Adversarial sample generation method, device, equipment, medium and program product
By performing masking iteration and image processing on the original text and images of the target model, adversarial samples are generated, which solves the problem of inaccurate adversarial sample generation in the existing technology and improves the content richness and attack similarity of adversarial samples.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHN ENERGY NEW ENERGY TECHNOLOGY RESEARCH INSTITUTE CO LTD
- Filing Date
- 2026-03-13
- Publication Date
- 2026-07-10
Smart Images
Figure CN122368670A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of big data technology, and in particular to an adversarial sample generation method, apparatus, computer device, computer-readable storage medium, and computer program product. Background Technology
[0002] With the development of technology, models are being used more and more widely. However, these models are also more vulnerable to attacks. A model attack specifically refers to an adversary perturbing the data, causing the model to make incorrect predictions. Therefore, to ensure the accuracy of model predictions, it is necessary to generate adversarial samples so that the model can cope with model attacks and maintain high accuracy in its predictions. Thus, there is an urgent need for a method to accurately generate adversarial samples. Summary of the Invention
[0003] Therefore, it is necessary to provide an adversarial sample generation method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the accuracy of adversarial sample generation in response to the above-mentioned technical problems.
[0004] In a first aspect, this application provides an adversarial sample generation method, the method comprising:
[0005] Obtain the original text and original image corresponding to the target model;
[0006] Based on the original image, the original text is iteratively updated with a mask to obtain adversarial intermediate text;
[0007] The original image is iteratively updated based on the adversarial intermediate text to obtain an adversarial image;
[0008] Based on the adversarial image and the adversarial intermediate text, adversarial interference simulation is performed to generate adversarial samples.
[0009] As one embodiment, the step of iteratively updating the mask of the original text based on the original image to obtain adversarial intermediate text includes:
[0010] Filter keyword text from the original text;
[0011] The keyword text in the original text is masked to obtain the masked text;
[0012] Based on the original image, the masked text is iteratively updated to obtain adversarial intermediate text.
[0013] As one embodiment, the step of iteratively updating the original image based on the adversarial intermediate text to obtain an adversarial image includes:
[0014] Text enhancement is performed on the adversarial intermediate text to obtain adversarial enhanced text, and text enhancement is performed on the original text to obtain original enhanced text;
[0015] The adversarial enhanced text and the original enhanced text are concatenated to obtain an enhanced text set;
[0016] The original image is iteratively updated based on the enhanced text set to obtain an adversarial image.
[0017] As one embodiment, the step of performing adversarial interference simulation and generating adversarial samples based on the adversarial image and the adversarial intermediate text includes:
[0018] The original image is enhanced to obtain an original enhanced image, and the adversarial image is enhanced to obtain an adversarial enhanced image.
[0019] The original enhanced image and the adversarial enhanced image are stitched together to obtain an enhanced image set;
[0020] Based on the enhanced image set and the adversarial intermediate text, iterative updates are performed to obtain adversarial samples.
[0021] As one embodiment, the image enhancement includes at least one of the following:
[0022] Randomly translate the pixels in the image;
[0023] Randomly flip the pixels in the image;
[0024] Randomly rotate the pixels in the image;
[0025] Randomly scale the pixels in the image;
[0026] Add random noise to the image.
[0027] As one embodiment, the method further includes:
[0028] Obtain a preset uniform noise, and add the preset uniform noise to the original image;
[0029] Determine the input pixel range of the target model;
[0030] Based on the input pixel range, the original image after adding noise is cropped and updated.
[0031] Secondly, this application also provides an adversarial sample generation apparatus, comprising:
[0032] The acquisition module is used to acquire the original text and original image corresponding to the target model;
[0033] An update module is used to perform iterative mask updates on the original text based on the original image to obtain adversarial intermediate text; and to perform iterative updates on the original image based on the adversarial intermediate text to obtain an adversarial image.
[0034] The simulation module is used to simulate adversarial interference based on the adversarial image and the adversarial intermediate text, and generate adversarial samples.
[0035] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the processor performs the following steps when executing the computer program:
[0036] Obtain the original text and original image corresponding to the target model;
[0037] Based on the original image, the original text is iteratively updated with a mask to obtain adversarial intermediate text;
[0038] The original image is iteratively updated based on the adversarial intermediate text to obtain an adversarial image;
[0039] Based on the adversarial image and the adversarial intermediate text, adversarial interference simulation is performed to generate adversarial samples.
