Abnormality detection method and device, electronic device, and storage medium

Abstract

Embodiments of the present application provide an anomaly detection method and device, electronic equipment and storage medium, belonging to the field of artificial intelligence, and suitable for the fields of financial technology and health care. The method comprises: reasoning sample input data through at least two cascaded first inference units to obtain reference features output by each first inference unit; reasoning the sample input data through at least two cascaded second inference units to obtain intermediate features output by each second inference unit; for the first inference units and the second inference units with the same sequential sequence, calculating the similarity between the reference features and the intermediate features; calculating a distillation loss value according to the similarity, the reference features and the intermediate features, and adjusting parameters of a student detection model according to the distillation loss value to obtain a target anomaly detection model. Finally, the target input data is subjected to anomaly detection based on the target anomaly detection model. The embodiments of the present application can improve the accuracy of anomaly detection.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and is applicable to the fields of fintech and healthcare, and particularly to an anomaly detection method and device, electronic device and storage medium. Background Technology

[0002] Currently, in the fintech and healthcare fields, pre-trained anomaly detection models are typically used to perform anomaly detection tasks. To reduce computational resource consumption, high-performance models are often used as teacher models, and lightweight student models are obtained through knowledge distillation, which are then deployed on edge devices.

[0003] However, existing knowledge distillation methods often focus only on the alignment of the teacher and student models at the final output layer. This makes it difficult for the student model to acquire fine-grained structured feature information during training, leading to problems such as low data utilization efficiency, insufficient small-sample learning ability, and sensitivity to input perturbations. Ultimately, this results in a significant decrease in model accuracy after lightweight deployment. For example, in medical image anomaly recognition tasks in the medical field, identifying lesion areas in medical images and marking them as abnormal areas achieves anomaly detection. In the scenario of insurance policy image anomaly detection in the fintech field, anomalies in policy images include text tampering, missing or misaligned fields, abnormal layout structure, and forged seals or signatures. Traditional distillation methods only use the final classification result as a supervision signal, making it difficult for the student model to learn multi-level features, ultimately leading to a decrease in detection accuracy.

[0004] Therefore, ensuring the accuracy of anomaly detection has become a pressing technical problem that needs to be solved. Summary of the Invention

[0005] The main objective of this application is to provide an anomaly detection method, apparatus, electronic device, and storage medium, which aims to improve the accuracy of anomaly detection.

[0006] To achieve the above objectives, a first aspect of this application proposes an anomaly detection method, the method comprising: Obtain a teacher detection model and a student detection model; wherein the teacher detection model includes at least two cascaded first inference units, and the student detection model includes at least two cascaded second inference units, and the number of the first inference units and the number of the second inference units are the same; Acquire sample input data, wherein the sample input data includes at least one of text and image, and infer the sample input data through at least two cascaded first inference units to obtain reference features output by each first inference unit; wherein the reference features output by each first inference unit are used as input features of the next first inference unit. The sample input data is inferred by at least two cascaded second inference units to obtain intermediate features output by each second inference unit; wherein, the intermediate features output by each second inference unit are used as input features of the next second inference unit. For the first inference unit and the second inference unit with the same sequential sequence, calculate the similarity between the reference feature and the intermediate feature; The distillation loss value is calculated based on the similarity, the reference feature, and the intermediate feature, and the parameters of the student detection model are adjusted based on the distillation loss value to obtain the target anomaly detection model; Obtain target input data and perform anomaly detection on the target input data based on the target anomaly detection model.

[0007] In some embodiments, after adjusting the parameters of the student detection model based on the distillation loss value to obtain the target anomaly detection model, the method further includes: Based on the reference features of the last first reasoning unit, a probability prediction is made to obtain the first answer probability distribution, and based on the intermediate features of the last second reasoning unit, a probability prediction is made to obtain the second answer probability distribution. The importance of the sample input data is evaluated based on the sample input data, the probability distribution of the first answer, and the probability distribution of the second answer, to obtain an importance score; The process involves returning to the acquired sample input data, filtering target sample data from a preset sample database based on the importance score, replacing the sample input data according to the target sample features, and updating the target anomaly detection model according to the target sample features, until the distillation loss value meets a preset iteration termination condition.

[0008] In some embodiments, the step of evaluating the importance of the sample input data based on the sample input data, the first answer probability distribution, and the second answer probability distribution to obtain an importance score includes: Divergence is calculated based on the probability distributions of the first and second answers to obtain probability distribution divergence data. Benchmark sample data is obtained from the sample database, and inference is performed on the benchmark sample data through at least two cascaded first inference units to obtain benchmark inference features output by each first inference unit; wherein the benchmark sample data is different from the sample input data; The degree of difference is evaluated based on the baseline inference features and the reference features to obtain the feature difference coefficients; The importance score is calculated based on the probability distribution divergence data and the feature difference coefficient.

[0009] In some embodiments, the step of evaluating the degree of difference based on the baseline inference feature and the reference feature to obtain a feature difference coefficient includes: Select a first reference unit from the first inference unit, and obtain the reference feature and the benchmark inference feature output by the first reference unit; Calculate the semantic similarity between the reference feature and the baseline inference feature; The semantic similarity is normalized to obtain the feature difference coefficient.

