CN114298202A - Image encryption method and device, electronic equipment and storage medium - Google Patents

Image encryption method and device, electronic equipment and storage medium Download PDF

Info

Publication number
CN114298202A
CN114298202A CN202111591956.XA CN202111591956A CN114298202A CN 114298202 A CN114298202 A CN 114298202A CN 202111591956 A CN202111591956 A CN 202111591956A CN 114298202 A CN114298202 A CN 114298202A
Authority
CN
China
Prior art keywords
image
noise
encrypted
trained
category
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202111591956.XA
Other languages
Chinese (zh)
Inventor
李辛昭
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Goldway Intelligent Transportation System Co Ltd
Original Assignee
Shanghai Goldway Intelligent Transportation System Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Goldway Intelligent Transportation System Co Ltd filed Critical Shanghai Goldway Intelligent Transportation System Co Ltd
Priority to CN202111591956.XA priority Critical patent/CN114298202A/en
Publication of CN114298202A publication Critical patent/CN114298202A/en
Pending legal-status Critical Current

Links

Images

Landscapes

  • Image Analysis (AREA)

Abstract

The application relates to an image encryption method, an image encryption device, electronic equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: acquiring an image to be encrypted; and inputting the image to be encrypted into a first neural network model to obtain an encrypted noise image of the image to be encrypted, wherein the category of the encrypted noise image of the image to be encrypted is the same as that of the image to be encrypted, and the category of the image to be encrypted is used for representing the category of an object in the image to be encrypted. In the application, the encrypted noise image of the image to be encrypted, which is obtained by the electronic equipment, can play a good encryption role on the image to be encrypted. Furthermore, when other equipment needs to perform model training, the electronic equipment can send a plurality of encrypted noise images to the other equipment, so that the other equipment is prevented from acquiring a plurality of sample images, the sample images can be effectively protected, and potential safety hazards are reduced.