[0040] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:
[0041] Obtain the original text and original image corresponding to the target model;
[0042] Based on the original image, the original text is iteratively updated with a mask to obtain adversarial intermediate text;
[0043] The original image is iteratively updated based on the adversarial intermediate text to obtain an adversarial image;
[0044] Based on the adversarial image and the adversarial intermediate text, adversarial interference simulation is performed to generate adversarial samples.
[0045] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:
[0046] Obtain the original text and original image corresponding to the target model;
[0047] Based on the original image, the original text is iteratively updated with a mask to obtain adversarial intermediate text;
[0048] The original image is iteratively updated based on the adversarial intermediate text to obtain an adversarial image;
[0049] Based on the adversarial image and the adversarial intermediate text, adversarial interference simulation is performed to generate adversarial samples.
[0050] The aforementioned adversarial sample generation method, apparatus, computer equipment, computer-readable storage medium, and computer program product acquire the original text and original image corresponding to the target model; based on the original image, iteratively update the original text through masking to obtain adversarial intermediate text; based on the adversarial intermediate text, iteratively update the original image to obtain an adversarial image; based on the adversarial image and the adversarial intermediate text, perform adversarial interference simulation to generate adversarial samples. By using the original text and original image as a basis, it is possible to generate content-rich adversarial intermediate text. The content-rich adversarial intermediate text further enriches the original image, ensuring that the generated adversarial image includes both textual and image information, thus guaranteeing the richness of the adversarial image's content. Finally, the adversarial sample is generated using the adversarial image and adversarial intermediate text, ensuring the richness of the adversarial sample's content. The overall adversarial interference simulation is performed at three levels, resulting in a high degree of content richness in the progressively simulated adversarial samples, thereby increasing the probability of the adversarial sample being similar to the model attack and improving the accuracy of adversarial sample generation. Attached Figure Description
[0051] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0052] Figure 1 This is a diagram illustrating the application environment of an adversarial sample generation method in one embodiment.
[0053] Figure 2 This is a flowchart illustrating an adversarial sample generation method in one embodiment;
[0054] Figure 3 This is a flowchart illustrating the steps of iteratively updating the original image based on the adversarial intermediate text to obtain an adversarial image in one embodiment.
[0055] Figure 4This is a flowchart illustrating the steps of generating adversarial samples by performing adversarial interference simulation based on the adversarial image and the adversarial intermediate text in one embodiment.
[0056] Figure 5 This is a structural block diagram of an adversarial sample generation device in one embodiment;
[0057] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation
[0058] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0059] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.
[0060] As an example, the adversarial sample generation method provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Server 104 acquires the original text and original image corresponding to the target model; based on the original image, iteratively updates the original text with a mask to obtain adversarial intermediate text; based on the adversarial intermediate text, iteratively updates the original image to obtain an adversarial image; based on the adversarial image and the adversarial intermediate text, it performs adversarial interference simulation to generate adversarial samples. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. Terminal 102 can be a device with the target model deployed on it.
[0061] In one exemplary embodiment, such as Figure 2 As shown, an adversarial sample generation method is provided, which can be applied to... Figure 1Taking server 104 as an example, the explanation includes the following steps 202 to 208. Wherein:
[0062] Step 202: Obtain the original text and original image corresponding to the target model.
[0063] In step 202, the target model is the model awaiting attack response. The target model can be either a model that has already been attacked or a model that has not been attacked; there are no restrictions here. The original text is the text used when training the target model, and the original image is the image used when training the target model.
[0064] Step 204: Based on the original image, perform mask iterative updates on the original text to obtain adversarial intermediate text.
[0065] For example, step 204 includes: iteratively updating the original text based on the original image to obtain adversarial intermediate text.
[0066] As one embodiment, the original text is iteratively updated based on the original image to obtain adversarial intermediate text, including: filtering keyword text from the original text; masking the keyword text in the original text to obtain masked text; and iteratively updating the masked text based on the original image to obtain adversarial intermediate text.
[0067] Further, filtering keyword texts from the original text includes: determining the importance of each word text in the original text; and filtering keyword texts from each word text based on the importance of each word text in the original text.
[0068] The importance of each word in the original text can be determined using a word importance ranking strategy. Specifically, the word texts are ranked from highest to lowest importance within the original text, and at least one word text ranking highest is selected as the keyword text. The number of keyword texts can be set by the user or correspond to the length of the original text; specifically, the number of keyword texts is positively correlated with the length of the original text.
