WO2020233564A1 - 一种对抗样本的检测方法及电子设备 - Google Patents

一种对抗样本的检测方法及电子设备 Download PDF

Info

Publication number
WO2020233564A1
WO2020233564A1 PCT/CN2020/091027 CN2020091027W WO2020233564A1 WO 2020233564 A1 WO2020233564 A1 WO 2020233564A1 CN 2020091027 W CN2020091027 W CN 2020091027W WO 2020233564 A1 WO2020233564 A1 WO 2020233564A1
Authority
WO
WIPO (PCT)
Prior art keywords
electronic device
value
picture
sample
pixel
Prior art date
Application number
PCT/CN2020/091027
Other languages
English (en)
French (fr)
Inventor
李实�
赵晓娜
王思善
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020233564A1 publication Critical patent/WO2020233564A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G06V40/16—Human faces, e.g. facial parts, sketches or expressions

Definitions

  • This application relates to the field of image recognition, and in particular to a detection method and electronic equipment for countermeasure samples.
  • Deep learning is the core technology applied in the field of machine learning and artificial intelligence today. In the field of machine vision, it has become the main force in face recognition, autonomous driving, surveillance, and security applications.
  • the deep learning network is very vulnerable to slight disturbances in the input, and these slight disturbances will cause the deep learning network to output incorrect recognition results.
  • a slight disturbance when the pixel value of some pixels in the input picture of the deep learning network changes (that is, a slight disturbance), it will cause the deep learning network to output incorrect recognition results. This slight disturbance is not easy to detect by the human eye, but it can completely deceive the deep learning network.
  • FIG. 1 is an example of an adversarial sample attack.
  • a certain amount of perturbation that is not easily detectable by the human eye is added to the panda picture (that is, the input picture) (that is, the pixel value of some pixels of the input picture is changed), and the result is the output picture Misidentified as a gibbon by the deep learning network.
  • the output picture appears to the human eye, but it is no different from the input picture.
  • the above-mentioned method of countering sample attacks can only be performed on pictures that already exist in the device (that is, the pixel values of some pixels are changed on the pictures that exist in the device).
  • the device cannot perform pixel interference processing on the face picture taken at the current moment (that is, the real-time face picture taken with the camera turned on).
  • the attacker wears specially processed adversarial items (such as adversarial glasses/eyeglass frames, adversarial stickers, etc.)
  • the face recognition system recognizes as a pre-designated person (ie, victim).
  • the adversarial sample and the original input picture are used as the training data set, and the training data set is input into the deep learning network for model training, and the adversarial sample detector is generated.
  • the counter-example detector can detect whether the input picture is a counter-example.
  • the adversarial sample detector can only detect the adversarial samples generated by the known adversarial sample generator, and it is desired that the adversarial sample detector can detect all For adversarial examples, it is necessary to train adversarial examples generated by all kinds of adversarial example generators. This operation is not only costly but also difficult to implement.
  • the denoiser can only process the adversarial samples generated by the known adversarial sample generator, and it needs to know in advance whether there is an adversarial sample attack.
  • the method also needs to know in advance the recognition result of the attacker's original picture in the picture recognition system, that is, it needs to know in advance who the attacker is, which is difficult to achieve in actual application scenarios.
  • the first aspect of the embodiments of the present application provides a detection method for adversarial samples.
  • the detection method is applied to face recognition scenarios of electronic devices (such as face payment on mobile phones, face unlocking, etc.), which specifically includes:
  • the electronic device can collect a face image at the current moment through the camera equipment (for example, a face picture taken at the current moment or a face picture intercepted from a camera video taken at the current moment).
  • the camera equipment can be the camera that comes with the electronic device, or it can be a camera that is physically separated from the electronic device but connected wirelessly (for example, the phone's camera is not turned on, the phone's camera is damaged or The mobile phone does not have its own camera, but there is a handheld camera connected to the mobile phone via Bluetooth).
  • the specific camera equipment is not limited here.
  • the electronic device can collect the face image at the current moment through the camera equipment in various forms.
  • the electronic device can be in response to the triggering of a certain operation instruction, that is, the execution of a certain operation instruction will trigger the electronic device to pass
  • the camera collects the face image at the current moment, or the camera equipment is always on. As long as the camera equipment captures the face image at the current moment, the electronic device collects the face image. Specifically, the electronic device collects the current moment
  • the form of the face image is not limited. If the electronic device detects an obstruction (such as glasses, stickers, etc.) within the face area in the face image taken at the current moment, the electronic device will further determine whether the obstruction is an anti-sample interference object. If the device determines that the obstruction is a counter-sample interference, the electronic device will determine that the face image taken at the current moment is a counter-sample (that is, it has suffered a counter-sample attack).
  • an obstruction such as glasses, stickers, etc.
  • the adversarial sample detection method used in the embodiments of this application is applied to face recognition scenarios. This detection method does not require deep model training on a large number of adversarial sample pictures, nor does it need to know which generator is used to generate the adversarial sample.
  • a kind of adversarial sample generation algorithm (including the known or newly generated adversarial sample generation algorithm), and it can detect whether there is an adversarial sample without knowing the face image of the attacker in advance, so that the attacker cannot realize the adversarial sample attack . And this detection method is low in complexity and easy to implement.
  • the electronic device judging whether the obstruction is an anti-sample interference object may include: firstly, the pixels of all pixels in the obstruction The value is calculated to obtain the image entropy value of the occluder; then, the calculated image entropy value of the occluder is compared with a preset threshold (ie, the preset threshold) to determine whether the occluder is against sample interference Things.
  • the preset threshold may be determined according to the first preset method. For example, the preset threshold determined by the first preset method may be set by the user according to experience values, or may be calculated based on a deep learning network. There is no limitation here. Finally, if the picture entropy value is greater than the aforementioned preset threshold, it is determined that the obstruction is an anti-sample interference object.
  • the image entropy value of the obstruction is calculated, and the image entropy value is compared with a preset threshold to determine whether the obstruction is against the sample interference object, which has practical operability.
  • the pixel values of all pixels in the occluder are calculated to obtain the picture entropy of the occluder Values can include: the pixel values of all pixels in the occluder are decomposed into a first vector pixel value (also called X-axis pixel value) and a second vector pixel value (also called Y-axis pixel value) in the color space ) And the third vector pixel value (also referred to as the Z-axis pixel value) to obtain a first set of first vector pixel values, a second set of second vector pixel values, and a third set of third vector pixel values; After that, the first picture entropy value of the first set, the second picture entropy value of the second set, and the third picture entropy value of the third set are respectively calculated according to the entropy value calculation formula; finally, the first picture entropy value of the first set, the second picture entropy value of the second set, and the third picture entropy value of the third set are respectively
  • the above-mentioned entropy calculation formula may be: Where i is the value of each element in the first set, the second set, or the third set, p i is the probability of the occurrence of i, H is the entropy value of the first picture, the second set The picture entropy value or the third picture entropy value. That is to say, if the occluder is a gray picture, the pixel values of all pixels in the occluder have the same value on each coordinate axis in the color space (such as the RGB color model).
  • the entropy value of the image of the occluder can be calculated by the entropy value calculation formula To obtain, where i is the pixel value of each pixel in the occluder, p i is the probability that the pixel value i appears, and H is the image entropy value of the occluder. If the occluder is a color picture, the entropy value of the picture on each coordinate axis of the occluder in the color space can still be calculated according to the entropy value calculation formula used when calculating the gray picture. Calculated.
  • i is the value of each pixel value in the first set
  • p i is the probability that i appears
  • H is the first picture entropy
  • i is the value of each pixel value in the second set
  • p i is the probability that i appears
  • H is the second picture entropy value
  • i is the value of each pixel value in the third set
  • p i is the probability that i appears
  • H is the third picture entropy value.
  • one of the specific entropy value calculation formulas is given, and the calculation formula is applicable to all pictures (including gray pictures and color pictures), and has a wide range of application and operability.
  • the detection method may further include:
  • the confrontation sample is processed according to the second preset manner, and the processed confrontation sample is identified to obtain a recognition result.
  • the purpose of the processing is to eliminate the influence of the anti-sample interference object.
  • the anti-sample interference object can be directly removed, or the anti-sample interference object can be converted into a common obstruction. The specifics are not limited here.
  • the electronic device can directly The face image is recognized, and the recognition result is obtained.
  • the purpose of re-identifying the processed obstruction is to prevent misidentification and improve user experience.
  • the second preset manner may include:
  • the pixel value x of all pixels in the object is processed by algebraic linear transformation. For example, modify the pixel values of all pixels in the anti-sample interference object to (255-x) or 0.5*(255-x), and the specific form of algebraic linear transformation processing is not limited here.
  • the target pixel value may include:
  • a pixel value is selected as the target pixel value
  • the electronic device determines the After the face image is a confrontational sample (that is, the recognition result is not the owner of the electronic device), the electronic device can further generate a reminder notification, which is used to remind the relevant user that the electronic device is being attacked by the confrontational sample.
  • the relevant user can Is the owner of the electronic device (ie the victim), then the reminder notification can remind the victim to deal with it in time (such as changing the payment password, alarming), and the relevant user can also be a service provider corresponding to the electronic device (such as: the attacker uses The victim’s mobile phone is used for online payment at Renrenle Supermarket, then the corresponding service merchant is the cashier platform of Renrenle Supermarket).
  • the reminder notification can be a service provider corresponding to the electronic device (such as: the attacker uses The victim’s mobile phone is used for online payment at Renrenle Supermarket, then the corresponding service merchant is the cashier platform of Renrenle Supermarket).
  • the reminder notification is reminded in the form of voice broadcast, alarm bell, etc. on the electronic device.
  • a corresponding reminder notification is generated to remind the relevant user, the specific practicality.
  • the first preset manner for determining the preset threshold may include:
  • a large number of (such as M, M ⁇ 1) normal face images (ie, reference face images) are acquired offline, and there are no occlusions in the face area of these face images (ie faces without any disturbance)
  • the original picture) or there are ordinary obstructions such as: wearing ordinary glasses, band-aids, masks, etc.; after that, you can calculate the pixel value of each normal face image obtained to obtain each normal
  • the picture entropy value of the face image that is, M target picture entropy values are obtained).
  • the calculation method of the picture entropy value can be obtained by the above entropy calculation formula; finally, the picture entropy values corresponding to all normal face images are taken arithmetic Average value, the arithmetic average value obtained can be used as the preset threshold.
  • the ninth implementation manner of the first aspect of the embodiments of the present application if the image entropy value is less than or equal to the preset threshold, it is determined that the obstruction is Ordinary obstruction; afterwards, the electronic device recognizes the ordinary obstruction and obtains the recognition result.
  • the obstruction is a common obstruction, then normal recognition is sufficient, which does not affect the normal use of the user and improves the user experience.
  • a second aspect of the embodiments of the present application provides an electronic device, which may include: one or more camera equipment; one or more touch screens; one or more processors; one or more memories;
  • the one or more memories stores one or more computer programs, and the one or more computer programs include instructions.
  • the electronic device is caused to perform the following steps:
  • the face image is determined to be the anti-sample.
  • the electronic device when the instruction is executed by the electronic device, the electronic device can also perform the following steps:
  • the obstruction is the anti-sample interference object.
  • the electronic device when the instruction is executed by the electronic device, the electronic device can also perform the following steps :
  • the pixel values of all pixels in the occluder are decomposed into the first vector pixel value, the second vector pixel value and the third vector pixel value in the color space to obtain the first set of the first vector pixel value and the second vector pixel value
  • the entropy value calculation formula may include:
  • i is the value of each element in the first set, the second set or the third set
  • p i is the probability of the occurrence of i
  • H is the first picture entropy value and the second picture entropy value Or the entropy value of the third picture.
  • the electronic device determines The obstruction is the anti-sample jammer, and when the instruction is executed by the electronic device, the electronic device can also perform the following steps:
  • the second preset manner includes:
  • the pixel values of all pixels in the anti-sample interference object are transformed algebraically linearly.
  • the determining the target pixel value includes:
  • the electronic device determines After the face image is a confrontational sample, when the instruction is executed by the electronic device, the electronic device further executes the following steps:
  • the first preset manner includes:
  • the reference face images are face images without obstructions or common obstructions within the face area, where M ⁇ 1;
  • the arithmetic mean of the entropy values of the M target pictures respectively corresponding to the M reference face images is the preset threshold.
  • the electronic device can also execute the following steps:
  • the third aspect of the embodiments of the present application further provides an electronic device, and the electronic device may specifically include:
  • the collection unit is used to collect the face image at the current moment through the camera equipment
  • the determining unit is configured to determine that the face image is a confrontational sample if the obstruction is the confrontational sample interferer.
  • the determining unit includes:
  • the calculation subunit is used to calculate the pixel values of all pixels in the occluder to obtain the image entropy value of the occluder;
  • a judging subunit for judging whether the picture entropy value is greater than a preset threshold, and the preset threshold is determined according to a first preset manner
  • the first determining subunit is configured to determine that the obstruction is the anti-sample interference if the picture entropy value is greater than the preset threshold.
  • the calculation subunit is specifically configured to:
  • the pixel values of all pixels in the occluder are decomposed into the first vector pixel value, the second vector pixel value and the third vector pixel value in the color space to obtain the first set of the first vector pixel value and the second vector pixel value
  • the entropy value calculation formula includes:
  • i is the value of each element in the first set, the second set or the third set
  • p i is the probability of the occurrence of i
  • H is the first picture entropy value and the second picture entropy value Or the entropy value of the third picture.
  • the electronic device further includes:
  • a processing unit configured to process the adversarial sample according to a second preset manner
  • the recognition unit is used for recognizing the processed adversarial sample to obtain the recognition result.
  • the second preset manner includes:
  • the pixel values of all pixels in the anti-sample interference object are transformed algebraically linearly.
  • the determining the target pixel value includes:
  • Determining the pixel value of any pixel in the counter-sample interference object is the target pixel value
  • the electronic device when determining the face After the image is the adversarial sample, also includes:
  • Broadcast unit used for voice broadcast of the reminder notification
  • the sending unit is configured to send the reminder notification to the corresponding server; and/or, send the reminder notification to the associated target electronic device.
  • the first preset manner includes:
  • the reference face images are face images without obstructions or common obstructions in the face area, where M ⁇ 1;
  • the arithmetic mean of the entropy values of the M target pictures respectively corresponding to the M reference face images is the preset threshold.
  • the determining unit further includes:
  • the second determining subunit is configured to determine that the obstruction is a normal obstruction if the image entropy value is less than or equal to the preset threshold;
  • the identification unit is specifically used to identify the ordinary obstruction to obtain the identification result.
  • a fourth aspect of the embodiments of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, and when it runs on a computer, the computer can execute any of the first aspect and the first aspect. Possible implementation methods of detection methods.
  • the fifth aspect of the embodiments of the present application provides a computer program product containing instructions, which, when run on a computer, enables the computer to execute the detection method of the first aspect and any one of the possible implementation manners of the first aspect.
  • the electronic device collects the face image at the current moment through the camera equipment (such as the camera on the electronic device, or the camera physically separated from the electronic device but connected wirelessly) at the current moment (such as the face picture taken at the current moment or from the current moment) Face pictures taken from video recordings). If the electronic device detects an obstruction (such as glasses, stickers, etc.) within the face area in the face image taken at the current moment, the electronic device will further determine whether the obstruction is an anti-sample interference object. If the device determines that the obstruction is a counter-sample interference, the electronic device will determine that the face image taken at the current moment is a counter-sample (that is, it has suffered a counter-sample attack).
  • the camera equipment such as the camera on the electronic device, or the camera physically separated from the electronic device but connected wirelessly
  • the electronic device detects an obstruction (such as glasses, stickers, etc.) within the face area in the face image taken at the current moment
  • the electronic device will further determine whether the obstruction is an anti-sample interference object
  • the adversarial sample detection method used in the embodiments of this application is applied to face recognition scenarios. This detection method does not require deep model training on a large number of adversarial sample pictures, nor does it need to know which generator is used to generate the adversarial sample.
  • a kind of adversarial sample generation algorithm (including the known or newly generated adversarial sample generation algorithm), and it can detect whether there is an adversarial sample without knowing the face image of the attacker in advance, so that the attacker cannot realize the adversarial sample attack . And this detection method is low in complexity and easy to implement.
  • FIG. 1 is a schematic diagram of an example of countering a sample attack in the prior art
  • FIG. 2 is a schematic diagram of an implementation manner of combating sample attacks in a face recognition application scenario
  • Figure 3 is a schematic diagram of the correspondence between the confrontation sample item and the victim
  • Figure 4 is another schematic diagram of the correspondence between the confrontation sample item and the victim
  • FIG. 5 is a schematic diagram of the adversarial sample detection method in an embodiment of the application.
  • Fig. 6 is a schematic diagram of calculation results of image entropy values of several different pixel point distributions
  • FIG. 7 is an implementation manner of processing the generated reminder notification in an embodiment of the application.
  • FIG. 8 is another implementation manner of processing the generated reminder notification in an embodiment of the application.
  • FIG. 9 is a schematic diagram of a reminder notification generated in an embodiment of the application being sent to a server corresponding to an electronic device;
  • FIG. 10 is a schematic diagram of a reminder notification generated in an embodiment of the application being sent to the associated target electronic device corresponding to the electronic device;
  • FIG. 11 is a schematic diagram of an electronic device in an embodiment of the application.
  • FIG. 12 is another schematic diagram of an electronic device in an embodiment of the application.
  • FIG. 13 is a hardware architecture diagram of an electronic device in an embodiment of the application.
  • Fig. 14 is a software architecture diagram of an electronic device in an embodiment of the application.
  • attacker A wears a specially processed anti-sample glasses frame a, in the application scenario of face recognition (such as: attacker A is using the person in the mobile phone Face payment), the electronic device (such as: mobile phone) collects the face image of the attacker A wearing the anti-sample glasses frame (denoted as frame a) through the camera at the moment, then the electronic device will recognize the attacker A as The victim V1 successfully completes the face payment function of the mobile phone (here it is assumed that the target face image of the face payment set in the mobile phone is the victim V1).
  • attacker B and attacker C can use similar
  • the attack method (such as wearing frame b and c) is identified by the electronic device as victim V2 and victim V3.
  • one of the above-mentioned recognition application scenarios includes: an attacker wearing a counter-sample item can correspond to multiple victims, and the corresponding multiple victims are determined by the deep learning network when the corresponding counter-sample item is generated. of.
  • the attacker can first determine the victim (such as: victim V11, Victim V12, victim V13) and the number of victims (such as: 3) and other requirements, then, according to the above needs of the attacker, the deep learning network uses a specific algorithm to generate the corresponding frame a1, and the attacker wears the frame a1 After that, it can be recognized by the electronic device as victim V11, victim V12, or victim V13.
  • the foregoing identification application scenario may also include: multiple attackers can also be identified as the same victim by wearing the same counter-sample item.
  • the counter-sample item as the counter-sample glasses frame as an example
  • the number of attackers is 3, that is, the attacker A11, the attacker A12, and the attacker A13 wear the counter-sample glasses frame (denoted as the mirror frame).
  • the deep learning network can determine the attacker A11, the attacker A12, and the attacker A13 wearing the frame a2 as the victim V21 according to the needs of the attacker. Then, no matter which of the attacker A11, the attacker A12, or the attacker A13 wears the frame a2, it can be recognized by the electronic device as the victim V21.
  • an embodiment of the present application provides a method for detecting adversarial samples, which can effectively detect the face collected at the current moment. Whether the image is an adversarial example can effectively prevent the successful implementation of an adversarial example attack.
  • the method for detecting confrontational samples is applied to a face recognition scene, and the main body of the detection method includes electronic equipment equipped with camera equipment (such as a camera) and display equipment (such as : LCD screen), which can be smart terminals such as mobile phones, tablets, smart watches, etc.
  • camera equipment such as a camera
  • display equipment such as : LCD screen
  • the specific electronic devices are not limited here.
  • the terms “first”, “second”, “third”, “fourth”, etc. (if any) in the specification and claims of this application and the aforementioned drawings are used to distinguish similar The object is not necessarily used to describe a specific order or sequence.
  • FIG. 5 is a schematic diagram of the adversarial sample detection method in an embodiment of the application, and the specific implementation is as follows:
  • the electronic device can collect the face image at the current moment through the camera equipment.
  • the camera equipment can be the camera that comes with the electronic device, or it can be a camera that is physically separated from the electronic device but connected wirelessly (for example, the phone's camera is not turned on, the phone's camera is damaged or The mobile phone does not have its own camera, but there is a handheld camera connected to the mobile phone via Bluetooth).
  • the specific camera equipment is not limited here.
  • the electronic device can collect the face image at the current moment through the camera equipment in various forms.
  • the operation instruction can be when the user uses the mobile phone to provide the payment QR code (such as the payment QR code of WeChat or Alipay) to scan the code
  • the payment operation needs to verify the user’s identity.
  • the operation instruction can also be the user’s opening operation of an application on the mobile phone (such as online banking, telephone bill inquiry, etc.). Information security, the opening operation also needs to verify the user's identity.
  • the form of the operation instruction is not limited.
  • the user’s execution of the operation instruction will trigger the electronic device to verify the user’s identity.
  • One of the verification methods is to recognize the face image acquired at the current moment, that is, the user’s above payment operations, opening operations, etc. will trigger the electronic device Turn on the camera to take a picture of the user's face to obtain the face image at the current moment.
  • the electronic device photographs the user’s face, which can be a directly taken picture or a recorded video, and then the picture is intercepted from the video.
  • the acquisition of the current face image The method is not limited.
  • the electronic equipment collects the face image at the current moment through the camera equipment.
  • the camera equipment can also be always on. As long as the camera equipment captures the face image at the current moment, the electronic The device collects the face image.
  • the form of the electronic device collecting the face image at the current moment is not limited.
  • step 502. Determine whether there is an obstruction within the range of the face area, if yes, execute step 503, and if not, execute step 504.
  • step 503 is executed, and if there is no obstruction in the face area, then step 504 is executed.
