Interactive attack test and optimization

Abstract

An interactive attack test method, comprising: performing at least one attack on a human-machine identification model deployed in a target terminal, wherein each attack comprises: determining an attack policy on the basis of an attack policy model, the attack policy comprising an action parameter for executing a preset interaction action (S100); grabbing the target terminal by means of a robotic arm, and executing the interaction action for the target terminal on the basis of the attack policy, so as to realize an attack on the human-machine identification model deployed in the target terminal (S102); determining a reward on the basis of a response of the human-machine identification model to the attack (S104); determining environmental information on the basis of attitude data of the target terminal in the process of being attacked (S106); and using reinforcement learning to update the attack policy model on the basis of the reward and the environmental information, so as to obtain a new attack policy (S108).

Description

Interactive attack testing and optimization Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an interactive attack testing method, an optimization method and a device. Background Art

[0002] In barrier-free human-machine identification scenarios, human-machine identification can be determined by having users perform fixed actions on their mobile devices, such as shaking them, and then collecting sensor data from the mobile device during the action. This type of human-machine identification mechanism is vulnerable to presentational attacks, where attackers use automated means such as robotic arms to complete specified actions and defeat the human-machine identification mechanism. Typically, robotic arms are used to simulate attack actions and collect attack data. This data can then be used to optimize the human-machine identification mechanism of the mobile device to a certain extent. However, this type of attack simulation relies on predefined attack actions, and therefore has very limited ability to improve the human-machine identification mechanism of the mobile device.

[0003] Summary of the Invention

[0004] One of the purposes of the present invention is to provide an interactive attack testing method, which enables a robotic arm to automatically attack a human-machine recognition model and adjust the attack strategy according to the human-machine recognition results, thereby effectively improving the attack efficiency.

[0005] According to the above-mentioned invention purpose, the embodiment of this specification proposes an interactive attack testing method, including performing at least one attack on a human-machine recognition model deployed in a target terminal; wherein each attack includes: determining an attack strategy based on an attack strategy model, the attack strategy including action parameters for executing a preset interactive action; grabbing the target terminal by a robotic arm, and executing the interactive action on the target terminal based on the attack strategy to achieve an attack on the human-machine recognition model deployed in the target terminal; determining a reward based on the response of the human-machine recognition model to the attack; determining environmental information based on the posture data of the target terminal during the attack process; and using reinforcement learning to update the attack strategy model based on the reward and the environmental information to obtain a new attack strategy.

[0006] The interactive attack testing method proposed in the embodiments of this specification uses an attack strategy model to derive an attack strategy. A robotic arm controls the target terminal to execute the attack strategy on the human-machine recognition model. Based on the results returned by the human-machine recognition model and the target terminal's posture, the attack strategy model is updated using reinforcement learning to generate a more aggressive attack strategy. After several rounds of attacks, the generated attack strategy has wider attack coverage and stronger attack effects, effectively testing the anti-attack capabilities of the human-machine recognition model. This process is highly automated, saving costs while improving the testing efficiency of the human-machine recognition model.

[0007] Furthermore, in some embodiments, determining a reward based on the response of the human-machine recognition model to the attack specifically includes: determining a reward signal in response to the human-machine recognition model being hacked; and determining a penalty signal in response to the human-machine recognition model not being hacked.

[0008] Furthermore, in some embodiments, determining the environmental information based on the posture data of the target terminal during the attack process specifically includes: for each attack, collecting the posture data of the target terminal during the attack process through a posture sensor; based on the posture data, determining the posture change feature vector of the target terminal during the attack process, and using the posture change feature vector as the environmental information.

[0009] Another object of the present invention is to provide an optimization method that can use the collected attack data to optimize the human-machine recognition model, effectively enhancing the model's ability to resist presentation attacks.

[0010] According to the above-mentioned invention purpose, the embodiment of this specification proposes an optimization method, which includes continuously performing up to N rounds of optimization on the human-machine recognition model deployed in the target terminal until the attack rate of the human-machine recognition model is lower than a preset first threshold; wherein, each round of optimization includes: using any one of the methods described in the above-mentioned interactive attack testing methods to attack the human-machine recognition model until an attack strategy model that meets the preset attack rate condition is obtained; based on the attack strategy generated by the attack strategy model that meets the preset attack rate condition, continuously attacking the human-machine recognition model and obtaining attack data when the human-machine recognition model is broken; optimizing the human-machine recognition model based on the attack data.

[0011] The optimization method provided in the embodiments of this specification uses an attack strategy model that can stably and spontaneously generate attack data to test and optimize the anti-attack ability of the human-machine recognition model. In each round of optimization, the face recognition model is updated according to the attack data to improve its ability to resist presentation attacks. After several rounds of optimization, a human-machine recognition model that can effectively defend against presentation attacks is obtained.

[0012] Furthermore, in some embodiments, the human-machine recognition model is pre-trained in the following manner: obtaining the posture data of the target terminal during the human-machine interaction process as a positive sample, and adding a positive sample label; obtaining the posture data of the target terminal during the machine attack process as a negative sample, and adding a negative sample label; based on the positive sample, the positive sample label, the negative sample and the negative sample label, training the pre-constructed model until a human-machine recognition model that meets the preset conditions is obtained.

[0013] Furthermore, in some embodiments, obtaining an attack strategy model that satisfies a preset attack rate condition specifically includes: obtaining the number of times the robotic arm breaks through the human-machine recognition model and the total number of times the attack is carried out within a target time period based on the current attack strategy; determining the attack rate based on the number of attacks and the total number of attacks; and determining whether the attack strategy model satisfies the attack rate condition based on the attack rate and a preset second threshold, wherein the second threshold is greater than the first threshold.

[0014] Furthermore, in some embodiments, optimizing the human-machine identification model based on the attack data specifically includes: using the attack data as a negative sample and adding a negative sample label; and training the human-machine identification model based on the attack data and the negative sample label.

[0015] An embodiment of this specification also provides an interactive attack testing device, including: an attack strategy generation module, configured to determine an attack strategy based on an attack strategy model; and using reinforcement learning to update the attack strategy model based on a reinforcement signal fed back by a target terminal to obtain a new attack strategy; the reinforcement signal includes: environmental information determined based on the posture data of the target terminal during the attack process, and a reward determined based on the response of a human-machine recognition model deployed in the target terminal after being attacked; a robotic arm, configured to grab the target terminal and, based on the attack strategy generated by the attack strategy generation module, apply corresponding interactive actions to the target terminal to achieve an attack on the human-machine recognition model.

