General security enhancement method and device for image recognition task, and storage medium

Abstract

The invention discloses a general security enhancement method and equipment for an image recognition task and a storage medium, and aims at constructing a general confrontation and defense technical framework for an AI system taking image recognition as a core. The method comprises the steps of obtaining a target model and a security demand; multi-level vulnerability analysis is carried out on the target model based on the security demand to obtain a vulnerability rule of the target model, a confrontation and defense building block library system architecture is formed, and when the target model is an image recognition model, the multi-level vulnerability analysis comprises sensitivity analysis on a convolutional neural network component; obtaining a target building block assembly from a preset confrontation and defense building block library based on a vulnerability rule of the target model and the architecture; and constructing based on the target building block assembly to obtain a safety enhancement process. According to the method, through multi-level vulnerability analysis and building block type defense component construction, universalization security enhancement of an image recognition model is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence security, in particular to a general security enhancement method for image recognition tasks, equipment and a storage medium. BACKGROUND

[0002] In the current field of artificial intelligence security, adversarial attacks and defense techniques have become a research hotspot, but the existing technology has the following limitations: Existing defense schemes lack a unified response mechanism for multi-modal attacks in image recognition tasks and are difficult to be universal in heterogeneous architectures such as convolutional neural networks and Transformers; most existing defense schemes are designed for specific attack types or model structures, lacking a general defense framework that can adapt to multiple deep learning architectures and different attack scenarios, making it difficult to respond to diversified unknown attacks. Therefore, the existing security scheme lacks universality when studying image recognition models.

[0003] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0004] The main purpose of the present application is to provide a general security enhancement method for image recognition tasks, equipment and a storage medium, which aims to solve the technical problem of the lack of universality of the existing security scheme when studying image recognition models.

[0005] To achieve the above purpose, the present application provides a general security enhancement method for image recognition tasks, which comprises: obtaining a target model and security requirements; performing multi-level vulnerability analysis on the target model based on the security requirements to obtain the vulnerability law of the target model, forming an adversarial and defense building block library system architecture, when the target model is an image recognition model, the multi-level vulnerability analysis includes sensitivity analysis of the convolutional neural network component; obtaining target building block components from a pre-set adversarial and defense building block library based on the vulnerability law of the target model and the architecture; constructing a security enhancement process based on the target building block components.

[0006] When the target model is an image recognition model, based on the spatial dependency vulnerability of its convolutional layer and pooling layer, targeted adversarial samples are generated.

[0007] In an embodiment, the step of performing multi-level vulnerability analysis on the target model based on the security requirements to obtain the vulnerability law of the target model comprises: performing at least one of a basic component level analysis, a functional module level analysis, and a backbone network level analysis on the target model based on the security requirement, to obtain a vulnerability law of the target model.

[0008] In an embodiment, the step of performing a basic component level analysis on the target model based on the security requirement comprises: analyzing vulnerability of at least one of a full connection layer, a convolution layer, a pooling layer, a three-dimensional data convolution operation, a batch normalization layer, and a random deactivation layer in the target model based on the security requirement; the vulnerability of the full connection layer is that the full connection layer is sensitive to a specific direction of an input space, and the specific direction of the input space is related to an eigenvector of a weight matrix in the full connection layer; the vulnerability of the convolution layer is that it has dependency on a local spatial pattern, and a feature extraction process of the convolution layer is easy to be misled by a pre-designed perturbation pattern; the vulnerability of the batch normalization layer is that different behaviors of the batch normalization layer in training and inference stages introduce potential attack surfaces.

[0009] In an embodiment, the step of performing a functional module level analysis on the target model based on the security requirement comprises at least one of: analyzing vulnerability of at least one of a detection head, a tracking frame, and a recognition network in the target model based on the security requirement; analyzing vulnerability of at least one of a linear transformation component, a nonlinear activation mechanism, an attention mechanism, a hierarchical processing structure, and an optimization convergence characteristic in the target model based on the security requirement.

[0010] In an embodiment, the step of performing a backbone network level analysis on the target model based on the security requirement comprises: analyzing at least one of a multi-modal interaction weakness, a cross-task adaptability defect, and an architecture inherent limitation in the target model based on the security requirement.

[0011] In an embodiment, the step of obtaining a target component from a preset adversarial and defense block library based on the vulnerability law of the target model and the architecture comprises: generating an adversarial sample generation and security enhancement basic component based on the vulnerability law of the basic component in the target model, and generating a basic component block library based on the adversarial sample generation and security enhancement basic component; generating a functional module component based on the vulnerability law of the functional module in the target model, and generating a functional module block library based on the functional module component; generate a backbone network component based on the vulnerability law of the backbone network in the target model, and generate a backbone network building block library based on the backbone network component; generate the adversarial and defensive building block library based on the basic component building block library, the functional module building block library, and the backbone network building block library.

[0012] In an embodiment, the generating a functional module component based on the vulnerability law of the functional module in the target model comprises: generate an attention misleading component and / or an attention robustness enhancement component based on the focus shift vulnerability of the attention mechanism in the target model; generate an optimization path interference component and / or an optimization stability enhancement component based on the local optimum trap of the gradient descent optimization in the target model.

[0013] In an embodiment, when the target model is an image recognition model and the security requirement is to enhance the robustness of the image recognition model in the face of interference, the method further comprises: performing multi-level vulnerability analysis on the image recognition model based on the security requirement, obtaining that the vulnerability law of the image recognition model is that the conditional independence assumption of the connection temporal classification loss function in the functional module leads to poor robustness of the image recognition model in the face of interference; obtaining the target building block component from the preset adversarial and defensive building block library based on the vulnerability law of the image recognition model and the security requirement, the target building block component being an adversarial sample generated based on the conditional independence assumption of the connection temporal classification loss function; constructing the image recognition model training process based on the adversarial sample, so that the image recognition model adapts to and resists interference in training.

[0014] In addition, to achieve the above-mentioned purpose, the present application also proposes a general-purpose security enhancement device for an image recognition task, which comprises: a data acquisition module configured to acquire a target model and a security requirement; a law analysis module configured to perform multi-level vulnerability analysis on the target model based on the security requirement, obtain a vulnerability law of the target model, and form an adversarial and defensive building block library system architecture, wherein when the target model is an image recognition model, the multi-level vulnerability analysis comprises sensitivity analysis on a convolutional neural network component; a component acquisition module configured to obtain a target building block component from a preset adversarial and defensive building block library based on the vulnerability law of the target model and the architecture; a component combination module configured to construct a security enhancement process based on the target building block component.

[0015] Further, to achieve the above object, the present application also provides a general-purpose security enhancement device for an image recognition task, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the general-purpose security enhancement method for an image recognition task as described above.

[0016] Further, to achieve the above object, the present application also provides a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the general-purpose security enhancement method for an image recognition task as described above.

[0017] The one or more technical solutions provided by the present application have at least the following technical effects: The present application obtains the vulnerability law of the target model through multi-level vulnerability analysis of the target model and security requirements, and the vulnerability law of the target model and the security requirements obtain target building block components from a preset confrontation and defense building block library, and construct a security enhancement process based on the target building block components. At the same time, the structural weakness of the AI model is utilized to realize cross-task general security enhancement, and the intelligent defense capability is adaptive and expandable. Moreover, based on the deep analysis of the inherent vulnerability law of the model, the most effective target building block components are dynamically selected, and a security enhancement process is constructed based on the target building block components, so that the present application can quickly adapt to new model structures and defense mechanisms, greatly improving the practical value and life cycle of the model. The present application systematically excavates and utilizes the inherent vulnerability law of the model. This systematic excavation and utilization based on multi-level law analysis enables the present application to adapt to various deep learning architectures, various models, and various tasks, and has universality, specifically, cross-model and cross-task general attack and defense capabilities. BRIEF DESCRIPTION OF DRAWINGS

[0018] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application together with the specification.

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced here. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0020] Figure 1 A flowchart schematic diagram is provided for the first embodiment of the general-purpose security enhancement method for an image recognition task of the present application. Figure 2 Flowchart of the generalization security enhancement method of the present application for image recognition tasks Figure 1 ; Figure 3 Flowchart of the generalization security enhancement method of the present application for image recognition tasks Figure 2 ; Figure 4 Application mode selection diagram of the generalization security enhancement method of the present application for image recognition tasks Figure 5 Module structure diagram of the generalization security enhancement device of the present application for image recognition tasks Figure 6 Device structure diagram of the hardware operating environment involved in the generalization security enhancement method of the present application for image recognition tasks

[0021] The object implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0022] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and do not limit the present application.

[0023] In order to better understand the technical solutions of the present application, the following will be described in detail in combination with the drawings of the specification and the specific embodiments.

[0024] The main solution of the present application embodiment is: obtaining a target model and security requirements; performing multi-level vulnerability analysis on the target model based on the security requirements to obtain the vulnerability law of the target model, forming an anti and defense building block library system architecture, when the target model is an image recognition model, the multi-level vulnerability analysis includes sensitivity analysis of a convolutional neural network component; based on the vulnerability law of the target model and the architecture, obtaining a target building block component from a pre-set anti and defense building block library; based on the target building block component, constructing a security enhancement or adversarial sample generation process.

[0025] Taking ResNet and YOLO image classification models as examples, through feature vector analysis of convolution kernel weights, a perturbation mode is generated, and a misleading component is combined with an attention mechanism to achieve efficient adversarial attack.

[0026] In the present embodiment, for the sake of description, the following describes the security enhancement system as the execution subject.

[0027] In the current field of artificial intelligence security, adversarial attack and defense technology has become a research hotspot, but the existing technology still has many limitations, the following lists three limitations: First, the defense mechanism lacks universality and robustness. Most existing defense schemes are designed for specific attack types or model structures, lacking a universal defense framework that can adapt to various deep learning architectures and different attack scenarios, making it difficult to cope with diverse unknown attacks. When faced with new attack methods or applied to new model structures, these schemes need to be redesigned and adjusted, resulting in high defense costs and limited effectiveness. In particular, in industrial key application scenarios, the robustness of the model is directly related to system security, and a universal framework is urgently needed to fundamentally improve the model's attack resistance.

[0028] For example, although the GRFD framework achieves high defense effect on datasets such as MNIST and CIFAR10 by decoupling robust features, it relies on specific GAN structures and variational autoencoders, making it difficult to adapt to evolving new attack methods. Traditional defense methods such as adversarial training can only defend against attack types seen during training, have weak generalization ability for unknown attacks, and often come at the expense of significantly reducing model accuracy on clean samples.

[0029] Second, attack methods lack transferability and efficiency. Existing adversarial attack techniques are mostly designed for single models or single tasks, lacking cross-model and cross-task universal attack capabilities. For example, current adversarial sample generation methods, although they improve attack effectiveness by reducing feature map dispersion, are mainly targeted at object detection models and require access to internal feature maps, limiting their applicability in black-box scenarios. Similarly, integrated search black-box attack methods for deep learning model robustness detection, although they improve transferability through multiple proxy models, rely on a large number of queries and iterative optimization, making them inefficient and difficult to quickly generate effective adversarial samples in practical applications.

[0030] Third, existing intellectual property protection schemes have limitations. With the rise of machine learning services (MLaaS) platforms, the protection of deep learning model intellectual property rights has become increasingly important. Existing deep learning model copyright protection technologies such as watermark embedding and fingerprint identification face various security threats. For example, the GAN intellectual property protection framework proposed in CVPR 2021 is compatible with both black-box and white-box settings, but still faces threats from watermark removal and blurring attacks; while the deep fake fingerprint detection model copyright protection algorithm based on differential privacy can provide active protection and passive verification, but may affect the performance of the main task of the model. In addition, existing model authentication watermarking technology is vulnerable to label leakage attacks, and attackers can interfere with watermark extraction by analyzing the target label of the trigger sample. Furthermore, existing schemes lack robustness against common operations such as model modification and compression, making it difficult to provide long-term effective copyright protection in practical applications.

[0031] From the technical architecture level, the existing methods focus on single-level security analysis, lack of multi-level and systematic vulnerability regularity research of deep learning models, and fail to build a unified analysis and response framework. For example, the multi-modal adversarial sample generation technology mainly focuses on input level disturbance generation, while ignoring the inherent defects of model internal components and modules; this limitation makes it difficult for existing adversarial identification and defense methods to form a unified and evolving technical system, and cannot adapt to the evolution of deep learning model structure and attack methods.

