Training method and apparatus for generative model

Abstract

A training method and apparatus for a generative model. The training method comprises: acquiring a first training sample which comprises a first initial image and first information; inputting the first training sample into a generative model for model processing to obtain a first target image carrying steganographic information; inputting the first target image into a pre-trained discrimination model to obtain a first visibility score, wherein the first visibility score indicates the visibility of the steganographic information; and with the objective of reducing a first loss, adjusting parameters of the generative model, wherein the first loss is positively correlated to the first visibility score.

Description

A training method and device of a generation model

[0001] The present application claims priority to the Chinese patent application No. 202411053732.7, filed on August 01, 2024, and entitled "A training method and device of a generation model", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The embodiments of the present specification belong to the technical field of image processing, and particularly relate to a training method and device of a generation model. BACKGROUND

[0003] In many business fields such as business and finance, user authentication is often performed by verifying the photographed image of the client. For example, in the Electronic Know Your Customer (EKYC) scenario, a key step is to authenticate the true identity of the user according to the user's certificate image and face image. However, some attackers may use image injection attacks to implement illegal authentication, i.e., replacing the photographed image of the client with other images and uploading the other images to the server for authentication.

[0004] Therefore, it is urgent to provide a reliable solution that can generate images that can effectively resist image injection attacks to ensure the security of identity authentication.

[0005] SUMMARY

[0006] The embodiments of the present specification aim to provide a training method of a generation model, which can generate images that can effectively resist image injection attacks.

[0007] The first aspect of the present specification provides a training method of a generation model, comprising:

[0008] obtaining a first training sample, which includes a first initial image and first information;

[0009] inputting the first training sample into a generation model for model processing to obtain a first target image carrying steganographic information;

[0010] inputting the first target image into a pre-trained discrimination model to obtain a first visibility score; the first visibility score indicates the visibility of the steganographic information;

[0011] adjusting the parameters of the generation model to reduce a first loss, wherein the first loss is positively correlated with the first visibility score.

[0012] The second aspect of the specification provides a method for verifying an image, which is executed by a client that is deployed with a generation model trained according to the method of the first aspect, and the method comprises:

[0013] obtaining an initial image to be verified;

[0014] inputting the initial image into the generation model to obtain a target image carrying steganographic information;

[0015] sending the target image carrying steganographic information to a server.

[0016] The third aspect of the specification provides a method for verifying an image, which is executed by a server that is deployed with a pre-trained discrimination model, and the method comprises:

[0017] receiving a target image to be verified from a client; the client is configured to generate an image carrying steganographic information by using a generation model trained according to the method of the first aspect;

[0018] extracting steganographic information from the target image by using the discrimination model;

[0019] verifying the target image based on the steganographic information.

[0020] The fourth aspect of the specification provides a training device of a generation model, which comprises:

[0021] an obtaining unit configured to obtain a first training sample, wherein the first training sample comprises a first initial image and first information;

[0022] an input unit configured to input the first training sample into a generation model for model processing to obtain a first target image carrying steganographic information;

[0023] the input unit is further configured to input the first target image into a pre-trained discrimination model to obtain a first visibility score; the first visibility score indicates a visibility degree of the steganographic information;

[0024] an adjusting unit configured to adjust parameters of the generation model with a target of reducing a first loss; wherein the first loss is positively correlated with the first visibility score.

[0025] The fifth aspect of the specification provides a device for verifying an image, which is arranged in a client that is deployed with a generation model trained according to the method of the first aspect, and the device comprises:

[0026] an obtaining unit configured to obtain an initial image to be verified;

[0027] an input unit configured to input the initial image into the generation model to obtain a target image carrying steganographic information;

[0028] a sending unit configured to send the target image carrying the steganographic information to a server.

[0029] The sixth aspect of the present specification provides a device for verifying an image, which is arranged on a server, wherein the server is deployed with a pre-trained discriminator model, and the device comprises:

[0030] a receiving unit configured to receive a target image to be verified from a client, wherein the client is configured to generate an image carrying steganographic information by using a generative model trained according to the method of the first aspect;

[0031] an extracting unit configured to extract steganographic information from the target image by using the discriminator model;

[0032] a verifying unit configured to verify the target image based on the steganographic information.

[0033] The seventh aspect of the present specification provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed in a computer, the computer program causes the computer to execute the method of any one of the first aspect to the third aspect.

[0034] The eighth aspect of the present specification provides a computing device, which comprises a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method of any one of the first aspect to the third aspect.