[0016] An embodiment of the present specification also provides an optimization device, comprising: the interactive attack testing device, a control module and an optimization module as described above; the control module is configured to control the interactive attack device to perform multiple rounds of attacks on the human-machine recognition model; for each round of attack, when the attack strategy model meets a preset attack rate condition, the attack strategy generated based on the attack strategy model that meets the preset attack rate condition is used to continuously attack the human-machine recognition model, and obtain attack data for breaking the human-machine recognition model; the optimization module is configured to optimize the human-machine recognition model based on the attack data corresponding to each round of attack until the attack rate of the human-machine recognition model is lower than a preset first threshold.

[0017] Furthermore, in some embodiments, the optimization module is specifically used to use the attack data as a negative sample and add a negative sample label; based on the attack data and the negative sample label, the human-machine recognition model is trained to achieve optimization of the human-machine recognition model.

[0018] An embodiment of the present specification also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements at least one attack on a human-machine recognition model deployed in a target terminal; wherein each attack includes: determining an attack strategy based on an attack strategy model, the attack strategy including action parameters for executing a preset interactive action; controlling a robotic arm to grasp the target terminal, and executing the interactive action on the target terminal based on the attack strategy, so as to implement an attack on the human-machine recognition model deployed in the target terminal; determining a reward based on the response of the human-machine recognition model to the attack; determining environmental information based on the posture data of the target terminal during the attack; and using reinforcement learning to update the attack strategy model based on the reward and the environmental information to obtain a new attack strategy.

[0019] An embodiment of this specification also provides an interactive attack testing device, comprising: one or more processors; and a memory associated with the one or more processors, the memory being used to store program instructions, wherein when the program instructions are read and executed by the one or more processors, the one or more processors enable the one or more processors to implement at least one attack on the human-machine recognition model deployed in the target terminal; wherein each attack includes: determining an attack strategy based on an attack strategy model, the attack strategy including action parameters for executing preset interactive actions; controlling a robotic arm to grasp the target terminal, and executing the interactive action on the target terminal based on the attack strategy to implement an attack on the human-machine recognition model deployed in the target terminal; determining a reward based on the response of the human-machine recognition model to the attack; determining environmental information based on the posture data of the target terminal during the attack process; and using reinforcement learning to update the attack strategy model based on the reward and the environmental information to obtain a new attack strategy.

[0020] An embodiment of the present specification also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements up to N rounds of continuous optimization of the human-machine recognition model deployed in the target terminal until the attack rate of the human-machine recognition model is lower than a preset first threshold; wherein each round of optimization includes: attacking the human-machine recognition model using any one of the methods described in the above-mentioned interactive attack testing methods until an attack strategy model that meets a preset attack rate condition is obtained; continuously attacking the human-machine recognition model based on the attack strategy generated by the attack strategy model that meets the preset attack rate condition, and obtaining attack data when the human-machine recognition model is broken; and optimizing the human-machine recognition model based on the attack data.

[0021] An embodiment of this specification also provides an optimization device, comprising: one or more processors; and a memory associated with the one or more processors, the memory being used to store program instructions, wherein when the program instructions are read and executed by the one or more processors, the one or more processors enable the one or more processors to continuously perform up to N rounds of optimization on the human-machine recognition model deployed in the target terminal until the attack rate of the human-machine recognition model is lower than a preset first threshold; wherein each round of optimization includes: attacking the human-machine recognition model using any one of the methods described in the above-mentioned interactive attack testing methods until an attack strategy model that meets a preset attack rate condition is obtained; continuously attacking the human-machine recognition model based on the attack strategy generated by the attack strategy model that meets the preset attack rate condition, and obtaining attack data when the human-machine recognition model is broken; and optimizing the human-machine recognition model based on the attack data.

[0022] The beneficial effect of the interactive attack testing method described in the embodiment of this specification is that the robotic arm automatically attacks the human-machine recognition model based on the attack strategy generated by the attack strategy model, and uses reinforcement learning to update the attack strategy model according to the results returned by the human-machine recognition model and the posture of the target terminal, so that it generates a more aggressive attack strategy. After several rounds of attacks, the generated attack strategy has a wider attack coverage and a stronger attack effect, which can effectively test the anti-attack ability of the human-machine recognition model. The optimization method described in the embodiment of this specification uses an attack strategy model that can stably and spontaneously generate attack data to test and optimize the anti-attack ability of the human-machine recognition model. In each round of optimization, the face recognition model is updated according to the attack data to improve its resistance to presentation attacks. After several rounds of optimization, a human-machine recognition model that can effectively defend against presentation attacks is obtained.

[0023] The interactive attack testing device and optimization device described in the embodiments of this specification also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] FIG1 exemplarily shows a schematic diagram of an interactive attack testing system according to an embodiment of this specification.

[0026] FIG2 exemplarily shows a flow chart of an interactive attack testing method according to an embodiment of this specification in one implementation manner.

[0027] FIG3 exemplarily shows a flow chart of the optimization method described in the examples of this specification in one implementation manner.

[0028] FIG4 exemplarily shows a structural block diagram of an interactive attack testing device according to an embodiment of this specification in one implementation manner.

[0029] FIG5 exemplarily shows a structural block diagram of an optimization device according to an embodiment of this specification in one implementation manner.

[0030] FIG6 exemplarily shows a structural diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0031] First, it should be noted that the terms used in the embodiments of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. As used in the embodiments of the present invention and the appended claims, the singular forms "a," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise.

[0032] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Therefore, it should be recognized by those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0033] It should be noted that in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the method may include more or fewer steps than those described in this specification. In addition, a single step described in this specification may be broken down into multiple steps for description in other embodiments, and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0034] With the development of automation and artificial intelligence technologies, more and more tasks can be calculated using trained and optimized models. The results are then fed into machines, allowing them to simulate user actions. In barrier-free human-machine identification scenarios, this can be achieved by having users perform fixed actions on their mobile devices, such as "shaking" to grab red envelopes or match friends. Sensor data from the mobile devices during these actions is then collected to determine if the user is the real human or the real machine. However, these human-machine identification mechanisms are vulnerable to presentational attacks, where attackers use automated means such as robotic arms to control mobile devices, impersonating users and performing specific actions in order to defeat the human-machine identification mechanism. This can easily lead to resource loss and system disruption. Typically, robotic arms can be used to simulate attack actions and collect attack data. This data can then be used to test and optimize the human-machine identification mechanism of mobile devices to improve their anti-attack capabilities. To make these attack methods independent of predefined attack data, a testing solution with wider attack coverage is desired, providing greater room for improvement in the human-machine identification mechanism of mobile devices.

[0035] Therefore, one or more embodiments of the present invention provide an interactive attack testing method. Please refer to Figure 1, which exemplifies an interactive attack testing system that can be used to implement this interactive attack testing method. It should be noted that the interactive attack testing method described in one or more embodiments of this application can be implemented using the interactive attack testing system shown in Figure 1, but is not limited to this interactive attack testing system.

