Filter updating method and device, equipment, medium and product

Abstract

The embodiment of the invention provides a filter updating method and device, equipment, a medium and a product, and relates to the technical field of artificial intelligence. According to the method, diversified mixed samples are generated through disturbance, an adversarial experience library of a filter is expanded, the ability of recognizing multiple attack modes is established in the initial stage, a robustness foundation is laid for coping with dynamic attacks, and then target domain scene data are introduced, so that the robustness of the filter is improved. The information divergence between a mixed sample and a target domain sample is calculated in real time, the environment change degree is accurately quantified, parameter updating is automatically triggered in a real environment, the limitation that a traditional method depends on static rules and fixed period updating is broken through, the rapid response and continuous defense capability to novel threats is achieved, and the method is suitable for popularization and application. And the updating efficiency of the filter is improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, medium and product for updating filters. Background Technology

[0002] Filter updates refer to the process of dynamically adjusting filter parameters based on real-time data to maintain their adversarial sample filtering capabilities. UAV vision systems face complex and ever-changing operating environments. To improve environmental adaptability, enabling filters to have an adaptive update mechanism to cope with dynamically changing environments is crucial for ensuring the safe and stable operation of UAVs in complex environments.

[0003] In existing technologies, newly acquired adversarial examples, target domain data, or real-time feedback information are typically used to calculate gradients in conjunction with loss functions, and filter parameters are adjusted through optimization algorithms such as gradient descent. Some methods employ model fine-tuning strategies, reusing the general low-level structure of pre-trained filters and fine-tuning high-level parameters for new scene data to adapt to changes in domain distribution, thereby enhancing the filtering capability of the filters.

[0004] However, existing technologies suffer from low filter update efficiency. They generally rely on preset static rules and fixed-period parameter adjustments, lacking real-time awareness of environmental changes and threat dynamics. This passive update mode struggles to adapt to rapidly evolving attack strategies in dynamic adversarial scenarios, leading to reduced filter update efficiency. Summary of the Invention

[0005] This application provides a filter replacement method, apparatus, device, medium, and product to solve the problem of low filter replacement efficiency in the prior art.

[0006] In a first aspect, embodiments of this application provide a method for updating a filter, comprising:

[0007] When traversing the target query, initial adversarial samples, effective perturbations, and multiple normal samples are obtained; wherein, the target query is any one of a preset set of multiple queries, the effective perturbation is a noise vector that satisfies multiple preset constraints, and the multiple normal samples refer to multiple undisturbed original samples obtained from a preset source domain.

[0008] The initial adversarial sample, the effective perturbation, and the multiple normal samples are mixed to obtain a mixed dataset; wherein the mixed dataset includes multiple mixed samples;

[0009] The label of the target hybrid sample is obtained, and when the label of the target hybrid sample is the same as the preset target label, the target hybrid sample is determined as the final adversarial sample; wherein, the target hybrid sample is any one of the plurality of hybrid samples, and the label of the target hybrid sample is used to indicate the category of the target hybrid sample;

[0010] In response to the completion of the multiple queries, a target filter and multiple target domain samples are obtained; wherein, the target filter refers to a filtering model that needs to be updated with parameters, and the multiple target domain samples are multiple undisturbed original samples obtained from a preset application scenario;

[0011] Calculate the information divergence between the plurality of mixed samples and the plurality of target domain samples; wherein the information divergence is used to represent the degree of difference between the plurality of mixed samples and the plurality of target domain samples;

[0012] Based on the information divergence, the multiple final adversarial samples, the multiple target domain samples, and the preset Euclidean norm, the target filter is periodically updated to obtain an updated target filter; wherein, the updated target filter is used to purify input samples in the application scenario to resist sample attacks.

[0013] Secondly, embodiments of this application provide a filter updating device, comprising:

[0014] The first acquisition module is used to acquire initial adversarial samples, effective perturbations, and multiple normal samples when traversing the target query; wherein, the target query is any one of a preset set of multiple queries, the effective perturbation is a noise vector that satisfies multiple preset constraints, and the multiple normal samples refer to multiple undisturbed original samples acquired from a preset source domain.

[0015] A mixing module is used to mix samples based on the initial adversarial sample, the effective perturbation, and the multiple normal samples to obtain a mixed dataset; wherein the mixed dataset includes multiple mixed samples;

[0016] A determination module is used to acquire the label of a target mixed sample, and when the label of the target mixed sample is the same as a preset target label, the target mixed sample is determined as the final adversarial sample; wherein, the target mixed sample is any one of the plurality of mixed samples, and the label of the target mixed sample is used to indicate the category of the target mixed sample;

[0017] The second acquisition module is used to acquire a target filter and multiple target domain samples in response to the completion of the multiple queries; wherein, the target filter refers to a filtering model that needs to be updated with parameters, and the multiple target domain samples are multiple undisturbed original samples obtained from a preset application scenario;

[0018] A calculation module is used to calculate the information divergence between the plurality of mixed samples and the plurality of target domain samples; wherein the information divergence is used to represent the degree of difference between the plurality of mixed samples and the plurality of target domain samples;

[0019] The update module is used to periodically update the parameters of the target filter based on the information divergence, the multiple final adversarial samples, the multiple target domain samples, and the preset Euclidean norm, to obtain the updated target filter; wherein, the updated target filter is used to purify the input samples in the application scenario to resist sample attacks.

[0020] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0021] The memory stores computer-executed instructions;

[0022] When the processor executes computer execution instructions stored in the memory, it is used to implement the filter update method as described in any of the first aspects.

[0023] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the filter update method as described in any of the first aspects.

[0024] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the filter update method as described in any of the first aspects.

[0025] This application provides a filter update method, apparatus, device, medium, and product. By generating diverse mixed samples through perturbation, it expands the filter's adversarial experience base, enabling it to establish the ability to identify multiple attack modes in the initial stage. This lays a robust foundation for dealing with dynamic attacks. By introducing target domain scene data, it calculates the information divergence between mixed samples and target domain samples in real time, accurately quantifies the degree of environmental change, and automatically triggers parameter updates in real environments. This breaks through the limitations of traditional methods that rely on static rules and fixed-cycle updates, achieving rapid response and continuous defense capabilities against new threats, and improving the filter update efficiency. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0027] Figure 1 A schematic diagram illustrating an application scenario of the filter update method provided in this application embodiment;

[0028] Figure 2 Flowchart of the filter update method provided in the embodiments of this application Figure 1 ;

[0029] Figure 3 A flowchart illustrating the filter generation process provided in this application embodiment;

[0030] Figure 4 A flowchart of the offline preparation stage provided for embodiments of this application;

[0031] Figure 5 A flowchart of the online inference stage provided in this application embodiment;

[0032] Figure 6 Flowchart of the filter update method provided in the embodiments of this application Figure 2 ;

[0033] Figure 7 A schematic diagram of the structure of the filter updating device provided in the embodiments of this application;

[0034] Figure 8 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application.

[0035] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0036] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0037] In the embodiments of this application, the terms "first" and "second" are used to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply difference. It should be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner. In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more.

[0038] It should be noted that the phrase "at...time" in the embodiments of this application can refer to the instant at which a certain situation occurs, or to a period of time after the occurrence of a certain situation. The embodiments of this application do not specifically limit this. In addition, the filter updating method, apparatus, device, medium, and product provided in the embodiments of this application are only examples. A filter updating method, apparatus, device, medium, and product may also include more or less content.