  • the electronic device determines whether the obstruction is an anti-sample interference object. If the obstruction is an anti-sample interference object, step 505 is executed, and if the obstruction is not an anti-sample interference object, then step 504 is executed.
  • the anti-sample interference object refers to an anti-sample interference object trained by a deep learning network for the purpose of implementing an anti-sample attack, such as an anti-sample glasses frame (as shown in Figure 2 3, 4, the spectacle frame a, spectacle frame b, spectacle frame c, spectacle frame a1, spectacle frame a2), corresponding sample stickers, etc., the specific form of countering sample interference is not limited here.
  • the electronic device may analyze the pixel value of the pixel of the obstruction by but not limited to the method of calculating the image entropy to determine whether the obstruction is an anti-sample obstruction.
  • Color is the different perception of human eyes to light of different frequencies. Color is both objectively existing (light of different frequencies) and subjectively perceived, and there are differences in perception. Based on this, in order to describe colors more objectively and accurately, the concept of color space (also called color gamut) emerged.
  • color space also called color gamut
  • a color model By establishing a color model, a color can be represented by one-dimensional, two-dimensional, three-dimensional or even four-dimensional space coordinates. The color range defined by this coordinate system is the color space.
  • the types of color spaces that are frequently used at present mainly include the three primary color light mode (RGB), the printing quarter color mode (CMYK), and the color model (Lab).
  • the color space is the three primary color light mode as an example for description.
  • the three-primary color light model also known as the RGB color model or the red-green-blue color model, is an additive color model that separates the three primary colors of red (Red), green (Green), and blue (Blue). The proportions are added to produce a variety of color lights. These variety of color lights define a color space.
  • the amount of red is defined as the X coordinate axis
  • the amount of green is defined as the Y coordinate axis
  • the amount of blue is defined It is the Z coordinate axis (the red, green, and blue quantities are uniquely corresponding to the X coordinate axis, the Y coordinate axis, and the Z coordinate axis, respectively. This is just to illustrate one of the definition methods, which is not limited), so you will get In a three-dimensional space, each possible color has a unique position in this three-dimensional space.
  • the RGB color model has a variety of different implementation methods according to the actual device system capabilities.
  • each color channel of red, green, and blue has 256 color levels (the value range of the color level is an integer from 0 to 255).
  • the color space based on such RGB color model can be expressed as 256 ⁇ 256 ⁇ 256 ⁇ 16.7 million colors.
  • Some implementation methods can also use more color levels for each primary color (such as 512 color levels), so that they can be in the same range Achieve higher and more accurate color density within.
  • each color level is the pixel value of the pixel at the corresponding position in the picture.
  • the color level of each primary color is 256 as an example:
  • the color of the pixel value RGB(255,0,0) is expressed as For red, the color whose pixel value is RGB(0,255,0) is represented as green, and the color whose pixel value is RGB(0,0,255) is represented as blue.
  • the image is represented as a color image; when the pixel values are the same in each coordinate, the image is Expressed as a grayscale image, for example, when the color level of each primary color in the three primary colors is 255, the color performance of the pixel value RGB (255,255,255) is white, when the color level of each primary color in the three primary colors is 0 , The color performance of the pixel value RGB(0,0,0) is black.
  • the color performance of the pixel value RGB(m,m,m) is Gray, m is an integer and 0 ⁇ m ⁇ 255.
  • the pixel value RGB(100,100,100) represents the grayscale is 100
  • the pixel value RGB(50,50,50) represents the grayscale is 50.
  • Grayscale refers to the black and white image The color depth of each pixel.
  • entropy is used to describe the degree of chaos. It was first used to describe the degree of material chaos in physics. Later, it was gradually extended to the fields of informatics, image science and so on. A measure of uncertainty. The greater the amount of information, the smaller the uncertainty, and the greater the entropy; conversely, the smaller the amount of information, the greater the uncertainty, and the smaller the entropy. According to the characteristics of entropy, the randomness and disorder degree of an event can be judged by calculating the entropy value. Based on this, in the embodiments of this application, the concept of picture entropy is introduced. The picture entropy is used to reflect the distribution characteristics of pixel values in the image. The larger the picture entropy, the brighter the corresponding image color, and the image contains The amount of information is also greater.
  • the step of determining may include:
  • the electronic device can calculate the pixel values of all pixels in the shield through the corresponding entropy calculation formula to obtain the picture entropy value of the shield. Including but not limited to the following methods:
  • the entropy value of the image of the occluder can be calculated by but not limited to the entropy value calculation formula To obtain, where i is the pixel value of each pixel in the occluder, p i is the probability that the pixel value i appears, and H is the image entropy value of the occluder.
  • the pixel values of all pixels in the occluder are decomposed into the first vector pixel value (also called the X-axis pixel value) and the second vector pixel value (also Called the Y-axis pixel value) and the third vector pixel value (also called the Z-axis pixel value), get the first set of the first vector pixel value, the second set of the second vector pixel value, and the third vector pixel
  • the third set of values afterwards, the first picture entropy of the first set, the second picture entropy of the second set, and the third picture entropy of the third set are respectively calculated according to the entropy calculation formula; finally, the first picture entropy of the first set
  • the picture entropy value, the second picture entropy value, and the third picture entropy value take an arithmetic mean value, and the arithmetic mean value is used as the picture entropy value of the occluder.
  • the entropy value of the picture on each coordinate axis can also be calculated according to the entropy value calculation formula used when calculating the gray picture. Calculated. That is, when calculating the entropy value of the first picture on the X coordinate axis, i is the value of each pixel value in the first set, p i is the probability that i appears, and H is the first picture entropy; when calculating When the entropy value of the second picture on the Y coordinate axis, i is the value of each pixel value in the second set, p i is the probability that i appears, and H is the second picture entropy value; when calculating the Z coordinate axis In the case of the third picture entropy value above, i is the value of each pixel value in the third set, p i is the probability that i appears, and H is the third picture entropy value.
  • the number of pixels in the occluder is 4 as an example for description. It is assumed that the pixel values of these 4 pixels in the occluder are RGB1 (120, 50, 80) and RGB2 in the RGB color model. (30, 90, 40), RGB3 (70, 140, 200), RGB4 (100, 160, 20), then the electronic device will decompose the pixel values of these 4 pixels into (120, 0, 0) , (0,50,0), (0,0,80), (30,0,0), (0,90,0), (0,0,40), (70,0,0), ( 0,140,0), (0,0,200), (100,0,0), (0,160,0), (0,0,20).
  • the first set of pixel values of the first vector is ⁇ (120, 0, 0), (30, 0, 0), (70, 0, 0), (100, 0, 0) ⁇
  • the second set of vector pixel values is ⁇ (0,50,0), (0,90,0), (0,140,0), (0,160,0) ⁇
  • the third vector pixel value The three sets are ⁇ (0,0,80), (0,0,40), (0,0,200), (0,0,20) ⁇ .
  • the electronic device can calculate the formula according to the entropy
  • the picture entropy value in each set is calculated separately, so as to obtain the first picture entropy value Hx of the first set, the second picture entropy value Hy of the second set, and the third picture entropy value Hz of the third set.
  • the calculated image entropy value of the obstruction is compared with a preset threshold (ie, a preset threshold) to determine whether the obstruction is an anti-sample interference object.
  • a preset threshold ie, a preset threshold
  • the preset threshold value in the embodiment of the present application can be obtained in a variety of ways. It can be set by the user based on experience values, or it can be generated based on deep learning network calculations, which is not specifically limited here.
  • the preset threshold value may be determined in the following manner: A large number (such as M, M ⁇ 1) normal face images (ie, reference face images) are acquired offline, and these faces There is no occlusion in the face area of the image (that is, the original face image without any disturbance); after that, the pixel value of each normal face image can be calculated to obtain each normal face image.
  • a large number such as M, M ⁇ 1 normal face images (ie, reference face images) are acquired offline, and these faces There is no occlusion in the face area of the image (that is, the original face image without any disturbance); after that, the pixel value of each normal face image can be calculated to obtain each normal face image.
  • the picture entropy value of the face image, the calculation method of the picture entropy value can be obtained by the above-mentioned entropy calculation formula; finally, the arithmetic mean value of the picture entropy values corresponding to all normal face images is taken, and the arithmetic mean value obtained is Can be used as a preset threshold.
  • the electronic device determines that the image entropy value of the obstruction is greater than the preset threshold, it is determined that the obstruction is a counter-sample interference object.
  • the electronic device detects that there is no obstruction in the face area in the above face image, or the electronic device detects that the obstruction in the face area in the above face image is not an anti-sample interference object (that is, although there is an obstruction Objects may have ordinary obstructions (such as wearing ordinary glasses, band-aids, masks, etc.), but there is no case against sample attacks.
  • the electronic device determines that the image entropy of the obstruction is less than or If it is equal to the threshold, it is determined that the occluder is a normal occluder), indicating that it has not been attacked by the adversarial sample, then the electronic device directly recognizes the face image to obtain the recognition result.
  • the mobile phone obtains the face image and compares it with the authenticated target face image that can initiate the payment operation. If the comparison is passed (that is, the face image is consistent with the target face image, it is the same person), the payment environment is safe, and the mobile phone can complete the above payment operation; if the comparison is not passed (that is, the face image and the target person Face images are inconsistent, not the same person), it means that the payment environment is not secure, and the mobile phone can stop the above payment operation.
  • the electronic device determines that the face image is a confrontation sample, it can further process the confrontation sample.
  • the purpose of the processing is to eliminate the influence of interference from the confrontation sample, which may be
  • the direct removal of the counter-sample interference object may also be the conversion of the counter-sample interference object into a common obstruction, which is not specifically limited here.
  • processing can be performed in the following manner:
  • a. First determine a target pixel value, and modify the pixel values of all pixels in the anti-sample interference object to the target pixel value.
  • the target pixel value can also be determined in many ways, including but not limited to:
  • a pixel value is selected as the target pixel value
  • the pixel value x of all pixels in the anti-sample interference object is processed by algebraic linear transformation. For example, modify the pixel values of all pixels in the anti-sample interference object to (255-x) or 0.5*(255-x).
  • algebraic linear transformation processing is not limited here.
  • the electronic device can directly recognize the face image , Get the recognition result.
  • the specific identification method is similar to the above step 504, and will not be repeated here.
  • the electronic device determines that the face image is a real confrontation sample (that is, the recognition result is not the owner of the electronic device), the electronic device can further generate a reminder notification, which is used to remind the relevant user that the electronic device is suffering from the confrontation sample Attacks, for example, the relevant user can be the owner of the electronic device (ie the victim), then the reminder notification can remind the victim to deal with it in time (such as: change the payment password, alarm), and the relevant user can also be a service corresponding to the electronic device Merchants (for example, if the attacker uses the victim's mobile phone to make online payments at Renrenle Supermarket, the corresponding service merchant is the cashier platform of Renrenle Supermarket).
  • the reminder function there are many ways to realize the reminder, including but not limited to the following reminders (for example, if the attacker uses the victim's mobile phone to make online payments at Renrenle Supermarket, the corresponding service merchant is the cashier platform of Renrenle Supermarket).
  • the reminder notification will be reminded by voice broadcast, alarm bell, etc. on the mobile phone.
  • This reminder notification method is mainly to attract the attention of users around the mobile phone (such as the service staff at the checkout, other customers around the attacker, etc.), so that the attacker is afraid and actively abandons the adversarial sample attack or causes The surrounding users intervened in the attacker’s adversarial sample attack to stop the attack.
  • the mobile phone determines that the current face image collected through the camera of the mobile phone is a confrontational sample, the mobile phone can voice "Attacked by a confrontational sample, please stop paying! or similar reminders (such as: "This phone is suspected of being stolen, please stop paying!, "This phone is being used illegally, catch the bad guys! etc.), the specific form of the text content of the voice playback is not limited here.
  • the mobile phone can play alarm bells in addition to voice-related content to remind, to play a similar reminder function.
  • the alarm bell can also be expressed in multiple forms, as shown in Figure 8: the mobile phone can send out "Beep! Beep! Beep! Beep! Beep! alarm bells can also sound the alarm bell of "Woohoo! Woohoo! Woohoo! Woohoo! The specific form of the alarm bell is not limited here.
  • the mobile phone sends the reminder notification to the corresponding server.
  • the reminder notification generated by the mobile phone can be further sent to the server corresponding to the mobile phone (for example, the merchant platform that is making online payment), as shown in Figure 9, when the attacker is using online payment to pay the merchant platform.
  • the mobile phone detects that the face image of the attacker captured at the current moment is a confrontational sample, the mobile phone will send a reminder notification to the corresponding payment merchant platform to remind the merchant that the payment process is not secure, and the merchant platform receives the reminder Notice, you can actively terminate the payment process to ensure the financial security of the victim.
  • the mobile phone sends the reminder notification to other target electronic devices associated with the mobile phone.
  • the reminder notification generated by the mobile phone can be further sent to other target electronic devices associated with the mobile phone.
  • victim B if the owner of mobile phone a that is being attacked by the adversarial sample is victim B, victim B has mobile phone b, tablet c, and smart watch d in addition to mobile phone a.
  • Victim B will Mobile phone a, mobile phone b, tablet computer c, and smart watch d have been associated in advance (for example, a unified ID account has been registered before, and the content can be shared), then mobile phone b, tablet computer c, and smart watch d are implemented in this application In this example, other target electronic devices associated with mobile phone a.
  • mobile phone a will generate a reminder notification (for example: the reminder notification can be "Mobile phone a is under attack by adversarial samples, please intervene!), the reminder The notification will be sent to at least one of phone b, tablet c, or smart watch d, so that if victim B is wearing smart watch d, or is using phone b or tablet c, then victim B can be timely Knowing that his mobile phone a is being used illegally by the attacker, victim B can intervene in time, such as changing the payment password on other target electronic devices, and reporting to relevant departments.
  • the reminder notification can be "Mobile phone a is under attack by adversarial samples, please intervene!"
  • the reminder The notification will be sent to at least one of phone b, tablet c, or smart watch d, so that if victim B is wearing smart watch d, or is using phone b or tablet c, then victim B can be timely Knowing that his mobile phone a is being used illegally by the attacker, victim B can intervene in time, such as changing the payment password on other target electronic devices
  • the embodiment of the present application may divide the electronic device into functional modules according to the above detection method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • FIG. 11 shows a schematic diagram of an electronic device.
  • the electronic device provided in the embodiment of the present application may include:
  • the collection unit 1101 is used to collect the face image at the current moment through the camera equipment
  • the judging unit 1102 is used to judge whether the obstruction is an anti-sample interference object, and the obstruction is located within the face area in the face image;
  • the determining unit 1103 is configured to determine that the face image is a confrontation sample if the obstruction is the confrontation sample interferer.
  • the judgment unit 1102 may also include more sub-units to implement more functions.
  • FIG. 12 another schematic diagram of the electronic device provided by the embodiment of the present application.
  • the electronic device specifically includes: a collection unit 1201, a judgment unit 1202, and a determination unit 1203.
  • the collection unit 1201, the judgment unit 1202, and the determination unit 1203 implement functions similar to those implemented by the collection unit 1101, the judgment unit 1102, and the determination unit 1103 in FIG. 11, and will not be repeated here.
  • the determining unit 1202 may further include:
  • the calculation sub-unit 12021 is used to calculate the pixel values of all pixels in the shield to obtain the image entropy value of the shield;
  • the judging subunit 12022 is used to judge whether the entropy value of the picture is greater than a preset threshold, and the preset threshold is determined according to a first preset manner;
  • the first determining subunit 12023 is configured to determine that the obstruction is the anti-sample interference object if the picture entropy value is greater than the preset threshold.
  • the determining unit 1202 may further include a second determining subunit 12024, specifically configured to: if the image entropy value is less than or equal to the preset threshold, determine that the obstruction is a normal obstruction .
  • the first preset manner may include: firstly, obtaining M reference face images, where the reference face images are face images without obstructions in the face area, where M ⁇ 1; The pixel values of all pixels in the target reference face image in the M reference face images are calculated to obtain the target picture entropy value of the target reference face image; finally, it is determined to correspond to the M reference face images respectively
  • the arithmetic mean of the entropy values of the M target pictures is the preset threshold.
  • the calculation subunit 12021 may also be specifically used to:
  • the pixel values of all pixels in the occluder are decomposed into the first vector pixel value, the second vector pixel value and the third vector pixel value in the color space to obtain the first set of the first vector pixel value and the second vector pixel value And the third set of pixel values to the third vector; and calculate the first picture entropy value of the first set, the second picture entropy value of the second set and the third set respectively according to the entropy calculation formula Afterwards, determine the arithmetic mean of the first picture entropy value, the second picture entropy value and the third picture entropy value as the picture entropy value of the occluder.
  • the entropy value calculation formula may include: Where i is the value of each element in the first set, the second set or the third set, p i is the probability of the occurrence of i, and H is the first picture entropy value and the second picture entropy value Or the entropy value of the third picture.
  • the electronic device may further include more units to implement more functions.
  • the electronic device may further include:
  • the processing unit 1204 is configured to process the adversarial sample according to the second preset manner
  • the recognition unit 1205 is used to recognize the processed countermeasure samples to obtain a recognition result.
  • the identifying unit 1205 may also be specifically configured to identify the ordinary obstruction and obtain the identification result.
  • the above-mentioned second preset manner may include: determining a target pixel value, and modifying the pixel values of all pixels in the anti-sample interference object to the target pixel value; or, all pixels in the anti-sample interference object
  • the pixel values are transformed algebraically linearly.
  • determining the target pixel value may also include the following methods:
  • the electronic device may further include:
  • the generating unit 1206 is used to generate a reminder notification
  • the broadcasting unit 1207 is used for voice broadcasting the reminder notification
  • the sending unit 1208 is configured to send the reminder notification to the corresponding server and/or to the associated target electronic device.
  • the electronic equipment may include mobile phones, tablet computers, smart watches, personal computers, and so on.
  • the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2.
  • USB universal serial bus
  • Mobile communication module 150 wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, earphone interface 170D, sensor module 180, buttons 190, motor 191, indicator 192, camera equipment 193 (also called It is a camera 193), a display screen 194, a subscriber identification module (SIM) card interface 195, and so on.
  • the sensor module 180 can include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, and ambient light Sensor 180L, bone conduction sensor 180M, etc.
  • the structure of the electronic device 100 shown in FIG. 13 does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, it may include more or more Few parts, or combine some parts, or split some parts, or arrange different parts.
  • the illustrated components can be implemented in hardware, software, or a combination of software and hardware.
  • the processor 110 may include one or more processing units.
  • the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), and an image signal processor. (image signal processor, ISP), controller, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural-network processing unit (NPU), etc.
  • AP application processor
  • modem processor modem processor
  • GPU graphics processing unit
  • image signal processor image signal processor
  • ISP image signal processor
  • controller video codec
  • digital signal processor digital signal processor
  • DSP digital signal processor
  • NPU neural-network processing unit
  • the different processing units may be independent devices or integrated in one or more processors.
  • the controller can generate operation control signals according to the instruction operation code and timing signals to complete the control of fetching and executing instructions.
  • a memory may also be provided in the processor 110 to store instructions and data.
  • the memory in the processor 110 is a cache memory.
  • the memory can store instructions or data that have just been used or recycled by the processor 110. If the processor 110 needs to use the instruction or data again, it can be directly called from the memory. Repeated accesses are avoided, the waiting time of the processor 110 is reduced, and the efficiency of the system is improved.
  • the processor 110 may include one or more interfaces.
  • the interface may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (PCM) interface, and a universal asynchronous transmitter receiver/transmitter, UART) interface, mobile industry processor interface (MIPI), general-purpose input/output (GPIO) interface, subscriber identity module (SIM) interface, and / Or Universal Serial Bus (USB) interface, etc.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • UART universal asynchronous transmitter receiver/transmitter
  • MIPI mobile industry processor interface
  • GPIO general-purpose input/output
  • SIM subscriber identity module
  • USB Universal Serial Bus
  • the I2C interface is a two-way synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL).
  • the processor 110 may include multiple sets of I2C buses.
  • the processor 110 may be coupled to the touch sensor 180K, charger, flash, camera 193, etc. through different I2C bus interfaces.
  • the processor 110 may couple the touch sensor 180K through an I2C interface, so that the processor 110 and the touch sensor 180K communicate through an I2C bus interface to implement the touch function of the electronic device 100.
  • the processor 110 can couple the camera 193 through the I2C interface. If the camera collects the face image at the current moment, the camera can transmit the collected face image to the camera through the I2C bus interface.
  • the processor 110 performs processing.
  • the I2S interface can be used for audio communication.
  • the processor 110 may include multiple sets of I2S buses.
  • the processor 110 may be coupled with the audio module 170 through an I2S bus to realize communication between the processor 110 and the audio module 170.
  • the audio module 170 may also transmit audio signals to the wireless communication module 160 through the I2S interface, so as to realize the function of answering calls through the Bluetooth headset.
  • the PCM interface can also be used for audio communication to sample, quantize and encode analog signals.
  • the audio module 170 and the wireless communication module 160 may be coupled through a PCM bus interface.
  • the audio module 170 may also transmit audio signals to the wireless communication module 160 through the PCM interface, so as to realize the function of answering calls through the Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.
  • the processor 110 if the electronic device 100 is being attacked by an adversarial sample, the processor 110 will generate a reminder notification. If the processor 110 in the embodiment of the present application communicates with the audio module through an I2S bus interface or a PCM bus interface 170 is coupled, then the reminder notification can be sent to the audio module 170.
  • the UART interface is a universal serial data bus used for asynchronous communication.
  • the bus can be a two-way communication bus. It converts the data to be transmitted between serial communication and parallel communication.
  • the UART interface is generally used to connect the processor 110 and the wireless communication module 160.
  • the processor 110 communicates with the Bluetooth module in the wireless communication module 160 through the UART interface to implement the Bluetooth function.
  • the audio module 170 may transmit audio signals to the wireless communication module 160 through a UART interface, so as to realize the function of playing music through a Bluetooth headset.
  • the MIPI interface can be used to connect the processor 110 with the display screen 194, the camera 193 and other peripheral devices.
  • the MIPI interface includes camera serial interface (camera serial interface, CSI), display serial interface (display serial interface, DSI), etc.
  • the processor 110 and the camera 193 communicate through a CSI interface to implement the shooting function of the electronic device 100.
  • the processor 110 and the display screen 194 communicate through a DSI interface to realize the display function of the electronic device 100. Therefore, in the embodiment of the present application, the processor 110 can not only couple the camera 193 through the I2C interface, but also communicate with the camera 193 through the CSI interface.
  • the camera can not only The collected face image is transmitted to the processor 110 through the I2C bus interface for processing, and the collected face image may also be transmitted to the processor 110 through the CSI interface for processing.