[0036] As shown in Figure 1, the interactive attack test system includes a target terminal, a robotic arm, and a control terminal.

[0037] The target terminal is grasped by the robotic arm to perform the corresponding interactive action, and the control end controls the robotic arm to grasp the target terminal and perform the interactive action through a communication link. The communication link can be a wired network or a wireless network. For example, the robotic arm can establish a communication connection with the control end using communication methods such as WIFI, Bluetooth, and infrared. Alternatively, the robotic arm can also establish a communication connection with the control end through a mobile network, wherein the network standard of the mobile network can be any one of 2G (GSM), 2.5G (GPRS), 3G (WCDMA, TD-SCDMA, CDMA2000, UTMS), 4G (LTE), 4G+ (LTE+), WiMax, etc.

[0038] The target terminal is a mobile terminal, such as a mobile phone, laptop, iPad, etc. A front-end APP with human-machine recognition function is installed in the target terminal. The APP performs human-machine recognition based on the posture information of the target terminal through the human-machine recognition model deployed in the target terminal.

[0039] The robotic arm executes the attack strategy under the control of the control end, and completes the attack on the human-machine recognition model in the target terminal by grabbing the target terminal and executing the corresponding interactive actions in the attack strategy.

[0040] The control terminal can be a controller built into the robotic arm, or it can be additionally provided externally to the robotic arm, for generating an attack strategy based on the attack strategy model and controlling the robotic arm to execute the attack strategy. The control terminal can be any device, equipment, platform, or device cluster with computing and processing capabilities. In this embodiment, the implementation form of the control terminal is not limited. For example, the control terminal can be a single server or a server cluster composed of multiple servers. The control terminal can also be a cloud server, also known as a cloud computing server or cloud host, which is a host product in a cloud computing service system.

[0041] Reinforcement learning is a mechanism by which an intelligent agent learns strategies to maximize rewards or achieve specific goals during its interaction with the environment. By combining a robotic arm and reinforcement learning, the robotic arm is used as an intelligent agent. The control end controls the robotic arm to interactively attack the human-machine recognition model in the target terminal based on the attack strategy generated by the attack strategy model to test the anti-attack capability of the human-machine recognition model deployed in the target terminal. The control end optimizes the deployed attack strategy model based on the received human-machine recognition results and related environmental information to generate an attack strategy that can more effectively attack the human-machine recognition model and improve the attack efficiency. The human-machine recognition model in the target terminal can use the collected attack data to continuously optimize the model to have a stronger ability to resist attacks.

[0042] The passive face-swiping behavior detection method and device described in the embodiments of this specification will be further described in detail below in conjunction with the accompanying drawings and specific embodiments of the specification, but this detailed description does not constitute a limitation to the embodiments of this specification.

[0043] Corresponding to the above interactive attack test system, in one embodiment of this specification, an interactive attack test method is proposed. FIG2 exemplarily shows a flow chart of the interactive attack test method described in an embodiment of this specification in one implementation manner.

[0044] As shown in FIG2 , the interactive attack testing method includes performing at least one attack on the human-machine recognition model deployed in the target terminal; wherein each attack includes the following steps.

[0045] S100: Determine an attack strategy based on an attack strategy model, where the attack strategy includes action parameters for executing a preset interactive action.

[0046] The attack strategy can be used to determine the parameters of the preset interactive action executed when testing the anti-attack capabilities of the human-machine recognition model deployed on the target terminal. For example, when the preset interactive action is "shake," the attack strategy can include at least one of the target terminal's shaking amplitude, shaking duration, or shaking speed. Different action parameters can produce different interactive actions and thus correspond to different attack effects. Therefore, the attack strategy can be adjusted to achieve the preset attack effect, thereby more effectively testing the anti-attack capabilities of the human-machine recognition model.

[0047] The attack strategy model is used to classify tasks based on the different states of the input robotic arm, thereby outputting corresponding attack strategies for the robotic arm to execute. During the classification process, the action parameters of the preset interactive actions that the robotic arm needs to perform are determined. In some embodiments, the attack strategy model can be constructed based on a neural network model, such as a multilayer perceptron (MLP) model. Optionally, gradient descent can be used for model optimization to easily and quickly obtain the desired attack strategy model.

[0048] In some more specific embodiments, an attack strategy model is constructed based on the MLP model structure to obtain an MLP attack strategy model. The current state of the robotic arm is input into the MLP attack strategy model, and an attack strategy is output through a multi-classification task. The attack strategy includes at least one of the amplitude, duration, and speed of the shaking of the robotic arm when grasping the target terminal and performing a "shake" action.

[0049] S102: Grab the target terminal through the robotic arm and perform interactive actions on the target terminal based on the attack strategy to achieve an attack on the human-machine recognition model deployed in the target terminal.

[0050] The attack strategy generated by the attack strategy model can be executed by injecting it into a robotic arm, which grabs the target terminal and performs corresponding interactive actions based on the action parameters determined by the attack strategy. For example, the robotic arm grabs the target terminal and performs a "shake" action based on the shaking amplitude, shaking duration or shaking speed determined by the attack strategy, so as to disguise itself as a user to interact and perform at least one attack on the human-computer recognition model deployed in the target terminal.

[0051] Target terminals include, but are not limited to, sensor-equipped mobile devices such as smartphones and smartwatches. These sensors can identify interactive actions by capturing changes in the target terminal's posture, analyzing them to obtain corresponding action parameters, which are then transmitted to a human-machine identification model within the target terminal to determine whether the subject performing the interactive action is a human or a machine. The human-machine identification model can be a binary classification model, which outputs a classification result that indicates whether the subject performing the interactive action is a user or a machine.

[0052] S104: Determine a reward based on the response of the human-machine recognition model to the attack.

[0053] The attack strategy executed by the robotic arm to grasp the target terminal is analyzed by sensors within the target terminal to obtain sensor data corresponding to the interaction actions of the attack strategy. This sensor data is then fed into the human-machine recognition model to generate a response. The human-machine recognition model then determines whether the target is a user or a machine. If the target is determined to be a user, the robotic arm's impersonation attack is successful, and the human-machine recognition model is compromised. In other words, the human-machine recognition model is unable to accurately determine whether the target is a human or a machine. Conversely, if the target is determined to be a machine, the human-machine recognition model has not been compromised and is able to identify the robotic arm's counterfeit attack.

[0054] In some embodiments, a reward is determined based on the response of the human-machine recognition model to the attack, specifically including: determining a reward signal in response to the human-machine recognition model being hacked; determining a penalty signal in response to the human-machine recognition model not being hacked.

[0055] When the human-machine recognition model is compromised, it indicates that the attack strategy generated by the attack strategy model successfully disguises the user to complete the attack. The attack strategy has a certain attack effect. Therefore, a reward signal is determined to mark the action parameters contained in the attack strategy that can perform an effective attack.

[0056] When the human-machine recognition model is not broken, it means that the simulation of the attack strategy is not strong enough to effectively attack the human-machine recognition model. Therefore, a penalty signal is determined to mark the action parameters with weak offensiveness.

[0057] The reward signal or penalty signal determined based on the response of the human-machine recognition model to the attack helps to optimize the attack strategy, so that it can refer to and learn from historical attack data during the update of the attack strategy, thereby generating a more aggressive attack strategy with wider attack coverage, so as to more effectively test the human-machine recognition model in the target terminal's ability to resist presentation attacks.

[0058] S106: Determine environmental information based on the posture data of the target terminal during the attack process.

[0059] In some embodiments, environmental information is determined based on the posture data of the target terminal during the attack process, specifically including: for each attack, collecting the posture data of the target terminal during the attack process through a posture sensor; based on the posture data, determining the posture change feature vector of the target terminal during the attack process, and using the posture change feature vector as environmental information.

[0060] During each attack, the target terminal's posture data reflects its rotation or displacement changes along various axes. This data can be collected by the target terminal's posture sensor, and the posture change feature vector corresponding to this data can be further extracted as environmental information. This environmental information represents the interactive actions performed by the target terminal under the control of the robotic arm under the attack strategy generated by the attack strategy model, reflecting the effectiveness of the attack strategy.

[0061] S108: Using reinforcement learning, the attack strategy model is updated based on the reward and environment information to obtain a new attack strategy.

[0062] Reinforcement learning is a mechanism by which an intelligent agent learns strategies to maximize rewards or achieve specific goals during its interaction with the environment. In the embodiments of this specification, a robotic arm is used as the intelligent agent. Environmental information and rewards are determined based on the data returned by an attack on a human-machine recognition model deployed in a target terminal. During the interactive testing of the robotic arm and the human-machine recognition model, the attack strategy model is continuously learned and updated, generating more effective attack strategies. This results in an attack strategy model that can consistently break through the human-machine recognition model, thus achieving a combination of the robotic arm and reinforcement learning.

[0063] In some specific embodiments, the PPO reinforcement learning method can be used to optimize the attack strategy model.

[0064] Under the PPO method, the robotic arm is used as an intelligent agent to execute the interactive actions corresponding to the attack strategy generated by the attack strategy model to attack the human-machine recognition model deployed in the target terminal; the reward is determined based on the recognition result returned by the human-machine recognition model to mark the action parameters that can effectively break the human-machine recognition model; the environmental information is determined based on the posture data of the target terminal to determine the state of the robotic arm and the effect of the attack on the target terminal; the cross-entropy loss is determined based on the reward and environmental information, and the attack strategy model is updated with the goal of minimizing the loss. A new attack strategy is generated and executed by the robotic arm to grab the target terminal and attack the human-machine recognition model again; the above steps are repeated so that the attack strategy model continuously learns the action parameters that can effectively break the human-machine recognition model based on the reward signal, and the breakthrough rate is improved in repeated interactive attack tests until an attack strategy model that can stably break the human-machine recognition model is obtained, completing the optimization of the attack strategy model.

[0065] The interactive attack test method provided in the embodiments of this specification is that the robotic arm grabs the target terminal to execute the corresponding attack strategy and conducts at least one attack on the human-machine recognition model deployed in the target terminal. In each attack, the corresponding attack strategy is generated by the attack strategy model, which contains the action parameters of the interactive action to be performed; the human-machine recognition model makes a judgment based on the attack received, and determines the reward corresponding to the attack strategy based on this, and determines the environmental information according to the posture of the target terminal; the attack strategy is updated based on the reward and environmental information, and the robotic arm conducts the next round of attack according to the new attack strategy, and so on, until an attack strategy model that can stably break through the human-machine recognition model is obtained. The attack data is generated by the attack strategy model, so that the robotic arm can spontaneously attack the human-machine recognition model, which is conducive to realizing highly automated interactive attack testing, and the attack coverage rate is also effectively improved.

[0066] In another embodiment of the present specification, an optimization method is proposed. FIG3 exemplarily shows a flow chart of the optimization method described in an embodiment of the present specification in one implementation manner.

[0067] As shown in FIG3 , the method includes continuously optimizing the human-machine recognition model deployed in the target terminal for up to N rounds until the cracking rate of the human-machine recognition model is lower than a preset first threshold; wherein each round of optimization includes the following steps.

[0068] S200: Attacking the human-machine recognition model using any one of the above-mentioned interactive attack test methods until an attack strategy model that meets a preset attack rate condition is obtained.

[0069] In some embodiments, the human-machine recognition model is pre-trained in the following manner: obtaining the posture data of the target terminal during the human-machine interaction process as a positive sample, and adding a positive sample label; obtaining the posture data of the target terminal during the machine attack process as a negative sample, and adding a negative sample label; based on the positive samples, positive sample labels, negative samples and negative sample labels, training the pre-built model until a human-machine recognition model that meets the preset conditions is obtained.

[0070] Positive samples contain data on user interactions with the target device, while negative samples contain data on the robotic arm's interactions with the target device based on an attack strategy. These positive and negative samples are used as training samples and fed into the human-machine identification model for human-machine judgment. The model is trained to minimize the difference between the judgment result and the positive or negative sample label.

[0071] In some more specific embodiments, a human-machine recognition model may be constructed based on an RNN model, for example, a human-machine recognition model may be constructed based on an LSTM network structure.

[0072] Positive samples and corresponding positive sample labels are obtained, and the positive samples, i.e., the posture data of the target terminal during the human-computer interaction process, are input into the LSTM human-computer recognition model to obtain the recognition results. The cross-entropy loss is calculated based on the recognition results and the positive sample labels as the first loss. Negative samples and corresponding negative sample labels are obtained, and the negative samples, i.e., the posture data of the target terminal during the machine attack process, are input into the LSTM human-computer recognition model to obtain the recognition results. The cross-entropy loss is calculated based on the recognition results and the negative sample labels as the second loss. The recognition loss is calculated based on the first loss and the second loss, and the LSTM human-computer recognition model is trained with the goal of minimizing the recognition loss.

[0073] Of course, in other embodiments, a human-machine recognition model may also be constructed based on a CNN model, such as a ResNet model, or based on a Transformer model.

[0074] The pre-trained human-machine recognition model already has a certain ability to resist attacks. In order to further optimize it, it is necessary to obtain more aggressive attack data. Therefore, the attack strategy model optimized by the above interactive attack test method needs to meet a certain penetration rate so that it can effectively attack the human-machine recognition model. Based on this learning, the human-machine recognition model gains stronger resistance to attacks.

[0075] In some embodiments, obtaining an attack strategy model that meets a preset breakthrough rate condition specifically includes: obtaining the number of times the robotic arm breaks through the human-machine recognition model and the total number of attacks implemented within a target time period based on the current attack strategy; determining the breakthrough rate based on the number of breakthroughs and the total number of attacks; and determining whether the attack strategy model meets the breakthrough rate condition based on the breakthrough rate and a preset second threshold, wherein the second threshold is greater than the first threshold.

[0076] The breach rate is the ratio of the number of times the current attack strategy breaches the human-machine recognition model within the target time period to the total number of attacks carried out. It reflects the effectiveness of the attack strategy against the human-machine recognition model. The preset second threshold represents the minimum breach rate threshold that the attack strategy generated by the attack strategy model must meet. This threshold should be as high as possible. During each round of attack on the human-machine recognition model, the breach rate corresponding to the attack strategy executed in that round is calculated and compared with the second threshold. If it is higher than the second threshold, the attack strategy model has met the breach rate requirement and no further updates are required. Otherwise, the attack strategy is updated to continue with the next round of attack.

[0077] The first threshold represents the maximum attack rate threshold that the human-machine recognition model can withstand, which should be as low as possible. The attack rate of the optimized human-machine recognition model needs to be below the first threshold in order to stably resist attacks. Therefore, the second threshold is greater than the first threshold.

[0078] S202: Based on the attack strategy generated by the attack strategy model that meets the preset attack rate condition, the human-machine recognition model is continuously attacked, and attack data when the human-machine recognition model is broken is obtained.

[0079] The attack data includes the posture data of the target terminal in the process of the robotic arm grabbing the target terminal and attacking the human-machine recognition model based on the attack strategy, which can reflect the rotation or displacement changes of the target terminal on each direction axis.

[0080] S204: Optimize the human-machine recognition model based on the attack data.

[0081] The human-machine recognition model has been pre-trained and has a certain degree of anti-attack ability. However, in the face of attack strategy models with wider attack coverage and stronger aggressiveness, the human-machine recognition model needs to be further optimized for several rounds.

[0082] In some embodiments, optimizing the human-machine recognition model based on the attack data specifically includes: using the attack data as a negative sample and adding a negative sample label; and training the human-machine recognition model based on the attack data and the negative sample label.

[0083] The attack data is input as a negative sample into the pre-trained human-machine recognition model for human-machine judgment. Based on the difference between the obtained judgment result and the negative sample label, the attack rate of the human-machine recognition model under the current attack strategy is calculated, that is, the ratio of the number of times the human-machine recognition model is attacked by the current attack strategy to the total number of attacks within the target time period; in each round of optimization of the human-machine recognition model, the attack rate of the human-machine recognition model is compared with the first threshold. If it is lower than the first threshold, the human-machine recognition model can stably resist the attack of the robotic arm and the optimization can be completed. Otherwise, the next round of optimization will continue.

[0084] In some more specific embodiments, the human-machine recognition model built based on the RNN model can be optimized, for example, the human-machine recognition model built based on the LSTM network structure can be optimized.

[0085] Of course, in other embodiments, the human-machine recognition model based on the CNN model, such as the ResNet model, or the human-machine recognition model based on the Transformer model can also be optimized.

[0086] The optimization method provided in this embodiment uses an attack strategy model that meets the attack rate conditions obtained through the above-mentioned interactive attack testing method to conduct spontaneous and continuous attacks on the human-machine recognition model. The human-machine recognition model is optimized based on the attack data until the attack rate of the human-machine recognition model is lower than the preset attack rate. The attack resistance capability of the human-machine recognition model is effectively improved through model optimization.

[0087] In another embodiment of the present specification, an interactive attack testing device is also proposed. FIG4 exemplarily shows a structural block diagram of the interactive attack testing device described in an embodiment of the present specification in one implementation manner.

[0088] As shown in Figure 4, the interactive attack testing device 30 includes: an attack strategy generation module 32, configured to determine an attack strategy based on an attack strategy model; and using reinforcement learning to update the attack strategy model based on the reinforcement signal fed back by the target terminal to obtain a new attack strategy; the reinforcement signal includes: environmental information determined based on the posture data of the target terminal during the attack process, and a reward determined based on the response of the human-machine recognition model deployed in the target terminal after being attacked; a robotic arm 34, configured to grab the target terminal and, based on the attack strategy generated by the attack strategy generation module 32, apply corresponding interactive actions to the target terminal to achieve an attack on the human-machine recognition model.

[0089] The attack strategy can be used to determine the parameters of the preset interactive action executed when testing the anti-attack capabilities of the human-machine recognition model deployed on the target terminal. For example, when the preset interactive action is "shake," the attack strategy can include at least one of the target terminal's shaking amplitude, shaking duration, or shaking speed. Different action parameters can produce different interactive actions and thus correspond to different attack effects. Therefore, the attack strategy can be adjusted to achieve the preset attack effect, thereby more effectively testing the anti-attack capabilities of the human-machine recognition model.

[0090] The attack strategy model is used to classify tasks based on the different states of the input robotic arm 34, thereby outputting a corresponding attack strategy for the robotic arm 34 to execute. During the classification process, the action parameters of the preset interactive actions that the robotic arm 34 needs to perform are determined. In some embodiments, the attack strategy model can be constructed based on a neural network model, such as a multilayer perceptron (MLP) model. Optionally, a gradient descent method can be used for model optimization to easily and quickly obtain the desired attack strategy model.

[0091] In some more specific embodiments, the attack strategy generation module 32 constructs an attack strategy model based on the MLP model structure to obtain an MLP attack strategy model. The attack strategy generation module 32 inputs the current state of the robotic arm into the MLP attack strategy model and outputs an attack strategy through a multi-classification task. The attack strategy includes at least one of the amplitude, duration, and speed of the shake when the robotic arm grasps the target terminal and performs a "shake" action.

[0092] The attack strategy generation module 32 uses sensors within the target terminal to analyze the interaction actions corresponding to the attack strategy, generating sensor data. This sensor data is then fed into the human-machine recognition model, which then determines whether the target is a user or a machine. If the target is determined to be a user, the robot 34's disguised user attack is successful, and the human-machine recognition model is compromised. In other words, the human-machine recognition model is unable to accurately determine whether the target is a human or a machine. Conversely, if the target is determined to be a machine, the human-machine recognition model is intact and can identify the robot 34's counterfeit attack.

[0093] In some embodiments, the attack strategy generation module 32 determines a reward based on the response of the human-machine recognition model to the attack, specifically including: the attack strategy generation module 32 determines a reward signal in response to the human-machine recognition model being hacked; and determines a penalty signal in response to the human-machine recognition model not being hacked.

[0094] When the human-machine recognition model is compromised, it indicates that the attack strategy generated by the attack strategy model successfully disguises the user to complete the attack. The attack strategy has a certain attack effect. Therefore, a reward signal is determined to mark the action parameters contained in the attack strategy that can perform an effective attack.

[0095] When the human-machine recognition model is not broken, it means that the simulation of the attack strategy is not strong enough to effectively attack the human-machine recognition model. Therefore, a penalty signal is determined to mark the action parameters with weak offensiveness.

[0096] The reward signal or penalty signal determined based on the response of the human-machine recognition model to the attack helps to optimize the attack strategy, so that the attack strategy generation module 32 can refer to and learn historical attack data when updating the attack strategy, thereby generating an attack strategy with stronger aggressiveness and wider attack coverage, so as to more effectively test the human-machine recognition model in the target terminal's ability to resist presentation attacks.

[0097] In some embodiments, the attack strategy generation module 32 determines environmental information based on the posture data of the target terminal during the attack process, specifically including: for each attack, the attack strategy generation module 32 collects the posture data of the target terminal during the attack process through the posture sensor; based on the posture data, determines the posture change feature vector of the target terminal during the attack process, and uses the posture change feature vector as environmental information.

[0098] During each attack, the target terminal's posture data reflects its rotation or displacement changes along various axes. This data can be collected by the target terminal's posture sensor. The attack strategy generation module 32 further extracts the posture change feature vector corresponding to this posture data as environmental information. This environmental information represents the interactive actions performed by the target terminal under the control of the robotic arm 34 under the attack strategy generated by the attack strategy model, reflecting the effectiveness of the attack strategy.

[0099] In some specific embodiments, the attack strategy generation module 32 may use a PPO reinforcement learning method to optimize the attack strategy model.

[0100] Under the PPO method, the robotic arm 34 is used as an intelligent agent to execute the interactive actions corresponding to the attack strategy generated by the attack strategy model to attack the human-machine recognition model deployed in the target terminal; the attack strategy generation module 32 determines the reward based on the recognition result returned by the human-machine recognition model to mark the action parameters that can effectively break the human-machine recognition model; the environmental information is determined based on the posture data of the target terminal to determine the state of the robotic arm and the effect of the attack on the target terminal; the attack strategy generation module 32 determines the cross-entropy loss based on the reward and environmental information, updates the attack strategy model with the goal of minimizing the loss, generates a new attack strategy to attack the human-machine recognition model again; repeat the above steps, so that the attack strategy generation module 32 continuously learns the action parameters that can effectively break the human-machine recognition model based on the reward signal, and improves the breakthrough rate in repeated interactive attack tests until an attack strategy model that can stably break the human-machine recognition model is obtained, and the optimization of the attack strategy model is completed.

[0101] The robotic arm 34 receives the attack strategy injected by the attack strategy generation module 32 and executes it. It grabs the target terminal and performs corresponding interactive actions based on the action parameters determined by the attack strategy. For example, the robotic arm 34 grabs the target terminal and performs a "shake" action according to the shaking amplitude, shaking duration or shaking speed determined by the attack strategy, so as to disguise itself as a user to interact and perform at least one attack on the human-computer recognition model deployed in the target terminal.

[0102] In another embodiment of this specification, an optimization device is also proposed. FIG5 exemplarily shows a structural block diagram of the optimization device described in an embodiment of this specification in one implementation manner.

[0103] As shown in Figure 5, the optimization device 40 includes: the above-mentioned interactive attack testing device 30, a control module 42 and an optimization module 44; the control module 42 is configured to control the interactive attack device to perform multiple rounds of attacks on the human-machine recognition model; for each round of attack, when the attack strategy model meets the preset breakthrough rate condition, the human-machine recognition model is continuously attacked based on the attack strategy generated by the attack strategy model that meets the preset breakthrough rate condition, and attack data for breaking the human-machine recognition model is obtained; the optimization module 44 is configured to optimize the human-machine recognition model based on the attack data corresponding to each round of attack until the breakthrough rate of the human-machine recognition model is lower than the preset first threshold.

[0104] In some embodiments, the human-machine recognition model is pre-trained in the following manner: obtaining the posture data of the target terminal during the human-machine interaction process as a positive sample, and adding a positive sample label; obtaining the posture data of the target terminal during the machine attack process as a negative sample, and adding a negative sample label; based on the positive samples, positive sample labels, negative samples and negative sample labels, training the pre-built model until a human-machine recognition model that meets the preset conditions is obtained.

[0105] Positive samples contain data on user interactions with the target device, while negative samples contain data on the robotic arm's interactions with the target device based on an attack strategy. These positive and negative samples are used as training samples and fed into the human-machine identification model for human-machine judgment. The model is trained to minimize the difference between the judgment result and the positive or negative sample label.

[0106] In some more specific embodiments, a human-machine recognition model may be constructed based on an RNN model, for example, a human-machine recognition model may be constructed based on an LSTM network structure.

[0107] Positive samples and corresponding positive sample labels are obtained, and the positive samples, i.e., the posture data of the target terminal during the human-computer interaction process, are input into the LSTM human-computer recognition model to obtain the recognition results. The cross-entropy loss is calculated based on the recognition results and the positive sample labels as the first loss. Negative samples and corresponding negative sample labels are obtained, and the negative samples, i.e., the posture data of the target terminal during the machine attack process, are input into the LSTM human-computer recognition model to obtain the recognition results. The cross-entropy loss is calculated based on the recognition results and the negative sample labels as the second loss. The recognition loss is calculated based on the first loss and the second loss, and the LSTM human-computer recognition model is trained with the goal of minimizing the recognition loss.

[0108] Of course, in other embodiments, a human-machine recognition model may also be constructed based on a CNN model, such as a ResNet model, or based on a Transformer model.

[0109] The pre-trained human-machine recognition model already has a certain ability to resist attacks. In order to further optimize it, it is necessary to obtain more aggressive attack data. Therefore, the optimized attack strategy model needs to meet a certain penetration rate so that it can effectively attack the human-machine recognition model. Based on this learning, the human-machine recognition model gains stronger resistance to attacks.

[0110] In some embodiments, the control module 42 obtains an attack strategy model that meets a preset attack rate condition, specifically including: the control module 42 obtains the number of times the robotic arm breaks through the human-machine recognition model and the total number of attacks implemented within the target time period based on the current attack strategy; based on the number of attacks and the total number of attacks, determines the attack rate; based on the attack rate and a preset second threshold, determines whether the attack strategy model meets the attack rate condition, wherein the second threshold is greater than the first threshold.

[0111] The breach rate is the ratio of the number of times the current attack strategy breaches the human-machine recognition model within the target time period to the total number of attacks carried out. It reflects the effectiveness of the attack strategy on the human-machine recognition model. A preset second threshold represents the minimum breach rate threshold that the attack strategy generated by the attack strategy model must meet. This threshold should be as high as possible. During each round of attack on the human-machine recognition model, the control module 42 calculates the breach rate corresponding to the attack strategy executed in that round and compares it with the second threshold. If it exceeds the second threshold, the attack strategy model has met the breach rate requirement and no further updates are required. Otherwise, the attack strategy is updated to proceed to the next round of attack.

[0112] The first threshold represents the maximum attack rate threshold that the human-machine recognition model can withstand, which should be as low as possible. The attack rate of the optimized human-machine recognition model needs to be below the first threshold in order to stably resist attacks. Therefore, the second threshold is greater than the first threshold.

[0113] The human-machine identification model has been pre-trained and has a certain degree of anti-attack capability. However, in the face of an attack strategy model with a wider attack coverage and stronger aggressiveness, the optimization module 44 needs to further optimize the human-machine identification model for several rounds.

[0114] In some embodiments, the optimization module 44 is specifically configured to use the attack data as negative samples and add negative sample labels; and to train the human-machine recognition model based on the attack data and the negative sample labels to optimize the human-machine recognition model.

[0115] The optimization module 44 inputs the attack data as a negative sample into the pre-trained human-machine recognition model for human-machine judgment. Based on the difference between the obtained judgment result and the negative sample label, the attack rate of the human-machine recognition model under the current attack strategy is calculated, that is, the ratio of the number of times the human-machine recognition model is attacked by the current attack strategy to the total number of attacks within the target time period; in each round of optimization of the human-machine recognition model, the attack rate of the human-machine recognition model is compared with the first threshold. If it is lower than the first threshold, the human-machine recognition model can stably resist the attack of the robotic arm and the optimization can be completed. Otherwise, the next round of optimization will continue.

[0116] In some more specific embodiments, the optimization module 44 can optimize the human-machine recognition model built based on the RNN model, for example, optimize the human-machine recognition model built based on the LSTM network structure.

[0117] Of course, in other embodiments, the optimization module 44 may also optimize a human-machine recognition model based on a CNN model, such as a ResNet model, or a human-machine recognition model based on a Transformer model.

[0118] One embodiment of the present specification also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements at least one attack on a human-machine recognition model deployed in a target terminal; wherein each attack includes: determining an attack strategy based on an attack strategy model, the attack strategy including action parameters for executing preset interactive actions; controlling a robotic arm to grasp the target terminal, and performing interactive actions on the target terminal based on the attack strategy to implement an attack on the human-machine recognition model deployed in the target terminal; determining a reward based on the response of the human-machine recognition model to the attack; determining environmental information based on the posture data of the target terminal during the attack process; and using reinforcement learning to update the attack strategy model based on the reward and environmental information to obtain a new attack strategy.

[0119] An embodiment of the present specification also provides an interactive attack testing device, comprising: one or more processors; and a memory associated with the one or more processors, the memory being used to store program instructions, which, when read and executed by the one or more processors, enables the one or more processors to implement at least one attack on the human-machine recognition model deployed in the target terminal; wherein each attack includes: determining an attack strategy based on an attack strategy model, the attack strategy including action parameters for executing preset interactive actions; controlling a robotic arm to grasp the target terminal, and performing interactive actions on the target terminal based on the attack strategy to implement an attack on the human-machine recognition model deployed in the target terminal; determining a reward based on the response of the human-machine recognition model to the attack; determining environmental information based on the posture data of the target terminal during the attack process; and using reinforcement learning to update the attack strategy model based on the reward and environmental information to obtain a new attack strategy.

[0120] One embodiment of the present specification also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements up to N rounds of continuous optimization of the human-machine recognition model deployed in the target terminal until the attack rate of the human-machine recognition model is lower than a preset first threshold; wherein each round of optimization includes: attacking the human-machine recognition model using any one of the methods described in the above-mentioned interactive attack testing methods until an attack strategy model that meets the preset attack rate condition is obtained; continuously attacking the human-machine recognition model based on the attack strategy generated by the attack strategy model that meets the preset attack rate condition, and obtaining attack data when the human-machine recognition model is broken; and optimizing the human-machine recognition model based on the attack data.

[0121] One embodiment of the present specification also provides an optimization device, comprising: one or more processors; and a memory associated with the one or more processors, the memory being used to store program instructions, which, when read and executed by the one or more processors, enable the one or more processors to continuously optimize a human-machine recognition model deployed in a target terminal for up to N rounds until the attack rate of the human-machine recognition model is lower than a preset first threshold; wherein each round of optimization includes: attacking the human-machine recognition model using any one of the methods described in the above-mentioned interactive attack testing methods until an attack strategy model that meets a preset attack rate condition is obtained; continuously attacking the human-machine recognition model based on an attack strategy generated from the attack strategy model that meets the preset attack rate condition, and obtaining attack data when the human-machine recognition model is broken; and optimizing the human-machine recognition model based on the attack data.

[0122] Figure 6 exemplarily illustrates a block diagram of an electronic device provided in accordance with an embodiment of this specification, which illustrates a schematic diagram of the structure of a computer system 500 suitable for implementing a terminal device or server according to an embodiment of the present invention. The terminal device or server shown in Figure 6 is merely an example and should not limit the functionality or scope of use of the embodiments of the present invention.

[0123] In a typical configuration, computer system 500 includes one or more processors (CPUs) 502 , input interfaces 508 , output interfaces 510 , network interfaces 506 , and memory 504 .

[0124] Memory 504 may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0125] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0126] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0127] It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining."

[0128] It should be noted that the above examples are merely specific embodiments of the present invention. Obviously, the present invention is not limited to the above examples, and many similar variations are possible. All variations directly derived or conceived by those skilled in the art from the disclosure of the present invention are intended to fall within the scope of protection of the present invention.

Claims

1. An interactive attack test method, comprising: performing at least one attack on a human-machine recognition model deployed in a target terminal; wherein: Each attack includes: Determining an attack strategy based on the attack strategy model, wherein the attack strategy includes action parameters for executing a preset interactive action; Grasping the target terminal by a mechanical arm, and performing the interactive action on the target terminal based on the attack strategy, so as to implement an attack on a human-machine recognition model deployed in the target terminal; Determining a reward based on a response of the human-machine recognition model to the attack; Determining environmental information based on posture data of the target terminal during the attack process; Reinforcement learning is adopted to update the attack strategy model based on the reward and the environmental information to obtain a new attack strategy.

2. The method according to claim 1, wherein determining a reward based on a response of the human-machine recognition model to the attack specifically comprises: In response to the human-machine recognition model being breached, determining a reward signal; In response to the human-machine recognition model not being broken, a penalty signal is determined.

3. The method according to claim 1, wherein determining the environmental information based on the posture data of the target terminal during the attack process specifically comprises: For each attack, collecting posture data of the target terminal during the attack process through a posture sensor; Based on the posture data, a posture change feature vector of the target terminal during the attack process is determined, and the posture change feature vector is used as the environmental information.

4. An optimization method, comprising continuously optimizing the human-machine identification model deployed in the target terminal for at most N rounds until the attack rate of the human-machine identification model is lower than a preset first threshold; wherein, Each round of optimization includes: Adopting the method described in any one of claims 1 to 3 to attack the human-machine recognition model until an attack strategy model that meets a preset attack rate condition is obtained; Based on the attack strategy generated by the attack strategy model that meets the preset attack rate condition, continuously attack the human-machine identification model, and obtain attack data when the human-machine identification model is broken; The human-machine identification model is optimized based on the attack data.

5. The method according to claim 4, wherein the human-machine recognition model is pre-trained in the following manner: Acquire the posture data of the target terminal during the human-computer interaction process as a positive sample, and add a positive sample label; Obtaining the posture data of the target terminal during the machine attack as a negative sample, and adding a negative sample label; Based on the positive samples, the positive sample labels, the negative samples and the negative sample labels, a pre-built model is trained until a human-machine recognition model that meets preset conditions is obtained.

6. The method according to claim 4, wherein obtaining an attack strategy model that satisfies a preset attack rate condition comprises: Obtaining the number of times the robot arm breaks through the human-machine recognition model and the total number of times the attack is performed within a target time period based on the current attack strategy; Determining a breach rate based on the number of breaches and the total number of breaches; Based on the breach rate and a preset second threshold, it is determined whether the attack strategy model meets the breach rate condition, and the second threshold is greater than the first threshold.

7. The method according to claim 4, wherein optimizing the human-machine identification model based on the attack data specifically comprises: Taking the attack data as negative samples and adding negative sample labels; The human-machine recognition model is trained based on the attack data and the negative sample labels.

8. An interactive attack testing device, comprising: an attack strategy generation module configured to determine an attack strategy based on an attack strategy model; and adopting reinforcement learning to update the attack strategy model based on the reinforcement signal fed back by the target terminal to obtain a new attack strategy; The reinforcement signal includes: environmental information determined based on the posture data of the target terminal during the attack, and a reward determined based on the response of the human-machine recognition model deployed in the target terminal after the attack; The robot arm is configured to grab the target terminal and apply corresponding interactive actions to the target terminal based on the attack strategy generated by the attack strategy generation module to achieve an attack on the human-machine recognition model.

9. An optimization device, comprising: The interactive attack testing device, control module and optimization module as claimed in claim 8; The control module is configured to control the interactive attack device to perform multiple rounds of attacks on the human-machine identification model; for each round of attack, when the attack strategy model meets the preset attack rate condition, the attack strategy generated based on the attack strategy model that meets the preset attack rate condition is used to continuously attack the human-machine identification model, and obtain attack data for breaking the human-machine identification model; The optimization module is configured to optimize the human-machine identification model based on the attack data corresponding to each round of attack until the attack rate of the human-machine identification model is lower than a preset first threshold.

10. In the device as described in claim 9, the optimization module is specifically used to use the attack data as a negative sample and add a negative sample label; based on the attack data and the negative sample label, the human-machine recognition model is trained to achieve optimization of the human-machine recognition model.

11. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, at least one attack is performed on a human-machine recognition model deployed in a target terminal; wherein: Each attack includes: Determining an attack strategy based on the attack strategy model, wherein the attack strategy includes action parameters for executing a preset interactive action; Controlling the mechanical arm to grab the target terminal, and performing the interactive action on the target terminal based on the attack strategy, so as to achieve an attack on the human-machine recognition model deployed in the target terminal; Determining a reward based on a response of the human-machine recognition model to the attack; Determining environmental information based on posture data of the target terminal during the attack process; Reinforcement learning is adopted to update the attack strategy model based on the reward and the environmental information to obtain a new attack strategy.

12. An interactive attack testing device, comprising: one or more processors; as well as A memory associated with the one or more processors, the memory being used to store program instructions, wherein when the program instructions are read and executed by the one or more processors, the one or more processors implement at least one attack on the human-machine recognition model deployed in the target terminal; wherein each attack includes: Determining an attack strategy based on the attack strategy model, wherein the attack strategy includes action parameters for executing a preset interactive action; Controlling the mechanical arm to grab the target terminal, and performing the interactive action on the target terminal based on the attack strategy, so as to achieve an attack on the human-machine recognition model deployed in the target terminal; Determining a reward based on a response of the human-machine recognition model to the attack; Determining environmental information based on posture data of the target terminal during the attack process; Reinforcement learning is adopted to update the attack strategy model based on the reward and the environmental information to obtain a new attack strategy.

13. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program continuously optimizes a human-machine identification model deployed in a target terminal for at most N rounds until the attack rate of the human-machine identification model is lower than a preset first threshold; wherein: Each round of optimization includes: Adopting the method described in any one of claims 1 to 3 to attack the human-machine recognition model until an attack strategy model that meets a preset attack rate condition is obtained; Based on the attack strategy generated by the attack strategy model that meets the preset attack rate condition, continuously attack the human-machine identification model, and obtain attack data when the human-machine identification model is broken; The human-machine identification model is optimized based on the attack data.

14. An optimization device comprising: one or more processors; as well as A memory associated with the one or more processors, the memory being used to store program instructions, the program instructions When read and executed by the one or more processors, the command enables the one or more processors to continuously optimize the human-machine identification model deployed in the target terminal for at most N rounds until the attack rate of the human-machine identification model is lower than a preset first threshold; wherein each round of optimization includes: Adopting the method described in any one of claims 1 to 3 to attack the human-machine recognition model until an attack strategy model that meets a preset attack rate condition is obtained; Based on the attack strategy generated by the attack strategy model that meets the preset attack rate condition, continuously attack the human-machine identification model, and obtain attack data when the human-machine identification model is broken; The human-machine identification model is optimized based on the attack data.

Images