[0039] To facilitate a clear description of the technical solutions in the embodiments of this application, some terms and technologies involved in the embodiments of this application will be briefly introduced below:

[0040] Source domain: refers to the data distribution consisting of labeled datasets collected under controlled or pre-defined conditions during the initial training of the UAV vision model in the development phase. This data typically covers the main scenarios, target categories, and environmental conditions that the model is expected to encounter, and forms the data foundation for the model to learn and establish its basic recognition capabilities.

[0041] Adversarial examples are carefully crafted input data created by adding subtle perturbations that are imperceptible to the human eye to normal samples. These perturbations are not random noise, but are specifically designed to target the weaknesses of the target model, with the aim of misleading the model and causing it to make completely incorrect judgments or predictions about the input.

[0042] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0043] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0044] To clearly understand the technical solution of this application, the solutions of existing technologies will first be described in detail. UAV vision systems face complex and ever-changing operating environments. To improve environmental adaptability, enabling filters to have an adaptive update mechanism to cope with dynamically changing environments is particularly important for ensuring the safe and stable operation of UAVs in complex environments.

[0045] In existing technologies, newly acquired adversarial examples, target domain data, or real-time feedback information are typically used to calculate gradients using a loss function, and filter parameters are adjusted through optimization algorithms such as gradient descent. However, existing technologies generally rely on pre-set static rules and fixed-period parameter adjustments, lacking real-time awareness of environmental changes and threat dynamics. This passive update mode struggles to adapt to rapidly evolving attack strategies in dynamic adversarial scenarios, leading to reduced filter update efficiency. Therefore, existing technologies suffer from low filter update efficiency.

[0046] Therefore, addressing the issue of low filter update efficiency in existing technologies, this research reveals a solution: filter updates can be achieved by sensing changes in the filter's application environment and quantifying their impact on filtering effectiveness. This can be combined with scenario data and adversarial examples to dynamically adjust update triggering conditions and parameter optimization strategies. The results include: ① Real-time monitoring of data distribution, threat landscape, and performance indicators in the operating environment, with periodic initiation of the update process. ② The use of generative adversarial networks to synthesize a large number of diverse, realistic adversarial examples. This synthesized data can be used for continuous fine-tuning of the filter, enabling it to identify and defend against real attacks before they occur. ③ Integration of multi-dimensional data to construct a data collaborative analysis mechanism. This mechanism utilizes historical adversarial examples to ensure adversarial robustness, real-time target domain data to ensure scenario adaptability, operational feedback data to correct update deviations, and threat intelligence data to predict potential attack trends in advance. Through the complementarity and verification of multi-source data, the filter update strategy can be optimized.

[0047] Specifically, a closed-loop filter update scheme can be constructed, which integrates dynamic perception, data empowerment, and precise triggering. This scheme monitors the distribution of environmental data and changes in threat status in real time and quantifies their impact on the filtering effect. It integrates diverse adversarial examples and scenario-adaptive data to form support, uses dynamic thresholds to determine whether to trigger an update, and then optimizes the filter parameters accordingly. At the same time, it uses the update effect to correct the perception and triggering mechanism, thereby realizing the transformation from passive periodic updates to proactive and precise updates and improving update efficiency.

[0048] This application discloses a filter update method, apparatus, device, medium, and product. By generating diverse mixed samples through perturbation, it expands the filter's adversarial experience base, enabling it to establish the ability to identify multiple attack modes in the initial stage. This lays a robust foundation for dealing with dynamic attacks. By introducing target domain scene data, it calculates the information divergence between mixed samples and target domain samples in real time, quantifies the degree of environmental change, and automatically triggers parameter updates in the real environment. This breaks through the limitations of traditional methods that rely on static rules and fixed-cycle updates, achieving rapid response and continuous defense capabilities against new threats, and improving the filter update efficiency.

[0049] Based on the above-mentioned inventive discovery, the technical solution of this application is proposed.

[0050] The following describes the application scenarios of the filter update method provided in the embodiments of the present invention. Figure 1 This is a schematic diagram illustrating an application scenario of the filter update method provided in this application embodiment. For example... Figure 1 As shown, this application scenario includes a mobile device 101 and a server 102. During the traversal of the target query, the server 102 obtains an initial adversarial sample, effective perturbations, and multiple normal samples. The server 102 mixes the samples based on the initial adversarial sample, effective perturbations, and multiple normal samples to obtain a mixed dataset. The server 102 obtains the label of the target mixed sample, and when the label of the target mixed sample is the same as the preset target label, the target mixed sample is determined as the final adversarial sample. Upon completion of multiple queries, the server 102 obtains a target filter and multiple target domain samples. The server 102 calculates the information divergence between the multiple mixed samples and the multiple target domain samples. Based on the information divergence, the multiple final adversarial samples, the multiple target domain samples, and the preset Euclidean norm, the server 102 periodically updates the parameters of the target filter to obtain the updated target filter. The mobile device 101 sends an input sample to the server 102, and the server 102 cleans the input sample to defend against sample attacks.

[0051] The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0052] Figure 2 Flowchart of the filter update method provided in the embodiments of this application Figure 1 .like Figure 2 As shown, in this embodiment, the execution entity of this invention is a server. Therefore, the filter update method provided in this embodiment includes the following steps:

[0053] S201. When traversing the target query, obtain the initial adversarial sample, effective perturbation and multiple normal samples; where the target query is any one of the preset multiple queries, the effective perturbation is a noise vector that satisfies multiple preset constraints, and the multiple normal samples refer to multiple unperturbed original samples obtained from the preset source domain.

[0054] Specifically, during the sequential processing of each query, initial adversarial samples can be retrieved from a pre-set adversarial sample reserve. By filtering noise vectors that meet pre-set constraints, such as perturbation range and feature rationality, effective perturbations can be obtained. Multiple undisturbed original samples can be extracted from a pre-set source domain sample set as normal samples. This step is used to provide basic materials for subsequent sample mixing. By integrating initial adversarial samples, effective perturbations, and normal samples, the foundation for generating diverse mixed samples is laid, thereby enriching the adversarial modes that the filter can learn.

[0055] S202. Mix the initial adversarial sample, effective perturbation and multiple normal samples to obtain a mixed dataset; wherein, the mixed dataset includes multiple mixed samples.

[0056] Specifically, the initial adversarial samples can be perturbed by adding perturbations based on effective perturbations to obtain perturbed adversarial samples. Then, a portion of the perturbed adversarial samples and a portion of the normal samples are selected according to a preset ratio and the two are combined to form a hybrid dataset. This step is used to integrate the perturbed adversarial samples and the normal samples so that the hybrid dataset contains both adversarial and normal features, providing a diverse range of basic samples for the subsequent selection of the final adversarial samples that meet the target label.

[0057] S203. Obtain the label of the target mixed sample, and when the label of the target mixed sample is the same as the preset target label, determine the target mixed sample as the final adversarial sample; wherein, the target mixed sample is any one of multiple mixed samples, and the label of the target mixed sample is used to indicate the category of the target mixed sample.

[0058] Specifically, the target mixed sample can be classified using a pre-defined classification model to predict its category and obtain its label. The obtained label is then compared with the pre-defined target label. If they match, the target mixed sample is identified as the final adversarial sample. This step is used to filter out samples that truly possess the target adversarial characteristics from the mixed dataset and exclude samples that do not meet the adversarial requirements, thus providing accurate and effective adversarial sample material for subsequent filter parameter updates.