[0069] As one embodiment, the masked text is iteratively updated based on the original image to obtain adversarial intermediate text, including: supplementing the mask in the masked text based on the similar word text of the keyword text to obtain supplementary text; determining the similarity between the original image and the supplementary text; if the similarity representation between the original image and the supplementary text has not converged, word text replacement updates are performed on the similar word text in the supplementary text, and the process returns to the step of determining the similarity between the original image and the supplementary text until the similarity table between the original image and the supplementary text converges; if the similarity table between the original image and the supplementary text converges, the supplementary text in the current iteration is determined as adversarial intermediate text.
[0070] The steps of masking the keyword text in the original text to obtain masked text, and supplementing the masked text with the masked text based on the similar word text of the keyword text to obtain supplemented text can be implemented by a natural language processing model, such as BERT (Bidirectional Encoder Representations from Transformers).
[0071] Specifically, if the similarity between the original image and the supplementary text is greater than a first preset similarity threshold, it is determined that the similarity representation between the original image and the supplementary text has not converged; if the similarity between the original image and the supplementary text is not greater than the first preset similarity threshold, it is determined that the similarity representation between the original image and the supplementary text has converged. The first preset similarity threshold can be an empirical value.
[0072] In this way, the similarity between the original image and the supplementary text is used as the basis for the iterative update of the supplementary text. This ensures that the adversarial intermediate text obtained by the iterative update is based on the original text and has the lowest possible similarity to the original image, thus guaranteeing the distinctiveness of the adversarial intermediate text.
[0073] Specifically, a first loss function value can be calculated based on the similarity between the original image and the supplementary text. If the first loss function value is greater than a first preset loss function threshold, it is determined that the similarity representation between the original image and the supplementary text has not converged. If the first loss function value is not greater than the first preset loss function threshold, it is determined that the similarity representation between the original image and the supplementary text has converged. The first preset loss function threshold can be an empirical value.
[0074] Optionally, the first loss function value, calculated based on the similarity between the original image and the supplementary text, can be expressed by the following formula:
[0075]
[0076] in, The first loss function value, To supplement the text, This is the original image.
[0077] Step 206: Based on the adversarial intermediate text, iteratively update the original image to obtain the adversarial image.
[0078] For example, step 206 includes: iteratively updating the original image based on the adversarial intermediate text to obtain the adversarial image.
[0079] Step 208: Based on the adversarial image and the adversarial intermediate text, perform adversarial interference simulation to generate adversarial samples.
[0080] For example, step 208 includes: iteratively updating the adversarial image based on the original text to obtain adversarial samples.
[0081] Optionally, the above method further includes: obtaining a preset uniform noise and adding the preset uniform noise to the original image; determining the input pixel range of the target model; and cropping and updating the original image after adding noise according to the input pixel range.
[0082] The input pixel range of the target model refers to the limited pixel range of the target model for the input image, which can be 0-1. The preset uniform noise can be uniformly distributed noise with a mean of 0 and a variance of 0.05, or noise with other parameters, which is not limited here.
[0083] Therefore, considering that the target model may have pixel limitations for the input image, the image is cropped and updated based on the input pixel range to make the cropped and updated image fit the input requirements of the target model.
[0084] In the aforementioned adversarial sample generation method, the original text and original image corresponding to the target model are obtained; based on the original image, the original text is iteratively updated with a mask to obtain adversarial intermediate text; based on the adversarial intermediate text, the original image is iteratively updated to obtain an adversarial image; adversarial interference simulation is performed based on the adversarial image and the adversarial intermediate text to generate adversarial samples. By using the original text and original image as a basis, rich adversarial intermediate text can be generated. The rich adversarial intermediate text further enriches the content of the original image, ensuring that the generated adversarial image includes both textual and image information, thus guaranteeing the richness of the adversarial image's content. The final adversarial sample is generated using the adversarial image and the original text, ensuring the richness of the adversarial sample's content. The overall adversarial interference simulation is performed at three levels, resulting in a high level of content richness in the gradually simulated adversarial samples, thereby increasing the probability that the adversarial sample is similar to the model attack and improving the accuracy of adversarial sample generation.
[0085] In one exemplary embodiment, such as Figure 3 As shown, step 206 includes steps 302 to 306. Wherein:
[0086] Step 302: Perform text enhancement on the adversarial intermediate text to obtain adversarial enhanced text, and perform text enhancement on the original text to obtain original enhanced text.
