Sample purification method and apparatus, device and medium

Abstract

The present application relates to the technical field of artificial intelligence, and discloses a sample purification method and apparatus, a device, and a medium. The method comprises: acquiring an adversarial sample, wherein the adversarial sample comprises an adversarial image and a text; acquiring a noise-added image obtained by adding first noise to the adversarial image; determining a first correlation and a second correlation; and adding second noise to the adversarial image on the basis of the first correlation and the second correlation, so as to purify the adversarial image to obtain a purified image. The present application uses the first correlation, i.e., cross-modal attention distribution, as guidance to implement purification by adding noise to the adversarial image. The purification method not only processes the adversarial image, but also optimizes the cross-modal attention distribution mechanism itself. A visual language model can obtain a correct prediction result on the basis of the purified image, and the purification method enhances the robustness of the visual language model.

Description

Sample purification methods, apparatus, equipment and media

[0001] This application claims priority to Chinese Patent Application No. 202410994732.0, filed on July 23, 2024, entitled “Sample Purification Method, Apparatus, Equipment and Medium”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of artificial intelligence technology, and in particular to a sample purification method, apparatus, device, and medium. Background Technology

[0003] Large Vision-Language Models (LVLMs) are broadly defined as multimodal models that can learn from images and text. LVLMs are susceptible to adversarial examples when processing tasks. Adversarial examples are created by making minor modifications or perturbations to clean samples, causing the LVLM to produce incorrect predictions.

[0004] In related technologies, adversarial examples are cleaned up by performing certain preprocessing operations on the images input to the visual language model. For example, smoothing the image, i.e., applying a smoothing filter to reduce image noise, thereby reducing the impact of adversarial attacks; or scaling the image, i.e., changing the image features by altering the image scale (e.g., scaling), thereby reducing the effectiveness of adversarial attacks.

[0005] However, the decontamination of adversarial examples in related technologies mainly relies on traditional image processing techniques, resulting in less than ideal decontamination effects. In practical applications, adversarial examples still affect the task output (prediction results) of visual language models. Summary of the Invention

[0006] This application provides a sample purification method, apparatus, equipment, and medium, the technical solution of which is as follows:

[0007] According to one aspect of this application, a sample purification method is provided, the method comprising:

[0008] The adversarial sample is obtained by performing an adversarial attack on a clean sample, and the adversarial sample includes adversarial images and text;

[0009] Obtain the noisy image obtained by adding first noise to the adversarial image;

[0010] Determine a first correlation between at least one noisy image feature of the noisy image and at least one text feature of the text;

[0011] Determine a second correlation between at least one adversarial image feature of the adversarial image and at least one text feature of the text;

[0012] A second noise is added to the adversarial image based on the first correlation and the second correlation to clean the adversarial image and obtain a cleaned image.

[0013] According to one aspect of this application, a sample purification device is provided, the device comprising: an acquisition module, a determination module, and an addition module;

[0014] The acquisition module is used for:

[0015] The adversarial sample is obtained by performing an adversarial attack on a clean sample, and the adversarial sample includes adversarial images and text;

[0016] Obtain the noisy image obtained by adding first noise to the adversarial image;

[0017] The determining module is used for:

[0018] Determine a first correlation between at least one noisy image feature of the noisy image and at least one text feature of the text;

[0019] Determine a second correlation between at least one adversarial image feature of the adversarial image and at least one text feature of the text;

[0020] The adding module is used to add second noise to the adversarial image based on the first correlation and the second correlation to clean the adversarial image and obtain a cleaned image.

[0021] According to another aspect of this application, a computer device is provided, comprising: a processor and a memory, wherein the memory stores at least one computer program, the at least one computer program being loaded and executed by the processor to implement the sample purification method as described above.

[0022] According to another aspect of this application, a computer storage medium is provided, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor to implement the sample purification method as described above.

[0023] According to another aspect of this application, a computer program product is provided, comprising a computer program stored in a computer-readable storage medium; the computer program is read from and executed by a processor of a computer device from the computer-readable storage medium, causing the computer device to perform the sample purification method as described above.

[0024] The beneficial effects of the technical solution provided in this application include at least the following:

[0025] Visual language models often produce incorrect predictions based on adversarial examples. By performing a cleansing operation on the adversarial image in the adversarial examples, a cleaned image can be obtained, thus yielding a cleaned example. Specifically, a noisy image is obtained by randomly adding noise to the adversarial image. Since the noisy cross-modal attention distribution of the noisy image (i.e., the first correlation between at least one noisy image feature and at least one text feature of the text) is very close to the cross-modal attention distribution of the clean image (i.e., the correlation between at least one clean image feature and at least one text feature of the text), the noisy cross-modal attention distribution of the noisy image can be used as an optimization target. Random noise is added to the adversarial image, thereby making the adversarial cross-modal attention distribution of the adversarial image (i.e., the second correlation between at least one adversarial image feature and at least one text feature of the text) close to the noisy cross-modal attention distribution of the noisy image, thus completing the cleansing of the adversarial image and obtaining a cleaned image. This application, guided by the noisy cross-modal attention distribution, achieves adversarial image cleansing by adding noise to the adversarial image. Based on the cleaned image, the visual language model can obtain correct prediction results. This cleansing method enhances the robustness of the visual language model.

[0026] Furthermore, the method of adding random noise to adversarial images by using the noisy cross-modal attention distribution as the estimation direction not only optimizes the adversarial images but also optimizes the cross-modal attention distribution itself. This optimization enables the attention mechanism to focus more accurately on the key information in the image, thereby improving the accuracy of the prediction results output by the visual language model. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 is a schematic diagram of the architecture of a computer system provided in an exemplary embodiment of this application;

[0029] Figure 2 is a schematic diagram of a sample purification method provided in an exemplary embodiment of this application;

[0030] Figure 3 is a flowchart of a sample purification method provided in an exemplary embodiment of this application;

[0031] Figure 4A is a flowchart of a sample purification method provided in an exemplary embodiment of this application;

[0032] Figure 4B shows a flowchart of a sample purification method provided in an exemplary embodiment of this application;

[0033] Figure 5 is a flowchart of a sample purification method provided in an exemplary embodiment of this application;

[0034] Figure 6 is a flowchart of a sample purification method provided in an exemplary embodiment of this application;

[0035] Figure 7 is a structural block diagram of a sample purification device provided in an exemplary embodiment of this application;

[0036] Figure 8 is a schematic diagram of the structure of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0038] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0039] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0040] It should be understood that although the terms first, second, etc., may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, a first parameter may also be referred to as a second parameter without departing from the scope of this disclosure, and similarly, a second parameter may also be referred to as a first parameter. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0041] It should be noted that the data involved in this application (including but not limited to data used for analysis, training, and recommendation) is all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the settings and other information involved in this application were obtained with full authorization.

[0042] Before introducing the technical solutions of this application, some terms involved in this application will be explained. The following related explanations are optional and can be combined with the technical solutions of the embodiments of this application in any way, all of which fall within the protection scope of the embodiments of this application. The embodiments of this application include at least some of the following contents.

[0043] Visual language models (VLPs) are multimodal models that combine visual (image) and linguistic (text) inputs. They can receive image and text inputs and generate task outputs. VLPs can understand and process the relationships between images and text, and are used to handle various tasks such as image captioning, visual question answering (VQA), and image-text matching.

[0044] Clean samples: Clean samples refer to original samples that have not been modified or perturbed in any way. Clean samples are standard samples under ideal conditions and serve as a benchmark in the evaluation of visual language models. Clean samples include clean images and clean text.

[0045] Adversarial examples: Adversarial examples are samples that make minor modifications or perturbations to clean samples, causing the visual language model to make incorrect predictions. The perturbations in adversarial examples are not easily noticeable, but they lead to incorrect predictions or outputs from the visual language model. Adversarial examples include adversarial images and text. The cleanup operations for adversarial examples in this application can be viewed as cleanup operations for adversarial images.

[0046] Noisy adversarial samples: These are adversarial samples to which random noise has been added. The range of random noise addition is limited or constrained by the infinity norm. The goal of randomly noisy adversarial samples is to maintain the adversarial nature while making the cross-modal attention distribution of the noisy samples approximate that of the clean samples. Noisy samples include both noisy images and text.

[0047] Cleaned samples refer to samples that have undergone minor modifications or perturbations to adversarial samples. Cleaned samples can improve the probability of a visual language model generating correct predictions. The purpose of cleaned samples is to reduce adversarial perturbations that lead to incorrect predictions by the visual language model, thereby increasing the probability of the visual language model generating correct predictions. Cleaned samples include cleaned images and text. In the embodiments of this application, the cleaned sample obtained by the cleansing operation on the adversarial sample can be understood as the cleaned image obtained by the cleansing operation on the adversarial image.

[0048] Visual tokens: Visual tokens are feature representations extracted from an image and encoded by a visual encoder in a visual language model. The visual encoder divides the input image into several regions, each of which can be encoded as an image feature (or visual feature, region image feature). Several regions can be encoded as several image features. The language alignment module in the visual language model aligns these image features to obtain multiple visual tokens. Each visual token can be a fused representation of several image features. For example, one region of the image corresponds to one image feature, and a visual token can be a feature representation fused from several image features. For instance, the visual encoder in the visual language model divides the image into 16×16=256 regions and extracts 256 image features. The language alignment module processes these into 32 visual tokens, each of which can be a fused representation of the 256 image features. Optionally, different visual tokens may emphasize different aspects of the fused image features. For example, the first visual token may focus on the background region of the image, meaning it primarily represents the image features of the background region; the second visual token may focus on the object region of the image, meaning it primarily represents the image features of the object region.

[0049] Language tokens: Language tokens are feature representations extracted from text, obtained by encoding them through a language model segmenter in a visual language model. Optionally, the language model segmenter divides the input text into several words (or sub-words), and then converts each word into a corresponding feature vector. Text can typically be divided into several sub-words, and the feature vector of each sub-word can be represented as a language token. A language token usually corresponds to one sub-word in the text. Alternatively, the feature vectors of multiple sub-words can be represented as a language token, and a language token usually corresponds to multiple sub-words in the text. For example, a language token is the textual features of all sub-words in the text.

[0050] Cross-modal attention distribution refers to an attention mechanism employed by visual language models when processing multimodal data. Specifically, it describes how one modality (e.g., text) allocates attention or focus based on the content of another modality (e.g., an image) during multimodal data processing. In this application example, cross-modal attention distribution refers to how a visual language model focuses on relevant parts of an image in a sample when generating prediction results.

[0051] For example, in visual question answering applications, when processing images, visual language models can focus on image regions related to the descriptive text or question based on cross-modal attention distribution. For instance, the task of a visual language model is to answer a question in an image. The image input to the visual language model is a picture of a red car driving on a highway, and the text input is the question "What is the color of the car?". When the visual language model generates the first word "red" in the answer, it calculates the attention weights for all visual tokens (predefined image features) in the image. These attention weights represent the importance of each visual token to the currently generated word; that is, the visual language model evaluates the extent to which each visual token influences the generation of the first word "red". Optionally, the visual language model might focus on visual tokens representing the car portion of the image.

[0052] It should be noted that in this embodiment, the cleansing operation is mainly performed on the adversarial image in the adversarial examples to obtain a cleaned sample with a cleaned image. Unless otherwise specified, the cross-modal attention distribution corresponding to the clean sample can be understood as the cross-modal attention distribution corresponding to the clean image; the cross-modal attention distribution corresponding to the adversarial example can be understood as the cross-modal attention distribution corresponding to the adversarial image; the cross-modal attention distribution corresponding to the noisy sample can be understood as the cross-modal attention distribution corresponding to the noisy image; and the cross-modal attention distribution corresponding to the cleaned sample can be understood as the cross-modal attention distribution corresponding to the cleaned image.

[0053] Figure 1 shows a schematic diagram of the architecture of a computer system provided in one embodiment of this application. The computer system may include: a terminal 100 and a server 200.

[0054] Terminal 100 can be an electronic device such as a mobile phone, tablet computer, vehicle terminal (vehicle system), wearable device, personal computer (PC), or vehicle terminal. A client application for the target application can be installed and run on terminal 100. This target application can be an application that supports sample purification, and this application is not limited in this respect. Furthermore, this application does not limit the form of the target application, including but not limited to applications (Apps), mini-programs, clients, etc., installed on terminal 100, and it can also be in web page form.

[0055] Server 200 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and basic cloud computing services such as big data and artificial intelligence handheld image recognition platforms. Server 200 can be a backend server for the aforementioned target application, used to provide backend services to the clients of the target application.

[0056] Cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Based on the cloud computing business model, cloud technology encompasses network technology, information technology, integration technology, management platform technology, and application technology. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will require robust system support, which can only be achieved through cloud computing.

[0057] In some embodiments, the server described above can also be implemented as a node in a blockchain system. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer.