[0059] For example, Single Query Direct Attack (SQDP) can be used to generate adversarial examples in the source domain. SQDP is an attack method specifically designed for test-time training / adaptation models and defense methods with out-of-distribution (OOD) data detection mechanisms. This algorithm is well-suited to the main application scenarios. The specific process is as follows:

[0060] (1) Selecting initial adversarial samples The adversarial sample contains the target data for the model's output label. For non-targeted attacks, any different label can be selected. Target data, in adversarial attacks, refers to the specific label data the attacker wants the model to output for the input adversarial sample. Adversarial attacks are divided into targeted and non-targeted attacks. Targeted attacks involve the attacker pre-setting a specific target label and generating adversarial samples by adding perturbations, causing the model to misclassify the sample as the pre-set target label. Non-targeted attacks do not set a specific target label; they simply use perturbations to cause the model to misclassify the sample as any label different from the original label.

[0061] (2) Initializing the disturbance From Gaussian distribution Sampling is performed, and then updates are made each time to ensure that the following conditions are met:

[0062] Adversarial examples must be within the range and are represented as follows:

[0063]

[0064] in, For the first The feature in the first Adversarial sample feature values ​​at the time of step For the first The perturbation value of each feature at step k.

[0065] The disturbance must be relative to the distance, expressed as:

[0066]

[0067] in, Let be the 2-norm of the perturbation at step k, used to measure the magnitude of the perturbation. This is a proportionality coefficient used to control the relative relationship between the disturbance amplitude and the distance. Original sample With the Adversarial examples of steps The distance between them.

[0068] The perturbation aims to reduce the distance between the adversarial example and the original sample, expressed as:

[0069]

[0070] in, Original sample With the Adversarial examples of steps The distance between them Original sample Add perturbation at step k Post-adversarial examples The distance between them This is a scaling factor used to quantify the degree of reduction in distance between the adversarial sample and the original sample after perturbation, controlling the proportion of distance reduction.

[0071] In practice, it is difficult to sample from such a distribution, so a simpler heuristic can be used: first, sample from a Gaussian distribution. Sampling is performed, then the samples are rescaled and cropped to ensure that the adversarial examples are within the range and the perturbations are relative to the distance. Then... Projected onto the original image On the surrounding sphere, the conditions for the perturbation to reduce the distance between the adversarial sample and the original sample, and for the adversarial sample to remain within the range, are met. This is called orthogonal perturbation and is used in subsequent hyperparameter tuning. Finally, a small shift is made to the original image, ensuring that the conditions for the adversarial sample to remain within the range and for the perturbation to reduce the distance between the adversarial sample and the original sample are still met. Making a small shift to the original image means that after rescaling, cropping the samples, and projecting the perturbation onto the surrounding sphere of the original image, a small adjustment is applied to the perturbation adversarial sample, causing it to slightly shift towards the direction of the original image. The purpose of this operation is to further optimize the distance relationship between the adversarial sample and the original sample, making the perturbation more closely fit the preset conditions, while ensuring that the perturbation adversarial sample still meets the range constraints and distance reduction ratio requirements.

[0072] (3) After updating, the data is mixed with normal samples to generate a mixed dataset. :

[0073]

[0074] in, For a mixed dataset, These are weighting coefficients used to control the proportion of perturbed and normal samples in the mixed dataset. For datasets containing adversarial examples, This is the original sample set without adversarial perturbations.

[0075] (4) Obtain labels and match adversarial example labels:

[0076]

[0077]

[0078] in, To represent a mixed dataset After model The predicted labels This is the model function used to predict labels. It is a set of matches consisting of the class labels and predicted labels of the adversarial examples. To provide the true class labels for adversarial examples, For adversarial examples After model The predicted labels.

[0079] (5) Based on the results, choose whether to add the perturbation to the image. If it is the same as the target label, do not add the perturbation; otherwise, add the perturbation.

[0080] The above steps are repeated until the set number of queries is reached. Through these iterative steps, random perturbations are extracted from the proposal distribution. Combined with model prediction, mixed dataset construction, and label matching, adversarial examples are continuously updated until the set maximum number of steps is reached, thus achieving the adversarial attack process on the model. Unlike models with test-time training / test-time adaptation enabled, the source domain model itself does not have the ability to update parameters based on online data. Therefore, it does not need to mix normal samples to simulate real data flow, and once the input image successfully becomes an adversarial example, further perturbation and SQDP updates for that sample cease.

[0081] S204. In response to the completion of multiple queries, obtain the target filter and multiple target domain samples; where the target filter refers to the filtering model that needs to be updated with parameters, and the multiple target domain samples are multiple undisturbed original samples obtained from a preset application scenario.

[0082] Specifically, after the system detects that all preset queries have been completed, it can retrieve the filter model that needs parameter updates from the model storage module as the target filter, and then extract the undisturbed original samples from the sample library corresponding to the actual application scenario as multiple target domain samples. This step is used to provide the basic objects for subsequent calculation of sample differences, determination of whether to update filter parameters, and final execution of parameter updates. The target filter is the direct object of parameter optimization, while the target domain samples are used to reflect the sample characteristics of the actual application scenario, ensuring that subsequent updates can meet the needs of the scenario.

[0083] S205. Calculate the information divergence between multiple mixed samples and multiple target domain samples; wherein, the information divergence is used to represent the degree of difference between multiple mixed samples and multiple target domain samples.

[0084] Specifically, we can first calculate the probability distribution of multiple mixed samples and multiple target domain samples on key feature dimensions. For example, we can determine the distribution of the two by calculating the occurrence frequency or probability density of each feature. Then, we can substitute the two distributions into the preset calculation formula according to the information divergence calculation method to obtain the divergence value that reflects the difference between the two. This step is used to quantify the degree of difference between the distribution of adversarial related samples represented by the mixed samples and the distribution of actual application scenario samples represented by the target domain samples, providing an objective quantitative basis for subsequent judgment on whether to trigger filter parameter updates.

[0085] S206. Based on the information divergence, multiple final adversarial samples, multiple target domain samples, and the preset Euclidean norm, the target filter is periodically updated to obtain the updated target filter; wherein, the updated target filter is used to purify the input samples in the application scenario to resist sample attacks.

[0086] Specifically, in real-world scenarios, target domain data and adversarial sample data interspersed within it can be collected periodically. Information divergence, multiple final adversarial samples, and multiple target domain samples are then used periodically to update the training data as parameters for the target filter. A pre-defined Euclidean norm is introduced to constrain the magnitude of parameter adjustments, preventing excessive deviations from the original effective range. Gradient descent and other optimization algorithms are then used to iteratively adjust the target filter's model parameters until the model's filtering performance on the training data reaches the expected level. This results in the updated target filter. This step is used to specifically optimize filter parameters when it is confirmed that differences in sample distribution have affected the filtering effect. It strengthens the filter's resistance to attacks by leveraging final adversarial samples, ensures the filter's adaptability to real-world application scenarios by relying on target domain samples, and guarantees the stability of parameter updates through the Euclidean norm, thus achieving effective filter updates.

[0087] The updated target filter is used to purify input samples in real-world application scenarios to resist sample attacks and ensure that subsequent models, such as classifiers, can make decisions based on reliable samples. "Purification" means that the filter uses its own model capabilities to remove adversarial perturbations that may exist in the input samples, such as subtle noise or pixel tampering added to mislead the model. It repairs or restores the interfered samples to a state that is close to reality and free from malicious perturbations, ensuring that the samples output to subsequent models conform to the normal data distribution and preventing the model from being misled by adversarial samples and making incorrect judgments.