[0087] Optionally, text enhancement includes at least one of the following:
[0088] Randomly replace words in the text with synonyms;
[0089] Randomly insert words into the text.
[0090] Randomly swap words in the text;
[0091] Randomly delete words from the text.
[0092] Optionally, the text enhancement performed in step 302 can be achieved through EDA (Exploratory Data Analysis).
[0093] Step 304: Concatenate the adversarial enhanced text and the original enhanced text to obtain an enhanced text set.
[0094] Step 306: Based on the enhanced text set, iteratively update the original image to obtain an adversarial image.
[0095] For example, step 306 includes: updating the original image by adding noise and cropping to obtain a first updated image; determining the similarity between the first updated image and the enhanced text set; if the similarity between the first updated image and the enhanced text set indicates that the first updated image has not converged, updating the first updated image and returning to the step of determining the similarity between the first updated image and the enhanced text set until the similarity between the first updated image and the enhanced text set indicates that the first updated image has converged; if the similarity between the first updated image and the enhanced text set indicates that the first updated image has converged, determining the first updated image in the current iteration round as an adversarial image.
[0096] The method for updating the first updated image can be a combination of gradient ascent and norm constraint perturbation. If the similarity between the first updated image and the enhanced text set is less than a second preset similarity threshold, the similarity between the first updated image and the enhanced text set indicates that the first updated image has not converged. If the similarity between the first updated image and the enhanced text set is not less than the second preset similarity threshold, the similarity between the first updated image and the enhanced text set indicates that the first updated image has converged. The second preset similarity threshold can be an empirical value.
[0097] Optionally, the specific implementation of noise reduction and cropping updates to obtain an updated image can refer to the above-described steps of obtaining preset uniform noise and adding the preset uniform noise to the original image; determining the input pixel range of the target model; and cropping and updating the original image after adding noise based on the input pixel range. These details will not be elaborated here.
[0098] In this way, the similarity between the first updated image and the enhanced text set is used as the basis for iterative updating of the first updated image, so that the adversarial image obtained by iterative update is based on the original text and has the lowest possible similarity with the enhanced text set, thus ensuring the distinctiveness of the adversarial image.
[0099] Specifically, a second loss function value can be calculated based on the similarity between the first updated image and the enhanced text set. If the second loss function value is greater than a second preset loss function threshold, it is determined that the similarity representation between the first updated image and the enhanced text set has not converged. If the second loss function value is not greater than the second preset loss function threshold, it is determined that the similarity representation between the first updated image and the enhanced text set has converged. The second preset loss function threshold can be an empirical value.
[0100] Optionally, the second loss function value is calculated based on the similarity between the first updated image and the enhanced text set, which can be expressed by the formula:
[0101]
[0102] in, This is the value of the second loss function. Enhance the text a number of times. For the first updated image, To enhance the text collection.
[0103] In this embodiment, text enhancement is performed on the adversarial intermediate text to obtain adversarial enhanced text, and text enhancement is performed on the original text to obtain original enhanced text. The adversarial enhanced text and the original enhanced text are concatenated to obtain an enhanced text set. Based on the enhanced text set, the original image is iteratively updated to obtain an adversarial image. Through text enhancement, the richness of the adversarial enhanced text and the original enhanced text is increased. Using the original image as a blueprint, the enhanced text set obtained by concatenating the adversarial enhanced text and the original enhanced text is used as a basis for iterative updates, resulting in a richer updated adversarial image.
[0104] In one exemplary embodiment, such as Figure 4 As shown, step 208 includes steps 402 to 406. Wherein:
[0105] Step 402: Perform image enhancement on the original image to obtain an original enhanced image, and perform image enhancement on the adversarial image to obtain an adversarial enhanced image.
[0106] Optionally, the image enhancement content includes at least one of the following:
[0107] Randomly translate the pixels in the image;
[0108] Randomly flip the pixels in the image;
[0109] Randomly rotate the pixels in the image;
[0110] Randomly scale the pixels in the image;
[0111] Add random noise to the image.
[0112] Step 404: The original enhanced image and the adversarial enhanced image are stitched together to obtain an enhanced image set.
[0113] Step 406: Based on the enhanced image set and the adversarial intermediate text, perform iterative updates to obtain adversarial samples.