[0010] In some embodiments, the step of calculating a distillation loss value based on the similarity, the reference feature, and the intermediate feature, and adjusting the parameters of the student detection model based on the distillation loss value to obtain a target anomaly detection model includes: Based on the similarity, a first target unit is selected from the first reasoning unit, and a second reasoning unit whose sequence is the same as that of the first target unit is determined as the second target unit; The target temperature coefficient is obtained based on the number of training rounds of the target anomaly detection model; The distillation loss value is calculated based on the target temperature coefficient, the reference characteristics of the first target unit, and the intermediate characteristics of the second target unit; The parameters of the second target unit are adjusted based on the distillation loss value to obtain the target anomaly detection model.

[0011] In some embodiments, obtaining the target temperature coefficient based on the number of training epochs of the target anomaly detection model includes: The temperature regulation rate factor is obtained by querying the preset mapping relationship between the training rounds and the preset rounds parameter. A rate smoothing factor is obtained by performing a nonlinear mapping based on the number of training rounds and the temperature regulation speed factor. The target temperature coefficient is calculated based on the rate smoothing factor and the preset model temperature parameters.

[0012] In some embodiments, calculating the distillation loss value based on the target temperature coefficient, the reference characteristics of the first target unit, and the intermediate characteristics of the second target unit includes: The interlayer loss value is calculated based on the reference features of the first target unit and the intermediate features of the second target unit; The distillation loss value is calculated based on the target temperature coefficient and the interlayer loss value.

[0013] To achieve the above objectives, a second aspect of this application provides an anomaly detection device, the device comprising: The model acquisition module is used to acquire a teacher detection model and a student detection model; wherein the teacher detection model includes at least two cascaded first inference units, and the student detection model includes at least two cascaded second inference units, and the number of the first inference units and the number of the second inference units are the same. A first inference module is used to acquire sample input data, wherein the sample input data includes at least one of text and images, and to infer the sample input data through at least two cascaded first inference units to obtain reference features output by each first inference unit; wherein the reference features output by each first inference unit are used as input features of the next first inference unit. The second inference module is used to infer the sample input data through at least two cascaded second inference units to obtain intermediate features output by each second inference unit; wherein the intermediate features output by each second inference unit are used as input features of the next second inference unit. A similarity calculation module is used to calculate the similarity between the reference feature and the intermediate feature for the first inference unit and the second inference unit with the same sequential sequence. A model adjustment module is used to calculate a distillation loss value based on the similarity, the reference feature, and the intermediate feature, and to adjust the parameters of the student detection model based on the distillation loss value to obtain a target anomaly detection model. The third reasoning module is used to acquire target input data and perform anomaly detection on the target input data based on the target anomaly detection model.

[0014] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described in the first aspect.

[0015] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect.

[0016] The anomaly detection method, apparatus, electronic device, and storage medium proposed in this application establish a hierarchical correspondence between the teacher detection model and the student detection model across multiple cascaded inference units. They also calculate the similarity between reference features and intermediate features output by inference units of the same sequence. This allows the student detection model to learn the feature extraction and layer-by-layer representation process of the input data from the teacher detection model at different levels during training. This compensates for the information loss caused by relying solely on output layer alignment, ultimately improving the student detection model's ability to represent structural information and fine-grained features. The target anomaly detection model obtained through the method distillation in this embodiment can more accurately identify lesion areas in medical image anomaly recognition scenarios and more stably identify anomalies such as text tampering, field misalignment, and layout abnormalities in insurance policy image anomaly detection scenarios. Furthermore, it maintains high detection accuracy even with small sample data and input perturbations, ultimately effectively improving the anomaly detection performance of the target anomaly detection model when deployed on edge devices. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the application environment of the anomaly detection method provided in the embodiments of this application; Figure 2 This is a flowchart of the anomaly detection method provided in the embodiments of this application; Figure 3 yes Figure 2 The flowchart of step S205 in the text; Figure 4 yes Figure 3 The flowchart of step S302 in the text; Figure 5 yes Figure 3 The flowchart of step S303 in the process; Figure 6 This is another flowchart of the anomaly detection method provided in the embodiments of this application; Figure 7 yes Figure 6 The flowchart of step S602 in the document; Figure 8 yes Figure 7 The flowchart of step S703 in the process; Figure 9 This is a schematic diagram of the anomaly detection device provided in the embodiments of this application; Figure 10 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0020] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0022] First, let's analyze some of the terms used in this application: Artificial intelligence (AI) is a new branch of computer science that studies, develops, and applies theories, methods, technologies, and systems to simulate, extend, and expand human intelligence. It aims to understand the essence of intelligence and produce intelligent machines that can react in a way similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thought. Furthermore, AI utilizes digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceiving the environment, acquiring knowledge, and using that knowledge to achieve optimal results.

