2, characterized in that, Acquiring the data to be processed and preprocessing it also includes: If the data to be processed is an RGB color image, then convert the data to grayscale image format: in, Data to be processed X The corresponding grayscale image; R Data to be processed X of R Channel value; G Data to be processed X of G Channel value; B Data to be processed X of B Channel value.

4. The method of claim 1, wherein, The preprocessed data is segmented to obtain the target region mask, including: The preprocessed data is segmented to obtain the target region mask: wherein, M is a target region mask; is pre-processed data; P is a user input cue word; is a mask decoder; is an image encoder; is a cue encoder.

5. The method of claim 4, wherein, The preprocessed data is segmented to obtain the target region mask, and the process also includes: Binarize the target region mask: wherein, is a target region mask position value at the position; is a threshold value.

6. The method of claim 1, wherein, Initialize adversarial perturbations and generate adversarial examples by combining them with the target region mask, including: Gaussian noise initialization is used to combat disturbances. And generate adversarial examples by combining the target region mask: in, For adversarial examples; For element-wise multiplication; This is the preprocessed data; M For the target region mask; To counteract disturbances.

7. The method of claim 1, wherein, Optimized adversarial examples are generated by combining optimized adversarial perturbations with target region masks, and the robustness of the imaging model is calculated based on the optimized adversarial examples, including: Optimized adversarial examples are generated by combining optimized adversarial perturbations with target region masks; The optimized adversarial examples are input into the computational imaging model, and the peak signal-to-noise ratio and structural similarity index between the reconstruction results of the adversarial examples and the input optimized adversarial examples are analyzed. The data to be processed is input into a computational imaging model, and the peak signal-to-noise ratio and structural similarity index between the reconstruction results of the computational imaging model and the input data to be processed are analyzed. Based on the analysis results of the input optimized adversarial examples and the data to be processed, the robustness of the computational imaging model to the optimized adversarial examples is calculated.

8. A computing imaging model robustness testing apparatus, characterized by, include: The preprocessing module is used to acquire the data to be processed and to preprocess the data. The mask module is used to segment the preprocessed data to obtain the target region mask; The adversarial example generation module is used to initialize adversarial perturbations and generate adversarial examples by combining them with the target region mask; The adversarial perturbation optimization module is used to calculate the difference between the reconstruction results of the computational imaging model and the adversarial samples using the MSE loss function, and to optimize the adversarial perturbation using the ADAM optimizer based on the MSE loss function, including: The difference between the reconstruction results of the computational imaging model for adversarial examples and those for adversarial examples was calculated using the MSE loss function: wherein, is the MSE loss function; is the adversarial sample; is the computed imaging model; is the parameter of the computed imaging model; Based on the MSE loss function, the ADAM optimizer is used to optimize adversarial perturbations, including: Initialization , , where, t is the number of iterations; m is the first moment; v is the estimated second moment; Proceeding t At the next iteration: in, For the first t The gradient of the next iteration; For the first t The first moment of the next iteration; For the first t -1 iterations of the first moment; For the first t The estimated second moment in the next iteration; For the first t The estimated second moment after -1 iterations; For the first t -1 iterations of adversarial perturbation; To counteract the disturbance, partial derivatives are required; The momentum decay coefficient; The attenuation coefficient of the squared gradient; Correct the first-order moments and estimated second-order moments after iteration: in, For the corrected first t The first moment of the next iteration; For the corrected first t The estimated second moment in the next iteration; For the first t The momentum decay coefficient of the next iteration; For the first t The decay coefficient of the squared gradient in the next iteration; Update counter-perturbation: wherein, is the t adversarial perturbation of the is a preset learning rate; is a constant to prevent division by zero; The robustness calculation module is used to generate optimized adversarial examples by combining optimized adversarial perturbations with target region masks, and to calculate the robustness of the imaging model based on the optimized adversarial examples.

Images