[0088] This embodiment provides a cache optimization method that generates diverse mixed samples through perturbation, expanding the filter's adversarial experience base and enabling it to establish the ability to identify multiple attack patterns in the initial stage. This lays a robust foundation for dealing with dynamic attacks. Then, by introducing target domain scene data, the information divergence between the mixed samples and target domain samples is calculated in real time, accurately quantifying the degree of environmental change. Parameter updates are automatically triggered in real-world environments, breaking through the limitations of traditional methods that rely on static rules and fixed-period updates. This achieves rapid response and continuous defense capabilities against new threats and improves the filter's update efficiency.

[0089] In one possible design, S201 involves acquiring initial adversarial examples, effective perturbations, and multiple normal samples, including:

[0090] S2011. Obtain the initial adversarial sample, the initial perturbation, and multiple normal samples; where the initial perturbation refers to the original noise vector obtained by random sampling from a Gaussian distribution.

[0091] Specifically, initial adversarial samples can be retrieved from a pre-set adversarial sample reserve, and original noise vectors can be randomly generated from a Gaussian distribution as initial perturbations. Then, multiple unperturbed original samples can be extracted from a pre-set source domain sample set as normal samples. This step is used to provide initial material for subsequent adjustments to the initial perturbations to obtain effective perturbations that meet the constraints, and at the same time, to prepare basic samples for the sample mixing stage, ensuring the smooth progress of subsequent sample processing.

[0092] S2012. Adjust the initial disturbance to obtain an effective disturbance; wherein, the adjustment is used to make the initial disturbance satisfy multiple preset constraints.

[0093] Specifically, the initial perturbation can be adjusted by scaling the amplitude or filtering out parts that exceed the reasonable range of features, so that the adjusted perturbation meets the preset constraints, such as perturbation intensity limits and adaptability requirements to sample features, thereby obtaining an effective perturbation. This step is used to ensure that the perturbation has the ability to change sample characteristics to simulate an attack, but does not lose its practical adversarial significance due to excessive deviation from the reasonable range.

[0094] The technical effect of this scheme in this embodiment is as follows: by randomly sampling the initial perturbation from the Gaussian distribution, the diversity of attack directions is ensured. Then, through systematic adjustment, the perturbation is made to meet the requirements of the preset constraints, ensuring that the obtained effective perturbation is targeted and applicable, avoiding the introduction of invalid perturbation, and making the subsequent hybrid samples and final adversarial samples generated based on the effective perturbation more in line with the characteristics of the actual attack scenario. This perturbation generation process improves the usability of adversarial samples.

[0095] In one possible design, S202, the samples are mixed based on the initial adversarial examples, effective perturbations, and multiple normal samples to obtain a mixed dataset, including:

[0096] S2021. Add perturbations to the initial adversarial sample based on the effective perturbations to obtain perturbed adversarial samples.

[0097] Specifically, the noise features of effective perturbations can be fused with the features of the initial adversarial sample to give the initial adversarial sample new perturbation characteristics, thereby obtaining perturbed adversarial samples. This step is used to enrich the perturbation patterns of adversarial samples by introducing effective perturbations, generate diverse adversarial samples, and provide adversarial sample material for subsequent mixing with normal samples in proportion to form a hybrid dataset.

[0098] In this context, perturbation addition refers to fusing the noise features of effective perturbations with the features of the initial adversarial sample, giving the initial adversarial sample new perturbation characteristics, thereby generating perturbation adversarial samples with diverse perturbation patterns. This process enriches the perturbation patterns of the adversarial samples by introducing effective perturbations, providing the necessary adversarial sample material for subsequent proportional mixing with normal samples to form a hybrid dataset.

[0099] S2022. Mix the perturbation adversarial samples with multiple normal samples according to a preset ratio to obtain a mixed dataset.

[0100] Specifically, based on a preset ratio, a corresponding number of perturbation adversarial samples and normal samples can be selected respectively. Then, the two types of samples are integrated into the same dataset to obtain a hybrid dataset. This step is used to ensure that the hybrid dataset contains both samples with adversarial characteristics and samples that conform to normal scenarios. This provides a diverse basic sample library for the subsequent screening of the final adversarial samples that conform to the target label. At the same time, it helps the filter to learn the feature differences between adversarial samples and normal samples, laying a data foundation for parameter updates.

[0101] The term "mixing" refers to the process of first selecting a corresponding number of perturbation adversarial samples and normal samples according to a preset ratio, and then integrating these two types of samples into the same dataset to obtain a mixed dataset.

[0102] The technical effect of this solution in this embodiment is that by first generating adversarial samples based on effective perturbations, and then mixing them with normal samples in a preset ratio, it ensures that the mixed dataset contains enough adversarial samples to support the filter in learning attack patterns, while also providing baseline data features through a reasonable proportion of normal samples. This proportional mixing method makes the mixed dataset closer to the distribution characteristics of adversarial and normal samples in real-world scenarios, improving the accuracy of subsequent selection of final adversarial samples.

[0103] In one possible design, S204 involves acquiring the target filter and multiple target domain samples, including:

[0104] S2041. Construct a model based on multiple normal samples to obtain the first classifier.

[0105] Specifically, a suitable classification model structure can be selected, and multiple normal samples can be used as training data. By adjusting the model parameters, the model can be made to accurately identify the category of these normal samples, thereby constructing the first classifier. This step is used to provide a benchmark tool for evaluating the performance of multiple filters. The reconstructed samples output by the filter are classified by this classifier, and the performance of the filter is measured by the accuracy, laying the foundation for selecting the target filter with the best performance from multiple filters.

[0106] S2042. Based on a pre-defined generative adversarial network architecture with a gradient penalty strategy and multiple normal samples, construct multiple generative adversarial networks; wherein, each generative adversarial network includes a filter, and a first classifier is used to calculate the accuracy of multiple filters.

[0107] Specifically, a pre-defined generative adversarial network architecture with a gradient penalty strategy can be adopted. Multiple normal samples are used as training data. By adjusting the initial parameters of the network or key settings during the training process, multiple generative adversarial networks with the same structure but different parameters are obtained. This step is used to generate multiple candidate networks containing different filters, providing diverse candidates for subsequent evaluation of the performance of each filter and selection of the optimal target filter using the first classifier.

[0108] S2043. Input multiple normal samples into each filter to obtain multiple first reconstructed samples output by each filter; wherein, the multiple first reconstructed samples are samples obtained by each filter reconstructing multiple normal samples.

[0109] Specifically, multiple normal samples can be input into each filter, and each filter performs feature parsing and restoration on the input normal samples to reconstruct samples that match the features of the original samples, thereby obtaining multiple first reconstructed samples output by each filter. This step is used to obtain the reconstruction results of each filter on the normal samples, providing basic data for evaluating the performance of each filter through the first classifier, and helping to select the optimal target filter from multiple filters.

[0110] S2044. Input the multiple first reconstructed samples output by each filter into the first classifier to obtain the accuracy of each filter; wherein, the accuracy of each filter is used to represent the performance of each filter.

[0111] Specifically, the multiple first reconstructed samples output by each filter can be input into the pre-built first classifier. The first classifier judges the category of these reconstructed samples, and then calculates the proportion of samples in the reconstructed samples corresponding to each filter whose category is correctly judged by the classifier. This yields the accuracy of each filter. This step is used to quantitatively evaluate the reconstruction quality and performance of each filter for normal samples based on the judgment results of the first classifier, providing an objective performance measurement basis for subsequently selecting the target filter with the highest accuracy from multiple filters.

[0112] S2045. Determine the filter with the highest accuracy among multiple filters as the target filter.

[0113] Specifically, the accuracy of each filter can be summarized, the maximum value can be found by comparison, and the filter corresponding to the maximum value can be selected as the target filter. This step is used to select the filter with the best performance for reconstructing normal samples from multiple candidate filters, and use it as the basis for subsequent parameter updates, ensuring that the update work can be carried out based on the filter with better performance.

