Adversarial sample image generation method and apparatus, computer device, and storage medium

Abstract

An adversarial sample image generation method, executed by a computer device. The method comprises: acquiring an original sample image, and acquiring a perturbed sample image obtained by randomly perturbing the original sample image (202); acquiring at least one prompt text for the original sample image, wherein the relevance between each prompt text and the original sample image is less than a relevance threshold (204); extracting a first visual feature of the original sample image by means of a pre-trained vision language model, and for each prompt text, performing fusion on the basis of the prompt text and the first visual feature to obtain a first fused feature corresponding to the prompt text (206); extracting a second visual feature of the perturbed sample image by means of the vision language model, and for each prompt text, performing fusion on the basis of the prompt text and the second visual feature to obtain a second fused feature corresponding to the prompt text (208); on the basis of the first fused feature and the second fused feature corresponding to each prompt text, determining a perturbing loss value for the perturbed sample image (210); and using the perturbing loss value to perturb the perturbed sample image to obtain an updated perturbed sample image, and using the updated perturbed sample image to generate an adversarial sample image against the vision language model (212).

Description

Adversarial sample image generation method and device, computer device and storage medium

[0001] Related applications

[0002] The present application claims priority to the Chinese patent application No. 202411045853.7, filed on July 31, 2024, and entitled "Adversarial sample image generation method and device, computer device and storage medium", the contents of which are hereby incorporated by reference in their entirety. TECHNICAL FIELD

[0003] The present application relates to the field of artificial intelligence, in particular to an adversarial sample image generation method and device, a computer device and a storage medium. BACKGROUND

[0004] With the development of artificial intelligence technology, visual language models have emerged and are increasingly widely used in tasks such as visual question answering, visual dialogue, image search and retrieval.

[0005] In traditional technology, visual language models are vulnerable to adversarial sample images. For images with noise or carefully designed adversarial sample images, visual language models may give incorrect answers. Therefore, generating adversarial sample images through adversarial attack methods can counteract visual language models.

[0006] However, the adversarial sample images generated by traditional adversarial attack methods can cause visual language models to give incorrect answers to specific questions, but still give correct answers to questions other than the specific questions, so the adversarial ability of the adversarial sample images is poor. SUMMARY

[0007] Therefore, it is necessary to provide an adversarial sample image generation method, device, computer device and storage medium capable of improving the adversarial ability of adversarial sample images to solve the above technical problems.

[0008] In one aspect, the present application provides an adversarial sample image generation method, which is executed by a computer device, and the method comprises:

[0009] Obtaining an original sample image and an interference sample image obtained by randomly interfering with the original sample image;

[0010] Obtaining at least one prompt text for the original sample image, each prompt text having a correlation degree with the original sample image less than a correlation degree threshold;

[0011] Extracting a first visual feature of the original sample image through a pre-trained visual language model;

[0012] For each of the prompt texts, a first fusion feature corresponding to the prompt text is obtained based on the prompt text and the first visual feature;

[0013] The second visual feature of the interference sample image is extracted through the visual language model;

[0014] For each of the prompt texts, a second fusion feature corresponding to the prompt text is obtained based on the prompt text and the second visual feature;

[0015] According to the first fusion feature and the second fusion feature corresponding to each of the prompt texts, a interference loss value for the interference sample image is determined; and

[0016] The interference sample image is interfered with by using the interference loss value, an updated interference sample image is obtained, and an adversarial sample image against the visual language model is generated by using the updated interference sample image.

[0017] In another aspect, the present application also provides an adversarial sample image generation device, the device comprising:

[0018] An image acquisition module is configured to acquire an original sample image and acquire an interference sample image obtained by randomly interfering with the original sample image;

[0019] A text acquisition module is configured to acquire at least one prompt text for the original sample image, and the relevance degree of each of the prompt texts to the original sample image is less than a relevance degree threshold;

[0020] A first feature extraction module is configured to extract a first visual feature of the original sample image through a pre-trained visual language model, and for each of the prompt texts, a first fusion feature corresponding to the prompt text is obtained based on the prompt text and the first visual feature;

[0021] A second feature extraction module is configured to extract a second visual feature of the interference sample image through the visual language model, and for each of the prompt texts, a second fusion feature corresponding to the prompt text is obtained based on the prompt text and the second visual feature;

[0022] A loss value determination module is configured to determine a interference loss value for the interference sample image according to the first fusion feature and the second fusion feature corresponding to each of the prompt texts; and

[0023] An adversarial sample image generation module is configured to interfere with the interference sample image by using the interference loss value, obtain an updated interference sample image, and generate an adversarial sample image against the visual language model by using the updated interference sample image.

[0024] In another aspect, the present application also provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned method for generating an adversarial sample image when executing the computer program.

[0025] In another aspect, the present application also provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of the above-mentioned method for generating an adversarial sample image when executed by a processor.

[0026] In another aspect, the present application also provides a computer program product comprising a computer program, and the computer program implements the steps of the above-mentioned method for generating an adversarial sample image when executed by a processor.

[0027] The details of one or more embodiments of the present application are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the present application will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of the disclosed drawings.

[0029] FIG. 1 is an application environment diagram of the method for generating an adversarial sample image in some embodiments;

[0030] FIG. 2 is a flowchart of the method for generating an adversarial sample image in some embodiments;

[0031] FIG. 3 is a principle diagram of generating an adversarial sample image in some embodiments;

[0032] FIG. 4 is a comparison diagram of adversarial effects of different adversarial sample images in some embodiments;

[0033] FIG. 5 is a principle diagram of generating an adversarial sample image in other embodiments;

[0034] FIG. 6 is a principle diagram of obtaining a first output result in some embodiments;

[0035] FIG. 7 is a principle diagram of obtaining a third output result in some embodiments;

[0036] FIG. 8 is a flowchart of the method for generating an adversarial sample image in other embodiments;

[0037] FIG. 9 is a structural block diagram of an adversarial sample image generation apparatus in some embodiments;

[0038] FIG. 10 is an internal structure diagram of a computer device in some embodiments;

[0039] FIG. 11 is an internal structure diagram of a computer device in some other embodiments. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0041] The method for generating adversarial sample images provided by the embodiments of the present application can be applied in the application environment as shown in FIG. 1. Among them, the terminal 102 communicates with the server 104 through the network.

[0042] Specifically, the terminal 102 can send a request for generating adversarial sample images for a visual language model to the server 104. The server 104 acquires at least one original sample image in response to the request. For each original sample image, the server 104 acquires a disturbance sample image obtained by randomly disturbing the original sample image, acquires at least one prompt text with a correlation degree less than a correlation degree threshold with the original sample image, extracts a first visual feature of the original sample image through a pre-trained visual language model; for each prompt text, the server 104 fuses the prompt text and the first visual feature to obtain a first fusion feature corresponding to the prompt text, extracts a second visual feature of the disturbance sample image through the visual language model; for each prompt text, the server 104 fuses the prompt text and the second visual feature to obtain a second fusion feature corresponding to the prompt text, determines a disturbance loss value for the disturbance sample image according to the first fusion feature and the second fusion feature corresponding to each prompt text, disturbs the disturbance sample image using the disturbance loss value, obtains an updated disturbance sample image, and generates an adversarial sample image for the adversarial visual language model using the updated disturbance sample image. The server 104 can return the adversarial sample images obtained respectively according to each original sample image to the terminal 102, or store the generated adversarial sample images.

[0043] The terminal 102 can be, but is not limited to, a desktop computer, a notebook computer, a smart phone, a tablet computer, an Internet of Things device, and a portable wearable device. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, a projection device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The cloud server is used to provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, a content delivery network (CDN), and basic cloud computing services such as big data and artificial intelligence platforms. The terminal 102 and the server 104 can be connected directly or indirectly through wired or wireless communication, which is not limited in the present application.

[0044] In some embodiments, as shown in FIG. 2, an adversarial sample image generation method is provided, which can be executed by a terminal or a server, and can also be executed by a terminal and a server together. Taking the case where the method is applied to the server in FIG. 1 as an example, the method includes the following steps 202 to 212. Among them:

[0045] Step 202, obtaining an original sample image and obtaining an interference sample image obtained by randomly interfering with the original sample image.

[0046] The original sample image refers to an image that has not been artificially interfered with. The interference refers to adding noise to the image. The original sample image can also be referred to as a clean sample image. Random interference refers to introducing random changes or noise in the pixel values, colors, etc. of the original sample image. The original sample image can be obtained by shooting or generated by using a neural network model.

[0047] Specifically, the server can add random noise to the original sample image to achieve random interference and obtain the interference sample image. For Gaussian noise sampled from a normal distribution, the formula where μ is the mean and σ is the standard deviation, is a random variable of standard normal distribution. For salt and pepper noise, a pixel in the image can be randomly selected according to a certain probability p, and its value is set to the maximum value (such as 255) or the minimum value (such as 0). Then the random noise sampled is added to the pixel value of the original sample image pixel by pixel to obtain the interference sample image.

[0048] At step 204, at least one prompt text for the original sample image is obtained, each prompt text having a relevance degree to the original sample image less than a relevance degree threshold.

[0049] The prompt text is used for inputting into a pre-trained vision language model (VLM) so that the vision language model can determine a vision language task to be performed according to the prompt text and guide the vision language model to generate text. The vision language task includes, but is not limited to, a text generation, translation or visual question answering (VQA) task. In the visual question answering task, the prompt text is a text describing a question, for example, it can be "What color is the vehicle on the left?", "What color is the traffic light?", "What is in the mirror?", "Where is the man on horseback?", or "What is that pizza?", etc. In the text generation or translation task, the instruction type prompt text describes an instruction for instructing the vision language model to generate text, for example, in the text generation task, the prompt question can be "Please generate a caption according to the image" or "Please generate an essay according to the image", and in the translation task, the prompt question can be "Please translate What color is the traffic light into Chinese", etc.

[0050] Each prompt text in the at least one prompt text can be a prompt text in the same vision language task, or the at least one prompt text includes prompt texts in different vision language tasks, for example, including a prompt text in a visual question answering task and a prompt text in a text generation task. The prompt texts in the at least one prompt text can be irrelevant to the original sample image. The at least one prompt text can be one prompt text or multiple prompt texts, and multiple means at least two.

[0051] The input of the vision language model includes an image and a prompt text, and the output includes text generated according to the input image and the prompt text. The vision language model is used to analyze the input image and the prompt text and generate text in the form of natural language description. The vision language model can be applied to image description generation, visual question answering, image search and retrieval, visual dialogue, multi-model content generation, cross-modal knowledge reasoning, auxiliary visual understanding, etc. In the image description generation scenario, the vision language model can analyze the image content and generate a natural language description. In the visual question answering scenario, given an image and a question, the vision language model can understand and analyze the image and then generate a natural language answer to the question, which can be used to assist visually impaired persons, education or entertainment, etc. The vision language model can be a large vision language model (LVLM).

[0052] Specifically, the server can obtain a plurality of prompt texts, and determine a relevance degree of each prompt text in the plurality of prompt texts to the original sample image. The server can use a text-image similarity calculation method, for example, input the original sample image into a visual feature extraction network in a visual language model (such as a CLIP model, the image encoder of the CLIP model uses a ResNet-50 architecture, the convolution kernel size of the convolution layer is 3x3, the step is 1, the pooling layer uses maximum pooling, and the pooling kernel size is 2x2, the step is 2), and after the convolution, pooling and other operations of the network, the visual feature V of the original sample image is obtained, the prompt text is input into a language model (such as a BERT model, the hidden layer dimension of the BERT model is 768, the number of attention heads is 12, and the embedding dimension of the word embedding layer is 768), and after the word embedding (the learning rate of the word embedding is set to 0.001), attention mechanism (the dropout rate of the attention mechanism is 0.1) and other operations, the text feature T of the prompt text is obtained, and then the cosine similarity between them is calculated. The similarity is taken as the relevance degree of the prompt text to the original sample image. The server can sort the plurality of prompt texts in order of the relevance degree from small to large to generate a prompt text sequence, and select the top N prompt texts in the prompt text sequence as at least one prompt text for the original sample image.