[0035] The ninth aspect of the present specification provides a computer program product, which comprises computer programs / instructions, and when the computer programs / instructions are executed by a processor, the computer programs / instructions implement the steps of the method of any one of the first aspect to the third aspect.

[0036] The training method and device of the generative model provided by one or more embodiments of the present specification train the generative model by taking the visibility score output by the discriminator model for the image generated by the generative model as the target, so that the steganographic information in the image generated by the trained generative model has low visibility, thereby effectively resisting image injection attacks, and further ensuring the security of identity authentication. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present specification, the drawings required in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments described in the present specification, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0038] FIG. 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in the specification;

[0039] FIG. 2 is a flowchart of a method for training a generation model in an embodiment of the specification;

[0040] FIG. 3 is an interaction diagram of a method for verifying an image in an embodiment of the specification;

[0041] FIG. 4 is an interaction diagram of a method for verifying an image in an embodiment of the specification;

[0042] FIG. 5 is a schematic diagram of a training device for a generation model in an embodiment of the specification;

[0043] FIG. 6 is a schematic diagram of a device for verifying an image in an embodiment of the specification;

[0044] FIG. 7 is a schematic diagram of a device for verifying an image in an embodiment of the specification. DETAILED DESCRIPTION

[0045] In order to enable those skilled in the art to better understand the technical solutions in the specification, the technical solutions in the embodiments of the specification will be clearly and completely described below in conjunction with the drawings in the embodiments of the specification. Obviously, the described embodiments are only part of the embodiments of the specification, rather than all the embodiments. Based on the embodiments in the specification, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the specification.

[0046] As described above, in the process of authenticating a user, an attacker may use an image injection attack to attack a photographed image uploaded by a client. In order to resist the image injection attack, one implementation is to add steganographic information to the photographed image, and the added steganographic information needs to be low in visibility and high in robustness. The low visibility can ensure that the image carrying the steganographic information will not become the target of the attacker, and the high robustness can ensure that the image carrying the steganographic information can remain unchanged even if it is cropped, compressed or subjected to some common image processing operations.

[0047] To generate an image carrying steganographic information with low visibility and high robustness, an embodiment of the specification proposes to train a generation model, and the training process of the generation model is described below.

[0048] FIG. 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in the specification. In FIG. 1, the training of the generation model and the discriminative model can be alternately performed, for example, the discriminative model is pre-trained first. Then, the parameters of the discriminative model are fixed, and the generation model is trained. Next, the parameters of the generation model are fixed, and the discriminative model is trained, and so on. It should be understood that each training of the discriminative model or the generation model can include multiple rounds of iterations.

[0049] In addition, for the generation model, the corresponding training target is to reduce the visibility score output by the discriminator model for the image generated by the generation model, and for the discriminator model, the corresponding training target is to increase the visibility score. Therefore, the present scheme trains the generation model by the method of adversarial training, so as to ensure that the generation model generates an image with low steganographic information visibility, and the discriminator model can identify the steganographic information in the image generated by the generation model.

[0050] The pre-training process of the discriminator model will be described first.

[0051] In an embodiment, an image f1 carrying explicit information can be obtained as a positive sample, and a positive label is added thereto, and an image f2 carrying steganographic information can be obtained as a negative sample, and a negative label is added thereto. Then, based on the visibility score output by the discriminator model for the positive sample and the positive label, the loss L1 is calculated, and based on the visibility score output by the discriminator model for the negative sample and the negative label, the loss L2 is calculated. Finally, based on the comprehensive loss of the losses L1 and L2, the parameters of the discriminator model are adjusted, so as to obtain the pre-trained discriminator model. Specifically, assuming that the positive label is set to 1 and the negative label is set to 0, in the training process, the parameters of the discriminator model are adjusted so that the score output by the discriminator model for the image f1 in the positive sample tends to 1 and the score output by the discriminator model for the image f2 in the negative sample tends to 0.

[0052] In a more specific embodiment, the steganographic information in the image f2 is added to the image f2 by using a digital watermarking algorithm. The digital watermarking algorithm can include but is not limited to any one of the following: a least significant bit (LSB) algorithm, a frequency domain watermarking algorithm (such as DCT, DFT), a wavelet transform-based algorithm, etc.

[0053] Of course, in practice, the negative sample can also include an image f3 carrying no information, so that the loss L3 can also be calculated based on the visibility score output by the discriminator model for the image f3 and the negative label, and the parameters of the discriminator model can be adjusted based on the comprehensive loss of the losses L1, L2 and L3.