  • the GPIO interface can be configured through software.
  • the GPIO interface can be configured as a control signal or as a data signal.
  • the GPIO interface can be used to connect the processor 110 with the camera 193, the display screen 194, the wireless communication module 160, the audio module 170, the sensor module 180, and so on.
  • GPIO interface can also be configured as I2C interface, I2S interface, UART interface, MIPI interface, etc.
  • the USB interface 130 is an interface that complies with the USB standard specification, and specifically may be a Mini USB interface, a Micro USB interface, a USB Type C interface, and so on.
  • the USB interface 130 can be used to connect a charger to charge the electronic device 100, and can also be used to transfer data between the electronic device 100 and peripheral devices. It can also be used to connect headphones and play audio through the headphones. This interface can also be used to connect other electronic devices, such as AR devices.
  • the interface connection relationship between the modules illustrated in the embodiment of the present invention is merely a schematic description, and does not constitute a structural limitation of the electronic device 100.
  • the electronic device 100 may also adopt different interface connection modes in the foregoing embodiments, or a combination of multiple interface connection modes.
  • the charging management module 140 is used to receive charging input from the charger.
  • the charger can be a wireless charger or a wired charger.
  • the charging management module 140 may receive the charging input of the wired charger through the USB interface 130.
  • the charging management module 140 may receive the wireless charging input through the wireless charging coil of the electronic device 100. While the charging management module 140 charges the battery 142, it can also supply power to the electronic device through the power management module 141.
  • the power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110.
  • the power management module 141 receives input from the battery 142 and/or the charging management module 140, and supplies power to the processor 110, the internal memory 121, the display screen 194, the camera 193, and the wireless communication module 160.
  • the power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle times, and battery health status (leakage, impedance).
  • the power management module 141 may also be provided in the processor 110.
  • the power management module 141 and the charging management module 140 may also be provided in the same device.
  • the wireless communication function of the electronic device 100 can be implemented by the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor, and the baseband processor.
  • the antenna 1 and the antenna 2 are used to transmit and receive electromagnetic wave signals.
  • Each antenna in the electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.
  • antenna 1 can be multiplexed as a diversity antenna of a wireless local area network.
  • the antenna can be used in combination with a tuning switch.
  • the mobile communication module 150 can provide a wireless communication solution including 2G/3G/4G/5G and the like applied to the electronic device 100.
  • the mobile communication module 150 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc.
  • the mobile communication module 150 can receive electromagnetic waves by the antenna 1, and perform processing such as filtering, amplifying and transmitting the received electromagnetic waves to the modem processor for demodulation.
  • the mobile communication module 150 can also amplify the signal modulated by the modem processor, and convert it into electromagnetic waves for radiation via the antenna 1.
  • at least part of the functional modules of the mobile communication module 150 may be provided in the processor 110.
  • at least part of the functional modules of the mobile communication module 150 and at least part of the modules of the processor 110 may be provided in the same device.
  • the modem processor may include a modulator and a demodulator.
  • the modulator is used to modulate the low frequency baseband signal to be sent into a medium and high frequency signal.
  • the demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. Then the demodulator transmits the demodulated low-frequency baseband signal to the baseband processor for processing.
  • the low-frequency baseband signal is processed by the baseband processor and then passed to the application processor.
  • the application processor outputs a sound signal through an audio device (not limited to the speaker 170A, receiver 170B, etc.).
  • the sound signal is a reminder notification (for example, the voice broadcast "Is being attacked by an adversarial sample, please stop paying! (Or alarm bell) or display an image or video (such as a face image or a face video at the current moment in the embodiment of the present application) through the display screen 194.
  • the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be provided in the same device as the mobile communication module 150 or other functional modules.
  • the wireless communication module 160 can provide applications on the electronic device 100 including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), and global navigation satellites.
  • WLAN wireless local area networks
  • BT wireless fidelity
  • GNSS global navigation satellite system
  • FM frequency modulation
  • NFC near field communication technology
  • infrared technology infrared, IR
  • the wireless communication module 160 may be one or more devices integrating at least one communication processing module.
  • the wireless communication module 160 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110.
  • the wireless communication module 160 can also receive the signal to be sent from the processor 110, perform frequency modulation, amplify it, and convert it into electromagnetic wave radiation via the antenna 2.
  • the antenna 1 of the electronic device 100 is coupled with the mobile communication module 150, and the antenna 2 is coupled with the wireless communication module 160, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology.
  • the processor can send the generated reminder notification to the corresponding server through the mobile communication module 150 and the antenna 1, or to other target electronic devices associated therewith.
  • the wireless communication technologies may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), broadband Code division multiple access (wideband code division multiple access, WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC , FM, and/or IR technology, etc.
  • the GNSS may include global positioning system (GPS), global navigation satellite system (GLONASS), Beidou navigation satellite system (BDS), quasi-zenith satellite system (quasi -zenith satellite system, QZSS) and/or satellite-based augmentation systems (SBAS).
  • GPS global positioning system
  • GLONASS global navigation satellite system
  • BDS Beidou navigation satellite system
  • QZSS quasi-zenith satellite system
  • SBAS satellite-based augmentation systems
  • the electronic device 100 implements a display function through a GPU, a display screen 194, and an application processor.
  • the GPU is a microprocessor for image processing. For example, in the embodiment of the present application, if the electronic device 100 uses the camera 193 to capture a face video at the current moment, then the face video can be processed by the GPU, from the current The face image is extracted from the face video at the moment. Connect the display 194 and the application processor.
  • the GPU is used to perform mathematical and geometric calculations for graphics rendering.
  • the processor 110 may include one or more GPUs, which execute program instructions to generate or change display information.
  • the display screen 194 is used to display images, videos, etc., for example, can be used to display the face video or face image taken by the camera at the current moment in the embodiment of the present application.
  • the display screen 194 includes a display panel.
  • the display panel can adopt liquid crystal display (LCD), organic light-emitting diode (OLED), active-matrix organic light-emitting diode or active-matrix organic light-emitting diode (active-matrix organic light-emitting diode).
  • LCD liquid crystal display
  • OLED organic light-emitting diode
  • active-matrix organic light-emitting diode active-matrix organic light-emitting diode
  • AMOLED flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, quantum dot light-emitting diode (QLED), etc.
  • the electronic device 100 may include one or N display screens 194, and N is a positive integer greater than one.
  • the electronic device 100 can realize the shooting function through an ISP, a camera 193, a video codec, a GPU, a display screen 194, and an application processor. In the embodiment of the present application, it is through the aforementioned ISP, a camera 193, a video codec, and a GPU. , The display screen 194 and the application processor obtain the face image at the current moment.
  • the ISP is used to process the data fed back from the camera 193. For example, when taking a picture, the shutter is opened, the light is transmitted to the photosensitive element of the camera through the lens, the light signal is converted into an electrical signal, and the photosensitive element of the camera transfers the electrical signal to the ISP for processing and is converted into an image visible to the naked eye.
  • ISP can also optimize the image noise, brightness, and skin color. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene.
  • the ISP may be provided in the camera 193.
  • the camera 193 is used to capture still images or videos, such as a face image or a face video at the current moment in the embodiment of the present application.
  • the object generates an optical image through the lens and projects it to the photosensitive element.
  • the photosensitive element may be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor.
  • CMOS complementary metal-oxide-semiconductor
  • the photosensitive element converts the optical signal into an electrical signal, and then transmits the electrical signal to the ISP to convert it into a digital image signal.
  • ISP outputs digital image signals to DSP for processing.
  • DSP converts digital image signals into standard RGB, YUV and other formats.
  • the electronic device 100 may include 1 or N cameras 193, and N is a positive integer greater than 1.
  • Digital signal processors are used to process digital signals. In addition to digital image signals, they can also process other digital signals. For example, when the electronic device 100 selects the frequency point, the digital signal processor is used to perform Fourier transform on the energy of the frequency point.
  • Video codecs are used to compress or decompress digital video.
  • the electronic device 100 may support one or more video codecs. In this way, the electronic device 100 can play or record videos in a variety of encoding formats, such as: moving picture experts group (MPEG) 1, MPEG2, MPEG3, MPEG4, and so on.
  • MPEG moving picture experts group
  • NPU is a neural-network (NN) computing processor.
  • NN neural-network
  • the NPU can realize applications such as intelligent cognition of the electronic device 100, such as image recognition, face recognition, voice recognition, text understanding, and so on.
  • the external memory interface 120 may be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100.
  • the external memory card communicates with the processor 110 through the external memory interface 120 to realize the data storage function. For example, save music, video and other files in an external memory card.
  • the internal memory 121 may be used to store computer executable program code, where the executable program code includes instructions.
  • the internal memory 121 may include a storage program area and a storage data area.
  • the storage program area can store an operating system, at least one application program (such as a sound playback function, an image playback function, etc.) required by at least one function.
  • the data storage area can store data (such as audio data, phone book, etc.) created during the use of the electronic device 100.
  • the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, a universal flash storage (UFS), etc.
  • the processor 110 executes various functional applications and data processing of the electronic device 100 by running instructions stored in the internal memory 121 and/or instructions stored in a memory provided in the processor.
  • the electronic device 100 can implement audio functions through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the earphone interface 170D, and the application processor. For example, music playing, recording, etc., in the embodiment of the present application, the voice broadcast of the reminder notification or the playing of the alarm ringtone are realized.
  • the audio module 170 is used to convert digital audio information into an analog audio signal for output, and is also used to convert an analog audio input into a digital audio signal.
  • the audio module 170 can also be used to encode and decode audio signals.
  • the audio module 170 may be provided in the processor 110, or part of the functional modules of the audio module 170 may be provided in the processor 110.
  • the speaker 170A also called a “speaker” is used to convert audio electrical signals into sound signals.
  • the electronic device 100 can listen to music through the speaker 170A, or listen to a hands-free call.
  • the receiver 170B also called “earpiece” is used to convert audio electrical signals into sound signals.
  • the electronic device 100 answers a call or voice message, it can receive the voice by bringing the receiver 170B close to the human ear.
  • the microphone 170C also called “microphone”, “microphone”, is used to convert sound signals into electrical signals.
  • the user can approach the microphone 170C through the mouth to make a sound, and input the sound signal to the microphone 170C.
  • the electronic device 100 may be provided with at least one microphone 170C. In other embodiments, the electronic device 100 may be provided with two microphones 170C, which can implement noise reduction functions in addition to collecting sound signals. In some other embodiments, the electronic device 100 can also be provided with three, four or more microphones 170C to collect sound signals, reduce noise, identify sound sources, and realize directional recording functions.
  • the earphone interface 170D is used to connect wired earphones.
  • the earphone interface 170D may be a USB interface 130, or a 3.5mm open mobile terminal platform (OMTP) standard interface, or a cellular telecommunications industry association (cellular telecommunications industry association of the USA, CTIA) standard interface.
  • OMTP open mobile terminal platform
  • CTIA cellular telecommunications industry association
  • the pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal.
  • the pressure sensor 180A may be provided on the display screen 194. Pressure sensor 180A
  • the capacitive pressure sensor may include at least two parallel plates with conductive material.
  • the electronic device 100 determines the intensity of the pressure according to the change in capacitance.
  • the electronic device 100 detects the intensity of the touch operation according to the pressure sensor 180A.
  • the electronic device 100 may also calculate the touched position according to the detection signal of the pressure sensor 180A.
  • touch operations that act on the same touch location but have different touch operation strengths may correspond to different operation instructions.
  • the gyro sensor 180B may be used to determine the movement posture of the electronic device 100.
  • the angular velocity of the electronic device 100 around three axes ie, x, y, and z axes
  • the gyro sensor 180B can be used for image stabilization.
  • the gyro sensor 180B detects the shake angle of the electronic device 100, calculates the distance that the lens module needs to compensate according to the angle, and allows the lens to counteract the shake of the electronic device 100 through reverse movement to achieve anti-shake.
  • the gyro sensor 180B can also be used for navigation and somatosensory game scenes.
  • the air pressure sensor 180C is used to measure air pressure.
  • the electronic device 100 calculates the altitude based on the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation.
  • the magnetic sensor 180D includes a Hall sensor.
  • the electronic device 100 can use the magnetic sensor 180D to detect the opening and closing of the flip holster.
  • the electronic device 100 can detect the opening and closing of the flip according to the magnetic sensor 180D.
  • features such as automatic unlocking of the flip cover are set.
  • the acceleration sensor 180E can detect the magnitude of the acceleration of the electronic device 100 in various directions (generally three axes). When the electronic device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of electronic devices, and used in applications such as horizontal and vertical screen switching, pedometers and so on.
  • the electronic device 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the electronic device 100 may use the distance sensor 180F to measure the distance to achieve fast focusing.
  • the proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector such as a photodiode.
  • the light emitting diode may be an infrared light emitting diode.
  • the electronic device 100 emits infrared light to the outside through the light emitting diode.
  • the electronic device 100 uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the electronic device 100. When insufficient reflected light is detected, the electronic device 100 can determine that there is no object near the electronic device 100.
  • the electronic device 100 can use the proximity light sensor 180G to detect that the user holds the electronic device 100 close to the ear to talk, so as to automatically turn off the screen to save power.
  • the proximity light sensor 180G can also be used in leather case mode, and the pocket mode will automatically unlock and lock the screen.
  • the ambient light sensor 180L is used to sense the brightness of the ambient light.
  • the electronic device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived brightness of the ambient light.
  • the ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures.
  • the ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the electronic device 100 is in the pocket to prevent accidental touch.
  • the fingerprint sensor 180H is used to collect fingerprints.
  • the electronic device 100 can use the collected fingerprint characteristics to realize fingerprint unlocking, access application locks, fingerprint photographs, fingerprint answering calls, etc.
  • the temperature sensor 180J is used to detect temperature.
  • the electronic device 100 uses the temperature detected by the temperature sensor 180J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 180J exceeds a threshold value, the electronic device 100 executes to reduce the performance of the processor located near the temperature sensor 180J, so as to reduce power consumption and implement thermal protection.
  • the electronic device 100 when the temperature is lower than another threshold, the electronic device 100 heats the battery 142 to avoid abnormal shutdown of the electronic device 100 due to low temperature.
  • the electronic device 100 boosts the output voltage of the battery 142 to avoid abnormal shutdown caused by low temperature.
  • Touch sensor 180K also called “touch device”.
  • the touch sensor 180K may be disposed on the display screen 194, and the touch screen is composed of the touch sensor 180K and the display screen 194, which is also called a “touch screen”.
  • the touch sensor 180K is used to detect touch operations acting on or near it.
  • the touch sensor can pass the detected touch operation to the application processor to determine the type of touch event.
  • the visual output related to the touch operation can be provided through the display screen 194.
  • the touch sensor 180K may also be disposed on the surface of the electronic device 100, which is different from the position of the display screen 194.
  • the bone conduction sensor 180M can acquire vibration signals.
  • the bone conduction sensor 180M can obtain the vibration signal of the vibrating bone mass of the human voice.
  • the bone conduction sensor 180M can also contact the human pulse and receive the blood pressure pulse signal.
  • the bone conduction sensor 180M may also be provided in the earphone, combined with the bone conduction earphone.
  • the audio module 170 can parse the voice signal based on the vibration signal of the vibrating bone block of the voice obtained by the bone conduction sensor 180M, and realize the voice function.
  • the application processor may analyze the heart rate information based on the blood pressure beat signal obtained by the bone conduction sensor 180M, and realize the heart rate detection function.
  • the button 190 includes a power button, a volume button, and so on.
  • the button 190 may be a mechanical button. It can also be a touch button.
  • the electronic device 100 may receive key input, and generate key signal input related to user settings and function control of the electronic device 100.
  • the motor 191 can generate vibration prompts.
  • the motor 191 can be used for incoming call vibration notification, and can also be used for touch vibration feedback.
  • touch operations applied to different applications can correspond to different vibration feedback effects.
  • Acting on touch operations in different areas of the display screen 194, the motor 191 can also correspond to different vibration feedback effects.
  • Different application scenarios for example: time reminding, receiving information, alarm clock, games, etc.
  • the touch vibration feedback effect can also support customization.
  • the indicator 192 may be an indicator light, which may be used to indicate the charging status, power change, or to indicate messages, missed calls, notifications, and so on.
  • the SIM card interface 195 is used to connect to the SIM card.
  • the SIM card can be inserted into the SIM card interface 195 or pulled out from the SIM card interface 195 to achieve contact and separation with the electronic device 100.
  • the electronic device 100 may support 1 or N SIM card interfaces, and N is a positive integer greater than 1.
  • the SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, etc.
  • the same SIM card interface 195 can insert multiple cards at the same time. The types of the multiple cards can be the same or different.
  • the SIM card interface 195 can also be compatible with different types of SIM cards.
  • the SIM card interface 195 may also be compatible with external memory cards.
  • the electronic device 100 interacts with the network through the SIM card to implement functions such as call and data communication.
  • the electronic device 100 adopts an eSIM, that is, an embedded SIM card.
  • the eSIM card can be embedded in the electronic device 100 and cannot be separated from the electronic device 100.
  • the software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a microkernel architecture, a microservice architecture, or a cloud architecture.
  • the embodiment of the present application takes a layered Android system as an example to illustrate the software structure of the electronic device 100.
  • FIG. 14 is a software structure block diagram of the electronic device 100 according to an embodiment of the present application.
  • the layered architecture divides the software into several layers, and each layer has a clear role and division of labor. Communication between layers through software interface.
  • the Android system is divided into four layers, from top to bottom, the application layer, the application framework layer, the Android runtime and system library, and the kernel layer.
  • the application layer can include a series of application packages.
  • the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc.
  • the application framework layer provides application programming interfaces (application programming interface, API) and programming frameworks for applications in the application layer.
  • the application framework layer includes some predefined functions.
  • the application framework layer can include a window manager, a content provider, a view system, a phone manager, a resource manager, and a notification manager.
  • the window manager is used to manage window programs.
  • the window manager can obtain the size of the display, determine whether there is a status bar, lock the screen, take a screenshot, etc.
  • the content provider is used to store and retrieve data and make these data accessible to applications.
  • the data may include video, image, audio, phone calls made and received, browsing history and bookmarks, phone book, etc.
  • the data may include the face image at the current moment collected by the camera (including the face image directly captured or the face image intercepted from the face video), reminder notifications, and the like.
  • the view system includes visual controls, such as controls that display text and controls that display pictures.
  • the view system can be used to build applications.
  • the display interface can be composed of one or more views.
  • a display interface that includes a short message notification icon may include a view that displays text and a view that displays pictures.
  • the phone manager is used to provide the communication function of the electronic device 100. For example, the management of the call status (including connecting, hanging up, etc.).
  • the resource manager provides various resources for the application, such as localized strings, icons, pictures, layout files, video files, etc.
  • the notification manager enables the application to display notification information in the status bar, which can be used to convey notification-type messages, and it can disappear automatically after a short stay without user interaction.
  • the notification manager is used to notify the download completion, message reminder, etc.
  • the notification manager can also be a notification that appears in the status bar at the top of the system in the form of a chart or scroll bar text, such as a notification of an application running in the background, or a notification that appears on the screen in the form of a dialog window. For example, text messages are prompted in the status bar, prompt sounds, electronic devices vibrate, and indicator lights flash.
  • Android Runtime includes core libraries and virtual machines. Android runtime is responsible for the scheduling and management of the Android system.
  • the core library consists of two parts: one part is the function functions that the java language needs to call, and the other part is the core library of Android.
  • the application layer and the application framework layer run in a virtual machine.
  • the virtual machine executes the java files of the application layer and the application framework layer as binary files.
  • the virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.
  • the system library can include multiple functional modules. For example: surface manager (surface manager), media library (Media Libraries), three-dimensional graphics processing library (for example: OpenGL ES), 2D graphics engine (for example: SGL), etc.
  • the surface manager is used to manage the display subsystem and provides a combination of 2D and 3D layers for multiple applications.
  • the media library supports playback and recording of a variety of commonly used audio and video formats, as well as still image files.
  • the media library can support multiple audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.
  • the 3D graphics processing library is used to realize 3D graphics drawing, image rendering, synthesis, and layer processing.
  • the 2D graphics engine is a drawing engine for 2D drawing.
  • the kernel layer is the layer between hardware and software.
  • the kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.
  • the following exemplarily describes the workflow of the software and hardware of the electronic device 100 in combination with the scene where the electronic device collects the current face image through the camera in the embodiment of the present application.
  • the corresponding hardware interrupt is sent to the kernel layer.
  • the kernel layer processes touch operations into original input events (including touch coordinates, time stamps of touch operations, etc.).
  • the original input events are stored in the kernel layer.
  • the application framework layer obtains the original input event from the kernel layer, and identifies the control corresponding to the input event. Taking the touch operation as a touch click operation, and the control corresponding to the click operation is the control of the camera application icon as an example, the camera application calls the interface of the application framework layer to start the camera application, and then starts the camera driver by calling the kernel layer.
  • the camera 193 captures a face image at the current moment (or captures a face video at the current moment).
  • the software structure of the electronic device in the above-mentioned embodiments corresponding to FIGS. 4 to 10 may be based on the software structure shown in FIG. 14, and the software structure shown in FIG. 14 may correspondingly execute the method in the above-mentioned method embodiments in FIGS. 4-10 The steps will not be repeated here.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium, (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state hard disk).

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Evolutionary Biology (AREA)
  • General Engineering & Computer Science (AREA)
  • Evolutionary Computation (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Artificial Intelligence (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Human Computer Interaction (AREA)
  • Oral & Maxillofacial Surgery (AREA)
  • Multimedia (AREA)
  • Image Analysis (AREA)
  • Telephone Function (AREA)
  • Collating Specific Patterns (AREA)

Abstract

一种对抗样本的检测方法，应用于人脸识别场景，如：手机的人脸支付、人脸解锁等，包括：电子设备通过摄像装备采集当前时刻的人脸图像，如：拍摄的人脸图片或从拍摄的摄像录影中截取的人脸图片，并判断该人脸图像的人脸区域范围内是否存在遮挡物，如：眼镜、贴纸等，若存在，则进一步判断该遮挡物是否是对抗样本干扰物，若是对抗样本干扰物，则确定该人脸图像为对抗样本，说明遭受到对抗样本攻击。这种检测方法不需要对大量的对抗样本图片进行深度模型训练，也不需要知道生成对抗样本的生成器采用的是哪种对抗样本生成算法，更不需要预先知道攻击者的人脸图像，便可以检测出是否存在对抗样本，检测复杂度低，易于实现。

Description

一种对抗样本的检测方法及电子设备
本申请要求在2019年5月21日提交中国国家知识产权局、申请号为201910425689.5的中国专利申请的优先权，发明名称为“一种对抗样本的检测方法及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及图像识别领域，尤其涉及一种对抗样本的检测方法及电子设备。
背景技术
深度学习是如今机器学习和人工智能领域应用的核心技术。在机器视觉领域中，它已经成为人脸识别、自动驾驶、监控、安保应用中的主力。然而，深度学习网络对于输入中带有的轻微扰动是很脆弱的，这些轻微扰动会导致深度学习网络输出错误的识别结果。例如，在图像识别领域，当深度学习网络输入图片中的部分像素点的像素值发生改变(即出现轻微扰动)，则会导致深度学习网络输出错误的识别结果。这种轻微扰动人眼不易察觉，但却完全可以欺骗深度学习网络。这种在输入图片中加入适量扰动从而使深度学习网络输出错误识别结果的攻击方法被称为对抗样本攻击，其中加入扰动后的输入图片被称为对抗样本。如图1所示是对抗样本攻击的一个实例，对熊猫图片(即输入图片)加入一定量不容易被人眼察觉的扰动(即改变输入图片的部分像素点的像素值)，结果使输出图片被深度学习网络误识别为长臂猿。然而该输出图片在人眼看来，却与输入图片无异。上述这种对抗样本攻击的方式只能针对已经存在于设备中的图片进行(即对存在设备中的图片更改部分像素点的像素值)。而针对人脸识别场景中，设备对当前时刻拍下的人脸图片(即开启摄像头拍摄的实时人脸图片)则无法做像素点的干扰处理。基于此，则出现了另一种形式的对抗样本攻击：攻击者通过在脸上佩戴经过特殊处理的对抗样本物品(如对抗样本眼镜/眼镜框、对抗样本贴纸等)方式，使得攻击者被人脸识别系统识别成预先指定的人(即受害者)。
目前，针对上述两种形式(即在现有输入图片中更改部分像素点的像素值、当前时刻拍摄的人脸图片佩戴有对抗样本物品)的对抗样本攻击的解决方式有以下两种：1)将对抗样本和原始的输入图片共同作为训练数据集，并将该训练数据集输入到深度学习网络中进行模型训练，生成对抗样本检测器。用该对抗样本检测器可以检测出输入的图片是否是对抗样本。2)根据原始的输入图片的识别结果与对抗样本的识别结果之间的差异程度的函数(即损失函数)，训练生成去噪器，用该去噪器对输入的对抗样本进行去燥处理(即去除对抗样本中添加的扰动)。
然而，上述对抗样本攻击的解决方式都存在缺陷：1)对抗样本检测器只能检测出由已知的对抗样本生成器生成的对抗样本，而想要使该对抗样本检测器能检测出所有的对抗样本，则需要针对由所有种类的对抗样本生成器生成的对抗样本进行训练，这种操作不仅 成本巨大而且不易实现。2)去噪器只能对有已知对抗样本生成器生成的对抗样本进行处理，且需要预先知道是否存在对抗样本攻击。同时，该方法还需要预先知道攻击者的原始图片在图片识别系统中的识别结果，即需要预先知道攻击者是谁，这在实际应用场景中难以实现。
发明内容
本申请实施例第一方面提供了一种对抗样本的检测方法，该检测方法应用于电子设备的人脸识别场景(如：手机的人脸支付、人脸解锁等)，具体包括：
首先，电子设备可以通过摄像装备采集当前时刻的人脸图像(如：当前时刻拍摄的人脸图片或从当前时刻拍摄的摄像录影中截取的人脸图片)。需要说明的是，摄像装备可以是电子设备上自带的摄像头，也可以是与电子设备物理上分离但是无线连接的摄像头(如：手机没有开启自带的摄像头、手机自带的摄像头被损坏或该手机没有自带的摄像头，但存在与该手机进行了蓝牙连接的手持摄像头)，具体此处对摄像装备不做限定。还需要说明的是，电子设备通过摄像装备采集当前时刻的人脸图像可以有多种形式，例如，可以是响应于对某个操作指令的触发，即某个操作指令的执行会触发电子设备通过摄像头采集当前时刻的人脸图像，也可以是摄像装备始终处于开启状态，只要摄像装备捕捉到当前时刻存在人脸图像，电子设备就采集该人脸图像，具体此处对电子设备采集当前时刻的人脸图像的形式不做限定。如果电子设备在该当前时刻拍摄的人脸图像中人脸区域范围内检测到存在遮挡物(如：眼镜、贴纸等)，则电子设备会进一步判断该遮挡物是否是对抗样本干扰物，若电子设备确定该遮挡物是对抗样本干扰物，则电子设备会确定该当前时刻拍摄的人脸图像为对抗样本(即遭受到对抗样本攻击)。
在本申请实施例中，通过判断当前时刻拍摄的人脸图像中人脸区域范围内的遮挡物是否是对抗样本干扰物来确定该人脸图像是否为对抗样本。本申请实施例所采用的对抗样本的检测方法应用于人脸识别场景，这种检测方法不需要对大量的对抗样本图片进行深度模型训练，也不需要知道生成对抗样本的生成器采用的是哪种对抗样本生成算法(包括已知的或最新产生的对抗样本生成算法)，更不需要预先知道攻击者的人脸图像，便可以检测出是否存在对抗样本，从而使攻击者无法实现对抗样本攻击。并且这种检测方法复杂度低，易于实现。
结合本申请实施例第一方面，在本申请实施例第一方面的第一种实施方式中，电子设备判断遮挡物是否为对抗样本干扰物可以包括：首先，对遮挡物中所有像素点的像素值进行计算，得到该遮挡物的图片熵值；之后，用计算出的遮挡物的图片熵值与预先设定好的阈值(即预设阈值)进行比较，以判断遮挡物是否为对抗样本干扰物。该预设阈值可以根据第一预设方式进行确定，例如，通过该第一预设方式确定的预设阈值可以是用户根据经验值设定的，也可以是基于深度学习网络计算生成的，具体此处不做限定。最后，若该图片熵值大于上述预设阈值，则确定该遮挡物为对抗样本干扰物。
在本申请实施例中，通过计算遮挡物的图片熵值，并将该图片熵值与预设阈值相比较来判断遮挡物是不是对抗样本干扰物，具备实操性。
结合本申请实施例第一方面的第一种实施方式，在本申请实施例第一方面的第二种实 施方式中，对遮挡物中所有像素点的像素值进行计算得到该遮挡物的图片熵值可以包括：将该遮挡物中所有像素点的像素值在色彩空间分解为第一向量像素值(也可称为X轴像素值)、第二向量像素值(也可称为Y轴像素值)和第三向量像素值(也可称为Z轴像素值)，得到第一向量像素值的第一集合、第二向量像素值的第二集合和到第三向量像素值的第三集合；之后，根据熵值计算公式分别计算第一集合的第一图片熵值、第二集合的第二图片熵值和第三集合的第三图片熵值；最后，对第一图片熵值、所述第二图片熵值和所述第三图片熵值取算术平均值，并将该算术平均值作为该遮挡物的图片熵值。在本申请实施例中，说明了如何计算遮挡物的图片熵值，即先将遮挡物的所有像素点在色彩空间进行分拆，然后根据熵值计算公式计算得到，这种计算方式简单、方便、易操作。
结合本申请实施例第一方面的第二种实施方式，在本申请实施例第一方面的第三种实施方式中，上述熵值计算公式可以是：
Figure PCTCN2020091027-appb-000001
其中，i为所述第一集合、所述第二集合或所述第三集合中每一个元素的取值，p i为该i出现的概率，H为该第一图片熵值、该第二图片熵值或该第三图片熵值。也就是说，若该遮挡物是灰色图片时，则该遮挡物中所有像素点的像素值在色彩空间(如：RGB颜色模型)中每一个坐标轴上的取值都是相同的。那么对该遮挡物的图片熵值的计算可以通过熵值计算公式
Figure PCTCN2020091027-appb-000002
来得到，其中，i为遮挡物中每一个像素点的像素值，p i为像素值i出现的概率，H就为该遮挡物的图片熵值。若该遮挡物为彩色图片，则该遮挡物在色彩空间上的每一个坐标轴上的图片熵值也依然可以根据上述计算灰色图片时所采用的熵值计算公式
Figure PCTCN2020091027-appb-000003
计算得到。即当计算X坐标轴上的第一图片熵值时，i就为第一集合中每一个像素值的取值，p i就为i出现的概率，H就为第一图片熵值；当计算Y坐标轴上的第二图片熵值时，i就为第二集合中每一个像素值的取值，p i就为i出现的概率，H就为第二图片熵值；当计算Z坐标轴上的第三图片熵值时，i就为第三集合中每一个像素值的取值，p i就为i出现的概率，H就为第三图片熵值。
在本申请实施例中，给出了其中一种具体的熵值计算公式，该计算公式适用所有图片(包括灰色图片和彩色图片)，适用范围广且具备可操作性。
结合本申请实施例第一方面以及本申请实施例第一方面的第一种实施方式至第三种实施方式，在本申请实施例第一方面的第四种实施方式中，若电子设备检测到上述人脸图像中人脸区域范围内存在遮挡物，且该遮挡物是对抗样本干扰物，该检测方法还可以包括：
根据第二预设方式处理该对抗样本，并将处理后的对抗样本进行识别，得到识别结果。处理的目的是为了消除对抗样本干扰物的影响，可以是直接去除该对抗样本干扰物，也可以是将该对抗样本干扰物转变为普通遮挡物，具体此处不作限定。
在本申请实施例中，当对对抗样本干扰物进行上述处理之后，上述人脸图像中人脸区域范围内将不存在遮挡物或存在的遮挡物仅仅是普通遮挡物，那么电子设备则可以直接对该人脸图像进行识别，得到识别结果。对处理后的遮挡物再进行识别是为了以防出现误识别的情况，提高用户使用体验。
结合本申请实施例第一方面的第四种实施方式，在本申请实施例第一方面的第五种实施方式中，第二预设方式可以包括：
首先确定一个目标像素值，并将对抗样本干扰物中所有像素点的像素值都修改成目标 像素值；或，将对抗样本干扰物中所有像素点的像素值进行代数线性变换，即将对抗样本干扰物中所有像素点的像素值x做代数线性变换处理。例如，将对抗样本干扰物中所有像素点的像素值修改为(255-x)或0.5*(255-x)，具体此处对代数线性变换处理的形式不做限定。
在本申请实施例中，给出了第二预设方式的多种实现方式，更加具备灵活性。
结合本申请实施例第一方面的第五种实施方式，在本申请实施例第一方面的第六种实施方式中，确定目标像素值的方式也可以有多种，可以包括：
在像素值的取值范围内(即0-255中的任意整数)任意选取一个像素值作为目标像素值；
或，
取对抗样本干扰物中任意一个像素点A的像素值(即目标像素值)，然后将对抗样本干扰物内其他所有的像素点的像素值都修改为与该像素点A相同的像素值；
或，
取该人脸图像中人脸区域范围内任意一个像素点B的像素值(即目标像素值)，然后将对抗样本干扰物内所有的像素点的像素值都修改为与该像素点B相同的像素值；
或，
对该人脸图像中人脸区域范围内所有像素点的像素值取算术平均值C(即目标像素值)，然后将对抗样本干扰物内所有的像素点的像素值都修改为与该算术平均值C相同的像素值。
在本申请实施例中，给出了确定目标像素值的多种实现方式，具备灵活性。
结合本申请实施例第一方面以及本申请实施例第一方面的第一种实施方式至第六种实施方式，在本申请实施例第一方面的第七种实施方式中，电子设备在确定该人脸图像为对抗样本(即识别结果不是电子设备的主人)之后，那么该电子设备可以进一步生成提醒通知，该提醒通知用于提示相关用户该电子设备正遭受对抗样本攻击，例如，相关用户可以是电子设备的主人(即受害者)，那么提醒通知就可以提醒受害者及时进行处理(如：修改支付密码、报警)，相关用户也可以是与电子设备对应的服务商家(如：攻击者使用受害者的手机在人人乐超市进行线上支付，那么对应的服务商家就是人人乐超市的收银平台)。提醒通知要实现其提醒功能，则有多种实现方式，包括但不限于如下几种提醒方式：
该提醒通知在电子设备上以语音播报、警铃等形式进行提醒。
和/或，
向与该电子设备对应的服务器发送该提醒通知；
和/或，
向与该电子设备关联的目标电子设备发送该提醒通知。
在本申请实施例中，当确定电子设备正遭受对抗样本攻击时，生成相应的提醒通知来提醒相关用户，具体实用性。
结合本申请实施例第一方面的第一种实施方式至第七种实施方式，在本申请实施例第一方面的第八种实施方式中，确定预设阈值的第一预设方式可以包括：
线下获取大量(如M个，M≥1)正常的人脸图像(即参考人脸图像)，这些人脸图像的人脸区域范围内不存在任何遮挡物(即没有增加任何扰动的人脸原始图片)或存在普通 遮挡物(如：仅佩戴普通的眼镜、创口贴、口罩等)；之后，可以通过对获取到的每一个正常的人脸图像中像素值进行计算，得到每一个正常的人脸图像的图片熵值(即得到M个目标图片熵值)，该图片熵值的计算方式可以通过上述熵值计算公式得到；最后，将所有正常的人脸图像对应的图片熵值取算术平均值，得到的算术平均值就可作为预设阈值。
在本申请实施例中，给出了一种具体的设置预设阈值的方式，具有可操作性。
结合本申请实施例第一方面的第一种实施方式，在本申请实施例第一方面的第九种实施方式中，若上述图片熵值小于或等于该预设阈值，则确定该遮挡物为普通遮挡物；之后，电子设备对该普通遮挡物进行识别，得到识别结果。
在本申请实施例中，若该遮挡物是普通遮挡物，则进行正常识别即可，这样不影响用户的正常使用，提高用户的使用体验。
本申请实施例第二方面提供了一种电子设备，该电子设备可以包括：一个或多个摄像装备；一个或多个触摸屏；一个或多个处理器；一个或多个存储器；
其中，该一个或多个存储器存储有一个或多个计算机程序，该一个或多个计算机程序包括指令，当该指令被该一个或多个处理器执行时，使得该电子设备执行以下步骤：
获取当前时刻的人脸图像，该人脸图像由该摄像装备采集得到；
判断遮挡物是否为对抗样本干扰物，该遮挡物位于该人脸图像中人脸区域范围内；
若该遮挡物为该对抗样本干扰物，则确定该人脸图像为对抗样本。
结合本申请实施例第二方面，在本申请实施例第二方面的第一种实施方式中，当该指令被该电子设备执行时，使得该电子设备还可以执行如下步骤：
对该遮挡物中所有像素点的像素值进行计算，得到该遮挡物的图片熵值；
判断该图片熵值是否大于预设阈值，该预设阈值根据第一预设方式确定；
若该图片熵值大于该预设阈值，则确定该遮挡物为该对抗样本干扰物。
结合本申请实施例第二方面的第一种实施方式，在本申请实施例第二方面的第二种实施方式中，当该指令被该电子设备执行时，使得该电子设备还可以执行如下步骤：
将该遮挡物中所有像素点的像素值在色彩空间分解为第一向量像素值、第二向量像素值和第三向量像素值，得到第一向量像素值的第一集合、第二向量像素值的第二集合和到第三向量像素值的第三集合；
根据熵值计算公式分别计算该第一集合的第一图片熵值、该第二集合的第二图片熵值和该第三集合的第三图片熵值；
确定该第一图片熵值、该第二图片熵值和该第三图片熵值的算术平均值为该遮挡物的图片熵值。
结合本申请实施例第二方面的第二种实施方式，在本申请实施例第二方面的第三种实施方式中，该熵值计算公式可以包括：
Figure PCTCN2020091027-appb-000004
其中，i为该第一集合、该第二集合或该第三集合中每一个元素的取值，p i为该i出现的概率，H为该第一图片熵值、该第二图片熵值或该第三图片熵值。
结合本申请实施例第二方面、本申请实施例第二方面的第一种实施方式至第三种实施方式，在本申请实施例第二方面的第四种实施方式中，若该电子设备确定该遮挡物为该对抗样本干扰物，则当该指令被该电子设备执行时，使得该电子设备还可以执行如下步骤：
根据第二预设方式处理该对抗样本；
将处理后的对抗样本进行识别，得到识别结果。
结合本申请实施例第二方面的第四种实施方式，在本申请实施例第二方面的第五种实施方式中，该第二预设方式包括：
确定目标像素值，并将该对抗样本干扰物中所有像素点的像素值修改为该目标像素值；
或，
将该对抗样本干扰物中所有像素点的像素值进行代数线性变换。
结合本申请实施例第二方面的第五种实施方式，在本申请实施例第二方面的第六种实施方式中，该确定目标像素值包括：
在像素值的取值范围内任意选取一个像素值作为该目标像素值；
或，
确定该对抗样本干扰物中任意一个像素点的像素值为该目标像素值；
或，
确定该人脸区域范围内任意一个像素点的像素值为该目标像素值；
或，
确定该人脸区域范围内所有像素点的像素值的算术平均值为该目标像素值。
结合本申请实施例第二方面、本申请实施例第二方面的第一种实施方式至第六种实施方式，在本申请实施例第二方面的第七种实施方式中，在该电子设备确定该人脸图像为对抗样本之后，则当该指令被该电子设备执行时，使得该电子设备还执行如下步骤：
生成提醒通知；
语音播报该提醒通知；
和/或，
向对应的服务器发送该提醒通知；
和/或，
向关联的目标电子设备发送该提醒通知。
结合本申请实施例第二方面的第一种实施方式至第七种实施方式，在本申请实施例第二方面的第八种实施方式中，该第一预设方式包括：
获取M个参考人脸图像，该参考人脸图像为人脸区域范围内不存在遮挡物或存在普通遮挡物的人脸图像，其中，M≥1；
对该M个参考人脸图像中的目标参考人脸图像中所有像素点的像素值进行计算，得到该目标参考人脸图像的目标图片熵值；
确定与该M个参考人脸图像分别对应的M个目标图片熵值的算术平均值为该预设阈值。
结合本申请实施例第二方面的第一种实施方式，在本申请实施例第二方面的第九种实施方式中，若该图片熵值小于或等于该预设阈值，则当该指令被该电子设备执行时，使得该电子设备还可以执行如下步骤：
确定该遮挡物为普通遮挡物；
对该普通遮挡物进行识别，得到识别结果。
本申请实施例第三方面还提供一种电子设备，该电子设备具体可以包括：
采集单元，用于通过摄像装备采集当前时刻的人脸图像；
判断单元，用于判断遮挡物是否为对抗样本干扰物，该遮挡物位于该人脸图像中人脸区域范围内；
确定单元，用于若该遮挡物为该对抗样本干扰物，则确定该人脸图像为对抗样本。
结合本申请实施例第三方面，在本申请实施例第三方面的第一种实施方式中，该判断单元包括：
计算子单元，用于对该遮挡物中所有像素点的像素值进行计算，得到该遮挡物的图片熵值；
判断子单元，用于判断该图片熵值是否大于预设阈值，该预设阈值根据第一预设方式确定；
第一确定子单元，用于若该图片熵值大于该预设阈值，则确定该遮挡物为该对抗样本干扰物。
结合本申请实施例第三方面的第一种实施方式，在本申请实施例第三方面的第二种实施方式中，该计算子单元具体用于：
将该遮挡物中所有像素点的像素值在色彩空间分解为第一向量像素值、第二向量像素值和第三向量像素值，得到第一向量像素值的第一集合、第二向量像素值的第二集合和到第三向量像素值的第三集合；
根据熵值计算公式分别计算该第一集合的第一图片熵值、该第二集合的第二图片熵值和该第三集合的第三图片熵值；
确定该第一图片熵值、该第二图片熵值和该第三图片熵值的算术平均值为该遮挡物的图片熵值。
结合本申请实施例第三方面的第二种实施方式，在本申请实施例第三方面的第三种实施方式中，该熵值计算公式包括：
Figure PCTCN2020091027-appb-000005
其中，i为该第一集合、该第二集合或该第三集合中每一个元素的取值，p i为该i出现的概率，H为该第一图片熵值、该第二图片熵值或该第三图片熵值。
结合本申请实施例第三方面、本申请实施例第三方面的第一种实施方式至第三种实施方式，在本申请实施例第三方面的第四种实施方式中，若该遮挡物为该对抗样本干扰物，则该电子设备还包括：
处理单元，用于根据第二预设方式处理该对抗样本；
识别单元，用于将处理后的对抗样本进行识别，得到识别结果。
结合本申请实施例第三方面的第四种实施方式，在本申请实施例第三方面的第五种实施方式中，该第二预设方式包括：
确定目标像素值，并将该对抗样本干扰物中所有像素点的像素值修改为该目标像素值；
或，
将该对抗样本干扰物中所有像素点的像素值进行代数线性变换。
结合本申请实施例第三方面的第五种实施方式，在本申请实施例第三方面的第六种实施方式中，该确定目标像素值包括：
在像素值的取值范围内任意选取一个像素值作为该目标像素值；
或，
确定该对抗样本干扰物中任意一个像素点的像素值为该目标像素值；
或，
确定该人脸区域范围内任意一个像素点的像素值为该目标像素值；
或，
确定该人脸区域范围内所有像素点的像素值的算术平均值为该目标像素值。
结合本申请实施例第三方面、本申请实施例第三方面的第一种实施方式至第六种实施方式，在本申请实施例第三方面的第七种实施方式中，在确定该人脸图像为对抗样本之后，该电子设备还包括：
生成单元，用于生成提醒通知；
播报单元，用于语音播报该提醒通知；
和/或，
发送单元，用于向对应的服务器发送该提醒通知；和/或，向关联的目标电子设备发送该提醒通知。
结合本申请实施例第三方面的第一种实施方式至第七种实施方式，在本申请实施例第三方面的第八种实施方式中，该第一预设方式包括：
获取M个参考人脸图像，该参考人脸图像为人脸区域范围内不存在遮挡物或存在普通遮挡物的人脸图像，其中，M≥1；
对该M个参考人脸图像中的目标参考人脸图像中所有像素点的像素值进行计算，得到该目标参考人脸图像的目标图片熵值；
确定与该M个参考人脸图像分别对应的M个目标图片熵值的算术平均值为该预设阈值。
结合本申请实施例第三方面的第一种实施方式，在本申请实施例第三方面的第九种实施方式中，该判断单元还包括：
第二确定子单元，用于若该图片熵值小于或等于该预设阈值，则确定该遮挡物为普通遮挡物；
该识别单元，具体还用于对该普通遮挡物进行识别，得到识别结果。
本申请实施例第四方面提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第一方面以及第一方面任意一种可能实现方式的检测方法。
本申请实施例第五方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第一方面以及第一方面任意一种可能实现方式的检测方法。
从以上技术方案可以看出，本申请实施例具有以下优点：
电子设备通过摄像装备(如：电子设备上自带的摄像头，或与电子设备物理上分离但是无线连接的摄像头)采集当前时刻的人脸图像(如：当前时刻拍摄的人脸图片或从当前时刻拍摄的摄像录影中截取的人脸图片)。如果电子设备在该当前时刻拍摄的人脸图像中人脸区域范围内检测到存在遮挡物(如：眼镜、贴纸等)，则电子设备会进一步判断该遮挡物是否是对抗样本干扰物，若电子设备确定该遮挡物是对抗样本干扰物，则电子设备会确定该当前时刻拍摄的人脸图像为对抗样本(即遭受到对抗样本攻击)。在本申请实施例 中，通过判断当前时刻拍摄的人脸图像中人脸区域范围内的遮挡物是否是对抗样本干扰物来确定该人脸图像是否为对抗样本。本申请实施例所采用的对抗样本的检测方法应用于人脸识别场景，这种检测方法不需要对大量的对抗样本图片进行深度模型训练，也不需要知道生成对抗样本的生成器采用的是哪种对抗样本生成算法(包括已知的或最新产生的对抗样本生成算法)，更不需要预先知道攻击者的人脸图像，便可以检测出是否存在对抗样本，从而使攻击者无法实现对抗样本攻击。并且这种检测方法复杂度低，易于实现。
附图说明
图1为现有技术中对抗样本攻击的一个实例的示意图；
图2为人脸识别应用场景中对抗样本攻击的一种实施方式的示意图；
图3为对抗样本物品与受害者之间对应关系的一个示意图；
图4为对抗样本物品与受害者之间对应关系的另一个示意图；
图5为本申请实施例中对抗样本检测方法的一个示意图；
图6为几种不同像素点分布的图片熵值的计算结果的示意图；
图7为本申请实施例中对生成的提醒通知进行处理的一种实现方式；
图8为本申请实施例中对生成的提醒通知进行处理的另一种实现方式；
图9为本申请实施例中生成的提醒通知被发送至与电子设备对应的服务器的示意图；
图10为本申请实施例中生成的提醒通知被发送至与电子设备对应的关联目标电子设备的示意图；
图11为本申请实施例中电子设备的一个示意图；
图12为本申请实施例中电子设备的另一个示意图；
图13为本申请实施例中电子设备的硬件架构图；
图14为本申请实施例中电子设备的软件架构图。
具体实施方式
在人脸识别的应用场景中(如：手机中的人脸支付、人脸解锁等)，由于攻击者无法对电子设备(如：手机)当前时刻拍下的人脸图像做加扰处理(即：无法对当前时刻拍下的人脸图像中像素点的像素值进行修改)，因此攻击者无法采用与图1对应的方式来实现对抗样本攻击。在这种情况下，攻击者就通过佩戴加扰眼镜、加扰贴纸等对抗样本物品来实现对抗样本攻击。以图2为例对这种对抗样本攻击的方式进行说明：攻击者A佩戴经过特殊处理的对抗样本眼镜框a，在人脸识别的应用场景中(如：攻击者A正在使用手机中的人脸支付)，电子设备(如：手机)通过摄像头采集到当前时刻佩戴有对抗样本眼镜框(记为镜框a)的攻击者A的人脸图像，那么该电子设备就会将攻击者A识别为受害者V1，从而成功完成手机的人脸支付功能(这里假设该手机中设置的人脸支付的目标人脸图像是受害者V1)，以此类似，攻击者B、攻击者C可以采用类似的攻击方式(如：分别佩戴镜框b、镜框c)被电子设备分别识别成受害者V2、受害者V3。其中，上述的一种识别应用场景包括：一个佩戴有对抗样本物品的攻击者可以对应多个受害者，对应的这多个受害者是深度学习网络在生成对应的对抗样本物品时就已经确定了的。如图3所示，以对抗样本 物品为对抗样本眼镜框为例进行示意，在生成对抗样本眼镜框(记为镜框a1)之前，攻击者就可以先确定好受害者(如：受害者V11、受害者V12、受害者V13)以及受害者数量(如：3个)等需求，之后，根据攻击者的上述需求，深度学习网络采用特定的算法生成对应的镜框a1，攻击者佩戴上该镜框a1之后，就可以被电子设备识别成受害者V11、受害者V12或受害者V13。类似的，上述的一种识别应用场景还可以包括：多个攻击者通过佩戴同一个对抗样本物品也可以识别成同一个受害者。如图4所示，以对抗样本物品为对抗样本眼镜框为例进行示意，假设攻击者数量为3，即攻击者A11、攻击者A12、攻击者A13分别佩戴上对抗样本眼镜框(记为镜框a2)，深度学习网络就可以根据攻击者的需求将佩戴有镜框a2的攻击者A11、攻击者A12、攻击者A13均确定为受害者V21。那么，无论是攻击者A11、攻击者A12、攻击者A13中的哪一个佩戴上镜框a2，都可以被电子设备识别为受害者V21。
以上这种对抗样本攻击的方式给图像识别系统带来了很大的威胁并对识别结果造成了极大的影响(如：错误识别)，这种影响有可能会造成严重后果(如：识别成受害者并完成线上支付，造成受害者财务损失；或，识别成受害者并解锁了受害者的手机，造成受害者的隐私被泄露等)。为避免这种对抗样本攻击在人脸识别场景中造成的不良影响或严重后果，本申请实施例提供了一种对抗样本的检测方法，这种检测方法可以有效检测到当前时刻采集到的人脸图像是否是对抗样本，从而可以有效防止对抗样本攻击的成功实施。
需要说明的是，本申请实施例提供的对抗样本的检测方法应用于人脸识别场景，该检测方法的实现主体包括电子设备，该电子设备配备有摄像装备(如：摄像头)和显示装备(如：液晶显示屏)，可以是手机、平板电脑、智能手表等智能终端，具体此处对电子设备不做限定。还需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
图5为本申请实施例中对抗样本检测方法的一个示意图，具体实现方式如下：
501、通过摄像装备采集当前时刻的人脸图像。
电子设备可以通过摄像装备采集当前时刻的人脸图像。需要说明的是，摄像装备可以是电子设备上自带的摄像头，也可以是与电子设备物理上分离但是无线连接的摄像头(如：手机没有开启自带的摄像头、手机自带的摄像头被损坏或该手机没有自带的摄像头，但存在与该手机进行了蓝牙连接的手持摄像头)，具体此处对摄像装备不做限定。还需要说明的是，电子设备通过摄像装备采集当前时刻的人脸图像可以有多种形式，例如，可以是响应于对某个操作指令的触发，即某个操作指令的执行会触发电子设备通过摄像头采集当前时刻的人脸图像以电子设备为手机为例进行说明：该操作指令可以是用户使用手机向商家提供的支付二维码(如：微信或支付宝的支付二维码)进行扫码时的支付操作，为保证支付环境安全，该支付操作需要对用户的身份进行验证，该操作指令还可以是用户对手机上 某应用(如：网上银行、话费查询等)进行的开启操作，为保证信息安全，该开启操作也需要对用户的身份进行验证。在本申请实施例中，对操作指令的形式不做限定。用户对操作指令的执行会触发电子设备对用户的身份进行验证，其中验证方式之一就是对当前时刻获取到的人脸图像进行识别，即用户上述的支付操作、开启操作等将会触发电子设备开启摄像头对该用户的人脸进行拍摄，得到当前时刻的人脸图像。需要说明的是，电子设备对用户的人脸进行拍摄，可以是直接拍摄的图片，也可以是拍摄的录像，再从该录像中截取出图片，具体此处对当前时刻的人脸图像的获取方式不做限定。电子设备通过摄像装备采集当前时刻的人脸图像除了可以是响应于对某个操作指令的触发之外，还可以是摄像装备始终处于开启状态，只要摄像装备捕捉到当前时刻存在人脸图像，电子设备就采集该人脸图像。在本申请实施例中，对电子设备采集当前时刻的人脸图像的形式不做限定。
502、判断人脸区域范围内是否存在遮挡物，若是，则执行步骤503，若否，则执行步骤504。
电子设备通过摄像装备获取到当前时刻的人脸图像之后，将对该人脸图像中人脸区域范围内进行遮挡物的检测，即检测人脸区域范围内是否存在如眼镜、眼镜框、贴纸等人为佩戴的遮挡物。如果该人脸区域范围内存在遮挡物，则执行步骤503，若该人脸区域范围内不存在遮挡物，则执行步骤504。
503、判断该遮挡物是否为对抗样本干扰物，若是，则执行步骤505，若否，则执行步骤504。
若电子设备检测到上述人脸图像中人脸区域范围内存在遮挡物，则电子设备进一步判断该遮挡物是否是对抗样本干扰物。若该遮挡物是对抗样本干扰物，则执行步骤505，若该遮挡物不是对抗样本干扰物，则执行步骤504。
需要说明的是，本申请实施例中，对抗样本干扰物是指以实施对抗样本攻击为目的、由深度学习网络训练而得的具有对抗样本属性的干扰物，如对抗样本眼镜框(如图2、图3、图4中所述的镜框a、镜框b、镜框c、镜框a1、镜框a2)、对应样本贴纸等，具体此处对对抗样本干扰物的形式不做限定。
在人脸识别场景下对抗样本攻击形式中，由于对抗样本干扰物具有以下属性特点：小范围内像素点的像素值变化巨大且该变化无规律，其在视觉上的表现为色彩艳丽。基于此，在本申请的一些实施方式中，电子设备可以通过但不限于采用图片熵值计算的方法对遮挡物像素点的像素值进行分析，以判断该遮挡物是否为对抗样本遮挡物。在具体介绍此方法的详细步骤之前，先介绍在本申请实施例中可能出现的一些概念。
首先，介绍色彩空间的概念，色彩是人的眼睛对于不同频率光线的不同感受，色彩既是客观存在的(不同频率的光)又是主观感知的，有认识差异。基于此，为了更为客观、准确的对色彩进行描述，就出现了色彩空间(也可称为色域)的概念。通过建立色彩模型，以一维、二维、三维甚至四维空间坐标来表示某一色彩，这种坐标系统所能定义的色彩范围即色彩空间。目前经常用到的色彩空间的类型主要有三原色光模式(RGB)、印刷四分色模式(CMYK)、颜色模型(Lab)等。为便于描述，在本申请实施例中，以色彩空间为三原色光模式为例进行说明。三原色光模式，又可称为RGB颜色模型或红绿蓝颜色模型，是一种加色模型，将红色(Red)、绿色(Green)、蓝色(Blue)这三种原色的色光以不同的比例相 加，以产生多种多样的色光，这些多种多样的色光就定义了一个色彩空间，如果将红色的量定义为X坐标轴、绿色的量定义为Y坐标轴、蓝色的量定义为Z坐标轴(红色、绿色、蓝色的量与X坐标轴、Y坐标轴、Z坐标轴分别唯一对应即可，这里只是示意其中一种定义方式，具体不做限定)，这样就会得到一个三维空间，每种可能的颜色在这个三维空间中都有唯一的一个位置。RGB颜色模型根据实际使用设备系统能力的不同，有各种不同的实现方法。其中，最常用的是红色、绿色、蓝色中每个颜色通道有256色级(色级的取值范围为0-255的整数)。基于这样的RGB颜色模型的色彩空间就可以表现为256×256×256≈1670万色，一些实现方法还可以采用每种原色更多的色级(如512色级)，这样就能在相同范围内实现更高更精确的色彩密度。其中，每一个色级即为图片中对应位置的像素点的像素值。为便于描述理解，以每种原色的色级为256为例进行说明：
假设红色的量定义为X坐标轴、绿色的量定义为Y坐标轴、蓝色的量定义为Z坐标轴，那么在一个图像中，像素值为RGB(255,0,0)的色彩表现为红色，像素值为RGB(0,255，0)的色彩表现为绿色，像素值为RGB(0,0,255)的色彩表现为蓝色。当在一个图像中，像素值在各个坐标上的取值至少有两个不相同时，则该图像就表现为彩色图像；当像素值在各个坐标上的取值都相同时，则该图像就表现为灰度图像，例如，当三原色中每种原色的色级都为255时，则该像素值RGB(255,255,255)的色彩表现就为白色，当三原色中每种原色的色级都为0时，则该像素值RGB(0,0,0)的色彩表现就为黑色，当三原色中每种原色的色级都相等时，则该像素值RGB(m,m,m)的色彩表现就为灰色，m为整数且0＜m＜255，例如像素值RGB(100,100,100)就代表灰度为100，像素值RGB(50,50,50)就代表灰度为50，灰度是指黑白图像中每一个像素点的颜色深度。
其次，介绍图片熵值的概念，简单来说，熵就是用来描述混乱的程度，最早是物理学中用来描述物质混乱的程度，后来逐渐引申到信息学、图像学等领域，用来对不确定性的一种度量。信息量越大，不确定性就越小，熵也就越大；反之，信息量越小，不确定性越大，熵也越小。根据熵的特性，就可以通过计算熵值来判断一个事件的随机性及无序程度。基于此，在本申请实施例中，就引入图片熵值的概念，图片熵值用于反应图像中像素值的分布特征，图片熵值越大，那么对应的图像色彩就越艳丽，图像所含信息量也越大。
下面，详细介绍本申请实施例中电子设备如何通过图片熵值计算的方法来判断遮挡物是否为对抗样本遮挡物，判断的步骤可以包括：
a、对遮挡物中所有像素点的像素值进行计算，得到该遮挡物的图片熵值；
电子设备可以通过相应的熵值计算公式来对遮挡物中所有像素点的像素值进行计算，以得到该遮挡物的图片熵值。包括但不限行采用如下方式：
1)若该遮挡物为灰色图片，则该遮挡物中所有像素点的像素值在RGB颜色模型中每一个坐标轴上的取值都是相同的。那么对该遮挡物的图片熵值的计算可以通过但不限于熵值计算公式
Figure PCTCN2020091027-appb-000006
来得到，其中，i为遮挡物中每一个像素点的像素值，p i为像素值i出现的概率，H就为该遮挡物的图片熵值。图6(当遮挡物为灰色图片时)示意了几种不同像素点分布的图片熵值H的计算结果：当遮挡物中所有像素点的像素值在RGB颜色模型中的取值均为RGB(255，255，255)或取值均为RGB(0，0，0)时，则根据上述熵值计算公式得到该遮挡物的图片熵值H1＝H2＝0；当遮挡物中像素点的像素值分布如图 6中右边两种分布形式时，根据上述熵值计算公式得到的遮挡物图片熵值分别为H3＝1.0413和H4＝1.3476。
2)若该遮挡物为彩色图片，将该遮挡物中所有像素点的像素值在色彩空间分解为第一向量像素值(也可称为X轴像素值)、第二向量像素值(也可称为Y轴像素值)和第三向量像素值(也可称为Z轴像素值)，得到第一向量像素值的第一集合、第二向量像素值的第二集合和到第三向量像素值的第三集合；之后，根据熵值计算公式分别计算第一集合的第一图片熵值、第二集合的第二图片熵值和第三集合的第三图片熵值；最后，对第一图片熵值、所述第二图片熵值和所述第三图片熵值取算术平均值，并将该算术平均值作为该遮挡物的图片熵值。
需要说明的是，在本申请的一些实施方式中，在每一个坐标轴上的图片熵值也可以根据上述计算灰色图片时采用的熵值计算公式
Figure PCTCN2020091027-appb-000007
计算得到。即当计算X坐标轴上的第一图片熵值时，i就为第一集合中每一个像素值的取值，p i就为i出现的概率，H就为第一图片熵值；当计算Y坐标轴上的第二图片熵值时，i就为第二集合中每一个像素值的取值，p i就为i出现的概率，H就为第二图片熵值；当计算Z坐标轴上的第三图片熵值时，i就为第三集合中每一个像素值的取值，p i就为i出现的概率，H就为第三图片熵值。
为便于理解，以遮挡物中像素点的个数为4为例进行说明，假设该遮挡物中这4个像素点的像素值在RGB颜色模型中分别为RGB1(120，50，80)、RGB2(30，90，40)、RGB3(70，140，200)、RGB4(100，160，20)，那么电子设备将会将这4个像素点的像素值分别分解为(120，0，0)、(0，50，0)、(0，0，80)，(30，0，0)、(0，90，0)、(0，0，40)，(70，0，0)、(0，140，0)、(0，0，200)，(100，0，0)、(0，160，0)、(0，0，20)。那么得到的第一向量像素值的第一集合就为{(120，0，0)、(30，0，0)、(70，0，0)、(100，0，0)}，第二向量像素值的第二集合就为{(0，50，0)、(0，90，0)、(0，140，0)、(0，160，0)}，第三向量像素值的第三集合就为{(0，0，80)、(0，0，40)、(0，0，200)、(0，0，20)}。之后，电子设备就可以根据熵值计算公式
Figure PCTCN2020091027-appb-000008
分别计算每一个集合中的图片熵值，从而得到第一集合的第一图片熵值Hx、第二集合的第二图片熵值Hy、第三集合的第三图片熵值Hz。最后，可以将H＝(Hx+Hy+Hz)/3作为该遮挡物的图片熵值。
b、判断该图片熵值是否大于预设阈值；
之后，用计算出的遮挡物的图片熵值与预先设定好的阈值(即预设阈值)进行比较，以判断遮挡物是否为对抗样本干扰物。需要说明的是，本申请实施例中的预设阈值可以通过多种方式得到，可以是用户根据经验值设定的，也可以是基于深度学习网络计算生成的，具体此处不做限定。优选的，在本申请的一些实施方式中，预设阈值可以通过如下方式确定：线下获取大量(如M个，M≥1)正常的人脸图像(即参考人脸图像)，这些人脸图像的人脸区域范围内不存在任何遮挡物(即没有增加任何扰动的人脸原始图片)；之后，可以通过对获取到的每一个正常的人脸图像中像素值进行计算，得到每一个正常的人脸图像的图片熵值，该图片熵值的计算方式可以通过上述熵值计算公式得到；最后，将所有正常的人脸图像对应的图片熵值取算术平均值，得到的算术平均值就可作为预设阈值。
c、若该图片熵值大于预设阈值，则确定该遮挡物为对抗样本干扰物。
若电子设备确定遮挡物的图片熵值大于预设阈值，则确定该遮挡物为对抗样本干扰物。
504、对所述人脸图像进行识别，得到识别结果。
若电子设备检测到上述人脸图像中人脸区域范围内不存在遮挡物，或，电子设备检测到上述人脸图像中人脸区域范围内存在的遮挡物不是对抗样本干扰物(即虽然有遮挡物或存在普通遮挡物(如：仅佩戴普通的眼镜、创口贴、口罩等)，但不存在对抗样本攻击的情况，例如：在步骤503中，若电子设备确定遮挡物的图片熵值小于或等于阈值，则确定该遮挡物为普通遮挡物)，说明没有遭受到对抗样本攻击，那么电子设备则直接对该人脸图像进行识别，得到识别结果。目前对于现有的电子设备的人脸识别系统，正常的小范围的面部遮挡(如戴眼镜、贴创口贴等)并不会影响人脸识别系统的识别结果。以用户使用手机向商家提供的支付二维码进行扫码时的支付操作为例：手机获取到该人脸图像，将会与认证过的能够开启该支付操作的目标人脸图像进行比对，若比对通过(即该人脸图像与目标人脸图像一致，为同一人)，则说明支付环境安全，手机即可完成上述支付操作；若比对不通过(即该人脸图像与目标人脸图像不一致，不是同一人)，则说明支付环境不安全，手机即可中止上述支付操作。
505、确定所述人脸图像为对抗样本。
若电子设备检测到上述人脸图像中人脸区域范围内存在遮挡物，且该遮挡物是对抗样本干扰物，电子设备将确定该人脸图像为对抗样本，说明该电子设备正遭受对抗样本攻击。
506、对所述对抗样本进行处理。
优选的，在本申请的一些实施方式中，当电子设备确定该人脸图像为对抗样本之后，还可以进一步对该对抗样本进行处理，处理的目的是为了消除对抗样本干扰物的影响，可以是直接去除该对抗样本干扰物，也可以是将该对抗样本干扰物转变为普通遮挡物，具体此处不作限定。在本申请的一些实施方式中，可以通过如下方式进行处理：
a、首先确定一个目标像素值，并将对抗样本干扰物中所有像素点的像素值都修改成目标像素值。
需要说明的是，本申请实施例中确定目标像素值也可以有多种方式，包括但不限于：
在像素值的取值范围内(即0-255中的任意整数)任意选取一个像素值作为目标像素值；
或，
取对抗样本干扰物中任意一个像素点A的像素值(即目标像素值)，然后将对抗样本干扰物内其他所有的像素点的像素值都修改为与该像素点A相同的像素值；
或，
取该人脸图像中人脸区域范围内任意一个像素点B的像素值(即目标像素值)，然后将对抗样本干扰物内所有的像素点的像素值都修改为与该像素点B相同的像素值；
或，
对该人脸图像中人脸区域范围内所有像素点的像素值取算术平均值C(即目标像素值)，然后将对抗样本干扰物内所有的像素点的像素值都修改为与该算术平均值C相同的像素值。
b、将对抗样本干扰物中所有像素点的像素值进行代数线性变换。
将对抗样本干扰物中所有像素点的像素值x做代数线性变换处理。例如，将对抗样本 干扰物中所有像素点的像素值修改为(255-x)或0.5*(255-x)，具体此处对代数线性变换处理的形式不做限定。
507、将处理后的对抗样本进行识别，得到识别结果。
当对对抗样本干扰物进行上述处理之后，上述人脸图像中人脸区域范围内将不存在遮挡物或存在的遮挡物仅仅是普通遮挡物，那么电子设备则可以直接对该人脸图像进行识别，得到识别结果。具体的识别方式与上述步骤504类似，此处不予赘述。若对处理后的对抗样本识别后，若得到的识别结果是电子设备的主人，则说明上述是误触发；若得到的识别结果不是电子设备的主人，优选的，在本申请的一些实施方式中，若电子设备确定该人脸图像是真正的对抗样本(即识别结果不是电子设备的主人)，那么该电子设备可以进一步生成提醒通知，该提醒通知用于提示相关用户该电子设备正遭受对抗样本攻击，例如，相关用户可以是电子设备的主人(即受害者)，那么提醒通知就可以提醒受害者及时进行处理(如：修改支付密码、报警)，相关用户也可以是与电子设备对应的服务商家(如：攻击者使用受害者的手机在人人乐超市进行线上支付，那么对应的服务商家就是人人乐超市的收银平台)。提醒通知要实现其提醒功能，则有多种实现方式，包括但不限于如下几种提醒方式(为便于理解，以电子设备为手机为例进行说明)：
a、该提醒通知在手机上以语音播报、警铃等形式进行提醒。
提醒通知的这种提醒方式主要是为了引起手机周围的用户(如：正在收银的服务人员、在攻击者周围的其他顾客等)的注意，使得攻击者忌惮从而主动放弃此次对抗样本攻击或使得周围的用户对攻击者的此次对抗样本攻击进行干预使其停止攻击。如图7所示，当手机确定通过手机的摄像头采集到的当前时刻的人脸图像是对抗样本，那么手机可以语音播放“正遭受对抗样本攻击，请停止支付！”或类似提醒内容(如：“本手机疑似被盗，使用者请停止支付！”、“本手机正在被非法使用，快抓坏蛋！”等)，具体此处对语音播放的文字内容的具体形式不做限定。此外，手机除了可以是语音播放相关内容进行提醒之外，还可以是播放警铃，以起到类似的提醒作用，警铃的表现形式也可以是多种，如图8所示：手机可以发出“嘟！嘟嘟！嘟！嘟嘟！”的警铃声，也可以发出“呜唔！呜唔！呜唔！”的警铃声，具体此处对警铃的表现形式不做限定。
b、手机将该提醒通知发送至对应的服务器。
手机生成的提醒通知还可以进一步发送至与该手机对应的服务器(如：正在进行线上支付的商家平台)，如图9所示，当攻击者正在使用线上支付向商家平台支付款项的过程中，手机检测到当前时刻拍摄的攻击者的人脸图像是对抗样本时，那么手机将会向对应的收款商家平台发送提醒通知，提醒商家此次支付过程不安全，商家平台收到该提醒通知，就可以主动终止该支付过程，以保证受害者的财务安全。
c、手机将该提醒通知发送至与该手机关联的其他目标电子设备。
该手机生成的提醒通知还可以进一步发送至与该手机关联的其他目标电子设备。如图10所示，若正在遭受对抗样本攻击的手机a的主人是受害者B，受害者B除了拥有该手机a之外，还拥有手机b、平板电脑c、智能手表d，受害者B将手机a、手机b、平板电脑c、智能手表d已提前进行了关联(如：之前已经注册了统一的ID账号，内容可以共享)，那么手机b、平板电脑c、智能手表d就是本申请实施例中与手机a关联的其他目标电子设 备。若攻击者正在对受害者B的手机a实行对抗样本攻击，那么手机a将会生成一个提醒通知(例如：该提醒通知可以是“手机a正遭受对抗样本攻击，请干预！”)，该提醒通知会被发送至手机b、平板电脑c或智能手表d中的至少一个，这样受害者B若正佩戴着智能手表d，或，正在使用手机b或平板电脑c，那受害者B就可以及时知道自己的手机a正在被攻击者非法使用，受害者B就可以及时进行干预，如：在其他目标电子设备上更改支付密码、向相关部门报警等。
本申请实施例可以根据上述检测方法的示例对电子设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
例如，图11示出了一种电子设备的示意图，本申请实施例提供的电子设备可以包括：
采集单元1101，用于通过摄像装备采集当前时刻的人脸图像；
判断单元1102，用于判断遮挡物是否为对抗样本干扰物，该遮挡物位于该人脸图像中人脸区域范围内；
确定单元1103，用于若该遮挡物为该对抗样本干扰物，则确定该人脸图像为对抗样本。
优选的，在本申请的一些实施方式中，判断单元1102还可以包括更多的子单元，以实现更多功能。如图12所示，为本申请实施例提供的电子设备的另一示意图，该电子设备具体包括：采集单元1201、判断单元1202、确定单元1203。其中，采集单元1201、判断单元1202、确定单元1203与图11中的采集单元1101、判断单元1102、确定单元1103所实现的功能类似，此处不予赘述。在本申请实施例中，判断单元1202还可以进一步包括：
计算子单元12021，用于对该遮挡物中所有像素点的像素值进行计算，得到该遮挡物的图片熵值；
判断子单元12022，用于判断该图片熵值是否大于预设阈值，该预设阈值根据第一预设方式确定；
第一确定子单元12023，用于若该图片熵值大于该预设阈值，则确定该遮挡物为该对抗样本干扰物。
优选的，在本申请实施例中，判断单元1202还可以进一步包括第二确定子单元12024，具体用于：若该图片熵值小于或等于该预设阈值，则确定该遮挡物为普通遮挡物。
优选的，该第一预设方式可以包括：首先，获取M个参考人脸图像，该参考人脸图像为人脸区域范围内不存在遮挡物的人脸图像，其中，M≥1；之后，对该M个参考人脸图像中的目标参考人脸图像中所有像素点的像素值进行计算，得到该目标参考人脸图像的目标图片熵值；最后，确定与该M个参考人脸图像分别对应的M个目标图片熵值的算术平均值为该预设阈值。
优选的，在本申请的一些实施方式中，计算子单元12021具体还可以用于：
将该遮挡物中所有像素点的像素值在色彩空间分解为第一向量像素值、第二向量像素值和第三向量像素值，得到第一向量像素值的第一集合、第二向量像素值的第二集合和到 第三向量像素值的第三集合；并根据熵值计算公式分别计算该第一集合的第一图片熵值、该第二集合的第二图片熵值和该第三集合的第三图片熵值；之后，确定该第一图片熵值、该第二图片熵值和该第三图片熵值的算术平均值为该遮挡物的图片熵值。
优选的，在本申请的一些实施方式中，熵值计算公式可以包括：
Figure PCTCN2020091027-appb-000009
其中，i为该第一集合、该第二集合或该第三集合中每一个元素的取值，p i为该i出现的概率，H为该第一图片熵值、该第二图片熵值或该第三图片熵值。
优选的，在本申请的一些实施方式中，电子设备还可以包括更多的单元以实现更多功能，例如，当判断单元1202确定遮挡物为对抗样本干扰物，则电子设备还可以进一步包括：
处理单元1204，用于根据第二预设方式处理该对抗样本；
识别单元1205，用于将处理后的对抗样本进行识别，得到识别结果。
优选的，在本申请实施例中，若判断单元1202还进一步包括了第二确定子单元12024，则该识别单元1205还可以具体用于对该普通遮挡物进行识别，得到识别结果。
优选的，上述第二预设方式可以包括：确定目标像素值，并将该对抗样本干扰物中所有像素点的像素值修改为该目标像素值；或，将该对抗样本干扰物中所有像素点的像素值进行代数线性变换。
优选的，确定目标像素值也可以包括以下几种方式：
1)在像素值的取值范围内任意选取一个像素值作为该目标像素值；
2)确定该对抗样本干扰物中任意一个像素点的像素值为该目标像素值；
3)确定该人脸区域范围内任意一个像素点的像素值为该目标像素值；
4)确定该人脸区域范围内所有像素点的像素值的算术平均值为该目标像素值。
优选的，在本申请的一些实施方式中，在确定单元1203确定人脸图像为对抗样本之后，电子设备还可以进一步包括：
生成单元1206，用于生成提醒通知；
播报单元1207，用于语音播报该提醒通知；
和/或，
发送单元1208，用于向对应的服务器和/或向关联的目标电子设备发送该提醒通知。
图11以及图12对应的实施例中的电子设备具体的功能以及结构用于实现前述图4至图10中由电子设备进行处理的步骤，具体此处不予赘述。
如图13所示，为本申请实施例电子设备的另一示意图。为便于说明，仅示出了与本申请实施例相关的部分，具体技术细节未揭示的，请参照本申请实施例方法部分。该电子设备可以包括手机、平板电脑、智能手表、个人电脑等。该电子设备100可以包括处理器110，外部存储器接口120，内部存储器121，通用串行总线(universal serial bus，USB)接口130，充电管理模块140，电源管理模块141，电池142，天线1，天线2，移动通信模块150，无线通信模块160，音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，传感器模块180，按键190，马达191，指示器192，摄像装备193(也可以称为摄像头193)，显示屏194，以及用户标识模块(subscriber identification module，SIM)卡接口195等。其中传感器模块180可以包括压力传感器180A，陀螺仪传感器180B， 气压传感器180C，磁传感器180D，加速度传感器180E，距离传感器180F，接近光传感器180G，指纹传感器180H，温度传感器180J，触摸传感器180K，环境光传感器180L，骨传导传感器180M等。
本领域技术人员可以理解的是，图13中示出的电子设备100的结构并不构成对电子设备100的具体限定，在本申请的另一些实施例中，可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软件和硬件的组合实现。
下面结合图13对电子设备100的各个构成部件进行具体的介绍：
处理器110可以包括一个或多个处理单元，例如：处理器110可以包括应用处理器(application processor，AP)，调制解调处理器，图形处理器(graphics processing unit，GPU)，图像信号处理器(image signal processor，ISP)，控制器，视频编解码器，数字信号处理器(digital signal processor，DSP)，基带处理器，和/或神经网络处理器(neural-network processing unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。
控制器可以根据指令操作码和时序信号，产生操作控制信号，完成取指令和执行指令的控制。
处理器110中还可以设置存储器，用于存储指令和数据。在一些实施例中，处理器110中的存储器为高速缓冲存储器。该存储器可以保存处理器110刚用过或循环使用的指令或数据。如果处理器110需要再次使用该指令或数据，可从所述存储器中直接调用。避免了重复存取，减少了处理器110的等待时间，因而提高了系统的效率。
在一些实施例中，处理器110可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit，I2C)接口，集成电路内置音频(inter-integrated circuit sound，I2S)接口，脉冲编码调制(pulse code modulation，PCM)接口，通用异步收发传输器(universal asynchronous receiver/transmitter，UART)接口，移动产业处理器接口(mobile industry processor interface，MIPI)，通用输入输出(general-purpose input/output，GPIO)接口，用户标识模块(subscriber identity module，SIM)接口，和/或通用串行总线(universal serial bus，USB)接口等。
I2C接口是一种双向同步串行总线，包括一根串行数据线(serial data line，SDA)和一根串行时钟线(derail clock line，SCL)。在一些实施例中，处理器110可以包含多组I2C总线。处理器110可以通过不同的I2C总线接口分别耦合触摸传感器180K，充电器，闪光灯，摄像头193等。例如：处理器110可以通过I2C接口耦合触摸传感器180K，使处理器110与触摸传感器180K通过I2C总线接口通信，实现电子设备100的触摸功能。类似的，在本申请实施例中，处理器110就可以通过I2C接口耦合摄像头193，若摄像头采集到当前时刻的人脸图像，摄像头就可以通过I2C总线接口将采集到的上述人脸图像传输给处理器110进行处理。
I2S接口可以用于音频通信。在一些实施例中，处理器110可以包含多组I2S总线。处理器110可以通过I2S总线与音频模块170耦合，实现处理器110与音频模块170之间的通信。在一些实施例中，音频模块170还可以通过I2S接口向无线通信模块160传递音 频信号，实现通过蓝牙耳机接听电话的功能。
PCM接口也可以用于音频通信，将模拟信号抽样，量化和编码。在一些实施例中，音频模块170与无线通信模块160可以通过PCM总线接口耦合。在一些实施例中，音频模块170也可以通过PCM接口向无线通信模块160传递音频信号，实现通过蓝牙耳机接听电话的功能。所述I2S接口和所述PCM接口都可以用于音频通信。在本申请实施例的一些实现方式中，若电子设备100正在遭受对抗样本攻击，处理器110会生成提醒通知，若本申请实施例中的处理器110通过I2S总线接口或PCM总线接口与音频模块170进行了耦合，那么该提醒通知就可以被发送至音频模块170。
UART接口是一种通用串行数据总线，用于异步通信。该总线可以为双向通信总线。它将要传输的数据在串行通信与并行通信之间转换。在一些实施例中，UART接口通常被用于连接处理器110与无线通信模块160。例如：处理器110通过UART接口与无线通信模块160中的蓝牙模块通信，实现蓝牙功能。在一些实施例中，音频模块170可以通过UART接口向无线通信模块160传递音频信号，实现通过蓝牙耳机播放音乐的功能。
MIPI接口可以被用于连接处理器110与显示屏194，摄像头193等外围器件。MIPI接口包括摄像头串行接口(camera serial interface，CSI)，显示屏串行接口(display serial interface，DSI)等。在一些实施例中，处理器110和摄像头193通过CSI接口通信，实现电子设备100的拍摄功能。处理器110和显示屏194通过DSI接口通信，实现电子设备100的显示功能。因此，在本申请实施例中，处理器110除了可以通过I2C接口耦合摄像头193，还可以通过CSI接口与摄像头193进行通信，也就是说，若摄像头采集到当前时刻的人脸图像，摄像头不仅可以通过I2C总线接口将采集到的上述人脸图像传输给处理器110进行处理，也可以通过CSI接口将采集到的人脸图像传输给处理器110进行处理。
GPIO接口可以通过软件配置。GPIO接口可以被配置为控制信号，也可被配置为数据信号。在一些实施例中，GPIO接口可以用于连接处理器110与摄像头193，显示屏194，无线通信模块160，音频模块170，传感器模块180等。GPIO接口还可以被配置为I2C接口，I2S接口，UART接口，MIPI接口等。
USB接口130是符合USB标准规范的接口，具体可以是Mini USB接口，Micro USB接口，USB Type C接口等。USB接口130可以用于连接充电器为电子设备100充电，也可以用于电子设备100与外围设备之间传输数据。也可以用于连接耳机，通过耳机播放音频。该接口还可以用于连接其他电子设备，例如AR设备等。
可以理解的是，本发明实施例示意的各模块间的接口连接关系，只是示意性说明，并不构成对电子设备100的结构限定。在本申请另一些实施例中，电子设备100也可以采用上述实施例中不同的接口连接方式，或多种接口连接方式的组合。
充电管理模块140用于从充电器接收充电输入。其中，充电器可以是无线充电器，也可以是有线充电器。在一些有线充电的实施例中，充电管理模块140可以通过USB接口130接收有线充电器的充电输入。在一些无线充电的实施例中，充电管理模块140可以通过电子设备100的无线充电线圈接收无线充电输入。充电管理模块140为电池142充电的同时，还可以通过电源管理模块141为电子设备供电。
电源管理模块141用于连接电池142，充电管理模块140与处理器110。电源管理模 块141接收电池142和/或充电管理模块140的输入，为处理器110，内部存储器121，显示屏194，摄像头193，和无线通信模块160等供电。电源管理模块141还可以用于监测电池容量，电池循环次数，电池健康状态(漏电，阻抗)等参数。在其他一些实施例中，电源管理模块141也可以设置于处理器110中。在另一些实施例中，电源管理模块141和充电管理模块140也可以设置于同一个器件中。
电子设备100的无线通信功能可以通过天线1，天线2，移动通信模块150，无线通信模块160，调制解调处理器以及基带处理器等实现。
天线1和天线2用于发射和接收电磁波信号。电子设备100中的每个天线可用于覆盖单个或多个通信频带。不同的天线还可以复用，以提高天线的利用率。例如：可以将天线1复用为无线局域网的分集天线。在另外一些实施例中，天线可以和调谐开关结合使用。
移动通信模块150可以提供应用在电子设备100上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块150可以包括至少一个滤波器，开关，功率放大器，低噪声放大器(low noise amplifier，LNA)等。移动通信模块150可以由天线1接收电磁波，并对接收的电磁波进行滤波，放大等处理，传送至调制解调处理器进行解调。移动通信模块150还可以对经调制解调处理器调制后的信号放大，经天线1转为电磁波辐射出去。在一些实施例中，移动通信模块150的至少部分功能模块可以被设置于处理器110中。在一些实施例中，移动通信模块150的至少部分功能模块可以与处理器110的至少部分模块被设置在同一个器件中。
调制解调处理器可以包括调制器和解调器。其中，调制器用于将待发送的低频基带信号调制成中高频信号。解调器用于将接收的电磁波信号解调为低频基带信号。随后解调器将解调得到的低频基带信号传送至基带处理器处理。低频基带信号经基带处理器处理后，被传递给应用处理器。应用处理器通过音频设备(不限于扬声器170A，受话器170B等)输出声音信号，在本申请实施例中，声音信号就是提醒通知(如：语音播报的“正遭受对抗样本攻击，请停止支付！”或警铃声)或通过显示屏194显示图像或视频(如本申请实施例中的当前时刻的人脸图像或人脸视频)。在一些实施例中，调制解调处理器可以是独立的器件。在另一些实施例中，调制解调处理器可以独立于处理器110，与移动通信模块150或其他功能模块设置在同一个器件中。
无线通信模块160可以提供应用在电子设备100上的包括无线局域网(wireless local area networks，WLAN)(如无线保真(wireless fidelity，Wi-Fi)网络)，蓝牙(bluetooth，BT)，全球导航卫星系统(global navigation satellite system，GNSS)，调频(frequency modulation，FM)，近距离无线通信技术(near field communication，NFC)，红外技术(infrared，IR)等无线通信的解决方案。无线通信模块160可以是集成至少一个通信处理模块的一个或多个器件。无线通信模块160经由天线2接收电磁波，将电磁波信号调频以及滤波处理，将处理后的信号发送到处理器110。无线通信模块160还可以从处理器110接收待发送的信号，对其进行调频，放大，经天线2转为电磁波辐射出去。
在一些实施例中，电子设备100的天线1和移动通信模块150耦合，天线2和无线通信模块160耦合，使得电子设备100可以通过无线通信技术与网络以及其他设备通信。在本申请实施例中，处理器就可以将生成的提醒通知通过移动通信模块150及天线1发送至 对应的服务器，或，发送至与其关联的其他目标电子设备。所述无线通信技术可以包括全球移动通讯系统(global system for mobile communications，GSM)，通用分组无线服务(general packet radio service，GPRS)，码分多址接入(code division multiple access，CDMA)，宽带码分多址(wideband code division multiple access，WCDMA)，时分码分多址(time-division code division multiple access，TD-SCDMA)，长期演进(long term evolution，LTE)，BT，GNSS，WLAN，NFC，FM，和/或IR技术等。所述GNSS可以包括全球卫星定位系统(global positioning system，GPS)，全球导航卫星系统(global navigation satellite system，GLONASS)，北斗卫星导航系统(beidou navigation satellite system，BDS)，准天顶卫星系统(quasi-zenith satellite system，QZSS)和/或星基增强系统(satellite based augmentation systems，SBAS)。
电子设备100通过GPU，显示屏194，以及应用处理器等实现显示功能。GPU为图像处理的微处理器，例如，在本申请实施例中，若电子设备100通过摄像头193拍摄的是当前时刻的人脸视频，那么就可以通过GPU对该人脸视频进行处理，从当前时刻的人脸视频中提取出人脸图像。连接显示屏194和应用处理器。GPU用于执行数学和几何计算，用于图形渲染。处理器110可包括一个或多个GPU，其执行程序指令以生成或改变显示信息。
显示屏194用于显示图像，视频等，如可以用于显示本申请实施例中摄像头拍摄当前时刻的人脸视频或人脸图像。显示屏194包括显示面板。显示面板可以采用液晶显示屏(liquid crystal display，LCD)，有机发光二极管(organic light-emitting diode，OLED)，有源矩阵有机发光二极体或主动矩阵有机发光二极体(active-matrix organic light emitting diode的，AMOLED)，柔性发光二极管(flex light-emitting diode，FLED)，Miniled，MicroLed，Micro-oLed，量子点发光二极管(quantum dot light emitting diodes，QLED)等。在一些实施例中，电子设备100可以包括1个或N个显示屏194，N为大于1的正整数。
电子设备100可以通过ISP，摄像头193，视频编解码器，GPU，显示屏194以及应用处理器等实现拍摄功能，在本申请实施例中，就是通过上述ISP，摄像头193，视频编解码器，GPU，显示屏194以及应用处理器等获取到当前时刻的人脸图像。
ISP用于处理摄像头193反馈的数据。例如，拍照时，打开快门，光线通过镜头被传递到摄像头感光元件上，光信号转换为电信号，摄像头感光元件将所述电信号传递给ISP处理，转化为肉眼可见的图像。ISP还可以对图像的噪点，亮度，肤色进行算法优化。ISP还可以对拍摄场景的曝光，色温等参数优化。在一些实施例中，ISP可以设置在摄像头193中。
摄像头193用于捕获静态图像或视频，如本申请实施例中当前时刻的人脸图像或人脸视频。物体通过镜头生成光学图像投射到感光元件。感光元件可以是电荷耦合器件(charge coupled device，CCD)或互补金属氧化物半导体(complementary metal-oxide-semiconductor，CMOS)光电晶体管。感光元件把光信号转换成电信号，之后将电信号传递给ISP转换成数字图像信号。ISP将数字图像信号输出到DSP加工处理。DSP将数字图像信号转换成标准的RGB，YUV等格式的图像信号。在一些实施例中，电子设备100可以包括1个或N个摄像头193，N为大于1的正整数。
数字信号处理器用于处理数字信号，除了可以处理数字图像信号，还可以处理其他数字信号。例如，当电子设备100在频点选择时，数字信号处理器用于对频点能量进行傅里叶变换等。
视频编解码器用于对数字视频压缩或解压缩。电子设备100可以支持一种或多种视频编解码器。这样，电子设备100可以播放或录制多种编码格式的视频，例如：动态图像专家组(moving picture experts group，MPEG)1，MPEG2，MPEG3，MPEG4等。
NPU为神经网络(neural-network，NN)计算处理器，通过借鉴生物神经网络结构，例如借鉴人脑神经元之间传递模式，对输入信息快速处理，还可以不断的自学习。通过NPU可以实现电子设备100的智能认知等应用，例如：图像识别，人脸识别，语音识别，文本理解等。
外部存储器接口120可以用于连接外部存储卡，例如Micro SD卡，实现扩展电子设备100的存储能力。外部存储卡通过外部存储器接口120与处理器110通信，实现数据存储功能。例如将音乐，视频等文件保存在外部存储卡中。
内部存储器121可以用于存储计算机可执行程序代码，所述可执行程序代码包括指令。内部存储器121可以包括存储程序区和存储数据区。其中，存储程序区可存储操作系统，至少一个功能所需的应用程序(比如声音播放功能，图像播放功能等)等。存储数据区可存储电子设备100使用过程中所创建的数据(比如音频数据，电话本等)等。此外，内部存储器121可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(universal flash storage，UFS)等。处理器110通过运行存储在内部存储器121的指令，和/或存储在设置于处理器中的存储器的指令，执行电子设备100的各种功能应用以及数据处理。
电子设备100可以通过音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，以及应用处理器等实现音频功能。例如音乐播放，录音等，在本申请实施例中，就是实现了提醒通知的语音播报或播放警铃声。
音频模块170用于将数字音频信息转换成模拟音频信号输出，也用于将模拟音频输入转换为数字音频信号。音频模块170还可以用于对音频信号编码和解码。在一些实施例中，音频模块170可以设置于处理器110中，或将音频模块170的部分功能模块设置于处理器110中。
扬声器170A，也称“喇叭”，用于将音频电信号转换为声音信号。电子设备100可以通过扬声器170A收听音乐，或收听免提通话。
受话器170B，也称“听筒”，用于将音频电信号转换成声音信号。当电子设备100接听电话或语音信息时，可以通过将受话器170B靠近人耳接听语音。
麦克风170C，也称“话筒”，“传声器”，用于将声音信号转换为电信号。当拨打电话或发送语音信息时，用户可以通过人嘴靠近麦克风170C发声，将声音信号输入到麦克风170C。电子设备100可以设置至少一个麦克风170C。在另一些实施例中，电子设备100可以设置两个麦克风170C，除了采集声音信号，还可以实现降噪功能。在另一些实施例中，电子设备100还可以设置三个，四个或更多麦克风170C，实现采集声音信号，降噪，还可以识别声音来源，实现定向录音功能等。
耳机接口170D用于连接有线耳机。耳机接口170D可以是USB接口130，也可以是3.5mm的开放移动电子设备平台(open mobile terminal platform，OMTP)标准接口，美国蜂窝电信工业协会(cellular telecommunications industry association of the USA，CTIA)标准接口。
压力传感器180A用于感受压力信号，可以将压力信号转换成电信号。在一些实施例中，压力传感器180A可以设置于显示屏194。压力传感器180A
的种类很多，如电阻式压力传感器，电感式压力传感器，电容式压力传感器等。电容式压力传感器可以是包括至少两个具有导电材料的平行板。当有力作用于压力传感器180A，电极之间的电容改变。电子设备100根据电容的变化确定压力的强度。当有触摸操作作用于显示屏194，电子设备100根据压力传感器180A检测所述触摸操作强度。电子设备100也可以根据压力传感器180A的检测信号计算触摸的位置。在一些实施例中，作用于相同触摸位置，但不同触摸操作强度的触摸操作，可以对应不同的操作指令。例如：当有触摸操作强度小于第一压力阈值的触摸操作作用于短消息应用图标时，执行查看短消息的指令。当有触摸操作强度大于或等于第一压力阈值的触摸操作作用于短消息应用图标时，执行新建短消息的指令。
陀螺仪传感器180B可以用于确定电子设备100的运动姿态。在一些实施例中，可以通过陀螺仪传感器180B确定电子设备100围绕三个轴(即，x，y和z轴)的角速度。陀螺仪传感器180B可以用于拍摄防抖。示例性的，当按下快门，陀螺仪传感器180B检测电子设备100抖动的角度，根据角度计算出镜头模组需要补偿的距离，让镜头通过反向运动抵消电子设备100的抖动，实现防抖。陀螺仪传感器180B还可以用于导航，体感游戏场景。
气压传感器180C用于测量气压。在一些实施例中，电子设备100通过气压传感器180C测得的气压值计算海拔高度，辅助定位和导航。
磁传感器180D包括霍尔传感器。电子设备100可以利用磁传感器180D检测翻盖皮套的开合。在一些实施例中，当电子设备100是翻盖机时，电子设备100可以根据磁传感器180D检测翻盖的开合。进而根据检测到的皮套的开合状态或翻盖的开合状态，设置翻盖自动解锁等特性。
加速度传感器180E可检测电子设备100在各个方向上(一般为三轴)加速度的大小。当电子设备100静止时可检测出重力的大小及方向。还可以用于识别电子设备姿态，应用于横竖屏切换，计步器等应用。
距离传感器180F，用于测量距离。电子设备100可以通过红外或激光测量距离。在一些实施例中，拍摄场景，电子设备100可以利用距离传感器180F测距以实现快速对焦。
接近光传感器180G可以包括例如发光二极管(LED)和光检测器，例如光电二极管。发光二极管可以是红外发光二极管。电子设备100通过发光二极管向外发射红外光。电子设备100使用光电二极管检测来自附近物体的红外反射光。当检测到充分的反射光时，可以确定电子设备100附近有物体。当检测到不充分的反射光时，电子设备100可以确定电子设备100附近没有物体。电子设备100可以利用接近光传感器180G检测用户手持电子设备100贴近耳朵通话，以便自动熄灭屏幕达到省电的目的。接近光传感器180G也可用于皮套模式，口袋模式自动解锁与锁屏。
环境光传感器180L用于感知环境光亮度。电子设备100可以根据感知的环境光亮度自适应调节显示屏194亮度。环境光传感器180L也可用于拍照时自动调节白平衡。环境光传感器180L还可以与接近光传感器180G配合，检测电子设备100是否在口袋里，以防误触。
指纹传感器180H用于采集指纹。电子设备100可以利用采集的指纹特性实现指纹解锁，访问应用锁，指纹拍照，指纹接听来电等。
温度传感器180J用于检测温度。在一些实施例中，电子设备100利用温度传感器180J检测的温度，执行温度处理策略。例如，当温度传感器180J上报的温度超过阈值，电子设备100执行降低位于温度传感器180J附近的处理器的性能，以便降低功耗实施热保护。在另一些实施例中，当温度低于另一阈值时，电子设备100对电池142加热，以避免低温导致电子设备100异常关机。在其他一些实施例中，当温度低于又一阈值时，电子设备100对电池142的输出电压执行升压，以避免低温导致的异常关机。
触摸传感器180K，也称“触控器件”。触摸传感器180K可以设置于显示屏194，由触摸传感器180K与显示屏194组成触摸屏，也称“触控屏”。触摸传感器180K用于检测作用于其上或附近的触摸操作。触摸传感器可以将检测到的触摸操作传递给应用处理器，以确定触摸事件类型。可以通过显示屏194提供与触摸操作相关的视觉输出。在另一些实施例中，触摸传感器180K也可以设置于电子设备100的表面，与显示屏194所处的位置不同。
骨传导传感器180M可以获取振动信号。在一些实施例中，骨传导传感器180M可以获取人体声部振动骨块的振动信号。骨传导传感器180M也可以接触人体脉搏，接收血压跳动信号。在一些实施例中，骨传导传感器180M也可以设置于耳机中，结合成骨传导耳机。音频模块170可以基于所述骨传导传感器180M获取的声部振动骨块的振动信号，解析出语音信号，实现语音功能。应用处理器可以基于所述骨传导传感器180M获取的血压跳动信号解析心率信息，实现心率检测功能。
按键190包括开机键，音量键等。按键190可以是机械按键。也可以是触摸式按键。电子设备100可以接收按键输入，产生与电子设备100的用户设置以及功能控制有关的键信号输入。
马达191可以产生振动提示。马达191可以用于来电振动提示，也可以用于触摸振动反馈。例如，作用于不同应用(例如拍照，音频播放等)的触摸操作，可以对应不同的振动反馈效果。作用于显示屏194不同区域的触摸操作，马达191也可对应不同的振动反馈效果。不同的应用场景(例如：时间提醒，接收信息，闹钟，游戏等)也可以对应不同的振动反馈效果。触摸振动反馈效果还可以支持自定义。
指示器192可以是指示灯，可以用于指示充电状态，电量变化，也可以用于指示消息，未接来电，通知等。
SIM卡接口195用于连接SIM卡。SIM卡可以通过插入SIM卡接口195，或从SIM卡接口195拔出，实现和电子设备100的接触和分离。电子设备100可以支持1个或N个SIM卡接口，N为大于1的正整数。SIM卡接口195可以支持Nano SIM卡，Micro SIM卡，SIM卡等。同一个SIM卡接口195可以同时插入多张卡。所述多张卡的类型可以相同，也可以 不同。SIM卡接口195也可以兼容不同类型的SIM卡。SIM卡接口195也可以兼容外部存储卡。电子设备100通过SIM卡和网络交互，实现通话以及数据通信等功能。在一些实施例中，电子设备100采用eSIM，即：嵌入式SIM卡。eSIM卡可以嵌在电子设备100中，不能和电子设备100分离。
图13对应的实施例中的电子设备100具体的功能以及结构用于实现前述图4至图10中由电子设备进行处理的步骤，具体此处不予赘述。
电子设备100的软件系统可以采用分层架构，事件驱动架构，微核架构，微服务架构，或云架构。本申请实施例以分层架构的Android系统为例，示例性说明电子设备100的软件结构。
图14是本申请实施例的电子设备100的软件结构框图。
分层架构将软件分成若干个层，每一层都有清晰的角色和分工。层与层之间通过软件接口通信。在一些实施例中，将Android系统分为四层，从上至下分别为应用程序层，应用程序框架层，安卓运行时(Android runtime)和系统库，以及内核层。
应用程序层可以包括一系列应用程序包。
如图14所示，应用程序包可以包括相机，图库，日历，通话，地图，导航，WLAN，蓝牙，音乐，视频，短信息等应用程序。
应用程序框架层为应用程序层的应用程序提供应用编程接口(application programming interface，API)和编程框架。应用程序框架层包括一些预先定义的函数。
如图14所示，应用程序框架层可以包括窗口管理器，内容提供器，视图系统，电话管理器，资源管理器，通知管理器等。
窗口管理器用于管理窗口程序。窗口管理器可以获取显示屏大小，判断是否有状态栏，锁定屏幕，截取屏幕等。
内容提供器用来存放和获取数据，并使这些数据可以被应用程序访问。所述数据可以包括视频，图像，音频，拨打和接听的电话，浏览历史和书签，电话簿等。在本申请实施例中，数据就可以包括摄像头采集的当前时刻的人脸图像(包括直接拍摄到的人脸图像或从人脸视频中截取的人脸图像)、提醒通知等。
视图系统包括可视控件，例如显示文字的控件，显示图片的控件等。视图系统可用于构建应用程序。显示界面可以由一个或多个视图组成的。例如，包括短信通知图标的显示界面，可以包括显示文字的视图以及显示图片的视图。
电话管理器用于提供电子设备100的通信功能。例如通话状态的管理(包括接通，挂断等)。
资源管理器为应用程序提供各种资源，比如本地化字符串，图标，图片，布局文件，视频文件等等。
通知管理器使应用程序可以在状态栏中显示通知信息，可以用于传达告知类型的消息，可以短暂停留后自动消失，无需用户交互。比如通知管理器被用于告知下载完成，消息提醒等。通知管理器还可以是以图表或者滚动条文本形式出现在系统顶部状态栏的通知，例如后台运行的应用程序的通知，还可以是以对话窗口形式出现在屏幕上的通知。例如在状态栏提示文本信息，发出提示音，电子设备振动，指示灯闪烁等。
Android Runtime包括核心库和虚拟机。Android runtime负责安卓系统的调度和管理。
核心库包含两部分：一部分是java语言需要调用的功能函数，另一部分是安卓的核心库。
应用程序层和应用程序框架层运行在虚拟机中。虚拟机将应用程序层和应用程序框架层的java文件执行为二进制文件。虚拟机用于执行对象生命周期的管理，堆栈管理，线程管理，安全和异常的管理，以及垃圾回收等功能。
系统库可以包括多个功能模块。例如：表面管理器(surface manager)，媒体库(Media Libraries)，三维图形处理库(例如：OpenGL ES)，2D图形引擎(例如：SGL)等。
表面管理器用于对显示子系统进行管理，并且为多个应用程序提供了2D和3D图层的融合。
媒体库支持多种常用的音频，视频格式回放和录制，以及静态图像文件等。媒体库可以支持多种音视频编码格式，例如:MPEG4，H.264，MP3，AAC，AMR，JPG，PNG等。
三维图形处理库用于实现三维图形绘图，图像渲染，合成，和图层处理等。
2D图形引擎是2D绘图的绘图引擎。
内核层是硬件和软件之间的层。内核层至少包含显示驱动，摄像头驱动，音频驱动，传感器驱动。
下面结合本申请实施例中电子设备通过摄像头采集当前时人脸图像的场景，示例性说明电子设备100软件以及硬件的工作流程。
当触摸传感器180K接收到触摸操作，相应的硬件中断被发给内核层。内核层将触摸操作加工成原始输入事件(包括触摸坐标，触摸操作的时间戳等信息)。原始输入事件被存储在内核层。应用程序框架层从内核层获取原始输入事件，识别该输入事件所对应的控件。以该触摸操作是触摸单击操作，该单击操作所对应的控件为相机应用图标的控件为例，相机应用调用应用框架层的接口，启动相机应用，进而通过调用内核层启动摄像头驱动，通过摄像头193捕获当前时刻的人脸图像(或捕获当前时刻的人脸视频)。
上述图4至图10对应的实施例中电子设备的软件结构可以基于图14中所示的软件结构，图14所示的软件结构可以对应的执行上述图4至图10中方法实施例中的步骤，此处不再一一赘述。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储 设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如DVD)、或者半导体介质(例如固态硬盘)等。

Claims (23)

  1. 一种对抗样本的检测方法，应用于人脸识别场景，其特征在于，包括：
    通过摄像装备采集当前时刻的人脸图像；
    判断遮挡物是否为对抗样本干扰物，所述遮挡物位于所述人脸图像中人脸区域范围内；
    若所述遮挡物为所述对抗样本干扰物，则确定所述人脸图像为对抗样本。
  2. 根据权利要求1所述的检测方法，其特征在于，所述判断遮挡物是否为对抗样本干扰物包括：
    对所述遮挡物中所有像素点的像素值进行计算，得到所述遮挡物的图片熵值；
    判断所述图片熵值是否大于预设阈值，所述预设阈值根据第一预设方式确定；
    若所述图片熵值大于所述预设阈值，则确定所述遮挡物为所述对抗样本干扰物。
  3. 根据权利要求2所述的检测方法，其特征在于，所述对所述遮挡物中所有像素点的像素值进行计算，得到所述遮挡物的图片熵值包括：
    将所述遮挡物中所有像素点的像素值在色彩空间分解为第一向量像素值、第二向量像素值和第三向量像素值，得到第一向量像素值的第一集合、第二向量像素值的第二集合和到第三向量像素值的第三集合；
    根据熵值计算公式分别计算所述第一集合的第一图片熵值、所述第二集合的第二图片熵值和所述第三集合的第三图片熵值；
    确定所述第一图片熵值、所述第二图片熵值和所述第三图片熵值的算术平均值为所述遮挡物的图片熵值。
  4. 根据权利要求3所述的检测方法，其特征在于，所述熵值计算公式包括：
    Figure PCTCN2020091027-appb-100001
    其中，i为所述第一集合、所述第二集合或所述第三集合中每一个元素的取值，p i为所述i出现的概率，H为所述第一图片熵值、所述第二图片熵值或所述第三图片熵值。
  5. 根据权利要求1-4中任一项所述的检测方法，其特征在于，若所述遮挡物为所述对抗样本干扰物，则所述方法还包括：
    根据第二预设方式处理所述对抗样本；
    将处理后的对抗样本进行识别，得到识别结果。
  6. 根据权利要求5所述的检测方法，其特征在于，所述第二预设方式包括：
    确定目标像素值，并将所述对抗样本干扰物中所有像素点的像素值修改为所述目标像素值；
    或，
    将所述对抗样本干扰物中所有像素点的像素值进行代数线性变换。
  7. 根据权利要求6所述的检测方法，其特征在于，所述确定目标像素值包括：
    在像素值的取值范围内任意选取一个像素值作为所述目标像素值；
    或，
    确定所述对抗样本干扰物中任意一个像素点的像素值为所述目标像素值；
    或，
    确定所述人脸区域范围内任意一个像素点的像素值为所述目标像素值；
    或，
    确定所述人脸区域范围内所有像素点的像素值的算术平均值为所述目标像素值。
  8. 根据权利要求1-7中任一项所述的检测方法，其特征在于，在确定所述人脸图像为对抗样本之后，所述方法还包括：
    生成提醒通知；
    语音播报所述提醒通知；
    和/或，
    向对应的服务器发送所述提醒通知；
    和/或，
    向关联的目标电子设备发送所述提醒通知。
  9. 根据权利要求2-8中任一项所述的检测方法，其特征在于，所述第一预设方式包括：
    获取M个参考人脸图像，所述参考人脸图像为人脸区域范围内不存在遮挡物或存在普通遮挡物的人脸图像，其中，M≥1；
    对所述M个参考人脸图像中的目标参考人脸图像中所有像素点的像素值进行计算，得到所述目标参考人脸图像的目标图片熵值；
    确定与所述M个参考人脸图像分别对应的M个目标图片熵值的算术平均值为所述预设阈值。
  10. 根据权利要求2所述的检测方法，其特征在于，
    若所述图片熵值小于或等于所述预设阈值，则确定所述遮挡物为普通遮挡物；
    所述方法还包括：
    对所述普通遮挡物进行识别，得到识别结果。
  11. 一种电子设备，其特征在于，包括：
    一个或多个摄像装备；
    一个或多个触摸屏；
    一个或多个处理器；
    一个或多个存储器；
    所述一个或多个存储器存储有一个或多个计算机程序，所述一个或多个计算机程序包括指令，当所述指令被所述一个或多个处理器执行时，使得所述电子设备执行以下步骤：
    获取当前时刻的人脸图像，所述人脸图像由所述摄像装备采集得到；
    判断遮挡物是否为对抗样本干扰物，所述遮挡物位于所述人脸图像中人脸区域范围内；
    若所述遮挡物为所述对抗样本干扰物，则确定所述人脸图像为对抗样本。
  12. 根据权利要求11所述的电子设备，其特征在于，当所述指令被所述电子设备执行时，使得所述电子设备还执行如下步骤：
    对所述遮挡物中所有像素点的像素值进行计算，得到所述遮挡物的图片熵值；
    判断所述图片熵值是否大于预设阈值，所述预设阈值根据第一预设方式确定；
    若所述图片熵值大于所述预设阈值，则确定所述遮挡物为所述对抗样本干扰物。
  13. 根据权利要求12所述的电子设备，其特征在于，当所述指令被所述电子设备执行时，使得所述电子设备还执行如下步骤：
    将所述遮挡物中所有像素点的像素值在色彩空间分解为第一向量像素值、第二向量像素值和第三向量像素值，得到第一向量像素值的第一集合、第二向量像素值的第二集合和到第三向量像素值的第三集合；
    根据熵值计算公式分别计算所述第一集合的第一图片熵值、所述第二集合的第二图片熵值和所述第三集合的第三图片熵值；
    确定所述第一图片熵值、所述第二图片熵值和所述第三图片熵值的算术平均值为所述遮挡物的图片熵值。
  14. 根据权利要求13所述的电子设备，其特征在于，所述熵值计算公式包括：
    Figure PCTCN2020091027-appb-100002
    其中，i为所述第一集合、所述第二集合或所述第三集合中每一个元素的取值，p i为所述i出现的概率，H为所述第一图片熵值、所述第二图片熵值或所述第三图片熵值。
  15. 根据权利要求11-14中任一项所述的电子设备，其特征在于，若所述电子设备确定所述遮挡物为所述对抗样本干扰物，则当所述指令被所述电子设备执行时，使得所述电子设备还执行如下步骤：
    根据第二预设方式处理所述对抗样本；
    将处理后的对抗样本进行识别，得到识别结果。
  16. 根据权利要求15所述的电子设备，其特征在于，所述第二预设方式包括：
    确定目标像素值，并将所述对抗样本干扰物中所有像素点的像素值修改为所述目标像素值；
    或，
    将所述对抗样本干扰物中所有像素点的像素值进行代数线性变换。
  17. 根据权利要求16所述的电子设备，其特征在于，所述确定目标像素值包括：
    在像素值的取值范围内任意选取一个像素值作为所述目标像素值；
    或，
    确定所述对抗样本干扰物中任意一个像素点的像素值为所述目标像素值；
    或，
    确定所述人脸区域范围内任意一个像素点的像素值为所述目标像素值；
    或，
    确定所述人脸区域范围内所有像素点的像素值的算术平均值为所述目标像素值。
  18. 根据权利要求11-17中任一项所述的电子设备，其特征在于，在所述电子设备确定所述人脸图像为对抗样本之后，则当所述指令被所述电子设备执行时，使得所述电子设备还执行如下步骤：
    生成提醒通知；
    语音播报所述提醒通知；
    和/或，
    向对应的服务器发送所述提醒通知；
    和/或，
    向关联的目标电子设备发送所述提醒通知。
  19. 根据权利要求12-18中任一项所述的电子设备，其特征在于，所述第一预设方式包括：
    获取M个参考人脸图像，所述参考人脸图像为人脸区域范围内不存在遮挡物或存在普通遮挡物的人脸图像，其中，M≥1；
    对所述M个参考人脸图像中的目标参考人脸图像中所有像素点的像素值进行计算，得到所述目标参考人脸图像的目标图片熵值；
    确定与所述M个参考人脸图像分别对应的M个目标图片熵值的算术平均值为所述预设阈值。
  20. 根据权利要求12所述的电子设备，其特征在于，若所述图片熵值小于或等于所述预设阈值，则当所述指令被所述电子设备执行时，使得所述电子设备还执行如下步骤：
    确定所述遮挡物为普通遮挡物；
    对所述普通遮挡物进行识别，得到识别结果。
  21. 一种电子设备，其特征在于，包括：
    所述电子设备通过硬件或通过硬件执行相应的软件实现如权利要求1-10中任一项所述的检测方法，所述硬件或所述软件包括一个或多个与权利要求1-10任一项所述的检测方法相对应的模块。
  22. 一种计算机可读存储介质，包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1-10中任一项所述的检测方法。
  23. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如权利要求1-10中任一项所述的检测方法。
PCT/CN2020/091027 2019-05-21 2020-05-19 一种对抗样本的检测方法及电子设备 WO2020233564A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910425689.5A CN110321790B (zh) 2019-05-21 2019-05-21 一种对抗样本的检测方法及电子设备
CN201910425689.5 2019-05-21

Publications (1)

Publication Number Publication Date
WO2020233564A1 true WO2020233564A1 (zh) 2020-11-26

Family

ID=68113242

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/091027 WO2020233564A1 (zh) 2019-05-21 2020-05-19 一种对抗样本的检测方法及电子设备

Country Status (2)

Country Link
CN (1) CN110321790B (zh)
WO (1) WO2020233564A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112488130A (zh) * 2020-12-17 2021-03-12 苏州聚悦信息科技有限公司 一种ai的微小孔壁检测算法
CN113222056A (zh) * 2021-05-28 2021-08-06 北京理工大学 面向图像分类系统攻击的对抗样本检测方法
CN113409407A (zh) * 2021-05-17 2021-09-17 海南师范大学 一种基于平均压缩获取低频信息的对抗样本防御方法
CN113705620A (zh) * 2021-08-04 2021-11-26 百度在线网络技术（北京）有限公司 图像显示模型的训练方法、装置、电子设备和存储介质
CN114240732A (zh) * 2021-06-24 2022-03-25 中国人民解放军陆军工程大学 一种攻击人脸验证模型的对抗贴片生成方法
CN114333031A (zh) * 2021-12-31 2022-04-12 北京瑞莱智慧科技有限公司 活体检测模型的漏洞检测方法、装置及存储介质
WO2023019970A1 (zh) * 2021-08-20 2023-02-23 华为技术有限公司 一种攻击检测方法及装置
CN115909020A (zh) * 2022-09-30 2023-04-04 北京瑞莱智慧科技有限公司 模型鲁棒性检测方法、相关装置及存储介质
CN116935172A (zh) * 2023-07-31 2023-10-24 北京瑞莱智慧科技有限公司 图像处理方法、相关装置及存储介质

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110321790B (zh) * 2019-05-21 2023-05-12 华为技术有限公司 一种对抗样本的检测方法及电子设备
CN110768971B (zh) * 2019-10-16 2021-12-03 伍军 适用于人工智能系统的对抗样本快速预警方法及系统
CN110705652B (zh) * 2019-10-17 2020-10-23 北京瑞莱智慧科技有限公司 对抗样本及其生成方法、介质、装置和计算设备
CN111046379B (zh) * 2019-12-06 2021-06-18 支付宝(杭州)信息技术有限公司 一种对抗攻击的监测方法和装置
CN111325127A (zh) * 2020-02-12 2020-06-23 上海云从汇临人工智能科技有限公司 一种异常对象判断方法、系统、机器可读介质及设备
CN111353403A (zh) * 2020-02-24 2020-06-30 中国人民大学 一种深度神经网络图像对抗样本检测方法和系统
CN113591517A (zh) * 2020-04-30 2021-11-02 华为技术有限公司 一种活体检测方法及相关设备
CN111811657B (zh) * 2020-07-07 2022-05-27 杭州海康威视数字技术股份有限公司 一种纠正人脸测温的方法、装置及存储介质
CN112001249B (zh) * 2020-07-21 2022-08-26 山东师范大学 一种在物理世界通过生成贴纸构造可取消生物特征的方法
WO2022104503A1 (zh) * 2020-11-17 2022-05-27 华为技术有限公司 一种对抗样本的识别方法及相关装置
CN113240028A (zh) * 2021-05-24 2021-08-10 浙江大学 一种基于类激活图的对抗样本块攻击检测方法
CN114661940B (zh) * 2022-01-28 2023-08-08 宁波大学 一种适用于黑盒攻击下快速获取语音对抗样本的方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108171215A (zh) * 2018-01-25 2018-06-15 河南大学 基于低秩变异字典和稀疏表示分类的人脸伪装检测及伪装类别检测方法
CN108537271A (zh) * 2018-04-04 2018-09-14 重庆大学 一种基于卷积去噪自编码机防御对抗样本攻击的方法
CN109214327A (zh) * 2018-08-29 2019-01-15 浙江工业大学 一种基于pso的反人脸识别方法
CN109740615A (zh) * 2018-12-29 2019-05-10 武汉大学 一种对抗攻击样本扰动的去除方法
CN110321790A (zh) * 2019-05-21 2019-10-11 华为技术有限公司 一种对抗样本的检测方法及电子设备

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104143078B (zh) * 2013-05-09 2016-08-24 腾讯科技（深圳）有限公司 活体人脸识别方法、装置和设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108171215A (zh) * 2018-01-25 2018-06-15 河南大学 基于低秩变异字典和稀疏表示分类的人脸伪装检测及伪装类别检测方法
CN108537271A (zh) * 2018-04-04 2018-09-14 重庆大学 一种基于卷积去噪自编码机防御对抗样本攻击的方法
CN109214327A (zh) * 2018-08-29 2019-01-15 浙江工业大学 一种基于pso的反人脸识别方法
CN109740615A (zh) * 2018-12-29 2019-05-10 武汉大学 一种对抗攻击样本扰动的去除方法
CN110321790A (zh) * 2019-05-21 2019-10-11 华为技术有限公司 一种对抗样本的检测方法及电子设备

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
KURAKIN, ALEXEY ET AL.: "ADVERSARIAL EXAMPLES IN THE PHYSICAL WORLD", WORKSHOP TRACK - ICLR 2017, 11 February 2017 (2017-02-11), XP055626673, DOI: 20200806155134A *
LI, PAN ET AL.: "Security Issues and Their Countermeasuring Techniques of Machine Learning: A Survey", JOURNAL OF FRONTIERS OF COMPUTER SCIENCE AND TECHNOLOGY, 31 December 2018 (2018-12-31), ISSN: 1673-9418, DOI: 20200806155016A *

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112488130A (zh) * 2020-12-17 2021-03-12 苏州聚悦信息科技有限公司 一种ai的微小孔壁检测算法
CN112488130B (zh) * 2020-12-17 2023-08-15 苏州聚悦信息科技有限公司 一种ai的微小孔壁检测方法
CN113409407B (zh) * 2021-05-17 2022-05-17 海南师范大学 一种基于平均压缩获取低频信息的对抗样本防御方法
CN113409407A (zh) * 2021-05-17 2021-09-17 海南师范大学 一种基于平均压缩获取低频信息的对抗样本防御方法
CN113222056A (zh) * 2021-05-28 2021-08-06 北京理工大学 面向图像分类系统攻击的对抗样本检测方法
CN114240732A (zh) * 2021-06-24 2022-03-25 中国人民解放军陆军工程大学 一种攻击人脸验证模型的对抗贴片生成方法
CN113705620A (zh) * 2021-08-04 2021-11-26 百度在线网络技术（北京）有限公司 图像显示模型的训练方法、装置、电子设备和存储介质
CN113705620B (zh) * 2021-08-04 2023-08-15 百度在线网络技术（北京）有限公司 图像显示模型的训练方法、装置、电子设备和存储介质
WO2023019970A1 (zh) * 2021-08-20 2023-02-23 华为技术有限公司 一种攻击检测方法及装置
CN114333031A (zh) * 2021-12-31 2022-04-12 北京瑞莱智慧科技有限公司 活体检测模型的漏洞检测方法、装置及存储介质
CN115909020A (zh) * 2022-09-30 2023-04-04 北京瑞莱智慧科技有限公司 模型鲁棒性检测方法、相关装置及存储介质
CN115909020B (zh) * 2022-09-30 2024-01-09 北京瑞莱智慧科技有限公司 模型鲁棒性检测方法、相关装置及存储介质
CN116935172A (zh) * 2023-07-31 2023-10-24 北京瑞莱智慧科技有限公司 图像处理方法、相关装置及存储介质

Also Published As

Publication number Publication date
CN110321790B (zh) 2023-05-12
CN110321790A (zh) 2019-10-11

Similar Documents

Publication Publication Date Title
WO2020233564A1 (zh) 一种对抗样本的检测方法及电子设备
US20220253144A1 (en) Shortcut Function Enabling Method and Electronic Device
EP3859576B1 (en) Application permission management method and electronic device
EP4113415A1 (en) Service recommending method, electronic device, and system
US11910197B2 (en) Service processing method and device
WO2020216098A1 (zh) 一种跨电子设备转接服务的方法、设备以及系统
EP3882793A1 (en) Electronic device control method and electronic device
CN114553814B (zh) 处理推送消息的方法和装置
WO2022257474A1 (zh) 图像的预测方法、电子设备和存储介质
WO2022160991A1 (zh) 权限控制方法和电子设备
CN114528581A (zh) 一种安全显示方法及电子设备
CN113496477A (zh) 屏幕检测方法及电子设备
WO2022179495A1 (zh) 一种隐私风险反馈方法、装置及第一终端设备
WO2022033344A1 (zh) 视频防抖方法、终端设备和计算机可读存储介质
CN114157412B (zh) 信息验证的方法、电子设备及计算机可读存储介质
CN113676440B (zh) 通信过程中的权限协商方法、装置和电子设备
CN115016666B (zh) 触控处理方法、终端设备以及存储介质
CN116048831B (zh) 一种目标信号处理方法和电子设备
CN116669020B (zh) 一种密码管理方法、系统和电子设备
WO2021135659A1 (zh) 车辆信息的推送方法、装置、用户账号服务器和用户设备
CN116051351B (zh) 一种特效处理方法和电子设备
CN116048350B (zh) 一种截屏方法及电子设备
CN116233599B (zh) 一种录像模式推荐方法和电子设备
WO2022227979A1 (zh) 接触追踪方法及相关设备
CN117496964A (zh) 一种登录方法和电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20810825

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20810825

Country of ref document: EP

Kind code of ref document: A1