Description

Image encryption method and device, electronic equipment and storage medium
Technical Field
The present application relates to the field of computer technologies, and in particular, to an image encryption method and apparatus, an electronic device, and a storage medium.
Background
In a scene of image classification or image recognition, a certain image encryption apparatus may acquire a certain sample image and encrypt the sample image in its encryption module to generate an encrypted image, and then the image encryption apparatus may transmit the encrypted image to other devices. After receiving the encrypted image, the other device may decrypt the encrypted image in a decryption module in the other device to obtain the sample image, and then the other device may obtain, based on the sample image, the initial neural network model, and obtain the target neural network model that may be used for predicting the category to which the image belongs.
However, in the above method, because the sample image is needed in the process of training the neural network model in other devices, the other devices or target personnel may acquire the sample image, and there is a certain potential safety hazard.
Disclosure of Invention
The application provides an image encryption method, an image encryption device, electronic equipment and a storage medium, and solves the technical problem that other equipment or target personnel can acquire a sample image and certain potential safety hazards exist.
The technical scheme of the embodiment of the application is as follows:
according to a first aspect of embodiments of the present application, there is provided an image method. The method can comprise the following steps: acquiring an image to be encrypted; inputting the image to be encrypted into a first neural network model to obtain an encrypted noise image of the image to be encrypted, wherein the category of the encrypted noise image of the image to be encrypted is the same as that of the image to be encrypted, the category of the image to be encrypted is used for representing the category of an object in the image to be encrypted, and the first neural network model is obtained by training based on a plurality of sample images and the encrypted noise images of the sample images.
Optionally, the image encryption method further includes: acquiring a first sample image and a noise image to be trained of the first sample image, wherein the first sample image is one of the plurality of sample images; inputting the noise image to be trained of the first sample image and the first sample image into a second neural network model to obtain a first probability, a first feature matrix and a second feature matrix, wherein the second neural network model is an initial neural network model of the first neural network model, the input of the second neural network model is each sample image in the plurality of sample images and the noise image to be trained of each sample image, the first probability is a probability that a class of the noise image to be trained of the first sample image is predicted to be a first class, the first class is a class of the first sample image, the first feature matrix is a feature matrix output by a target network layer of the noise image to be trained of the first sample image, the second feature matrix is a feature matrix output by the target network layer of the first sample image, and the first feature matrix and the second feature matrix are respectively used for identifying the class of the first sample image and the first sample image The target network layer is one of a plurality of network layers included by the second neural network model; inputting the noise image to be trained of the first sample image into a third neural network model to obtain a second probability, wherein the second probability is the probability that the category of the noise image to be trained of the first sample image is predicted to be a second category, and the second category is the category of a random noise image; and updating the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix and the second feature matrix to generate an encrypted noise image of the first sample image.
Optionally, the updating the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix, and the second feature matrix to generate the encrypted noise image of the first sample image specifically includes: determining a target loss function according to the first probability, the second probability, the first feature matrix and the second feature matrix, and performing a gradient back-propagation operation on the target loss function to obtain an input gradient of the noise image to be trained of the first sample image, wherein the target loss function is used for representing the degree of inconsistency between the category of the first sample image and the encrypted noise image of the first sample image; updating the noise image to be trained of the first sample image based on the input gradient and the learning rate of the noise image to be trained of the first sample image to generate an encrypted noise image of the first sample image.
Optionally, the determining the target loss function according to the first probability, the second probability, the first feature matrix, and the second feature matrix specifically includes: determining a first loss function according to the first probability, wherein the first loss function is used for representing the degree of inconsistency of the first class and a third class, and the third class is a class of the noise image to be trained of the first sample image; determining a second loss function according to the second probability, wherein the second loss function is used for representing the degree of inconsistency between the second category and the third category; determining a third loss function according to the first feature matrix and the second feature matrix, wherein the third loss function is used for representing the similarity between the first feature matrix and the second feature matrix; determining the target loss function according to the first loss function, the second loss function and the third loss function.
Optionally, the image encryption method further includes: acquiring a plurality of noise images to be trained, a plurality of random noise images, a first label of each noise image to be trained in the plurality of noise images to be trained and a second label of each random noise image in the plurality of random noise images, wherein the first label is used for representing a non-noise image, and the second label is used for representing a noise image; training a third initial neural network model based on the plurality of noise images to be trained, a plurality of random noise images, the first label of each noise image to be trained in the plurality of noise images to be trained and the second label of each random noise image in the plurality of random noise images, wherein the third initial neural network model is used for judging whether one image is a noise image or not; and determining the trained third initial neural network model as the third neural network model.
According to a second aspect of embodiments of the present application, there is provided an image encryption apparatus. The apparatus may include: the device comprises an acquisition module and a processing module; the acquisition module is used for acquiring an image to be encrypted; the processing module is used for inputting the image to be encrypted into a first neural network model to obtain an encrypted noise image of the image to be encrypted, the category of the encrypted noise image of the image to be encrypted is the same as that of the image to be encrypted, the category of the image to be encrypted is used for representing the category of an object in the image to be encrypted, and the first neural network model is obtained by training based on a plurality of sample images and the encrypted noise images of the sample images.
Optionally, the obtaining module is further configured to obtain a first sample image and a noise image to be trained of the first sample image, where the first sample image is one of the plurality of sample images; the processing module is further configured to input the noise image to be trained of the first sample image and the first sample image into a second neural network model, to obtain a first probability, a first feature matrix, and a second feature matrix, where the second neural network model is an initial neural network model of the first neural network model, the input of the second neural network model is each sample image of the plurality of sample images and the noise image to be trained of each sample image, the first probability is a probability that a class of the noise image to be trained of the first sample image is predicted to be a first class, the first class is a class of the first sample image, the first feature matrix is a feature matrix of the noise image to be trained of the first sample image output through a target network layer, and the second feature matrix is a feature matrix of the first sample image output through the target network layer, the first feature matrix and the second feature matrix are respectively used for identifying the category of the first sample image and the category of a noise image to be trained of the first sample image, and the target network layer is one of a plurality of network layers included in the second neural network model; the processing module is further configured to input the noise image to be trained of the first sample image into a third neural network model, so as to obtain a second probability, where the second probability is a probability that the category of the noise image to be trained of the first sample image is predicted to be a second category, and the second category is a category of a random noise image; the processing module is further configured to update the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix and the second feature matrix to generate an encrypted noise image of the first sample image.
Optionally, the image encryption apparatus further comprises a determining module; the determining module is used for determining a target loss function according to the first probability, the second probability, the first feature matrix and the second feature matrix, and performing a gradient back-propagation operation on the target loss function to obtain an input gradient of the noise image to be trained of the first sample image, wherein the target loss function is used for representing the degree of inconsistency between the category of the first sample image and the encrypted noise image of the first sample image; the processing module is specifically configured to update the noise image to be trained of the first sample image based on the input gradient and the learning rate of the noise image to be trained of the first sample image to generate an encrypted noise image of the first sample image.
Optionally, the determining module is specifically configured to determine, according to the first probability, a first loss function, where the first loss function is used to characterize a degree of inconsistency between the first category and a third category, where the third category is a category of the noise image to be trained of the first sample image; the determining module is specifically further configured to determine a second loss function according to the second probability, where the second loss function is used to characterize a degree of inconsistency between the second category and the third category; the determining module is specifically further configured to determine a third loss function according to the first feature matrix and the second feature matrix, where the third loss function is used to characterize a similarity between the first feature matrix and the second feature matrix; the determining module is specifically further configured to determine the target loss function according to the first loss function, the second loss function, and the third loss function.