[0054] In an example, the losses L1, L2 or L3 can be determined based on the positive and negative labels of the positive and negative samples and the predicted visibility scores by using a mean square error (MSE) loss function or a cross-entropy loss function, etc. Then, the update gradient corresponding to the parameters of the discriminator model can be calculated by using the back propagation method based on the comprehensive loss, and the parameters of the discriminator model can be adjusted based on the update gradient.

[0055] In addition, in actual application, the pre-training of the discriminative model includes multiple rounds of iterations, and the above steps are only the method steps included in the tthround of iteration. It can be understood that by repeatedly executing the steps of pre-training, multiple rounds of parameter adjustment of the discriminative model can be realized, and then the discriminative model after the last round of adjustment parameters is taken as the pre-trained discriminative model.

[0056] After pre-training the discriminative model, the parameters of the discriminative model can be fixed, and then the generative model is trained. The training process of the generative model is described below.

[0057] FIG. 2 is a flowchart of a training method of a generative model in an embodiment of the present specification. The method can be executed by any device, equipment, platform, cluster of equipment having computing and processing capabilities. As shown in FIG. 2, the method can include the following steps:

[0058] Step S202, obtaining a training sample, which includes an initial image and first information.

[0059] In an embodiment, the initial image described above can be taken by a client in the process of performing a target service. Wherein, the target service here can be, for example, an identity authentication service, etc.

[0060] When the target service is an identity authentication service, the initial image described above is a face image or a certificate image of a user.

[0061] The first information described above can be, for example, an image, text, symbol or number, etc. The following is described by taking the first information as text as an example.

[0062] Step S204, inputting the training sample into the generative model for model processing to obtain a target image f1carrying steganographic information.

[0063] In an embodiment, the generative model described above includes an encoder t1, an encoder t2 and a decoder. Wherein, the encoder t1 is an encoder corresponding to the image modality, which can be implemented as a convolutional neural network, such as CNN (Convolutional Neural Networks), RNN (Recurrent Neural Network), FCN (Fully Convolutional Networks), etc. Of course, it can also be implemented as other neural networks, such as MLP (MultiLayer Perceptron Network) network, etc. The encoder t2 is an encoder corresponding to the text modality, which can also be called a text encoder, which can be implemented as a Transformer encoder, i.e., it encodes the first information based on an attention mechanism.

[0064] Specifically, the initial image can be processed by an encoder t1 to obtain an image representation, and the first information can be processed by an encoder t2 to obtain a text representation. Then, in a decoder, based on the image representation and the text representation, the target image f1 carrying the steganographic information is generated.

[0065] Of course, in practice, the generation model can also be implemented based on other networks or models capable of outputting images based on images, which are not limited in the present specification.

[0066] Step S206: inputting the target image f1 into the pre-trained discriminator model to obtain a visibility score s1, which indicates the visibility degree of the steganographic information.

[0067] Here, the discriminator model can be trained through the pre-training process described above, and of course can also be trained through other methods of training binary classification models, which are not limited in the present specification.

[0068] Of course, in practice, in addition to the visibility score s1, the pre-trained discriminator model can also output predicted steganographic information.

[0069] Step S208: adjusting the parameters of the generation model with the goal of reducing the loss L1, which is positively correlated with the visibility score s1.

[0070] It should be understood that the training goal of the generation model is that the discriminator model cannot identify the steganographic information in the target image f1, and therefore, for the generation model, the visibility score s1 should be as small as possible. Therefore, the loss L1 can be set to be positively correlated with the visibility score s1. In this way, the direction in which the loss L1 is reduced is the direction in which the visibility score s1 is reduced.

[0071] In one example, the loss L1 can be calculated according to the following formula (1):

[0072] As shown in formula (1), θ G is the parameter of the generation model, z i is the input data of the generation model, i.e., the initial image and the first information, G(z i , θ G ) is the output of the generation model, i.e., the target image f1, and D(G(z i , θ G )) is the visibility score s1 output by the pre-trained discriminator model for the target image f1. As can be seen from formula (1), the visibility score s1 output by the discriminator model is positively correlated with the loss L1. That is, the smaller the visibility score s1, the smaller the loss L1 of the generation model. Thus, θ Gso that the smaller the loss L1 is, i.e. the smaller the visibility score s1 is, and thus the generator model is optimized.