[0058] Terminal 100 and server 200 can communicate via a network, such as a wired or wireless network.

[0059] The sample purification method provided in this application can be executed by a computer device, which refers to an electronic device with data computing, processing, and storage capabilities. Taking the computer system shown in Figure 1 as an example, the sample purification method can be executed by the terminal 100, the server 200, or by the terminal 100 and the server 200 interacting and cooperating to execute the sample purification method. This application does not limit this.

[0060] For example, Figure 2 illustrates a schematic diagram of a sample purification method provided in an exemplary embodiment of this application. The method is executed by a computer device, which may be the terminal 100 and / or server 200 shown in Figure 1. In this embodiment, the computer device is described as server 200. The sample purification method is executed by server 200.

[0061] In related technologies, adversarial example cleanup is achieved by performing preprocessing operations on the images input to the visual language model. For example, smoothing the image (applying a smoothing filter to reduce image noise) can mitigate the impact of adversarial attacks; similarly, scaling the image (e.g., resizing) can alter image features and reduce the effectiveness of adversarial attacks. However, these adversarial example cleanup techniques primarily rely on traditional image processing methods, resulting in less than ideal cleanup effects. In practical applications, adversarial examples can still impact the task output of the visual language model.

[0062] To address the aforementioned issues, this application proposes a sample cleansing method. To reduce adversarial attacks in adversarial examples and ensure the visual language model produces accurate predictions, adversarial examples (primarily adversarial images) input to the visual language model can be cleansed, resulting in cleaned samples (cleaned images). In this application, the cross-modal attention distribution is used as the target direction for the cleansing process, guiding the adversarial examples to complete the cleansing operation. Optionally, random noise can be added to the adversarial examples to guide the adversarial cross-modal attention distribution of the adversarial examples to approximate the clean cross-modal attention distribution of the clean examples, thereby enabling the visual language model to produce accurate predictions.

[0063] In visual question answering applications, visual language models can answer natural language questions about images. For example, referring to Figure 2, clean sample 10 includes a clean image and text; adversarial sample 20 includes an adversarial image and text; noisy sample 30 includes a noisy image and text; and clean sample 40 includes a clean image and text. The text in clean sample 10, adversarial sample 20, noisy sample 30, and clean sample 40 is a description of a natural language question: "What is this man doing?".

[0064] Optionally, inputting clean sample 10 into visual language model 50 yields an output result 60, which is the correct answer "hit the ball". When generating the answer "hit the ball", visual language model 50 calculates the clean cross-modal attention distribution of the clean image in clean sample 10. Optionally, visual language model 50 calculates the attention weights of all visual tokens in the clean image. Visual language model 50 divides the clean image into several regions, and the image features of each region (or the image features corresponding to multiple regions) can be represented as a visual token. The attention weights represent the importance of each visual token to the answer "hit the ball", that is, visual language model evaluates the extent to which each visual token influences the generation of "hit the ball". Optionally, cross-modal attention distribution diagram 70 is a visualization of the cross-modal attention distribution, showing the attention paid by the visual language model to different visual tokens in the image when processing the task.

[0065] In some embodiments, the cross-modal attention distributions of clean sample 10 and adversarial sample 20 are significantly different; this can also be understood as the cross-modal attention distributions of clean image and adversarial image being significantly different. Adversarial sample 20 can be cleaned by guiding its adversarial cross-modal attention distribution to approximate the clean cross-modal attention distribution of clean sample 10. However, in adversarial cleanup scenarios, it is often impossible to directly obtain clean sample 10, and consequently, its clean cross-modal attention distribution.

[0066] In one possible implementation, by adding first noise to the adversarial image of adversarial sample 20, a noisy sample 30 is obtained. Compared to the adversarial cross-modal attention distribution of adversarial sample 20, the noisy cross-modal attention distribution of noisy sample 30 is closer to the clean cross-modal attention distribution corresponding to clean sample 10 (indicated by the attention weight distribution in the cross-modal attention distribution map corresponding to noisy sample 30 being close to the attention weight distribution in the cross-modal attention distribution map corresponding to clean sample 10). Therefore, using the noisy cross-modal attention distribution of noisy sample 30 as a reference estimation direction to guide the optimization of the adversarial cross-modal attention distribution of adversarial sample 20 can be considered as a cleanup operation for adversarial sample 20, making it closer to clean sample 10. Optionally, by guiding the adversarial cross-modal attention distribution corresponding to adversarial sample 20 to be close to the noisy cross-modal attention distribution corresponding to noisy sample 30, the cleanup of adversarial sample 20 is achieved.

[0067] In some embodiments, the noisy cross-modal attention distribution corresponding to noisy sample 30 is used as the target to guide the adversarial cross-modal attention distribution corresponding to adversarial sample 20 to approach the noisy cross-modal attention distribution corresponding to noisy sample 30. Optionally, with minimizing the attention difference value as the optimization objective, a second noise is added to the adversarial image to generate a cleaned image, i.e., a cleaned operation is performed on adversarial sample 20 to generate cleaned sample 40. Here, the attention difference value is the difference between the noisy cross-modal attention distribution corresponding to noisy sample 30 and the adversarial cross-modal attention distribution corresponding to adversarial sample 20. The visual language model 50 can generate the correct answer "hit the ball" based on cleaned sample 40.

[0068] In some embodiments, the cleaned sample 40 is obtained based on the following steps: First, the norm of the attention difference value is calculated, which measures the distance between the adversarial cross-modal attention distribution corresponding to the adversarial sample 20 and the noisy cross-modal attention distribution corresponding to the noisy sample 30. Second, the gradient of the attention difference value with respect to the pixels in the adversarial image is calculated, which indicates how to add second noise to minimize the attention difference value under the current adversarial sample 20. Then, the gradient direction is determined based on the sign function, which indicates the direction in which the second noise is added to the adversarial image in the adversarial sample 20, i.e., the pixels in the adversarial image are adjusted towards the gradient direction to reduce the attention difference value. Optionally, the gradient is used as the input to the sign function. When the gradient is positive, the output of the sign function is 1, meaning that the adversarial sample 20 increases the pixel values ​​in the adversarial image according to the gradient direction. When the gradient is negative, the output of the sign function is -1, meaning that the adversarial sample 20 decreases the pixel values ​​in the adversarial image according to the gradient direction. When the gradient is zero, the output of the sign function is 0, meaning that the adversarial sample keeps the pixel values ​​in the adversarial image unchanged according to the gradient direction (basically, pixel values ​​will change, and there is almost no case where they remain unchanged). Optionally, increasing or decreasing the pixel values ​​in the adversarial image according to the gradient direction yields a cleaned image after adding the second noise.

[0069] In some embodiments, the magnitude of the second noise added to the adversarial image is controlled. Optionally, the gradient includes not only gradient direction information but also intensity information. The intensity of the gradient is positively correlated with the magnitude of the added second noise. Optionally, the adversarial images in the adversarial sample 20 are divided into pixel-level segments, and second noise of different perturbation levels (different sizes) is added to different pixel positions in the adversarial image based on the gradient direction. Optionally, pixels with larger gradients in the adversarial image should be subject to greater perturbation, i.e., relatively larger noise is added; pixels with smaller gradients in the adversarial image should be subject to smaller perturbation, i.e., relatively smaller noise is added. Optionally, the maximum and minimum gradient values ​​are obtained, and a gradient standard value is obtained based on the maximum and minimum gradient values. The gradient standard value is the gradient value after normalization, with the gradient normalized to [0, 1]. In some embodiments, since the gradient standard values ​​differ significantly, the average gradient standard value can be used to represent the gradient standard value. The perturbation amplitude of the second noise is determined based on the gradient standard value and its average value. The perturbation amplitude includes a perturbation factor used to determine the magnitude of the second noise, and the magnitude of the second noise added to each pixel in the adversarial image is determined based on the perturbation factor.

[0070] In some embodiments, a purified image is obtained through the purification operation on the adversarial image described above, that is, a purified sample 40 is obtained through the purification operation on the adversarial sample 20. Optionally, the purified sample 40 is input into the visual language model 50, and the visual language model 50 can obtain the correct output result "hit the ball" based on the purified sample 40.

[0071] It should be understood that, in the embodiments of this application, the noisy cross-modal attention distribution is also referred to as the first correlation between at least one noisy image feature of the noisy image and at least one text feature of the text; the adversarial cross-modal attention distribution is also referred to as the second correlation between at least one adversarial image feature of the adversarial image and at least one text feature of the text. The attention difference value is also referred to as the correlation difference value.

[0072] Figure 3 is a flowchart of a sample purification method provided in an exemplary embodiment of this application. The method can be executed by a computer device, which may be the terminal 100 or server 200 in Figure 1. The method includes the following steps.

[0073] Step 210: Obtain adversarial examples;

[0074] Adversarial examples are samples generated after performing adversarial attacks on clean samples. Optionally, clean samples include clean images and text. Adversarial examples include adversarial images and text.

[0075] In some embodiments, a clean sample refers to an original sample that has not been modified or perturbed in any way. An adversarial sample is a sample generated after performing an adversarial attack on a clean sample. The adversarial attack involves making minor modifications or perturbations to the clean sample. These modifications or perturbations are not easily noticeable, but they can cause the visual language model to make incorrect predictions and generate incorrect prediction results (outputs).

[0076] In some embodiments, adversarial examples can be used to evaluate the performance of visual language models in the face of minor perturbations. Introducing adversarial examples allows for testing the robustness of visual language models in real-world applications, revealing their vulnerability to attacks or misdirection. Adversarial examples can be used as attack tools to attempt to gain a competitive advantage or conduct malicious activities by interfering with the visual language model. Therefore, the sanitization of adversarial examples is particularly important.

[0077] For example, consider a clean image showing a cat. In a visual question-answering scenario, the visual language model correctly classifies it as "cat." By applying an adversarial attack to this clean image, such as an adversarial attack based on the FGSM (Fast Gradient Sign Method), an adversarial image can be generated. The generated adversarial image still looks like a cat, but the visual language model might incorrectly classify it as "dog" or another category.

[0078] In some embodiments, in order to reduce adversarial attacks in adversarial examples and enable the visual language model to produce correct prediction results, a cleansing operation is performed on the adversarial images in the adversarial examples to obtain cleaned images.

[0079] Step 220: Obtain the noisy image obtained after adding the first noise to the adversarial image;

[0080] The noisy image is the image after applying a first perturbation to the adversarial image. The first noise refers to random noise added to the adversarial image. The first noise is generated randomly or according to certain rules, with the purpose of perturbing the pixel values ​​of the adversarial image. Optionally, the first noise can be Gaussian noise, uniform noise, or other types of random noise.

[0081] In some embodiments, a visual language model is a multimodal model that combines visual (image) and language (text) inputs, capable of receiving image and text inputs and generating task outputs. The visual language model is able to understand and process the relationships between images and text, and can be used to handle various tasks. Optionally, the visual language model includes at least one of the following: a deep neural network model (DNN), a convolutional neural network model (CNN), a Transformer model, a contrastive language-image pre-training model (CLIP), an extreme learning machine model (ELM), or other neural network models, but is not limited thereto, and the embodiments of this application do not specifically limit this.

[0082] In some embodiments, the first noise added to the adversarial image is uniform noise. The noisy image can be represented as:

[0083] in, Represents a noisy image, x′ i Let α represent the adversarial image, and α represent the first noise, i.e., the first noise is based on the first distribution interval [-α]. ∞ ,α ∞ The first noise value obtained by pseudo-random sampling is determined, and the first distribution interval is [-α]. ∞ ,α ∞ ] represents the range of a uniformly distributed interval. R(x′) i ,α ∞ ) indicates adversarial image x′ i Add an infinite norm constraint of α to the top. ∞ Random noise.

[0084] In one possible implementation, the first noise is added via a computer program. Optionally, a noise-adding program is installed on the computer device. Using a programming language (such as NumPy in Python, the OpenCV library, etc.), a uniformly distributed first noise can be generated and added to the adversarial image. Alternatively, the noise-adding program uses the OpenCV library to read the adversarial image to which the first noise is to be added, and uses a random number generator to generate uniformly distributed random numbers, which will serve as the noise values ​​for the first noise. Optionally, the value of the generated random noise (first noise) is adjusted according to the required noise intensity. The noise intensity can be controlled by adjusting the range of the random number generator. Then, the noise values ​​of the first noise generated by the random number generator are added to the pixels of the adversarial image.

[0085] In one possible implementation, the first noise is added via a noise model, such as using Generative Adversarial Networks (GANs), Variational Autoencoders (VAEs), or other deep learning models to generate the first noise, which is then added to the adversarial image. For example, the addition of the first noise to the adversarial image using a GAN to generate a noisy image is illustrated. The GAN receives random noise (the first noise) as input. The random noise can be sampled from a uniform distribution. The GAN outputs a uniformly distributed noise image based on the random noise. The GAN then performs noise addition processing, adding the generated noise image to the adversarial image, i.e., superimposing the pixel values ​​of the noise image onto the adversarial image to obtain the noisy image. This is merely an illustrative example, and this application does not limit the method of adding noise.

[0086] Step 230: Determine a first correlation between at least one noisy image feature of the noisy image and at least one text feature of the text;

[0087] In other words, we can compute the noisy cross-modal attention distribution. This noisy cross-modal attention distribution describes the attention distribution of noisy images and text.

[0088] In some embodiments, the cross-modal attention distributions of clean samples and adversarial samples differ significantly. This can also be understood as the clean cross-modal attention distribution of a clean image differing significantly from the adversarial cross-modal attention distribution of an adversarial image. Adversarial image cleansing can be achieved by guiding the adversarial cross-modal attention distribution of the adversarial image to approximate the clean cross-modal attention distribution of the clean image. However, in adversarial cleansing scenarios, it is often impossible to directly obtain a clean image, and consequently, it is impossible to directly obtain the clean cross-modal attention distribution of a clean image.

[0089] In one possible implementation, a noisy image is obtained by adding first noise to the adversarial image. Compared to the adversarial cross-modal attention distribution of the adversarial image, the noisy cross-modal attention distribution of the noisy image is closer to the clean cross-modal attention distribution of the clean image. Therefore, using the noisy cross-modal attention distribution of the noisy image as a reference estimation direction to guide the optimization of the adversarial cross-modal attention distribution of the adversarial image can be considered as a cleansing operation for the adversarial image, making it closer to the clean image. Optionally, adversarial image cleansing is achieved by guiding the adversarial cross-modal attention distribution of the adversarial image to approach the noisy cross-modal attention distribution of the noisy image.

[0090] In some embodiments, the noisy cross-modal attention distribution corresponding to the noisy image is calculated. Cross-modal attention distribution refers to an attention distribution in which a visual language model processes multimodal data. Noisy cross-modal attention distribution refers to how a visual language model focuses on the magnitude (or attention weight) of the noisy image in the noisy sample when generating prediction results based on the noisy sample.

[0091] Optionally, the visual language model calculates the attention weights of all visual tokens in the noisy image, where each visual token corresponds to a noisy image feature. The visual language model divides the noisy image into several regions, each region corresponding to a region image feature. This can represent fusing the region image features of multiple regions into at least one noisy image feature, or fusing them into at least one visual token. Here, each region image feature corresponds to one visual token, or multiple image features corresponding to multiple regions can be represented as one visual token. The attention weights represent the importance of each visual token to the prediction result generated by the visual language model, that is, the visual language model evaluates the extent to which each visual token affects the generation of the prediction result.

[0092] For example, the task of a visual language model is to answer a question in a noisy image. The noisy image input to the visual language model is an image of a car driving on a highway, and the text input to the visual language model is the question "What is the color of the car?". When the visual language model generates a prediction, it calculates attention weights for all visual tokens in the noisy image. These attention weights represent the importance of each visual token to the current prediction; that is, the visual language model evaluates the extent to which each visual token influences the generation of the prediction. Optionally, the visual language model may focus on visual tokens representing the car portion of the noisy image.

[0093] Step 240: Determine a second correlation between at least one adversarial image feature of the adversarial image and at least one text feature of the text;

[0094] In other words, we compute the adversarial cross-modal attention distribution corresponding to the adversarial image. The adversarial cross-modal attention distribution describes the attention distribution between the adversarial image and the text.

[0095] It should be understood that the calculation method for adversarial cross-modal attention distribution can refer to the calculation method for noisy cross-modal attention distribution, and will not be repeated in the embodiments of this application.

[0096] Step 250: Add second noise to the adversarial image based on the first correlation and the second correlation to clean the adversarial image and obtain a cleaned image.

[0097] The purified image is the image after applying a second perturbation to the adversarial image. The second noise refers to random noise added to the adversarial image. The second noise is generated randomly or according to certain rules, with the purpose of perturbing the pixel values ​​of the adversarial image. Optionally, the second noise can be Gaussian noise, uniform noise, or other types of random noise.

[0098] In some embodiments, the noisy cross-modal attention distribution (i.e., the first correlation) of the noisy image is used as the target to guide the adversarial cross-modal attention distribution (i.e., the second correlation) of the adversarial image to approach the noisy cross-modal attention distribution (i.e., the first correlation) corresponding to the noisy image.

[0099] Optionally, by continuously adding random noise to the adversarial image, the second correlation can be guided to approach the first correlation, thereby generating a cleaned image. Optionally, the random noise added to the adversarial image is noise value randomly sampled within a range of a range distribution. The second noise is added to the adversarial image to generate a cleaned image, with the optimization objective of minimizing the difference between the first and second correlations.

[0100] In some embodiments, the visual language model can obtain correct predictions based on the cleaned image.

[0101] Using a clean image as a reference, a sanitized image may exhibit greater perturbation than an adversarial image. Visual language models (VLAs) may produce incorrect predictions based on adversarial images but correct predictions based on sanitized images. Although sanitized images may be visually noisier, the sanitized cross-modal attention distribution (i.e., the correlation between at least one sanitized image feature and at least one text feature) is likely closer to the clean cross-modal attention distribution (i.e., the correlation between at least one clean image feature and at least one text feature) of a clean image. This is because the added noise in the sanitized image adjusts the VLA's attention distribution, enhancing its focus on features relevant to the prediction task within the sanitized image. Therefore, the VLA's predictions for sanitized images are closer to its predictions for clean images.

[0102] In some embodiments, the clean sample includes a clean image and text; the method further includes: determining a third correlation between at least one clean image feature of the clean image and at least one text feature of the text; wherein a first correlation is closer to the third correlation than a second correlation.

[0103] In other words, the noisy cross-modal attention distribution (i.e., the first correlation) is closer to the clean cross-modal attention distribution (i.e., the third correlation) than the adversarial cross-modal attention distribution (i.e., the first correlation). This allows us to optimize the noisy cross-modal attention distribution of the noisy image by adding random noise to the adversarial image, thereby making the adversarial cross-modal attention distribution of the adversarial image closer to the noisy cross-modal attention distribution of the noisy image, thus completing the purification of the adversarial image and obtaining a purified image.

[0104] It should be understood that the calculation method for the third correlation can refer to the calculation methods for the first and second correlations, and this application will not elaborate on this further.

[0105] In summary, the method provided in this embodiment addresses the erroneous predictions made by the visual language model based on adversarial examples. By performing a cleansing operation on the adversarial images in the adversarial examples, a cleaned image is obtained, which in turn yields a cleaned sample. Specifically, a noisy image is obtained by randomly adding noise to the adversarial image. Since the noisy cross-modal attention distribution of the noisy image (i.e., the first correlation between at least one noisy image feature of the noisy image and at least one text feature of the text) is very close to the cross-modal attention distribution of the clean image (i.e., the correlation between at least one clean image feature of the clean image and at least one text feature of the text), random noise is added to the adversarial image with the noisy cross-modal attention distribution of the noisy image as the optimization objective. This makes the adversarial cross-modal attention distribution of the adversarial image (i.e., the second correlation between at least one adversarial image feature of the adversarial image and at least one text feature of the text) close to the noisy cross-modal attention distribution of the noisy image, thus completing the cleansing of the adversarial image and obtaining a cleaned image. Furthermore, this application guides the adversarial image sanitization process by adding noise to adversarial examples, guided by a cross-modal attention distribution. The visual language model can then obtain correct predictions based on the sanitized image (or sanitized example), enhancing the robustness of the visual language model. Moreover, this method of adding noise to adversarial images using a cross-modal attention distribution as the estimation method not only processes the adversarial image but also optimizes the cross-modal attention distribution itself. This optimization allows the attention distribution to more accurately focus on key information in the image, thereby improving the accuracy of the visual language model's output predictions.

[0106] Calculate the cross-modal attention distribution for the noisy image.

[0107] In some embodiments, the noisy cross-modal attention distribution of a noisy image is closer to the clean cross-modal attention distribution of a clean image than the adversarial cross-modal attention distribution of an adversarial image. Optionally, adversarial image cleansing is achieved by guiding the adversarial cross-modal attention distribution of the adversarial image to approximate the noisy cross-modal attention distribution of the noisy image.

[0108] In some embodiments, the noisy cross-modal attention distribution corresponding to the noisy image is calculated using a visual language model. Of course, the noisy cross-modal attention distribution corresponding to the noisy image can also be calculated using other models or other models similar to the visual language model. This application embodiment does not limit this.

[0109] The following example illustrates the calculation process of noisy cross-modal attention distribution using a visual language model:

[0110] Figure 4A shows a flowchart of a sample purification method provided by an exemplary embodiment of this application, wherein step 230 can be replaced by steps 231, 232 and 233.

[0111] Step 231: Divide the noisy image into multiple regions based on the visual encoder, and encode each region as a region image feature; align the region image features of multiple regions through a visual language model to obtain at least one noisy image feature;

[0112] In some embodiments, the visual language model includes a visual encoder, which extracts feature vectors from the noisy image and encodes the noisy image into region image features (or visual features) of multiple regions. Optionally, the visual encoder receives the noisy image as input and segments it into several regions, each of which can be of the same size. Then, feature extraction is performed on image patches within each region, and each image patch can be encoded as an image feature (i.e., a region image feature). Optionally, at least one noisy image feature is obtained by aligning the multiple region image features using a language alignment module in the visual language model. Each noisy image feature corresponds to a visual token, or in other words, each visual token is used for at least one noisy image feature. Each visual token or noisy image feature can be a fused representation of several region image features. For example, one region of the noisy image corresponds to one region image feature, and a visual token can be a feature representation fused from several image features. For example, the visual encoder in the visual language model divides the noisy image into 16*16=256 regions and extracts 256 image features. The language alignment module then processes these features into 32 visual tokens, each of which can be a fused representation of the 256 image features.

[0113] In one possible implementation, a region image feature can be viewed as a visual token or a noisy image feature in the noisy image, with each visual token indicating a region image feature in the noisy image. Alternatively, multiple region image features can be viewed as a visual token or a noisy image feature in the noisy image, with each visual token indicating image features of multiple regions in the noisy image. For example, if the noisy image is divided into 16×16 regions, each region corresponding to a region image feature, the visual language model processes the noisy image to obtain 32 visual tokens, and each visual token can be a fused representation of the image features of all regions.

[0114] The following example illustrates the image features of a region of an image using a visual token.

[0115] For example, suppose a noisy image is provided, showing a man hitting a ball on a grassy field. This noisy image is input into a visual language model. The visual encoder in the model segments the noisy image into several fixed-size regions, for example, 32 regions. Optionally, for each region, the visual encoder extracts the features of that region to obtain image features. The image features of each region are encoded into a visual token, and each visual token represents the visual information of the corresponding region in the noisy image. For example, region 1 represents grass in the noisy image, and visual token 1 is used to indicate the image features representing the grass portion in the noisy image; region 2 represents grass and a man's feet in the noisy image, and visual token 2 is used to indicate the image features representing the grass and the man's feet portion in the noisy image; region 3 represents a man's head in the noisy image, and visual token 3 is used to indicate the image features representing the man's head portion in the noisy image; region 4 represents a man's arm and a golf club in the noisy image, and visual token 4 is used to indicate the image features representing the man's arm and the golf club portion in the noisy image; region 5 represents a ball in the noisy image, and visual token 5 is used to indicate the image features representing the ball portion in the noisy image; region 6 represents the base of the golf club and grass in the noisy image, and visual token 6 is used to indicate the image features representing the base of the golf club and the grass portion in the noisy image... and so on.

[0116] Step 232: Divide the text into multiple text units based on the language model word segmenter, and encode each text unit as a text unit feature; align the text unit features of multiple text units through the visual language model to obtain at least one text feature;

[0117] In some embodiments, the visual language model includes a language model tokenizer, which extracts feature vectors from the text and encodes the text into text unit features of multiple text units. Optionally, the language model tokenizer receives text as input and breaks down the input text into smaller text units (i.e., text units, which may include words, subwords, or strings).

[0118] The following example illustrates the process of obtaining text features by decomposing text into several sub-words:

[0119] In some embodiments, each sub-word can be encoded by a language model word segmenter to obtain the sub-word features (i.e., text unit features, which can also be understood as a feature vector). Then, each sub-word feature is used as a text feature, or multiple sub-word features are used as a text feature.

[0120] In some embodiments, each sub-word can be encoded by a language model word segmenter to obtain the sub-word feature (i.e., text unit feature, which can also be understood as a feature vector). The visual language model can also preserve the order information of each sub-word in the text and add a positional code to the sub-word feature of each sub-word to obtain a new sub-word feature. The positional code is a value calculated based on the position of the sub-word in the text. Then, each new sub-word feature is used as a text feature, or multiple new sub-word features are used as a text feature.

[0121] The following example illustrates the textual features of a subword of a text using a language token.

[0122] For example, suppose the text for the noisy image above is a question description, indicating the question "What is this man doing?". Inputting this text into a visual language model, the language model segmenter within the visual language model breaks the text down into several sub-words, for example, breaking "What is this man doing?" down into the following sub-words: ["this", "man", "in", "doing", "what", "?"]. For each sub-word, the language model segmenter extracts the corresponding feature vector. To preserve the order information of the sub-words in the text, each sub-word's feature vector may be appended with a positional encoding. The positional encoding is a value calculated based on the sub-word's position in the text. The language alignment module in the visual language model aligns the feature vector and positional encoding of each sub-word, generating language tokens. Each language token represents the textual features of a sub-word in a corresponding region of the text. For example, subword 1 represents "this" in the text, and language token 1 is used to indicate the text features of subword "this"; subword 2 represents "man" in the text, and language token 2 is used to indicate the text features of subword "man"; subword 3 represents "at" in the text, and language token 3 is used to indicate the text features of subword "at"; subword 4 represents "do" in the text, and language token 4 is used to indicate the text features of subword "do"; subword 5 represents "what" in the text, and language token 5 is used to indicate the text features of subword "what"... and so on.

[0123] Step 233: Calculate the first correlation when generating noisy prediction results using a visual language model.

[0124] The denoising prediction result is the prediction result of the visual language model after fusing at least one visual token and at least one linguistic token for the denoised image; where each visual token corresponds to a denoised image feature and each linguistic token corresponds to a text feature.

[0125] In some embodiments, all visual tokens and their corresponding attention weights in the noisy image are integrated together to form an overall representation of the noisy image. The visual language model generates a noisy prediction result corresponding to the noisy image based on the integrated visual tokens and the description of the corresponding language tokens. This noisy prediction result is the prediction result of the visual language model on the integrated visual tokens (noisy image) based on the language tokens (the question description corresponding to the text).

[0126] In some embodiments, when the visual language model generates a noisy prediction result based on a noisy image, it calculates the attention weights of all visual tokens in the noisy image. The attention weights represent the importance of each visual token to the noisy prediction result; that is, the visual language model evaluates the extent to which each visual token influences the generation of the noisy prediction result. Optionally, when generating the noisy prediction result, the visual language model focuses on visual tokens in the noisy image whose attention weights are greater than a first preset weight threshold, and ignores visual tokens in the noisy image whose attention weights are less than a second preset weight threshold.

[0127] In some embodiments, the noisy cross-modal attention distribution can be represented by a noisy cross-modal attention distribution map, that is, the noisy cross-modal attention distribution map is a visual representation of the noisy cross-modal attention distribution. The noisy cross-modal attention distribution map has several dimensions; for example, it can represent the number of layers and the number of visual tokens in the visual language model. The noisy cross-modal attention distribution map can more clearly represent the attention distribution of visual tokens in a noisy image. Optionally, in the noisy cross-modal attention distribution map, visual tokens in the noisy image with attention weights greater than a first preset weight threshold can be represented as a first form, visual tokens in the noisy image with attention weights less than a second preset weight threshold can be represented as a second form, and visual tokens in the noisy image with attention weights less than the first preset weight threshold and greater than the second preset weight threshold can be represented as a third form. Optionally, the visual saliency of the first form is higher than that of the third form, and the visual saliency of the third form is higher than that of the second form. This application does not limit this.

[0128] For example, suppose a noisy image is input into a visual language model. The noisy image shows a man hitting a ball on grass, and the corresponding text is a question description: "What is this man doing?". For example, region 1 in the noisy image represents the grass; region 2 represents the grass and the man's feet; region 3 represents the man's head; region 4 represents the man's arms and the club; region 5 represents the ball; region 6 represents the sky, etc.; sub-word 1 in the text represents "this"; sub-word 2 represents "man"; sub-word 3 represents "at"; sub-word 4 represents "doing"; sub-word 5 represents "what", etc. When generating a noisy prediction result for the noisy image, the visual language model calculates the attention weight of each sub-word in the text to each region (visual token) in the noisy image. This reflects the degree of attention the visual language model pays to the visual token when generating the noisy prediction result. Optionally, when generating noisy prediction results, the visual language model may focus on regions with high attention weights in the noisy image. For example, the attention weight of the visual token corresponding to region 1 in the noisy image is 0.05, the attention weight of the visual token corresponding to region 2 is 0.1, the attention weight of the visual token corresponding to region 3 is 0.1, the attention weight of the visual token corresponding to region 4 is 0.3, the attention weight of the visual token corresponding to region 5 is 0.2, and the attention weight of the visual token corresponding to region 6 is 0.01, etc. For example, when generating noisy prediction results, the visual language model will focus on the "man's arm and club" indicated by region 4 and the "ball" indicated by region 5 in the noisy image, and ignore the "sky" indicated by region 6 in the noisy image. The visual language model, combined with the question description corresponding to the text, obtains the noisy prediction result as "throwing the ball," "hitting the ball," or other results.

[0129] It should be understood that the embodiments of this application do not limit the structure of the visual language model. For example, the visual encoder and the language model segmenter described above can be replaced by a single model or module to achieve the functions of the visual encoder and the language model segmenter.

[0130] In summary, the method provided in this application encodes a noisy image into several region image features using a visual encoder. Each visual token represents the image features (one or more sets of feature vectors) of one or more regions of the image. This decomposition simplifies the complex information of the noisy image into a set of structured features, which helps the visual language model process and understand different parts of the noisy image. The text is then encoded into several sets of text unit features, i.e., feature vectors, using a language model tokenizer. Each language token represents one or more sub-words of the text. This decomposition transforms the text into structured features, which helps the visual language model understand the semantics of the text. The method also calculates the noisy cross-modal attention distribution using a visual language model, allowing the model to focus on the correlation between the noisy image and the text when generating noisy prediction results. This helps the model determine which image regions in the noisy image are most relevant to which sub-words in the text, thereby more accurately understanding and interpreting the relationship between the image and the text, and generating more accurate and relevant prediction results.

[0131] Calculate the cross-modal attention distribution corresponding to the adversarial image

[0132] Optionally, adversarial image cleansing can be achieved by guiding the adversarial cross-modal attention distribution of the adversarial image to approximate the noisy cross-modal attention distribution of the noisy image.

[0133] In some embodiments, the adversarial cross-modal attention distribution corresponding to the adversarial image is calculated using a visual language model. Of course, the adversarial cross-modal attention distribution corresponding to the adversarial image can also be calculated using other models or other models similar to the visual language model. This application embodiment does not limit this.

[0134] The following example illustrates the calculation process of adversarial cross-modal attention distribution using a visual language model:

[0135] Figure 4B shows a flowchart of a sample purification method provided by an exemplary embodiment of this application, wherein step 240 can be replaced by steps 241, 242 and 243.

[0136] Step 241: Divide the adversarial image into multiple regions based on the visual encoder, and encode each region as a region image feature; align the region image features of multiple regions through a visual language model to obtain at least one adversarial image feature;

[0137] In some embodiments, the visual language model includes a visual encoder, which extracts feature vectors from the adversarial image and encodes the adversarial image into region image features (or visual features) of multiple regions. Optionally, the visual encoder receives the adversarial image as input and segments it into several regions, each of which can be of the same size. Then, it extracts features from image patches within each region, encoding each region's image patch into an image feature (i.e., a region image feature). Optionally, the language alignment module in the visual language model aligns the multiple region image features to obtain at least one adversarial image feature. Each adversarial image feature corresponds to a visual token, or in other words, each visual token is used for at least one adversarial image feature. Each visual token or adversarial image feature can be a fused representation of several region image features. For example, one region of the adversarial image corresponds to one region image feature, and a visual token can be a feature representation fused from several image features. For instance, the visual encoder in the visual language model divides the adversarial image into 16*16 = 256 regions and extracts 256 image features, which are then processed by the language alignment module into 32 visual tokens. Each visual token can be a fused representation of the 256 image features.

[0138] In one possible implementation, a region image feature can be viewed as a visual token or adversarial image feature of the adversarial image, with each visual token indicating a region image feature of the adversarial image. Alternatively, multiple region image features can be viewed as a visual token or adversarial image feature of the adversarial image, with each visual token indicating image features of multiple regions of the adversarial image. For example, the adversarial image is divided into 16×16 regions, each region corresponding to a region image feature. The visual language model processes the adversarial image to obtain 32 visual tokens, each of which can be a fused representation of the image features of all regions.

[0139] Step 242: Divide the text into multiple text units based on the language model word segmenter, and encode each text unit as a text unit feature; align the text unit features of multiple text units through the visual language model to obtain at least one text feature;

[0140] For an explanation of step 242, please refer to step S232. This application embodiment will not repeat the details.

[0141] Step 243: Calculate the second correlation when generating adversarial test results using a visual language model.

[0142] The adversarial prediction result is the prediction result of the visual language model after fusing at least one visual token and at least one linguistic token for the adversarial image; where each visual token corresponds to an adversarial image feature and each linguistic token corresponds to a text feature.

[0143] The adversarial prediction result is the prediction result of the visual language model after fusing at least one visual token and at least one linguistic token for the adversarial image.

[0144] In some embodiments, all visual tokens and their corresponding attention weights in the adversarial image are integrated to form an overall representation of the adversarial image. The visual language model generates an adversarial prediction result corresponding to the adversarial image based on the integrated visual tokens and the description of the corresponding language tokens. This adversarial prediction result is the prediction result of the visual language model on the integrated visual tokens (adversarial image) based on the language tokens (problem descriptions corresponding to the text).

[0145] In some embodiments, when the visual language model generates adversarial prediction results based on an adversarial image, it calculates the attention weights of all visual tokens in the adversarial image. The attention weights represent the importance of each visual token to the adversarial prediction result; that is, the visual language model evaluates the extent to which each visual token influences the generation of the adversarial prediction result. Optionally, when generating adversarial prediction results, the visual language model focuses on visual tokens in the adversarial image whose attention weights are greater than a first preset weight threshold, and ignores visual tokens in the adversarial image whose attention weights are less than a second preset weight threshold.

[0146] In some embodiments, the adversarial cross-modal attention distribution can be represented by an adversarial cross-modal attention distribution map, that is, the adversarial cross-modal attention distribution map is a visual representation of the adversarial cross-modal attention distribution. The adversarial cross-modal attention distribution map has several dimensions; for example, it can represent the number of layers in the visual language model and the number of visual tokens. The adversarial cross-modal attention distribution map can more clearly represent the attention distribution of visual tokens in the adversarial image. Optionally, in the adversarial cross-modal attention distribution map, visual tokens in the adversarial image with attention weights greater than a first preset weight threshold can be represented in a first form, visual tokens in the adversarial image with attention weights less than a second preset weight threshold can be represented in a second form, and visual tokens in the adversarial image with attention weights less than the first preset weight threshold and greater than the second preset weight threshold can be represented in a third form. Optionally, the visual saliency of the first form is higher than that of the third form, and the visual saliency of the third form is higher than that of the second form. This application does not limit this.

[0147] In summary, the method provided in this application encodes adversarial images into several regions of image features using a visual encoder. Each visual token represents the image features (one or more sets of feature vectors) of one or more regions of the image. This decomposition simplifies the complex information of the adversarial image into a set of structured features, which helps the visual language model process and understand different parts of the adversarial image. The text is then encoded into several sets of text unit features, i.e., feature vectors, using a language model tokenizer. Each language token represents one or more subwords of the text. This decomposition transforms the text into structured features, which helps the visual language model understand the semantics of the text. By calculating a noisy cross-modal attention distribution using the visual language model, the model can focus on the correlation between the adversarial image and the text when generating adversarial prediction results. This helps the visual language model determine which image regions in the adversarial image are most relevant to which subwords in the text, thereby more accurately understanding and interpreting the relationship between the image and the text, and generating more accurate and relevant prediction results.

[0148] Adding a second noise to adversarial images with the goal of minimizing correlation differences

[0149] In some embodiments, a first correlation is used as a target to guide a second correlation to approach the first correlation. Optionally, a second noise is added to the adversarial image to generate a cleaned image, with the goal of minimizing the difference between the first and second correlations.

[0150] Figure 5 shows a flowchart of a sample purification method provided by an exemplary embodiment of this application, wherein step 250 can be replaced by step 251.

[0151] Step 251: With the goal of minimizing the correlation difference, add a second noise to the adversarial image to clean it and obtain a cleaned image.

[0152] The correlation difference refers to the difference between the first and second correlations. This correlation difference can also be called the attention difference or attention value, which represents the difference between the noisy cross-modal attention distribution and the adversarial cross-modal attention distribution.

[0153] In some embodiments, the noisy cross-modal attention distribution is the cross-modal attention distribution corresponding to the noisy image, used to describe the attention distribution of the noisy image and the text. The adversarial cross-modal attention distribution is the cross-modal attention distribution corresponding to the adversarial image, used to describe the attention distribution of the adversarial image and the text. Optionally, the noisy cross-modal attention distribution corresponding to the noisy image is calculated based on visual tokens and linguistic tokens in the noisy image, and the adversarial cross-modal attention distribution corresponding to the adversarial image is calculated based on visual tokens and linguistic tokens in the adversarial image.

[0154] In some embodiments, an attention difference value can be obtained based on the adversarial cross-modal attention distribution and the noisy cross-modal attention distribution, where the attention difference value is the difference between the noisy cross-modal attention distribution and the adversarial cross-modal attention distribution. Optionally, a second noise is added to the adversarial image with the goal of minimizing the attention difference value.

[0155] Alternatively, the attention difference value can be expressed as:

[0156] ΔA=A(x′ i ,x t ,f)-A(R(x′ i ,α ∞ ),x t f)

[0157] Where ΔA represents the attention difference value, x′ i Represents an adversarial image, R(x′) i ,α ∞ ) represents a noisy image, i.e., in the adversarial image x′ i Add first noise α ∞ The resulting noisy image, x t Let A(x′) represent text, f represent the visual language model, and A(x′) represent the text. i ,x t f) represents the adversarial cross-modal attention distribution corresponding to the adversarial image, A(R(x′) i ,α ∞ ),x t f) represents the noisy cross-modal attention distribution corresponding to the noisy image.

[0158] In some embodiments, the noisy cross-modal attention distribution corresponding to the noisy image is close to the clean cross-modal attention distribution corresponding to the clean image. Therefore, the noisy cross-modal attention distribution can be considered as a reference point for cleansing. Optionally, adversarial image cleansing is achieved by guiding the adversarial cross-modal attention distribution to approach the noisy cross-modal attention distribution, i.e., minimizing the difference (attention difference value) between the adversarial cross-modal attention distribution and the noisy cross-modal attention distribution. In one possible implementation, adding a second noise to the adversarial image can influence the attention distribution (or attention weights) of visual tokens in the adversarial cross-modal attention distribution, thereby achieving adversarial image cleansing and obtaining a cleaned image.

[0159] Alternatively, the purified image can be represented as:

[0160] in, Indicates a cleaned image, x′ i Represents an adversarial image, R(x′) ′ ,α ∞) represents a noisy image, x t Let f represent the text, f represent the visual language model, and β represent the second noise, i.e., the second noise is based on the second distribution interval [0, β]. ∞ The second noise value obtained by pseudo-random sampling is determined, and the second distribution interval is [0, β]. ∞ ] represents the range of a uniformly distributed interval. A(x′) i ,x t f) represents the adversarial cross-modal attention distribution corresponding to the adversarial image, A(R(x′) i ,α ∞ ),x t f) represents the noisy cross-modal attention distribution corresponding to the noisy image, A(x′) i ,x t ,f)-A(R(x′ i ,α ∞ ),x t f) represents the attention difference value. This represents minimizing the attention difference value.

[0161] In some embodiments, a second noise is added to the adversarial image to obtain a cleaned image, with the goal of minimizing attention differences. Optionally, the second noise added to the adversarial image is uniform noise.

[0162] In some embodiments, an image with added second noise is input into a visual language model for prediction. Optionally, the image is determined to be a cleaned image based on the visual language model's prediction result for the image with added second noise: if the visual language model's prediction result for the image is correct (the same as the prediction result for the clean image), the image can be determined to be a cleaned image; if the visual language model's prediction result for the image is incorrect (different from the prediction result for the clean image), random noise is continued to be added to the adversarial image based on the noisy cross-modal attention distribution to adjust the attention distribution of visual tokens in the adversarial image until the visual language model's prediction result is a correct prediction result.

[0163] In one possible implementation, a preset question-answering score threshold is set in the visual language model, and the prediction result of the visual language model is determined based on the preset question-answering score threshold to determine whether the prediction result is correct. Optionally, when the question-answering score of the visual language model for the image after adding second noise to the adversarial image is greater than the preset question-answering score threshold, the prediction result of the visual language model is a correct prediction result, and the image at this time is a cleaned image; when the question-answering score of the visual language model for the image after adding second noise to the adversarial image is less than the preset question-answering score threshold, the prediction result of the visual language model is an incorrect prediction result, and random noise is continued to be added to the adversarial image based on the noisy cross-modal attention distribution until the visual language model outputs a correct prediction result. This application does not limit the specific value of the preset question-answering score threshold.

[0164] In some implementations, adding a second noise to the adversarial image based on the noisy cross-modal attention distribution and the adversarial cross-modal attention distribution to clean the adversarial image and obtain a cleaned image includes: adding a second noise to the adversarial image with the goal of minimizing a target difference value to obtain the cleaned image; wherein the target difference value is the product or sum of an attention difference value and a preset coefficient, and the attention difference value is the difference between the noisy cross-modal attention distribution and the adversarial cross-modal attention distribution. In summary, when designing the optimization target, as long as the adversarial cross-modal attention distribution of the adversarial image can be made close to the noisy cross-modal attention distribution of the noisy image, the embodiments of this application do not limit the optimization target.

[0165] In this embodiment, by calculating the adversarial cross-modal attention distribution corresponding to the adversarial image and the noisy cross-modal attention distribution corresponding to the noisy image, and with the goal of minimizing the difference (attention difference value) between the adversarial cross-modal attention distribution and the noisy cross-modal attention distribution, a second noise is added to the adversarial image. This guidance method, which uses the cross-modal attention distribution as the estimation direction, can obtain a cleaned image. This method not only processes the noise in the adversarial image, but also optimizes the cross-modal attention distribution mechanism itself, so that the attention mechanism can more accurately focus on the key information in the adversarial image and ignore irrelevant or interfering information, thereby improving the accuracy and efficiency of the cross-modal task.

[0166] Control the direction of the noise added to the adversarial image

[0167] In some embodiments, a second noise is added to the adversarial image to generate a cleaned image, with the objective of minimizing the difference between the adversarial cross-modal attention distribution and the noisy cross-modal attention distribution. Optionally, the cleaned image is generated by controlling the direction of the noise added to the adversarial image. In other words, a second noise is added to the adversarial image to generate a cleaned image, with the objective of minimizing the correlation difference. Optionally, the cleaned image is generated by controlling the direction of the noise added to the adversarial image.

[0168] Figure 6 shows a flowchart of a sample purification method provided by an exemplary embodiment of this application, wherein step 251 can be replaced by steps 251a, 251b and 251c.

[0169] Step 251a: Calculate the norm of the correlation difference;

[0170] The norm is used to measure the distance between the first correlation and the second correlation.

[0171] In some embodiments, both the first correlation and the second correlation can be represented as matrices, and the norm is used to measure the spatial distance between the first correlation and the second correlation.

[0172] In some embodiments, the norm is the L2 norm (Euclidean norm), which is the square root of the sum of the squares of the vectors (attention matrices) and is used to measure the magnitude of the difference between the primary and secondary correlations. The norm value corresponding to the norm provides a quantitative measure. Optionally, a smaller norm value indicates that the primary and secondary correlations are similar, while a larger norm value indicates that the primary and secondary correlations are significantly different.

[0173] In some embodiments, calculating the norm of the correlation difference can also be understood as calculating the loss function of the correlation difference (the L2 distance between correlation differences). Optionally, the norm of the correlation difference can be expressed as:

[0174] Y = ||A(x′) i ,x t ,f)-A(R(x′ i ,α ∞ ),x t ,f)||2

[0175] Where, x′ i Represents an adversarial image, R(x′) i ,α ∞ ) represents a noisy image, x t Let A(x′) represent text, f represent the visual language model, and A(x′) represent the text. i ,x tf) represents the adversarial cross-modal attention distribution corresponding to the adversarial image, i.e., the second correlation, A(R(x′) i ,α ∞ ),x t f) represents the noisy cross-modal attention distribution corresponding to the noisy image, i.e., the first correlation, A(x′). i ,x t ,f)-A(R(x′ i ,α ∞ ),x t f) represents the correlation difference, ||A(x′) i ,x t ,f)-ARxi′,α∞,xt,f2 represents the norm of the correlation difference.

[0176] Step 251b: Calculate the norm of the correlation difference for the gradient of each pixel in the adversarial image;

[0177] In some embodiments, the norm of the correlation difference can be considered as a loss function for the correlation difference, where the norm of the correlation difference is relative to the gradient of each pixel in the adversarial image. This can be understood as the loss function being relative to the gradient of each pixel in the adversarial image. Optionally, the gradient is used to indicate the direction of the fastest descent of the loss function; that is, the gradient is used to indicate how to add a second noise to minimize the correlation difference.

[0178] Alternatively, the gradient can be expressed as:

[0179] Where g represents the gradient, A(x′) i ,x t f) represents the adversarial cross-modal attention distribution corresponding to the adversarial image, A(R(x′) i ,α ∞ ),x t f) represents the noisy cross-modal attention distribution corresponding to the noisy image. This represents the gradient of pixels in an adversarial image.

[0180] Step 251c: Determine the noise addition method for each pixel based on the gradient of each pixel, and add second noise to each pixel according to the noise addition method of each pixel to obtain a cleaned image.

[0181] In some embodiments, the gradient direction is determined based on a sign function. The gradient direction is used to indicate the direction of adding second noise to the adversarial image, that is, adding second noise to the pixels in the adversarial image. The pixels in the adversarial image are adjusted toward the gradient direction to reduce correlation differences.

[0182] In some embodiments, the noise addition direction of each pixel is determined based on the gradient of each pixel in the adversarial image. This can also be understood as determining the noise addition method of each pixel based on the gradient of each pixel in the adversarial image. The noise addition direction is the same as the gradient direction; that is, the noise addition method is to add a second noise along the gradient direction to the pixel of the adversarial image. Optionally, the noise addition method includes increasing the pixel value of the pixel in the adversarial image; or decreasing the pixel value of the pixel in the adversarial image; or keeping the pixel value unchanged (the case of unchanged pixel values ​​is almost non-existent; essentially, the pixel value of each pixel in the adversarial image changes).

[0183] Optionally, determining the noise addition direction (or noise addition method for each pixel) of the adversarial image based on the sign function can be expressed as:

[0184] Where, A(x′) i ,x t f) represents the adversarial cross-modal attention distribution corresponding to the adversarial image, A(R(x′) i ,α ∞ ),x t f) represents the noisy cross-modal attention distribution corresponding to the noisy image, and sign(·) represents the sign function. This represents the gradient.

[0185] In some embodiments, the gradient is used as input to the sign function. When the gradient is positive (i.e., the gradient of the i-th pixel in the adversarial image is positive), the sign function outputs 1, indicating that the noise addition method for the i-th pixel is the first noise addition method, which adds second noise to the pixel value of the i-th pixel to increase its pixel value. When the gradient is negative (i.e., the gradient of the i-th pixel is negative), the sign function outputs -1, indicating that the noise addition method for the i-th pixel is the second noise addition method, which adds second noise to the pixel value of the i-th pixel to decrease its pixel value. When the gradient is zero (i.e., the gradient of the i-th pixel in the adversarial image is zero), the sign function outputs 0, indicating that the noise addition method for the i-th pixel is to keep the pixel value unchanged. Optionally, keeping the pixel value of the i-th pixel unchanged (this situation is almost non-existent). A cleaned image is obtained by applying the noise addition method to each pixel in the adversarial image as described above.

[0186] In this embodiment, the gradient direction is determined by using a sign function. The gradient direction is used to indicate the direction of adding second noise to the adversarial image. That is, the noise addition method of each pixel is determined based on the gradient. By using the gradient to guide the adjustment of pixel values, the adversarial image can be precisely cleaned. Using a sign function can simplify the processing of the gradient, directly converting the gradient into the direction of pixel value adjustment (increase or decrease), thus simplifying the calculation process.

[0187] In summary, the method provided in this application can quantitatively assess the difference between the first and second correlations by calculating the norm of the correlation difference. By utilizing the gradient of each pixel to determine its noise addition method, the purification process becomes targeted. The noise addition method is adaptively adjusted based on the gradient of each pixel. The purified image obtained by adaptively adjusting the method for each pixel in the adversarial image can significantly reduce the impact of adversarial perturbations, enhance the robustness and security of the visual language model, and improve its defense against adversarial attacks.

[0188] In some embodiments, adding second noise to the adversarial image with the goal of minimizing the correlation difference to clean the adversarial image and obtain the cleaned image includes: calculating the minimum difference value of the correlation difference; calculating the gradient of the norm of the minimum correlation difference with respect to each pixel in the adversarial image; determining the noise addition method for each pixel based on the gradient of each pixel; adding second noise to each pixel according to the noise addition method of each pixel to obtain the cleaned image.

[0189] It should be understood that the correlation difference is actually a matrix, and the minimum correlation difference is the smallest element in that matrix.

[0190] It should be understood that the gradient calculation method and the noise addition method for each pixel can be referred to above, and will not be repeated in the embodiments of this application.

[0191] In some embodiments, adding second noise to the adversarial image with the goal of minimizing the correlation difference to clean the adversarial image and obtain the cleaned image includes: calculating the maximum difference value of the correlation difference; calculating the gradient of the norm of the maximum correlation difference with respect to each pixel in the adversarial image; determining the noise addition method for each pixel based on the gradient of each pixel; adding second noise to each pixel according to the noise addition method of each pixel to obtain the cleaned image.

[0192] It should be understood that the correlation difference is actually a matrix, and the maximum correlation difference is the largest element in that matrix.

[0193] It should be understood that the gradient calculation method and the noise addition method for each pixel can be referred to above, and will not be repeated in the embodiments of this application.

[0194] Control the amount of noise added to the adversarial image at the pixel level.

[0195] In some embodiments, the gradient of each pixel in the adversarial image is calculated, and the gradient includes both direction and intensity information, which indicates the magnitude of pixel adjustment in the adversarial image.

[0196] The intensity information of the gradient is used to determine the second noise corresponding to each pixel in the adversarial image, which is used to indicate the gradient magnitude of each pixel in the adversarial image.

[0197] In some embodiments, adversarial images in adversarial examples are divided into pixel-level segments, and second noise of varying perturbation levels (different noise magnitudes) is added to different pixel locations in the adversarial images based on gradient direction. The gradient intensity information is used to indicate the gradient magnitude of each pixel in the adversarial image. Optionally, pixels with larger gradients in the adversarial image should be subject to greater perturbation, i.e., have relatively larger noise added; pixels with smaller gradients in the adversarial image should have smaller perturbation, i.e., have relatively smaller noise added.

[0198] In this embodiment, the magnitude of the second noise added to each pixel in the adversarial image is determined by the gradient intensity information. The intensity information reflects the magnitude of the gradient and can better guide the addition of the second noise, making the noise addition process more accurate.

[0199] In some embodiments, a first gradient value and a second gradient value are obtained, wherein the first gradient value is the maximum gradient value of all pixels in the adversarial image, and the second gradient value is the minimum gradient value of all pixels in the adversarial image. Optionally, a gradient standard value is obtained based on the maximum and minimum gradient values, wherein the gradient standard value is the gradient value after normalization. Optionally, the gradient is normalized to [0, 1].

[0200] Alternatively, the gradient can be represented as:

[0201] Where g represents the gradient, A(x′) i ,x t f) represents the adversarial cross-modal attention distribution corresponding to the adversarial image, A(R(x′) i ,α ∞ ),x t f) represents the noisy cross-modal attention distribution corresponding to the noisy image.

[0202] Optionally, the standard value of the gradient is represented as: g norm =(gg)min ) / (g max -g min )

[0203] Among them, g norm G represents the standard value of the gradient. min G represents the first gradient value, i.e., the minimum gradient value. max This represents the second gradient value, which is the maximum value of the gradient.

[0204] In some embodiments, since the gradient standard values ​​differ significantly, the gradient standard values ​​can be represented based on their average value. Optionally, the perturbation amplitude of the second noise is determined based on the gradient standard values ​​and their average value. The perturbation amplitude includes a perturbation factor used to determine the magnitude of the second noise, and the magnitude of the second noise added to each pixel in the adversarial image is determined based on the perturbation factor. The magnitude of the second noise is positively correlated with the intensity information of the gradient; that is, pixels with larger gradients (stronger intensity information) in the adversarial image should be subject to greater perturbation, i.e., a relatively larger amount of second noise should be added; pixels with smaller gradients (weaker intensity information) in the adversarial image should be subject to smaller perturbation, i.e., a relatively smaller amount of second noise should be added.

[0205] Optionally, the magnitude of a second noise added to each pixel in the adversarial image is determined based on a perturbation factor to obtain a cleaned image. The cleaned image can be represented as:

[0206] in, Indicates a cleaned image, x′ i Representing an adversarial image, sign(g) indicates the direction of adding second noise (or the noise addition method for each pixel) in the adversarial image. norm Represents the standard value of the gradient. The average value of the gradient standard can be represented by... Determine the amplitude of the second noise disturbance. The value of is the perturbation factor, which is used to determine the second noise β. ∞ The magnitude of the perturbation factor. Optionally, 0 represents the first normalized value, and 1 represents the second normalized value. The perturbation factor is the maximum of the first normalized value and the first value itself, the first value is the minimum of the second normalized value and the second value, and the second value is the quotient of the standard gradient value and the average of the standard gradient values. That is, the first value is... The second value is g norm and The business Optionally, the disturbance factor is a value within the disturbance amplitude.

[0207] In some embodiments, the second noise is determined based on the product of a second noise value obtained by pseudo-random sampling in a second distribution interval and a perturbation factor, wherein the second distribution interval is a uniformly distributed interval range.

[0208] In this embodiment, by obtaining the maximum and minimum gradient values ​​of all pixels in the adversarial image and normalizing the gradient values ​​to obtain standard gradient values, gradient values ​​at different scales can be processed uniformly. The perturbation amplitude of the second noise is determined based on the standard gradient value and its average value, making the noise addition process more flexible and adaptive. This adaptive adjustment method can reasonably determine the magnitude of the added second noise according to the actual gradient situation; that is, the larger the gradient, the larger the added second noise. This method of adding second noise to the adversarial image improves the purification effect.

[0209] In some embodiments, the size of the second noise corresponding to each pixel in the adversarial image can also be a preset size, that is, it is not necessary to use the intensity information of the gradient to determine the size of the second noise.

[0210] It should be understood that the embodiments of this application do not limit the calculation method of the above-mentioned gradient standard value. For example, the gradient standard value is the average value of the gradients of all pixels in the adversarial image.

[0211] Training process of visual language model

[0212] In some embodiments, a visual language model can be pre-trained. Inputting a sanitized sample into the visual language model yields a question-answer score, which indicates the probability that the sanitized sample belongs to the correct prediction (correct category). Optionally, the question-answer score is positively correlated with the sanitized cross-modal attention distribution of the sanitized sample.

[0213] In one possible implementation, the visual language model is trained as follows:

[0214] In some embodiments, a clean sample dataset is obtained. This dataset is a collection of samples used to train a visual language model. The clean sample dataset includes multiple clean samples, each comprising a clean image and text. The clean image is an image obtained using the method provided in the above embodiments. A corresponding label on each clean sample indicates the category to which the clean image belongs. Then, the clean samples are input into the visual language model, which encodes the clean image as image features and the text as text features. Optionally, the visual language model fuses image features and text features based on the clean cross-modal attention distribution of the clean image. The clean cross-modal attention distribution describes the attention distribution between the clean image and the text, allowing the visual language model to focus on text-related image regions within the clean image based on this distribution.

[0215] In some embodiments, the visual language model predicts the fused features, which are features generated by fusing image and text features based on the attention distributions of image and text in the cleansing cross-modal attention distribution. Optionally, the visual language model predicts based on the fused features to obtain a question-answer score for the cleaned sample, which indicates the probability that the cleaned sample belongs to the correct prediction result (correct category). Optionally, the question-answer score is positively correlated with the cleansing cross-modal attention distribution of the cleaned image. Optionally, a score threshold is set in the visual language model. When the question-answer score of the visual language model is greater than the score threshold, it indicates that the cleaned sample belongs to the correct prediction result; when the question-answer score of the visual language model is less than or equal to the score threshold, it indicates that the cleaned sample belongs to the incorrect prediction result, indicating that the input cleaned sample belongs to the incomplete cleansing result. When the visual language model's prediction result for the cleaned sample is an incorrect prediction result, it indicates that the cleansing cross-modal attention distribution in the cleaned sample needs to be further adjusted, that is, random noise needs to be added to the adversarial examples to adjust the adversarial cross-modal attention distribution of the adversarial examples.

[0216] In some embodiments, the predicted result corresponding to the question-answer score is compared with the true result (the label corresponding to the cleaned sample) to obtain a calculated loss, which is used to indicate the error between the predicted result and the true result corresponding to the question-answer score. Optionally, a backpropagation algorithm is used to adjust the parameters of the visual language model so that the predicted result of the visual language model is closer to the label corresponding to the cleaned sample. Optionally, the visual language model is optimized through a loss function. The loss function can be any type of loss function, for example, it can be a CE loss (Cross Entropy loss) function or a Mean Square Error (MSE) loss function.

[0217] It should be noted that the training of the visual language model provided in this embodiment is only illustrative and does not constitute a limitation on the training method of the visual language model.

[0218] In some embodiments, the visual language model can be applied to visual question answering scenarios.

[0219] In one application scenario, sample sanitization can be applied to the field of classification question answering. The sanitized sample is input into a visual language model, which then performs recognition based on the sanitized sample to obtain the correct question answer corresponding to the sanitized sample.

[0220] Step 1, obtain classification adversarial examples;

[0221] Classification adversarial examples are adversarial examples generated after performing adversarial attacks on clean samples. Classification adversarial examples include a classification adversarial image and a problem description.

[0222] In some embodiments, adversarial attacks involve making minor modifications or perturbations to clean samples. Modifications or perturbations in classification adversarial examples are often imperceptible, but can cause the visual language model to make incorrect predictions and generate incorrect output.

[0223] For example, a clean image shows a bicycle parked in front of a building. In a question-and-answer scenario, the question for this clean image is described as "What material is the door of this building made of?" The visual language model correctly classifies it as "wood". By applying an adversarial attack to this clean image, such as an adversarial attack based on the FGSM method, a classification adversarial image can be generated. In a question-and-answer scenario, the question for this classification adversarial image is described as "What material is the door of this building made of?" The visual language model incorrectly classifies it as "metal".

[0224] In some embodiments, the visual language model calculates the adversarial cross-modal attention distribution corresponding to the clean image based on visual tokens and linguistic tokens in the clean image. Optionally, the clean image is encoded into image features based on a visual encoder, and at least one visual token is obtained by aligning the image features through the visual language model, where each of the at least one visual token is used to indicate the image features of the clean image; the question description is encoded into text features based on a language model tokenizer, and at least one linguistic token is obtained by aligning the text features through the visual language model, where each of the at least one linguistic token is used to indicate the text features of the question description; the clean cross-modal attention distribution for generating a clean prediction result is calculated through the visual language model, where the clean prediction result is the prediction result of the visual language model after fusing at least one visual token and at least one linguistic token.

[0225] For example, when the visual language model predicts a clean image, the generated clean prediction result is "wood". The visual language model calculates the attention weights of all visual tokens in the clean image. The visual language model divides the clean image into several regions. The image features of each region (or the image features corresponding to multiple regions) can be represented as a visual token. The attention weights represent the importance of each visual token to the answer "wood". That is, the visual language model evaluates the extent to which each visual token affects the generation of "wood".

[0226] In some embodiments, when a visual language model predicts a classification adversarial image, it calculates the adversarial cross-modal attention distribution for that image. The adversarial cross-modal attention distribution is the cross-modal attention distribution corresponding to the classification adversarial image, used to describe the attention distribution between the classification adversarial image and the question description. The process for calculating the adversarial cross-modal attention distribution for a classification adversarial image is similar to the process for calculating the clean cross-modal attention distribution for a clean image described above.

[0227] Step 2: Obtain the noisy image obtained after adding the first noise to the adversarial image;

[0228] The noisy image is the image after applying a first perturbation to the classification adversarial image. The first noise refers to random noise added to the classification adversarial image. The first noise is generated randomly or according to certain rules, with the aim of perturbing the pixel values ​​of the classification adversarial image. In one possible implementation, the first noise is added via a computer program. In another possible implementation, the first noise is added via a noise model, such as using a generative adversarial network, variational autoencoder, or other deep learning model to generate the first noise, which is then added to the classification adversarial image.

[0229] Step 3: Determine the first correlation between at least one noisy image feature of the noisy image and at least one text feature of the text;

[0230] In other words, we can calculate the noisy cross-modal attention distribution corresponding to the noisy image.

[0231] The noisy cross-modal attention distribution is used to describe the correlation between at least one noisy image feature of the noisy image and at least one text feature of the problem description text.

[0232] In one possible implementation, a noisy image is obtained by adding first noise to the class adversarial image. Compared to the adversarial cross-modal attention distribution of the class adversarial image, the noisy cross-modal attention distribution of the noisy image is closer to the clean cross-modal attention distribution of the clean image. Therefore, using the noisy cross-modal attention distribution of the noisy image as a reference estimation direction to guide the optimization of the adversarial cross-modal attention distribution of the class adversarial image can be regarded as a cleaning operation for the class adversarial image, making it closer to the clean image.

[0233] For example, if the problem description for a noisy image is "What material is the door of this building made of?", a visual language model might incorrectly classify it as "bricks". However, the noisy cross-modal attention distribution for this noisy image is closer to the clean cross-modal attention distribution for the clean image.

[0234] In some embodiments, the noisy cross-modal attention distribution corresponding to the noisy image is calculated. The noisy cross-modal attention distribution refers to how the visual language model pays attention to the noisy image in the noisy sample when generating prediction results based on the noisy sample. The adversarial cross-modal attention distribution for noisy images is similar to the process described above for the noisy cross-modal attention distribution of noisy images.

[0235] Step 4: Determine a second correlation between at least one adversarial image feature of the adversarial image and at least one text feature of the text;

[0236] In other words, calculate the adversarial cross-modal attention distribution corresponding to the adversarial image;

[0237] Adversarial cross-modal attention distribution is used to describe the correlation between at least one adversarial image feature of the adversarial image and at least one text feature of the problem description text.

[0238] Step 5: Add second noise to the adversarial image based on the first correlation and the second correlation to clean the adversarial image and obtain a cleaned image.

[0239] The purified image is the image after applying a second perturbation to the adversarial image. The second noise refers to random noise added to the classification adversarial image. The second noise is generated randomly or according to certain rules, and its purpose is to perturb the pixel values ​​of the classification adversarial image.

[0240] For example, if the problem description for a noisy image is "What material is the door of this building made of?", the visual language model might correctly classify it as "wood". Although a cleaned image may be visually noisier, the cleaned cross-modal attention distribution of the cleaned image may be closer to the clean cross-modal attention distribution of the clean image. Therefore, the visual language model's prediction for the cleaned image is closer to its prediction for the clean image.

[0241] In some embodiments, by continuously adding random noise to the classification adversarial image, the second correlation can be guided to approach the first correlation, thereby generating a cleaned image. Optionally, a second noise is added to the classification adversarial image with the goal of minimizing the correlation difference, resulting in a cleaned image.

[0242] In some embodiments, the direction of adding second noise can be determined. First, the norm of the correlation difference is calculated, which measures the distance between the first and second correlations. Second, the gradient of the correlation difference with respect to pixels in the classification adversarial image is calculated. Then, the gradient direction is determined based on the sign function; this can also be understood as determining the noise addition method for each pixel based on its gradient, with the gradient direction indicating the direction of adding second noise. Optionally, the gradient is used as input to the sign function. When the gradient is positive, the pixel value in the adversarial image is increased according to the gradient direction; when the gradient is negative, the pixel value in the adversarial image is decreased according to the gradient direction. Increasing or decreasing the pixel value in the adversarial image according to the gradient direction yields a cleaned image after adding second noise.

[0243] In some embodiments, the magnitude of the added second noise can also be determined. Optionally, the gradient includes not only gradient direction information but also intensity information. Optionally, pixels with larger gradients in the adversarial image should be subjected to greater perturbation, i.e., relatively larger noise should be added; pixels with smaller gradients in the adversarial image should be subjected to smaller perturbation, i.e., relatively smaller noise should be added.

[0244] In summary, visual language models produce erroneous predictions based on classification adversarial examples. By performing a cleansing operation on the classification adversarial images in the adversarial examples, cleaned images can be obtained, thus leading to cleaned samples. Specifically, a noisy image is obtained by randomly adding noise to the classification adversarial image. Since the noisy cross-modal attention distribution (i.e., the first correlation) of the noisy image is very close to the cross-modal attention distribution (i.e., the second correlation) of the clean image, the noisy cross-modal attention distribution of the noisy image can be used as the optimization target. Random noise is added to the classification adversarial image, thereby making the adversarial cross-modal attention distribution of the classification adversarial image close to that of the noisy cross-modal attention distribution, thus completing the cleansing of the classification adversarial image and obtaining a cleaned image. This application, guided by the noisy cross-modal attention distribution, achieves the cleansing of classification adversarial images by adding noise. The visual language model can obtain correct prediction results based on the cleaned image. This cleansing method enhances the robustness of the visual language model.

[0245] Quantitative results of this scheme

[0246] This scheme can be called FFF, specifically, it applies to clean images x in clean samples. i The prediction result f(x) of the visual language model i ,x t This is also correct; it extracts the clean cross-modal attention distribution A(x) from the clean image. i ,x t f). For the adversarial image x′ in the adversarial samplei The prediction result of the visual language model f(x′) i ,x t The statement is incorrect; it refers to extracting the adversarial cross-modal attention distribution A(x′) from the adversarial image. i ,x t (f) By comparison, it can be found that the adversarial cross-modal attention distribution of the adversarial image is significantly different from that of the clean cross-modal attention distribution of the clean image, which can show significant mode differences in the adversarial cross-modal attention distribution map and the clean cross-modal attention distribution map. Through feasibility verification, that is, if the clean cross-modal attention distribution of the clean image is used as the target to optimize the adversarial image, the adversarial image can be cleaned up.

[0247] However, in adversarial cleanup scenarios, the clean image is unknown, making it impossible to extract the clean cross-modal attention distribution of the clean image. Therefore, a reasonable estimation of the clean cross-modal attention distribution of the clean image is necessary. Tests show that adding an infinity norm constraint of α to the adversarial image of the adversarial example can help. ∞ Random noise, i.e., R(x) ′ ′ i ,α ∞ Although the prediction result of the visual language model is f(R(x) ′ ′ i ,α ∞ ),x t The result is still incorrect, but the noisy cross-modal attention distribution A(R(x) is incorrect. ′ ′ i ,α ∞ ),x t f) There is a tendency to move towards a clean cross-modal attention distribution for clean images. If we move towards a noisy cross-modal attention distribution A(R(x′)... i ,α ∞ ),x t f) Optimizing the adversarial cross-modal attention distribution of adversarial images may achieve image cleanup. Experiments have shown this to be true; by targeting the adversarial cross-modal attention distribution of randomly noisy adversarial images, adding noise to the adversarial image yields a cleaned image. Correct, and the cleansing of the image's cross-modal attention distribution. It does indeed resemble a clean cross-modal attention distribution more like a clean image.

[0248] Below we will present some quantitative results.

[0249] First, this method verifies whether the clean cross-modal attention distribution of a clean image can cleanse adversarial images. This method targets the clean cross-modal attention distribution of a clean image and adds noise to the adversarial image; the results are shown in Table 1. Higher noise intensity leads to better cleansing, and the cross-modal attention distribution of the adversarial image after adding noise does indeed closely resemble the clean cross-modal attention distribution of the clean image.

[0250] Table 1

[0251] The mean squared error is the L2 norm mentioned above. The VQA score is the visual question-answering score of the visual language model based on the input image. In Table 1, the first row is the score of the visual language model (visual question-answering score), and the second and third rows are measures of the difference between the cross-modal attention distribution corresponding to the adversarial image with added noise and the clean cross-modal attention distribution corresponding to the clean image.

[0252] Secondly, this method verifies the impact of randomly adding noise to adversarial images on prediction results and cross-modal attention distribution. As shown in Table 2, with the increase of noise intensity, the visual question-answering score of the visual language model improves to some extent but not significantly. However, the cross-modal attention distribution corresponding to the noisy image is closer to the clean cross-modal attention distribution of the clean image.

[0253] Table 2

[0254] This scheme uses the noisy cross-modal attention distribution of a randomly noisy image as an estimate of the clean cross-modal attention distribution of the clean image to add noise to the adversarial image. The noise magnitude is randomly selected, and the estimated noisy cross-modal attention distribution is used to control the direction. The results are shown in Table 3. The first row shows the random direction, and the second row onwards represents the method of this scheme. It can be seen that this scheme can indeed achieve a certain degree of performance cleanup. Each row represents the noise intensity added to the estimated clean cross-modal attention distribution of the clean image, and each column represents the noise intensity added to the cleaned adversarial image.

[0255] Table 3

[0256] Previously, this solution only controlled the noise direction, while the noise magnitude was still randomly selected. This solution further controls the noise magnitude, and the results are shown in Table 4. The first row shows the random direction, and the second row onwards represents the method of this solution. It can be seen that controlling the noise magnitude is more effective than optimizing only the direction.

[0257] Table 4

[0258] Figure 7 shows a structural block diagram of a sample purification device provided in an embodiment of this application. This sample purification device has the function of implementing the sample purification method example described above. The function can be implemented by hardware or by hardware executing corresponding software. The purification device can be the server described above, or it can be installed within a server. As shown in Figure 7, the purification device may include: an acquisition module 710, a determination module 720, and an addition module 730;

[0259] Module 710 is used for:

[0260] The adversarial sample is obtained by performing an adversarial attack on a clean sample, and the adversarial sample includes adversarial images and text;

[0261] Obtain the noisy image obtained by adding first noise to the adversarial image;

[0262] The determination module 720 is used for:

[0263] Determine a first correlation between at least one noisy image feature of the noisy image and at least one text feature of the text;

[0264] Determine a second correlation between at least one adversarial image feature of the adversarial image and at least one text feature of the text;

[0265] The addition module 730 is used to add second noise to the adversarial image based on the first correlation and the second correlation in order to clean the adversarial image and obtain a cleaned image.

[0266] In some embodiments, the adding module 730 is specifically used to: add a second noise to the adversarial image with the goal of minimizing the correlation difference, so as to clean the adversarial image and obtain a cleaned image; wherein the correlation difference is the difference between the first correlation and the second correlation.

[0267] In some embodiments, the adding module 730 is specifically used to: calculate the norm of the correlation difference, the norm being used to measure the distance between the first correlation and the second correlation; calculate the gradient of the correlation difference norm for each pixel in the adversarial image; determine the noise addition method for each pixel based on the gradient of each pixel; add second noise to each pixel according to the noise addition method of each pixel to obtain a cleaned image.

[0268] In some embodiments, the adding module 730 is specifically configured to: when the gradient of the i-th pixel in the adversarial image is positive, determine that the noise addition method of the i-th pixel is a first noise addition method, the first noise addition method being used to add second noise to the pixel value of the i-th pixel to increase the pixel value of the i-th pixel, where i is a positive integer; when the gradient of the i-th pixel is negative, determine that the noise addition method of the i-th pixel is a second noise addition method, the second noise addition method being used to add second noise to the pixel value of the i-th pixel to decrease the pixel value of the i-th pixel; and add second noise to each pixel based on the noise addition method for each pixel in the adversarial image to obtain a cleaned image.

[0269] In some embodiments, the gradient includes intensity information, and the determining module 720 is further configured to: determine a second noise corresponding to each pixel in the adversarial image based on the intensity information of the gradient, wherein the intensity information is used to indicate the gradient magnitude of each pixel in the adversarial image.

[0270] In some embodiments, the determining module 720 is specifically configured to: obtain a first gradient value and a second gradient value, wherein the first gradient value is the maximum gradient value of all pixels in the adversarial image, and the second gradient value is the minimum gradient value of all pixels in the adversarial image; obtain a gradient standard value based on the first gradient value and the second gradient value, wherein the gradient standard value is the gradient value after normalization; determine the perturbation amplitude of the second noise based on the gradient standard value and the average value of the gradient standard value, wherein the perturbation amplitude includes a perturbation factor for determining the magnitude of the second noise; and determine the magnitude of the second noise added to each pixel in the adversarial image based on the perturbation factor, wherein the magnitude of the second noise is positively correlated with the intensity information of the gradient.

[0271] In some embodiments, the perturbation factor is the maximum value of a first normalized value and a first value, the first value is the minimum value of a second normalized value and a second value, the second value is the quotient of the standard gradient value and the average of the standard gradient values, the first normalized value is 0, and the second normalized value is 1.

[0272] In some embodiments, the purification device further includes a generation module 740, wherein the acquisition module 710 is further configured to acquire purification samples, the purification samples including purification images and text; the generation module 740 is configured to generate prediction results for the purification images based on the purification samples using a visual language model, and the prediction results for the purification images are correct prediction results.

[0273] In some embodiments, the determining module 720 is specifically used to: determine a first relevance through a visual language model.

[0274] In some embodiments, the visual language model includes a visual encoder and a language model segmenter; the determination module 720 is specifically configured to: divide the noisy image into multiple regions based on the visual encoder, and encode each region as a region image feature; align the region image features of the multiple regions through the visual language model to obtain at least one noisy image feature; divide the text into multiple text units based on the language model segmenter, and encode each text unit as a text unit feature; align the text unit features of the multiple text units through the visual language model to obtain at least one text feature; calculate the first correlation when generating the noisy prediction result through the visual language model, wherein the noisy prediction result is the prediction result of the visual language model after fusing at least one visual token and at least one language token for the noisy image; wherein each visual token corresponds to a noisy image feature; and each language token corresponds to a text feature.

[0275] In some embodiments, the determining module 720 is specifically used to: determine a second correlation through a visual language model.

[0276] In some embodiments, the visual language model includes a visual encoder and a language model segmenter; the determination module 720 is specifically configured to: divide the adversarial image into multiple regions based on the visual encoder, and encode each region as a region image feature; align the region image features of the multiple regions through the visual language model to obtain at least one adversarial image feature; divide the text into multiple text units based on the language model segmenter, and encode each text unit as a text unit feature; align the text unit features of the multiple text units through the visual language model to obtain at least one text feature; calculate the second correlation when generating the adversarial test result through the visual language model, wherein the adversarial prediction result is the prediction result of the visual language model after fusing at least one visual token and at least one language token for the adversarial image; wherein each visual token corresponds to an adversarial image feature; and each language token corresponds to a text feature.

[0277] In some embodiments, the first noise is determined based on a first noise value obtained by pseudo-random sampling in a first distribution interval.

[0278] In some embodiments, the first distribution interval is a uniformly distributed interval range.

[0279] In some embodiments, the second noise is determined based on a second noise value obtained by pseudo-random sampling in the second distribution interval.

[0280] In some embodiments, the second distribution interval is a uniformly distributed interval range.

[0281] In some embodiments, the clean sample includes a clean image and text; the determining module 720 is further configured to: determine a third correlation between at least one clean image feature of the clean image and at least one text feature of the text; wherein the first correlation is closer to the third correlation than the second correlation.

[0282] It should be noted that the specific limitations of the one or more sample purification devices provided above can be found in the limitations of the sample purification methods above, and will not be repeated here. Each module of the above purification device can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in the processor of the computer device in hardware form or independent of the processor, or it can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0283] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0284] Figure 8 shows a structural block diagram of a computer device 1200 according to an exemplary embodiment of this application. This computer device can be used to implement the sample purification method provided in the above embodiments. The computer device 1200 includes a Central Processing Unit (CPU) 1201, a system memory 1204 including Random Access Memory (RAM) 1202 and Read-Only Memory (ROM) 1203, and a system bus 1205 connecting the system memory 1204 and the CPU 1201. The computer device 1200 also includes a basic input / output system (I / O system) 1206 to facilitate information transfer between various devices within the computer device, and a mass storage device 1207 for storing an operating system 1213, application programs 1214, and other program modules 1215.

[0285] The basic input / output system 1206 includes a display 1208 for displaying information and an input device 1209 for user input, such as a mouse or keyboard. Both the display 1208 and the input device 1209 are connected to the central processing unit 1201 via an input / output controller 1210 connected to the system bus 1205. The basic input / output system 1206 may also include the input / output controller 1210 for receiving and processing input from multiple other devices such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller 1210 also provides output to a display screen, printer, or other types of output devices.

[0286] The mass storage device 1207 is connected to the central processing unit 1201 via a mass storage controller (not shown) connected to the system bus 1205. The mass storage device 1207 and its associated computer-readable storage media provide non-volatile storage for the terminal device 1200. That is, the mass storage device 1207 may include computer-readable storage media (not shown), such as a hard disk or a compact disc read-only memory (CD-ROM) drive.

[0287] Without loss of generality, the computer-readable storage medium may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable storage instructions, data structures, program modules, or other data. Computer storage media include RAM, ROM, erasable programmable read-only memory (EPROM), electrically-erasable programmable read-only memory (EEPROM), flash memory or other solid-state storage technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that the computer storage medium is not limited to the above-mentioned types. The system memory 1204 and mass storage device 1207 described above can be collectively referred to as memory.

[0288] The memory stores one or more programs, which are configured to be executed by one or more central processing units 1201. The one or more programs contain instructions for implementing the above method embodiments, and the central processing unit 1201 executes the one or more programs to implement the sample purification methods provided by the above method embodiments.

[0289] According to various embodiments of this application, the computer device 1200 can also be connected to a remote terminal device on a network, such as the Internet. That is, the computer device 1200 can be connected to the network 1212 via the network interface unit 1211 connected to the system bus 1205, or the network interface unit 1211 can be used to connect to other types of networks or remote terminal device systems (not shown).

[0290] The memory further includes one or more programs stored in the memory, and the one or more programs include the sample purification steps performed by the terminal device in the method provided in the embodiments of this application.

[0291] This application also provides a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the sample purification method provided in the above-described method embodiments.

[0292] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. The computer program is read from and executed by a processor of a computer device, causing the computer device to perform the sample purification method provided in the above-described method embodiments.

[0293] It is understood that, in the specific embodiments of this application, the data involved, historical data, and user data processing related to user identity or characteristics, such as profiles, require user permission or consent when applied to specific products or technologies. Furthermore, the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0294] It should be noted that, unless otherwise expressly defined herein, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field. Unless otherwise expressly stated, all references to "an element, device, component, apparatus, step, etc." are openly interpreted as referring to at least one instance of an element, device, component, apparatus, step, etc. Unless expressly stated otherwise, the steps of any method disclosed herein are not necessarily to be performed in the exact order disclosed.

[0295] It should be understood that "multiple" as used in this article refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

Claims

1. A method of purifying a sample, characterized by, The method comprises: obtaining an adversarial sample, the adversarial sample being generated by performing an adversarial attack on a clean sample, the adversarial sample comprising an adversarial image and text; obtaining a noisy image obtained by adding first noise to the adversarial image; determining a first correlation between at least one noisy image feature of the noisy image and at least one text feature of the text; determining a second correlation between at least one adversarial image feature of the adversarial image and the at least one text feature of the text; adding second noise to the adversarial image based on the first correlation and the second correlation to purify the adversarial image to obtain a purified image.

2. The method of claim 1, wherein, The adding of the second noise to the adversarial image based on the first correlation and the second correlation to purify the adversarial image to obtain a purified image comprises: adding second noise to the adversarial image to purify the adversarial image to obtain the purified image, with the aim of minimizing a correlation difference; wherein the correlation difference is a difference between the first correlation and the second correlation.

3. The method of claim 2, wherein, The adding of the second noise to the adversarial image to purify the adversarial image to obtain the purified image, with the aim of minimizing the correlation difference, comprises: calculating a norm of the correlation difference, the norm being used to measure a distance between the first correlation and the second correlation; calculating a gradient of the norm with respect to each pixel in the adversarial image; determining a noise adding mode for each pixel based on the gradient of each pixel, and adding second noise to each pixel according to the noise adding mode for each pixel to obtain the purified image.

4. The method of claim 3, wherein, The determining of the noise adding mode for each pixel based on the gradient of each pixel, and the adding of the second noise to each pixel according to the noise adding mode for each pixel to obtain the purified image, comprises: in a case where the gradient of an i-th pixel in the adversarial image is positive, determining that the noise adding mode for the i-th pixel is a first noise adding mode, the first noise adding mode being used to add second noise to a pixel value of the i-th pixel to increase the pixel value of the i-th pixel, i being a positive integer; in a case where the gradient of the i-th pixel is negative, determining that the noise adding mode for the i-th pixel is a second noise adding mode, the second noise adding mode being used to add second noise to a pixel value of the i-th pixel to decrease the pixel value of the i-th pixel; adding second noise to each pixel in the adversarial image based on the noise adding mode for each pixel to obtain the purified image.

5. The method according to claim 3 or 4, characterized in that, The gradient comprises intensity information, and the method further comprises: determining second noise corresponding to each pixel in the adversarial image based on intensity information of the gradient, the intensity information being used to indicate a gradient size of each pixel in the adversarial image.

6. The method of claim 5, wherein, The determining of the second noise corresponding to each pixel in the adversarial image based on the intensity information of the gradient comprises: obtaining a first gradient value and a second gradient value, the first gradient value being a maximum gradient value of all pixels in the adversarial image, and the second gradient value being a minimum gradient value of all pixels in the adversarial image; obtaining a gradient standard value based on the first gradient value and the second gradient value, the gradient standard value being a gradient value after normalization processing of the gradient; determining a perturbation amplitude of the second noise according to the gradient standard value and an average value of the gradient standard value, the perturbation amplitude including a perturbation factor for determining a size of the second noise; determining a size of the second noise added to each pixel in the adversarial image based on the perturbation factor, the size of the second noise being positively correlated with intensity information of the gradient.

7. The method of claim 6, wherein, The perturbation factor is a maximum value of a first normalized value and a first value, the first value being a minimum value of a second normalized value and a second value, the second value being a quotient of the gradient standard value and an average value of the gradient standard value, the first normalized value being 0, and the second normalized value being 1.

8. The method according to any one of claims 1 to 7, characterized in that, The method further comprises: obtaining a purified sample, the purified sample including the purified image and the text; generating a prediction result for the purified image based on the purified sample by a visual language model, the prediction result for the purified image being a correct prediction result.

9. The method according to any one of claims 1 to 8, characterized in that, The determining of the first correlation between the at least one image feature of the noisy image and the at least one text feature of the text comprises: determining the first correlation by a visual language model.

10. The method of claim 9, wherein, The visual language model includes a visual encoder and a language model tokenizer. The determining of the first correlation by the visual language model comprises: dividing the noisy image into a plurality of regions based on the visual encoder, and encoding each region as a region image feature; aligning the region image features of the plurality of regions by the visual language model to obtain the at least one image feature; dividing the text into a plurality of text units based on the language model tokenizer, and encoding each text unit as a text unit feature; aligning the text unit features of the plurality of text units by the visual language model to obtain the at least one text feature; calculating the first correlation when generating a noisy prediction result by the visual language model, the noisy prediction result being a prediction result fused by at least one visual token and at least one language token of the visual language model for the noisy image; wherein each visual token corresponds to one image feature, and each language token corresponds to one text feature.

11. The method according to any one of claims 1 to 8, characterized in that, The determining of the second correlation between the at least one image feature of the adversarial image and the at least one text feature of the text comprises: determining the second correlation by a visual language model.

12. The method of claim 11, wherein, The visual language model includes a visual encoder and a language model tokenizer. The determining of the second correlation by the visual language model comprises: dividing the adversarial image into a plurality of regions based on the visual encoder, and encoding each region as a region image feature; aligning region image features of the multiple regions through the visual language model, to obtain the at least one adversarial image feature; dividing the text into multiple text units based on the language model tokenizer, and encoding each text unit into a text unit feature; aligning text unit features of the multiple text units through the visual language model, to obtain the at least one text feature; calculating the second correlation when generating the adversarial prediction result through the visual language model, the adversarial prediction result being a prediction result of the visual language model after fusion of at least one visual token and at least one language token corresponding to the adversarial image; each visual token corresponds to one adversarial image feature; and each language token corresponds to one text feature.

13. The method according to any one of claims 1 to 12, characterized in that, The first noise is determined based on a first noise value obtained by pseudo-random sampling in a first distribution interval.

14. The method of claim 13, wherein, The first distribution interval is an interval range of uniform distribution.

15. The method according to any one of claims 1 to 14, characterized in that, The second noise is determined based on a second noise value obtained by pseudo-random sampling in a second distribution interval.

16. The method of claim 15, wherein, The second distribution interval is an interval range of uniform distribution.

17. The method according to any one of claims 1 to 16, characterized in that, The clean sample includes a clean image and text; and the method further includes: determining a third correlation between at least one clean image feature of the clean image and at least one text feature of the text; The first correlation is closer to the third correlation than the second correlation.

18. A sample purification device, characterized by, The apparatus includes an obtaining module, a determining module, and an adding module. The obtaining module is configured to: obtain an adversarial sample, the adversarial sample being generated by performing an adversarial attack on a clean sample, the adversarial sample including an adversarial image and text; obtain a noisy image obtained by adding first noise to the adversarial image; The determining module is configured to: determine a first correlation between at least one noisy image feature of the noisy image and at least one text feature of the text; determine a second correlation between at least one adversarial image feature of the adversarial image and the at least one text feature of the text; The adding module is configured to add second noise to the adversarial image based on the first correlation and the second correlation, to purify the adversarial image, and obtain a purified image.

19. A computer device, comprising: The computer device includes a processor and a memory, and the memory stores at least one computer program, the at least one computer program is loaded and executed by the processor to implement the sample purification method according to any one of claims 1 to 17.

20. A computer storage medium, comprising, The computer readable storage medium stores at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the sample purification method according to any one of claims 1 to 17.

21. A computer program product, characterised in that, The computer program product includes a computer program stored in a computer readable storage medium; the computer program is read and executed by the processor of the computer device from the computer readable storage medium, so that the computer device executes the sample purification method according to any one of claims 1 to 17.

Images