[0114] For example, step 406 includes: concatenating the enhanced image set and the adversarial intermediate text to obtain an image-text concatenated set; performing image enhancement and text enhancement on the image-text concatenated set to obtain an image-text concatenated enhanced set; and selecting adversarial samples from the image-text concatenated enhanced set based on the original text and the enhanced image set.
[0115] Optionally, the specific implementation of image enhancement and text enhancement on the image-text splicing set to obtain the image-text splicing enhancement set can be referred to the specific implementation of image enhancement and text enhancement described above, and will not be repeated here.
[0116] As one embodiment, adversarial samples are selected from the image-text splicing enhancement set based on the original text and the enhanced image set, including: determining a first similarity between each image-text splicing enhancement sample in the image-text splicing enhancement set and the original text, and a second similarity between each image-text splicing enhancement sample in the image-text splicing enhancement set and the enhanced image set; and selecting the sample with the largest similarity difference between the opposite of the first similarity and the second similarity from each image-text splicing enhancement sample in the image-text splicing enhancement set as the adversarial sample.
[0117] Optionally, the similarity difference between the negative of the first similarity and the second similarity can be expressed by the following formula:
[0118]
[0119] in, The similarity difference. For image-text splicing enhancement samples, Enhance the image text with the following numbers: To enhance the image collection.
[0120] In this embodiment, image enhancement is performed on the original image to obtain an original enhanced image, and image enhancement is performed on the adversarial image to obtain an adversarial enhanced image. The original enhanced image and the adversarial enhanced image are then concatenated to obtain an enhanced image set. Based on the enhanced image set and the adversarial intermediate text, iterative updates are performed to obtain adversarial samples. Through image enhancement, the richness of the original enhanced image and the adversarial enhanced image is increased. The enhanced image set obtained by concatenating the original enhanced image and the adversarial enhanced image, along with the adversarial intermediate text, serves as the basis for generating adversarial samples, resulting in a high richness of the updated adversarial samples.
[0121] As a detailed embodiment, the following steps are taken: First, obtain the original text and original image corresponding to the target model. Second, filter keyword text from the original text. Third, mask the keyword text in the original text to obtain masked text. Fourth, iteratively update the masked text based on the original image to obtain adversarial intermediate text. Fifth, perform text enhancement on the adversarial intermediate text to obtain adversarial enhanced text, and perform text enhancement on the original text to obtain original enhanced text. Sixth, concatenate the adversarial enhanced text and the original enhanced text to obtain an enhanced text set. Seventh, iteratively update the original image based on the enhanced text set to obtain an adversarial image. Eighth, perform image enhancement on the original image to obtain an original enhanced image, and perform image enhancement on the adversarial image to obtain an adversarial enhanced image. Fifth, concatenate the original enhanced image and the adversarial enhanced image to obtain an enhanced image set. Finally, iteratively update the enhanced image set and the adversarial intermediate text to obtain adversarial samples.
[0122] Thus, by acquiring the original text and original image corresponding to the target model; by iteratively updating the original text with a mask based on the original image to obtain adversarial intermediate text; by iteratively updating the original image with the adversarial intermediate text to obtain an adversarial image; by performing adversarial interference simulation based on the adversarial image and the adversarial intermediate text to generate adversarial samples, and by using the original text and original image as a basis, it is possible to generate content-rich adversarial intermediate text. The content-rich adversarial intermediate text further enriches the original image, ensuring that the generated adversarial image includes both textual and image information, thus guaranteeing the richness of the adversarial image's content. Finally, the adversarial sample is generated using the adversarial image and adversarial intermediate text, ensuring the richness of the adversarial sample's content. The overall adversarial interference simulation is performed at three levels, resulting in a high content richness of the gradually simulated adversarial samples, thereby increasing the probability that the adversarial sample is similar to the model attack and improving the accuracy of adversarial sample generation.
[0123] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.
[0124] Based on the same inventive concept, this application also provides an adversarial sample generation apparatus for implementing the adversarial sample generation method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more adversarial sample generation apparatus embodiments provided below can be found in the limitations of the adversarial sample generation method described above, and will not be repeated here.
[0125] In one exemplary embodiment, such as Figure 5 As shown, an adversarial sample generation device is provided, comprising: an acquisition module and a simulation module, wherein:
[0126] The acquisition module is used to acquire the original text and original image corresponding to the target model.
[0127] An update module is used to perform iterative mask updates on the original text based on the original image to obtain adversarial intermediate text; and to perform iterative updates on the original image based on the adversarial intermediate text to obtain an adversarial image.