[0073] In addition, for the steganographic information added to the target image f1, it is generally desired to have a higher robustness, i.e. after the target image f1 is subjected to degradation processing such as compression, cropping, adding noise or resizing, it is still desired that the discriminator model can identify the steganographic information. It should be understood that it is desired that the discriminator model can identify the steganographic information, i.e. it is desired that the visibility score s2 output by the discriminator model for the degraded image f1’ is as large as possible. However, since the discriminator model and the generator model are trained in an adversarial manner, when training the generator model, the training goal of the generator model is to make the visibility score s2 as small as possible, i.e. to set the loss L1 to be positively correlated with the visibility score s2 output by the discriminator model for the degraded image f1’. In this way, the direction in which the loss L1 decreases is to reduce the visibility score s2.

[0074] In another example, the loss L1 can be calculated according to the following formula (2):

[0075] wherein the definition of the first half of formula 2 can refer to the above formula 1, and D(f i (D(G(z i ,θ G )) is the visibility score s2 output by the pre-trained discriminator model for the degraded image f1’. As can be seen from formula (2), the visibility score s2 output by the discriminator model is positively correlated with the loss L1. That is, the smaller the visibility score s2 is, the smaller the loss L1 of the generator model is. Thus, the parameters θ G so that the smaller the loss L1 is, i.e. the smaller the visibility score s2 is, and thus the generator model is optimized.

[0076] It should be understood that in practice, the training of the generator model includes multiple iterations, i.e. the step of adjusting the parameters of the generator model will be repeated multiple times. After repeating the step of adjusting the parameters of the generator model multiple times, the parameters of the generator model can be fixed, and then the discriminator model is trained, and the training process of the discriminator model is described below.

[0077] Specifically, the above training sample can be input into the generator model with fixed parameters to obtain a target image f2 carrying steganographic information, and the target image f2 is input into the discriminator model to obtain a visibility score s3. The parameters of the discriminator model are adjusted to reduce the loss L2, wherein the loss L2 is inversely correlated with the visibility score s3.

[0078] It should be understood that the training target of the discriminator model is that the discriminator model is expected to identify the steganographic information in the target image f2 as much as possible, and therefore, for the discriminator model, the visibility score s3 described above is expected to be as large as possible. Therefore, the loss L2 can be set to be inversely related to the visibility score s3. In this way, the direction in which the loss L2 decreases is the direction in which the visibility score s3 increases.

[0079] In addition, the input of the discriminator model can also include the initial image described above, so that L2 can also be set to be inversely related to the visibility score s4 output by the discriminator model for the initial image.

[0080] In one example, the loss L2 can be calculated according to the following formula (3):

[0081] As shown in formula (3), θ D is the parameter of the discriminator model, is the positive sample, including the target image f2, denotes the negative sample, i.e., the initial image, and the sum of i and j is m, is the visibility score s3 output by the discriminator model for the positive sample, is the visibility score s4 output by the discriminator model for the negative sample. As can be seen from formula (3), the loss L2 is inversely related to the visibility score s3, that is, the larger the visibility score s3, the smaller the loss L2; the loss L2 is positively related to the visibility score s4, that is, the smaller the visibility score s4, the smaller the loss L2. θ D can be adjusted by, for example, a gradient descent method, so that the loss L2 decreases and the discriminator model becomes more accurate.

[0082] In addition, as described above, the discriminator model is expected to output a visibility score for the degraded image as much as possible, and therefore, L2 can also be set to be inversely related to the visibility score output by the discriminator model for the degraded image. In this way, the positive sample in the above formula 3 can also include the degraded image f2' of the target image f2.

[0083] Finally, in practice, the output of the discriminator model described above can also include predicted steganographic information, so that the training target of the discriminator model also includes that the predicted steganographic information is as accurate as possible (i.e., as close to the first information as possible). Therefore, the loss L2 can also be set to be positively related to a difference loss determined based on a comparison between the first information and the predicted steganographic information. In this way, in the direction in which the loss L2 decreases, that is, in the direction in which the difference loss described above decreases.

[0084] In one example, the difference loss is determined based on a vector distance between the first information and the predicted steganographic information, and the difference loss is positively related to the vector distance. Here, the vector distance can be, for example, an Euclidean distance or a cosine distance, etc.

[0085] In summary, it can be seen from the definitions of the loss LI and the loss L2 that the training objectives of the generation model and the discrimination model form an antagonism. That is, the present solution trains the generation model by drawing on the idea of adversarial learning.

[0086] It should be understood that, in practice, the training of the discrimination model also includes multiple rounds of iteration, that is, the step of adjusting the parameters of the discrimination model will be performed multiple times repeatedly. After the step of adjusting the parameters of the discrimination model is performed multiple times repeatedly, the parameters of the discrimination model can be fixed, and the generation model can be trained again. In this way, the generation model and the discrimination model are alternately trained multiple times until a training end condition (for example, the parameters of the generation model and the discrimination model converge) is reached.

[0087] In summary, the training method of the generation model provided by the embodiments of the present specification trains the generation model by drawing on the idea of adversarial learning. Further, the present solution trains the generation model with the goal of reducing the visibility score of the degradation image output by the discrimination model for the image generated by the generation model, so that the trained generation model can generate an image with low steganographic information visibility and high robustness. In summary, the generation model trained by the present solution can generate an image with low steganographic information visibility and high robustness, thereby effectively resisting image injection attacks and ensuring the security of identity authentication.

[0088] It should be noted that the generation model and the discrimination model trained by the embodiments of the present specification can be applied to the image verification step (i.e., verifying whether an image has been subjected to an injection attack) in the identity authentication process. The image verification process based on the two models is described below.

[0089] FIG. 3 is an interaction diagram of a method for verifying an image according to an embodiment of the present specification. As shown in FIG. 3, the method can include the following steps:

[0090] In step S302, the client obtains an initial image to be verified.

[0091] In the client, a generation model trained by the method shown in FIG. 2 is deployed.

[0092] In one embodiment, the initial image described above can be an image taken by the client in the process of performing a target service. The target service can be, for example, an identity authentication service.

[0093] When the target service is an identity authentication service, the initial image described above is a face image or a certificate image of a user.

[0094] Step S304. The client inputs the initial image into the above generation model to obtain a target image carrying steganographic information.

[0095] In one embodiment, the client can also input the first information into the generation model, so that the generation model outputs a target image carrying steganographic information.

[0096] Of course, in practice, after the generation model is trained, the first information can be built into the generation model, so that the client only needs to input the initial image into the generation model.

[0097] Step S306, the client sends the target image carrying steganographic information to the server.

[0098] In practice, the client can also send the client identifier to the server.

[0099] In this scheme, the server is deployed with a discriminant model trained together with the above generation model.

[0100] Step S308, the server extracts steganographic information from the target image through the discriminant model.

[0101] Step S310, the server verifies the target image based on the extracted steganographic information.

[0102] Specifically, the server can find the verification information corresponding to the client from the storage unit according to the client identifier received from the client, and match the verification information with the steganographic information extracted from the target image, and in the case of matching, it is determined that the initial image is generated by the client, thereby realizing the verification of whether the initial image is subjected to injection attack.

[0103] In summary, the method for verifying an image provided by the embodiments of the present specification, the client generates the image to be verified by using the generation model, and the server extracts steganographic information from the image to be verified by using the discriminant model, and verifies whether the image is subjected to injection attack based on the steganographic information.

[0104] FIG. 4 is an interaction diagram of a method for verifying an image in an embodiment of the present specification, as shown in FIG. 4, the method can include the following steps:

[0105] Step S402, the client inputs the user's face image and the certificate image into the generation model respectively, to obtain a face image carrying steganographic information and a certificate image carrying steganographic information.

[0106] Step S404, the client sends the face image carrying steganographic information and the certificate image carrying steganographic information to the server.

[0107] Step S406, the server extracts steganographic information from the face image and the certificate image respectively through the discrimination model, and matches the two extracted steganographic information; if the matching is consistent, it is determined that the face image and the certificate image are generated by the client; if the matching is inconsistent, it is determined that the face image and the certificate image are not generated by the client.

[0108] Therefore, whether the face image and the certificate image are subjected to injection attack is verified.

[0109] Corresponding to the training method of the generation model, an embodiment of the present specification also provides a training device of a generation model, as shown in FIG. 5, which can include:

[0110] The acquisition unit 502 is configured to acquire a first training sample, which includes a first initial image and first information.

[0111] The input unit 504 is configured to input the first training sample into the generation model for model processing to obtain a first target image carrying steganographic information.

[0112] The input unit 504 is further configured to input the first target image into the pre-trained discrimination model to obtain a first visibility score, which indicates the visibility of the steganographic information.

[0113] The adjustment unit 506 is configured to adjust the parameters of the generation model with the goal of reducing a first loss, wherein the first loss is positively correlated with the first visibility score.

[0114] In one embodiment, the generation model includes a first encoder, a second encoder, and a decoder.

[0115] The input unit 504 is specifically configured to:

[0116] The first initial image is processed by the first encoder to obtain a first image representation. The first information is processed by the second encoder to obtain a first text representation. The first target image is generated based on the first image representation and the first text representation by the decoder.

[0117] In one embodiment, the input of the discrimination model further includes a first degraded image obtained by degrading the first target image, and the first loss is further positively correlated with a visibility score output by the discrimination model for the first degraded image.

[0118] The degradation processing includes at least one of the following: compression, cropping, adding noise, and adjusting size, etc.

[0119] In one embodiment, the input unit 504 is further configured to input the first training sample into the generation model with fixed parameters to obtain a second target image carrying steganographic information.

[0120] The input unit 504 is further configured to input the second target image into the discrimination model to obtain a second visibility score.

[0121] The adjustment unit 506 is further configured to adjust parameters of the discrimination model with a target of reducing a second loss, where the second loss is inversely related to the second visibility score.

[0122] In one embodiment, the input of the discrimination model further includes a second degraded image obtained by performing degradation processing on the second target image, and the second loss is further inversely related to a visibility score output by the discrimination model for the second degraded image.

[0123] In one embodiment, the input of the discrimination model further includes the first initial image, and the second loss is further positively related to a visibility score output by the discrimination model for the first initial image.

[0124] In one embodiment, the output of the discrimination model further includes predicted stego information, and the second loss is further positively related to a difference loss determined based on a comparison between the first information and the predicted stego information.

[0125] In one embodiment, the apparatus further includes:

[0126] The acquisition unit 508 is configured to acquire positive samples and negative samples, where the positive samples include first images carrying explicit information, and the negative samples include second images carrying stego information.

[0127] The training unit 510 is configured to train the discrimination model based on the positive samples and the negative samples.

[0128] The stego information in the second image is added to the second image by using a digital watermarking algorithm.

[0129] In a more specific embodiment, the negative samples further include third images carrying no information.

[0130] The functions of each functional unit of the apparatuses in the foregoing embodiments of the present specification can be realized through each step of the foregoing method embodiments, and thus the specific working process of the apparatus provided in an embodiment of the present specification will not be repeated here.

[0131] The training apparatus for generating a model provided in an embodiment of the present specification can train a generated model capable of generating an image that can effectively resist image injection attacks.

[0132] Corresponding to the method for verifying an image, an embodiment of the present specification further provides an apparatus for verifying an image, which is arranged at a client that deploys a generated model trained according to the method shown in FIG. 2. As shown in FIG. 6, the apparatus can include:

[0133] The acquisition unit 602 is configured to acquire an initial image to be verified.

[0134] The input unit 604 is configured to input the initial image into the generation model to obtain a target image carrying steganographic information.

[0135] The sending unit 606 is configured to send the target image carrying steganographic information to a server.

[0136] The functions of each functional unit of the above-mentioned embodiment device can be realized through each step of the above-mentioned method embodiment, and therefore, the specific working process of the device provided by one embodiment of the present specification will not be repeated here.

[0137] Corresponding to the above-mentioned method for verifying an image, one embodiment of the present specification further provides a device for verifying an image, which is arranged in a server. The server is deployed with a discriminator model trained together with the generation model. As shown in FIG. 7, the device can include:

[0138] The receiving unit 702 is configured to receive a target image to be verified from a client. The client is configured to generate an image carrying steganographic information by using the generation model trained according to the method shown in FIG. 2.

[0139] The extraction unit 704 is configured to extract steganographic information from the target image by using the discriminator model.

[0140] The verification unit 706 is configured to verify the target image based on the steganographic information.

[0141] The functions of each functional unit of the above-mentioned embodiment device can be realized through each step of the above-mentioned method embodiment, and therefore, the specific working process of the device provided by one embodiment of the present specification will not be repeated here.

[0142] The device for verifying an image provided by one embodiment of the present specification can verify whether an image is subjected to an injection attack.

[0143] According to another aspect, an embodiment also provides a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in combination with FIG. 2.

[0144] According to still another aspect, an embodiment also provides a computing device including a memory and a processor, the memory having executable code stored therein, and the processor implementing the method described in combination with FIG. 2 when executing the executable code.

[0145] Each of the embodiments described in this specification has at least one implementation in some embodiments, parts of which are the same as or similar to parts of other embodiments. Each embodiment is described in terms of its differences from the other embodiments. In particular, the medium or device embodiments are described relatively simply because they are substantially similar to the method embodiments, and the relevant parts are described with reference to the method embodiment descriptions.

[0146] The steps of a method or algorithm described in connection with the present disclosure can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium can be integral to the processor. The processor and the storage medium can reside in an ASIC. Alternatively, the processor and the storage medium can be located in a server, and the server can be located in a cloud. The processor and the storage medium can be located in a user terminal. The processor and the storage medium can be located in any other suitable device component.

[0147] In the 1990s, it was relatively easy to distinguish whether an improvement in a technology was a hardware improvement (e.g., an improvement in the circuit structure of a diode, transistor, switch, etc.) or a software improvement (an improvement in a method flow). However, as technology has evolved, many improvements in method flows today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flows into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming the PLD, rather than by ordering a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented using "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0148] The controller can be implemented in any suitable way, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code form, the controller can perfectly well be implemented to perform the same functions in the form of logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of logical programming of the method steps. Such a controller can thus be considered a hardware component, and the means comprised therein for performing the various functions can also be considered structures within the hardware component. Alternatively, or even, the means for performing the various functions can be considered both software modules implementing the method and structures within the hardware component.

[0149] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, computers implementing the functions of the above embodiments can be personal computers, laptop computers, vehicle-mounted human-computer interaction devices, cellular phones, camera phones, smart phones, personal digital assistants, media players, navigation devices, electronic mail devices, game consoles, tablet computers, wearable devices, or combinations of any of these devices.

[0150] Although the method operational steps are provided in one or more embodiments herein in the order listed, other embodiments could include fewer or more steps and / or different ordering of the steps, based on the common or inventive concepts. The order in which steps are listed is merely one example of the ordering of the steps. The steps listed in the embodiments can be performed in serial, parallel, or in any order, as long as the end result is that the steps are performed. The term "comprising" or "including" or any other variant is intended to cover both the case where one or more steps are included in the process, method, article, or apparatus, and the case where one or more steps are not included in the process, method, article, or apparatus. The terms "comprising", "including", or any other variant thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises or includes one or more steps does not include only those one or more steps, but can include other steps not expressly listed or inherent to such process, method, article, or apparatus. The use of the terms "first", "second", or any other ordinal term is not meant to indicate any particular order, but is meant to indicate a different class of elements. For example, the use of the term "first" to describe one element does not mean that the element is the first element to be performed, but rather that the element is the first of a different class of elements.

[0151] For the sake of description, the above apparatuses are described in functional modules for convenience. Certainly, when implementing one or more embodiments of the present specification, the functions of the modules can be implemented in one or more software and / or hardware, or the modules implementing the same function can be combined into a combination of sub-modules or sub-units. The above-described apparatus embodiment is only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed elements can be indirect coupling or communication connection through some interface, apparatus or unit, and can be electrical, mechanical or other forms.

[0152] The present application is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus generate the apparatus for implementing the functions specified in one or more flows or blocks of the flowcharts and / or block diagrams.

[0153] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0154] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0155] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0156] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the computer stores information about an operating system or application programs, e.g., DRAM, SRAM, etc. The memory is an example of computer readable media.

[0157] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0158] Those skilled in the art will appreciate that the one or more embodiments described herein can be provided as a method, a system or a computer program product. Accordingly, the one or more embodiments described herein can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the one or more embodiments described herein can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable code.

[0159] The one or more embodiments described herein can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The one or more embodiments described herein can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0160] The various embodiments described in this specification are described in the context of progressive embodiments, with each embodiment building on the previous one. The same or similar parts between embodiments are cross-referenced as appropriate. Each embodiment focuses on the differences between that embodiment and the previous one. In particular, the system embodiments are described relatively simply, as they are substantially similar to the method embodiments. In the description of the specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the specific feature, structure, material or characteristic being described in connection with that embodiment or example is included in at least one embodiment or example in the specification. Illustrative descriptions of the above terms in the specification do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Furthermore, the skilled person can combine and combine the features of different embodiments or examples and different embodiments or examples described in the specification, without contradiction.

[0161] The above description merely provides examples of the one or more embodiments described in this specification and does not limit the one or more embodiments described in this specification. The one or more embodiments described in this specification can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the one or more embodiments described in this specification should be included in the scope of the claims.

Claims

1. A method for training a generative model, comprising: Obtain the first training sample, which includes the first initial image and the first information; The first training sample is input into the generation model for model processing to obtain the first target image carrying steganographic information; The first target image is input into a pre-trained discrimination model to obtain a first visibility score; The first visibility score indicates the degree of visibility of the steganographic information; The parameters of the generative model are adjusted with the goal of reducing the first loss; wherein the first loss is positively correlated with the first visibility score.

2. The method according to claim 1, wherein, The generative model includes: a first encoder, a second encoder, and a decoder; The model processing includes: The first initial image is processed using the first encoder to obtain a first image representation; the first information is processed using the second encoder to obtain a first text representation; and the first target image is generated using the decoder based on the first image representation and the first text representation.

3. The method according to claim 1, wherein, The input to the discrimination model also includes a first downgraded image obtained by downgrading the first target image, and the first loss is positively correlated with the visibility score output by the discrimination model for the first downgraded image.

4. The method according to claim 3, wherein, The degradation process includes at least one of the following: compression, cropping, adding noise, and resizing.

5. The method according to claim 1, further comprising: By inputting the first training sample into the generative model with fixed parameters, a second target image carrying steganographic information is obtained. The second target image is input into the discrimination model to obtain the second visibility score; The parameters of the discrimination model are adjusted with the goal of reducing the second loss; wherein the second loss is inversely correlated with the second visibility score.

6. The method according to claim 5, wherein, The input to the discrimination model also includes a second downgraded image obtained by downgrading the second target image, and the second loss is also inversely correlated with the visibility score output by the discrimination model for the second downgraded image.

7. The method according to claim 5, wherein, The input to the discriminant model also includes the first initial image; the second loss is also positively correlated with the visibility score output by the discriminant model for the first initial image.

8. The method according to claim 5, wherein, The output of the discriminant model also includes predicted steganalytic information; the second loss is also positively correlated with the difference loss determined based on the comparison between the first information and the predicted steganalytic information.

9. The method according to claim 1, wherein, The discriminant model is pre-trained through the following steps: Obtain positive and negative samples; the positive samples include a first image carrying explicit information, and the negative samples include a second image carrying steganographic information; The discrimination model is trained based on the positive and negative samples.

10. The method according to claim 9, wherein, The steganographic information in the second image is added to the second image using a digital watermarking algorithm.

11. The method according to claim 9, wherein, The negative samples also include a third image that does not carry any information.

12. A method for verifying an image, executed by a client, the client being deployed with... The generative model trained according to the method of claim 1, wherein the method comprises: Obtain the initial image to be verified; The initial image is input into the generation model to obtain a target image carrying steganographic information; Send the target image carrying steganographic information to the server.

13. A method for verifying an image, executed by a server, the server being deployed with... The discriminant model trained according to the method described in claim 5, wherein the method comprises: The client receives a target image to be verified from the client; the client is used to generate an image carrying steganographic information using a generative model trained according to the method of claim 1. Steganographic information is extracted from the target image using the discrimination model; The target image is verified based on the steganographic information.

14. The method according to claim 13, wherein, The target image includes a face image and an identification document image; the verification of the target image includes: The steganographic information extracted from the face image is matched with the steganographic information extracted from the ID card image, and based on the matching result, it is determined whether the face image and the ID card image were generated by the client.

15. A training device for a generative model, comprising: An acquisition unit is used to acquire a first training sample, which includes a first initial image and first information; The input unit is used to input the first training sample into the generation model for model processing to obtain a first target image carrying steganographic information. The input unit is further configured to input the first target image into a pre-trained discrimination model to obtain a first visibility score; the first visibility score indicates the visibility of the steganographic information. An adjustment unit is used to adjust the parameters of the generative model with the goal of reducing a first loss; wherein the first loss is positively correlated with the first visibility score.

16. An image verification device, configured on a client, the client having deployed... The apparatus for training the generative model according to claim 1 includes: The acquisition unit is used to acquire the initial image to be verified. An input unit is used to input the initial image into the generation model to obtain a target image carrying steganographic information; The sending unit is used to send the target image carrying steganographic information to the server.

17. An image verification device, disposed on a server, the server being equipped with The discriminant model trained according to the method of claim 5, the apparatus comprises: A receiving unit is configured to receive a target image to be verified from a client; the client is configured to generate an image carrying steganographic information using a generative model trained according to the method described in claim 1. The extraction unit is used to extract steganographic information from the target image through the discrimination model; The verification unit is used to verify the target image based on the steganographic information.

18. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-14.

Images