[0053] N is greater than or equal to 1. The relevance degree threshold can be the relevance degree of the prompt text ranked N+1 in the prompt text sequence to the original sample image.

[0054] In step 206, a first visual feature of the original sample image is extracted through a pre-trained visual language model, and a first fusion feature corresponding to each prompt text is fused based on the prompt text and the first visual feature.

[0055] Specifically, the server can use a visual language model to encode the original sample image into a visual feature to obtain the first visual feature of the original sample image. The visual feature refers to a series of attributes or characteristics in an image that can be recognized and understood by the human visual system, including but not limited to color, texture, or contour, etc.

[0056] In some embodiments, the visual language model includes a visual feature extraction network. The visual feature extraction network is used to encode an image into a visual feature, and the visual feature extraction network can also be referred to as a visual encoder. The visual feature extraction network includes but is not limited to a CLIP (Contrastive Language-Image Pre-training) model, which is a multi-modal model capable of processing both text and image data. The server can input the original sample image into the visual feature extraction network to extract the visual feature, and obtain the first visual feature of the original sample image.

[0057] In some embodiments, the server can utilize the visual language model to extract semantic features from the prompt text, fuse the semantic features with the first visual features to obtain first fused features.

[0058] In some embodiments, the server can input the prompt text into a language processing module in the visual language model, and extract semantic features from the prompt text through word embedding, attention mechanism and other operations. For the fusion of semantic features and first visual features, a splicing method can be adopted to splice the semantic feature vector and the first visual feature vector in order; or a weighted summation method can be adopted to assign weights to the semantic features and the first visual features. The weights can be determined by training a weight network, and the weight network adopts a simple fully connected layer, the input of which is the spliced vector of the semantic features and the first visual features, and the output of which is two weight values w1 and w2, satisfying w1+w2=1. Then the corresponding elements of the semantic feature vector and the first visual feature vector are multiplied by w1 and w2 respectively, and summed to obtain the first fused features.

[0059] Step 208, extracting second visual features of the interference sample image through the visual language model; for each prompt text, fusing the prompt text and the second visual features to obtain second fused features corresponding to the prompt text.

[0060] Specifically, the server can utilize the visual language model to encode the interference sample image into visual features to obtain the second visual features of the interference sample image. For example, the server can input the interference sample image into a visual feature extraction network to extract visual features, thereby obtaining the second visual features of the interference sample image. The server can utilize the visual language model to extract semantic features from the prompt text, fuse the semantic features with the second visual features to obtain second fused features.

[0061] Step 210, determining an interference loss value for the interference sample image according to the first fused features and the second fused features corresponding to each prompt text respectively.

[0062] Specifically, for each prompt text, the server can determine a difference value between the first fusion feature corresponding to the prompt text and the second fusion feature corresponding to the prompt text, to obtain a difference value corresponding to the prompt text. The difference value refers to a value for representing the degree of difference between the first fusion feature and the second fusion feature corresponding to the prompt text, which is calculated in this application by calculating the Euclidean distance between the first fusion feature and the second fusion feature or using the MSE formula. The interference loss value is related to the difference value. The difference value is used to represent the degree of difference between the first fusion feature and the second fusion feature. The greater the difference value, the greater the difference between the first fusion feature and the second fusion feature. The interference loss value is in a positive correlation with each difference value, reflecting the size of the sum of the difference values.

[0063] In some embodiments, when the at least one prompt text is only one prompt text, the difference value can be taken as the interference loss value. When the at least one prompt text is a plurality of prompt texts, the difference values corresponding to the plurality of prompt texts respectively can be integrated to obtain the interference loss value. For example, the sum of the difference values corresponding to the plurality of prompt texts respectively can be taken as the interference loss value; or the mean of the difference values corresponding to the plurality of prompt texts respectively can be taken as the interference loss value.

[0064] The server can calculate the Euclidean distance between the first fusion feature and the second fusion feature, and take the calculated Euclidean distance as the difference value corresponding to the prompt text. The specific calculation method is that, assuming that the first fusion feature is a vector q=(q1, q2, …, qn), and the second fusion feature is a vector q'=(q1', q2', …, qn'), the Euclidean distance between them is n n . Alternatively, the server can calculate the difference value using the MSE (Mean Squared Error) formula, and the MSE formula is where n is the dimension of the vector.

[0065] Step 212, using the interference loss value to interfere with the interference sample image to obtain an updated interference sample image, and using the updated interference sample image to generate an adversarial sample image of the adversarial visual language model.

[0066] Wherein, the adversarial visual language model refers to making the visual language model produce an incorrect output result through the adversarial sample image. The adversarial sample image refers to an image formed by adding subtle interference such as human imperceptible interference to the original sample image. The adversarial sample image can be generated using an adversarial attack method. It can be understood that the interference sample image changes through interference, and the interference sample image obtains the adversarial sample image through at least one interference.

[0067] ​Specifically, the server can determine, according to the interference loss value, an image interference value for interfering with the interference sample image, and the image interference value can include interference values corresponding to at least some of the pixels in the adversarial sample image. The server can incorporate the interference values into the pixel values of the corresponding pixels, thereby changing the pixel values of the pixels in the interference sample image and achieving interference with the interference sample image. The image interference value refers to a value determined according to the interference loss value and used for interfering with the interference sample image, and includes interference values corresponding to at least some of the pixels in the adversarial sample image. Incorporating the interference values into the pixel values of the corresponding pixels can change the pixel values of the pixels in the interference sample image.

[0068] For a pixel in the interference sample image, the server can determine, according to the gradient value of the interference loss function at the pixel and the interference loss value, an interference value corresponding to the pixel. The gradient value of the interference loss function at the pixel can be obtained by using an automatic derivation tool (such as the autograd module in PyTorch) to derive the pixel value of the interference loss function with respect to the pixel. The following formula can be used: interference value = a x sign(gradient value) x interference loss value, where a is a preset step coefficient, and sign is a sign function used to obtain the sign of the gradient value.

[0069] In some embodiments, after interfering with the interference sample image using the interference loss value to obtain an updated interference sample image, the server can determine the updated interference sample image as the adversarial sample image used to attack the visual language model.

[0070] In some embodiments, after interfering with the interference sample image using the interference loss value to obtain an updated interference sample image, the server can again calculate the interference loss value and perform interference for the updated interference sample image. The interference sample image obtained after multiple iterations of interference can be determined as the adversarial sample image used to attack the visual language model.

[0071] In some embodiments, the visual language model includes a visual feature extraction network and a fusion network, as shown in FIG. 3, which shows a schematic diagram of generating an adversarial sample image. The original sample image is input into the visual feature extraction network to obtain first visual features. The prompt text and the first visual features are input into the fusion network to obtain first fusion features. The original sample image is randomly disturbed to obtain a disturbed sample image. The disturbed sample image is input into the visual feature extraction network to obtain second visual features. The prompt text and the second visual features are input into the fusion network to obtain second fusion features. Then, an adversarial loss value is generated according to the first fusion features and the second fusion features. The disturbed sample image is disturbed using the adversarial loss value to update the disturbed sample image. The process of obtaining the second fusion features from the disturbed sample image can be iteratively performed to iteratively update the disturbed sample image. When the iteration ends, the disturbed sample image is taken as the adversarial sample image.

[0072] In some embodiments, the server can evaluate the accuracy and robustness of the visual language model using the generated adversarial sample image, and can also train the visual language model using the generated adversarial sample image to improve the robustness and accuracy of the visual language model.

[0073] In the above-mentioned adversarial sample image generation method, the first fusion features are extracted by the visual language model based on the prompt text and the original sample image, and the second fusion features are extracted by the visual language model based on the prompt text and the disturbed sample image. Therefore, the disturbance loss value for the disturbed sample image is determined according to the first fusion features and the second fusion features corresponding to each prompt text, the disturbed sample image is disturbed using the disturbance loss value to obtain an updated disturbed sample image, and the adversarial sample image of the adversarial visual language model is generated using the updated disturbed sample image. Thus, the adversarial sample image can be generated by disturbance. Since the relevance of each prompt text to the original sample image is less than the relevance threshold, compared to generating an adversarial sample image using a prompt text with a higher relevance to the original sample image, generating an adversarial sample image based on a prompt text with a relevance less than the relevance threshold can obtain an adversarial sample image with stronger adversarial ability, thereby improving the adversarial ability of the adversarial sample image.

[0074] As shown in FIG. 4, the relevance degree of the relevant question to the original sample image is greater than the relevance degree of the irrelevant question to the original sample image, and the question with a relevance degree less than the relevance degree threshold can be an irrelevant question. The relevance degree of the relevant question to the original sample image is greater than or equal to the second relevance degree threshold, and the second relevance degree threshold is greater than or equal to the first relevance degree threshold. Since the difference between the adversarial sample image and the original sample image is not perceivable or not obviously perceivable by the human eye, the relevance degree between the prompt text and the original sample image also reflects the relevance degree between the prompt text and the adversarial sample image. In FIG. 4, the original sample image is disturbed based on the relevant question to obtain an adversarial sample image 1 generated by the relevant question, the adversarial sample image 1 is disturbed based on the irrelevant question to obtain an adversarial sample image 2 generated by the irrelevant question by using the adversarial sample image generation method provided in the present application, then the adversarial sample image 1 is used to participate in the visual question and answer, that is, for each question in question 1 to question 6, the adversarial sample image 1 and the question are input into the visual language model to obtain an answer 1 output by the visual language model, similarly, the adversarial sample image 2 is used to participate in the visual question and answer, that is, for each question in question 1 to question 6, the adversarial sample image 2 and the question are input into the visual language model to obtain an answer 2 output by the visual language model, so that two answers, i.e., the answer 1 and the answer 2, are generated for each question. “X” represents an incorrect answer, and “√” represents a correct answer. It can be seen that the answer 1 of question 1 is incorrect, and the answer 1 of other questions is correct. Since the relevant question of the adversarial sample image 1 is the same as question 1, questions 2 to 6 are different from question 1, and therefore, the adversarial sample image 1 can make the visual language model give an incorrect answer to question 1 used to generate the adversarial sample image 1, but cannot make the visual language model give an incorrect answer to other questions different from question 1, so the adversarial sample image 1 has poor adversarial ability. Since the answer 2 of each question is incorrect, the adversarial sample image 2 has strong adversarial ability. Therefore, the adversarial sample image generation method provided in the present application can also be referred to as a QAVA (Query-Agnostic Visual Attack) method, and the query-agnostic means that the generated adversarial sample image can attack more prompt texts successfully, rather than only attacking specific prompt texts successfully.

[0075] In some embodiments, the at least one prompt text for the original sample image is obtained by: obtaining a prompt text set for the original sample image; and sampling the prompt text set to obtain the at least one prompt text for the original sample image.

[0076] The relevance degree of the prompt text in the prompt text set to the original sample image is less than a relevance degree threshold. The prompt text set refers to a set containing multiple prompt texts with a relevance degree less than the relevance degree threshold to the original sample image. At least one prompt text for generating the adversarial sample image can be sampled from the set.

[0077] Specifically, the server can randomly sample at least one prompt text from the prompt text set for the original sample image to obtain at least one prompt text for the original sample image.

[0078] In some embodiments, the server can obtain multiple prompt texts, determine the relevance degree of each prompt text in the multiple prompt texts to the original sample image respectively, and group prompt texts with a relevance degree less than a relevance degree threshold to form a prompt text set for the original sample image. The relevance degree threshold can be set as needed.

[0079] In this embodiment, at least one prompt text for the original sample image is sampled from the prompt text set by sampling, thereby enhancing the randomness of the prompt text. The adversarial sample image generated based on the prompt text is not only attacking for a specific problem related to the original sample image, but also attacking for more problems related to the original sample image, for example, in the visual question answering task, the adversarial sample image can make the visual language model give an incorrect answer to more problems related to the original sample image, thereby improving the performance of the adversarial sample image, i.e., the attack force.