[0128] The simulation module is used to simulate adversarial interference based on the adversarial image and the adversarial intermediate text, and generate adversarial samples.
[0129] In one embodiment, the update module is further configured to: filter keyword text from the original text; mask the keyword text in the original text to obtain masked text; and iteratively update the masked text according to the original image to obtain adversarial intermediate text.
[0130] In one embodiment, the update module is further configured to: perform text enhancement on the adversarial intermediate text to obtain adversarial enhanced text, and perform text enhancement on the original text to obtain original enhanced text; concatenate the adversarial enhanced text and the original enhanced text to obtain an enhanced text set; and iteratively update the original image according to the enhanced text set to obtain an adversarial image.
[0131] In one embodiment, the simulation module is further configured to: perform image enhancement on the original image to obtain an original enhanced image, and perform image enhancement on the adversarial image to obtain an adversarial enhanced image; concatenate the original enhanced image and the adversarial enhanced image to obtain an enhanced image set; and perform iterative updates based on the enhanced image set and the adversarial intermediate text to obtain adversarial samples.
[0132] In one embodiment, the adversarial sample generation apparatus further includes an enhancement module for performing at least one of the following: randomly translating pixels in an image; randomly flipping pixels in an image; randomly rotating pixels in an image; randomly scaling pixels in an image; and adding random noise to an image.
[0133] In one embodiment, the update module is further configured to obtain a preset uniform noise and add the preset uniform noise to the original image; determine the input pixel range of the target model; and crop and update the original image after adding noise according to the input pixel range.
[0134] Each module in the aforementioned adversarial sample generation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.
[0135] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements an adversarial sample generation method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.
[0136] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0137] In one embodiment, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.
[0138] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.
[0139] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.
[0140] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.
[0141] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.
[0142] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.
[0143] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. A method for generating adversarial samples, characterized in that, The method includes: Obtain the original text and original image corresponding to the target model; Based on the original image, the original text is iteratively updated with a mask to obtain adversarial intermediate text; The original image is iteratively updated based on the adversarial intermediate text to obtain an adversarial image; Based on the adversarial image and the adversarial intermediate text, adversarial interference simulation is performed to generate adversarial samples.
2. The method according to claim 1, characterized in that, The step of iteratively updating the mask of the original text based on the original image to obtain adversarial intermediate text includes: Filter keyword text from the original text; The keyword text in the original text is masked to obtain the masked text; Based on the original image, the masked text is iteratively updated to obtain adversarial intermediate text.
3. The method according to claim 1, characterized in that, The step of iteratively updating the original image based on the adversarial intermediate text to obtain an adversarial image includes: Text enhancement is performed on the adversarial intermediate text to obtain adversarial enhanced text, and text enhancement is performed on the original text to obtain original enhanced text; The adversarial enhanced text and the original enhanced text are concatenated to obtain an enhanced text set; The original image is iteratively updated based on the enhanced text set to obtain an adversarial image.
4. The method according to claim 1, characterized in that, The step of performing adversarial interference simulation based on the adversarial image and the adversarial intermediate text to generate adversarial samples includes: The original image is enhanced to obtain an original enhanced image, and the adversarial image is enhanced to obtain an adversarial enhanced image. The original enhanced image and the adversarial enhanced image are stitched together to obtain an enhanced image set; Based on the enhanced image set and the adversarial intermediate text, iterative updates are performed to obtain adversarial samples.
5. The method according to claim 4, characterized in that, The image enhancement includes at least one of the following: Randomly translate the pixels in the image; Randomly flip the pixels in the image; Randomly rotate the pixels in the image; Randomly scale the pixels in the image; Add random noise to the image.
6. The method according to claim 1, characterized in that, The method further includes: Obtain a preset uniform noise, and add the preset uniform noise to the original image; Determine the input pixel range of the target model; Based on the input pixel range, the original image after adding noise is cropped and updated.
7. An adversarial sample generation device, characterized in that, The device includes: The acquisition module is used to acquire the original text and original image corresponding to the target model; An update module is used to perform mask iterative updates on the original text based on the original image to obtain adversarial intermediate text; and to perform iterative updates on the original image based on the adversarial intermediate text to obtain an adversarial image. The simulation module is used to simulate adversarial interference based on the adversarial image and the adversarial intermediate text, and generate adversarial samples.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.