Optionally, the acquiring module is further configured to acquire a plurality of noise images to be trained, a plurality of random noise images, a first label of each of the plurality of noise images to be trained, and a second label of each of the plurality of random noise images, where the first label is used for characterizing a non-noise image and the second label is used for characterizing a noise image; the processing module is further used for training a third initial neural network model based on the plurality of noise images to be trained, a plurality of random noise images, the first label of each noise image to be trained in the plurality of noise images to be trained and the second label of each random noise image in the plurality of random noise images, and the third initial neural network model is used for judging whether one image is a noise image or not; the determining module is configured to determine the trained third initial neural network model as the third neural network model.
According to a third aspect of embodiments of the present application, there is provided an electronic device, which may include: a processor and a memory configured to store processor-executable instructions; wherein the processor is configured to execute the instructions to implement any one of the above-described optional image encryption methods of the first aspect.
According to a fourth aspect of embodiments of the present application, there is provided a computer-readable storage medium having instructions stored thereon, which, when executed by an electronic device, enable the electronic device to perform any one of the above-mentioned optional image encryption methods of the first aspect.
According to a fifth aspect of embodiments of the present application, there is provided a computer program product comprising computer instructions which, when run on an electronic device, cause the electronic device to perform the optional image encryption method as in any one of the first aspects.
The technical scheme provided by the embodiment of the application at least has the following beneficial effects:
based on any one of the above aspects, in the present application, the electronic device may obtain an image to be encrypted, and input the image to be encrypted into the first neural network model, so as to obtain an encrypted noise image of the image to be encrypted. Since the category of the encrypted noise image of the image to be encrypted is the same as the category of the image to be encrypted, it is described that the encrypted noise image of the image to be encrypted can replace the image to be encrypted. And because the encrypted noise image of the image to be encrypted is a noise image, namely, the image of the category cannot be identified by human eyes, the encrypted noise image of the image to be encrypted obtained by the electronic equipment can play a good encryption role on the image to be encrypted. Furthermore, when other equipment needs to perform model training, the electronic equipment can send a plurality of encrypted noise images to the other equipment, so that the other equipment is prevented from acquiring a plurality of sample images, the sample images can be effectively protected, and potential safety hazards are reduced.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application and are not to be construed as limiting the application.
FIG. 1 is a schematic diagram illustrating an image encryption system provided by an embodiment of the present application;
fig. 2 is a schematic flowchart illustrating an image encryption method provided in an embodiment of the present application;
FIG. 3 is a flow chart illustrating a further image encryption method provided by an embodiment of the present application;
FIG. 4 is a flow chart illustrating a further image encryption method provided in the embodiment of the present application;
FIG. 5 is a flow chart illustrating a further image encryption method provided in the embodiments of the present application;
FIG. 6 is a flow chart illustrating a further image encryption method provided in the embodiments of the present application;
FIG. 7 is a flowchart illustrating a further image encryption method provided in an embodiment of the present application;
FIG. 8 is a flow chart illustrating a further image encryption method provided by an embodiment of the present application;
FIG. 9 is a flow chart illustrating a further image encryption method provided in an embodiment of the present application;
fig. 10 is a schematic structural diagram illustrating an image encryption apparatus according to an embodiment of the present application;
fig. 11 is a schematic structural diagram illustrating still another image encryption apparatus according to an embodiment of the present application.
Detailed Description
In order to make the technical solutions of the present application better understood by those of ordinary skill in the art, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.
It should be noted that the terms "first," "second," and the like in the description and claims of this application and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the application described herein are capable of operation in sequences other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.
It will be further understood that the terms "comprises" and/or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, and/or components.
The data referred to in the present application may be data authorized by the user or sufficiently authorized by the parties.
Some concepts related to the embodiments of the present application are explained below.
And (3) noise attack: a sample image (e.g., a first sample image) is attacked with a large amount of noise, and the first sample image is changed into a noisy image. The noisy image may have at least two of the following capabilities: (1) the discrimination ability of the human eye can be changed, namely the noise image is completely a noise image applied with a large number of wave times in the appearance of the human eye, and the category of the noise image cannot be identified; (2) the discrimination capability of the network is ensured, i.e. the noise image can replace the first sample image to complete the training of the downstream model (such as the target neural network model). In the embodiment of the present application, the electronic device performing noise attack may specifically be understood as the electronic device updating the noise image to be trained of the first sample image (specifically, updating the pixel values of the noise image to be trained of the first sample image) based on the input gradient of the noise image to be trained of the first sample image and the learning rate of the noise image to be trained of the first sample image, so as to generate the encrypted noise image of the first sample image. The encrypted noise image may replace the first sample image during the training process of the target neural network model, and the similarity between the feature of the encrypted noise image in the target neural network model and the feature of the first sample image in the target neural network model may be greater than or equal to a similarity threshold.
As described in the background art, there is a certain potential safety hazard because other devices or target persons may acquire a sample image during the training process of the neural network model. Based on this, the embodiment of the present application provides an image encryption method, where an encrypted noise image of an image to be encrypted obtained by an electronic device can play a good role in encrypting the image to be encrypted. Furthermore, when other equipment needs to perform model training, the electronic equipment can send a plurality of encrypted noise images to the other equipment, so that the other equipment is prevented from acquiring a plurality of sample images, the sample images can be effectively protected, and potential safety hazards are reduced.
The image encryption method, the image encryption device, the electronic device and the storage medium provided by the embodiment of the application are applied to scenes of image classification or image recognition, and particularly the electronic device can determine the category of an image to be encrypted based on an encrypted noise image of the image to be encrypted. When the electronic device acquires an image to be encrypted, an encrypted noise image of the image to be encrypted can be acquired according to the method provided by the embodiment of the application.
The image encryption method provided by the embodiment of the application is exemplarily described below with reference to the accompanying drawings:
fig. 1 is a schematic view of an image encryption system according to an embodiment of the present disclosure, as shown in fig. 1, the image encryption system may include an electronic device 101 and an electronic device 102, and the electronic device 101 may establish a connection with the electronic device 102 through a wired network or a wireless network.
Specifically, the electronic device 101 may obtain an image to be encrypted and input the image to be encrypted into the first neural network model, resulting in an encrypted noise image of the image to be encrypted. In one implementation of the embodiment of the present application, the electronic device 101 may further send the encrypted noise image of the image to be encrypted and the category of the encrypted noise image (or the category of the image to be encrypted) to the electronic device 102.
After receiving the encrypted noise image of the image to be encrypted and the category of the encrypted noise image, the electronic device 102 may train an initial neural network model based on the encrypted noise image of the image to be encrypted and the category of the encrypted noise image to obtain a target neural network model, which may predict the category of a noise image to be recognized.
The electronic devices (including the electronic device 101 and the electronic device 102) in the embodiment of the present application may be a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a Personal Digital Assistant (PDA), an Augmented Reality (AR) \ Virtual Reality (VR) device, and other devices that can be installed and used with a content community application, and the present application does not particularly limit the specific form of the electronic device. The system can be used for man-machine interaction with a user through one or more modes of a keyboard, a touch pad, a touch screen, a remote controller, voice interaction or handwriting equipment and the like.
As shown in fig. 2, when the image encryption method is applied to the above-described electronic apparatus 101, the image encryption method may include S101-S104.
S101, the electronic equipment acquires a first sample image and a noise image to be trained of the first sample image.
Wherein the first sample image is one of the plurality of sample images.
It should be understood that the noise image to be trained of the first sample image is a noise image of the same size as the sample image.
Referring to fig. 2, as shown in fig. 3, in an implementation manner of the embodiment of the present application, acquiring a noise image to be trained of a first sample image may specifically include S1011-S1012.
S1011, the electronic equipment creates a noise pool.
Wherein, the noise pool comprises the noise images of the plurality of sample images.
It should be understood that the number of noise images included in the noise pool is the same as the number of the plurality of sample images (i.e., a plurality of noise images are included in the noise pool), and the size of each noise image included in the noise pool is the same as the size of the sample image corresponding to each noise image corresponding to one sample image (which may also be understood as one noise image corresponding to each sample image in the plurality of sample images), and the noise image to be trained of the first sample image is one of the plurality of noise images.
S1012, the electronic device obtains a noise image to be trained of the first sample image from the noise pool based on the first sample image.
It is understood that the electronic device obtains the noise image to be trained of the first sample image from the noise pool, that is, obtains the noise image to be trained of the first sample image from the noise images of the plurality of sample images included in the noise pool, where the noise image to be trained is the corresponding noise image of the first sample image in the noise pool (or the plurality of noise images).