[0023] Natural Language Processing (NLP): NLP uses computers to process, understand, and utilize human language (such as Chinese and English). It is a branch of artificial intelligence and an interdisciplinary field of computer science and linguistics, often referred to as computational linguistics. NLP includes syntactic analysis, semantic analysis, and discourse understanding. It is commonly used in machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, intent recognition, information extraction and filtering, text classification and clustering, sentiment analysis, and opinion mining. It involves data mining, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research, and linguistic research related to language computation.

[0024] Currently, in the fintech and healthcare fields, pre-trained anomaly detection models are typically used to perform anomaly detection tasks. To reduce computational resource consumption, high-performance models are often used as teacher models, and lightweight student models are obtained through knowledge distillation, which are then deployed on edge devices.

[0025] However, existing knowledge distillation methods often focus only on the alignment of the teacher and student models at the final output layer. This makes it difficult for the student model to acquire fine-grained structured feature information during training, leading to problems such as low data utilization efficiency, insufficient small-sample learning ability, and sensitivity to input perturbations. Ultimately, this results in a significant decrease in model accuracy after lightweight deployment. For example, in medical image anomaly recognition tasks in the medical field, identifying lesion areas in medical images and marking them as abnormal areas achieves anomaly detection. In the scenario of insurance policy image anomaly detection in the fintech field, anomalies in policy images include text tampering, missing or misaligned fields, abnormal layout structure, and forged seals or signatures. Traditional distillation methods only use the final classification result as a supervision signal, making it difficult for the student model to learn multi-level features, ultimately leading to a decrease in detection accuracy. Therefore, how to ensure the accuracy of anomaly detection has become an urgent technical problem to be solved.

[0026] Based on this, embodiments of this application provide an anomaly detection method and apparatus, electronic device and storage medium, aiming to improve the accuracy of anomaly detection.

[0027] The anomaly detection method, apparatus, electronic device, and storage medium provided in this application are specifically described through the following embodiments. First, the anomaly detection method in this application is described.

[0028] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0029] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0030] The anomaly detection method provided in this application relates to the field of artificial intelligence technology. This anomaly detection method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the anomaly detection method, but is not limited to the above forms.

[0031] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0032] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0033] The anomaly detection method provided in this application embodiment can be applied to, for example, Figure 1 In this application environment, the client communicates with the server via a network. The server can obtain teacher detection models and student detection models from the client. The teacher detection model includes at least two cascaded first inference units, and the student detection model includes at least two cascaded second inference units. The server acquires sample input data and infers from the sample input data using the at least two cascaded first inference units to obtain reference features output by each first inference unit. It then infers from the sample input data using the at least two cascaded second inference units to obtain intermediate features output by each second inference unit. For first and second inference units with the same sequence, the server calculates the similarity between the reference features and the intermediate features. Based on the similarity, reference features, and intermediate features, the server calculates the distillation loss value and adjusts the parameters of the student detection model according to the distillation loss value to obtain the target anomaly detection model. Finally, the server acquires target input data and performs anomaly detection on the target input data based on the target anomaly detection model. The target anomaly detection model obtained by distillation according to the method of this application can more accurately identify lesion areas in medical image anomaly recognition scenarios and more stably identify anomalies such as text tampering, field misalignment, and layout abnormalities in insurance policy image anomaly detection scenarios. Furthermore, it maintains high detection accuracy even with small sample data and input perturbations, ultimately effectively improving the anomaly detection performance of the target anomaly detection model when deployed on edge devices. The client can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The following detailed description of specific embodiments further illustrates this application.

[0034] Figure 2 This is an optional flowchart of the anomaly detection method provided in the embodiments of this application. Figure 2 The method may include, but is not limited to, steps S201 to S206: Step S201: Obtain the teacher detection model and the student detection model; wherein, the teacher detection model includes at least two cascaded first inference units, and the student detection model includes at least two cascaded second inference units; Step S202: Obtain sample input data, wherein the sample input data includes at least one of text and image, and infer the sample input data through at least two cascaded first inference units to obtain reference features output by each first inference unit; wherein the reference features output by each first inference unit are used as input features of the next first inference unit. Step S203: The sample input data is inferred through at least two cascaded second inference units to obtain the intermediate features output by each second inference unit; wherein, the intermediate features output by each second inference unit are used as the input features of the next second inference unit. Step S204: For the first and second reasoning units with the same sequential sequence, calculate the similarity between the reference feature and the intermediate feature; Step S205: Calculate the distillation loss value based on similarity, reference features, and intermediate features, and adjust the parameters of the student detection model based on the distillation loss value to obtain the target anomaly detection model; Step S206: Obtain target input data and perform anomaly detection on the target input data based on the target anomaly detection model.

[0035] Steps S201 to S206 of this embodiment establish a hierarchical correspondence between the teacher detection model and the student detection model across multiple cascaded inference units. They also calculate the similarity between reference features and intermediate features output by inference units of the same sequence. This allows the student detection model to learn the feature extraction and layer-by-layer representation process of the input data at different levels from the teacher detection model during training. This compensates for the information loss caused by relying solely on output layer alignment, ultimately improving the student detection model's ability to represent structural information and fine-grained features. The target anomaly detection model obtained through the method distillation of this embodiment can more accurately identify lesion areas in medical image anomaly recognition scenarios and more stably identify anomalies such as text tampering, field misalignment, and layout abnormalities in insurance policy image anomaly detection scenarios. Furthermore, it maintains high detection accuracy even with small sample data and input perturbations, effectively improving the anomaly detection performance of the target anomaly detection model when deployed on edge devices.