[0114] For example, a lightweight purifier model can be built using a training framework based on generative adversarial networks. A generative adversarial network is a dual-network deep learning model that includes a filter and a discriminator. Through adversarial training, the filter outputs synthetic data that approximate the distribution of real data. In this implementation scheme, the Attention Recurrent Generative Adversarial Network (AR-GAN) method can be used to train the filter.

[0115] First, an initial classifier, called the first classifier, is trained based on undisturbed samples from the source domain and used for subsequent filter model optimization. Then, a set of generative adversarial networks is trained on the same undisturbed samples using the Wasserstein GAN with Gradient Penalty (WGAN-GP) architecture and a gradient penalty strategy. The WGAN-GP framework, through fundamental principle reconstruction and the addition of a penalty mechanism, effectively addresses the inherent defects of traditional GANs, such as training instability and mode collapse. Its loss function is as follows:

[0116]

[0117] in, This is a filter used to distinguish between real samples and generated samples. V is the generator used to generate samples that simulate real data, and V is the value function. To determine the distribution of real data Samples from the middle Calculate the discriminator The logarithmic expectation of its discrimination result, For the noise distribution of the generator input Mid-sampling Calculate and generate samples After discriminator The expected logarithm of the result after discrimination. The coefficient of the gradient penalty term is used to control the penalty strength. This is a gradient penalty term. It is an interpolation sample between real data and generated data. Is it the discriminator in The gradient norm at a given point is used to constrain the gradient norm to be close to 1, thereby improving training stability.

[0118] Sampling points Linear interpolation between real and generated data:

[0119]

[0120] in, This serves as an interpolation sample between real and generated data. These are interpolation coefficients, ranging from 0 to 1, controlling the values ​​of the actual samples. and generate samples Weights in interpolation, Samples generated by the generator This is a real data sample.

[0121] In the filter selection stage, the classification accuracy of each filter on the reconstructed samples of the test set is evaluated using a first classifier, and the optimal filter, i.e., the target filter, is selected. This filter is then used to reconstruct samples from the unperturbed source domain, and the first classifier is fine-tuned using these reconstructed samples to obtain a robust second classifier, thereby improving its discrimination accuracy on the reconstructed samples. Ultimately, the constructed AR-GAN purification system consists of the target filter and the second classifier. The target filter is responsible for reconstructing and purifying the input samples, while the second classifier makes the final decision based on the purified output. Figure 3 A flowchart of filter generation provided in the embodiments of this application is shown below. Figure 3 As shown, a drone classification model is trained using a mixed dataset to obtain a first classifier. A generative adversarial network is trained based on WGAN-GP. The best filter model is selected based on the classification accuracy of the first classifier on the generated images. The training images are then reconstructed using the generator. Based on the accuracy of the first classifier on the reconstructed images and normal images, it is decided whether to retrain the first classifier on the reconstructed images generated by the generator to obtain a second classifier.

[0122] The technical effect of this scheme in this embodiment is as follows: by constructing multiple generative adversarial networks containing filters and introducing a gradient penalty strategy, the stability and generalization ability of the filters in reconstructing normal samples are enhanced, reducing fluctuations in model training. The accuracy of the reconstructed samples output by each filter is evaluated by the first classifier, and the filter with the highest accuracy is selected as the target filter, ensuring that the selected filter can retain the core features of normal samples. This selection method based on multi-model comparison and performance quantification provides a high-quality basic model for subsequent filter parameter updates, enabling it to have reliable defense capabilities when dealing with attacks and improving the effectiveness of the update process.

[0123] In one possible design, S205, calculating the information divergence between multiple mixed samples and multiple target domain samples includes:

[0124] S2051. Extract features from multiple mixed samples to obtain the feature distribution of the mixed samples.

[0125] Specifically, key features can be extracted from multiple mixed samples using a preset feature extraction model or algorithm. These features are then analyzed to obtain the distribution that reflects the overall feature pattern of the mixed samples, i.e., the mixed sample feature distribution. This step is used to present the features of the mixed samples in a distributional form, providing basic data for subsequent quantification of the differences between the two.

[0126] S2052. Extract features from multiple target domain samples to obtain the target domain sample feature distribution.

[0127] Specifically, key features can be extracted from multiple target domain samples using a preset feature extraction model or algorithm. These features are then analyzed to obtain the target domain sample feature distribution. This step is used to present the features of the target domain samples in a distributional form, providing basic data for subsequent calculation of information divergence and quantification of the differences between the feature distributions of mixed samples.

[0128] S2053. Calculate the information divergence based on the feature distribution of the mixed samples and the feature distribution of the target domain samples.

[0129] Specifically, based on the probability of each feature in the mixed sample feature distribution and the target domain sample feature distribution, the information divergence calculation method can be used. By comparing the differences in the distribution of the two in the feature dimension, a specific divergence value can be obtained. This step is used to quantify the degree of difference between the mixed sample and the target domain sample in the feature distribution, providing a quantitative standard for subsequent judgment on whether this difference reaches the level that needs to trigger a filter update, and ensuring the objectivity of the update decision.

[0130] For example, an adaptive update mechanism based on distribution alignment can be used to dynamically optimize the parameters of the filter model. The specific process is as follows:

[0131] First, based on the source domain dataset and pre-generated adversarial examples, spatial distribution information of its deep features is extracted through cluster analysis to construct a source domain reference distribution model. , Let be the mean of the source domain feature distribution. The covariance matrix of the source domain feature distribution is used. During online inference, the feature distribution of each batch of target domain samples is calculated in real time. The KL divergence is used to measure the difference between the distribution and the source domain reference distribution, as shown in the following formula:

[0132]

[0133] in, The loss value for the KL divergence is used to quantify the degree of difference between two probability distributions. The mean of the feature distribution of the target domain. Let be the covariance matrix of the characteristic distribution of the target domain.

[0134] To effectively constrain the model update direction and prevent overfitting or parameter drift, the L2 norm is introduced as a regularization term to stabilize the optimization process and ensure the consistency of the filter function.

[0135]

[0136] in, The result of the L2 norm calculation is used to measure the difference between two parameter vectors. For source domain-related model parameters, These are the model parameters corresponding to the target domain.

[0137] Ultimately, through joint optimization divergence and The loss function, composed of regularization terms, periodically updates the filter model parameters, enabling it to maintain excellent adaptability even when continuously facing changes in input distribution and potential adversarial disturbances.

[0138] The filter update method mainly includes an offline preparation phase and an online defense phase, which are executed sequentially. Figure 4 This is a flowchart of the offline preparation stage provided in an embodiment of this application. Figure 5 The flowchart of the online inference stage provided in the embodiments of this application is as follows: Figure 4 and Figure 5As shown, firstly, in the offline preparation phase, adversarial examples are actively generated on the source domain data to simulate potential attacks. Then, a lightweight filter model is trained by combining the original source domain samples and the generated adversarial examples to identify and filter abnormal inputs, and the distribution of the source domain and the generated adversarial examples is calculated by clustering. Finally, in the online inference phase, a distribution alignment mechanism is introduced so that the filter model can effectively align the feature distributions of the source domain and the target domain while adapting during testing, thereby improving adversarial robustness while maintaining adaptability.

[0139] This application employs Single-Step Query Attack (SQDP) to generate adversarial examples in the offline phase. This method does not rely on the model's internal parameters and gradient information; it constructs effective adversarial examples solely through input-output feedback. This allows the trained AR-GAN filter model to learn general features of adversarial perturbations, rather than gradient-dependent features specific to a particular model structure. During online inference, the distribution-alignment-based defense mechanism only focuses on differences in data distribution and does not depend on whether the attacker possesses model information. Therefore, it has a universal defense effect against query-based black-box attacks, overcoming the shortcomings of existing gradient-masking methods, such as defensive distillation, in protecting against black-box attacks.

[0140] Traditional adversarial training relies on offline simulation of fixed attack types, resulting in static defense boundaries. This application adopts a two-stage architecture of "offline pre-training + online update." In the offline stage, SQDP is used to generate diverse adversarial samples, laying the foundation for the robustness of the filters. In the online stage, KL divergence is used to monitor changes in the target domain distribution in real time. When a distribution shift caused by a new type of attack is detected, the filter parameters are immediately updated by jointly optimizing the KL divergence loss and the L2 norm regularization term. This allows the defense strategy to dynamically adjust with the attack mode, effectively responding to unknown attacks and solving the problem of the generalization limitations of static defense.

[0141] Existing detection methods can only identify adversarial examples and cannot restore the normal characteristics of the data, leading to system denial of service. This application's AR-GAN filter comprises two modules: a filter and a classifier. The filter reconstructs and cleanses the input adversarial examples, eliminating perturbations and restoring the target's normal characteristics. The second classifier outputs accurate recognition results based on the cleaned data, achieving a closed-loop defense from attack identification to functional restoration. Even under attack, the UAV target recognition system can maintain normal business continuity, overcoming the passive defense deficiency of "detection without restoration."

[0142] Existing detection methods often misclassify benign off-distribution samples, such as normal traffic signs affected by sudden changes in lighting or viewing angle, as adversarial examples, hindering the model's proper adaptation. The filter module in this application does not rely on a single logic of "feature difference judgment," but instead reconstructs and cleans all input samples, including benign off-distribution samples and adversarial examples. For benign off-distribution samples, such as traffic signs slightly distorted due to camera shake, their essence still conforms to the basic characteristics of the target category. The filter can retain the core target features and correct for distribution shifts caused by environmental interference during reconstruction, based on the normal data distribution learned from the source domain, ultimately outputting a cleaned result consistent with the characteristics of normal samples in the source domain. For adversarial examples, the filter directly eliminates perturbations, restoring them to images conforming to a normal distribution.

[0143] When the second classifier performs recognition based on the cleaned image, it does not need to additionally determine whether the input is an adversarial example; it only needs to classify the cleaned normal features. This "clean first, then recognize" process fundamentally avoids the problem of "misjudging benign samples based on feature differences" in traditional detection methods. Even if the input is an out-of-distribution benign sample, it can be transformed into normal features that conform to the model's recognition habits after being cleaned by the filter. This not only ensures the model's benign adaptation to environmental changes but also completely eliminates the impact of false alarms on the normal operation of the system.

[0144] There are several alternatives to adversarial example generation methods:

[0145] First alternative: Projected Gradient Descent Attack (PGD).

[0146] PGD ​​attacks update perturbations through multiple iterations, projecting the perturbation onto a pre-defined Lp sphere constraint at each step to ensure the perturbation is invisible and effective. In the offline phase, SQDP can be substituted, using PGD to generate multi-step iterative adversarial examples, which are then mixed with clean samples from the source domain to construct a training set. The subsequent training process for the AR-GAN purifier remains consistent with the original scheme. PGD is a more general adversarial example generation method; however, compared to SQDP, the generated adversarial examples are less aggressive. The diversity of adversarial examples can be improved by adjusting the number of iterations, ensuring the purifier still possesses basic defense capabilities. This approach is suitable for drone deployment scenarios with extremely high real-time requirements and limited computing power.

[0147] The second alternative is Conditional Generative Adversarial Network (CGAN).

[0148] CGAN introduces class label information into the filters and discriminator of GANs, enabling the filters to generate normal samples of specific categories. In the offline phase, CGAN replaces AR-GAN. CGAN is trained based on clean samples from the source domain and class labels. The filters are responsible for reconstructing normal samples based on the class labels, and the discriminator distinguishes between real and generated samples. In the online phase, the CGAN filters reconstruct the input samples with class constraints to eliminate adversarial perturbations, and the classifier identifies based on the reconstruction results. CGAN's class constraints improve the matching degree between reconstructed samples and target categories, especially suitable for UAV target recognition scenarios with clear categories (such as traffic signs, pedestrians, and vehicles). However, it requires the additional introduction of class label information, making the training process slightly more complex. This can be mitigated by reusing the original labels of the source domain samples to reduce label dependence and achieve the same defensive effect as the original approach.

[0149] The third alternative is the variational autoencoder (VAE).

[0150] VAE maps data to a latent space through an encoder and then reconstructs the data through a decoder. Its core function is learning the probability distribution of the data. In the offline phase, VAE replaces AR-GAN, training the VAE to learn the distribution of clean samples in the source domain. In the online phase, the VAE decoder reconstructs the input samples, filtering adversarial perturbations, and the classifier identifies based on the reconstructed data. Simultaneously, it calculates the distribution difference (e.g., KL divergence) between the target domain samples and the source domain samples in the latent space to guide VAE parameter updates. VAE training is more stable, less prone to mode collapse, and can accurately learn the data distribution; however, the detail fidelity of the reconstructed image is slightly lower than that of GAN. This can be improved by increasing the dimension of the latent space, making it suitable for drone scenarios where defensive stability is more important than reconstruction detail.

[0151] The technical effect of this scheme in this embodiment is as follows: by extracting features from the mixed samples and the target domain samples respectively, the original samples are transformed into feature distributions that better reflect their essential characteristics. Then, based on these two feature distributions, the information divergence is calculated, which effectively filters out the interference of irrelevant noise in the original data. This makes the obtained information divergence more accurately quantify the essential differences between the mixed samples and the target domain samples, improves the perception accuracy of distribution shifts caused by environmental changes and attacks, and provides a reliable quantitative basis for subsequent judgment on whether to trigger filter updates.

[0152] Figure 6 Flowchart of the filter update method provided in the embodiments of this application Figure 2 In this embodiment, in Figure 2 Based on the provided embodiments, the filter update method is further explained as follows: The filter update method includes:

[0153] S601. Construct a model based on multiple normal samples to obtain the first classifier.

[0154] S602. Based on a pre-defined generative adversarial network architecture with a gradient penalty strategy and multiple normal samples, construct multiple generative adversarial networks; wherein, each generative adversarial network includes a filter, and a first classifier is used to calculate the accuracy of multiple filters.

[0155] S603. Input multiple normal samples into each filter to obtain multiple first reconstructed samples output by each filter; wherein, the multiple first reconstructed samples are samples obtained by each filter reconstructing multiple normal samples.

[0156] S604. Input the multiple first reconstructed samples output by each filter into the first classifier to obtain the accuracy of each filter; wherein, the accuracy of each filter is used to represent the performance of each filter.

[0157] S605. Determine the filter with the highest accuracy among multiple filters as the target filter.

[0158] S601-S605 are similar to S2041-S2045, and will not be described again in this embodiment.

[0159] S606. Input multiple normal samples into the target filter to obtain multiple second reconstructed samples; wherein, the multiple second reconstructed samples are samples obtained by the target filter reconstructing multiple normal samples, and the multiple second reconstructed samples are used to optimize the first classifier.