[0032] Based on this, the present application provides a solution, which obtains the vulnerability regularity of the target model through multi-level vulnerability analysis of the target model and security requirements, obtains target building block components from a preset adversarial and defense building block library based on the security requirements and the vulnerability regularity of the target model, and constructs a security enhancement process based on the target building block components. The inherent vulnerability regularity of the model is systematically mined and utilized. This systematicness based on multi-level regularity analysis enables the framework to adapt to various deep learning architectures and various models or various tasks, and has cross-model and cross-task general attack and defense capabilities. Moreover, based on the deep analysis of the inherent vulnerability regularity of the model, the most effective target building block components are dynamically selected, and a security enhancement process is constructed based on the target building block components, so that the framework can quickly adapt to new model structures and defense mechanisms, greatly improving the practical value and life cycle of the model.

[0033] It should be noted that the execution subject of the present embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a general-purpose security enhancement device for image recognition tasks, etc., or an electronic system, a security enhancement system, etc. capable of realizing the above functions. The present embodiment and the following embodiments will be described below taking the security enhancement system as an example.

[0034] Based on this, the present application embodiment provides a general-purpose security enhancement method for image recognition tasks, which is described with reference to Figure 1 , Figure 1 The flowchart provided by the first embodiment of the general-purpose security enhancement method for image recognition tasks of the present application is shown in the figure.

[0035] In the present embodiment, the general-purpose security enhancement method for image recognition tasks comprises steps S10-S20, S70-S80: Step S10, obtaining a target model and security requirements; The target model can be various types of deep learning models, such as a convolutional neural network (CNN) for image classification, a recurrent neural network (RNN) for natural language processing and its variants (such as LSTM, GRU), or more complex deep learning architectures such as the Transformer model, etc.

[0036] The security requirements specify the security standards and requirements that the target model needs to meet. The security requirements can cover multiple aspects, such as the robustness requirements of the model in the face of interference / malicious attacks (such as adversarial sample attacks, cross-modal attacks, data poisoning attacks, and noise interference), the protection requirements of the model for data privacy (to prevent data leakage and ensure compliance in data use), and the reliability requirements of the model in specific application scenarios (such as in critical infrastructure, the model cannot have false positives or failures that cause serious consequences).

[0037] In step S20, a multi-level vulnerability analysis is performed on the target model based on the security requirements, and the vulnerability rules of the target model are obtained to form an adversarial and defensive building block library system architecture. When the target model is an image recognition model, the multi-level vulnerability analysis includes sensitivity analysis of the convolutional neural network component. The multi-level vulnerability analysis is performed on the target model from multiple different levels to discover possible vulnerabilities.

[0038] As an implementation, at least one of the basic component level analysis, the functional module level analysis, and the backbone network level analysis can be performed on the target model based on the security requirements to obtain the vulnerability rules of the target model.

[0039] The systematicity based on multi-level rule analysis enables the embodiments of the present application to adapt to various deep learning architectures, including CNN, GAN, VAE, and visual language models, significantly improving the universality and scope of application of the technology.

[0040] The understanding of the common vulnerability rules of deep learning models in the present application enables efficient black-box attack capabilities across models and tasks without the need for detailed understanding of the internal structure of the target model, which is particularly suitable for model robustness evaluation and security testing in practical applications.

[0041] In step S70, the target building block component is obtained from a pre-set adversarial and defensive building block library based on the vulnerability rules of the target model and the architecture. For different levels of vulnerability rules, the core of the framework is a set of targeted adversarial and security enhancement systems in the form of building blocks. The system designs a flexible combination of adversarial and defensive building block libraries, where each building block corresponds to a specific level or type of vulnerability exploitation or reinforcement strategy.

[0042] It should be noted that the present application designs a set of dynamically combinable building block type confrontation and defense components according to the vulnerability rules of different levels, which can flexibly adjust the confrontation identification and security enhancement scheme according to the specific structure and application scene of the target model.

[0043] Among them, the confrontation and defense building block library contains various components or modules for deep learning model confrontation and defense. These components are similar to building blocks and can be used flexibly. The components in the building block library may include different adversarial sample generation algorithms, defense strategies (such as data enhancement, model regularization, adversarial training, etc.), feature extraction methods, model structure optimization modules, etc. Each component has its specific function and applicable scene, and can be selected and combined according to specific needs.

[0044] Compared with the current adversarial false data injection method only applicable to a specific field or integrated search black box attack method for robustness detection, the strategy combination of the present application does not depend on specific field knowledge or fixed proxy model set, but is based on deep analysis of the inherent vulnerability rules of the model, dynamically selects the most effective confrontation and defense components. This dynamic combination mechanism enables the present framework to quickly adapt to new model structures and defense mechanisms, greatly improving its practical value and life cycle.

[0045] Step S80, constructing a security enhancement process based on the target building block component.

[0046] Among them, the selected target building block component can be combined in a certain order and logic to form a complete security enhancement scheme for the target model.

[0047] As an implementation, the present application can also provide a comprehensive solution component for model intellectual property protection, combining active protection with passive verification, which can effectively resist various security threats such as label leakage attacks and model modification attacks, and provide solid protection for model copyrights on MLaaS platforms.

[0048] The embodiment provides a general security enhancement method for an image recognition task. The security enhancement method comprises the following steps: performing multi-level vulnerability analysis on a target model and security requirements to obtain vulnerability rules of the target model; obtaining target building block components from a preset confrontation and defense building block library according to the security requirements and the vulnerability rules of the target model; and constructing a security enhancement process based on the target building block components. The security enhancement method systematically mines and utilizes inherent vulnerability rules of the model. The systematic multi-level rule analysis enables the framework to adapt to various deep learning architectures, various models or various tasks, and has cross-model and cross-task general attack and defense capabilities. Furthermore, the security enhancement method dynamically selects the most effective target building block components based on deep analysis of inherent vulnerability rules of the model, and constructs a security enhancement process based on the target building block components, so that the framework can quickly adapt to new model structures and defense mechanisms, greatly improving the practical value and life cycle of the model.

[0049] Based on the first embodiment, in the second embodiment, the same or similar contents as the above first embodiment can be referred to the above introduction, and will not be described in detail. On this basis, in step S20, the multi-level vulnerability analysis of the target model based on the security requirements is performed to obtain the vulnerability rules of the target model, which comprises the following step S21: In step S21, at least one of the basic component level analysis, the function module level analysis and the backbone network level analysis of the target model based on the security requirements is performed to obtain the vulnerability rules of the target model.

[0050] In the deep learning model, a plurality of basic components are combined together to form a function module in order to realize a specific function. For example, in an image classification model, there can be a feature extraction module composed of a plurality of convolution layers, pooling layers and activation function layers, which is responsible for extracting useful features from the input image; and a classification module usually composed of fully connected layers and a softmax function, which is used for classifying and predicting the extracted features. Different function modules undertake different tasks, and the cooperation and interaction between them determine the overall performance of the model.

[0051] In the deep learning model, a plurality of basic components are combined together to form a function module in order to realize a specific function. For example, in an image classification model, there can be a feature extraction module composed of a plurality of convolution layers, pooling layers and activation function layers, which is responsible for extracting useful features from the input image; and a classification module usually composed of fully connected layers and a softmax function, which is used for classifying and predicting the extracted features. Different function modules undertake different tasks, and the cooperation and interaction between them determine the overall performance of the model.

[0052] Among them, the backbone network is the core architecture of the deep learning model, which determines the overall structure and computational complexity of the model. Common backbone networks include ResNet, VGG, MobileNet, etc. Different backbone networks differ in the number of layers, connection methods, and parameter quantities, and are suitable for different application scenarios. The backbone network is responsible for extracting high-level abstract features from the input data, providing basic support for subsequent tasks such as classification, detection, segmentation, etc.

[0053] Among them, by analyzing at least one of the basic component level, the function module level, and the backbone network level, the analysis results at each level are synthesized and summarized, which can more comprehensively and deeply understand the vulnerability of the target model.

[0054] The embodiment of the present application establishes a systematic analysis methodology of the vulnerability law of the deep learning model at multiple levels, covering a comprehensive vulnerability evaluation framework from basic components, function modules to complete backbone networks. This methodology constitutes the theoretical cornerstone of the present framework. Unlike existing technologies that only focus on single-level vulnerability, the present framework systematically mines and utilizes the inherent vulnerability law of the model from three levels of basic components, function modules, and complete backbone networks, forming a general framework for adversarial identification and security enhancement.

[0055] Based on the above embodiments of the present application, embodiment three of the present application is proposed. In embodiment three of the present application, the same or similar content as the above embodiments can be referred to in the above introduction, and will not be described in detail hereinafter. On this basis, the basic component level analysis of the target model based on the security requirements includes step S211: Step S211, based on the security requirements, analyze the vulnerability of at least one of the fully connected layer, the convolutional layer, the pooling layer, the three-dimensional data convolution operation, the batch normalization layer, and the random deactivation layer in the target model.

[0056] Among them, the present embodiment studies the commonly used basic component combination connection level, such as the natural vulnerability of the fully connected layer, the convolutional layer, the pooling layer, the three-dimensional data convolution operation, the batch normalization layer, and the random deactivation layer and its basic combination, and deeply analyzes the sensitivity law and decision boundary defects of these basic components under specific input.

[0057] Among them, the vulnerability of the fully connected layer is that the fully connected layer is sensitive to a specific direction of the input space, and the specific direction of the input space is related to the eigenvector of the weight matrix in the fully connected layer; The vulnerability of the convolutional layer is the dependence on spatial local patterns, and the feature extraction process of the convolutional layer is easily misled by the pre-designed perturbation pattern; The vulnerability of the batch normalization layer is that the different behaviors of the batch normalization layer in the training and inference stages introduce potential attack surfaces.

[0058] Specifically, the present application finds that the fully connected layer is extremely sensitive to certain directions of the input space, which are often related to the eigenvectors of the weight matrix; the convolutional layer has a high dependence on local patterns in space, and can be effectively misled in the feature extraction process through a carefully designed perturbation pattern; the different behaviors of the batch normalization layer in the training and inference stages introduce potential attack surfaces; the pooling layer causes information loss, and the vulnerability is amplified when combined with other layers.

[0059] Based on these findings, the present application constructs a vulnerability knowledge system at the basic component level, and encapsulates the corresponding adversarial sample generation and security enhancement basic components. These components can initiate effective attacks or conduct security reinforcement based on the component type without understanding the complete model structure.

[0060] The embodiments of the present application find the common vulnerability rules of basic deep learning components, including the inherent defects of components such as fully connected layers, convolutional layers, pooling layers, three-dimensional convolution operations, batch normalization layers, and random deactivation layers, and the vulnerability patterns exhibited by these components in different combination modes. These rules are the knowledge base for constructing various components in the framework.

[0061] Based on the above embodiments of the present application, Embodiment Four of the present application is proposed. In Embodiment Four of the present application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be described hereinafter. On this basis, based on the security requirements, the target model is analyzed at the function module level, including at least one of steps S212-S213: Step S212, analyzing the vulnerability of at least one of the detection head, tracking frame, and recognition network in the target model based on the security requirements; Among them, the vulnerability is analyzed based on complete function modules such as detection head, tracking frame, and recognition network. For example, all networks contain linear transformation; in terms of nonlinear activation function, ReLU, Sigmoid, and other nonlinear activation functions are used; hierarchical feature extraction is performed; shared local connection is used in convolutional neural networks (such as CNN); attention mechanism is commonly used in modern networks; and local optimal solution is found by gradient descent method to achieve optimization convergence. For these common vulnerabilities, a modular attack and defense strategy library can be developed.

[0062] Step S213, analyzing the vulnerability of at least one of the linear transformation component, nonlinear activation mechanism, attention mechanism, hierarchical processing structure, and optimization convergence characteristics in the target model based on the security requirements.

[0063] Further, the present application not only proposes structural attacks and defense strategy component library for deep learning function modules, including but not limited to specific attacks and reinforcement methods of common modules such as detection heads, tracking boxes and identification networks, but also can further analyze the vulnerability of common structural features such as linear transformation, nonlinear activation, hierarchical feature extraction, local connection and attention mechanism commonly used in deep learning models.

[0064] The structural weaknesses of deep learning models are mined in the embodiments of the present application, and the generated adversarial samples have stronger cross-model transferability. Compared with existing methods such as multi-modal universal adversarial perturbation or adversarial sample generation method of reducing feature map dispersion, the adversarial perturbation generated by the embodiments of the present application is not only suitable for transfer between isomorphic models, but also can be effectively transferred between heterogeneous models (such as image classification model and speech recognition model), greatly expanding the applicable scenarios of the framework. This feature makes the embodiments of the present application particularly effective in a black box setting, without the need to understand the internal structure of the target model in detail to achieve efficient attack, which has important value for model robustness evaluation and security reinforcement in practical applications.

[0065] Based on the above embodiments of the present application, the fifth embodiment of the present application is proposed. In the fifth embodiment of the present application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be described hereinafter. On this basis, the backbone network level analysis of the target model based on the security requirements includes step S214: Step S214, based on the security requirements, analyzing the target model to obtain at least one of the multi-modal interaction weakness, cross-task adaptability defect and architecture inherent limitation in the target model.

[0066] Among them, multi-modal interaction refers to the ability of a model to simultaneously process and integrate information from multiple different modalities (such as images, text, audio, video, etc.); cross-task adaptability refers to the ability of a model to quickly adjust and maintain good performance in different task scenarios; architecture inherent limitation refers to the limitations and defects of the architecture itself that are difficult to overcome by simple adjustment. Different model architectures, such as convolutional neural networks (CNN), recurrent neural networks (RNN) and Transformers, have their unique advantages and limitations.

[0067] For example, in a multi-modal attack on a visual language model, the embodiments of the present application can simultaneously call the feature extraction vulnerability component for the visual backbone network and the semantic analysis defect component for the language understanding module, and the generated adversarial perturbation can guide the model to make an erroneous decision in the multi-modal space. Meanwhile, a multi-modal robustness training solution is also provided, which improves the resistance of the model to cross-modal attacks by introducing adversarial samples on multiple modalities at the same time. Compared with single-modal defense, this multi-level and multi-modal joint enhancement solution has a significant effect and has less impact on the performance of the model on clean samples.

[0068] The embodiments of the present application develop a full-stack adversarial attack and security enhancement solution for a complete backbone network, which can utilize the vulnerabilities of different levels of the model to produce a collaborative attack effect or joint defense mechanism across components and modules, significantly improving the attack power and transferability of adversarial samples or the overall robustness of the model. Moreover, this solution not only considers the overall architecture characteristics of the model, but also integrates the interaction of vulnerability rules at different levels, thereby producing more powerful and efficient adversarial attack and defense mechanisms.

[0069] Based on the above embodiments of the present application, embodiment six of the present application is proposed. In embodiment six of the present application, the same or similar contents as the above embodiments can be referred to the introduction above, and will not be described in detail hereinafter. On this basis, step S70, based on the vulnerability rule of the target model and the architecture, obtains target component assembly from a preset adversarial and defense building block library before steps S30-S60: Step S30, based on the vulnerability rule of the basic component in the target model, generates an adversarial sample generation and security enhancement basic component, and generates a basic component building block library based on the adversarial sample generation and security enhancement basic component; Wherein, the basic components of the target model, such as neurons, activation functions, convolution kernels, etc., have specific vulnerability rules. After mastering the vulnerability rules, adversarial sample generation and security enhancement basic components can be designed.

[0070] Then, the generated adversarial sample generation and security enhancement basic components are sorted and classified according to functions, application scenarios, etc., to form a basic component building block library.

[0071] Step S40, based on the vulnerability rule of the functional module in the target model, generates a functional module component, and generates a functional module building block library based on the functional module component; Wherein, after mastering the vulnerability rule of the functional module, the functional module component can be designed, and a functional module building block library is generated based on the functional module component.

[0072] Step S50, based on the vulnerability rule of the backbone network in the target model, generates a backbone network component, and generates a backbone network building block library based on the backbone network component; Wherein, after grasping the vulnerability law of the backbone network, the backbone network component can be designed in a targeted manner, and a functional module block library is generated based on the backbone network component.

[0073] Step S60, generating the confrontation and defense block library based on the basic component block library, the functional module block library and the backbone network block library.

[0074] Wherein, in actual application, users can select appropriate components from the confrontation and defense block library according to the characteristics and security requirements of the target model, and quickly build an effective confrontation identification and security enhancement process.

[0075] For example, for model robustness evaluation in a black box scenario, a module-level attack block with high transferability can be preferentially selected; and for security reinforcement in a white box scenario, a component-level and model-level defense block can be combined for comprehensive protection. This block-based architecture not only improves the flexibility and usability of the framework, but also enables the framework to continuously evolve by continuously injecting new vulnerability law knowledge and defense strategies, maintaining the effectiveness of protection against new model architectures, and embodying the core value of a sustainable technology system.

[0076] The embodiment of the application constructs a block-based combinable confrontation and defense system, which is the core architecture of the framework, allowing users to flexibly select and combine different attack and defense components according to specific scenarios to form a customized technical solution. This system has high scalability and can continuously integrate new functional modules as new model architectures emerge.

[0077] Based on the above-mentioned embodiments of the application, the seventh embodiment of the application is proposed. In the seventh embodiment of the application, the same or similar contents as the above-mentioned embodiments can be referred to in the foregoing description, and will not be described again. On this basis, step S40, generating a functional module component based on the vulnerability law of the functional module in the target model, includes steps S41-S42: Step S41, generating an attention misleading component and / or an attention robustness enhancement component based on the focus shift vulnerability of the attention mechanism in the target model; Wherein, for the focus shift vulnerability commonly existing in the attention mechanism, the attention misleading component is designed in the embodiment of the application, which can make the model focus on irrelevant features through a small input disturbance.

[0078] Meanwhile, the embodiment of the application also provides an attention robustness enhancement component, which adjusts the attention weight distribution to improve the resistance of the model to disturbance.

[0079] Step S42, generating an optimization path interference component and / or an optimization stability enhancement component based on the local optimum trap of gradient descent optimization in the target model.

[0080] Wherein, in order to avoid the local optimum trap shared by gradient descent optimization, the embodiment of the application provides an optimization path interference component to make the model deviate from the expected direction during fine-tuning.

[0081] Meanwhile, the embodiment of the application also designs an optimization stability enhancement component to enhance the robustness of model training through regularization and gradient clipping.

[0082] It should be noted that these module-level components are not dependent on specific model implementations, but are based on the general characteristics of functional modules, and therefore have wide applicability.

[0083] After mastering the vulnerability rules of functional modules, the embodiment of the application can design functional module components and generate a functional module block library based on the functional module components, so that an effective adversarial recognition and security enhancement process can be constructed based on the functional module block library.

[0084] Based on the above embodiments of the application, the eighth embodiment of the application is proposed. In the eighth embodiment of the application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be described in detail. On this basis, when the target model is an image recognition model and the security requirement is to enhance the robustness of the image recognition model when facing interference, the method further includes steps S1-S3: Step S1, based on the security requirement, performing multi-level vulnerability analysis on the image recognition model to obtain the vulnerability rule of the image recognition model, which is that the conditional independence assumption of the connection time series classification loss function in the functional module leads to poor robustness of the image recognition model when facing interference; Wherein, at the functional module level, the conditional independence assumption of the connection time series classification loss function can lead to the model being easily misled by adversarial samples, resulting in poor robustness when facing interference / attacks. At the same time, the model has weak resistance to noise, and the noise introduced at different time steps can significantly affect the recognition result.

[0085] Step S2, based on the vulnerability rule of the image recognition model and the security requirement, obtaining the target block component from the pre-set adversarial and defense block library, the target block component being an adversarial sample generated based on the conditional independence assumption of the connection time series classification loss function; Wherein, the conditional independence assumption of the connection time series classification loss function is used to design a component for generating adversarial samples. This component introduces adversarial perturbations at different time steps, so that the model is exposed to various possible interference situations during the training process, thereby improving the model's resistance to noise.

[0086] Step S3, constructing the image recognition model training process based on the adversarial samples, so that the image recognition model adapts to and resists interference in training.

[0087] Among them, for model training, adversarial perturbations are continuously introduced during the training process, so that the model gradually adapts to and resists these interferences. Through multiple iterations, a safety-enhanced image recognition system model is constructed, which can more accurately identify images in the presence of adversarial samples and noise.

[0088] For example, in order to help understand the implementation process of the above-mentioned general safety enhancement method for image recognition task of the embodiment, please refer to Figure 2 , Figure 2 The flowchart of the general safety enhancement method for image recognition task of the present application Figure 1 , Specifically, the process includes the following steps A1~A7: Step A1, obtaining the target model and user demand.

[0089] Step A2, input the target model and user demand into the multi-level vulnerability analysis module, perform multi-level vulnerability analysis on the target model based on the safety requirement, obtain the vulnerability law of the target model, form the anti and defense block library system architecture, when the target model is an image recognition model, the multi-level vulnerability analysis includes sensitivity analysis of convolutional neural network components. Specifically, at least one of the basic component level analysis, function module level analysis, and backbone network level analysis is performed on the target model based on the safety requirement, and vulnerability law matching and knowledge retrieval are performed to obtain the vulnerability law of the target model.

[0090] Step A3, input the vulnerability law of the target model into the strategy decision module, and the strategy decision module formulates subsequent strategies by comprehensively considering multiple factors after receiving the vulnerability law of the target model.

[0091] Step A4, select attack / defense mode. If the strategy decision module decides to use attack mode, it will further select specific attack methods according to the vulnerability law of the target model; if defense mode is selected, the corresponding defense strategy will be selected according to the vulnerability law.

[0092] Step A5, select the target block component through the block component selection module.

[0093] Step A6, construct the target block component through the dynamic component combination module to obtain the safety enhancement process.

[0094] Step A7, execute the safety enhancement process through the execution engine, and output the result.

[0095] Please refer to Figure 3 ,Figure 3 Flowchart of the generalization security enhancement method of the present application for image recognition tasks Figure 2 , Figure 4 Application mode selection diagram of the generalization security enhancement method of the present application for image recognition tasks, Figure 3 and Figure 4 Comprise the following steps B1~B6: Step B1, obtaining target model and security requirements.

[0096] Step B2, input the target model and security requirements into the multi-level vulnerability analysis engine for vulnerability analysis. Specifically, at least one of the basic component level analysis, functional module level analysis, and backbone network level analysis of the target model is performed based on the security requirements. Further, the vulnerability of at least one of the full connection layer, convolution layer, pooling layer, three-dimensional data convolution operation, batch normalization layer, and random deactivation layer in the target model can be analyzed based on the security requirements. The vulnerability of at least one of the detection head, tracking frame, and recognition network in the target model can be analyzed based on the security requirements. The vulnerability of at least one of the linear transformation component, nonlinear activation mechanism, attention mechanism, hierarchical processing structure, and optimization convergence characteristics in the target model can be analyzed based on the security requirements. At least one of the multi-modal interaction weakness, cross-task adaptability defect, and architecture inherent limitation in the target model can be analyzed based on the security requirements.

[0097] Step B3, based on the vulnerability law of the basic components in the target model, generate the adversarial sample generation and security enhancement basic components, and generate the basic component building block library based on the adversarial sample generation and security enhancement basic components; based on the vulnerability law of the functional modules in the target model, generate the functional module components, and generate the functional module building block library based on the functional module components; based on the vulnerability law of the backbone network in the target model, generate the backbone network components; and generate the backbone network building block library based on the backbone network components, generate the adversarial and defense building block library based on the basic component building block library, the functional module building block library, and the backbone network building block library.

[0098] Step B4, the basic component building block library, the functional module building block library, and the backbone network building block library are continuously learned and updated.

[0099] Step B5, obtain target building block components based on the basic component building block library, the functional module building block library, and the backbone network building block library through a dynamic building block strategy combiner.

[0100] Step B6, in response to the application mode selection instruction, when the target block assembly is acquired, if the adversarial identification mode is selected, an adversarial sample is generated and output; if the security enhancement mode is selected, the model robustness is enhanced and the security enhanced model is output; if the intellectual property protection mode is selected, the copyright protection mechanism is deployed and the protected model is output.

[0101] It should be noted that the application scenarios of the embodiments of the present application are not limited to traditional image classification models, but can also be widely applied to various artificial intelligence tasks such as speech recognition, text analysis, and multi-modal learning. For example, in an image intelligent identification system, the embodiments of the present application can generate effective adversarial samples by using the conditional independence assumption of the connection time series classification loss function; at the same time, a robustness training component for image models is also provided, which improves the noise resistance of the model by introducing adversarial perturbations at different time steps. In a multi-modal visual language model, the embodiments of the present application can simultaneously call attack components for two modalities of vision and text to solve the problem of insufficient attack effect of single-modal adversarial perturbation; at the same time, a multi-modal adversarial training solution is also provided, which improves the resistance of the model to cross-modal attacks by introducing adversarial samples on multiple modalities for training. These cross-domain applications reflect the wide applicability of the embodiments of the present application as a general-purpose technical system.

[0102] In a specific implementation aspect, the embodiments of the present application adopt modular design, encapsulate different levels of vulnerability analysis tools, adversarial generation components, and general-purpose security enhancement methods for image recognition tasks into independent software modules, and provide services through a unified application programming interface. This design enables the embodiments of the present application to flexibly adapt to different user needs, whether it is model robustness analysis in academic research or system security evaluation and reinforcement in the industry, and an appropriate application method can be found. At the same time, the embodiments of the present application also provide different levels of configuration options, and users can select the corresponding analysis strategy and component according to their understanding of the target model (white box, gray box, or black box), to balance the attack effect and implementation cost or the defense strength and performance overhead.

[0103] In terms of technical verification, the present application has been fully tested on multiple public data sets and model architectures, including but not limited to MNIST, CIFAR10, CIFAR100, etc. benchmark data sets, and various mainstream deep learning architectures. Experimental results show that the present application significantly reduces the perturbation amplitude and generation time of adversarial samples while maintaining a high attack success rate, especially in the black box setting, its transferability attack effect is significantly better than traditional methods such as integrated search black box attack or adversarial attack based on autoencoder; at the same time, in terms of security improvement, the defense solution provided by the present application has achieved excellent robustness performance in multiple benchmark tests, and the impact on the performance of the model on clean samples is controlled within an acceptable range. These experimental results fully prove the effectiveness and advancement of the present application.

[0104] It should be noted that the above examples are only for understanding the present application and do not constitute a limitation on the universal security enhancement method for image recognition tasks based on this technical concept. More simple transformations based on this technical concept are within the scope of protection of the present application.

[0105] The present application also provides a universal security enhancement device for image recognition tasks, please refer to Figure 5 , the universal security enhancement device for image recognition tasks comprises: a data acquisition module 10 for acquiring a target model and security requirements; a rule analysis module 20 for performing multi-level vulnerability analysis on the target model based on the security requirements to obtain the vulnerability rules of the target model, forming an adversarial and defense building block library system architecture, when the target model is an image recognition model, the multi-level vulnerability analysis includes sensitivity analysis of a convolutional neural network component; a component acquisition module 30 for acquiring target building block components from a pre-set adversarial and defense building block library based on the vulnerability rules of the target model and the architecture; a construction module 40 for constructing a security enhancement process based on the target building block components.

[0106] The universal security enhancement device for image recognition tasks provided by the present application adopts the universal security enhancement method for image recognition tasks in the above embodiments, which can solve the technical problem of the lack of universality of existing security solutions in studying image recognition models. Compared with the prior art, the universal security enhancement device for image recognition tasks provided by the present application has the same beneficial effects as the universal security enhancement method for image recognition tasks provided by the above embodiments, and other technical features in the universal security enhancement device for image recognition tasks are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0107] The application provides a general-purpose security enhancement device for an image recognition task, which comprises at least one processor and a memory in communication connection with the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the general-purpose security enhancement method for the image recognition task in the first embodiment.

[0108] Reference will now be made to the drawings, and specific language will be used to describe the same. Figure 6 which shows a structural diagram of the general-purpose security enhancement device for the image recognition task suitable for implementing the embodiments of the application. The general-purpose security enhancement device for the image recognition task in the embodiments of the application can include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (for example, vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 6 The general-purpose security enhancement device for the image recognition task shown is only an example, and should not bring any limitation to the functions and use range of the embodiments of the application.

[0109] As Figure 6As shown, the general-purpose security enhancement device for image recognition tasks can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory 1002 or loaded from a storage device 1003 into a random access memory 1004. Various programs and data required for operation of the general-purpose security enhancement device for image recognition tasks are also stored in the random access memory 1004. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are connected to each other by a bus 1005. An input / output interface 1006 is also connected to the bus. Generally, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the general-purpose security enhancement device for image recognition tasks to communicate with other devices wirelessly or by wire to exchange data. Although the general-purpose security enhancement device for image recognition tasks with various systems is shown in the figure, it should be understood that all the shown systems are not required to be implemented or possessed. More or fewer systems can be alternatively implemented or possessed.

[0110] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by a communication device, or installed from the storage device 1003, or installed from the read-only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are performed.

[0111] The general-purpose security enhancement device for image recognition tasks provided by the present disclosure adopts the general-purpose security enhancement method for image recognition tasks in the above-mentioned embodiments, and can solve the technical problem that the existing security scheme lacks generality when studying image recognition models. Compared with the prior art, the general-purpose security enhancement device for image recognition tasks provided by the present disclosure has the same beneficial effects as the general-purpose security enhancement method for image recognition tasks provided by the above-mentioned embodiments, and other technical features in the general-purpose security enhancement device for image recognition tasks are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0112] It should be understood that various aspects disclosed herein can be implemented in hardware, software, firmware, or combinations thereof, to achieve the various aspects disclosed herein. In the description above, specific terminology is used to describe particular features, configurations, materials, or characteristics. But such terminology is used only in a descriptive sense and not for purposes of limitation.

[0113] The above description is only specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0114] The present application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e., computer programs) for performing the generalized security enhancement method for image recognition tasks in the above-described embodiments.

[0115] The computer readable storage medium provided by the present application may, for example, be a U disk, but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system or device, or any combination thereof. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more conductive wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an optical fiber, a portable compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system or device. The program code contained in the computer readable storage medium can be transmitted in any suitable medium, including but not limited to electrical wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0116] The above-described computer readable storage medium can be included in the generalized security enhancement device for image recognition tasks; or can exist separately and not be assembled into the generalized security enhancement device for image recognition tasks.

[0117] The computer readable storage medium described above carries one or more programs, when the one or more programs are executed by the general-purpose security enhancement device facing an image recognition task, the general-purpose security enhancement device facing an image recognition task is caused to: acquire a target model and security requirements; perform multi-level vulnerability analysis on the target model based on the security requirements to obtain vulnerability rules of the target model, form an architecture of an anti-attack and defense building block library system, when the target model is an image recognition model, the multi-level vulnerability analysis includes sensitivity analysis on a convolutional neural network component; based on the vulnerability rules of the target model and the architecture, obtain a target building block component from a preset anti-attack and defense building block library; and based on the target building block component, construct a security enhancement process.

[0118] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0119] The flow and block diagrams in the drawings show architectural, functional and operational architectures of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flow and block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations thereof, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or combinations of hardware and software.

[0120] The modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0121] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e. computer programs) for executing the above-mentioned general-purpose security enhancement method for image recognition tasks, and can solve the technical problem that the existing security scheme lacks generality when studying image recognition models. Compared with the prior art, the beneficial effects of the computer readable storage medium provided by the present application are the same as those of the above-mentioned general-purpose security enhancement method for image recognition tasks, and are not described here.

[0122] The above only describes some embodiments of the present application, and does not limit the patent scope of the present application. Any equivalent structural transformation, direct / indirect application in other related technical fields, or the like made by using the content of the present application specification and drawings is included in the patent protection scope of the present application.

Claims

1. A generalized security enhancement method for image recognition tasks, characterized in that, The method includes: Obtain the target model and security requirements; Based on the security requirements, a multi-level vulnerability analysis is performed on the target model to obtain the vulnerability patterns of the target model and form an adversarial and defense building block system architecture. When the target model is an image recognition model, the multi-level vulnerability analysis includes sensitivity analysis of convolutional neural network components. Based on the vulnerability patterns of the target model and the architecture, target building block components are obtained from a pre-set adversarial and defensive building block library; A security enhancement process is constructed based on the target building block components.

2. The method as described in claim 1, characterized in that, The steps of performing multi-level vulnerability analysis on the target model based on the security requirements to obtain the vulnerability patterns of the target model include: Based on the security requirements, at least one of the following analyses is performed on the target model: basic component-level analysis, functional module-level analysis, and backbone network-level analysis, to obtain the vulnerability patterns of the target model.

3. The method as described in claim 2, characterized in that, The steps for performing basic component-level analysis of the target model based on the aforementioned security requirements include: Based on the aforementioned security requirements, analyze the vulnerability of at least one of the following in the target model: fully connected layer, convolutional layer, pooling layer, convolutional operation of 3D data, batch normalization layer, and random deactivation layer; The vulnerability of the fully connected layer is that it is sensitive to a specific direction in the input space, which is related to the eigenvectors of the weight matrix in the fully connected layer. The vulnerability of the convolutional layer lies in its dependence on spatial local patterns, and the feature extraction process of the convolutional layer is easily misled by pre-designed perturbation patterns. The vulnerability of the batch normalization layer introduces a potential attack surface due to the different behaviors of the batch normalization layer during the training and inference phases.

4. The method as described in claim 2, characterized in that, The steps of performing functional module-level analysis of the target model based on the security requirements include at least one of the following: Based on the aforementioned security requirements, analyze the vulnerability of at least one of the detection head, tracking box, and recognition network in the target model; Based on the aforementioned security requirements, the vulnerability of at least one of the following in the target model: linear transformation component, nonlinear activation mechanism, attention mechanism, hierarchical processing structure, and optimized convergence characteristics.

5. The method as described in claim 2, characterized in that, The steps for performing backbone network-level analysis of the target model based on the aforementioned security requirements include: Based on the security requirements, the target model is analyzed to identify at least one of the following: multimodal interaction weaknesses, cross-task adaptability defects, and inherent architectural limitations.

6. The method as described in claim 2, characterized in that, Prior to the step of obtaining target building block components from a pre-set adversarial and defensive building block library based on the vulnerability patterns of the target model and the architecture, the following steps are included: Based on the vulnerability patterns of the basic components in the target model, adversarial sample generation and security enhancement basic components are generated, and a basic component building block library is generated based on the adversarial sample generation and security enhancement basic components. Based on the vulnerability patterns of functional modules in the target model, functional module components are generated, and a functional module block library is generated based on the functional module components. Based on the vulnerability patterns of the backbone network in the target model, backbone network components are generated, and a backbone network block library is generated based on the backbone network components. The adversarial and defensive block library is generated based on the basic component block library, the functional module block library, and the backbone network block library.

7. The method as described in claim 6, characterized in that, The generation of functional module components based on the vulnerability patterns of functional modules in the target model includes: Based on the focus shift vulnerability of the attention mechanism in the target model, generate attention misdirection components and / or attention robustness enhancement components; Based on the local optimum traps of gradient descent optimization in the target model, an optimization path interference component and / or an optimization stability enhancement component are generated.

8. The method as described in claim 2, characterized in that, When the target model is an image recognition model, and the security requirement is to enhance the robustness of the image recognition model in the face of interference, the method further includes: Based on the aforementioned security requirements, a multi-level vulnerability analysis was conducted on the image recognition model. The vulnerability pattern of the image recognition model was found to be that the conditional independence assumption of the connection time-series classification loss function in the functional modules leads to poor robustness of the image recognition model when facing interference. Based on the vulnerability patterns of the image recognition model and the security requirements, the target building block component is obtained from the preset adversarial and defense building block library. The target building block component is an adversarial sample generated based on the conditional independence assumption of the connection time-series classification loss function. The image recognition model training process is constructed based on the adversarial examples to enable the image recognition model to adapt to and resist interference during training.

9. A general-purpose security enhancement device for image recognition tasks, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the generalized security enhancement method for image recognition tasks as claimed in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the generalized security enhancement method for image recognition tasks as described in any one of claims 1 to 7.

Images