In the embodiment of the application, the electronic device creates a noise pool, and can acquire the noise image to be trained of the first sample image from the noise pool (specifically, a plurality of noise images included in the noise pool) based on the first sample image, so that the noise image to be trained of each sample image can be effectively acquired, and the efficiency of image encryption is improved.
Alternatively, before model training (or when the model is trained for the first time), the plurality of noise images included in the noise pool may be blank images, that is, the pixel values of the plurality of noise images are 0; in the subsequent training process, the plurality of noise images included in the noise pool are trained one round by one into noise images with pixel values between 0 and 1, and then encrypted noise images of the plurality of sample images can be obtained.
S102, the electronic equipment inputs the noise image to be trained of the first sample image and the first sample image into a second neural network model to obtain a first probability, a first feature matrix and a second feature matrix.
Wherein the second neural network model is an initial neural network model of the first neural network model, the input of the second neural network model is each sample image in the plurality of sample images and a noise image to be trained of each sample image, the first probability is the probability that the class of the noise image to be trained of the first sample image is predicted to be the first class, the first category is the category of the first sample image, the first feature matrix is the feature matrix of the noise image to be trained of the first sample image output by the target network layer, the second feature matrix is a feature matrix of the first sample image output through the target network layer, the first feature matrix and the second feature matrix are respectively used for identifying the category of the first sample image and the category of a noise image to be trained of the first sample image, and the target network layer is one of a plurality of network layers included in the second neural network model.
It should be understood that the category of the first sample image is a category of an object in the first sample image. For example, the first sample image includes a monkey, and the category of the first sample image may be a monkey.
Alternatively, the target network layer may be a convolutional layer included in the second neural network model, that is, the first feature matrix may be a shallow convolution matrix output by the convolutional layer of the noise image to be trained of the first sample image, and the second feature matrix may be a shallow convolution matrix output by the convolutional layer of the first sample image.
S103, the electronic equipment inputs the noise image to be trained of the first sample image into a third neural network model to obtain a second probability.
Wherein the second probability is the probability that the class of the noise image to be trained of the first sample image is predicted to be the second class, and the second class is the class of the random noise image.
It should be understood that the random noise image of the first sample image is a noise image of the same size as the first sample image, and the random noise image is a random matrix of a certain parameter, i.e., the same size as the first sample image, and the value of the random matrix is between 0 and 1.
Alternatively, the random noise image may be a gaussian noise image generated randomly.
In the embodiment of the present application, the category of the random noise image of the first sample image may be understood as noise (or a noise image). The electronic equipment inputs the noise image to be trained of the first sample image into the third neural network model to obtain the second probability, so as to improve the similarity between the noise to be trained of the first sample image and the random noise image of the first sample image, so that the noise image to be trained of the first sample image is more and more like a noise image, that is, the category of the noise image to be trained of the first sample image cannot be recognized by human eyes, and only the noise image to be trained of the first sample image is recognized as a noise image.
Optionally, the electronic device may set the label (i.e., label) of the second category to 1 (hereinafter referred to as a second label, where the second label is used to characterize the noise image), and the second probability obtained by the electronic device is the probability that the noise image to be trained of the first sample image is predicted as the second label.
It should be noted that the embodiment of the present application does not limit the execution sequence of the above S102 and S103. For example, S102 and then S103 may be executed first, S103 and then S102 may be executed first, or S102 and S103 may be executed simultaneously, and for convenience of description, S102 and then S103 are executed first in fig. 2.
And S104, the electronic equipment updates the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix and the second feature matrix to generate an encrypted noise image of the first sample image.
Specifically, the electronic device may update the pixel values of the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix, and the second feature matrix to obtain an encrypted noise image of the first sample image. It should be understood that the similarity between the second feature matrix and the third feature matrix (i.e., the feature matrix of the encrypted noise image of the first sample image output via the target network layer) is greater than or equal to the similarity threshold.
With reference to fig. 2, as shown in fig. 4, in an implementation manner of the embodiment of the present application, the updating the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix, and the second feature matrix to generate the encrypted noise image of the first sample image specifically includes S1041-S1042.
S1041, the electronic device determines a target loss function according to the first probability, the second probability, the first feature matrix and the second feature matrix, and performs gradient back-propagation operation on the target loss function to obtain an input gradient of the noise image to be trained of the first sample image.
Wherein the target loss function is used to characterize a degree of disparity between the class of the first sample image and the encrypted noise image of the first sample image.
It should be understood that the electronic device may update the pixel values of the noise image to be trained of the first sample image based on the target loss function to obtain the encrypted noise image of the first sample image, so that the similarity between the second feature matrix and the third feature matrix is greater than or equal to the similarity threshold, i.e., the encrypted noise image of the first sample image can be substituted for the first sample image.
With reference to fig. 4, as shown in fig. 5, in an implementation manner of the embodiment of the present application, the determining the target loss function according to the first probability, the second probability, the first feature matrix, and the second feature matrix specifically includes S1041a-S1041 d.
S1041a, the electronic device determines a first loss function according to the first probability.
The first loss function is used for representing the degree of inconsistency between the first category and a third category, wherein the third category is a category of the noise image to be trained of the first sample image.
In conjunction with the description of the above embodiments, it is understood that the first category is a category of the first sample image.
It is understood that, after determining the first loss function, the electronic device may update the noise image to be trained of the first sample image based on the first loss function, so that the category of the updated noise image to be trained of the first sample image (specifically, the category of the updated noise image to be trained of the first sample image predicted in the second neural network model) is the same as the first category. That is, the prediction results obtained by the second neural network model for the updated noise image to be trained of the first sample image and the first sample image should be the same, so that the updated noise image to be trained of the first sample image can replace the first sample image.
In one implementation of the embodiment of the present application, the electronic device determines that the first loss function satisfies the following formula:
loss1＝nll_loss(A)
therein, loss1Representing the first loss function and a representing the first probability.
And S1041b, the electronic device determines a second loss function according to the second probability.
Wherein the second loss function is used for characterizing the degree of inconsistency between the second category and the third category.
In connection with the description of the above embodiment, it should be understood that the second category is a category of random noise images of the first sample image, and the third category is a category of noise images to be trained of the first sample image.
It is understood that the second loss function can ensure that the noise image to be trained of the first sample image (or the updated noise image to be trained of the first sample image) is a noise image, i.e., an image of which the human eye cannot recognize the category.
In one implementation of the embodiment of the present application, the electronic device determines that the second loss satisfies the following formula:
loss2＝logB
therein, loss2Represents the firstA two-loss function, B representing the second probability.
S1041c, the electronic device determines a third loss function according to the first feature matrix and the second feature matrix.
Wherein the third loss function is used for characterizing the similarity between the first feature matrix and the second feature matrix.
It should be understood that the larger the third loss function, the smaller the similarity between the first feature matrix and the second feature matrix; correspondingly, the smaller the third loss function is, the greater the similarity between the first feature matrix and the second feature matrix is.
Optionally, the third loss function may also characterize a degree of inconsistency between the first feature matrix and the second feature matrix.
In one implementation of the embodiment of the present application, the electronic device may determine a mean square error between the first feature matrix and the second feature matrix as the third loss function. That is, the third loss function may satisfy the following equation:
loss3＝MSE(C,D)
therein, loss3Representing the third loss function, C representing the first feature matrix, and D representing the second feature matrix.
S1041d, the electronic device determines a target loss function according to the first loss function, the second loss function, and the third loss function.
In one implementation of the embodiments of the present application, the electronic device may determine a sum of the first loss function, the second loss function, and the third loss function as the target loss function.
And S1042, the electronic device updates the noise image to be trained of the first sample image based on the input gradient and the learning rate of the noise image to be trained of the first sample image to generate an encrypted noise image of the first sample image.
In conjunction with the description of the above embodiment, it is to be understood that the input gradient is an input gradient of the noise image to be trained of the first sample image, and the electronic device may determine a value based on the input gradient and the learning rate, and update the noise image to be trained of the first sample image based on the value to generate an encrypted noise image of the first sample image.
It is understood that the electronic device updates the noise image to be trained of the first sample image, i.e., updates the pixel values of the noise image to be trained of the first sample image, to obtain the pixel values of the encrypted noise image of the first sample image, i.e., to obtain the encrypted noise image of the first sample image.
In an alternative implementation, the electronic device may determine that pixel values of an encrypted noise image of the first sample image satisfy the following equation:
Z＝Z'-Zgrad*Inoise