[0080] In some embodiments, sampling the prompt text set to obtain at least one prompt text for the original sample image includes: determining the type of the prompt text in the prompt text set; dividing the prompt text set into multiple type corresponding sub-sets according to the type, each sub-set including at least one prompt text in the prompt text set; and sampling at least one sub-set to obtain at least one prompt text for the original sample image.

[0081] The type of the prompt text can be a topic type or a preset type. The preset type is a type that can be recognized by a classification model. The classification model can classify the prompt text to determine the preset type to which the prompt text belongs. For example, taking the prompt text in the prompt text set as a question in a visual question and answer task, since the question can be a quantity question, a yes / no question, or other types of questions, the topic type can include, but is not limited to, quantity type, yes / no type, or other type. For example, the quantity question can be “How many trees are in the picture?” and the yes / no question can be “Is there a cat in the picture?” The preset type includes, but is not limited to, “What is on the,” “What animal is,” “What color is,” and the like.

[0082] The type corresponds to a sub-set. The sub-set refers to a plurality of sets obtained by dividing the prompt text set according to the type of the prompt text. Each sub-set contains at least one prompt text of the same type in the prompt text set. At least one prompt text for generating an adversarial sample image can be sampled from the sub-set. Each sub-set includes at least one prompt text. The types of the prompt texts in the sub-set are the types corresponding to the sub-set.

[0083] Specifically, the prompt text set includes prompt texts of different types. The server can divide the prompt text set into a plurality of sub-sets corresponding to different types by clustering. The server can randomly select at least one prompt text from any sub-set as at least one prompt text for the original sample image.

[0084] In some embodiments, the at least one prompt text for the original sample image is a plurality of prompt texts. The server can randomly select at least one prompt text from each sub-set, i.e., sample at least one prompt text. The prompt texts randomly selected from each sub-set are used as the plurality of prompt texts for the original sample image. The number of prompt texts selected by the server from each sub-set can be the same or different.

[0085] In some embodiments, there can be a classification model for the type of the prompt text. The classification model can be a neural network model. The server inputs the prompt text into the classification model for classification to obtain the type of the prompt text output by the classification model.

[0086] A classification model can exist to determine the type of the prompt text. This model can be a Transformer-based neural network model, such as BERT. The structure of this classification model includes an input layer, multiple Transformer layers, and an output layer. The input layer converts the prompt text into word vectors, the multiple Transformer layers perform feature extraction and representation learning on the word vectors, and the output layer is a fully connected layer whose output dimension is the number of categories. During training, a large amount of prompt text data with type labels is used, and the cross-entropy loss function is employed for training. The model's parameters are continuously adjusted to ensure accurate classification of the prompt text. The server inputs the prompt text into the trained classification model for classification, obtaining the type of the prompt text output by the model.

[0087] In this embodiment, at least one prompt text for the original sample image is sampled from at least one subset of multiple types of corresponding subsets. This allows the at least one prompt text to be either of the same type or include prompt text of different types, thereby improving the flexibility of the types of the at least one prompt text. When different types of prompt text are included, the adversarial sample image is generated by interfering with the interfering sample image based on the different types of prompt text. This makes the adversarial sample image more aggressive against more types of prompt text, thereby further increasing the performance, i.e., the attack power, of the adversarial sample image.

[0088] In some embodiments, determining an interference loss value for an interference sample image based on a first fusion feature and a second fusion feature corresponding to each prompt text includes: determining the difference value between the first fusion feature and the second fusion feature corresponding to each prompt text; combining the difference values ​​determined for each prompt text to obtain an interference loss value for the interference sample image; and using the interference loss value to interfere with the interference sample image to obtain an updated interference sample image, including: interfering with the interference sample image in a direction that increases the interference loss value to obtain an updated interference sample image.

[0089] Specifically, the first fusion feature and the second fusion feature are vectors of the same dimension, for example, both are (M,N) dimensional vectors. The first and second fusion features contain the same number of numerical values, each numerical value being an element in the vector. The server can determine the difference between the numerical values ​​at the same position in the first and second fusion features, square the difference at the same position to obtain the squared value, and combine the squared values ​​obtained from each position to obtain the difference value corresponding to the prompt text. For example, the server can use the sum of the squared values ​​obtained from each position as the difference value corresponding to the prompt text; or, it can use the average of the squared values ​​obtained from each position as the difference value corresponding to the prompt text. For example, if the first fusion feature is represented by q and the second fusion feature by q′, the server can use formula (1) to calculate the difference value corresponding to the prompt text:

[0090] Where D(q,q′) represents the difference value, and q and q′ are M×N dimensional vectors. i,j Let q' be the value at position (i,j) in q. i,j Let be the value at position (i,j) in q′. When there is only one prompt text, the difference value corresponding to the prompt text can be used as the interference loss value for the interference sample image. For example, the interference loss value can be expressed as: but (2). When the interference loss value is the mean of the difference values ​​corresponding to each prompt text, and there are at least n prompt texts, then D i (q, q′) represents the difference value corresponding to the i-th prompt text among the n prompt texts. If the prompt text is represented by x... t,QAVA Indicates that the original sample image is represented by x. i The interference sample image is represented by x′. i If q = Q(f) i (x i ),x t,QAVA ), q′=Q(f i (x′ i ),x t,QAVA Q represents the network in the visual language model that obtains the first and second fusion features; this network can be called a fusion network. i (x i In the diagram, the subscript 'i' is an abbreviation for 'image'. i Represents the visual encoder, f i (x i ) represents the first visual feature, f i (x′ i () represents the second visual feature. The original sample image is represented by x. i With the interference sample image, x′i It can satisfy |x i -x′ i | ∞ ≤∈。 |x i -x′ i | ∞ ≤∈ means x i and x′ i The difference should be minimized, and ∈ can be set as needed.

[0091] In this embodiment, the interference loss value for the interference sample image is obtained by combining the difference values ​​determined for each prompt text. That is, the interference loss value is related to the difference value. When the interference sample image is interfered with in a direction that increases the interference loss value, the difference value can be changed in the direction of increase, which increases the difference between the first fusion feature and the second fusion feature. Therefore, when the prompt text related to the generated adversarial sample image and the original sample image is input into the visual language model, it is easy for the visual language model to output incorrect text, thus improving the performance of the interference sample image.

[0092] In some embodiments, generating adversarial sample images for an adversarial visual language model using updated interfering sample images includes: if a preset interfering stopping condition is not met, returning to the step of extracting second visual features of the interfering sample image through a visual language model for the updated interfering sample image; and if the interfering stopping condition is met, determining the updated interfering sample image as an adversarial sample image for the adversarial visual language model.

[0093] Interference stopping conditions refer to the conditions for determining whether to stop the interference operation during the process of interfering with the interference sample image. For example, the number of times the interference loss value is used to interfere reaches a threshold, or the difference between the updated interference loss value and the original interference loss value is less than a preset value.

[0094] The interference stopping condition can be that the number of times interference is applied using the interference loss value reaches a threshold, which can be set as needed, such as 5 or 10 times. Another interference stopping condition is that the difference between the updated and unupdated interference loss values ​​is less than a preset value. This preset value can be set as needed. The interference loss value obtained based on the updated interference sample image is greater than or equal to the interference loss value obtained based on the unupdated interference sample image.

[0095] Specifically, for each pixel in the interference sample image, the server can determine the corresponding interference value based on the gradient value of the interference loss function at that pixel and the interference loss value itself. The interference loss function is the function, i.e., the formula, used to calculate the interference loss value. The gradient value of the interference loss function at that pixel can be obtained by calculating the gradient of the pixel value using the interference loss function. Two methods are provided here for the server to interfere with the interference sample image: one is to integrate the interference value corresponding to the pixel into the pixel value of the interference sample image, for example, by adding the interference value to the pixel value, or through other mathematical operations (such as multiplication); the other is to use a truncation function to truncate the sum of the pixel value and the interference value for each pixel, i.e., changing values ​​less than a preset minimum value to the preset minimum value, values ​​greater than a preset maximum value to the preset maximum value, and values ​​within a preset range to remain unchanged, and then updating the pixel value of the pixel to the truncated value.

[0096] In some embodiments, the server can use a mapping function to map gradient values ​​to values ​​within a preset range, obtaining the mapped value corresponding to the gradient value, and determining the interference value based on the mapped value. If the sign function `sign` is used as the mapping function, for the gradient value `g`, its mapped value `m = sign(g)`, that is, when `g > 0`, `m = 1`; when `g = 0`, `m = 0`; when `g < 0`, `m = -1`. If a linear mapping function is used, assuming the preset range is and the range of gradient values ​​is , then the mapped value `m = ...` The mapped value is positively correlated with the interference value. For example, the mapped value can be used as the interference value. Alternatively, the product of the mapped value and a preset coefficient can be used as the interference value. The preset range can be set as needed, for example, (-1, 1). The preset coefficient is a value between 0 and 1, such as 0.02, 0.05, or 0.1.

[0097] In some embodiments, the formula for interfering with the sample image can be expressed as: Where x′ on the left side of the equal sign i The image represents the updated, or perturbed, image of the perturbed sample; x′ on the right side of the equals sign represents this. i This represents the updated image of the interfering sample before the interference. This represents the gradient value at each pixel. α represents a preset coefficient. Clip is the clipping function.

[0098] In this embodiment, an iterative method is used to interfere with the interference sample image, which allows for multiple interferences and further improves the performance of the interference sample image.

[0099] In some embodiments, obtaining a first fused feature corresponding to the prompt text based on the fusion of the prompt text and the first visual features includes: extracting semantic features from the prompt text; and extracting visual features related to the prompt text by fusing the semantic features and the first visual features to obtain the first fused feature corresponding to the prompt text.

[0100] Semantic features refer to features extracted from the prompt text that reflect the semantic information of the prompt text. These features can be fused with first visual features or second visual features to obtain first fused features or second fused features. Fusion can be achieved through attention mechanisms, including but not limited to at least one of self-attention or multi-head attention mechanisms.

[0101] Specifically, a visual language model may include a fusion network. The fusion network maps visual features to the input space of the language model to generate text-related visual features. These generated text-related visual features can be understood by the language model, thus achieving visual-language alignment. Therefore, the fusion network can also be called a visual-language alignment network. The server can input the prompt text and its corresponding first visual features into the fusion network. The fusion network extracts semantic features from the prompt text and fuses these semantic features with the first visual features. This fusion process extracts visual features related to the prompt text, which are the first fused features corresponding to the prompt text. Visual features can be called visual tokens. Semantic features can be called semantic tokens. The fusion network can have multiple layers. The first fused feature can be the output of any layer in the fusion network, such as an intermediate layer or the last layer. Alternatively, the first fused feature can also include the outputs of at least two layers in the fusion network.

[0102] The fusion network includes, but is not limited to, Q-former (Querying Transformer). Q-former is a lightweight Transformer architecture. Q-former introduces a set of learnable query vectors, which are continuously optimized during training to better capture visual information related to the text.

[0103] In this embodiment, since the first fusion feature is a visual feature related to the prompt text, the interference sample image is interfered with according to the interference loss value. This can make the visual feature related to the prompt text obtained based on the original sample image more different from the visual feature related to the prompt text obtained based on the interference sample image. Since the visual feature has a great influence on the output of the visual language model, the difference in the output result can be improved, so that the obtained adversarial sample image can generate adversarial capability.

[0104] In some embodiments, the interference loss value is a first interference loss value, and the method further includes: for each prompt text, obtaining a first model output result of the visual language model outputting the prompt text based on the prompt text and the first fusion feature corresponding to the prompt text, and obtaining a second model output result of the visual language model outputting the prompt text based on the prompt text and the second fusion feature corresponding to the prompt text; determining a second interference loss value for the interference sample image based on the first model output result and the second model output result corresponding to each prompt text; and interfering with the interference sample image using the interference loss value to obtain an updated interference sample image, including: interfering with the interference sample image using the first interference loss value and the second interference loss value to obtain an updated interference sample image.

[0105] In steps 210 and 212, the interference loss value is the first interference loss value. The first interference loss value refers to the interference loss value determined based on the first and second fusion features corresponding to each prompt text, used to interfere with the interference sample image to generate adversarial example images. The visual language model includes a language model, which can be used to generate text, translate, generate summaries, or provide answers to questions. The language model can be a Large Language Model (LLM), including but not limited to BERT (Bidirectional Encoder Representations from Transformers), a bidirectional encoder model based on the Transformer architecture.

[0106] Specifically, the server can input the prompt text and the first fusion feature corresponding to the prompt text into the language model in the visual language model to generate text and obtain the output result of the language model, which is the first model output result corresponding to the prompt text.

[0107] In some embodiments, the dimension of the first fused feature is a first dimension. The visual language model may include a mapping layer. The server can input the first fused feature into the mapping layer, which maps the first fused feature to a feature of a second dimension, obtaining the mapped feature corresponding to the first fused feature. The second dimension is different from the first dimension; for example, the first dimension is 768, and the second dimension is 4096. Then, the server inputs the mapped feature corresponding to the first fused feature and the prompt text into the language model, obtaining the output of the language model, which is the first model output corresponding to the prompt text. The second model output can be obtained in the same way.

[0108] In some embodiments, the output of the first model may include the generated first text and the probability distribution corresponding to each word in the first text, and the output of the second model may include the generated second text and the probability distribution corresponding to each word in the second text. The server can use the probability distributions corresponding to the words in the output of the first model as labels and calculate the second interference loss value using the cross-entropy loss function.

[0109] The second interference loss value refers to the interference loss value for the interference sample image, which is determined based on the first model output result and the second model output result corresponding to each prompt text. It is used together with the first interference loss value to interfere with the interference sample image, so as to further improve the adversarial capability of the adversarial sample image.

[0110] In some embodiments, the server can use the sum of the first interference loss value and the second interference loss value as the comprehensive interference loss value. To interfere with the interference sample image using the comprehensive interference loss value, the gradients of the first and second interference loss values ​​with respect to the pixel values ​​of the interference sample image can be calculated first, and then these two gradients can be added together to obtain the comprehensive gradient. Next, based on the comprehensive gradient and a preset step size coefficient, the interference value for each pixel is determined; the calculation method for the interference value can refer to the method described above. Finally, the interference value is incorporated into the pixel value of the corresponding pixel to achieve interference with the interference sample image, resulting in an updated interference sample image.

[0111] To illustrate the principle of interfering with sample images, as shown in Figure 5, the original sample image is input into a visual feature extraction network to obtain the first visual feature. The prompt text and the first visual feature are then input into a fusion network to obtain the first fused feature. This first fused feature is then input into a mapping layer to obtain the mapped feature corresponding to the first fused feature. The mapped feature corresponding to the first fused feature is then input into a language model to obtain the output of the first model. Random perturbation is applied to the original sample image to obtain interfering sample images. These interfering sample images are then input into a visual feature extraction network to obtain the second visual feature. The prompt text and the second visual feature are then input into a fusion network to obtain the second fused feature. This second fused feature is then input into a mapping layer to obtain the mapped feature corresponding to the second fused feature. The mapped feature corresponding to the second fused feature is then input into a language model to obtain the output of the second model. Figure 5 shows the probability distribution of the words generated in the second model output. Then, based on the first and second fused features, a first adversarial loss value is generated. Based on the outputs of the first and second models, a second adversarial loss value is obtained. These first and second adversarial loss values ​​are then used to perturb the sample images.

[0112] The first adversarial loss is a loss value used in the generation of adversarial example images. It measures the difference between the original sample image and the interfering sample image at the feature fusion level. This loss value is used to perturb the interfering sample image to generate the adversarial example image. The second adversarial loss is another loss value used in the generation of adversarial example images. Unlike the first adversarial loss, it measures the difference between the original sample image and the interfering sample image at the model output level. This loss value is used to perturb the interfering sample image to generate the adversarial example image.

[0113] In this embodiment, when interfering with the interference sample image, in addition to using the first interference loss value, a second interference loss value is also used, which can increase the difference between the output results of the first model and the output results of the second model, and further enhance the adversarial capability of the adversarial sample image.

[0114] In some embodiments, the relevance threshold in step 204 is a first relevance threshold. The method further includes: obtaining at least one first prompt text for the original sample image; for each first prompt text, inputting the first prompt text and the adversarial sample image into a visual language model to obtain the result output by the visual language model for the first prompt text, thus obtaining a first output result corresponding to the first prompt text; obtaining the expected output result of the visual language model for each first prompt text, thus obtaining a second output result corresponding to each first prompt text; and evaluating the accuracy of the visual language model based on the first and second output results corresponding to each first prompt text.

[0115] The first prompt text refers to the prompt text whose relevance to the original sample image is greater than or equal to the second relevance threshold. Inputting it and the adversarial sample image into the visual language model yields the output of the visual language model for the prompt text, which is used to evaluate the accuracy of the visual language model.

[0116] The first relevance threshold refers to a boundary value used in this application to filter prompt texts that have a low relevance to the original sample image. When the relevance of the prompt text to the original sample image is less than this threshold, the prompt text can be used to generate adversarial sample images.

[0117] The second relevance threshold refers to a boundary value used in this application to filter prompt texts that are highly relevant to the original sample image. This threshold is greater than or equal to the first relevance threshold. When the relevance of the prompt text to the original sample image is greater than or equal to this threshold, the prompt text can be used for operations such as evaluating the accuracy of the visual language model.

[0118] The first output refers to the result output by the visual language model when the first prompt text and adversarial example image are input into the model. This output is compared with the expected output to evaluate the accuracy of the visual language model. The second output refers to the expected output of the visual language model for each specific prompt text. This second output is compared with the first output to evaluate the accuracy of the visual language model.

[0119] Each first prompt text has a correlation with the original sample image that is greater than or equal to a second correlation threshold, and the second correlation threshold is greater than or equal to a first correlation threshold. If the correlation with the original sample image is greater than or equal to the second correlation threshold, then the correlation with the adversarial sample image is greater than or equal to the second correlation threshold.

[0120] Figure 6 shows the principle of obtaining the first output result. The adversarial sample image is processed by a visual feature extraction network to obtain visual features. The first prompt text and visual features are processed by a fusion network to obtain fused features. The fused features are processed by a mapping layer to obtain mapped features. The mapped features are processed by a language model to obtain the first output result.

[0121] When the first output and the second output are inconsistent, it means that the adversarial sample image causes the visual language model to give a different output than the original sample image, indicating that the attack was successful. For example, in a visual question answering task, if the first prompt text is "How many frisbees are in this photo?", the first output is 0, and the second output is 1, thus indicating that the attack was successful.

[0122] Specifically, the server can determine the number of first prompt texts included in the at least one first prompt text, obtain a first quantity, count the number of first prompt texts that match the first output result and the second output result, obtain a second quantity, and calculate the ratio of the first quantity to the second quantity to obtain the accuracy of the visual language model. Of course, other metrics for evaluating model accuracy can also be used to determine the accuracy; there are no restrictions on the calculation method of accuracy here.

[0123] In this embodiment, compared with adversarial sample images generated by traditional techniques, the adversarial sample images generated by this application have stronger adversarial capabilities, thereby enabling better evaluation of the model's accuracy.

[0124] In some embodiments, the method further includes: determining the model loss value of the visual language model based on the first output result and the second output result corresponding to each first prompt text; and training the visual language model using the model loss value of the visual language model.

[0125] The second output is the label from the training process. The adversarial example images are the samples used to train the visual language model. Using adversarial example images to train the visual language model achieves adversarial training, improving the visual language model's noise resistance and accuracy.

[0126] The model loss value refers to the value determined based on the first and second output results corresponding to each first prompt text, or based on the third and fourth output results corresponding to each second prompt text. It is used to train the visual language model to improve its accuracy and robustness.

[0127] Specifically, for each first prompt text, the server can determine the difference between the first output result and the second output result corresponding to the first prompt text, thus obtaining the difference value corresponding to the first prompt text. Based on the difference value corresponding to each first prompt text, the model loss value is determined. The model loss value is positively correlated with the difference value. The difference value between the first output result and the second output result can be calculated using the cross-entropy function. The server can adjust the parameters of the visual language model in a direction that reduces the model loss value to train the visual language model.

[0128] In this embodiment, by training the visual language model using the model loss value, the visual language model can resist adversarial sample images and give the correct answer. Adversarial sample images can be understood as noise added to the original sample image. Through training, the visual language model can still give the correct answer in the presence of noise, thereby improving the accuracy and robustness of the visual language model.

[0129] In some embodiments, the visual language model is used for multiple visual language tasks, with different types of cue texts used in different visual language tasks. At least one cue text is the cue text used in a first visual language task, and the adversarial sample image has inter-task transferability. At least one first cue text is the cue text used in a second visual language task, and the first visual language task is different from the second visual language task.

[0130] The first visual language task refers to one of several tasks performed by the visual language model. In this application, at least one cue text is the cue text used in this task to generate adversarial example images. The second visual language task refers to one of several tasks performed by the visual language model. Unlike the first visual language task, at least one first cue text is the cue text used in this task to evaluate the inter-task transferability of adversarial example images.

[0131] In this context, inter-task transferability refers to the fact that using adversarial example images generated from prompt text in a first visual language task can increase the probability that the visual language model will output incorrect outputs for prompt text in a second visual language task. For example, if the first visual language task is a visual question-answering task and the second visual language task is a caption generation task, inputting prompt text such as "Please generate captions for the image" and adversarial example images into the visual language model can increase the probability that the visual language model will output incorrect captions.

[0132] In this embodiment, since adversarial sample images have stronger adversarial capabilities, they exhibit inter-task transferability. This allows for the evaluation of the accuracy of visual language models under different visual language tasks based on adversarial sample images, thereby improving evaluation efficiency.

[0133] In some embodiments, the relevance threshold in step 204 is a first relevance threshold, the adversarial example image has inter-model transferability, and the visual language model in step 206 is a first visual language model. The method further includes: acquiring at least one second prompt text for the original sample image, where the relevance of each second prompt text to the original sample image is greater than or equal to a second relevance threshold, and the second relevance threshold is greater than or equal to a first relevance threshold; for each second prompt text, inputting the second prompt text and the adversarial example image into a pre-trained second visual language model to obtain the output result of the second visual language model for the second prompt text, thus obtaining a third output result corresponding to the second prompt text; acquiring the expected output result of the second visual language model for each second prompt text, thus obtaining a fourth output result corresponding to each second prompt text; and determining the accuracy of the second visual language model based on the third and fourth output results corresponding to each second prompt text.

[0134] The first visual language model refers to the pre-trained visual language model used in this application to extract visual features and fusion features from the original sample image and the interfering sample image, as well as to generate adversarial sample images. The second visual language model refers to other pre-trained visual language models besides the first visual language model, used to evaluate the inter-model transferability of adversarial sample images. By inputting the second prompt text and the adversarial sample image into this model, the corresponding output results can be obtained to determine its accuracy.

[0135] The second prompt text refers to the prompt text whose relevance to the original sample image is greater than or equal to the second relevance threshold. By inputting the prompt text and the adversarial sample image into the pre-trained second visual language model, the output result of the second visual language model for the prompt text can be obtained, which is used to determine the accuracy of the second visual language model, etc.

[0136] The third output result refers to the result output by the second visual language model in response to the second prompt text and the adversarial sample image, which is then compared with the expected output result to determine the accuracy of the second visual language model.

[0137] The fourth output refers to the expected output of the second visual language model for each second prompt text, which is used to compare with the third output to determine the accuracy of the second visual language model.

[0138] Inter-model transferability means that, in addition to being adversarial against the first visual language model upon which the adversarial sample image is generated, the adversarial sample image can also be adversarial against at least one visual language model other than the first visual language model. Some or all of the at least one second prompt text can be identical to the first prompt text in the at least one first prompt text, or each second prompt text can be different from each first prompt text.

[0139] The second visual language model is a visual language model other than the first visual language model. For example, the first visual language model could be the InstructBLIP model, and the second visual language model could be LLaVA (Large Language and Vision Assistant), or the first visual language model could be the LLaVA model, and the second visual language model could be InstructBLIP. InstructBLIP is the third model in the BLIP series. The full English name of the BLIP model is Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generation, which is a multimodal visual-text large language model. LLaVA is a large multimodal model trained end-to-end.

[0140] Specifically, as shown in Figure 7, the principle of obtaining the third output result is illustrated. The adversarial loss value determined by the first visual language model is used to interfere with the interfering sample image, generating an adversarial sample image. After generating the adversarial sample image, the adversarial sample image and the second prompt text are output to the second visual language model to obtain the third output result. The process of determining the accuracy of the second visual language model can refer to the process of obtaining the accuracy of the first visual language model described above, and will not be repeated here.

[0141] In some embodiments, the at least one cue text is a cue text used in a first visual language task, and the at least one second cue text is a cue text used in a third visual language task, wherein the first visual language task and the third visual language task are different. The second visual language task may be the same as or different from the third visual language task. This allows for simultaneous implementation of inter-model transferability and inter-task transferability.

[0142] In this embodiment, since adversarial sample images have stronger adversarial capabilities, they exhibit inter-model transferability. Based on adversarial sample images, the accuracy of other visual language models besides the first visual language model can be evaluated, thereby improving evaluation efficiency and the accuracy of evaluation results.

[0143] In some embodiments, the method further includes: determining the model loss value of the second visual language model based on the third output result and the fourth output result corresponding to each second prompt text; and training the second visual language model using the model loss value of the second visual language model.

[0144] The process of determining the model loss value of the second visual language model can be referred to the process of obtaining the model loss value of the first visual language model, and will not be repeated here.

[0145] In this embodiment, the adversarial sample images have inter-model transferability. By training the second visual language model based on the adversarial sample images, adversarial training of the second visual language model can still be achieved without generating adversarial sample images separately for the second visual language model, even without using the second visual language model to generate corresponding adversarial sample images, thus improving the efficiency of adversarial training.

[0146] In some embodiments, as shown in FIG8, an adversarial example image generation method is provided. This method can be executed by a terminal or a server, or jointly by both. Taking the application of this method to a server as an example, it includes the following steps 802 to 822. Wherein:

[0147] Step 802: Obtain the original sample image and obtain the interference sample image obtained by randomly interfering with the original sample image.

[0148] Step 804: Obtain a set of prompt texts for the original sample image, wherein the correlation between the prompt texts and the original sample image is less than a correlation threshold.

[0149] Step 806: Sample the set of prompt texts to obtain at least one prompt text for the original sample image.

[0150] Step 808: Extract the first visual features of the original sample image through the visual feature extraction network in the pre-trained visual language model.

[0151] Step 810: For each prompt text, the prompt text and the first visual feature are fused through the fusion network in the visual language model to obtain the first fused feature corresponding to the prompt text.

[0152] Step 812: Extract the second visual features of the interference sample images using a visual language model.

[0153] Step 814: For each prompt text, the prompt text and the second visual feature are fused through the fusion network in the visual language model to obtain the second fused feature corresponding to the prompt text.

[0154] Step 816: Determine the interference loss value for the interference sample image based on the first fusion feature and the second fusion feature corresponding to each prompt text.

[0155] Step 818: Use the interference loss value to perturb the interference sample image in order to update the interference sample image.

[0156] Step 820: Determine whether the interference stop condition is met. If not, return to step 812. If yes, proceed to step 822.

[0157] Step 822: Identify the interfering sample images as adversarial sample images for the adversarial visual language model.

[0158] In this embodiment, compared to generating adversarial sample images using prompt text that is highly relevant to the original sample image, generating adversarial sample images based on prompt text with a relevance level less than a relevance threshold can improve the adversarial capability of the adversarial sample images.

[0159] The adversarial example image generation method provided in this application can be used in scenarios including but not limited to evaluating the robustness of visual language models on visual language tasks and training visual language models to improve their robustness on visual language tasks.

[0160] For example, taking a visual language task as a medical image analysis task, the original sample image can be a medical image obtained through medical imaging technology. Medical imaging technology includes, but is not limited to, X-ray, computed tomography, magnetic resonance imaging, ultrasound, and nuclear medicine imaging. Medical images can reflect the internal anatomical structure or functional state of the human body. The server acquires interfering sample images obtained by randomly perturbing the medical image, and uses the adversarial sample image generation method provided in this application to generate adversarial sample images based on the perturbing of the interfering sample images. The visual language model used to generate the adversarial sample images can be any visual language model. Then, the server can acquire multiple relevant prompt texts related to the medical image. These relevant prompt texts can be prompt texts with a relevance greater than a relevance threshold to the medical image. Examples of relevant prompt texts include "Please analyze this X-ray to determine if there are signs of pneumonia" or "Describe the size, shape, and boundary clarity of the lesion in this magnetic resonance image." The server can use the adversarial sample images and relevant prompt texts to evaluate the accuracy and robustness of the visual language model, and can also use the adversarial sample images and relevant prompt texts to train the visual language model.

[0161] For example, taking visual language tasks as product defect detection tasks, the original sample image can be a product image obtained through image acquisition. The server acquires interfering sample images obtained by randomly perturbing the product image, and uses the adversarial sample image generation method provided in this application to generate adversarial sample images based on the perturbed sample images. Then, the server can acquire multiple relevant prompt texts related to the product image, such as "Please check if there are scratches in the image" or "Check if the solder joints on the circuit board are complete, and whether there are any cold solder joints or missing solder joints." The server can use the adversarial sample images and relevant prompt texts to evaluate the accuracy and robustness of the visual language model, and can also use the adversarial sample images and relevant prompt texts to train the visual language model. The principles of evaluating accuracy and training the visual language model have been discussed above and will not be repeated here.

[0162] To verify the adversarial capability of the adversarial example images generated using this application, experiments were conducted using the VQA v2 dataset. First, M images were selected from the VQA v2 dataset. For each of these M images, N known target questions were selected. These N known target questions are image-related questions, and the answers to the target questions can be definite. Image-text pairs were formed by combining the image with each corresponding target question, resulting in M×N image-text pairs. For example, for image 1 among the M images, if N is 2, then image 1 corresponds to two target questions, such as question 1 and question 2. Therefore, image 1 and question 1 were paired, and image 1 and question 2 were also paired. The M×N image-text pairs generated from the VQA v2 dataset constituted the VQA v2 M+N dataset. VQA v2 refers to the second version of VQA (Visual Question Answering). The VQA v2 dataset is an important dataset for visual question answering tasks. Each image in the VQA v2 M+N dataset is the original sample image.

[0163] Secondly, for each image in the VQA v2 M+N dataset, multiple sets of irrelevant questions are randomly collected for that image. Each set of irrelevant questions includes at least one irrelevant question. Irrelevant questions are those whose relevance to the image is less than a relevance threshold. For example, there are six sets of irrelevant questions, with each set containing 1, 5, 10, 15, 10, and 25 irrelevant questions, respectively. RSQ is then used. nThis represents the method for obtaining each set of irrelevant questions, where n represents the number of irrelevant questions included in a set. RSQ is an abbreviation for Random Sample Questions, meaning that a set of irrelevant questions is obtained by randomly sampling. For example, RSQ1 represents randomly sampling 1 irrelevant question to obtain the first set of irrelevant questions; RSQ5 represents randomly sampling 5 irrelevant questions to obtain the second set of irrelevant questions; RSQ... 10 This represents a third set of irrelevant questions obtained by randomly sampling 10 irrelevant questions; RSQ 15 This represents a fourth set of irrelevant questions obtained by randomly sampling 15 irrelevant questions; RSQ 20 This represents a fifth set of irrelevant questions obtained by randomly sampling 20 irrelevant questions; RSQ 25 This represents a random sampling of 25 irrelevant questions, resulting in the sixth group of irrelevant questions.

[0164] Furthermore, the adversarial example images generated in this application can be based on the adversarial attack methods PGD (Projected Gradient Descent) or CW (Carlini & Wagner). PGD is an iterative attack method that generates adversarial examples through projected gradient descent. CW is an optimization-based adversarial attack method. A visual language model is determined for generating the adversarial example images. Each image in the VQA v2 M+N dataset is used as an original sample image, and each set of irrelevant questions for each image is used as at least one cue text for the original sample image. Based on the PGD algorithm, the adversarial example image generation method provided in this application is used to generate adversarial example images corresponding one-to-one with each set of irrelevant questions. (The last sentence is a repetition of the previous one and can be omitted.)

[0165] To better demonstrate the adversarial capabilities of the adversarial example images, each image in the VQA v2 M+N dataset is used as an original sample image, and the N questions corresponding to each image are used as at least one prompt text for the original sample image. Based on the PGD algorithm, the adversarial example image generation method provided in this application is used to generate adversarial example images corresponding to the N target questions. Furthermore, using the CW algorithm and the adversarial example image generation method provided in this application, adversarial example images corresponding to the N target questions are generated. Using the N target questions corresponding to each image as at least one prompt text for the original sample image can be referred to as WTQ. N WTQ is an abbreviation for White-box targeting questions.

[0166] Then, experiments were conducted using the generated adversarial sample images, where M=32 and N=50 in VQA v2 M+N.

[0167] Experiment 1: The visual language model used to generate adversarial example images was InstructBLIP (Vicuna-7B). InstructBLIP Vicuna-7B refers to a Large Language Model (LLM) configuration used in the InstructBLIP model, where the LLM part uses Vicuna-7B as the base model. InstructBLIP is the third model in the BLIP (Multimodal Visual Language Pre-trained Model) series, aiming to build more general and powerful visual language models through instruction fine-tuning techniques. Vicuna is a large natural language processing model. Vicuna-7B refers to a specific configuration of Vicuna, where "7B" indicates that the model has approximately 7 billion parameters. In the experiment, the adversarial ability of adversarial example images against InstructBLIP (Vicuna-7B) was tested, and the test results are shown in Table 1.

[0168] Table 1

[0169] In Table 1, "All" represents the M images and the N target questions corresponding to them, i.e., M×N target questions. These M×N target questions are divided into three categories: "Yes / No," "Quantity," and "Other." In the experiment, adversarial sample images generated using different methods were used for each of these M images. For example, for each of the M images, for each of the N target questions corresponding to that image, an adversarial sample image corresponding to the first set of irrelevant questions generated using the "PGD" and "RSQ1" methods is input into InstructBLIP(Vicuna-7B). That is, one adversarial sample image and one target question are input at a time. Then, the answer output by InstructBLIP(Vicuna-7B) for the target question is obtained. Based on the answers to the M×N target questions, the accuracy of InstructBLIP(Vicuna-7B) is determined. The lower the accuracy, the stronger the adversarial capability of the adversarial sample image. As can be seen from Table 1, the accuracies of the three types of questions, "Other," "Quantity," and "Yes / No," are 45.20, 60.13, and 85.68, respectively. The total accuracy of the M×N target questions is 62.81. (±1.34) As can be seen from Table 1, the accuracy decreases as n increases, thus indicating that the adversarial capability of the adversarial sample images is enhanced.

[0170] Experiment 2: Experiment 2 was conducted identically to Experiment 1, except that the adversarial sample images used in Experiment 2 were generated using the first adversarial loss value, while those used in Experiment 1 were generated using the second adversarial loss value. The first adversarial loss value is expressed as... The second adversarial loss value is expressed as: Table 2 presents the comparison results between Experiment 1 and Experiment 2. Since the M×N objective problem is used to test accuracy, [the following method is used]. and WTQ 50 The adversarial sample images generated by this method exhibit high adversarialness to the target problem, resulting in low accuracy. Table 2 shows that for adversarial sample images generated using the first adversarial loss value, the results obtained when n=5 are close to those obtained using the first adversarial loss value. and WTQ 50 The results obtained from experiments on the adversarial sample images generated by the method show that the adversarial sample image generation method provided in this application can achieve a good adversarial effect. Therefore, the adversarial sample image generation method provided in this application can generate adversarial sample images with strong adversarial ability without the need to specifically generate image-related target problems, and the generation efficiency of adversarial sample images is high.

[0171] Table 2

[0172] Experiment 3: The inter-model transferability of adversarial sample images generated using the adversarial sample image method provided in this application was tested. The test results are shown in Table 3. In Table 3, the model in the first column refers to the visual language model used when generating the adversarial sample image, i.e., the first visual language model. The model in the first row of Table 3 is the visual language model used to test the inter-model transferability, i.e., the second visual language model. The second row is the accuracy obtained by testing the accuracy of each model in the first row using the original sample image. In Table 3, when the visual language model in the row and column of the data is the same visual language model, the data represents the accuracy obtained by testing the visual language model used to generate the adversarial sample image against the visual language model used to generate the adversarial sample image. The smaller the data in Table 3, the smaller the accuracy; the higher the adversarial ability, the smaller the accuracy. As can be seen from Table 3, the adversarial sample images generated by the first visual language model have high adversarial ability against multiple second visual language models, thus proving that the adversarial sample images have inter-model transferability.

[0173] Table 3

[0174] In Table 3, the visual encoders in both BLIP-2 and InstructBLIP are CLIP. opt-2.7B and FlanT5 XL opt-6.7B, FlanT5 XXL Vicuna-7B and Vicuna-13B represent specific configurations of the visual language model. BLIP-2FlanT5 XL The language model represented in BLIP-2 is FlanT5. XL BLIP-2FlanT5 XX The language model represented in BLIP-2 is FlanT5. XXL FlanT5 XL Model and FlanT5 XXL The model is a large-scale language model based on the T5 (Text-to-Text Transfer Transformer) architecture. InstructBLIP FlanT5 XL and InstructBLIP FlanT5 XXLSimilarly, no further explanation is needed. BLIP-2opt-2.7B means that the language model in BLIP-2 is opt-2.7B. opt stands for Open Pre-trained Transformer Language Models, meaning open-source pre-trained language models. 2.7B refers to the model's parameter size of 2.7 billion (2.7 billion). The explanation of BLIP-2opt-6.7B is similar and will not be repeated. For InstructBLIP Vicuna-7B and InstructBLIP Vicuna-13B, please refer to the explanation of InstructBLIP (Vicuna-7B), which will not be repeated here.

[0175] Experiment 4: The accuracy of each of the eight visual language models in Table 4 (i.e., the data in column 2 of Table 4) was tested when the image was undisturbed. The accuracy of models based on... and RSQ 25 The adversarial example images obtained by the method were used to test the accuracy of the eight visual language models in Table 4, as shown in column 3 of Table 4. The accuracy of these models was also tested using a method based on... and RSQ 10 The adversarial sample images obtained by the method were used to test the accuracy of the eight visual language models in Table 4, which is the data in column 4 of Table 4. It can be seen that the data in column 4 is relatively low overall, thus indicating that the data based on... The adversarial sample images obtained by this method have stronger adversarial capabilities.

[0176] Table 4

[0177] Experiment 5: The test will use adversarial sample images generated by each visual language model in column 1 of Table 5, applied to the LLaVA model, to measure the LLaVA visual question-answering score. The visual question-answering score represents accuracy; a lower score indicates lower accuracy. Table 5 shows that when LLaVA performs visual question answering using the original, unperturbed sample images, the score is 78.32. However, when LLaVA performs visual question answering using the adversarial sample images generated by the visual language models in column 1, the score is less than 78.32. This indicates that the adversarial sample images lower the visual question-answering score, demonstrating the adversarial capability of the adversarial sample images against LLaVA and verifying the inter-model transferability of the adversarial sample images.

[0178] Table 5

[0179] Experiment 6: To verify the inter-task transferability of adversarial example images, adversarial example images generated from questions in a visual question-answering task were used in an image captioning task. In the experiment, the adversarial example images and the prompt text from the image captioning task were input into a visual language model. The output of the visual language model was obtained, and the accuracy of the visual language model in the scenario of generating captions for adversarial example images was determined based on the output results. The accuracy is shown in Table 6. The bolded parts in Table 6 represent the values ​​of the InstructBLIP model on various evaluation metrics when performing the image captioning task on undisturbed images (i.e., the original sample images). The italicized parts in Table 6 represent the values ​​for InstructBLIP-based FlanT5 models. XL PGD and RSQ 10 When performing image captioning tasks on the generated adversarial example images, the values ​​of the InstructBLIP model on various evaluation metrics are explained similarly for the other rows of data, and will not be explained individually again. CIDEr, BLEU-1, BLEU-2, BLEU-3, BLEU-4, ROUGE-L, METEOR, and SPICE represent different evaluation metrics. CIDEr (Consensus-based Image Description Evaluation) is an evaluation metric for evaluating image captioning tasks. BLEU (Bilingual Evaluation Understudy) is a machine translation evaluation metric, and BLEU-1 measures word-level accuracy. BLEU-2, BLEU-3, and BLEU-4 measure the accuracy of higher-order n-grams (i.e., segments consisting of two, three, and four consecutive words, respectively). ROUGE (Recall-Oriented Understudy for Gisting Evaluation) is a similarity metric based on recall. ROUGE-L uses the longest common subsequence (LCS) to calculate the similarity between the candidate summary and the reference summary. METEOR is a machine translation evaluation metric based on word alignment. SPICE (Semantic Propositional Image Caption Evaluation) is an image captioning evaluation metric based on semantic propositions. As shown in Table 6, although the adversarial example images are generated using questions, they still exhibit adversarial characteristics in the image captioning task, thus demonstrating the inter-task transferability of adversarial example images.

[0180] Table 6

[0181] Experiment 7: The model used to generate adversarial example images in Experiment 6 is the same model as the model used to apply them. To investigate the task transferability of adversarial example images across different models, Experiment 7 applies adversarial example images generated using the first visual language model to the second visual language model, determining the accuracy of the second visual language model when performing image captioning tasks on adversarial example images generated using the question. Table 7 shows that adversarial example images generated using the model in column 2 exhibit adversarial effects against the model in column 1 in the image captioning task, further demonstrating the task transferability of adversarial example images.

[0182] Table 7

[0183] Experiment 8: In generating the adversarial example images used in Experiment 2, at least one irrelevant question was randomly selected to generate the adversarial example images; no classification or clustering method was used to select at least one irrelevant question. In Experiment 8, RSQ t 10 This approach involves dividing the original sample image into multiple irrelevant questions based on different themes, resulting in a set of irrelevant questions that corresponds one-to-one with each theme. Then, 10 irrelevant questions are randomly selected from each set, either uniformly or non-uniformly. Uniform selection means that the number of irrelevant questions selected from each set is the same or substantially the same. RSQ c 10 The method involves using a classification model to divide multiple irrelevant questions unrelated to the original sample image, resulting in a set of irrelevant questions corresponding one-to-one with multiple preset types. Then, 10 irrelevant questions are randomly selected from this set, either uniformly or non-uniformly. Table 8 shows that selecting at least one irrelevant question using classification to generate adversarial sample images can further improve the overall adversarial capability of the adversarial sample images. Experiment 8 also uses VQG... 10 The method generates adversarial example images from the generated questions and tests the accuracy of the visual language model when performing a visual question answering task on the generated adversarial example images. VQG is an abbreviation for Visual Question Generation. 10 VQG10 represents generating 10 questions from the original sample image and then using these 10 questions to generate adversarial example images. Visual question generation refers to a method that automatically generates questions from the original sample image. VQG10 means generating 10 questions from the original sample image and then using these generated questions to generate adversarial example images, which can be used to test the performance of visual language models in visual question answering tasks.

[0184] Table 8

[0185] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0186] Based on the same inventive concept, this application also provides an adversarial sample image generation apparatus for implementing the adversarial sample image generation method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more adversarial sample image generation apparatus embodiments provided below can be found in the limitations of the adversarial sample image generation method described above, and will not be repeated here.

[0187] In some embodiments, as shown in FIG9, an adversarial example image generation apparatus is provided, including: an image acquisition module 902, a text acquisition module 904, a first feature extraction module 906, a second feature extraction module 908, a loss value determination module 910, and an adversarial example image generation module 912, wherein:

[0188] The image acquisition module 902 is used to acquire the original sample image and to acquire the interference sample image obtained by randomly interfering with the original sample image.

[0189] The text acquisition module 904 is used to acquire at least one prompt text for the original sample image, wherein the correlation between each prompt text and the original sample image is less than a correlation threshold.

[0190] The first feature extraction module 906 is used to extract the first visual features of the original sample image through a pre-trained visual language model; and for each prompt text, to obtain the first fused feature corresponding to the prompt text by fusing the prompt text and the first visual features.

[0191] The second feature extraction module 908 is used to extract the second visual features of the interference sample image through a visual language model; for each prompt text, the second fused feature corresponding to the prompt text is obtained by fusing the prompt text and the second visual features.

[0192] The loss value determination module 910 is used to determine the interference loss value for the interference sample image based on the first fusion feature and the second fusion feature corresponding to each prompt text.

[0193] The adversarial sample image generation module 912 is used to perturb the perturbation sample image using the perturbation loss value, obtain an updated perturbation sample image, and generate adversarial sample images for the adversarial visual language model using the updated perturbation sample image.

[0194] In some embodiments, the text acquisition module 904 is further configured to acquire a set of prompt texts for the original sample image, wherein the correlation between the prompt texts in the set and the original sample image is less than a correlation threshold; and to sample the set of prompt texts to obtain at least one prompt text for the original sample image.

[0195] In some embodiments, the text acquisition module 904 is further configured to determine the type of the prompt text in the prompt text set; divide the prompt text set into multiple subsets corresponding to the types, each subset including at least one prompt text in the prompt text set; and sample at least one subset to obtain at least one prompt text for the original sample image.

[0196] In some embodiments, the loss value determination module 910 is further configured to determine, for each prompt text, the difference value between the first fusion feature corresponding to the prompt text and the second fusion feature corresponding to the prompt text; and to obtain the interference loss value for the interference sample image by combining the difference values ​​determined for each prompt text; and the adversarial sample image generation module 912 is further configured to interfere with the interference sample image in a direction that increases the interference loss value, and to obtain an updated interference sample image.

[0197] In some embodiments, the adversarial sample image generation module 912 is further configured to, if the preset interference stopping condition is not met, return to the step of extracting the second visual features of the interference sample image through the visual language model for the updated interference sample image; and if the interference stopping condition is met, determine the updated interference sample image as an adversarial sample image of the adversarial visual language model.

[0198] In some embodiments, the first feature extraction module 906 is further configured to extract semantic features from the prompt text; and to extract visual features related to the prompt text by fusing the semantic features and the first visual features to obtain the first fused features corresponding to the prompt text.

[0199] In some embodiments, the interference loss value is a first interference loss value. The loss value determination module 910 is further configured to, for each prompt text, obtain a first model output result of the visual language model outputting the prompt text based on the prompt text and the first fusion feature corresponding to the prompt text, and obtain a second model output result of the visual language model outputting the prompt text based on the prompt text and the second fusion feature corresponding to the prompt text; determine a second interference loss value for the interference sample image based on the first model output result and the second model output result corresponding to each prompt text; the adversarial sample image generation module 912 is further configured to, using the first interference loss value and the second interference loss value, interfere with the interference sample image to obtain an updated interference sample image.

[0200] In some embodiments, the relevance threshold is a first relevance threshold, and the adversarial example image generation apparatus further includes an adversarial example image application module, configured to acquire at least one first prompt text for the original sample image, wherein the relevance of each first prompt text to the original sample image is greater than or equal to a second relevance threshold, and the second relevance threshold is greater than or equal to the first relevance threshold; for each first prompt text, inputting the first prompt text and the adversarial example image into a visual language model to obtain the result output by the visual language model for the first prompt text, and obtaining a first output result corresponding to the first prompt text; acquiring the expected output result of the visual language model for each first prompt text, and obtaining a second output result corresponding to each first prompt text; and evaluating the accuracy of the visual language model based on the first output result and the second output result corresponding to each first prompt text.

[0201] In some embodiments, the adversarial example image application module is further configured to determine the model loss value of the visual language model based on the first output result and the second output result corresponding to each first prompt text; and to train the visual language model using the model loss value of the visual language model.

[0202] In some embodiments, the visual language model is used for multiple visual language tasks, with different types of cue texts used in different visual language tasks. At least one cue text is the cue text used in a first visual language task, and the adversarial sample image has inter-task transferability. At least one first cue text is the cue text used in a second visual language task, and the first visual language task is different from the second visual language task.

[0203] In some embodiments, the relevance threshold is a first relevance threshold, the adversarial sample images have inter-model transferability, the visual language model is a first visual language model, and the adversarial sample image application module is further configured to obtain at least one second prompt text for the original sample image, wherein the relevance of each second prompt text to the original sample image is greater than or equal to a second relevance threshold, and the second relevance threshold is greater than or equal to a first relevance threshold; for each second prompt text, the second prompt text and the adversarial sample image are input into a pre-trained second visual language model to obtain the output result of the second visual language model for the second prompt text, thereby obtaining a third output result corresponding to the second prompt text; the expected output result of the second visual language model for each second prompt text is obtained to obtain a fourth output result corresponding to each second prompt text; and the accuracy of the second visual language model is determined based on the third and fourth output results corresponding to each second prompt text.

[0204] In some embodiments, the adversarial example image application module is further configured to determine the model loss value of the second visual language model based on the third and fourth output results corresponding to each second prompt text; and to train the second visual language model using the model loss value of the second visual language model.

[0205] Each module in the aforementioned adversarial example image generation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0206] In some embodiments, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in Figure 10. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores data involved in the adversarial example image generation method. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements an adversarial example image generation method.

[0207] In some embodiments, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in Figure 11. The computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used for exchanging information between the processor and external devices. The communication interface of the computer device is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements an adversarial sample image generation method. The display unit of the computer device is used to form a visually visible image and may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0208] Those skilled in the art will understand that the structures shown in Figures 10 and 11 are merely block diagrams of some structures related to the present application and do not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements.

[0209] In some embodiments, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the adversarial sample image generation method described above.

[0210] In some embodiments, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the adversarial sample image generation method described above.

[0211] In some embodiments, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the adversarial sample image generation method described above.

[0212] In summary, this application provides a method, apparatus, computer device, computer-readable storage medium, and computer program product for generating adversarial sample images. The computer device first acquires the original sample image and randomly perturbs it to obtain a perturbed sample image. Random perturbation introduces random changes or noise into the pixel values, colors, etc., of the original sample image, such as adding Gaussian noise or salt-and-pepper noise. This random perturbation provides the basis for subsequent generation of adversarial sample images, making the perturbed sample image different from the original sample image, thus creating conditions for subsequent adversarial attacks. Next, the computer device acquires at least one prompt text for the original sample image, and each prompt text has a correlation degree with the original sample image that is less than a correlation threshold. The prompt text is used as input to a pre-trained visual language model to guide the model in performing a visual language task. By using prompt text with a correlation degree less than the threshold, the limitation of generating adversarial sample images only for specific related problems is avoided, making the generated adversarial sample images more broadly adversarial.

[0213] Then, the computer device extracts the first visual features of the original sample images using a pre-trained visual language model. The visual feature extraction network in the visual language model, such as the CLIP model, encodes the image into visual features, which include information such as color, texture, and contour. For each prompt text, the computer device fuses the prompt text and the first visual features to obtain a first fused feature. The fusion process can employ methods such as concatenation or weighted summation to combine the semantic features of the prompt text with the first visual features, ensuring that the generated first fused feature contains both image and text information, providing a richer feature representation for subsequent loss calculations.

[0214] Similarly, the computer device extracts the second visual features of the interfering sample image through a visual language model, and fuses the prompt text and the second visual features to obtain a second fused feature. Based on the first and second fused features corresponding to each prompt text, the computer device determines the interference loss value for the interfering sample image. The interference loss value reflects the degree of difference between the first and second fused features; the greater the difference, the greater the interference loss value. The interfering sample image is then perturbed using the interference loss value to obtain an updated interfering sample image, which is then used to generate adversarial sample images against the visual language model. Since the correlation between each prompt text and the original sample image is less than a correlation threshold, generating adversarial sample images based on prompt texts with a correlation less than the correlation threshold yields more adversarial sample images compared to generating adversarial sample images using prompt texts with a high correlation to the original sample image. In visual question answering tasks, such adversarial sample images can cause the visual language model to give incorrect answers to more different types of questions, improving the adversarial capability of the adversarial sample images, enhancing the attack effect on the visual language model, and improving resource utilization, because adversarial sample images with broad adversarial capabilities can be generated with fewer sample images.

[0215] Furthermore, the computer device acquires a set of prompt texts for the original sample image, where the correlation between the prompt texts and the original sample image is less than a correlation threshold. This set of prompt texts is then sampled to obtain at least one prompt text for the original sample image. This sampling method enhances the randomness of the prompt texts. When generating adversarial example images, different combinations of prompt texts can give the adversarial example images different characteristics, thus making them not only offensive against specific questions related to the original sample image. In visual question answering tasks, adversarial example images can cause visual language models to give incorrect answers to more questions related to the original sample image, improving the performance, i.e., the attack power, of the adversarial example images. This randomness also improves the generalization ability of adversarial example images, enabling them to function in different visual language tasks and improving processing efficiency, because adversarial example images with broad adversarial power can be generated with fewer prompt texts.

[0216] Furthermore, the computer device determines the type of the prompt text in the prompt text set. Based on the type, the prompt text set is divided into multiple subsets corresponding to each type. Each subset includes at least one prompt text from the prompt text set. Sampling at least one subset yields at least one prompt text for the original sample image. Sampling prompt text from at least one subset of multiple subsets corresponding to different types ensures that the at least one prompt text contains either prompt text of the same type or prompt text of different types, enhancing the flexibility of prompt text types. When different types of prompt text are included, adversarial sample images are generated by interfering with the interfering sample image based on these different types of prompt text. This makes the adversarial sample images more offensive against a wider range of prompt text types. In visual question answering tasks, different types of questions may involve different aspects of the image, such as color, quantity, and position. Adversarial sample images can cause the visual language model to give incorrect answers to these different types of questions, further increasing the performance, i.e., the attack power, of the adversarial sample images. This improves the targeting and effectiveness of the adversarial sample images and enhances the attack effect on the visual language model.

[0217] Furthermore, for each prompt text, the computer device determines the difference value between the first fusion feature and the second fusion feature corresponding to that prompt text. By combining the difference values ​​determined for each prompt text, an interference loss value is obtained for the interference sample image. Combining the difference values ​​of each prompt text to obtain the interference loss value makes the interference loss value more comprehensively reflect the difference between the first and second fusion features. When the interference sample image is subjected to interference in a direction that increases the interference loss value, the difference value can be changed in the direction of increase, thus increasing the difference between the first and second fusion features. After inputting the generated adversarial sample image and the prompt text related to the original sample image into the visual language model, due to the increased difference between the first and second fusion features, the visual language model is more prone to errors when processing these features, thus making it easier for the visual language model to output incorrect text, improving the performance of the interference sample image. This method improves the generation quality of the adversarial sample image, enabling the adversarial sample image to more effectively interfere with the output of the visual language model and enhancing the attack effect on the visual language model.

[0218] Furthermore, the computer equipment perturbs the adversarial sample image in a direction that increases the perturbation loss value, obtaining an updated perversarial sample image. Perturbation in a direction that increases the perturbation loss value continuously widens the difference between the first and second fusion features. In visual language models, fusion features are crucial for generating output results; increased differences make it easier for the visual language model to make incorrect judgments when processing these features, thus outputting incorrect results. This perturbation method continuously enhances the adversarial capability of adversarial sample images. In visual question answering tasks, it enables the visual language model to give incorrect answers to more questions, improving the attack efficiency of adversarial sample images, enhancing the attack effect on the visual language model, and also improving resource utilization, as adversarial sample images with strong adversarial capabilities can be generated with fewer perturbation attempts.

[0219] Furthermore, if the preset interference stopping condition is not met, the computer device returns to the step of extracting the second visual features of the interference sample image through the visual language model for the updated interference sample image. If the interference stopping condition is met, the updated interference sample image is identified as an adversarial sample image against the visual language model. Iterative interference allows for multiple perturbations of the interference sample image. Each perturbation changes the features of the interference sample image, thereby continuously increasing the difference between the first and second fused features. Through multiple iterations, the adversarial capability of the adversarial sample image can be further improved. In visual question answering tasks, adversarial sample images generated through multiple iterations can cause the visual language model to give incorrect answers to more questions, further improving the performance of the interference sample image. This iterative approach also improves the stability of the adversarial sample image, enabling it to maintain strong adversarial capability in different visual language tasks and enhancing the attack effect on the visual language model.

[0220] Furthermore, the computer device extracts semantic features from the prompt text. By fusing the semantic features with the first visual features, it extracts visual features related to the prompt text, obtaining the first fused feature corresponding to the prompt text. Since the first fused feature is a visual feature related to the prompt text, when perturbing the perturbation sample image according to the perturbation loss value, the difference between the visual features related to the prompt text obtained based on the original sample image and the visual features related to the prompt text obtained based on the perturbation sample image can be increased. Visual features have a significant impact on the output of the visual language model; increasing the difference can improve the difference in the output results. In visual question answering tasks, this difference can cause the visual language model to give different answers to the same prompt text, thereby making the obtained adversarial sample image adversarial. This fusion method can also improve the visual language model's ability to understand images and text, enabling it to better handle visual language tasks and enhancing the attack effect on the visual language model.

[0221] Furthermore, the interference loss value is the first interference loss value. For each prompt text, the computer device obtains the first model output result of the visual language model based on the prompt text and its corresponding first fusion feature, and obtains the second model output result of the visual language model based on the prompt text and its corresponding second fusion feature. Based on the first and second model output results corresponding to each prompt text, a second interference loss value is determined for the interference sample image. The first and second interference loss values ​​are used to interfere with the interference sample image, resulting in an updated interference sample image. In interfering with the interference sample image, in addition to using the first interference loss value, the second interference loss value is also used, which can increase the difference between the first and second model output results. The first and second model output results are the outputs obtained by the visual language model based on the original sample image and the interference sample image, respectively. The increased difference means that the visual language model has produced a larger bias when processing these two types of images. In visual question answering tasks, this bias can cause the visual language model to give different answers to the same prompt text, further enhancing the adversarial capability of adversarial sample images. This approach also increases the diversity of adversarial sample images, enabling them to function in different visual language tasks and enhancing the attack effectiveness against visual language models.

[0222] Furthermore, the relevance threshold is a first relevance threshold. The computer device acquires at least one first prompt text for the original sample image. For each first prompt text, the first prompt text and the adversarial sample image are input into the visual language model to obtain the output of the visual language model for the first prompt text. A first output result corresponding to the first prompt text is obtained. The expected output result of the visual language model for each first prompt text is obtained, resulting in a second output result corresponding to each first prompt text. Based on the first and second output results corresponding to each first prompt text, the accuracy of the visual language model is evaluated. Compared to adversarial sample images generated by traditional techniques, the adversarial sample images generated in this application have stronger adversarial capabilities. When evaluating the accuracy of the visual language model, these adversarial sample images can make the visual language model more likely to give incorrect answers, thus more accurately reflecting the performance of the visual language model. Through this evaluation method, problems existing in the visual language model when facing adversarial sample images can be discovered, providing a basis for further improvement of the visual language model, improving the accuracy and effectiveness of the evaluation, and enhancing the evaluation effect of the visual language model.

[0223] Furthermore, the computer device determines the model loss value of the visual language model based on the first and second output results corresponding to each first prompt text, and trains the visual language model using this model loss value. Training the visual language model using the model loss value enables it to provide correct answers even in the presence of adversarial examples. Adversarial examples can be understood as noise added to the original sample image; through training, the visual language model can still provide correct answers even in the presence of noise. During training, the visual language model continuously adjusts its parameters to reduce the model loss value, thereby improving its noise resistance and accuracy. This training method enhances the robustness of the visual language model, enabling it to work stably in different environments and strengthening the training effect.

[0224] Furthermore, the visual language model is used for multiple visual language tasks, employing different types of cue text in each task. At least one cue text is used in the first visual language task, and the adversarial example image exhibits task transferability. At least one of the first cue texts is used in the second visual language task, which differs from the second task. Due to the stronger adversarial capabilities of the adversarial example image, it possesses task transferability. In different visual language tasks, the adversarial example image can cause the visual language model to give incorrect answers to different types of cue text. In visual question answering and text generation tasks, the adversarial example image can cause the visual language model to produce incorrect outputs in both tasks. This task transferability allows for the evaluation of the accuracy of the visual language model across different visual language tasks using the adversarial example image, improving evaluation efficiency because multiple visual language tasks can be evaluated using a single adversarial example image. This reduces the number of samples and time required for evaluation, enhancing the evaluation effect of the visual language model.

[0225] Furthermore, the relevance threshold is a first relevance threshold, the adversarial example image exhibits inter-model transferability, the visual language model is a first visual language model, the computer device acquires at least one second prompt text for the original sample image, for each second prompt text, the second prompt text and the adversarial example image are input into a pre-trained second visual language model, the output result of the second visual language model for the second prompt text is obtained, the third output result corresponding to the second prompt text is obtained, the expected output result of the second visual language model for each second prompt text is obtained, the fourth output result corresponding to each second prompt text is obtained, based on the third and fourth output results corresponding to each second prompt text, the accuracy of the second visual language model is determined. Because the adversarial example image has stronger adversarial capabilities, it exhibits inter-model transferability. The accuracy of other visual language models besides the first visual language model can be evaluated based on the adversarial example image. When evaluating multiple visual language models, multiple models can be evaluated using a single adversarial example image, reducing the number of samples and time required for evaluation, improving evaluation efficiency and the accuracy of evaluation results. This inter-model transferability can also reveal common problems among different visual language models when faced with adversarial sample images, providing a reference for improving these models and enhancing the evaluation effect of visual language models.

[0226] Furthermore, the computer device determines the model loss value of the second visual language model based on the third and fourth output results corresponding to each second prompt text, and trains the second visual language model using this model loss value. Leveraging the inter-model transferability of adversarial example images, training the second visual language model based on these images allows for adversarial training of the second visual language model without the need to generate separate adversarial example images for the second visual language model, even without generating corresponding adversarial example images for it. During training, the second visual language model adjusts its parameters based on the model loss value to improve its noise resistance and accuracy. This training method improves the efficiency of adversarial training, reduces the number of samples and training time required, and enhances the training effect of the second visual language model.

[0227] The specification also mentions using different adversarial attack methods (such as PGD and CW) and problem sampling strategies (such as RSQ, WTQ, RSQt, RSQc, and VQG) to generate adversarial sample images, and conducts multiple experiments to verify the adversarial capabilities of these images. These experimental results show that the adversarial sample images generated using the method provided in this application have stronger adversarial capabilities. In the experiments, by comparing the attack effects of adversarial sample images generated by different methods on visual language models, it can be found that adversarial sample images generated based on prompt text with a relevance level less than a threshold and those generated by selecting prompt text through classification or clustering methods can reduce the accuracy of visual language models, i.e., they have stronger adversarial capabilities. These methods can improve the generation efficiency and quality of adversarial sample images, reduce the time and resources required to generate adversarial sample images, and improve resource utilization. Simultaneously, these experiments also verify the inter-model and inter-task transferability of adversarial sample images, further demonstrating the effectiveness and practicality of the method in this application, and enhancing the attack and evaluation effects on visual language models.

[0228] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0229] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0230] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0231] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for generating adversarial sample images, executed by a computer device, the method comprising: obtaining an original sample image and an interference sample image obtained by randomly interfering the original sample image; obtaining at least one prompt text for the original sample image, each prompt text having a correlation degree with the original sample image less than a correlation degree threshold; extracting, by a pre-trained visual language model, a first visual feature of the original sample image; for each prompt text, fusing the prompt text and the first visual feature to obtain a first fusion feature corresponding to the prompt text; extracting, by the visual language model, a second visual feature of the interference sample image; for each prompt text, fusing the prompt text and the second visual feature to obtain a second fusion feature corresponding to the prompt text; determining, according to the first fusion feature and the second fusion feature corresponding to each prompt text, an interference loss value for the interference sample image; and interfering the interference sample image using the interference loss value to obtain an updated interference sample image, and generating an adversarial sample image for the visual language model using the updated interference sample image.

2. The method of claim 1, wherein the obtaining at least one prompt text for the original sample image comprises: obtaining a set of prompt texts for the original sample image, each prompt text in the set having a correlation degree with the original sample image less than a correlation degree threshold; sampling the set of prompt texts to obtain at least one prompt text for the original sample image.

3. The method of claim 2, wherein the sampling the set of prompt texts to obtain at least one prompt text for the original sample image comprises: determining a type of prompt text in the set of prompt texts; dividing the set of prompt texts into a plurality of sub-sets according to the type, each sub-set including at least one prompt text in the set of prompt texts; sampling at least one of the sub-sets to obtain at least one prompt text for the original sample image.

4. The method of any one of claims 1 to 3, wherein the determining, according to the first fusion feature and the second fusion feature corresponding to each prompt text, an interference loss value for the interference sample image comprises: for each prompt text, determining a difference value between the first fusion feature corresponding to the prompt text and the second fusion feature corresponding to the prompt text; integrating the difference values determined for each prompt text to obtain the interference loss value for the interference sample image.

5. The method of claim 4, wherein the interfering the interference sample image using the interference loss value to obtain an updated interference sample image comprises: interfering the interference sample image in a direction that increases the interference loss value to obtain an updated interference sample image. ​ 6. The method of any one of claims 1-5, wherein the generating, using the updated interference sample image, an adversarial sample image that is adversarial to the visual language model comprises: returning, in a case where a preset interference stop condition is not satisfied, to the extracting, using the visual language model, the second visual feature of the updated interference sample image; and determining, in a case where the interference stop condition is satisfied, the updated interference sample image as the adversarial sample image that is adversarial to the visual language model.

7. The method of any one of claims 1-6, wherein the fusing the prompt text and the first visual feature to obtain a first fused feature corresponding to the prompt text comprises: extracting a semantic feature from the prompt text; and extracting a visual feature related to the prompt text by fusing the semantic feature and the first visual feature to obtain the first fused feature corresponding to the prompt text.

8. The method of any one of claims 1-7, wherein the interference loss value is a first interference loss value, and the method further comprises: obtaining, for each prompt text, a first model output result output by the visual language model for the prompt text according to the prompt text and the first fused feature corresponding to the prompt text, and a second model output result output by the visual language model for the prompt text according to the prompt text and the second fused feature corresponding to the prompt text; determining a second interference loss value for the interference sample image according to the first model output result and the second model output result corresponding to each prompt text; and interfering, using the interference loss value, the interference sample image to obtain an updated interference sample image comprises: interfering, using the first interference loss value and the second interference loss value, the interference sample image to obtain the updated interference sample image.

9. The method of any one of claims 1-8, wherein the relevance threshold is a first relevance threshold, and the method further comprises: obtaining at least one first prompt text for the original sample image, each first prompt text having a relevance to the original sample image greater than or equal to a second relevance threshold, the second relevance threshold being greater than or equal to the first relevance threshold; inputting, for each first prompt text, the first prompt text and the adversarial sample image into the visual language model to obtain a result output by the visual language model for the first prompt text, thereby obtaining a first output result corresponding to the first prompt text; obtaining a result expected to be output by the visual language model for each first prompt text, thereby obtaining a second output result corresponding to each first prompt text; and evaluating, based on the first output result and the second output result corresponding to each first prompt text, respectively, an accuracy of the visual language model.

10. The method of claim 9, further comprising: ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ determine a model loss value of the visual language model based on the first output result and the second output result corresponding to each of the at least one prompt text; train the visual language model by using the model loss value of the visual language model.

11. The method of any one of claims 1-10, wherein the visual language model is used for a plurality of visual language tasks, different types of prompt texts are used in different visual language tasks, the at least one prompt text is a prompt text used in a first visual language task, the adversarial sample image has task-to-task transferability, and the at least one first prompt text is a prompt text used in a second visual language task, wherein the first visual language task is different from the second visual language task.

12. The method of any one of claims 1-11, wherein the correlation threshold is a first correlation threshold, the adversarial sample image has model-to-model transferability, and the visual language model is a first visual language model, the method further comprising: obtaining at least one second prompt text for the original sample image, each of the second prompt texts having a correlation with the original sample image greater than or equal to a second correlation threshold, wherein the second correlation threshold is greater than or equal to the first correlation threshold; for each of the second prompt texts, inputting the second prompt text and the adversarial sample image into a pre-trained second visual language model to obtain a result output by the second visual language model for the second prompt text, thereby obtaining a third output result corresponding to the second prompt text; obtaining a result expected to be output by the second visual language model for each of the second prompt texts, thereby obtaining a fourth output result corresponding to each of the second prompt texts; determining an accuracy of the second visual language model based on the third output result and the fourth output result corresponding to each of the second prompt texts.

13. The method of claim 12, further comprising: determining a model loss value of the second visual language model based on the third output result and the fourth output result corresponding to each of the second prompt texts; training the second visual language model by using the model loss value of the second visual language model.

14. An adversarial sample image generation apparatus, the apparatus comprising: an image obtaining module configured to obtain an original sample image and an interference sample image obtained by randomly interfering with the original sample image; a text obtaining module configured to obtain at least one prompt text for the original sample image, each of the prompt texts having a correlation with the original sample image less than a correlation threshold; a first feature extraction module configured to extract a first visual feature of the original sample image by using a pre-trained visual language model, and for each of the prompt texts, fuse the prompt text and the first visual feature to obtain a first fusion feature corresponding to the prompt text; and a second feature extraction module configured to extract a second visual feature of the interference sample image by using the pre-trained visual language model, and for each of the prompt texts, fuse the prompt text and the second visual feature to obtain a second fusion feature corresponding to the prompt text. a second feature extraction module configured to extract second visual features of the interference sample image by using the visual language model; and for each prompt text, fuse the prompt text and the second visual features to obtain a second fusion feature corresponding to the prompt text; a loss value determination module configured to determine an interference loss value for the interference sample image according to the first fusion feature and the second fusion feature corresponding to each prompt text; and an adversarial sample image generation module configured to interfere with the interference sample image by using the interference loss value, obtain an updated interference sample image, and generate an adversarial sample image for the visual language model by using the updated interference sample image.

15. A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method in any one of claims 1-13 when executing the computer program.

16. A computer readable storage medium, having a computer program stored thereon, wherein the computer program implements the steps of the method in any one of claims 1-13 when executed by a processor.

17. A computer program product, comprising a computer program, wherein the computer program implements the steps of the method in any one of claims 1-13 when executed by a processor.

Images