[0036] In step S201 of some embodiments, the teacher detection model is an anomaly detection model used to provide high-precision feature representation, and the student detection model is a lightweight model used to perform anomaly detection tasks in resource-constrained environments (such as local equipment in hospitals or financial institutions). The first inference unit is the network structure constituting the teacher detection model, and the second inference unit is the network structure constituting the student detection model. For example, the teacher detection model can adopt a deep convolutional neural network structure based on residual networks, and the student detection model can adopt a lightweight convolutional network structure with compressed channels or reduced layers. Both the first and second inference units are convolutional residual modules at corresponding layers. It should be noted that the number of first and second inference units is the same. In the medical image anomaly detection scenario, the teacher detection model uses a multi-layer convolutional residual structure to extract features from medical images layer by layer to obtain high-level semantic features containing information about lesion boundaries and tissue structure. The student detection model, while maintaining the hierarchical correspondence of the network structure, constructs a lightweight network structure by reducing the number of channels or compressing the number of convolutional kernels.

[0037] In step S202 of some embodiments, the sample input data is the raw data used to train the anomaly detection model. The sample input data is input as initial input to both the teacher detection model and the student detection model for inference. The reference features are the feature representations output by each first inference unit of the teacher detection model. Exemplarily, the sample input data can be at least one of a policy image, a medical image, or text describing a scene. For example, the sample input data could be a brain CT image and the text "This is a brain CT scan of a 65-year-old person whose symptoms are frequent dizziness."

[0038] In step S203 of some embodiments, the intermediate feature is the feature representation output by the student detection model in each second inference unit.

[0039] In step S204 of some embodiments, similarity can be obtained by calculating the vector distance, cosine similarity, or mean square error between reference features and intermediate features at the same level. For example, if the teacher detection model includes 10 cascaded first inference units, then for the first first inference unit, its corresponding reference features and the intermediate features corresponding to the first second inference unit of the student detection model are obtained, and the similarity between the two is calculated. In this embodiment, the similarity value ranges from [0,1].

[0040] In step S205 of some embodiments, the target anomaly detection model is a student detection model obtained by distillation training for performing anomaly detection tasks.

[0041] Please see Figure 3In some embodiments, step S205 may include, but is not limited to, steps S301 to S304: Step S301: Select the first target unit from the first reasoning unit based on similarity, and determine the second reasoning unit whose sequence is the same as the first target unit as the second target unit; Step S302: Obtain the target temperature coefficient based on the number of training rounds of the target anomaly detection model; Step S303: Calculate the distillation loss value based on the target temperature coefficient, the reference characteristics of the first target unit, and the intermediate characteristics of the second target unit; Step S304: Adjust the parameters of the second target unit according to the distillation loss value to obtain the target anomaly detection model.

[0042] In step S301 of some embodiments, the first target unit is an inference unit selected from a plurality of first inference units that has a small difference from the corresponding hierarchical features of the student detection model, and the second target unit is a second inference unit that corresponds to the first target unit in the sequence. Specifically, the similarity is higher than or equal to a preset similarity threshold (in this embodiment, the preset similarity threshold can be 0.7), or the similarity is sorted in descending order, and a preset number of the first inference units that appear first in the sequence are selected as the first target units. The number of first target units can be adjusted according to actual needs, and this embodiment does not strictly limit this.

[0043] In step S302 of some embodiments, the target temperature coefficient is a parameter used to adjust the smoothness of the characteristic output distribution during the distillation process.

[0044] Please see Figure 4 In some embodiments, step S302 may include, but is not limited to, steps S401 to S403: Step S401: Query the preset round number parameter mapping relationship according to the training round number to obtain the temperature regulation rate factor; Step S402: Perform nonlinear mapping based on the number of training rounds and the temperature adjustment speed factor to obtain the rate smoothing factor; Step S403: Calculate the target temperature coefficient based on the rate smoothing factor and the preset model temperature parameters.

[0045] In step S401 of some embodiments, the round number parameter mapping relationship describes the correspondence between the number of training rounds and the temperature regulation rate change, and the temperature regulation rate factor is a regulation parameter used to characterize the rate of temperature change in different training stages. During training, the corresponding temperature regulation rate factor is obtained by querying or calculating the round number parameter mapping relationship based on the current training round number. Specifically, the training round number can be divided into multiple intervals, with a larger temperature regulation rate factor in the initial training stage and a gradually decreasing temperature regulation rate factor in subsequent training stages.

[0046] In step S402 of some embodiments, nonlinear mapping refers to the process of converting the number of training rounds and the temperature adjustment rate factor through a nonlinear function. The rate smoothing factor is a parameter obtained after nonlinear mapping to control the smoothness of temperature changes, wherein the rate smoothing factor can be expressed as... ,in, represents the temperature regulation rate factor, t represents the number of training rounds, and · represents the multiplication operation.

[0047] In step S403 of some embodiments, the model temperature parameters are a set of parameters used to define the range of temperature coefficient values, including the minimum value of the temperature coefficient. and the maximum value of the temperature coefficient ,in Used to determine the initial value of the temperature coefficient. Both the upper limit of the temperature coefficient and the upper limit are preset values. In this embodiment, It can be 1.5. It can be 8.0. The calculation process for the target temperature coefficient can refer to the following analytical formula: (1), in, Indicates the target temperature coefficient. This represents the minimum value of the temperature coefficient. This represents the maximum value of the temperature coefficient. Represents the rate smoothing factor. represents the temperature regulation rate factor, t represents the number of training rounds, and · represents the multiplication operation.

[0048] Steps S401 to S403 as shown in the embodiments of this application establish a mapping relationship between the number of training rounds and temperature parameters, and introduce a temperature regulation rate factor and a rate smoothing factor to constrain the temperature change process. This makes the target temperature coefficient exhibit dynamic changes with the training process, thereby effectively improving the accuracy and stability of the student detection model in representing abnormal features. Even with small sample data and input perturbations, it can still maintain high anomaly detection accuracy, ultimately improving the reliability of anomaly detection results.

[0049] In step S303 of some embodiments, please refer to Figure 5 Step S303 may include, but is not limited to, steps S501 to S502: Step S501: Calculate the interlayer loss value based on the reference features of the first target unit and the intermediate features of the second target unit; Step S502: Calculate the distillation loss value based on the target temperature coefficient and the interlayer loss value.

[0050] In step S501 of some embodiments, the interlayer loss value may be the mean square error between the reference features of the first target cell and the intermediate features of the second target cell in the same order.

[0051] In step S502 of some embodiments, the calculation of the distillation loss value can refer to the following analytical expression: (2), Where L represents the distillation loss value, This represents the cross-entropy loss between the student detection model output and the true label. This represents the sum of interlayer loss values. Indicates the target temperature coefficient. This represents the weighting coefficient, which is a preset value. In this embodiment, the weighting coefficient can be 0.6.

[0052] Steps S501 to S502, as illustrated in this embodiment, involve measuring the interlayer difference between the reference features of the first target unit and the intermediate features of the second target unit to construct an interlayer loss value reflecting the deviation of features at different levels. Furthermore, a target temperature coefficient is introduced to adjust the interlayer loss value, enabling the distillation loss value to simultaneously reflect the degree of feature difference and the characteristics of the training phase. This achieves adaptive constraints on key level features during training. Through this technical solution, the student detection model's ability to fit multi-level features of the teacher detection model can be improved, enhancing the student detection model's accuracy in expressing abnormal features. This also improves the stability and accuracy of anomaly detection results under conditions of small sample data and input perturbations, thereby enhancing the application effect of the distilled model in actual anomaly detection scenarios.

[0053] In step S304 of some embodiments, an optimization objective is constructed based on the distillation loss value, the gradient is calculated through backpropagation, and an optimization algorithm is used to iteratively update the parameters of the second target unit. For example, in the anomaly detection task of insurance policy images, the distillation loss value is used as the optimization objective, and the gradient descent algorithm is used to update the convolution kernel parameters in the second target unit, so that the intermediate features output by the second target unit gradually approximate the reference features output by the corresponding first target unit.

[0054] Steps S301 to S304 as illustrated in the embodiments of this application introduce a similarity-based screening mechanism among multiple inference units to determine the first target unit that contributes more to the anomaly detection task, and apply targeted distillation constraints to the corresponding second target unit. At the same time, the target temperature coefficient is dynamically adjusted in conjunction with the number of training rounds, so that the distillation process has differentiated feature alignment capabilities at different training stages. This enables the student detection model to fully learn the feature expression rules of the teacher detection model at key levels, reduce the interference of redundant features on model training, and improve distillation efficiency.

[0055] After step S205 in some embodiments, please refer to Figure 6 The anomaly detection method in this application embodiment may also include, but is not limited to, steps S601 to S603: Step S601: Based on the reference features of the last first reasoning unit, perform probability prediction to obtain the first answer probability distribution, and based on the intermediate features of the last second reasoning unit, perform probability prediction to obtain the second answer probability distribution; Step S602: Evaluate the importance of the sample input data based on the sample input data, the probability distribution of the first answer, and the probability distribution of the second answer, and obtain an importance score; Step S603: Return to the obtained sample input data, and select target sample data from the preset sample database according to the importance score. Replace the sample input data according to the target sample characteristics, and update the target anomaly detection model according to the target sample characteristics until the distillation loss value meets the preset iteration termination condition.

[0056] In step S601 of some embodiments, the first answer probability distribution is the probability output result obtained after classification mapping based on the reference features of the last first inference unit, and the second answer probability distribution is the probability output result obtained after classification mapping based on the intermediate features of the last second inference unit, that is, the probability representation of the corresponding category.

[0057] In step S602 of some embodiments, the importance score is a quantitative indicator used to characterize the contribution of sample input data to the learning performance of the student detection model during the knowledge distillation process.

[0058] Please see Figure 7 In some embodiments, step S602 includes, but is not limited to, steps S701 to S704: Step S701: Calculate the divergence based on the probability distribution of the first answer and the probability distribution of the second answer to obtain the probability distribution divergence data; Step S702: Obtain benchmark sample data from the sample database, and infer the benchmark sample data through at least two cascaded first inference units to obtain the benchmark inference features output by each first inference unit. Step S703: Evaluate the degree of difference based on the baseline inference features and reference features to obtain the feature difference coefficient; Step S704: Calculate the importance score based on the probability distribution divergence data and the feature difference coefficient.

[0059] In step S701 of some embodiments, the probability distribution divergence data is a numerical representation used to measure the degree of difference between the first answer probability distribution and the second answer probability distribution. The probability distribution divergence data can be calculated as the KL divergence between the first answer probability distribution and the second answer probability distribution.

[0060] In step S702 of some embodiments, the sample database is a collection of data used to store historical sample features and current sample input data, and the benchmark sample data are sample features selected from the sample database for comparative analysis. The benchmark inference features are the output features of each first inference unit during the teacher detection model's inference process on the benchmark sample data.

[0061] In step S703 of some embodiments, the feature difference coefficient is a quantitative indicator used to measure the degree of difference between the baseline inference feature and the reference feature. See also... Figure 8 Step S703 may include, but is not limited to, steps S801 to S803: Step S801: Select a first reference unit from the first inference unit, and obtain the reference features and baseline inference features output by the first reference unit; Step S802: Calculate the semantic similarity between the reference feature and the baseline inference feature; Step S803: Normalize the semantic similarity to obtain the feature difference coefficient.

[0062] In step S801 of some embodiments, the first reference unit is an inference unit selected from a plurality of first inference units for performing feature comparison analysis. The first reference unit can be selected according to a preset order position of the inference units in the model structure.

[0063] In step S802 of some embodiments, semantic similarity is a metric used to measure the degree of consistency between reference features and baseline inference features in the semantic space. Reference features and baseline inference features can be uniformly mapped by a feature encoding network, and the semantic distance between them can be calculated based on the similarity metric function.

[0064] In step S803 of some embodiments, the feature difference coefficient is a quantification result obtained after normalization based on semantic similarity, which is used to unify the difference measurement scale between different samples.

[0065] Steps S801 to S803 of this embodiment involve selecting a first reference unit in the first inference unit of the teacher detection model, establishing a correspondence between reference features and benchmark inference features, and measuring the consistency of representation between the two types of features based on semantic similarity. On this basis, a stable feature difference coefficient is obtained through normalization, ensuring the comparability of the feature difference coefficient between different samples, thus providing a reliable basis for calculating importance scores. Through the above technical solution, the degree of semantic difference between the sample input data and the benchmark sample data can be effectively characterized, enhancing the sensitivity of the student detection model to changes in key features, improving the ability to distinguish abnormal features, and improving the accuracy and stability of anomaly detection under complex data distribution and perturbation conditions, thereby enhancing the application effect of the distilled model in actual anomaly detection scenarios.

[0066] Adjusting the parameters of the student detection model based on the distillation loss value refers to the process of optimizing the model parameters using the backpropagation algorithm. Specifically, the student detection model (in some embodiments, only the parameters of the second target unit in the student detection model are adjusted) is iteratively updated using the stochastic gradient descent algorithm to obtain the target anomaly detection model.

[0067] In step S604 of some embodiments, the importance score can be calculated based on the following analytical expression: (3), in, The importance score is represented by f(x), the reference feature is represented by f(x′), and the baseline inference feature is represented by f(x′). Represents the probability distribution divergence data. Let represent the feature difference coefficient, p represent the probability distribution of the first answer, and q represent the probability distribution of the second answer.

[0068] Steps S701 to S704 of this embodiment quantify the difference between the probability distribution of the first answer and the probability distribution of the second answer to obtain probability distribution divergence data reflecting the degree of difference in model prediction. A benchmark sample data is introduced to construct a comparison reference. The feature difference coefficient is obtained by evaluating the difference between the benchmark inference features and the reference features. On this basis, the difference information at the probability distribution level and the difference information at the feature level are fused to obtain an importance score that comprehensively reflects the contribution of the sample to knowledge transfer, thereby realizing the refined screening and utilization of sample input data. Through the above technical solution, the student detection model can improve its attention to key sample features, enhance its ability to distinguish abnormal features, and improve the accuracy and stability of anomaly detection in complex abnormal scenarios and data distribution changes, thereby improving the detection performance of the distilled model in practical applications.

[0069] In step S603 of some embodiments, the importance scores are sorted in descending order for all sample input data. A preset number of samples from the top-ranked samples can be selected, or an importance score threshold can be set to filter the sample input data. Preset iteration termination conditions may include: the distillation loss value being lower than a preset threshold, the change amplitude being less than a set range for multiple consecutive rounds, or training being terminated when the number of training rounds reaches a preset upper limit. Then, the target sample features are re-input into the student detection model and parameters are updated using the distillation loss. For example, the selected high-importance sample features are used to retrain the student detection model, enabling the model to obtain better feature representation capabilities on key samples.