wherein Z represents the pixel value of the encrypted noise image of the first sample image, Z' represents the pixel value of the noise image to be trained of the first sample image, ZgradInput gradient, I, of a noisy image to be trained representing the first sample imagenoiseThe learning rate of the noise image to be trained of the first sample image is represented.
With reference to fig. 2, as shown in fig. 6, in an implementation manner, the image encryption method provided by the embodiment of the present application may further include S105-S107.
S105, the electronic equipment acquires a plurality of noise images to be trained, a plurality of random noise images, a first label of each noise image to be trained in the plurality of noise images to be trained, and a second label of each random noise image in the plurality of random noise images.
Wherein the first label is used to characterize a non-noise image and the second label is used to characterize a noise image.
It should be understood that there is a one-to-one correspondence between the plurality of noise images to be trained and the plurality of random noise images, and a specific noise image to be trained in the plurality of noise images to be trained may correspond to a random noise image in the plurality of random noise images, that is, one noise image to be trained corresponds to one random noise image. The noise image to be trained of the first sample image may be one of the plurality of noise images to be trained, that is, the random noise image of the first sample image is a random noise image corresponding to the noise image to be trained of the first sample image in the plurality of random noise images.
Alternatively, the electronic device may set the label (i.e., label) of the category (e.g., the third category described above) of each of the plurality of noise images to be trained to 0 (i.e., the first label), and may set the label of the category of each of the plurality of random noise images to 1 (i.e., the second label). Specifically, at the beginning of the training of the model, the electronic device may default that the plurality of noise images to be trained are not noise images (i.e., are non-noise images), and the plurality of random noise images are noise images.
S106, the electronic equipment trains a third initial neural network model based on the plurality of noise images to be trained, the plurality of random noise images, the first label of each noise image to be trained in the plurality of noise images to be trained and the second label of each random noise image in the plurality of random noise images.
Wherein the third initial neural network model is used for judging whether an image is a noise image.
Specifically, the electronic device trains the third initial neural network model, that is, the parameters of the third initial neural network model are updated based on the noise images to be trained, the random noise images, the first label of each of the noise images to be trained, and the second label of each of the random noise images.
S107, the electronic equipment determines the trained third initial neural network model as a third neural network model.
In one implementation of the embodiment of the application, obtaining, by the electronic device, the third neural network model may include steps a to C.
And step A, the electronic equipment inputs the first noise image to be trained and the first random noise image into a third initial neural network model to obtain a third probability and a fourth probability.
The first to-be-trained noise image is one of the plurality of to-be-trained noise images, the first random noise image is a random noise image corresponding to the first to-be-trained noise image in the plurality of random noise images, the third probability is a probability that the category of the first to-be-trained noise is predicted as the first label, and the fourth probability is a probability that the category of the first random noise is predicted as the second label.
In connection with the description of the above embodiments, it should be understood that the probability that the category of the first noise image to be trained is predicted as the first label is the probability that the first noise image to be trained is predicted as the non-noise image, and the probability that the category of the first random noise image is predicted as the second label is the probability that the first random noise image is predicted as the noise image.
And step B, the electronic equipment determines a fourth loss function according to the third probability and the fourth probability.
The fourth loss function is used for characterizing the degree of inconsistency between a first prediction result and the non-noise image and the degree of inconsistency between a second prediction result and the noise image, wherein the first prediction result is the prediction result of the category of the first noise image to be trained in the third initial neural network model, and the second prediction result is the prediction result of the category of the first random noise image in the third initial neural network model.
In one implementation of the embodiment of the present application, the electronic device determines that the fourth loss function satisfies the following formula:
loss4＝logE+log(1-F)
therein, loss4Represents the fourth loss function, E represents the fourth probability, and F represents the third probability.
And C, updating parameters included in the third initial neural network model based on the fourth loss function to obtain a third neural network model.
It should be understood that, in the case where the above-described plurality of sample images are acquired, the electronic apparatus may generate encrypted noise images of the plurality of sample images based on the image encryption method described in the above-described embodiment (specifically, S101 to S104 described above). As such, the electronic device may also derive the first neural network model based on the plurality of sample images and the encrypted noise image training of the plurality of sample images. Specifically, with reference to fig. 2, as shown in fig. 7, the image encryption method provided in the embodiment of the present application further includes S108 to S110.
S108, acquiring a plurality of sample images and encrypted noise images of the sample images.
S109, training a first initial neural network model based on the multiple sample images and the encrypted noise images of the multiple sample images.
Wherein the first initial neural network model is used to determine an encrypted noise image of an image (including a sample image).
And S110, determining the trained first initial neural network model as a first neural network model.
To this end, when acquiring a certain image (for example, an image to be encrypted), the electronic device may input the image to be encrypted into the first neural network model to obtain an encrypted noise image of the image to be encrypted.
As shown in fig. 8, the image encryption provided by the embodiment of the present application may further include S201-S202.
S201, the electronic equipment acquires an image to be encrypted.
S202, the electronic equipment inputs the image to be encrypted into the first neural network model to obtain an encrypted noise image of the image to be encrypted.
The class of the encrypted noise image of the image to be encrypted is the same as that of the image to be encrypted, the class of the image to be encrypted is used for representing the class of an object in the image to be encrypted, and the first neural network model is obtained by training based on a plurality of sample images and the encrypted noise images of the sample images.
In particular, the second neural network model (i.e. the initial neural network model of the first neural network model) may also be understood as the first initial neural network model described above.
In one case, i.e., S202, the electronic device may be directly used when the first neural network model has been trained, i.e., the image to be encrypted may be input into the first neural network model to obtain an encrypted noise image of the image to be encrypted.
In another case, the electronic device may further perform neural network training based on the sample images and the encrypted noise images of the sample images to obtain the first neural network model, and then input the image to be encrypted into the first neural network model to obtain the encrypted noise image of the image to be encrypted.
It should be noted that, the training process of the first neural network model may refer to the description in S108-S110, and is not described herein again.
In the embodiment of the present application, the category of the encrypted noise image of the image to be encrypted is the same as the category of the image to be encrypted, which indicates that the encrypted noise image of the image to be encrypted can replace the image to be encrypted. And because the encrypted noise image of the image to be encrypted is a noise image, namely, the image of the category cannot be identified by human eyes, the encrypted noise image of the image to be encrypted obtained by the electronic equipment can play a good encryption role on the image to be encrypted. Furthermore, when other equipment needs to perform model training, the electronic equipment can send a plurality of encrypted noise images to the other equipment, so that the other equipment is prevented from acquiring a plurality of sample images, the sample images can be effectively protected, and potential safety hazards are reduced.
In one implementation of the embodiment of the present application, the electronic device may acquire a plurality of images to be encrypted, encrypt the plurality of images to be encrypted to obtain encrypted noise images of the plurality of images to be encrypted, train the initial neural network model based on the encrypted noise images of the plurality of images to be encrypted and categories of the plurality of images to be encrypted (or categories of the encrypted noise images of the plurality of images to be encrypted), and generate a target neural network model, where the target neural network model may be used to determine a category of a certain noise image.
In another implementation manner of the embodiment of the application, after the electronic device acquires the multiple images to be encrypted and inputs the multiple images to be encrypted into the first neural network model (which may also be understood as encrypting the multiple images to be encrypted) respectively to obtain encrypted noise images of the multiple images to be encrypted, the electronic device may further send the encrypted noise images of the multiple images to be encrypted and categories of the multiple images to be encrypted (or categories of the encrypted noise images of the multiple images to be encrypted) to other devices, so that the other devices may train a certain initial neural network model based on the encrypted noise images of the multiple images to be encrypted and the categories of the multiple images to be encrypted to generate a target neural network model. Further, when the other device acquires a certain noise image, the noise image may be input to the target neural network model to determine the category of the noise image. As shown in fig. 9, the process may include S301-S308.
S301, the electronic equipment acquires a plurality of images to be encrypted and a plurality of categories of the images to be encrypted.
S302, the electronic equipment encrypts the multiple images to be encrypted to obtain encrypted noise images of the multiple images to be encrypted.
One image to be encrypted corresponds to one encrypted noise image, and the category of the encrypted noise image of the image to be encrypted is the same as that of the image to be encrypted.
S303, the electronic equipment sends the encrypted noise images of the plurality of images to be encrypted and the categories of the plurality of images to be encrypted to other equipment.
Illustratively, the electronic device may be the electronic device 101 in fig. 1 described above, and the other device may be the electronic device 102 in fig. 1.
S304, the other equipment receives the encrypted noise images of the plurality of images to be encrypted sent by the electronic equipment and the categories of the plurality of images to be encrypted.