[0160] Specifically, multiple normal samples can be input into a predetermined target filter. The target filter then performs feature parsing and reconstruction on these normal samples to generate multiple second reconstructed samples that match the features of the original samples. This step is used to obtain the reconstruction results of the target filter on the normal samples, providing specific data for subsequent optimization of the first classifier based on these samples. This allows the optimized classifier to better adapt to the output of the target filter, laying the foundation for building an efficient purification system.

[0161] S607. Optimize the first classifier based on multiple second reconstructed samples to obtain a second classifier; wherein, the second classifier is a classifier obtained by optimizing the first classifier based on multiple second reconstructed samples.

[0162] Specifically, multiple second reconstructed samples can be used as new training data to input into the first classifier. By adjusting the parameters of the classifier, the classifier can be made to classify these reconstructed samples better, thus obtaining the second classifier. This step is used to make the classifier better adapt to the reconstructed samples output by the target filter, improve its recognition accuracy of the reconstructed samples, and provide a more suitable classification component for the subsequent construction of a purification system that can efficiently complete sample reconstruction and classification.

[0163] S608. Based on the second classifier and the target filter, construct a purification system; wherein, the purification system is used to reconstruct and classify the input samples.

[0164] Specifically, the target filter and the second classifier can be connected according to a preset processing flow. The input sample is first reconstructed by the target filter, and then the reconstructed sample is input into the second classifier for category determination. This combination forms a purification system. This step is used to build a system that can complete both reconstruction and classification of input samples, thereby achieving effective purification of samples and improving the accuracy and stability of processing various types of input samples.

[0165] The technical effect of this solution in this embodiment is as follows: Second reconstructed samples are obtained by reconstructing normal samples using a target filter. These samples, originating from a high-accuracy target filter, accurately retain the core features of normal samples. Based on this, the first classifier is optimized, allowing the generated second classifier to better adapt to the output characteristics of the target filter, reducing the deviation between the two when their functions are integrated. Subsequently, the second classifier is combined with the target filter to construct a purification system. The filter is responsible for removing adversarial perturbations from the input samples, while the optimized classifier can achieve more accurate category judgment for the reconstructed samples. This strengthens the performance of a single module and, through collaboration, enhances the defense system's ability to handle attack samples, enabling the system to both resist attacks and ensure the reliability of classification results in practical applications.

[0166] Figure 7 This is a schematic diagram of the filter updating device provided in an embodiment of this application. Figure 7 As shown, the filter renewal device includes:

[0167] The first acquisition module 701 is used to acquire initial adversarial samples, effective perturbations, and multiple normal samples when traversing the target query; wherein, the target query is any one of the preset multiple queries, the effective perturbation is a noise vector that satisfies multiple preset constraints, and the multiple normal samples refer to multiple unperturbed original samples acquired from the preset source domain.

[0168] The mixing module 702 is used to mix samples based on the initial adversarial sample, effective perturbation and multiple normal samples to obtain a mixed dataset; wherein the mixed dataset includes multiple mixed samples.

[0169] The determination module 703 is used to obtain the label of the target mixed sample, and when the label of the target mixed sample is the same as the preset target label, the target mixed sample is determined as the final adversarial sample; wherein, the target mixed sample is any one of multiple mixed samples, and the label of the target mixed sample is used to indicate the category of the target mixed sample.

[0170] The second acquisition module 704 is used to acquire the target filter and multiple target domain samples in response to the completion of multiple queries; wherein, the target filter refers to the filtering model that needs to be updated with parameters, and the multiple target domain samples are multiple undisturbed original samples obtained from a preset application scenario.

[0171] The calculation module 705 is used to calculate the information divergence between multiple mixed samples and multiple target domain samples; wherein, the information divergence is used to represent the degree of difference between multiple mixed samples and multiple target domain samples.

[0172] The update module 706 is used to periodically update the parameters of the target filter based on the information divergence, multiple final adversarial samples, multiple target domain samples and the preset Euclidean norm, so as to obtain the updated target filter; wherein, the updated target filter is used to purify the input samples in the application scenario to resist sample attacks.

[0173] In one possible design, the first acquisition module 701 includes:

[0174] The first acquisition unit is used to acquire the initial adversarial sample, the initial perturbation, and multiple normal samples; wherein, the initial perturbation refers to the original noise vector obtained by random sampling from a Gaussian distribution.

[0175] The adjustment unit is used to adjust the initial disturbance to obtain an effective disturbance; wherein, the adjustment is used to make the initial disturbance meet multiple preset constraints.

[0176] In one possible design, hybrid module 702 includes:

[0177] The perturbation addition unit is used to add perturbations to the initial adversarial sample based on the effective perturbations, so as to obtain the perturbation adversarial sample.

[0178] The mixing unit is used to mix perturbation adversarial samples with multiple normal samples according to a preset ratio to obtain a mixed dataset.

[0179] In one possible design, the second acquisition module 704 includes:

[0180] The first building unit is used to build a model based on multiple normal samples to obtain the first classifier.

[0181] The second building unit is used to construct multiple generative adversarial networks based on a preset generative adversarial network architecture with a gradient penalty policy and multiple normal samples; wherein each generative adversarial network includes a filter, and the first classifier is used to calculate the accuracy of multiple filters.

[0182] The first reconstruction unit is used to input multiple normal samples into each filter to obtain multiple first reconstructed samples output by each filter; wherein, the multiple first reconstructed samples are samples obtained by each filter reconstructing multiple normal samples.

[0183] An accuracy calculation unit is used to input multiple first reconstructed samples output by each filter into a first classifier to obtain the accuracy of each filter; wherein, the accuracy of each filter is used to represent the performance of each filter.

[0184] The determination unit is used to determine the filter with the highest accuracy among multiple filters as the target filter.

[0185] In one possible design, the second acquisition module 704 further includes:

[0186] The second reconstruction unit is used to input multiple normal samples into the target filter to obtain multiple second reconstructed samples; wherein, the multiple second reconstructed samples are samples obtained by the target filter reconstructing multiple normal samples, and the multiple second reconstructed samples are used to optimize the first classifier.

[0187] An optimization unit is used to optimize the first classifier based on multiple second reconstructed samples to obtain a second classifier; wherein the second classifier is a classifier obtained by optimizing the first classifier based on multiple second reconstructed samples.

[0188] The third building unit is used to construct a purification system based on the second classifier and the target filter; wherein the purification system is used to reconstruct and classify the input samples.

[0189] In one possible design, the computing module 705 includes:

[0190] The first feature extraction unit is used to extract features from multiple mixed samples to obtain the feature distribution of the mixed samples.

[0191] The second feature extraction unit is used to extract features from multiple target domain samples to obtain the feature distribution of the target domain samples.

[0192] The information divergence calculation unit is used to calculate the information divergence based on the feature distribution of the mixed samples and the feature distribution of the target domain samples.

[0193] The filter updating device provided in this embodiment can perform... Figure 2 and Figure 6The technical solution of the filter update method embodiment shown herein, its implementation principle and technical effects are similar to Figure 2 and Figure 6 The filter update method shown in the example is similar and will not be described in detail here.

[0194] Figure 8 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application. Figure 8 As shown, the electronic device 80 includes at least one processor 810 and a memory 820. The electronic device also includes a communication component 830. The processor 810, memory 820, and communication component 830 are connected via a bus 840.

[0195] In a specific implementation, at least one processor 810 executes computer execution instructions stored in memory 820, causing at least one processor 810 to implement a filter update method of the above embodiment.

[0196] The specific implementation process of processor 810 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0197] In the above embodiments, it should be understood that the processor 810 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0198] The memory 820 may include high-speed RAM memory, and may also include non-volatile memory NVM, such as at least one disk storage.

[0199] Bus 840 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Bus 840 can be divided into address bus, data bus, control bus, etc. For ease of illustration, the bus 840 in the accompanying drawings of this application is not limited to only one bus or one type of bus.

[0200] The above description of the functions implemented by electronic devices and main control devices has introduced the solutions provided by the embodiments of the present invention. It is understood that, in order to implement the above functions, the electronic device or main control device includes hardware structures and / or software modules corresponding to the execution of each function. By combining the units and algorithm steps of the various examples described in the embodiments of the present invention, the embodiments of the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the technical solutions of the embodiments of the present invention.

[0201] This application also provides a computer-readable storage medium storing computer-executable instructions. When executed by a processor, these instructions implement a filter update method as described in the above embodiments. In the specific implementation of the aforementioned filter update method, each module can be implemented as a processor.

[0202] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0203] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in application-specific integrated circuits (ASICs). Alternatively, the processor and the readable storage medium can exist as discrete components in an electronic device or a host device.

[0204] This application also provides a computer program product, including a computer program, which, when executed by a processor, is used to implement a filter update method according to the above embodiments.

[0205] The computer program is stored in a readable storage medium, and at least one processor can read the computer program from the readable storage medium and execute the computer program to perform the scheme provided in any of the above embodiments.

[0206] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disk, or optical disk.

[0207] The technical solutions of this application have been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it is readily understood by those skilled in the art that the scope of protection of this application is obviously not limited to these specific embodiments. The above embodiments are only used to illustrate the technical solutions of this application and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for updating a filter, characterized in that, include: When traversing the target query, initial adversarial samples, effective perturbations, and multiple normal samples are obtained; wherein, the target query is any one of a preset set of multiple queries, the effective perturbation is a noise vector that satisfies multiple preset constraints, and the multiple normal samples refer to multiple undisturbed original samples obtained from a preset source domain. The initial adversarial sample, the effective perturbation, and the multiple normal samples are mixed to obtain a mixed dataset; wherein the mixed dataset includes multiple mixed samples; The label of the target hybrid sample is obtained, and when the label of the target hybrid sample is the same as the preset target label, the target hybrid sample is determined as the final adversarial sample; wherein, the target hybrid sample is any one of the plurality of hybrid samples, and the label of the target hybrid sample is used to indicate the category of the target hybrid sample; In response to the completion of the multiple queries, a target filter and multiple target domain samples are obtained; wherein, the target filter refers to a filtering model that needs to be updated with parameters, and the multiple target domain samples are multiple undisturbed original samples obtained from a preset application scenario; Calculate the information divergence between the plurality of mixed samples and the plurality of target domain samples; wherein the information divergence is used to represent the degree of difference between the plurality of mixed samples and the plurality of target domain samples; Based on the information divergence, the multiple final adversarial samples, the multiple target domain samples, and the preset Euclidean norm, the target filter is periodically updated to obtain an updated target filter; wherein, the updated target filter is used to purify input samples in the application scenario to resist sample attacks.

2. The filter update method according to claim 1, characterized in that, The acquisition of the initial adversarial sample, effective perturbation, and multiple normal samples includes: The initial adversarial sample, the initial perturbation, and the plurality of normal samples are obtained; wherein, the initial perturbation refers to the original noise vector randomly sampled from a Gaussian distribution; The initial disturbance is adjusted to obtain the effective disturbance; wherein the adjustment is used to make the initial disturbance satisfy a plurality of preset constraints.

3. The filter update method according to claim 1, characterized in that, The step of mixing samples based on the initial adversarial sample, the effective perturbation, and the multiple normal samples to obtain a mixed dataset includes: The initial adversarial sample is perturbed by adding perturbations based on the effective perturbations to obtain perturbated adversarial samples. The perturbation adversarial samples are mixed with the multiple normal samples according to a preset ratio to obtain the mixed dataset.

4. The filter update method according to claim 1, characterized in that, The acquisition of the target filter and multiple target domain samples includes: A model is constructed based on the multiple normal samples to obtain a first classifier; Based on a pre-defined generative adversarial network architecture with a gradient penalty strategy and the multiple normal samples, multiple generative adversarial networks are constructed; wherein each generative adversarial network includes a filter, and the first classifier is used to calculate the accuracy of the multiple filters. The plurality of normal samples are input into each of the filters to obtain a plurality of first reconstructed samples output by each of the filters; wherein, the plurality of first reconstructed samples are samples obtained by each of the filters reconstructing the plurality of normal samples; The multiple first reconstructed samples output by each of the filters are input into the first classifier to obtain the accuracy of each filter; wherein, the accuracy of each filter is used to represent the performance of each filter; The filter with the highest accuracy among the multiple filters is determined as the target filter.

5. The filter update method according to claim 4, characterized in that, After determining the filter corresponding to the maximum accuracy among the plurality of filters as the target filter, the method further includes: The plurality of normal samples are input into the target filter to obtain a plurality of second reconstructed samples; wherein, the plurality of second reconstructed samples are samples obtained by the target filter reconstructing the plurality of normal samples, and the plurality of second reconstructed samples are used to optimize the first classifier; The first classifier is optimized based on the plurality of second reconstructed samples to obtain a second classifier; wherein, the second classifier is a classifier obtained by optimizing the first classifier based on the plurality of second reconstructed samples; A purification system is constructed based on the second classifier and the target filter; wherein the purification system is used to reconstruct and classify the input samples.

6. The filter update method according to claim 1, characterized in that, The calculation of the information divergence between the plurality of mixed samples and the plurality of target domain samples includes: Feature extraction is performed on the multiple mixed samples to obtain the feature distribution of the mixed samples; Feature extraction is performed on the multiple target domain samples to obtain the target domain sample feature distribution; The information divergence is calculated based on the feature distribution of the mixed samples and the feature distribution of the target domain samples.

7. A filter replacement device, characterized in that, include: The first acquisition module is used to acquire initial adversarial samples, effective perturbations, and multiple normal samples when traversing the target query; wherein, the target query is any one of a preset set of multiple queries, the effective perturbation is a noise vector that satisfies multiple preset constraints, and the multiple normal samples refer to multiple undisturbed original samples acquired from a preset source domain. A mixing module is used to mix samples based on the initial adversarial sample, the effective perturbation, and the multiple normal samples to obtain a mixed dataset; wherein the mixed dataset includes multiple mixed samples; A determination module is used to acquire the label of a target mixed sample, and when the label of the target mixed sample is the same as a preset target label, the target mixed sample is determined as the final adversarial sample; wherein, the target mixed sample is any one of the plurality of mixed samples, and the label of the target mixed sample is used to indicate the category of the target mixed sample; The second acquisition module is used to acquire a target filter and multiple target domain samples in response to the completion of the multiple queries; wherein, the target filter refers to a filtering model that needs to be updated with parameters, and the multiple target domain samples are multiple undisturbed original samples obtained from a preset application scenario; A calculation module is used to calculate the information divergence between the plurality of mixed samples and the plurality of target domain samples; wherein the information divergence is used to represent the degree of difference between the plurality of mixed samples and the plurality of target domain samples; The update module is used to periodically update the parameters of the target filter based on the information divergence, the multiple final adversarial samples, the multiple target domain samples, and the preset Euclidean norm, to obtain the updated target filter; wherein, the updated target filter is used to purify the input samples in the application scenario to resist sample attacks.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; When the processor executes the computer execution instructions stored in the memory, it is used to implement the filter update method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the filter update method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, is used to implement the filter update method as described in any one of claims 1 to 6.

Images