[0070] Steps S601 to S603 as illustrated in this embodiment of the application involve jointly analyzing the probability distributions of the teacher detection model and the student detection model in the final inference unit, and constructing an importance assessment mechanism based on the sample input data to quantify the contribution of the sample input data in the anomaly detection process. This allows for the selection of target sample features with higher value for model training from the sample database, and the replacement and updating of the sample input data. This enables the target anomaly detection model to continuously introduce high-value sample information during iterative training, improving the model's ability to learn key features, thereby enhancing the stability and reliability of the distilled model in the anomaly detection task.

[0071] In step S206 of some embodiments, the target input data is data in a real-world application scenario that needs to be detected for anomalies, and may include at least one of images and text. Anomaly detection of target input data based on a target anomaly detection model refers to the process of using a trained target anomaly detection model to extract and discriminate features from the target input data to identify abnormal regions or patterns. For example, in the fintech field, the target input data may be an insurance policy image; the target anomaly detection model analyzes the policy image to identify anomalies such as text tampering, field misalignment, or forged seals. In a medical scenario, the target input data may be a medical image; the target anomaly detection model analyzes the medical image and symptom-related text descriptions to accurately identify lesion areas and mark them as abnormal areas.

[0072] Please see Figure 9 This application also provides an anomaly detection device that can implement the above-described anomaly detection method. The device includes: The model acquisition module 901 is used to acquire the teacher detection model and the student detection model; wherein, the teacher detection model includes at least two cascaded first inference units, and the student detection model includes at least two cascaded second inference units, and the number of first inference units and second inference units is the same; The first inference module 902 is used to acquire sample input data, wherein the sample input data includes at least one of text and images, and to infer the sample input data through at least two cascaded first inference units to obtain reference features output by each first inference unit; wherein the reference features output by each first inference unit are used as input features of the next first inference unit. The second inference module 903 is used to infer sample input data through at least two cascaded second inference units to obtain intermediate features output by each second inference unit; wherein the intermediate features output by each second inference unit are used as input features of the next second inference unit. The similarity calculation module 904 is used to calculate the similarity between reference features and intermediate features for first and second inference units with the same sequential sequence. Model adjustment module 905 is used to calculate the distillation loss value based on similarity, reference features and intermediate features, and adjust the parameters of the student detection model based on the distillation loss value to obtain the target anomaly detection model; The third inference module 906 is used to acquire target input data and perform anomaly detection on the target input data based on the target anomaly detection model.

[0073] The specific implementation of this anomaly detection device is basically the same as the specific implementation of the anomaly detection method described above, and will not be repeated here.

[0074] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described anomaly detection method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0075] Please see Figure 10 , Figure 10 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 1001 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 1002 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 1002 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1002 and is called and executed by the processor 1001 using the anomaly detection method of the embodiments of this application. Input / output interface 1003 is used to implement information input and output; The communication interface 1004 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 1005 transmits information between various components of the device (e.g., processor 1001, memory 1002, input / output interface 1003, and communication interface 1004); The processor 1001, memory 1002, input / output interface 1003 and communication interface 1004 are connected to each other within the device via bus 1005.

[0076] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described anomaly detection method.

[0077] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0078] The anomaly detection method, device, electronic equipment, and storage medium provided in this application establish a hierarchical correspondence between the teacher detection model and the student detection model across multiple cascaded inference units. They also calculate the similarity between reference features and intermediate features output by inference units of the same sequence. This allows the student detection model to learn the feature extraction and layer-by-layer representation process of the input data at different levels from the teacher detection model during training. This compensates for the information loss caused by relying solely on output layer alignment, ultimately improving the student detection model's ability to represent structural information and fine-grained features. The target anomaly detection model obtained through the method distillation in this embodiment can more accurately identify lesion areas in medical image anomaly recognition scenarios and more stably identify anomalies such as text tampering, field misalignment, and layout abnormalities in insurance policy image anomaly detection scenarios. Furthermore, it maintains high detection accuracy even with small sample data and input perturbations, ultimately effectively improving the anomaly detection performance of the target anomaly detection model when deployed on edge devices.

[0079] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0080] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0081] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0082] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0083] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0084] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0085] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0086] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0087] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0088] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0089] It should be noted that any AI models, software tools, or components not belonging to this company appearing in the embodiments of this application are merely illustrative examples and do not represent actual use. All user personal information involved in the embodiments of this application has been authorized (with the knowledge and consent) by the relevant parties or has been fully authorized by all parties, and the executing entity may obtain it through various legal and compliant means. The collection, storage, use, processing, transmission, provision, and disclosure of the information, data, and signals involved all comply with relevant laws and regulations and do not violate public order and good morals.

[0090] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. An anomaly detection method, characterized in that, The method includes: Obtain a teacher detection model and a student detection model; wherein the teacher detection model includes at least two cascaded first inference units, and the student detection model includes at least two cascaded second inference units, and the number of the first inference units and the number of the second inference units are the same; Acquire sample input data, wherein the sample input data includes at least one of text and image, and infer the sample input data through at least two cascaded first inference units to obtain reference features output by each first inference unit; wherein the reference features output by each first inference unit are used as input features of the next first inference unit. The sample input data is inferred by at least two cascaded second inference units to obtain intermediate features output by each second inference unit; wherein, the intermediate features output by each second inference unit are used as input features of the next second inference unit. For the first inference unit and the second inference unit with the same sequential sequence, calculate the similarity between the reference feature and the intermediate feature; The distillation loss value is calculated based on the similarity, the reference feature, and the intermediate feature, and the parameters of the student detection model are adjusted based on the distillation loss value to obtain the target anomaly detection model; Obtain target input data and perform anomaly detection on the target input data based on the target anomaly detection model.

2. The method according to claim 1, characterized in that, After adjusting the parameters of the student detection model based on the distillation loss value to obtain the target anomaly detection model, the method further includes: Based on the reference features of the last first reasoning unit, a probability prediction is made to obtain the first answer probability distribution, and based on the intermediate features of the last second reasoning unit, a probability prediction is made to obtain the second answer probability distribution. The importance of the sample input data is evaluated based on the sample input data, the probability distribution of the first answer, and the probability distribution of the second answer, to obtain an importance score; The process involves returning to the acquired sample input data, filtering target sample data from a preset sample database based on the importance score, replacing the sample input data according to the target sample features, and updating the target anomaly detection model according to the target sample features, until the distillation loss value meets a preset iteration termination condition.

3. The method according to claim 2, characterized in that, The step of evaluating the importance of the sample input data based on the sample input data, the probability distribution of the first answer, and the probability distribution of the second answer to obtain an importance score includes: Divergence is calculated based on the probability distributions of the first and second answers to obtain probability distribution divergence data. Benchmark sample data is obtained from the sample database, and inference is performed on the benchmark sample data through at least two cascaded first inference units to obtain benchmark inference features output by each first inference unit; wherein the benchmark sample data is different from the sample input data; The degree of difference is evaluated based on the baseline inference features and the reference features to obtain the feature difference coefficients; The importance score is calculated based on the probability distribution divergence data and the feature difference coefficient.

4. The method according to claim 3, characterized in that, The step of evaluating the degree of difference based on the benchmark inference features and the reference features to obtain feature difference coefficients includes: Select a first reference unit from the first inference unit, and obtain the reference feature and the benchmark inference feature output by the first reference unit; Calculate the semantic similarity between the reference feature and the baseline inference feature; The semantic similarity is normalized to obtain the feature difference coefficient.

5. The method according to claim 1, characterized in that, The step of calculating a distillation loss value based on the similarity, the reference feature, and the intermediate feature, and adjusting the parameters of the student detection model based on the distillation loss value to obtain a target anomaly detection model includes: Based on the similarity, a first target unit is selected from the first reasoning unit, and a second reasoning unit whose sequence is the same as that of the first target unit is determined as the second target unit; The target temperature coefficient is obtained based on the number of training rounds of the target anomaly detection model; The distillation loss value is calculated based on the target temperature coefficient, the reference characteristics of the first target unit, and the intermediate characteristics of the second target unit; The parameters of the second target unit are adjusted based on the distillation loss value to obtain the target anomaly detection model.

6. The method according to claim 5, characterized in that, The step of obtaining the target temperature coefficient based on the number of training epochs of the target anomaly detection model includes: The temperature regulation rate factor is obtained by querying the preset mapping relationship between the training rounds and the preset rounds parameter. A rate smoothing factor is obtained by performing a nonlinear mapping based on the number of training rounds and the temperature regulation speed factor. The target temperature coefficient is calculated based on the rate smoothing factor and the preset model temperature parameters.

7. The method according to claim 5, characterized in that, The step of calculating the distillation loss value based on the target temperature coefficient, the reference characteristics of the first target unit, and the intermediate characteristics of the second target unit includes: The interlayer loss value is calculated based on the reference features of the first target unit and the intermediate features of the second target unit; The distillation loss value is calculated based on the target temperature coefficient and the interlayer loss value.

8. An anomaly detection device, characterized in that, The device includes: The model acquisition module is used to acquire a teacher detection model and a student detection model; wherein the teacher detection model includes at least two cascaded first inference units, and the student detection model includes at least two cascaded second inference units, and the number of the first inference units and the number of the second inference units are the same. A first inference module is used to acquire sample input data, wherein the sample input data includes at least one of text and images, and to infer the sample input data through at least two cascaded first inference units to obtain reference features output by each first inference unit; wherein the reference features output by each first inference unit are used as input features of the next first inference unit. The second inference module is used to infer the sample input data through at least two cascaded second inference units to obtain intermediate features output by each second inference unit; wherein the intermediate features output by each second inference unit are used as input features of the next second inference unit. A similarity calculation module is used to calculate the similarity between the reference feature and the intermediate feature for the first inference unit and the second inference unit with the same sequential sequence. A model adjustment module is used to calculate a distillation loss value based on the similarity, the reference feature, and the intermediate feature, and to adjust the parameters of the student detection model based on the distillation loss value to obtain a target anomaly detection model. The third reasoning module is used to acquire target input data and perform anomaly detection on the target input data based on the target anomaly detection model.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images