S305, training the initial neural network model by other equipment based on the encrypted noise images of the plurality of images to be encrypted and the categories of the plurality of images to be encrypted.
And S306, determining the trained initial neural network model as a target neural network model by other equipment.
Wherein the target neural network model is used to determine a class of a noisy image.
And S307, acquiring the noise image to be identified by other equipment.
And S308, inputting the noise image to be recognized into the target neural network model by other equipment to obtain the category of the noise image to be recognized.
To this end, the other device may predict a category to which a certain noise image (e.g., a noise image to be recognized) belongs based on the target neural network model.
It is understood that, in practical implementation, the electronic device according to the embodiment of the present application may include one or more hardware structures and/or software modules for implementing the corresponding image encryption method, and these hardware structures and/or software modules may constitute an electronic device. Those of skill in the art will readily appreciate that the present application is capable of hardware or a combination of hardware and computer software implementing the various illustrative algorithm steps described in connection with the embodiments disclosed herein. Whether a function is performed as hardware or computer software drives hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
Based on such understanding, the embodiment of the present application further provides an image encryption apparatus, and fig. 10 shows a schematic structural diagram of the image encryption apparatus provided in the embodiment of the present application. As shown in fig. 10, the image encryption apparatus 20 may include: an acquisition module 201 and a processing module 202.
An obtaining module 201, configured to obtain an image to be encrypted.
The processing module 202 is configured to input the image to be encrypted into a first neural network model, to obtain an encrypted noise image of the image to be encrypted, where a category of the encrypted noise image of the image to be encrypted is the same as a category of the image to be encrypted, the category of the image to be encrypted is used to characterize a category of an object in the image to be encrypted, and the first neural network model is trained based on a plurality of sample images and encrypted noise images of the plurality of sample images.
Optionally, the obtaining module 201 is further configured to obtain a first sample image and a noise image to be trained of the first sample image, where the first sample image is one of the plurality of sample images.
The processing module 202 is further configured to input the noise image to be trained of the first sample image and the first sample image into a second neural network model, to obtain a first probability, a first feature matrix, and a second feature matrix, where the second neural network model is an initial neural network model of the first neural network model, the input of the second neural network model is each sample image of the plurality of sample images and the noise image to be trained of each sample image, the first probability is a probability that a class of the noise image to be trained of the first sample image is predicted to be a first class, the first class is a class of the first sample image, the first feature matrix is a feature matrix of the noise image to be trained of the first sample image output through a target network layer, and the second feature matrix is a feature matrix of the first sample image output through the target network layer, the first feature matrix and the second feature matrix are respectively used for identifying the class of the first sample image and the class of a noise image to be trained of the first sample image, and the target network layer is one of a plurality of network layers included in the second neural network model.
The processing module 202 is further configured to input the noise image to be trained of the first sample image into a third neural network model, so as to obtain a second probability, where the second probability is a probability that the class of the noise image to be trained of the first sample image is predicted to be a second class, and the second class is a class of a random noise image.
The processing module 202 is further configured to update the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix, and the second feature matrix, so as to generate an encrypted noise image of the first sample image.
Optionally, the image encryption apparatus 20 further includes a determination module 203.
A determining module 203, configured to determine an objective loss function according to the first probability, the second probability, the first feature matrix and the second feature matrix, and perform a gradient back-propagation operation on the objective loss function to obtain an input gradient of the noise image to be trained of the first sample image, where the objective loss function is used to characterize a degree of inconsistency between a category of the first sample image and an encrypted noise image of the first sample image.
The processing module 202 is specifically configured to update the noise image to be trained of the first sample image based on the input gradient and the learning rate of the noise image to be trained of the first sample image, so as to generate an encrypted noise image of the first sample image.
Optionally, the determining module 203 is specifically configured to determine, according to the first probability, a first loss function, where the first loss function is used to characterize a degree of inconsistency between the first class and a third class, where the third class is a class of the noise image to be trained of the first sample image.
The determining module 203 is further specifically configured to determine a second loss function according to the second probability, where the second loss function is used to characterize the degree of inconsistency between the second category and the third category.
The determining module 203 is further specifically configured to determine a third loss function according to the first feature matrix and the second feature matrix, where the third loss function is used to characterize a similarity between the first feature matrix and the second feature matrix.
The determining module 203 is specifically further configured to determine the target loss function according to the first loss function, the second loss function, and the third loss function.
Optionally, the obtaining module 201 is further configured to obtain a plurality of noise images to be trained, a plurality of random noise images, a first label of each of the plurality of noise images to be trained, and a second label of each of the plurality of random noise images, where the first label is used for characterizing a non-noise image, and the second label is used for characterizing a noise image.
The processing module 202 is further configured to train a third initial neural network model based on the plurality of noise images to be trained, the plurality of random noise images, the first label of each of the plurality of noise images to be trained, and the second label of each of the plurality of random noise images, where the third initial neural network model is used to determine whether an image is a noise image.
A determining module 203, configured to determine the trained third initial neural network model as the third neural network model.
As described above, the embodiment of the present application can perform division of functional modules on an image encryption apparatus according to the above-described method example. The integrated module can be realized in a hardware form, and can also be realized in a software functional module form. In addition, it should be further noted that the division of the modules in the embodiment of the present application is schematic, and is only a logic function division, and there may be another division manner in actual implementation. For example, the functional blocks may be divided for the respective functions, or two or more functions may be integrated into one processing block.
With regard to the image encryption apparatus in the foregoing embodiment, the specific manner in which each module performs operations and the beneficial effects thereof have been described in detail in the foregoing method embodiment, and are not described herein again.
Fig. 11 is a schematic structural diagram of another image encryption device provided in the present application. As shown in fig. 11, the image encryption apparatus 30 may include at least one processor 301 and a memory 303 for storing processor-executable instructions. Wherein the processor 301 is configured to execute instructions in the memory 303 to implement the image encryption method in the above-described embodiments.
In addition, the image encryption apparatus 30 may further include a communication bus 302 and at least one communication interface 304.
The processor 301 may be a Central Processing Unit (CPU), a micro-processing unit, an ASIC, or one or more integrated circuits for controlling the execution of programs according to the present disclosure.
The communication bus 302 may include a path that conveys information between the aforementioned components.
The communication interface 304 may be any device, such as a transceiver, for communicating with other devices or communication networks, such as an ethernet, a Radio Access Network (RAN), a Wireless Local Area Network (WLAN), etc.
The memory 303 may be, but is not limited to, a read-only memory (ROM) or other type of static storage device that may store static information and instructions, a Random Access Memory (RAM) or other type of dynamic storage device that may store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, optical disk storage (including compact disc, laser disc, optical disc, digital versatile disc, blu-ray disc, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. The memory may be self-contained and connected to the processing unit by a bus. The memory may also be integrated with the processing unit.
The memory 303 is used for storing instructions for executing the scheme of the application, and is controlled by the processor 301 to execute. The processor 301 is configured to execute instructions stored in the memory 303 to implement the functions of the method of the present application.
In particular implementations, processor 301 may include one or more CPUs such as CPU0 and CPU1 in fig. 11 for one embodiment.
In a specific implementation, the image encryption apparatus 30 may include a plurality of processors, such as the processor 301 and the processor 307 in fig. 11, as an embodiment. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (e.g., computer program instructions).
In a specific implementation, the image encryption apparatus 30 may further include an output device 305 and an input device 306, as an embodiment. The output device 305 is in communication with the processor 301 and may display information in a variety of ways. For example, the output device 305 may be a Liquid Crystal Display (LCD), a Light Emitting Diode (LED) display device, a Cathode Ray Tube (CRT) display device, a projector (projector), or the like. The input device 306 is in communication with the processor 301 and can accept user input in a variety of ways. For example, the input device 306 may be a mouse, a keyboard, a touch screen device, or a sensing device, among others.
Those skilled in the art will appreciate that the configuration shown in fig. 11 does not constitute a limitation of the image encryption apparatus 30, and may include more or fewer components than those shown, or combine some components, or employ a different arrangement of components.
In addition, the present application also provides a computer-readable storage medium, which includes instructions, when executed by an electronic device, cause the electronic device to execute the image encryption method provided in the above embodiment.
In addition, the present application also provides a computer program product comprising instructions which, when executed by an electronic device, cause the electronic device to perform the image encryption method as provided in the above embodiments.
Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.

Claims (13)

1. An image encryption method, comprising:
acquiring an image to be encrypted;
inputting the image to be encrypted into a first neural network model to obtain an encrypted noise image of the image to be encrypted, wherein the category of the encrypted noise image of the image to be encrypted is the same as that of the image to be encrypted, the category of the image to be encrypted is used for representing the category of an object in the image to be encrypted, and the first neural network model is obtained by training based on a plurality of sample images and the encrypted noise images of the sample images.
2. The image encryption method according to claim 1, characterized in that the method further comprises:
acquiring a first sample image and a noise image to be trained of the first sample image, wherein the first sample image is one of the plurality of sample images;
inputting the noise image to be trained of the first sample image and the first sample image into a second neural network model to obtain a first probability, a first feature matrix and a second feature matrix, wherein the second neural network model is an initial neural network model of the first neural network model, the input of the second neural network model is each sample image in the plurality of sample images and the noise image to be trained of each sample image, the first probability is a probability that a category of the noise image to be trained of the first sample image is predicted to be a first category, the first category is a category of the first sample image, the first feature matrix is a feature matrix of the noise image to be trained of the first sample image output through a target network layer, and the second feature matrix is a feature matrix of the first sample image output through the target network layer, the first feature matrix and the second feature matrix are respectively used for identifying the category of the first sample image and the category of a noise image to be trained of the first sample image, and the target network layer is one of a plurality of network layers included in the second neural network model;
inputting the noise image to be trained of the first sample image into a third neural network model to obtain a second probability, wherein the second probability is the probability that the category of the noise image to be trained of the first sample image is predicted to be a second category, and the second category is the category of a random noise image;
updating the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix and the second feature matrix to generate an encrypted noise image of the first sample image.
3. The image encryption method according to claim 2, wherein the updating the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix, and the second feature matrix to generate an encrypted noise image of the first sample image comprises:
determining a target loss function according to the first probability, the second probability, the first feature matrix and the second feature matrix, and performing a gradient back-propagation operation on the target loss function to obtain an input gradient of the noise image to be trained of the first sample image, wherein the target loss function is used for representing the degree of inconsistency between the category of the first sample image and the encrypted noise image of the first sample image;
updating the noise image to be trained of the first sample image based on the input gradient and a learning rate of the noise image to be trained of the first sample image to generate an encrypted noise image of the first sample image.
4. The image encryption method according to claim 3, wherein the determining an objective loss function from the first probability, the second probability, the first feature matrix, and the second feature matrix comprises:
determining a first loss function according to the first probability, wherein the first loss function is used for representing the degree of inconsistency between the first class and a third class, and the third class is a class of a noise image to be trained of the first sample image;
determining a second loss function according to the second probability, wherein the second loss function is used for representing the degree of inconsistency between the second category and the third category;
determining a third loss function according to the first feature matrix and the second feature matrix, wherein the third loss function is used for representing the similarity between the first feature matrix and the second feature matrix;
and determining the target loss function according to the first loss function, the second loss function and the third loss function.
5. The image encryption method according to any one of claims 2 to 4, characterized in that the method further comprises:
acquiring a plurality of noise images to be trained, a plurality of random noise images, a first label of each noise image to be trained in the plurality of noise images to be trained, and a second label of each random noise image in the plurality of random noise images, wherein the first label is used for representing a non-noise image, and the second label is used for representing a noise image;
training a third initial neural network model based on the plurality of noise images to be trained, a plurality of random noise images, the first label of each noise image to be trained in the plurality of noise images to be trained and the second label of each random noise image in the plurality of random noise images, wherein the third initial neural network model is used for judging whether one image is a noise image or not;
and determining the trained third initial neural network model as the third neural network model.
6. An image encryption apparatus characterized by comprising: the device comprises an acquisition module and a processing module;
the acquisition module is used for acquiring an image to be encrypted;
the processing module is configured to input the image to be encrypted into a first neural network model to obtain an encrypted noise image of the image to be encrypted, where a category of the encrypted noise image of the image to be encrypted is the same as a category of the image to be encrypted, the category of the image to be encrypted is used to characterize a category of an object in the image to be encrypted, and the first neural network model is obtained by training based on a plurality of sample images and the encrypted noise images of the plurality of sample images.
7. The image encryption apparatus according to claim 6,
the obtaining module is further configured to obtain a first sample image and a noise image to be trained of the first sample image, where the first sample image is one of the plurality of sample images;
the processing module is further configured to input the noise image to be trained of the first sample image and the first sample image into a second neural network model, so as to obtain a first probability, a first feature matrix, and a second feature matrix, where the second neural network model is an initial neural network model of the first neural network model, the input of the second neural network model is each sample image of the plurality of sample images and the noise image to be trained of each sample image, the first probability is a probability that a category of the noise image to be trained of the first sample image is predicted to be a first category, the first category is a category of the first sample image, the first feature matrix is a feature matrix of the noise image to be trained of the first sample image output through a target network layer, and the second feature matrix is a feature matrix of the first sample image output through the target network layer, the first feature matrix and the second feature matrix are respectively used for identifying the category of the first sample image and the category of a noise image to be trained of the first sample image, and the target network layer is one of a plurality of network layers included in the second neural network model;
the processing module is further configured to input the noise image to be trained of the first sample image into a third neural network model, so as to obtain a second probability, where the second probability is a probability that the category of the noise image to be trained of the first sample image is predicted to be a second category, and the second category is a category of a random noise image;
the processing module is further configured to update the noise image to be trained of the first sample image according to the first probability, the second probability, the first feature matrix, and the second feature matrix, so as to generate an encrypted noise image of the first sample image.
8. The image encryption apparatus according to claim 7, characterized in that the image encryption apparatus further comprises a determination module;
the determining module is configured to determine a target loss function according to the first probability, the second probability, the first feature matrix and the second feature matrix, and perform a gradient back-propagation operation on the target loss function to obtain an input gradient of the noise image to be trained of the first sample image, where the target loss function is used to represent a degree of disparity between a category of the first sample image and an encrypted noise image of the first sample image;
the processing module is specifically configured to update the noise image to be trained of the first sample image based on the input gradient and a learning rate of the noise image to be trained of the first sample image to generate an encrypted noise image of the first sample image.
9. The image encryption apparatus according to claim 8,
the determining module is specifically configured to determine a first loss function according to the first probability, where the first loss function is used to characterize a degree of inconsistency between the first category and a third category, and the third category is a category of the noise image to be trained of the first sample image;
the determining module is specifically further configured to determine a second loss function according to the second probability, where the second loss function is used to characterize a degree of inconsistency between the second category and the third category;
the determining module is specifically further configured to determine a third loss function according to the first feature matrix and the second feature matrix, where the third loss function is used to characterize a similarity between the first feature matrix and the second feature matrix;
the determining module is specifically further configured to determine the target loss function according to the first loss function, the second loss function, and the third loss function.
10. The image encryption apparatus according to any one of claims 7 to 9, characterized in that the image encryption apparatus further comprises a determination module;
the acquiring module is further configured to acquire a plurality of noise images to be trained, a plurality of random noise images, a first label of each of the plurality of noise images to be trained, and a second label of each of the plurality of random noise images, where the first label is used for representing a non-noise image and the second label is used for representing a noise image;
the processing module is further configured to train a third initial neural network model based on the plurality of noise images to be trained, the plurality of random noise images, the first label of each of the plurality of noise images to be trained, and the second label of each of the plurality of random noise images, where the third initial neural network model is used to determine whether an image is a noise image;
and the determining module is used for determining the trained third initial neural network model as the third neural network model.
11. An electronic device, characterized in that the electronic device comprises:
a processor;
a memory configured to store the processor-executable instructions;
wherein the processor is configured to execute the instructions to implement the image encryption method of any one of claims 1-5.
12. A computer-readable storage medium having instructions stored thereon, wherein the instructions in the computer-readable storage medium, when executed by an electronic device, enable the electronic device to perform the image encryption method of any one of claims 1-5.
13. A computer program product, characterized in that it comprises computer instructions which, when run on an electronic device, cause the electronic device to carry out the image encryption method according to any one of claims 1 to 5.
CN202111591956.XA 2021-12-23 2021-12-23 Image encryption method and device, electronic equipment and storage medium Pending CN114298202A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111591956.XA CN114298202A (en) 2021-12-23 2021-12-23 Image encryption method and device, electronic equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111591956.XA CN114298202A (en) 2021-12-23 2021-12-23 Image encryption method and device, electronic equipment and storage medium

Publications (1)

Publication Number Publication Date
CN114298202A true CN114298202A (en) 2022-04-08

Family

ID=80968937

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111591956.XA Pending CN114298202A (en) 2021-12-23 2021-12-23 Image encryption method and device, electronic equipment and storage medium

Country Status (1)

Country Link
CN (1) CN114298202A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114676396A (en) * 2022-05-30 2022-06-28 山东极视角科技有限公司 Protection method and device for deep neural network model, electronic equipment and medium
CN117058493A (en) * 2023-10-13 2023-11-14 之江实验室 Image recognition security defense method and device and computer equipment

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114676396A (en) * 2022-05-30 2022-06-28 山东极视角科技有限公司 Protection method and device for deep neural network model, electronic equipment and medium
CN117058493A (en) * 2023-10-13 2023-11-14 之江实验室 Image recognition security defense method and device and computer equipment
CN117058493B (en) * 2023-10-13 2024-02-13 之江实验室 Image recognition security defense method and device and computer equipment

Similar Documents

Publication Publication Date Title
US20200320281A1 (en) Face recognition method and apparatus, electronic device, and storage medium
US11575500B2 (en) Encrypted protection system for a trained neural network
CN109284313B (en) Federal modeling method, device and readable storage medium based on semi-supervised learning
US10891161B2 (en) Method and device for virtual resource allocation, modeling, and data prediction
EP3970039A1 (en) Identity verification and management system
EP3707906B1 (en) Electronic apparatus and control method thereof
CN109564575A (en) Classified using machine learning model to image
CN107609506B (en) Method and apparatus for generating image
CN114298202A (en) Image encryption method and device, electronic equipment and storage medium
CN110929799B (en) Method, electronic device, and computer-readable medium for detecting abnormal user
CN112394974B (en) Annotation generation method and device for code change, electronic equipment and storage medium
CN110084317B (en) Method and device for recognizing images
WO2023216494A1 (en) Federated learning-based user service strategy determination method and apparatus
US11443045B2 (en) Methods and systems for explaining a decision process of a machine learning model
CN116129452A (en) Method, application method, device, equipment and medium for generating document understanding model
EP3798920A1 (en) Method and system for selectively encrypting dataset
CN112434620A (en) Scene character recognition method, device, equipment and computer readable medium
CN113722738B (en) Data protection method, device, medium and electronic equipment
US20220318675A1 (en) Secure environment for a machine learning model generation platform
CN113138847A (en) Computer resource allocation scheduling method and device based on federal learning
CN115880506A (en) Image generation method, model training method and device and electronic equipment
CN114493683A (en) Advertisement material recommendation method, model training method and device and electronic equipment
CN116129534A (en) Image living body detection method and device, storage medium and electronic equipment
CN105765567A (en) Generation of a communication request based on visual selection
CN113240430A (en) Mobile payment verification method and device

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination