CN115880537A

CN115880537A - Method and system for evaluating image quality of confrontation sample

Info

Publication number: CN115880537A
Application number: CN202310121665.7A
Authority: CN
Inventors: 温文媖; 黄明辉; 方玉明; 张玉书; 左一帆
Original assignee: Jiangxi University of Finance and Economics
Current assignee: Jiangxi University of Finance and Economics
Priority date: 2023-02-16
Filing date: 2023-02-16
Publication date: 2023-03-31
Anticipated expiration: 2043-02-16
Also published as: CN115880537B

Abstract

The invention provides a method and a system for evaluating the image quality of a confrontation sample, wherein the method comprises the following steps: screening out original images with confidence degrees larger than a confidence degree threshold value through a classifier to construct an anti-sample data set, attacking the anti-sample data set by using multiple anti-attack methods, and obtaining anti-samples by adjusting parameters of different attack methods; calculating a residual image of the countermeasure sample, performing feature pre-extraction on the original image, the countermeasure sample and the residual image by using a feature coding network, splicing feature graphs extracted from the original image, the countermeasure sample and the residual image to obtain a new feature graph, and processing the new feature graph and the feature graph of the countermeasure sample by using a multi-scale feature extraction network to obtain feature graphs of different scales; and measuring the characteristic graphs of different scales by using a structural similarity measurement method to obtain corresponding scores, and finally averaging the scores of all scales to obtain the final quality score. The method can effectively evaluate the image quality of the confrontation sample.

Description

Method and system for evaluating image quality of confrontation sample

Technical Field

The invention relates to the technical field of image processing, in particular to a method and a system for evaluating the image quality of a confrontation sample.

Background

At present, the deep neural network (DNN) The research of (1) has a breakthrough progress, is more widely applied to the aspects of image classification, semantic recognition and the like, and is successfully applied to real life, such as automatic driving, face recognition and the like. To lift upDNNThe work to find the limitations of deep learning is also ongoing, and in particular, methods for studying how to invade deep learning models are increasing, and the deep learning can promote the classification error or the recognition error of the deep learning. Relevant studies indicate that cases of fighting samples to interfere with deep learning models are prevalent in machine learning models. In particular, a given classifierDDefining a small perturbationrWill berAdding to original image

And (4) putting the image into a classifier, wherein the prediction result is different from the originally predicted label, namely the image class predicted by the classifier is an error class. In real life, it is very dangerous if the recognition system of automatic driving is added with countermeasure samples, causing the car to take unexpected and inappropriate actions. Since the strength of the confrontation sample indirectly reflectsDNNTherefore, it is necessary to improve the robustness of machine learning from the perspective of fighting samples.

The study of challenge samples helps to understand the image features used by the classifier, but the existence of these challenge samples is related toDNNThe generalization capability of the algorithm is contradictory. Although it is a matter of courseDNNAdvanced performance is shown in some areas, but robustness in the face of subtle perturbations is not high. In the face of disturbance which cannot be recognized by human eyes, it is worth studying how to judge whether the image is added with the disturbance. At present, researchers get through

The norm judges the similarity of the challenge sample and the original image to evaluate the strength of the challenge sample. In addition to that, is>

The norm is also used as a constraint to constrain the challenge model by continually decreasing the ≦ for the challenge sample>

The norm value optimizes the countermeasure model. However, with the findings of the study，/>

The norm ignores human visual perception in the process of measurement and is not suitable for evaluating the strength of the challenge sample. Therefore, how to effectively evaluate the quality of the countersample image is a technical problem to be solved by those skilled in the art.

Disclosure of Invention

To this end, an embodiment of the present invention proposes a countermeasure sample image quality evaluation method to effectively evaluate the countermeasure sample image quality.

The method for evaluating the image quality of the confrontation sample according to one embodiment of the invention comprises the following steps:

step 1, screening out original images with confidence degrees larger than a confidence degree threshold value through a classifier to construct an anti-sample data set, attacking the anti-sample data set by using multiple anti-attack methods, and obtaining an anti-sample by adjusting parameters of different attack methods;

step 2, calculating a residual image of the countermeasure sample, performing feature pre-extraction on the original image, the countermeasure sample and the residual image by using a feature coding network, splicing the feature maps extracted from the original image, the countermeasure sample and the residual image by splicing to obtain a new feature map, and further processing the new feature map and the feature map of the countermeasure sample by using a multi-scale feature extraction network to obtain feature maps of different scales;

and 3, measuring the characteristic graphs of different scales by using a structural similarity measuring method to obtain corresponding scores, and finally averaging the scores of all scales to obtain final quality scores.

According to the method for evaluating the image quality of the countermeasure sample, the original image with the confidence coefficient larger than the confidence coefficient threshold value is screened out through the classifier to construct the countermeasure sample data set, the image features are pre-extracted through the feature coding network, redundant information in the image is abandoned, and the receptive field is expanded; the hierarchical characteristics of a human visual perception system are simulated through multi-scale features, and the semantic information of the image is enriched; and acquiring a structural similarity score of the image by a structural similarity measurement method, and averaging to acquire a final quality score of the confrontation sample. The method can accurately extract the structure information of the confrontation sample under the disturbance, can more accurately calculate the quality of the confrontation sample through the structure similarity measurement method, has stronger effectiveness in the method for calculating the image quality of the confrontation sample, and has good expandability for the constructed confrontation sample.

In addition, the method for evaluating the image quality of the confrontation sample according to the embodiment of the invention may further have the following additional technical features:

further, step 1 specifically includes:

step 1.1, selecting four classifiers of VGG, resNet, alexNet and GoogleNet to obtain confidence coefficients of input images, and respectively marking the input images as confidence coefficients

For an input image->

When the input image is greater or less>

Is/are>

Greater than 90%, based on the number of the input images &>

As an original image with a confidence level greater than a confidence threshold；

Step 1.2, attacking the set of challenge sample data by using a plurality of challenge attack methods, wherein the plurality of challenge attack methods are FGSM, MI-FGSM, PI-FGSM, gaussian Noise, PGD, ODS-PGD, and the initial Epsilon value of each challenge method is (0.01, 0.1,0.2,0.3, 0.5), (0.5, 15,35, 55), (0.01, 0.1,0.2,0.3, 0.5), (0.03, 0.10,0.20, 0.30, 0.50).

Further, step 2 specifically includes:

step 2.1, based on the original image and the confrontation sample, calculating and generating a residual image by utilizing a normalized logarithmic difference function, wherein the calculation formula is as follows:

；

wherein ,

represents a pixel of the residual image, -is selected>

Represents a pixel of the original image, is selected>

Pixel representing a challenge sample, <' > or>

Representing an image normalization influence parameter;

step 2.2, constructing a feature coding network, wherein the input channel of the 1 st layer of convolution layer of the feature coding network is 3, the output channel is 32, the convolution kernel size is 3, the step length is 1, the input channels of the 2 nd, 3 rd and 4 th layers of convolution layers of the feature coding network are 32, the output channel is 32, the convolution kernel size is 3, and the step length is 1, and performing feature pre-extraction on the original image, the countermeasure sample and the residual image through the feature coding network to obtain feature maps of the original image, the countermeasure sample and the residual image;

step 2.3, the image quality evaluation method of the confrontation sample based on the multi-scale Feature extraction network splices the Feature maps of the original image, the confrontation sample and the residual image by using a splicing function Torque.

；

Wherein dim represents a dimension, and when dim =1, columns are spliced;

step 2.4, carrying out dimension reduction treatment on the new characteristic diagram for a plurality of times;

step 2.5, inputting the new feature diagram obtained in the step 2.4 after the dimension reduction treatment and the feature diagram of the countermeasure sample obtained in the step 2.2 into a multi-scale feature extraction network to obtain features of different scales, namely feature diagrams

And antagonistic samples>

。/>

Further, in step 2.1,

is 1.

Further, step 3 specifically includes:

step 3.1, based on the characteristic diagram

And antagonistic samples>

Measuring feature graphs of different scales by using a structural similarity measurement method to obtain corresponding scores, wherein a calculation formula is as follows:

；

wherein ,

represents a dimension pick>

Corresponding score, <' > or>

and />

Respectively represents a scale->

Is based on a characteristic map>

And antagonizing the sample>

Is greater than or equal to>

Represents a dimension pick>

Characteristic map of>

And antagonizing the sample>

The covariance of (a) is determined,Cto prevent a natural number with a denominator of 0;

step 3.2, averaging the scores of all scales to obtain a final mass score, wherein the calculation formula is as follows:

；

wherein ,

the final mass fraction is represented as a function of,nrepresenting the total number of scales.

Another embodiment of the present invention provides a countermeasure sample image quality evaluation system for effectively evaluating the countermeasure sample image quality.

The countermeasure sample image quality evaluation system according to an embodiment of the invention includes:

the image preprocessing module is used for screening out original images with confidence degrees larger than a confidence degree threshold value through the classifier to construct an anti-sample data set, attacking the anti-sample data set by utilizing multiple anti-attack methods, and obtaining anti-samples by adjusting parameters of different attack methods;

the calculation splicing module is used for calculating a residual image of the countermeasure sample, performing feature pre-extraction on the original image, the countermeasure sample and the residual image by using a feature coding network, splicing feature maps extracted from the original image, the countermeasure sample and the residual image by splicing to obtain a new feature map, and further processing the new feature map and the feature map of the countermeasure sample by using a multi-scale feature extraction network to obtain feature maps of different scales;

and the score calculating module is used for measuring the characteristic graphs of different scales by using a structural similarity measuring method to obtain corresponding scores, and finally averaging the scores of all scales to obtain the final quality score.

According to the countermeasure sample image quality evaluation system provided by the embodiment of the invention, the original image with the confidence coefficient larger than the confidence coefficient threshold value is screened out through the classifier to construct the countermeasure sample data set, the image characteristics are pre-extracted through the characteristic coding network, redundant information in the image is abandoned, and the receptive field is expanded; the hierarchical characteristics of a human visual perception system are simulated through multi-scale features, and the semantic information of the image is enriched; and acquiring a structural similarity score of the image by a structural similarity measurement method, and averaging to acquire a final quality score of the confrontation sample. The method can accurately extract the structure information of the confrontation sample under the disturbance, can more accurately calculate the quality of the confrontation sample through the structure similarity measurement method, has stronger effectiveness in the method for calculating the image quality of the confrontation sample, and has good expandability for the constructed confrontation sample.

In addition, the system for evaluating the image quality of the confrontation sample according to the above embodiment of the present invention may further have the following additional technical features:

further, the image preprocessing module is specifically configured to perform the following steps:

step 1.1, selecting four classifiers of VGG, resNet, alexNet and GoogleNet to obtain the confidence coefficient of the input image, and marking the classifiers as

For an input image>

When an image is input>

In:>

greater than 90%, based on the number of the input images &>

As an original image with a confidence level greater than a confidence level threshold; />

Step 1.2, attacking the set of challenge sample data by using a plurality of challenge attack methods, wherein the plurality of challenge attack methods are FGSM, MI-FGSM, PI-FGSM, gaussian Noise, PGD, ODS-PGD, and the initial Epsilon value of each challenge method is (0.01, 0.1,0.2,0.3, 0.5), (0.5, 5,15,35, 55), (0.01, 0.1,0.2,0.3, 0.5), (0.03, 0.10,0.20, 0.30, 0.50).

Further, the calculation splicing module is specifically configured to perform the following steps:

；

wherein ,

pixel representing a residual image>

Represents a pixel of an original image>

Pixel representing a challenge sample, <' > or>

Representing image normalization influence parameters;

step 2.3, the method for evaluating the image quality of the confrontation sample based on the multi-scale Feature extraction network splices the Feature maps of the original image, the confrontation sample and the residual image by using a splicing function torch.cat (), so as to obtain a new Feature map, wherein the splicing process comprises the following steps:

；

wherein dim represents dimension, and when dim =1, it represents that columns are spliced;

And antagonizing the sample>

。

Further, the air conditioner is provided with a fan,

is 1.

Further, the score calculating module is specifically configured to perform the following steps:

step 3.1, based on the characteristic diagram

And antagonizing the sample>

；

wherein ,

represents a dimension pick>

Corresponding score, <' > or>

and />

Respectively represents a scale->

Is based on a characteristic map>

And antagonizing the sample>

Is greater than or equal to>

Represents a dimension pick>

Is based on a characteristic map>

And antagonizing the sample>

The covariance of (a) of (b),Cto prevent a natural number with a denominator of 0;

step 3.2, averaging the scores of all scales to obtain the final mass score, wherein the calculation formula is as follows:

；

wherein ,

the final mass fraction is represented as a function of,nrepresenting the total number of scales. />

Drawings

The above and/or additional aspects and advantages of embodiments of the present invention will become apparent and readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings of which:

FIG. 1 is a flow chart illustrating a method for evaluating image quality of a challenge sample according to an embodiment of the present invention;

FIG. 2 is a graph of the different confidences of 50 images on the four classifiers VGG, resNet, alexNet and GoogleNet;

fig. 3 is a block diagram of a countermeasure sample image quality evaluation system according to an embodiment of the invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

Referring to fig. 1, an embodiment of the invention provides a method for evaluating image quality of a confrontation sample, including the following steps:

step 1, screening out original images with confidence degrees larger than a confidence degree threshold value through a classifier to construct an anti-sample data set, attacking the anti-sample data set by utilizing multiple anti-attack methods, and obtaining anti-samples by adjusting parameters of different attack methods.

In the embodiment, the classifier with wider application and stronger performance is used for screening out the image with higher confidence coefficient, so that the attack effect of the anti-attack method can be detected and the robustness of the classification model can be verified.

Because not all images in the selected image dataset meet the requirements, partial images contain less characteristic information, and the classifier has images with lower confidence, although no disturbance is added, the classifier is wrongly classified or has lower accuracy, so that a standard needs to be formulated to screen the images, namely, a plurality of classifiers are selected to obtain the confidence of each original image. The 4 classifiers are more popular at present and are more widely applied.

Specifically, the step 1 comprises:

For an input image>

When an image is input>

Is/are>

Greater than 90%, based on the number of the input images &>

As an original image with a confidence level greater than a confidence level threshold;

according to the final data, 35 images meeting the requirements are selected, and the images can better verify the robustness of the classification model and the effect of the anti-attack method. Referring to fig. 2, fig. 2 shows the confidence of 50 sub-images in the classifier, wherein 0-50 in the abscissa represents 50 sub-images, and the classifier (1), the classifier (2), the classifier (3) and the classifier (4) represent different classifiers, which correspond to GoogleNet, resNet, VGG and Alexnet, respectively. In addition, the ordinate represents the confidence of different images on the classifier, such as: the confidence of image 1 on classifier (1) is 100%, the confidence on classifier (2) is 100%, the confidence on classifier (3) is 100%, and the confidence on classifier (4) is 86%.

The various anti-attack methods are FGSM, MI-FGSM, PI-FGSM, gaussian Noise, PGD, ODS-PGD, which include representative and advanced anti-attack methods. After the counterattack method is selected, in order to better verify the influence of parameters in the counterattack sample on the model, the counterattack samples with different grades are generated by adjusting parameters such as Epsilon in the method.

Through the step 1, images showing high confidence in the classification model can be screened out, the influence of classification errors of the classification model on the final image quality score and the classification model robustness caused by low confidence images is reduced, and the influence of the attack method under different grades is verified by adjusting parameters of the anti-attack method.

And 2, calculating a residual image of the countermeasure sample, performing feature pre-extraction on the original image, the countermeasure sample and the residual image by using a feature coding network, splicing the feature maps extracted from the original image, the countermeasure sample and the residual image to obtain a new feature map, and further processing the new feature map and the feature map of the countermeasure sample by using a multi-scale feature extraction network to obtain feature maps of different scales.

The final result of the quality evaluation method is to match the human visual system, so that the constructed quality evaluation method is more consistent with the human visual system. In this embodiment, the evaluation method is further enhanced by using the residual image. The residual image is not only an average objective error map, but also weights each pixel value in the image to reflect the human visual perception system. In addition, the normalized logarithmic difference function is used for optimizing the residual image, zero values in the residual image are reduced, and the influence of the zero values on training convergence is reduced.

In this embodiment, step 2 specifically includes:

；

wherein ,

pixel representing a residual image>

Represents a pixel of the original image, is selected>

Pixel representing a challenge sample, <' > or>

Representing image normalization influence parameters; when/is>

The smaller the influence of other factors (e.g., pixel values, distortion, etc.) on the image, the smaller is the->

Is set to 1.

wherein, the image characteristics are extracted, and a characteristic coding network is utilized. The single layer 3 x 3 convolutional layer extracts features from the image, reducing the size of the receptive field, which is detrimental to image quality evaluation. In order to enlarge the receptive field, obtain more image characteristics and enhance the human perception image quality, therefore, in the present invention, multiple convolutional layers are used to obtain more image distortion information and more high-level and low-level semantic information. And constructing a characteristic coding network, wherein the characteristic coding network comprises 4 convolutional layers, the input channel of the convolutional layer 1 is 3, the output channel of the convolutional layer 1 is 32, the size of a convolutional kernel is 3, and the step length is 1. The input channel of the convolution layers of the 2 nd, 3 rd and 4 th layers is 32, the output channel is 32, and the rest is the same as the first layer network, so that the characteristic diagrams of the original image, the confrontation sample and the residual image are obtained.

；/>

specifically, a new Feature map Feature _ map is obtained by splicing, so that the quality score of the image is predicted conveniently by comparing image features. Therefore, dimension reduction processing is carried out, and Feature _ map is subjected to secondary dimension reduction by using a convolution network of 1 x 1. Assuming the feature map is 1 × 96 × 224 by stitching, first, a first dimensionality reduction is performed using convolution layers, with an input channel of 96, an output channel of 64, a convolution kernel size of 1, and a step size of 0, i.e., the feature map is output as 1 × 64 × 224. In the same operation, after the second dimensionality reduction operation, the obtained characteristic diagram is 1 × 32 × 224.

And antagonizing the sample>

。

The quality of the network prediction image coded by using the features is only insufficient, and in the process, although the receptive field is enlarged, more redundant information still exists. In addition, in the process of evaluating the image quality, besides the receptive field, the image global information and the semantic information are also considered. Therefore, in order to obtain more global information and semantic information, the advantages of the multi-scale feature extraction network are combined. The multi-scale feature extraction network well simulates the layering sense of a human visual system and obtains more structural information. Therefore, the obtained feature map after dimensionality reduction and the feature coding network are put into a multi-scale feature extraction network for the feature map for resisting sample processing to obtain features of different scales, namely the feature map

And antagonizing the sample>

. wherein ,/>

Represents a scale, in the present embodiment, based on the measured value>

Has a value range of [1,2,3,4 ]]。

And 3, measuring the characteristic graphs of different scales by using a structural similarity measurement method to obtain corresponding scores, and finally averaging the scores of all scales to obtain the final quality score.

The structural change of the image in the process of generating the countermeasure sample is small, and the feature coding network and the multi-scale feature extraction network acquire more and more detailed structural information. The image quality is predicted using a structural similarity metric method.

Wherein, step 3 specifically includes:

step 3.1, based on the characteristic diagram

And antagonizing the sample>

；

wherein ,

represents a dimension pick>

Corresponding score, based on the number of points in the image>

and />

Respectively represents a scale->

Is based on a characteristic map>

And antagonizing the sample>

Is greater than or equal to>

Represents a dimension pick>

Is based on a characteristic map>

And antagonizing the sample>

The covariance of (a) of (b),Cto prevent the denominator from being a natural number of 0. In the present embodiment, the first and second electrodes are,Ctaking 0.01;

；

wherein ,

It is important to apply various evaluation indexes to measure the effectiveness of the algorithm, and the pearson coefficients (c) and (d) of different evaluation methodsPLCC) The Spireman coefficient (C:)SRCC) Kendel correlation coefficient: (KRCC) Root mean square error (RMS) <RMSE) The correlation between the subjective score and the objective score can be effectively verified. When in usePLCC、SRCC、KRCCThe closer to 1 the more closely the image is,RMSEcloser to 0, indicating a better linear relationship between subjective score and objective score. Table 1 shows the performance of the method of this embodiment compared to other existing image quality evaluation algorithms.

Table 1:

as can be seen from Table 1, this exampleCompared with other existing image quality evaluation algorithms,PLCC、SRCC、 KRCCis closer to 1, andRMSEcloser to 0, the method of the present embodiment is illustrated to clearly prioritize other existing image quality evaluation algorithms.

In conclusion, according to the method for evaluating the image quality of the countermeasure sample provided by the invention, the original image with the confidence coefficient greater than the confidence coefficient threshold value is screened out through the classifier to construct the countermeasure sample data set, the image features are pre-extracted through the feature coding network, redundant information in the image is abandoned, and the receptive field is expanded; the hierarchical characteristics of a human visual perception system are simulated through multi-scale features, and the semantic information of the image is enriched; and acquiring a structural similarity score of the image by a structural similarity measurement method, and averaging to acquire a final quality score of the confrontation sample. The method can accurately extract the structure information of the confrontation sample under the disturbance, can more accurately calculate the quality of the confrontation sample through the structure similarity measurement method, has stronger effectiveness in the method for calculating the image quality of the confrontation sample, and has good expandability for the constructed confrontation sample.

Referring to fig. 3, another embodiment of the present invention provides a system for evaluating image quality of a confrontation sample, including:

the image preprocessing module is used for screening out original images with confidence degrees larger than a confidence degree threshold value through the classifier to construct an anti-sample data set, attacking the anti-sample data set by utilizing multiple anti-attack methods and obtaining anti-samples by adjusting parameters of different attack methods;

the calculation splicing module is used for calculating a residual image of the countermeasure sample, performing feature pre-extraction on the original image, the countermeasure sample and the residual image by using a feature coding network, splicing the feature maps extracted from the original image, the countermeasure sample and the residual image to obtain a new feature map by splicing, and further processing the new feature map and the feature map of the countermeasure sample by using a multi-scale feature extraction network to obtain feature maps of different scales;

In this embodiment, the image preprocessing module is specifically configured to perform the following steps:

For an input image->

When an image is input>

Is/are>

Greater than 90%, based on the number of the input images &>

As an original image with a confidence level greater than a confidence threshold;

In this embodiment, the calculation splicing module is specifically configured to execute the following steps:

；

wherein ,

pixel representing a residual image>

Represents a pixel of the original image, is selected>

Pixels representing antagonistic samples>

Representing an image normalization influence parameter;

step 2.2, constructing a feature coding network, wherein the input channel of the 1 st layer of convolution layer of the feature coding network is 3, the output channel is 32, the size of a convolution kernel is 3, the step length is 1, the input channels of the 2 nd, 3 th and 4 th layers of convolution layers of the feature coding network are 32, the output channel is 32, the size of the convolution kernel is 3, the step length is 1, and performing feature pre-extraction on the original image, the countermeasure sample and the residual image through the feature coding network to obtain feature maps of the original image, the countermeasure sample and the residual image;

；

And antagonizing the sample>

。

In the present embodiment of the present invention,

is 1.

In this embodiment, the score calculating module is specifically configured to execute the following steps:

step 3.1, based on the characteristic diagram

And antagonistic samples>

；

wherein ,

represents a dimension pick>

Corresponding score, <' > or>

and />

Respectively represent a scale>

Is based on a characteristic map>

And antagonizing the sample>

Is greater than or equal to>

Represents a dimension pick>

Is based on a characteristic map>

And antagonizing the sample>

；

wherein ,

In conclusion, according to the countermeasure sample image quality evaluation system provided by the invention, the original image with the confidence coefficient greater than the confidence coefficient threshold value is screened out through the classifier to construct the countermeasure sample data set, the image features are pre-extracted through the feature coding network, redundant information in the image is abandoned, and the receptive field is expanded; the hierarchical characteristics of a human visual perception system are simulated through multi-scale features, and the semantic information of the image is enriched; and acquiring a structural similarity score of the image by a structural similarity measurement method, and averaging to acquire a final quality score of the confrontation sample. The method can accurately extract the structure information of the confrontation sample under the disturbance, can more accurately calculate the quality of the confrontation sample through the structure similarity measurement method, has stronger effectiveness in the method for calculating the image quality of the confrontation sample, and has good expandability for the constructed confrontation sample.

In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

While embodiments of the invention have been shown and described, it will be understood by those of ordinary skill in the art that: various changes, modifications, substitutions and alterations can be made to the embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A method for evaluating the image quality of a confrontation sample is characterized by comprising the following steps:

step 1, screening out original images with confidence degrees larger than a confidence degree threshold value through a classifier to construct an anti-sample data set, attacking the anti-sample data set by utilizing multiple anti-attack methods, and obtaining anti-samples by adjusting parameters of different attack methods;

2. The method for evaluating the image quality of a confrontational sample according to claim 1, wherein step 1 specifically comprises:

For an input image->

When the input image is greater or less>

Is/are>

If at least three of these are greater than 90%, the input image is->

3. The method for evaluating the image quality of a confrontational sample according to claim 2, wherein the step 2 specifically comprises:

step 2.1, based on the original image and the confrontation sample, calculating and generating a residual image by using a normalized logarithmic difference function, wherein the calculation formula is as follows:

；

wherein ,

represents a pixel of the residual image, -is selected>

Represents a pixel of the original image, is selected>

Pixel representing a challenge sample, <' > or>

Representing image normalization influence parameters;

；

And antagonizing the sample>

。/>

4. The countermeasure sample image quality evaluation method of claim 3, wherein, in step 2.1,

is 1.

5. The method for evaluating the image quality of a confrontational sample according to claim 3, wherein step 3 specifically comprises:

step 3.1, based on the characteristic diagram

And antagonizing the sample>

；

wherein ,

represents a dimension pick>

Corresponding score, <' > or>

and />

Respectively represents a scale->

Is based on a characteristic map>

And antagonizing the sample>

Is greater than or equal to>

Represents a dimension pick>

Is based on a characteristic map>

And antagonistic samples>

；

wherein ,

6. A countermeasure sample image quality evaluation system, comprising:

7. The system for image quality evaluation of confrontational samples according to claim 6, wherein said image preprocessing module is specifically configured to perform the steps of:

For an input image->

When an image is input>

Is/are>

Greater than 90%, based on the number of the input images &>

8. The system for image quality evaluation of confrontational sample according to claim 7, wherein said computational stitching module is specifically configured to perform the steps of: