WO2022222832A1 - 图像攻击检测、图像攻击检测模型训练方法和装置 - Google Patents

图像攻击检测、图像攻击检测模型训练方法和装置 Download PDF

Info

Publication number
WO2022222832A1
WO2022222832A1 PCT/CN2022/086735 CN2022086735W WO2022222832A1 WO 2022222832 A1 WO2022222832 A1 WO 2022222832A1 CN 2022086735 W CN2022086735 W CN 2022086735W WO 2022222832 A1 WO2022222832 A1 WO 2022222832A1
Authority
WO
WIPO (PCT)
Prior art keywords
image
training
classification
local
global
Prior art date
Application number
PCT/CN2022/086735
Other languages
English (en)
French (fr)
Inventor
李博
徐江河
吴双
丁守鸿
李季檩
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2022222832A1 publication Critical patent/WO2022222832A1/zh
Priority to US18/072,272 priority Critical patent/US20230104345A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/764—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using classification, e.g. of video objects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/25—Fusion techniques
    • G06F18/253—Fusion techniques of extracted features
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/40—Extraction of image or video features
    • G06V10/44—Local feature extraction by analysis of parts of the pattern, e.g. by detecting edges, contours, loops, corners, strokes or intersections; Connectivity analysis, e.g. of connected components
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/74—Image or video pattern matching; Proximity measures in feature spaces
    • G06V10/761—Proximity, similarity or dissimilarity measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/77—Processing image or video features in feature spaces; using data integration or data reduction, e.g. principal component analysis [PCA] or independent component analysis [ICA] or self-organising maps [SOM]; Blind source separation
    • G06V10/774—Generating sets of training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/77—Processing image or video features in feature spaces; using data integration or data reduction, e.g. principal component analysis [PCA] or independent component analysis [ICA] or self-organising maps [SOM]; Blind source separation
    • G06V10/776—Validation; Performance evaluation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/77—Processing image or video features in feature spaces; using data integration or data reduction, e.g. principal component analysis [PCA] or independent component analysis [ICA] or self-organising maps [SOM]; Blind source separation
    • G06V10/80—Fusion, i.e. combining data from various sources at the sensor level, preprocessing level, feature extraction level or classification level
    • G06V10/809—Fusion, i.e. combining data from various sources at the sensor level, preprocessing level, feature extraction level or classification level of classification results, e.g. where the classifiers operate on the same input data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the present application relates to the field of computer technology, and in particular, to an image attack detection, image attack detection model training method, device, computer equipment and storage medium.
  • An image attack detection method includes:
  • the number of targets is calculated according to the defense rate of the reference image corresponding to the image to be detected.
  • the defense rate of the reference image is used to represent the reference image when it is attacked by the image. degree of defense;
  • the consistency of the recognition results is detected based on the target classification recognition results and the global recognition results.
  • the image to be detected is determined to be an attack image.
  • An image attack detection device the device includes:
  • the global classification module is used to obtain the image to be detected, perform global classification and recognition based on the image to be detected, and obtain the global classification and recognition result;
  • the local extraction module is used to randomly perform local image extraction based on the image to be detected, and obtain local images of the target number.
  • the number of targets is calculated according to the defense rate of the reference image corresponding to the image to be detected.
  • the defense rate of the reference image is used to represent the reference. The degree of defense of the image when it is attacked by the image;
  • the local classification module is used to perform local classification and recognition based on the local images of the target number, obtain each local classification and recognition result, and fuse each local classification and recognition result to obtain the target classification and recognition result;
  • the detection module is used for detecting the consistency of the recognition results based on the target classification recognition results and the global recognition results, and when the target classification recognition results and the global classification recognition results are inconsistent, it is determined that the image to be detected is an attack image.
  • a computer device includes a memory and a processor, the memory stores computer-readable instructions, and the processor implements the following steps when executing the computer-readable instructions:
  • the number of targets is calculated according to the defense rate of the reference image corresponding to the image to be detected.
  • the defense rate of the reference image is used to represent the reference image when it is attacked by the image. degree of defense;
  • the consistency of the recognition results is detected based on the target classification recognition results and the global recognition results.
  • the image to be detected is determined to be an attack image.
  • a computer-readable storage medium having computer-readable instructions stored thereon, the computer-readable instructions realizing the following steps when executed by a processor:
  • the number of targets is calculated according to the defense rate of the reference image corresponding to the image to be detected.
  • the defense rate of the reference image is used to represent the reference image when it is attacked by the image. degree of defense;
  • the consistency of the recognition results is detected based on the target classification recognition results and the global recognition results.
  • the image to be detected is determined to be an attack image.
  • the above image attack detection method, device, computer equipment and storage medium obtain a global classification and recognition result by acquiring an image to be detected, and performing global classification and recognition based on the to-be-detected image. Since the global recognition result of the real image is consistent with any local recognition result, and the image attack by means of physical attack cannot change each local recognition result, so the local images of the target number can be randomly extracted. It is calculated according to the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to characterize the defense degree of the reference image when it is attacked by the image, so as to identify each local classification and recognition result, and then classify each local classification and recognition result. Fusion, when the obtained target classification and recognition results are inconsistent with the global classification and recognition results, the image to be detected is judged to be an attack image, which can improve the accuracy of image attack detection and reduce security risks.
  • An image attack detection model training method comprising:
  • training data which includes training images and image attack category labels
  • the number of training targets is calculated from the defense rate of the training reference images corresponding to the training images.
  • the defense rate of the training reference images is used to indicate that the training reference images are affected by the images. defense when attacking;
  • the steps of obtaining the initial consistency detection result are performed until the training is completed, and the target image attack detection model is obtained.
  • An image attack detection model training device includes:
  • the data acquisition module is used to acquire training data, which includes training images and image attack category labels;
  • the training global classification module is used to input the training image into the global image classification and recognition model for global classification and recognition, and obtain the training global classification and recognition result vector;
  • the training local extraction module is used to randomly extract local images based on the training images to obtain training local images with the number of training targets.
  • the number of training targets is calculated from the defense rate of the training reference image corresponding to the training image.
  • the defense rate of the training reference image is calculated by It is used to characterize the defense degree of the training reference image when it is attacked by the image;
  • the training local classification module is used to input the training local images of the target number into the local image classification and recognition model for local classification and recognition, and obtain each training local classification and recognition result vector, and fuse each training local classification and recognition result vector to obtain the target.
  • Training classification recognition result vector ;
  • the training detection module is used to input the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model for consistency detection of the recognition results, and obtain the initial consistency detection result;
  • the iterative module is used to update the initial image attack detection model based on the initial consistency detection result and the image attack category label, and return the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model for recognition results.
  • the steps of obtaining the initial consistency detection result are performed until the training is completed, and the target image attack detection model is obtained.
  • a computer device includes a memory and a processor, the memory stores computer-readable instructions, and the processor implements the following steps when executing the computer-readable instructions:
  • training data which includes training images and image attack category labels
  • the number of training targets is calculated from the defense rate of the training reference images corresponding to the training images.
  • the defense rate of the training reference images is used to indicate that the training reference images are affected by the images. defense when attacking;
  • the steps of obtaining the initial consistency detection result are performed until the training is completed, and the target image attack detection model is obtained.
  • a computer-readable storage medium having computer-readable instructions stored thereon, the computer-readable instructions realizing the following steps when executed by a processor:
  • training data which includes training images and image attack category labels
  • the number of training targets is calculated from the defense rate of the training reference images corresponding to the training images.
  • the defense rate of the training reference images is used to indicate that the training reference images are affected by the images. defense when attacking;
  • the steps of obtaining the initial consistency detection result are performed until the training is completed, and the target image attack detection model is obtained.
  • the training image is input into the global image classification and recognition model for global classification and recognition, and the training global classification and recognition result vector is obtained; based on the training image, local image extraction is randomly performed to obtain the training local number of training targets.
  • Image the number of training targets is calculated from the defense rate of the training reference image corresponding to the training image.
  • the defense rate of the training reference image is used to represent the defense degree of the training reference image when it is attacked by the image; Perform local classification and recognition in the local image classification and recognition model, obtain each training local classification and recognition result vector, and fuse each training local classification and recognition result vector to obtain the target training classification and recognition result vector;
  • the recognition result vector is input into the initial image attack detection model for consistency detection of the recognition results, and the initial consistency detection result is obtained; based on the initial consistency detection result and the image attack category label, the initial image attack detection model is updated and cyclic iteration is performed to obtain the target
  • the image attack detection model that is, the target image attack detection model trained by using the target training classification recognition result vector and the training global classification recognition result, can make the obtained target image attack detection model improve the accuracy of consistency detection, thereby improving the Image attack detection accuracy.
  • FIG. 1 is an application environment diagram of an image attack detection method in one embodiment
  • FIG. 2 is a schematic flowchart of an image attack detection method in one embodiment
  • FIG. 3 is a schematic flowchart of an image attack detection method in another embodiment
  • Fig. 4 is the schematic flow chart of obtaining target quantity in one embodiment
  • FIG. 5 is a schematic flowchart of an image attack detection model training method in one embodiment
  • FIG. 6 is a schematic flowchart of obtaining the number of training targets in one embodiment
  • FIG. 7 is a schematic flowchart of obtaining a training partial image in one embodiment
  • FIG. 8 is a schematic diagram of a training partial image binarization result in a specific embodiment
  • FIG. 9 is a schematic flowchart of obtaining a global image classification and recognition model in one embodiment
  • FIG. 10 is a schematic diagram of a learning rate change function in a specific embodiment
  • FIG. 11 is a schematic flowchart of obtaining a partial image classification and recognition model in one embodiment
  • FIG. 12 is a schematic flowchart of an image attack detection method in a specific embodiment
  • FIG. 13 is a schematic diagram of attacking by an attack image in a specific embodiment
  • FIG. 14 is a schematic diagram of the architecture of the image attack detection method in the specific embodiment of FIG. 13;
  • 15 is a structural block diagram of an image attack detection apparatus in one embodiment
  • FIG. 16 is a structural block diagram of an image attack detection model training apparatus in one embodiment
  • Figure 17 is an internal structure diagram of a computer device in one embodiment
  • Figure 18 is a diagram of the internal structure of a computer device in one embodiment.
  • the image attack detection method provided in this application can be applied to the application environment shown in FIG. 1 .
  • the terminal 102 communicates with the server 104 through the network.
  • the server 104 acquires the image to be detected sent by the terminal 102, performs global classification and recognition based on the image to be detected, and obtains a global classification and recognition result; the server 102 randomly performs partial image extraction based on the image to be detected, and obtains a target number of partial images, and the target number is determined according to the to-be-detected image.
  • the defense rate of the reference image corresponding to the detection image is calculated, and the defense rate of the reference image is used to represent the defense degree of the reference image when it is attacked by the image; the server 104 performs partial classification and recognition based on the partial images of the target number, and obtains each partial classification and recognition. As a result, each local classification recognition result is fused to obtain a target classification recognition result; the server 104 detects the consistency of the recognition results based on the target classification recognition result and the global recognition result, and when the target classification recognition result and the global classification recognition result are inconsistent, it determines the The detection image is an attack image, and the server 104 sends the detection result to the terminal for display, and may also save the detection result in the database 106 .
  • the terminal 102 can be, but is not limited to, various desktop computers, notebook computers, smart phones, tablet computers, and portable wearable devices, and the server 104 can be an independent physical server, or a server cluster or distributed server composed of multiple physical servers. It can also provide basic cloud services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Cloud servers for computing services.
  • the terminal and the server can be directly or indirectly connected through wired or wireless communication.
  • an image attack detection method is provided, and the method is applied to the server in FIG. 1 as an example for description. It can be understood that the method can also be applied to a terminal, It can also be applied to a system including a terminal and a server, and is realized through the interaction between the terminal and the server. In this embodiment, the following steps are included:
  • Step 202 Obtain an image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result.
  • the to-be-detected image refers to an image that needs to be image attack detection, and it is detected whether the to-be-detected image is a real image or an attack image.
  • the real image refers to the real image
  • the attack image refers to the image against the attack.
  • Adversarial attack is a technology that makes classification and recognition make wrong judgments by perturbing the image.
  • Physical attack is one of the important branches.
  • the attack area because the attack area can be generated on the physical side by means of 3D printing, etc., has a large amount of disturbance and is not easily disturbed by environmental conditions, which is more likely to cause security risks.
  • the image to be detected may be any image that needs to be classified and identified for the content of the image, for example, it may be a face image for performing face recognition, face detection, and face liveness detection. It can also be an object image for object classification and recognition, such as images of cars and obstacles. It can also be a species image for species classification and identification, such as images of cats and dogs.
  • the global classification and recognition result refers to the result obtained by classifying and recognizing the image to be detected as a whole.
  • the server can acquire the image to be detected sent by the terminal, the image to be detected from the server, the image to be detected collected from the Internet, or the image to be detected provided by the service server. and many more. Then the server performs global classification and recognition on the image to be detected, and obtains a global classification and recognition result.
  • the global image classification and recognition model established by the neural network algorithm can be used in advance and deployed to the server. When the image to be detected is obtained, the global image classification and recognition model is called to perform global classification and recognition of the image to be detected, so as to obtain the global classification and recognition result.
  • Step 204 randomly perform partial image extraction based on the to-be-detected image to obtain a target number of partial images, the target number is calculated according to the defense rate of the reference image corresponding to the to-be-detected image, and the defense rate of the reference image is used to indicate that the reference image is affected by the image. Defense when attacking.
  • the reference image is an image used to determine the number of partial image extractions, and the size of the reference image is consistent with the size of the image to be detected.
  • the defense rate of the reference image is used to represent the defense degree of the reference image when it is attacked by an image, and the defense degree refers to the possibility that the image attack detection result is an attack image when the reference image is an attack image.
  • the server randomly extracts partial images of the images to be inspected according to the target number, and obtains partial images of the target number, wherein, each time the partial image extraction is performed, the extraction is performed on the whole of the image to be inspected, so as to ensure that each partial image is extracted. Extractions are independent of each other and have no dependencies.
  • the size of the extracted partial images is predetermined, and the size of all partial images is the same. In one embodiment, the size of the partial image may be determined according to the preset proportional relationship between the partial image size and the overall image size, or may also be determined according to the preset size relationship between the partial image area and the overall image area.
  • the number of targets may be calculated in advance according to the defense rate of the reference image corresponding to the image to be detected, and the defense rate of the reference image is used to represent the defense degree of the reference image when it is attacked by the image.
  • the size of the extracted partial images may be of any size, that is, the sizes of different partial images may be different.
  • Step 206 Perform local classification and recognition based on the partial images of the target number, respectively, to obtain each partial classification and recognition result, and fuse the local classification and recognition results to obtain the target classification and recognition result.
  • the local classification and recognition result refers to the result obtained after classifying and recognizing the local image.
  • the target classification and recognition result refers to the result of the integration of each partial classification and recognition result.
  • the server performs partial classification and recognition on the partial images of the target number respectively, and obtains each partial classification and recognition result.
  • a neural network algorithm can be used to establish a local image classification and recognition model, and then deployed to the server.
  • the local image classification and recognition model is called to perform local classification and recognition of the local image, so as to obtain the local classification and recognition result.
  • Perform local classification and recognition on each local image in turn to obtain the local classification and recognition results of the number of targets, and add the local classification and recognition results of the number of targets to obtain the total results of local classification and recognition, and then carry out according to the total results of local classification and recognition and the number of targets. Average calculation to obtain the target classification and recognition results.
  • the server may first perform weighting processing on the local classification and recognition results of the target number to obtain weighted local classification and recognition results, and then perform an average calculation according to the weighted local classification and recognition results and the number of targets to obtain the target classification Identify the results.
  • the weighting weight may be determined according to the area size of the partial image, or may be determined according to the average pixel of the partial image.
  • Step 208 Detect the consistency of the recognition results based on the target classification recognition result and the global recognition result. When the target classification recognition result and the global classification recognition result are inconsistent, determine that the image to be detected is an attack image.
  • the server judges the consistency between the target classification recognition result and the global recognition result detection and recognition result, wherein the target classification recognition result and the global recognition result detection and recognition result may be matched, and the consistency is judged according to the matching result, and the target classification may also be calculated.
  • the recognition results and the global recognition results detect the similarity of the recognition results, and determine the consistency according to the similarity. Consistency detection and identification can also be performed through a pre-established image attack detection model. Wherein, when the target classification recognition result is inconsistent with the global classification recognition result, it means that the global classification recognition result is an error result formed after the confrontation attack, and at this time, the image to be detected is determined to be an attack image.
  • the target classification recognition result is consistent with the global classification recognition result, it indicates that the global classification recognition result is the real result, and the image to be detected is judged to be a real image.
  • the above image attack detection method, device, computer equipment and storage medium obtain a global classification and recognition result by acquiring an image to be detected, and performing global classification and recognition based on the to-be-detected image. Since the global recognition result of the real image is consistent with any local recognition result, and the image attack by means of physical attack cannot change each local recognition result, so the local images of the target number can be randomly extracted. It is calculated according to the defense rate of the reference image corresponding to the image to be detected. The defense rate of the reference image is used to characterize the defense degree of the reference image when it is attacked by the image, so as to identify each local classification and recognition result, and then classify each local classification and recognition result. Fusion, when the obtained target classification and recognition results are inconsistent with the global classification and recognition results, the image to be detected is judged to be an attack image, which can improve the accuracy of image attack detection and reduce security risks.
  • the image attack detection method further includes:
  • Step 302 Input the image to be detected into a global image classification and recognition model for global classification and recognition, and obtain a global classification and recognition result vector.
  • the global image classification and recognition model refers to an image classification and recognition model obtained by using the whole image through neural network algorithm training, which is used to classify and recognize the whole image
  • the neural network algorithm may be CNN (Convolutional Neural Networks, convolutional neural network Network) algorithm, RNN (Recurrent Neural Network, Recurrent Neural Network) and so on.
  • the neural network algorithm may be a ResNet18 (residual network) network algorithm or may be a VGGNet (deep convolutional neural network) network algorithm, an Inception (a convolutional neural network structure) network algorithm, a DenseNet ( Densely Connected Convolutional Networks, dense convolutional neural network) network algorithm and so on.
  • the server may use the entire image in advance to obtain a global image classification and recognition model through neural network algorithm training, and deploy and use the global image classification and recognition model.
  • the server inputs the image to be detected into the global image classification and recognition model for global classification and recognition, and obtains an output global classification and recognition result vector.
  • the global classification and recognition result vector refers to the classification probability vector of the entire image to be detected, that is, each element in the global classification and recognition result vector is used to represent the probability of the corresponding class.
  • the image to be detected may also be input into a global image classification and recognition model for global classification and recognition, and the feature map output by the convolutional layer during global classification and recognition is obtained as a global classification and recognition result vector.
  • Step 304 randomly perform partial image extraction based on the image to be detected to obtain a target number of partial images.
  • Step 306 respectively input the local images of the target number into the local image recognition model for local classification and recognition, obtain each local classification and recognition result vector, and fuse each local classification and recognition result vector to obtain the target classification and recognition result vector.
  • the local image recognition model refers to a model obtained by using a local image to train through a neural network algorithm, or a model obtained by further training a global image recognition model using a local image.
  • the partial image recognition model is used to classify and identify partial images.
  • the local classification and recognition result vector refers to the classification probability vector corresponding to the local image, that is, each element in the local classification and recognition result vector is used to represent the probability of the corresponding class.
  • the target classification and recognition result vector refers to the fused local classification and recognition result vector, and the target classification and recognition result is used to represent the classification and recognition result of the image obtained when the local image is used for classification and recognition.
  • the server calculates the number of targets according to the defense rate of the reference image corresponding to the image to be detected, and the defense rate of the reference image is used to represent the defense degree of the reference image when it is attacked by the image. Then, random local image extraction is performed on the images to be detected according to the target number to obtain the target number of local images.
  • the server inputs each partial image into the partial image recognition model for partial classification and recognition, and obtains each partial classification and recognition result vector.
  • the local image may also be input into the local image classification and recognition model for local classification and recognition, and the feature map output by the convolutional layer during the local classification and recognition is obtained as the local classification and recognition result vector. Then the server fuses each local classification and recognition result vector to obtain the target classification and recognition result vector.
  • the server may calculate the average vector of each partial classification and recognition result vector to obtain the target classification and recognition result vector. That is, the vector sum of each local classification and recognition result vector is calculated, and then the ratio of the vector sum to the target number is calculated to obtain an average vector, and the average vector is used as the target classification and recognition result vector.
  • the server may also obtain the weights corresponding to each local classification and recognition result vector, and perform a weighted average of the weights corresponding to each local classification and recognition result vector to obtain the target classification and recognition result vector.
  • the weight corresponding to each local classification and recognition result vector may be determined according to the importance of the local image, and the importance of the local image may be calculated by the CAM (Class Activation Mapping, class activation mapping) algorithm.
  • Step 308 Input the target classification recognition result vector and the global classification recognition result vector into the image attack detection model for consistency detection. When the target classification recognition result and the global classification recognition result are inconsistent, determine the image to be detected as an attack image.
  • the image attack detection model is used to detect the consistency of the target classification recognition result vector and the global classification recognition result, so as to obtain a model of the discrimination result.
  • the discrimination result can be that the image to be detected is an attack image or the image to be detected is a real image .
  • the image attack detection model is a binary classification model, which is pre-trained with the binary classification algorithm using the target classification recognition result vector of the training image and the global classification recognition result.
  • the binary classification algorithm may be a linear regression algorithm, a support vector machine algorithm, a neural network algorithm, a decision tree algorithm, a random forest algorithm, and the like.
  • the server when the server obtains the target classification recognition result vector and the global classification recognition result vector, it can directly input the target classification recognition result vector and the global classification recognition result vector into the image attack detection model for consistency detection, and the image attack detection model It is judged that when the target classification recognition result is inconsistent with the global classification recognition result, the image to be detected is output as the detection result of the attack image.
  • the server splices the target local recognition result vector and the global recognition result vector end to end to obtain a splicing vector.
  • the target local recognition result vector can be first, and the global recognition result vector can be spliced end to end to obtain the splicing vector, or the global recognition result vector can be first, and the target local recognition result vector can be spliced end to end to obtain the splicing vector.
  • the splicing vector is input into the image attack detection model, and the image attack detection model is used to detect the consistency of the target local recognition result vector and the global recognition result vector, and it is judged that when the target classification recognition result is consistent with the global classification recognition result, the output image to be detected is The detection result of the real image, when the target classification recognition result is inconsistent with the global classification recognition result, the image to be detected is output as the detection result of the attack image.
  • the image to be detected is globally classified and recognized by using the global image recognition model, the local image is classified and recognized by the local image recognition model, and finally the target local recognition result vector and the global recognition result are determined by the image attack detection model.
  • the consistency of the vector is detected to obtain the image detection result, which not only improves the accuracy of image attack detection, but also improves the efficiency of image attack detection.
  • the detection result of the image to be detected in the image attack detection method of the present application can be stored on the blockchain to ensure data security and non-tampering.
  • the image attack detection method further includes:
  • Step 402 Obtain the global size of the image to be detected, obtain a reference image based on the global size of the image to be detected, the reference image includes a preset reference attack area, and the reference attack area is determined according to the preset upper limit size of the attack area.
  • the global size refers to the width and height of the image to be detected.
  • the reference attack area refers to the attack area in the reference image, which is preset.
  • the upper limit size of the preset attack area refers to the preset maximum width and height of the attack area.
  • the server acquires the global size of the image to be detected, wherein different image classification and recognition scenarios are performed on images of different sizes.
  • the number of objects corresponding to different sizes of images to be detected is different.
  • the server obtains the global size of the image to be detected, it can obtain the reference image according to the global size of the image to be detected, and the global size of the reference image is consistent with the global size of the image to be detected.
  • the reference image includes a preset reference attack area, and the reference attack area is determined according to the upper limit size of the preset attack area.
  • Step 404 Perform parameter calculation based on the global size and the preset upper limit size of the attack area to obtain a proportion parameter of the target partial image, where the image content of the reference attack area exists in the target partial image.
  • the target partial image refers to a partial image where the image content of the reference attack area exists, and the partial image is a partial image corresponding to the reference image.
  • the partial image of the target can contain part of the reference attack area or all of the reference attack area.
  • the proportion parameter of the target partial image refers to the ratio of the number of target partial images corresponding to the reference image to the number of all partial images.
  • the weight parameter of the target partial image is used to characterize the possibility of extracting the target partial image during image extraction.
  • the server may determine the local size of the partial image to be extracted from the reference image according to the global size, and then use the global size, the local size and the preset upper limit size of the attack area to perform parameter calculation to obtain the proportion parameter of the target partial image.
  • step 404 parameter calculation is performed based on the global size and the upper limit size of the preset attack area to obtain the proportion parameter of the target partial image, including the steps:
  • the local size is determined based on the global size, and the total number of local images that can be extracted from the reference image is calculated based on the global size and the local size. Calculate the total number of target local images that can be extracted from the reference image based on the global size, local size and the upper limit size of the preset attack area. Calculate the ratio of the total number of target partial images to the total number of partial images, and obtain the proportion parameter of the target partial images.
  • the total number of partial images that can be extracted from the reference image refers to the maximum number of partial images that can be extracted when the reference image performs partial image extraction.
  • the total number of target partial images refers to the maximum number of target partial images that can be extracted by partial image extraction from the reference image.
  • the server may determine the local size of the global size corresponding to the reference image according to the preset proportional relationship between the global image and the local image, where the local size is the size of the local image extracted from the reference image. Then use the global size and local size to calculate the total number of local images that can be extracted by the reference image, and use the global size, local size and the upper limit size of the preset attack area to calculate the total number of target local images that can be extracted by the reference image. Finally, the ratio of the total number of target partial images to the total number of partial images is calculated, and the proportion parameter of the target partial image is obtained.
  • the server can use the formula (1) shown below to calculate the total number of partial images that can be extracted from the reference image.
  • n all represents the total number of local images
  • w represents the width in the global dimension
  • h represents the height in the global dimension
  • k i represents the width in the local dimension
  • k j represents the height in the local dimension.
  • the server can use the formula (2) shown below to calculate the total number of target partial images that can be extracted from the reference image.
  • n adv min( pi +k i -1,wk i +1 )
  • n adv represents the total number of target partial images
  • pi represents the width in the upper limit size of the preset attack area
  • p j represents the height in the upper limit size of the preset attack area.
  • the server can use the formula (3) shown below to calculate the weight parameter of the target partial image.
  • p la represents the weight parameter of the target local image.
  • Step 406 Obtain the number of reference partial image extractions, and randomly perform partial image extraction on the reference image based on the number of reference partial image extractions to obtain partial images with the reference partial image extraction number.
  • the reference number of partial image extractions refers to the number of partial image extractions to be determined.
  • the server may be the extraction quantity of the reference partial image obtained from the terminal, or may be the extraction quantity of the reference partial image obtained from the database. Partial image extraction is randomly performed on the reference image according to the number of reference partial image extractions, so as to obtain partial images with the number of reference partial image extractions.
  • the server extracts the partial image independently, that is, the partial image extraction is performed on the basis of the reference partial image every time.
  • Step 408 perform local classification and recognition based on the partial images of the reference partial image extraction quantity, obtain the partial classification recognition result of the reference partial image extraction quantity, perform statistical calculation based on the local classification recognition result of the reference partial image extraction quantity, and obtain the extraction of the target partial image.
  • Minimum quantity perform local classification and recognition based on the partial images of the reference partial image extraction quantity, obtain the partial classification recognition result of the reference partial image extraction quantity, perform statistical calculation based on the local classification recognition result of the reference partial image extraction quantity, and obtain the extraction of the target partial image.
  • the server may use the partial image classification and recognition model to respectively perform partial classification and recognition on the partial images with reference to the number of partial image extractions, and obtain the partial classification and recognition results with reference to the number of partial image extractions.
  • the statistics refer to the local classification recognition results with the largest number of local classification recognition results and the second largest number of local classification recognition results among the local classification recognition results of the number of local image extractions, calculated using the local classification recognition results with the largest number and the second largest number of local classification recognition results.
  • the number of extraction lower bounds for the target partial image.
  • statistical calculation is performed based on the local classification and identification results of the extracted quantity of the reference partial image to obtain the extraction lower limit quantity of the target partial image, including:
  • the number of the first category and the number of the second category in the local classification and recognition results with reference to the number of partial image extractions.
  • the number of categories other than the first category is the largest; based on the number of the first category and the number of the second category, the extraction lower limit number of the target partial image is calculated.
  • different partial classification and recognition results may have different categories.
  • the partial image is obtained by partially extracting the face image of A.
  • the partial recognition result contains the recognition of A.
  • identification results such as identification as B, identification as C, and so on.
  • the server conducts statistics on the number of categories according to the number of local classification and recognition results extracted by referring to the number of partial images, obtains the number of local classification and recognition results of different categories, sorts each category according to the number of local classification and recognition results of different categories, and sorts the local classification and recognition results.
  • the category with the largest number of results is used as the first category
  • the category with the largest number of local classification recognition results other than the first category among the partial classification and recognition results of the extracted number of reference partial images is used as the second category.
  • the first category is the real classification and recognition result corresponding to the reference image.
  • Use the number of the first category and the number of the second category to calculate the extraction lower bound number of the target partial image.
  • the extraction lower limit of the target local image is the number of local classification and recognition results that must be changed at least when the attack image is to be successfully attacked.
  • the following formula (4) can be used to calculate the extraction lower limit of the target partial image.
  • n a represents the extraction lower limit number of target partial images
  • n c1 represents the number of the first category
  • n c2 represents the number of the second category.
  • Step 410 performing a binomial distribution sum calculation based on the extraction lower limit quantity of the target partial image, the extraction quantity of the reference partial image and the target partial image proportion parameter, to obtain the defense rate of the reference image;
  • the server uses a binomial distribution sum formula to calculate based on the extraction lower limit quantity of the target partial image, the extraction quantity of the reference partial image and the target partial image proportion parameter, and obtains the defense rate of the reference image.
  • the defense rate of the reference image can be calculated using the binomial distribution summation formula (5) shown below.
  • pe represents the defense rate of the reference image
  • the defense rate of the reference image is used to characterize the probability that the number of reference partial images extracted does not exceed the lower limit of the number of target partial images extracted.
  • N refers to the number of reference partial image extractions. That is, p e is a function that increases monotonically with the variable N.
  • Step 412 when the defense rate of the reference image meets the preset condition, the extracted quantity of the reference partial image is taken as the target quantity.
  • the preset condition refers to the preset defense rate condition, which can be the lower limit value of the defense rate.
  • Different lower limit values of the defense rate can be set in different image classification and recognition scenarios, that is, they can be set according to requirements.
  • the server determines that when the defense rate of the reference image meets the preset condition, the extraction quantity of the reference partial image is taken as the target quantity.
  • the updated reference partial image extraction quantity is obtained, the updated reference partial image extraction quantity is taken as the reference partial image extraction quantity, and the process returns to step 406 for iterative execution until the reference image defense
  • the number of reference partial image extractions is taken as the target number.
  • the extraction lower limit quantity of the target partial image, the target partial image proportion parameter and the reference partial image extraction quantity obtained by calculation are calculated by summing the binomial distribution to obtain the defense rate of the reference image, so that the obtained reference image has a
  • the defense rate is more accurate, and when the defense rate of the reference image meets the preset condition, the extracted number of reference partial images is used as the number of targets, so that the determined number of targets is more accurate.
  • the image attack detection method further comprises the steps of:
  • the extraction quantity of each reference partial image calculate the corresponding defense rate based on the extraction quantity of each reference partial image, and establish the correlation between the extraction quantity of the reference partial image and the defense rate based on the extraction quantity of each reference partial image and the corresponding defense rate; For the preset defense rate corresponding to the image to be detected, the number of target reference partial image extractions corresponding to the preset defense rate is searched from the correlation between the reference partial image extraction quantity and the defense rate, and the target reference partial image extraction quantity is used as the target quantity.
  • the correlation between the number of reference partial image extractions and the defense rate refers to the one-to-one correspondence between the number of reference partial image extractions and the defense rate
  • the preset defense rate refers to the preset defense degree of the image to be detected when it is attacked by an image.
  • the server obtains the extraction quantity of each reference partial image, and calculates the corresponding defense rate based on the extraction quantity of each reference partial image, wherein, by calculating the proportion parameter of the target partial image corresponding to the extraction quantity of each reference partial image and the target partial image
  • the number of extraction lower limit of each reference partial image, the proportion parameter of the target partial image and the extraction lower limit number of the target partial image are used for the binomial distribution sum calculation, and the defense rate corresponding to the extraction quantity of each reference partial image is obtained, and then The extracted number of each reference local image is stored in association with the corresponding defense rate.
  • the preset defense rate corresponding to the image to be detected When it is necessary to perform image attack detection on the image to be detected, obtain the preset defense rate corresponding to the image to be detected, and then find the target reference partial image extraction corresponding to the preset defense rate from the relationship between the number of saved reference partial image extractions and the defense rate.
  • the number of target reference partial images is taken as the target number. Among them, the higher the defense rate is, the more the corresponding reference local images are extracted.
  • the corresponding extraction quantity of the target reference partial image can be directly found, and the The extraction quantity of the target reference local image is used as the target quantity, which can improve the efficiency of obtaining the target quantity.
  • step 412 taking the reference partial image extraction quantity as the target quantity, includes the steps:
  • the resource information corresponding to the current device and determine the current partial image extraction quantity based on the resource information corresponding to the current device; when the reference partial image extraction quantity exceeds the current partial image extraction quantity, the current partial image extraction quantity is used as the target quantity; when the reference partial image extraction quantity is used as the target quantity; When the extraction quantity does not exceed the current partial image extraction quantity, the reference partial image extraction quantity is used as the target quantity.
  • the current device refers to a device that performs image attack detection.
  • Resource information refers to the resources that the current device can use when detecting image attacks, and the resources include but are not limited to memory resources, storage resources, computing resources, and time resources.
  • Memory resources refer to the memory that can be occupied by the current device for image attack detection.
  • Storage resources refer to the storage space that can be used by the current device during image attack detection.
  • Computing resources refer to the computing power that the current device can use when performing image attack detection.
  • Time resource refers to the time that the current device can consume when performing image attack detection.
  • the current number of partial image extractions refers to the number of partial images that can be extracted under the resource information of the current device.
  • the server obtains resource information corresponding to itself, and the resource information may be pre-allocated.
  • the server determines the current number of partial image extractions according to the corresponding resource information, and the server determines the current number of partial image extractions according to resource information corresponding to the current device according to the resource information consumed when extracting sequential partial images.
  • the server determines that when the reference partial image extraction quantity exceeds the current partial image extraction quantity, the current partial image extraction quantity is taken as the target quantity.
  • the number of reference partial image extractions does not exceed the current partial image extraction number
  • the reference partial image extraction number is used as the target number. For example, the time resource of the current device is 1 second, and the number of targets determined based on the time resource cannot make the image attack detection take more than 1 second.
  • a method for training an image attack detection model is provided, and the method is applied to the server in FIG. 1 as an example for illustration. It can be understood that the method can also be applied to a terminal It can also be applied to a system including a terminal and a server, and is realized through the interaction between the terminal and the server. In this embodiment, the following steps are included:
  • Step 502 Acquire training data, where the training data includes training images and image attack category labels.
  • the training image refers to the image used to train the image attack detection model.
  • the image attack category label refers to the attack category label corresponding to the training image.
  • Attack class labels include labels where training images are real images and labels where training images are attack images.
  • the server may obtain training data from a database, may also obtain training data from a third-party database, and may also collect training data from the Internet.
  • Step 504 input the training image into the global image classification and recognition model for global classification and recognition, and obtain a training global classification and recognition result vector.
  • the global image classification and recognition model is a pre-trained neural network model for classifying and recognizing the whole image.
  • the training global classification and recognition result vector refers to the global classification and recognition result vector corresponding to the entire training image.
  • the server inputs the training image into the global image classification and recognition model for global classification and recognition, and obtains a training global classification and recognition result vector.
  • Step 506 randomly extracting local images based on the training images to obtain training local images of the number of training targets, the number of training targets is calculated from the defense rate of the training reference images corresponding to the training images, and the defense rate of the training reference images is used to represent the training reference. The degree of defense of the image when it is attacked by the image.
  • the number of training targets refers to the number of local images to be extracted corresponding to the training images.
  • the training reference image refers to the reference image during training.
  • the server obtains the number of training targets, randomly extracts local images from the training images according to the number of training targets, and obtains training local images for the number of training targets. For example, a square area of a fixed size can be randomly cropped from an image according to the number of training targets to obtain a training partial image.
  • Step 508 respectively input the training local images of the target number into the local image classification and recognition model for local classification and recognition, obtain each training local classification and recognition result vector, and fuse each training local classification and recognition result vector to obtain the target training classification and recognition result. vector.
  • the local image classification and recognition model refers to a pre-trained neural network model for classifying and recognizing local images.
  • the training local classification and recognition result vector refers to the vector of the local classification and recognition result corresponding to the training local image.
  • the target training classification and recognition result vector is a vector obtained by fusing each training local classification and recognition result vector.
  • the server respectively inputs the target number of training partial images into the partial image classification and recognition model for partial classification and recognition, obtains each training partial classification and recognition result vector, and then calculates the average vector of each training partial classification and recognition result vector, and the average vector The vector is used as the target training classification recognition result vector.
  • Step 510 Input the target training classification identification result vector and the training global classification identification result vector into the initial image attack detection model to perform consistency detection of the identification results, and obtain an initial consistency detection result.
  • the initial image attack detection model refers to an image attack detection model initialized with model parameters.
  • the initial consistency detection result refers to the initial consistency detection result, and the consistency detection result refers to whether the image obtained by judging whether the target training classification recognition result vector is consistent with the training global classification recognition result is an attack image.
  • the server can splicing the target training classification recognition result vector and the training global classification recognition result vector to obtain the spliced vector, and input the spliced vector into the initial image attack detection model, and the initial image attack detection model trains the target The consistency between the classification and recognition result vector and the training global classification and recognition result vector is detected, and the initial consistency detection result is output.
  • Step 512 update the initial image attack detection model based on the initial consistency detection result and the image attack category label, and return the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model for consistency of recognition results.
  • the steps of obtaining the initial consistency detection result are performed until the training is completed, and the target image attack detection model is obtained.
  • the server uses a binary classification loss function to calculate the initial consistency detection result and the loss value of the image attack category label, wherein the binary classification loss function may be a cross entropy loss function.
  • update the initialized parameters in the initial image attack detection model based on the loss value to obtain the updated image attack detection model, which will be updated The image attack detection model is used as the initial image attack detection model, and the target training classification recognition result vector and the training global classification recognition result vector are input into the initial image attack detection model for consistency detection of the recognition results, and the initial consistency detection result is obtained.
  • the steps of is iteratively executed until the preset loss threshold is reached, and the initial image attack detection model that reaches the preset loss threshold is used as the target image attack detection model.
  • the training image is input into the global image classification and recognition model for global classification and recognition, and the training global classification and recognition result vector is obtained; local image extraction is randomly performed based on the training image to obtain the number of training local images of the training target, Input the training local images of the target number into the local image classification and recognition model for local classification and recognition, and obtain each training local classification and recognition result vector, and fuse each training local classification and recognition result vector to obtain the target training classification and recognition result vector;
  • the target training classification recognition result vector and the training global classification recognition result vector are input into the initial image attack detection model for consistency detection of the recognition results, and the initial consistency detection result is obtained; the initial image is updated based on the initial consistency detection result and the image attack category label Attack the detection model and perform loop iteration to obtain the target image attack detection model, that is, the target image attack detection model trained by using the target training classification recognition result vector and the training global classification recognition result, which can improve the target image attack detection model. Consistency detection accuracy, thereby improving image attack detection accuracy.
  • the image attack detection model training method further includes:
  • Step 602 Obtain the training global size of the training image, obtain a training reference image based on the training global size of the training image, the training reference image includes a preset training reference attack area, and the training reference attack area is determined according to the preset upper limit size of the training attack area .
  • the training global size refers to the size of the training image, that is, width and height.
  • the attack area in the training image is preset when training the reference attack area.
  • the upper limit size of the preset training attack area refers to the maximum size of the preset attack area, that is, the width and height.
  • the server obtains the training global size of the training image, and obtains the training reference image based on the training global size of the training image.
  • the size of the training reference image can be the same as the training global size of the training image.
  • the training global size of the training image is consistent with the global size of the image to be detected.
  • Step 604 Perform parameter calculation based on the training global size and the preset upper limit size of the training attack area to obtain a weight parameter of the training target partial image, and the training target partial image has image content of the training reference attack area.
  • the training target local image refers to a local image with a training reference attack area during training, and the training target local image may include part of the training reference attack area, or may include all the training reference attack areas.
  • the proportion parameter of the training target partial image refers to the proportion of the training target partial image corresponding to the training reference image to all the training partial images, which is used to represent the possibility of extracting the training target partial image when the training image is extracted.
  • the server may determine the training local size of the training local image to be extracted from the training reference image according to the training global size, and then use the training global size, the training local size and the preset training attack area upper limit size to perform parameter calculation to obtain the training target local size The weight parameter of the image.
  • step 604 includes the steps of: determining the training local size based on the training global size, and calculating the total number of training local images that can be extracted from the training reference image based on the training global size and the training local size. Calculate the total number of training target local images that can be extracted from the training reference image based on the training global size, training local size and the preset training attack area upper limit size. Calculate the ratio of the total number of training target partial images to the total number of training partial images, and obtain the proportion parameter of the training target partial images.
  • the total number of training partial images that can be extracted from the training reference image refers to the maximum number of partial images that can be extracted when the training reference image is used for partial image extraction.
  • the total number of training target partial images refers to the total number of target partial images that can be extracted from the training reference image.
  • the server may determine the training local size according to the training global size according to the preset size relationship between the overall image and the partial image. Then use the training global size and the training local size to calculate the total number of training local images that can be extracted from the training reference image.
  • formula (1) can be used to calculate the total number of training partial images that can be extracted from the training reference image.
  • use the training global size, training local size and preset training attack area upper limit size to calculate the total number of training target local images that can be extracted from the training reference image for example, can be calculated using formula (2).
  • the ratio of the total number of training target partial images to the total number of training partial images is calculated to obtain the weight parameter of the training target partial image.
  • the weight parameter of the training target partial image can be calculated using formula (3).
  • Step 606 Obtain the number of training reference partial images extracted, randomly perform partial image extraction on the training reference image based on the number of training reference partial images extracted, and obtain the number of partial images extracted from the training reference partial images.
  • the number of local image extractions for training reference refers to the number of local image extractions to be determined during training.
  • the server obtains the extraction quantity of the training reference partial images, randomly performs partial image extraction on the training reference image according to the extraction quantity of the training reference partial images, and obtains the partial images of the extraction quantity of the training reference partial images.
  • Step 608 Perform local classification and recognition based on the number of local images extracted from the training reference local images to obtain a local classification and recognition result of the number of training reference local images extracted, and perform statistical calculation based on the local classification and recognition results of the number of training reference local images extracted to obtain the training target.
  • the number of extraction lower bounds for partial images.
  • the server may input the partial images of the training reference partial image extraction quantity into the partial image classification and recognition model for partial classification and recognition, and obtain the output local classification and recognition result of the training reference partial image extraction quantity. Then count the local classification recognition results with the largest number of local classification recognition results and the local classification recognition results with the largest number of local classification recognition results of the number of local image extractions for training, and use the local classification recognition results with the largest number and the number of local classification recognition results to obtain training.
  • the number of extraction lower bounds for the target partial image.
  • step 608 includes the step of: counting the number of the first training category and the number of the second training category in the local classification recognition result of the number of training reference partial image extractions, where the first training category refers to the training reference partial image extraction The category with the largest number in the number of local classification and recognition results, and the second training category refers to the category with the largest number of local classification and recognition results except for the first training category in the number of local classification and recognition results extracted from the training reference local images; based on the number of the first training category and the second training category The number of classes computes the lower bound number of extractions for training target local images.
  • the server counts the number of the first training category corresponding to the category with the largest number in the local classification and recognition results of the number of training reference partial image extractions, and counts the number of local classification recognition results excluding the first training category in the number of training reference partial image extractions.
  • the number of second training classes corresponding to the largest class. Then use the number of the first training category and the number of the second training category to calculate the extraction lower limit of the training target partial images, wherein the extraction lower limit of the training target partial images can be calculated by using formula (4).
  • Step 610 Perform a binomial distribution sum calculation based on the extraction lower limit quantity of the training target partial images, the extraction quantity of the training reference partial images and the training target partial image proportion parameter to obtain the defense rate corresponding to the training reference image.
  • the server uses the extraction lower limit quantity of the training target partial image, the extraction quantity of the training reference partial image and the training target partial image proportion parameter to calculate using the binomial distribution summation formula to obtain the defense rate corresponding to the training reference image. That is, the defense rate corresponding to the training reference image can be calculated using formula (5).
  • Step 612 when the defense rate corresponding to the training reference image meets the preset condition, the extracted quantity of the training reference partial image is taken as the training target quantity.
  • the server determines that when the defense rate of the training reference image meets the preset condition, the number of extracted partial images of the training reference is taken as the number of training targets.
  • the updated training reference partial image extraction quantity is obtained, the updated training reference partial image extraction quantity is used as the training reference partial image extraction quantity, and the process returns to step 606 for iterative execution until when When the defense rate of the training reference image meets the preset conditions, the number of training reference partial images extracted is used as the number of training targets.
  • a binomial distribution sum calculation is performed by calculating the extraction lower limit of the training target partial image, the extraction quantity of the training reference partial image, and the training target partial image proportion parameter to obtain the defense rate corresponding to the training reference image, and then Determining the number of training targets according to the defense rate corresponding to the training reference image can make the number of training targets more accurate.
  • step 506 is to randomly perform partial image extraction based on the training image to obtain the training partial images of the training target number, including:
  • Step 702 Obtain the importance of each region in the training image, and divide the training image into binary values based on the importance of each region according to a preset importance threshold to obtain a target region and a non-target region.
  • the preset importance threshold refers to a preset importance threshold when the image is divided into two values.
  • the target area refers to an area whose importance exceeds a preset importance threshold.
  • a non-target area refers to an area whose importance does not exceed a preset importance threshold.
  • the server obtains the importance of the regions in the training image, then obtains a preset importance threshold, and divides the importance of each region into two values according to the preset importance threshold to obtain the target region and the non-target region.
  • the CAM algorithm can be used to judge the importance of each region in the training image to the classification, and generate a CAM heat map. Then set the threshold, and define the part of the heat map that exceeds the threshold as the target area to generate a binarized map.
  • the CAM algorithm refers to taking the weight of the last fully connected layer in the classification and recognition model as the importance of different regions to the classification result, and determining the importance of each channel (channel) feature map before global average pooling by the weight. , and the channel feature maps are added according to the weights and scaled to the original image size to determine the importance of each area in the original image
  • FIG. 8 it is a schematic diagram of the obtained target area and non-target area, wherein, the image a in FIG. 8 is classified and recognized to obtain the last fully connected layer in the classification and recognition model.
  • the weights of each channel (channel) feature map are determined by the weights, the channel feature maps are added according to the weights, and scaled to the size of the original image to determine the importance of each area in the original image, and then
  • the importance threshold is obtained, and the image a in FIG. 8 is divided into two values according to the importance threshold to obtain the b image in FIG. 8 , in which the target area is the black part, and the non-target area is the white part.
  • Step 704 randomly select the first partial image from the target area, and randomly select the second partial image from the non-target area, wherein the area of the first partial image is larger than the area of the second partial image;
  • Step 706 obtaining a training partial image based on the first partial partial image and the second partial partial image.
  • the server randomly selects the first partial image from the target area, and randomly selects the second partial image from the non-target area, wherein the area of the selected first partial image is larger than the area of the selected second partial image, Then, a training partial image is obtained by fusing the extracted first partial image and the second partial partial image.
  • the server selects a partial image from the binarized training image, and the area of the partial image overlaps with the target area by more than 50%.
  • the classification and recognition of the partial images can be made more accurate by ensuring more image contents of the target area in the randomly extracted partial images.
  • the training of the global image classification and recognition model includes the following steps:
  • Step 902 Obtain global training data, where the global training data includes global training images and corresponding global category labels.
  • the global training data refers to the training data used when training the global image classification and recognition model.
  • the global training image refers to the image used when training the global image classification and recognition model, which is a complete image.
  • the global class label refers to the class label corresponding to the global training image.
  • the server may obtain the global training data directly from the database, may also obtain the global training data from a third-party database, or may obtain the global training data from the Internet.
  • Step 904 Input the global training image into the initial global image classification and recognition model for global image classification and recognition, and obtain an initial global classification and recognition result.
  • the initial global image classification and recognition model refers to a global image classification and recognition model initialized with model parameters.
  • the initial global classification recognition result refers to the global classification recognition result obtained by using the initialization parameters.
  • the service asks to input the global training image into the initial global image classification and recognition model for global image classification and recognition, and obtain the output initial global classification and recognition result
  • Step 906 Perform loss calculation based on the initial global classification and recognition result and the global class label to obtain global loss information.
  • the global loss information refers to the model loss corresponding to the global training image, which is used to represent the error between the classification and recognition results obtained by training and the actual classification and recognition results.
  • the server uses a classification loss function to calculate the loss between the initial global classification recognition result and the global class label, and obtains global loss information
  • the classification loss function can be a cross entropy loss function, a logarithmic loss function, a square loss function and exponential loss function, etc.
  • Step 908 Reversely update the parameters in the initial global image classification and recognition model based on the global loss information to obtain an updated global image classification and recognition model.
  • the server uses a gradient descent algorithm to reversely update the parameters in the initial global image classification and recognition model, that is, use the global loss information to calculate the gradient, and use the gradient to reversely update the parameters in the initial global image classification and recognition model.
  • a gradient descent algorithm to reversely update the parameters in the initial global image classification and recognition model, that is, use the global loss information to calculate the gradient, and use the gradient to reversely update the parameters in the initial global image classification and recognition model.
  • the parameter update is completed , to obtain the updated global image classification and recognition model.
  • step 908 includes the steps of: acquiring the current learning rate, and reversely updating the parameters of the initial global image classification and recognition model based on the current learning rate and the global loss information, to obtain an updated global image classification and recognition model.
  • the current learning rate may be the currently used learning rate, or may be set.
  • the learning rate is a hyperparameter during training.
  • the server may also acquire a historical learning rate, and use a preset cosine function to adjust based on the historical learning rate to obtain the current learning rate.
  • a preset cosine function can be used to adjust the learning rate.
  • the learning rate changes according to the law of the cosine function, that is, after the current learning rate fluctuates to the lowest point each time, it jumps directly to the highest point, and at the same time, the cosine period is also constantly getting longer.
  • a warm up (adaptive training) decay strategy can also be used to adjust the learning rate, that is, training is performed with a small learning rate at the beginning of training, and the learning rate gradually increases as the training progresses, and reaches a certain level.
  • the training is performed at the set initial learning rate, and the learning rate gradually decreases.
  • Step 910 take the updated global image classification and recognition model as the initial global image classification and recognition model, and return to the steps of inputting the global training image into the initial global image classification and recognition model for global image classification and recognition, and obtaining the initial global classification and recognition result, Until the global training completion condition is reached, the initial global image classification recognition model when the global training completion condition is reached is used as the global image classification recognition model.
  • the server takes the updated global image classification and recognition model as the initial global image classification and recognition model, and returns to the steps of inputting the global training image into the initial global image classification and recognition model for global image classification and recognition, and obtaining the initial global classification and recognition result. Execute until the global training completion condition is reached, and the initial global image classification recognition model when the global training completion condition is reached is used as the global image classification recognition model.
  • the global training completion condition may be that the global loss information is less than the preset loss threshold, or It can be to reach a preset number of iterations and so on.
  • the initial global classification and recognition model is trained by using the global training data, so as to obtain the global image classification and recognition model, which is convenient for subsequent use.
  • the training of the partial image classification and recognition model includes the following steps:
  • Step 1102 using the global image classification and recognition model as the initial local image classification and recognition model.
  • Step 1104 Obtain local training data, where the regional image training data includes local training images and corresponding local image category labels.
  • the local training image is a part of the complete image.
  • the local image class label refers to the class label corresponding to the local training image.
  • the server may perform fine-tuning training on the basis of the already trained global image classification and recognition model, that is, the server uses the global image classification and recognition model as the initial local image classification and recognition model. Then get the local training data from the database. It is also possible to obtain global training data, extract a local training image from the global training image of the global training data, and use the global image category label corresponding to the global training image as the local training image label. Local training data can also be obtained from third-party databases, and local training data can also be collected from the Internet.
  • Step 1106 input the local training image into the initial local image classification and recognition model for local classification and recognition, and obtain an initial local classification and recognition result.
  • Step 1108 Perform loss calculation based on the initial local classification and recognition results and local image category labels to obtain local loss information, and reversely update the initial local image classification and recognition model based on the local loss information to obtain an updated local image classification and recognition model.
  • the server inputs the local training image into the initial local image classification and recognition model for local classification and recognition, and obtains the initial local classification and recognition result, and then reversely updates the initial local image classification and recognition model through the gradient descent algorithm, that is, the initial local image classification and recognition model is calculated by using the classification loss function.
  • the local loss information between the local classification recognition result and the local image class label, the local loss information is used to characterize the error between the initial local classification recognition result and the local image class label, and then use the local loss information to reversely update the initial local image classification
  • the parameters in the recognition model are obtained, and the updated local image classification recognition model is obtained when the parameter update is completed.
  • Step 1110 take the updated local image classification and recognition model as the initial local image classification and recognition model, and return to the steps of inputting the local training image into the initial local image classification and recognition model for local classification and recognition, and obtaining the initial local classification and recognition result, until When the local training completion condition is reached, the initial local image classification recognition model when the local training completion condition is reached is used as the local image classification recognition model.
  • the server performs iterative training, that is, the updated local image classification and recognition model is used as the initial local image classification and recognition model, and the local training image is input into the initial local image classification and recognition model for local classification and recognition, and the initial local classification and recognition result is obtained.
  • the steps are iteratively executed until the local training completion condition is reached, and the local training completion condition includes that the local loss information obtained by training reaches the preset local loss threshold, the number of training times reaches the preset upper limit of the number of iterations, and the model parameters no longer change.
  • the server takes the initial partial image classification and recognition model as the partial image classification and recognition model when the local training completion condition is reached.
  • the local image classification and recognition model is obtained, which can improve the local image classification and recognition model. Identify the efficiency of the model.
  • an image attack detection method which specifically includes the following steps:
  • Step 1202 Acquire training data, where the training data includes training images and image attack category labels.
  • Step 1204 input the training image into the global image classification and recognition model for global classification and recognition, and obtain a training global classification and recognition result vector; randomly extract local images based on the training images to obtain training local images with the number of training targets.
  • Step 1206 respectively input the training partial images of the target number into the partial image classification and recognition model for partial classification and recognition, obtain each training partial classification and recognition result vector, calculate the average vector of each training partial classification and recognition result vector, and obtain the target training classification and recognition. result vector.
  • Step 1208 splicing the target training classification recognition result vector and the training global classification recognition result vector and inputting them into the initial image attack detection model to perform consistency detection of the recognition results to obtain an initial consistency detection result;
  • Step 1210 update the initial image attack detection model based on the initial consistency detection result and the image attack category label, and return the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model for consistency of recognition results.
  • the steps of obtaining the initial consistency detection result are performed until the training is completed, and the target image attack detection model is obtained.
  • Step 1212 Obtain an image to be detected, input the image to be detected into a global image classification and recognition model for global classification and recognition, and obtain a global classification and recognition result vector. Partial image extraction is randomly performed based on the image to be detected to obtain a target number of partial images.
  • Step 1214 respectively input the target number of local images into the local image recognition model for local classification and recognition, obtain each local classification and recognition result vector, and calculate the average vector of each local classification and recognition result vector, obtain the target classification and recognition result vector, get: Object classification recognition result vector.
  • Step 1216 splicing the target local recognition result vector and the global recognition result vector to obtain a splicing vector.
  • the splicing vector is input into the target image attack detection model, and the target image attack detection model detects that when the target classification recognition result is inconsistent with the global classification recognition result, the image to be detected is determined as an attack image.
  • the present application also provides an application scenario where the above-mentioned image attack detection method is applied. specifically,
  • the identity of the person obtained through face image recognition is used for subsequent processing, such as face unlocking.
  • Figure 13 it is a schematic diagram of attacking the face recognition system by attacking images.
  • the attacker generates the attack area by confronting the real image, and generates the attack image by physical means.
  • the result of the face recognition system for real image recognition is A, and then when the face recognition system does not perform image attack detection, the attacker uses the generated attack image to use the face recognition result as an incorrect result, which is B.
  • FIG. 14 it is a schematic diagram of the architecture of image attack detection.
  • the face recognition system wants to recognize a face image, it first takes the face image as the face image to be detected, and then inputs the face image to be detected into the global image classification and recognition model for recognition, and obtains the global category vector.
  • the face image to be detected is subjected to partial image extraction of the target number, and the extracted partial image of the target number is input into the partial image classification and recognition model for identification, and the local category vector is obtained, and the local category vector is averaged to obtain the average vector.
  • the present application can effectively resist the physical attack launched by the black industry on the security system, detect the corresponding attack and reject it.
  • the image attack detection method in this application can also be applied to an image text recognition scene, a pedestrian detection scene, and an object recognition scene.
  • the defense effect of the image attack detection method of the present application and the existing technology on adaptive attacks is tested, specifically: using CIFAR10 (a small dataset for identifying universal objects) and Imagenette ( An image dataset) dataset for testing.
  • CIFAR10 a small dataset for identifying universal objects
  • Imagenette An image dataset
  • steps in the flowcharts of FIGS. 2-12 are shown in sequence according to the arrows, these steps are not necessarily executed in the sequence shown by the arrows. Unless explicitly stated herein, the execution of these steps is not strictly limited to the order, and these steps may be performed in other orders. Moreover, at least a part of the steps in FIGS. 2-12 may include multiple steps or multiple stages. These steps or stages are not necessarily executed and completed at the same time, but may be executed at different times. The execution of these steps or stages The order is also not necessarily sequential, but may be performed alternately or alternately with other steps or at least a portion of the steps or phases within the other steps.
  • an image attack detection apparatus 1500 is provided.
  • the apparatus can adopt software modules or hardware modules, or a combination of the two to become a part of computer equipment.
  • the apparatus specifically includes: a global Classification module 1502, local extraction module 1504, local classification module 1506 and detection module 1508, wherein:
  • the global classification module 1502 is used to obtain the image to be detected, perform global classification and recognition based on the image to be detected, and obtain a global classification and recognition result;
  • the local extraction module 1504 is used to randomly perform local image extraction based on the to-be-detected image to obtain a target number of local images, the target number is calculated according to the defense rate of the reference image corresponding to the to-be-detected image, and the defense rate of the reference image is used to represent The defense degree of the reference image when it is attacked by the image;
  • the local classification module 1506 is used to respectively perform local classification and recognition based on the local images of the target quantity, obtain each local classification and recognition result, and fuse each local classification and recognition result to obtain the target classification and recognition result;
  • the detection module 1508 is configured to detect the consistency of the recognition results based on the target classification recognition results and the global recognition results, and when the target classification recognition results and the global classification recognition results are inconsistent, determine the image to be detected as an attack image.
  • the image attack detection apparatus 1500 further includes:
  • the global model classification module is used to input the image to be detected into the global image classification and recognition model for global classification and recognition, and obtain the global classification and recognition result vector;
  • the random extraction module is used to randomly extract local images based on the images to be detected to obtain the target number of local images
  • the local model classification module is used to input the local images of the target number into the local image recognition model for local classification and recognition, and obtain each local classification and recognition result vector, and fuse each local classification and recognition result vector to obtain the target classification and recognition result. vector;
  • the detection model detection module is used to input the target classification recognition result vector and the global classification recognition result vector into the image attack detection model for consistency detection.
  • the image to be detected is judged as an attack. image.
  • the detection model detection module is further configured to splicing the target local recognition result vector and the global recognition result vector to obtain a splicing vector; input the splicing vector into the image attack detection model, and identify the target local recognition through the image attack detection model The consistency of the result vector and the global recognition result vector.
  • the image to be detected is judged to be a real image.
  • the target classification recognition result and the global classification recognition result are inconsistent, the image to be detected is judged as Attack image.
  • the local model classification module is further configured to calculate the average vector of each local classification and recognition result vector to obtain the target classification and recognition result vector.
  • the image attack detection apparatus 1500 further includes:
  • a size obtaining module configured to obtain the global size of the image to be detected, and obtain a reference image based on the global size of the image to be detected, the reference image includes a preset reference attack area, and the reference attack area is determined according to the upper limit size of the preset attack area;
  • the parameter calculation module is used to perform parameter calculation based on the global size and the upper limit size of the preset attack area, to obtain the proportion parameter of the target partial image, and the image content of the reference attack area exists in the target partial image;
  • the reference local extraction module is used to obtain the extraction quantity of the reference local image, and randomly performs local image extraction on the reference image based on the extraction quantity of the reference local image to obtain the local image with the reference local image extraction quantity;
  • the lower limit number calculation module is used to perform local classification and recognition based on the number of partial images extracted from the reference partial images, obtain the local classification and recognition results of the number of reference partial images extracted, and perform statistical calculations based on the local classification and recognition results of the number of reference partial image extractions to obtain the target.
  • the number of extraction lower bounds for partial images
  • the defense rate calculation module is used to perform a binomial distribution sum calculation based on the extraction lower limit quantity of the target partial image, the extraction quantity of the reference partial image and the target partial image proportion parameter to obtain the defense rate of the reference image;
  • the target quantity obtaining module is used for taking the reference partial image extraction quantity as the target quantity when the defense rate of the reference image meets the preset condition.
  • the parameter calculation module is further configured to determine the local size based on the global size, calculate the total number of local images that can be extracted from the reference image based on the global size and the local size; calculate based on the global size, the local size and the upper limit size of the preset attack area The total number of target partial images that can be extracted from the reference image; the ratio of the total number of target partial images to the total number of partial images is calculated to obtain the proportion parameter of the target partial image.
  • the lower limit number calculation module is further configured to count the number of the first category and the number of the second category in the partial classification recognition result with reference to the number of partial image extractions, where the first category refers to the partial classification with reference to the number of partial image extractions The category with the largest number in the recognition result, and the second category refers to the category with the largest number of local classification recognition results other than the first category in the reference partial image extraction number; the extraction of the target partial image is calculated based on the number of the first category and the number of the second category Minimum quantity.
  • the image attack detection apparatus 1500 further includes:
  • the relationship establishment module is used to obtain the extraction quantity of each reference partial image, calculate the corresponding defense rate based on the extraction quantity of each reference partial image, and establish the reference partial image extraction quantity and defense rate based on the extraction quantity of each reference partial image and the corresponding defense rate. rate relationship;
  • the search module is used to obtain the preset defense rate corresponding to the image to be detected, find the extracted number of target reference partial images corresponding to the preset defense rate from the correlation between the number of reference partial images extracted and the defense rate, and extract the number of target reference partial images. as the target quantity.
  • the target quantity obtaining module is further configured to obtain resource information corresponding to the current device, and determine the current partial image extraction quantity based on the resource information corresponding to the current device; when the reference partial image extraction quantity exceeds the current partial image extraction quantity, the The current number of partial image extractions is used as the target number; when the reference partial image extraction number does not exceed the current partial image extraction number, the reference partial image extraction number is used as the target number.
  • an image attack detection model training apparatus 1600 is provided.
  • the apparatus may adopt software modules or hardware modules, or a combination of the two to become a part of computer equipment.
  • the apparatus specifically includes : data acquisition module 1602, training global classification module 1604, training local extraction module 1606, training local classification module 1608, training detection module 1610 and iteration module 1612, wherein:
  • a data acquisition module 1602 configured to acquire training data, where the training data includes training images and image attack category labels;
  • the training global classification module 1604 is used to input the training image into the global image classification and recognition model for global classification and recognition, and obtain the training global classification and recognition result vector;
  • the training local extraction module 1606 is used for randomly extracting local images based on the training images to obtain training local images of the number of training targets.
  • the number of training targets is calculated from the defense rate of the training reference image corresponding to the training image.
  • the defense rate of the training reference image It is used to characterize the defense degree of the training reference image when it is attacked by the image;
  • the training local classification module 1608 is used to respectively input the training local images of the target number into the local image classification and recognition model for local classification and recognition, obtain each training local classification and recognition result vector, and fuse each training local classification and recognition result vector to obtain target training classification recognition result vector;
  • the training detection module 1610 is used to input the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model to perform consistency detection of the recognition results, and obtain the initial consistency detection result;
  • the iteration module 1612 is configured to update the initial image attack detection model based on the initial consistency detection result and the image attack category label, and return the target training classification recognition result vector and the training global classification recognition result vector into the initial image attack detection model for recognition In the consistency detection of the results, the steps of obtaining the initial consistency detection results are performed until the training is completed, and the target image attack detection model is obtained.
  • the image attack detection model training apparatus 1600 further includes:
  • the training size acquisition module is used to obtain the training global size of the training image, and obtain the training reference image based on the training global size of the training image.
  • the training reference image contains the preset training reference attack area, and the training reference attack area is based on the preset training attack area.
  • the upper limit size is determined;
  • the training parameter calculation module is used for parameter calculation based on the training global size and the upper limit size of the preset training attack area, to obtain the proportion parameter of the training target partial image, and the image content of the training reference attack area exists in the training target partial image;
  • the training reference local extraction module is used to obtain the extraction quantity of the training reference local images, and randomly extracts the local images from the training reference images based on the extraction quantity of the training reference local images to obtain the local images of the training reference local image extraction quantity;
  • the training lower limit number calculation module is used to perform local classification and recognition based on the number of local images extracted from the training reference local images, obtain the local classification and recognition results of the number of training reference local images extracted, and perform statistics based on the number of local classification and recognition results extracted from the training reference local images. Calculate to obtain the extraction lower limit of the local images of the training target;
  • the training defense rate calculation module is used to perform a binomial distribution sum calculation based on the extraction lower limit quantity of the training target partial images, the extraction quantity of the training reference partial images and the training target partial image proportion parameter to obtain the defense rate corresponding to the training reference image;
  • the training target quantity obtaining module is used for taking the training reference partial image extraction quantity as the training target quantity when the defense rate corresponding to the training reference image meets the preset condition.
  • the training parameter calculation module is further configured to determine the training local size based on the training global size, and calculate the total number of training local images that can be extracted from the training reference image based on the training global size and the training local size; Size and the upper limit size of the preset training attack area Calculate the total number of training target partial images that can be extracted by the training reference image;
  • the training lower limit number calculation module is further configured to count the number of the first training category and the number of the second training category in the partial classification recognition result of the number of training reference partial images extracted, where the first training category refers to the training reference partial image
  • the number of training classes calculates the lower limit of the number of training target partial images to be extracted.
  • the training reference local extraction module is further configured to obtain the importance of each region in the training image, and based on the importance of each region, the training image is divided into two values according to a preset importance threshold to obtain the target region and the non-target region. area; randomly select the first partial image from the target area, and randomly select the second partial image from the non-target area, wherein the area of the first partial image is larger than the area of the second partial image; based on the first partial image and The second part of the partial image gets the training partial image.
  • the image attack detection model training apparatus 1600 further includes:
  • the global recognition model training module is used to obtain global training data.
  • the global training data includes global training images and corresponding global class labels; the global training images are input into the initial global image classification and recognition model for global image classification and recognition, and the initial global classification and recognition are obtained.
  • the latter global image classification and recognition model is used as the initial global image classification and recognition model, and returns to input the global training image into the initial global image classification and recognition model for global image classification and recognition, and the steps of obtaining the initial global classification and recognition result are performed until the global training is completed.
  • the initial global image classification and recognition model when the global training completion condition is reached is used as the global image classification and recognition model.
  • the global recognition model training module is further used to obtain the current learning rate; based on the current learning rate and the global loss information, the parameters of the initial global image classification and recognition model are reversely updated to obtain the updated global image classification and recognition model.
  • the global recognition model training module is further configured to obtain a historical learning rate, and use a preset cosine function to adjust based on the historical learning rate to obtain the current learning rate.
  • the image attack detection model training apparatus 1600 further includes:
  • the local recognition model training module is used to use the global image classification and recognition model as the initial local image classification and recognition model; obtain local training data, and the regional image training data includes local training images and corresponding local image category labels; input the local training images into the initial Perform local classification and recognition in the local image classification and recognition model to obtain the initial local classification and recognition results; perform loss calculation based on the initial local classification and recognition results and local image class labels to obtain local loss information, and reversely update the initial local image classification and recognition based on the local loss information model to obtain the updated local image classification and recognition model; take the updated local image classification and recognition model as the initial local image classification and recognition model, and return to input the local training image into the initial local image classification and recognition model for local classification and recognition, and obtain the initial local image classification and recognition model.
  • the steps of the local classification and recognition result are performed until the local training completion condition is reached, and the initial local image classification recognition model when the local training completion condition is reached is used as the local image classification recognition model.
  • Each module in the above image attack detection device and image attack detection model training device can be implemented in whole or in part by software, hardware and combinations thereof.
  • the above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.
  • a computer device is provided, and the computer device may be a server, and its internal structure diagram may be as shown in FIG. 17 .
  • the computer device includes a processor, memory, and a network interface connected by a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium, an internal memory.
  • the non-volatile storage medium stores an operating system, computer readable instructions and a database.
  • the internal memory provides an environment for the execution of the operating system and computer-readable instructions in the non-volatile storage medium.
  • the database of the computer device is used for images to be detected or for storing training data.
  • the network interface of the computer device is used to communicate with an external terminal through a network connection.
  • the computer-readable instructions when executed by the processor, implement an image attack detection method and an image attack detection model training method.
  • a computer device is provided, and the computer device may be a terminal, and its internal structure diagram may be as shown in FIG. 18 .
  • the computer equipment includes a processor, memory, a communication interface, a display screen, and an input device connected by a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium, an internal memory.
  • the non-volatile storage medium stores an operating system and computer-readable instructions.
  • the internal memory provides an environment for the execution of the operating system and computer-readable instructions in the non-volatile storage medium.
  • the communication interface of the computer device is used for wired or wireless communication with an external terminal, and the wireless communication can be realized by WIFI, operator network, NFC (Near Field Communication) or other technologies.
  • the computer-readable instructions when executed by the processor, implement an image attack detection method and an image attack detection model training method.
  • the display screen of the computer equipment may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment may be a touch layer covered on the display screen, or a button, a trackball or a touchpad set on the shell of the computer equipment , or an external keyboard, trackpad, or mouse.
  • FIG. 17 and FIG. 18 are only block diagrams of partial structures related to the solution of the present application, and do not constitute a limitation on the computer equipment to which the solution of the present application is applied.
  • a computer device may include more or fewer components than those shown in the figures, or combine certain components, or have a different arrangement of components.
  • a computer device including a memory and a processor, where computer-readable instructions are stored in the memory, and when the processor executes the computer-readable instructions, the steps in the foregoing method embodiments are implemented.
  • a computer-readable storage medium which stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, implements the steps in the foregoing method embodiments.
  • a computer program product or computer program comprising computer instructions stored in a computer readable storage medium.
  • the processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps in the foregoing method embodiments.
  • Non-volatile memory may include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, or optical memory, and the like.
  • Volatile memory may include random access memory (RAM) or external cache memory.
  • the RAM may be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Evolutionary Computation (AREA)
  • Artificial Intelligence (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Multimedia (AREA)
  • Computing Systems (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Security & Cryptography (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Mathematical Physics (AREA)
  • Molecular Biology (AREA)
  • Computational Linguistics (AREA)
  • Biophysics (AREA)
  • Biomedical Technology (AREA)
  • Virology (AREA)
  • Image Analysis (AREA)

Abstract

本申请涉及一种图像攻击检测方法、装置、计算机设备和存储介质。所述方法包括：获取待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果；基于待检测图像随机进行局部图像提取，得到目标数量的局部图像，目标数量是根据待检测图像对应的参考图像的防御率计算得到的；基于目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将各个局部分类识别结果进行融合，得到目标分类识别结果；基于目标分类识别结果和全局识别结果检测识别结果的一致性，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。采用本方法能够提高图像攻击检测的准确性，减少安全隐患。

Description

图像攻击检测、图像攻击检测模型训练方法和装置
本申请要求于2021年04月21日提交中国专利局，申请号为2021104311531，申请名称为“图像攻击检测、图像攻击检测模型训练方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，特别是涉及一种图像攻击检测、图像攻击检测模型训练方法、装置、计算机设备和存储介质。
背景技术
随着图像识别技术的发展，出现了图像对抗攻击技术，比如，通过采用物理攻击(攻击区域可以通过3D打印等方式在物理侧生成)的方式对图像识别进行攻击，使图像识别的结果成为错误的结果，容易造成安全隐患。目前，通常是通过预处理或后处理手段修改攻击区域的像素值，破坏物理攻击效果，例如添加图像的滤波、颜色变换等，然而，目前对物理攻击的防御方式非常容易被规避，从而使得图像攻击检测的准确性降低，造成安全隐患。
发明内容
基于此，有必要针对上述技术问题，提供一种能够提高图像攻击检测准确性的图像攻击检测、图像攻击检测模型训练方法、装置、计算机设备和存储介质。
一种图像攻击检测方法，所述方法包括：
获取待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果；
基于待检测图像随机进行局部图像提取，得到目标数量的局部图像，目标数量是根据待检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度；
基于目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将各个局部分类识别结果进行融合，得到目标分类识别结果；
基于目标分类识别结果和全局识别结果检测识别结果的一致性，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
一种图像攻击检测装置，所述装置包括：
全局分类模块，用于获取待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果；
局部提取模块，用于基于待检测图像随机进行局部图像提取，得到目标数量的局部图像，目标数量是根据待检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度；
局部分类模块，用于基于目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将各个局部分类识别结果进行融合，得到目标分类识别结果；
检测模块，用于基于目标分类识别结果和全局识别结果检测识别结果的一致性，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
一种计算机设备，包括存储器和处理器，所述存储器存储有计算机可读指令，所述处理器执行所述计算机可读指令时实现以下步骤：
获取待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果；
基于待检测图像随机进行局部图像提取，得到目标数量的局部图像，目标数量是根据待 检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度；
基于目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将各个局部分类识别结果进行融合，得到目标分类识别结果；
基于目标分类识别结果和全局识别结果检测识别结果的一致性，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
一种计算机可读存储介质，其上存储有计算机可读指令，所述计算机可读指令被处理器执行时实现以下步骤：
获取待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果；
基于待检测图像随机进行局部图像提取，得到目标数量的局部图像，目标数量是根据待检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度；
基于目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将各个局部分类识别结果进行融合，得到目标分类识别结果；
基于目标分类识别结果和全局识别结果检测识别结果的一致性，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
上述图像攻击检测方法、装置、计算机设备和存储介质，通过获取待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果。由于真实图像的全局识别结果和任意的局部识别结果是一致的，而通过物理攻击的方式进行图像攻击是无法改变每个局部识别结果的，从而可以随机提取到目标数量的局部图像，该目标数量是根据待检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度，从而识别到各个局部分类识别结果，然后将各个局部分类识别结果进行融合，当得到的目标分类识别结果和全局分类识别结果不一致时，就判断待检测图像为攻击图像，从而能够提高对图像攻击检测的准确性，减少安全隐患。
一种图像攻击检测模型训练方法，所述方法包括：
获取训练数据，训练数据包括训练图像和图像攻击类别标签；
将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；
基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，训练目标数量是训练图像对应的训练参考图像的防御率计算得到的，训练参考图像的防御率用于表征训练参考图像受到图像攻击时的防御度；
分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量；
将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；
基于初始一致性检测结果和图像攻击类别标签更新初始图像攻击检测模型，并返回将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤执行，直到训练完成时，得到目标图像攻击检测模型。
一种图像攻击检测模型训练装置，所述装置包括：
数据获取模块，用于获取训练数据，训练数据包括训练图像和图像攻击类别标签；
训练全局分类模块，用于将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；
训练局部提取模块，用于基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，训练目标数量是训练图像对应的训练参考图像的防御率计算得到的，训练参考图像的防御率用于表征训练参考图像受到图像攻击时的防御度；
训练局部分类模块，用于分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量；
训练检测模块，用于将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；
迭代模块，用于基于初始一致性检测结果和图像攻击类别标签更新初始图像攻击检测模型，并返回将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤执行，直到训练完成时，得到目标图像攻击检测模型。
一种计算机设备，包括存储器和处理器，所述存储器存储有计算机可读指令，所述处理器执行所述计算机可读指令时实现以下步骤：
获取训练数据，训练数据包括训练图像和图像攻击类别标签；
将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；
基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，训练目标数量是训练图像对应的训练参考图像的防御率计算得到的，训练参考图像的防御率用于表征训练参考图像受到图像攻击时的防御度；
分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量；
将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；
基于初始一致性检测结果和图像攻击类别标签更新初始图像攻击检测模型，并返回将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤执行，直到训练完成时，得到目标图像攻击检测模型。
一种计算机可读存储介质，其上存储有计算机可读指令，所述计算机可读指令被处理器执行时实现以下步骤：
获取训练数据，训练数据包括训练图像和图像攻击类别标签；
将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；
基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，训练目标数量是训练图像对应的训练参考图像的防御率计算得到的，训练参考图像的防御率用于表征训 练参考图像受到图像攻击时的防御度；
分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量；
将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；
基于初始一致性检测结果和图像攻击类别标签更新初始图像攻击检测模型，并返回将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤执行，直到训练完成时，得到目标图像攻击检测模型。
在上述图像攻击检测模型训练方法中，通过将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，训练目标数量是训练图像对应的训练参考图像的防御率计算得到的，训练参考图像的防御率用于表征训练参考图像受到图像攻击时的防御度；分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量；将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；基于初始一致性检测结果和图像攻击类别标签更新初始图像攻击检测模型并进行循环迭代，得到目标图像攻击检测模型，即通过使用目标训练分类识别结果向量和训练全局分类识别结果来训练得到的目标图像攻击检测模型，能够使得到的目标图像攻击检测模型提高一致性检测的准确性，从而提高了图像攻击检测的准确性。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为一个实施例中图像攻击检测方法的应用环境图；
图2为一个实施例中图像攻击检测方法的流程示意图；
图3为另一个实施例中图像攻击检测方法的流程示意图；
图4为一个实施例中得到目标数量的流程示意图；
图5为一个实施例中图像攻击检测模型训练方法的流程示意图；
图6为一个实施例中得到训练目标数量的流程示意图；
图7为一个实施例中得到训练局部图像的流程示意图；
图8为一个具体实施例中训练局部图像二值化结果的示意图；
图9为一个实施例中得到全局图像分类识别模型的流程示意图；
图10为一个具体实施例中学习率变化函数的示意图；
图11为一个实施例中得到局部图像分类识别模型的流程示意图；
图12为一个具体实施例中图像攻击检测方法的流程示意图；
图13为一个具体实施例中攻击图像进行攻击的示意图；
图14为图13具体实施例中图像攻击检测方法的架构示意图；
图15为一个实施例中图像攻击检测装置的结构框图；
图16为一个实施例中图像攻击检测模型训练装置的结构框图
图17为一个实施例中计算机设备的内部结构图；
图18为一个实施例中计算机设备的内部结构图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请提供的图像攻击检测方法，可以应用于如图1所示的应用环境中。其中，终端102通过网络与服务器104进行通信。服务器104获取终端102发送的待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果；服务器102基于待检测图像随机进行局部图像提取，得到目标数量的局部图像，目标数量是根据待检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度；服务器104基于目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将各个局部分类识别结果进行融合，得到目标分类识别结果；服务器104基于目标分类识别结果和全局识别结果检测识别结果的一致性，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像，服务器104将检测结果发送终端进行展示，还可以将检测结果保存到数据库106中。其中，终端102可以但不限于是各种台式计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备，服务器104可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式系统，还可以是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、CDN、以及大数据和人工智能平台等基础云计算服务的云服务器。终端以及服务器可以通过有线或无线通信方式进行直接或间接地连接。
在一个实施例中，如图2所示，提供了一种图像攻击检测方法，以该方法应用于图1中的服务器为例进行说明，可以理解的是，该方法也可以应用在终端中，还可以应用于包括终端和服务器的系统，并通过终端和服务器的交互实现。在本实施例中，包括以下步骤：
步骤202，获取待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果。
其中，待检测图像是指需要进行图像攻击检测的图像，检测该待检测图像是否为真实图像或者攻击图像。真实图像是指真实的图像，攻击图像是指对抗攻击的图像。对抗攻击是一种通过对图像施加扰动来使分类识别做出错误判断的技术，物理攻击是其中一个重要的分支，物理攻击的特点是在图像的一个的局部区域施加不受限制的扰动，形成攻击区域，由于该攻击区域可以通过3D打印等方式在物理侧生成，扰动量较大不易受到环境条件的干扰，更容易造成安全隐患。待检测图像可以是任意的需要对图像内容进行分类识别的图像，比如，可以是进行人脸识别、人脸检测以及人脸活体检测的人脸图像。也可以是进行物体分类识别的物体图像，比如，车、障碍物的图像。也可以是进行物种分类识别的物种图像，比如，猫、狗的图像。全局分类识别结果是指对待检测图像从整体上进行分类识别得到的结果。
具体地，服务器可以获取到终端发送的待检测图像，也可以从服务器中获取到待检测图像，还可以是从互联网络中采集到待检测图像，还可以是获取到业务服务器提供的待检测图像等等。然后服务器对待检测图像进行全局分类识别，得到全局分类识别结果。可以预先使 用神经网络算法建立的全局图像分类识别模型，并部署到服务器中，当获取到待检测图像时调用全局图像分类识别模型来对待检测图像进行全局分类识别，从而得到全局分类识别结果。
步骤204，基于待检测图像随机进行局部图像提取，得到目标数量的局部图像，目标数量是根据待检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度。
其中，参考图像是用于确定局部图像提取数量的图像，参考图像的尺寸与待检测图像的尺寸一致。参考图像的防御率用于表征参考图像受到图像攻击时的防御度，该防御度是指当参考图像为攻击图像时图像攻击检测结果为攻击图像的可能性。
具体地，服务器按照目标数量对待检测图像随机进行局部图像提取，得到目标数量的局部图像，其中，每次进行局部图像提取时都是在待检图像的整体上进行提取的，保证每次局部图像提取都是相互独立、不存在依赖。提取的局部图像的尺寸是预先确定好的，所有局部图像的尺寸都是相同的。在一个实施例中，局部图像的尺寸可以按照预先设置好的局部图像尺寸和整体图像尺寸的比例关系来确定或者也可以按照预先设置好的局部图像面积和整体图像面积的大小关系来确定。目标数量可以是预先根据待检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度。在一个实施例中，提取的局部图像的尺寸可以是任意大小的，即不同的局部图像的尺寸可以是不相同的。
步骤206，基于目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将各个局部分类识别结果进行融合，得到目标分类识别结果。
其中，局部分类识别结果是指对局部图像进行分类识别后得到的结果。目标分类识别结果是指各个局部分类识别结果集成后的结果。
具体地，服务器对目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果。其中，可以先使用神经网络算法建立局部图像分类识别模型，然后部署到服务器中，当获取到待检测图像时调用局部图像分类识别模型来对局部图像进行局部分类识别，从而得到局部分类识别结果。依次对每个局部图像进行局部分类识别，得到目标数量的局部分类识别结果，将目标数量的局部分类识别结果进行相加，得到局部分类识别总结果，然后根据局部分类识别总结果和目标数量进行平均计算，得到目标分类识别结果。在一个实施例中，服务器也可以先对目标数量的局部分类识别结果进行加权处理，得到加权后的局部分类识别结果，再根据加权后的局部分类识别结果和目标数量进行平均计算，得到目标分类识别结果。其中，加权权重可以根据局部图像的面积大小确定，也可以是根据局部图像的平均像素确定。
步骤208，基于目标分类识别结果和全局识别结果检测识别结果的一致性，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
具体地，服务器判断目标分类识别结果和全局识别结果检测识别结果的一致性，其中，可以将目标分类识别结果和全局识别结果检测识别结果进行匹配，根据匹配结果判断一致性，也可以计算目标分类识别结果和全局识别结果检测识别结果的相似度，根据相似度确定一致性。还可以通过预先建立的图像攻击检测模型进行一致性检测识别。其中，当目标分类识别结果和全局分类识别结果不一致时，说明全局分类识别结果是对抗攻击后形成的错误的结果，此时判别待检测图像为攻击图像。当目标分类识别结果和全局分类识别结果一致时，说明全局分类识别结果是真实的结果，判别待检测图像为真实图像。
上述图像攻击检测方法、装置、计算机设备和存储介质，通过获取待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果。由于真实图像的全局识别结果和任意 的局部识别结果是一致的，而通过物理攻击的方式进行图像攻击是无法改变每个局部识别结果的，从而可以随机提取到目标数量的局部图像，该目标数量是根据待检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度，从而识别到各个局部分类识别结果，然后将各个局部分类识别结果进行融合，当得到的目标分类识别结果和全局分类识别结果不一致时，就判断待检测图像为攻击图像，从而能够提高对图像攻击检测的准确性，减少安全隐患。
在一个实施例中，如图3所示，图像攻击检测方法，还包括：
步骤302，将待检测图像输入全局图像分类识别模型中进行全局分类识别，得到全局分类识别结果向量。
其中，全局图像分类识别模型是指使用整体的图像通过神经网络算法训练得到的图像分类识别模型，用于对整体图像进行分类识别，其中，神经网络算法可以是CNN(Convolutional Neural Networks，卷积神经网络)算法、RNN(Recurrent Neural Network、循环神经网络)等等。在一个具体的实施例中，神经网络算法可以是ResNet18(残差网络)网络算法或者可以是VGGNet(深度卷积神经网络)网络算法、Inception(一种卷积神经网络结构)网络算法、DenseNet(Densely Connected Convolutional Networks，稠密卷积神经网络)网络算法等等。
具体地，服务器可预先使用整体的图像通过神经网络算法训练得到全局图像分类识别模型，将全局图像分类识别模型进行部署使用。当获取到待检测图像，服务器将待检测图像输入全局图像分类识别模型中进行全局分类识别，得到输出的全局分类识别结果向量。该全局分类识别结果向量是指待检测图像整体的分类概率向量，即全局分类识别结果向量中的每个元素用于表征对应类别的概率。在一个实施例中，也可以将待检测图像输入全局图像分类识别模型中进行全局分类识别，获取到在进行全局分类识别时卷积层输出的特征图作为全局分类识别结果向量。
步骤304，基于待检测图像随机进行局部图像提取，得到目标数量的局部图像。
步骤306，分别将目标数量的局部图像输入到局部图像识别模型中进行局部分类识别，得到各个局部分类识别结果向量，并将各个局部分类识别结果向量进行融合，得到目标分类识别结果向量。
其中，局部图像识别模型是指使用局部图像通过神经网络算法训练得到的模型，也可以是使用局部图像对全局图像识别模型进行进一步训练得到的模型。该局部图像识别模型用于对局部图像进行分类识别。局部分类识别结果向量是指局部图像对应的分类概率向量，即局部分类识别结果向量中的每个元素用于表征对应类别的概率。目标分类识别结果向量是指融合后的局部分类识别结果向量，目标分类识别结果用于表征使用局部图像进行分类识别时，得到图像的分类识别结果。
具体地，服务器根据待检测图像对应的参考图像的防御率计算得到目标数量，参考图像的防御率用于表征参考图像受到图像攻击时的防御度。然后按照目标数量对待检测图像随机进行局部图像提取，得到目标数量的局部图像。服务器将每个局部图像输入到局部图像识别模型中进行局部分类识别，得到各个局部分类识别结果向量。在一个实施例中，也可以将局部图像输入局部图像分类识别模型中进行局部分类识别，获取到在进行局部分类识别时卷积层输出的特征图作为局部分类识别结果向量。然后服务器将各个局部分类识别结果向量进行融合，得到目标分类识别结果向量。
在一个实施例中，服务器可以计算各个局部分类识别结果向量的平均向量，得到目标分类识别结果向量。即计算各个局部分类识别结果向量的向量和，然后计算向量和与目标数量的比值，得到平均向量，将该平均向量作为目标分类识别结果向量。
在一个实施例中，服务器也可以获取到各个局部分类识别结果向量对应的权重，对各个局部分类识别结果向量对应的权重进行加权平均，得到目标分类识别结果向量。其中，各个局部分类识别结果向量对应的权重可以是根据局部图像的重要性确定，局部图像的重要性可以是通过CAM(Class Activation Mapping，类激活映射)算法计算得到的。
步骤308，将目标分类识别结果向量和全局分类识别结果向量输入到图像攻击检测模型中进行一致性检测，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
其中，图像攻击检测模型用于对目标分类识别结果向量和全局分类识别结果的一致性进行检测，从而得到判别结果的模型，该判别结果可以是待检测图像为攻击图像或待检测图像为真实图像。图像攻击检测模型是二分类模型，是预先使用训练图像的目标分类识别结果向量和全局分类识别结果使用二分类算法进行训练得到的。其中，二分类算法可以是线性回归算法、支持向量机算法、神经网络算法、决策树算法、随机森林算法等等。
具体地，服务器在获取到目标分类识别结果向量和全局分类识别结果向量时，可以直接将目标分类识别结果向量和全局分类识别结果向量输入到图像攻击检测模型中进行一致性检测，图像攻击检测模型判断当目标分类识别结果和全局分类识别结果不一致时，输出待检测图像为攻击图像的检测结果。
在一个实施例中，服务器将目标局部识别结果向量和全局识别结果向量进行首尾拼接，得到拼接向量。其中，可以是目标局部识别结果向量在前，全局识别结果向量在后进行首尾拼接，得到拼接向量，也可以是全局识别结果向量在前，目标局部识别结果向量在后进行首尾拼接，得到拼接向量。然后将拼接向量输入到图像攻击检测模型，通过图像攻击检测模型检测目标局部识别结果向量和全局识别结果向量的一致性，判断当目标分类识别结果和全局分类识别结果一致时，输出待检测图像为真实图像的检测结果，当目标分类识别结果和全局分类识别结果不一致时，输出待检测图像为攻击图像的检测结果。
在上述实施例中，通过使用全局图像识别模型待检测图像进行全局分类识别，并通过局部图像识别模型对局部图像进行局部分类识别，最后通过图像攻击检测模型对目标局部识别结果向量和全局识别结果向量的一致性进行检测，从而得到图像检测结果，不仅提高了图像攻击检测的准确性，而且提高了图像攻击检测的效率。
在一个实施例中，本申请图像攻击检测方法中对待检测图像的检测结果可保存于区块链上，保证数据的安全、不可篡改。
在一个实施例中，如图4所示，图像攻击检测方法还包括：
步骤402，获取待检测图像的全局尺寸，基于待检测图像的全局尺寸获取参考图像，参考图像包含预设的参考攻击区域，参考攻击区域是根据预设攻击区域上限尺寸确定的。
其中，全局尺寸是指待检测图像的宽和高。参考攻击区域是指参考图像中的攻击区域，是预先设置的。预设攻击区域上限尺寸是指预先设置好攻击区域最大的宽和高。
具体地，服务器获取到待检测图像的全局尺寸，其中，不同的图像分类识别场景是对不同尺寸的图像进行分类识别的。不同尺寸的待检测图像对应的目标数量是不同的。当服务器获取到待检测图像的全局尺寸时，可以根据待检测图像的全局尺寸来获取到参考图像，该参 考图像的全局尺寸和待检测图像的全局尺寸一致。该参考图像中包含预设的参考攻击区域，参考攻击区域是根据预设攻击区域上限尺寸确定的。
步骤404，基于全局尺寸和预设攻击区域上限尺寸进行参数计算，得到目标局部图像的比重参数，目标局部图像中存在参考攻击区域的图像内容。
其中，目标局部图像是指存在参考攻击区域的图像内容的局部图像，局部图像是参考图像对应的局部图像。目标局部图像中可以包含部分的参考攻击区域，也可以包含所有的参考攻击区域。目标局部图像的比重参数是指参考图像对应的目标局部图像数量占所有局部图像数量的比值。目标局部图像的比重参数用于表征图像提取时提取到目标局部图像的可能性。
具体地，服务器可以根据全局尺寸确定参考图像要提取的局部图像的局部尺寸，然后使用全局尺寸、局部尺寸和预设攻击区域上限尺寸进行参数计算，得到目标局部图像的比重参数。
在一个实施例中，步骤404，基于全局尺寸和预设攻击区域上限尺寸进行参数计算，得到目标局部图像的比重参数，包括步骤：
基于全局尺寸确定局部尺寸，基于全局尺寸和局部尺寸计算参考图像可提取的局部图像总数量。基于全局尺寸、局部尺寸和预设攻击区域上限尺寸计算参考图像可提取的目标局部图像总数量。计算目标局部图像总数量与局部图像总数量的比例，得到目标局部图像的比重参数。
其中，参考图像可提取的局部图像总数量是指参考图像进行局部图像提取时能够提取的局部图像的最大数量。目标局部图像总数量是指参考图像进行局部图像提取能够提取到的目标局部图像的最大数量。
具体地，服务器可以按照预先设置好的全局图像和局部图像的比例关系来确定参考图像对应的全局尺寸的局部尺寸，该局部尺寸为参考图像提取的局部图像的尺寸。然后使用全局尺寸和局部尺寸计算参考图像可提取的局部图像总数量，并使用全局尺寸、局部尺寸和预设攻击区域上限尺寸计算参考图像可提取的目标局部图像总数量。最后计算目标局部图像总数量与局部图像总数量的比值，得到目标局部图像的比重参数。
在一个具体的实施例中，服务器可以使用如下所示的公式(1)计算得到参考图像可提取的局部图像总数量。
n all＝(w-k i+1)×(h-k j+1)  公式(1)
其中，n all表示局部图像总数量，w表示全局尺寸中的宽，h表示全局尺寸中的高。k i表示局部尺寸中的宽，k j表示局部尺寸中的高。服务器可以使用如下所示的公式(2)计算得到参考图像可提取的目标局部图像总数量。
n adv＝min(p i+k i-1,w-k i+1)
×min(p i+k j-1,h+k j+1)   公式(2)
其中，n adv表示目标局部图像总数量，p i表示预设攻击区域上限尺寸中的宽，p j表示预设攻击区域上限尺寸中的高。服务器可以使用如下所示的公式(3)计算得到目标局部图像的比重参数。
Figure PCTCN2022086735-appb-000001
其中，p la表示目标局部图像的比重参数。
步骤406，获取参考局部图像提取数量，基于参考局部图像提取数量将参考图像随机进行局部图像提取，得到参考局部图像提取数量的局部图像。
其中，参考局部图像提取数量是指待确定的局部图像提取数量。
具体地，服务器可以是从终端中获取到的参考局部图像提取数量，也可以是从数据库中获取到参考局部图像提取数量。按照参考局部图像提取数量将参考图像随机进行局部图像提取，得到参考局部图像提取数量的局部图像。服务器在进行局部图像提取时独立提取，即每次都以参考局部图像为基础进行局部图像提取。
步骤408，基于参考局部图像提取数量的局部图像进行局部分类识别，得到参考局部图像提取数量的局部分类识别结果，基于参考局部图像提取数量的局部分类识别结果进行统计计算，得到目标局部图像的提取下限数量。
具体地，服务器可以使用局部图像分类识别模型分别对参考局部图像提取数量的局部图像进行局部分类识别，得到参考局部图像提取数量的局部分类识别结果。统计参考局部图像提取数量的局部分类识别结果中数量最多的局部分类识别结果和数量第二多的局部分类识别结果，使用数量最多的局部分类识别结果和数量第二多的局部分类识别结果计算得到目标局部图像的提取下限数量。
在一个实施例中，基于参考局部图像提取数量的局部分类识别结果进行统计计算，得到目标局部图像的提取下限数量，包括：
统计参考局部图像提取数量的局部分类识别结果中第一类别的数量和第二类别的数量，第一类别是指参考局部图像提取数量的局部分类识别结果中数量最多类别，第二类别是指参考局部图像提取数量的局部分类识别结果中除第一类别以外数量最多类别；基于第一类别的数量和第二类别的数量计算目标局部图像的提取下限数量。
其中，不同的局部分类识别结果可能存在不同的类别，比如在人脸识别的，将A的人脸图像进行局部提取得到局部图像，对局部图像进行识别时，局部识别结果中就存在A的识别结果，也可能存在其他的识别结果，比如，识别为B，识别为C等等。
具体地，服务器根据参考局部图像提取数量的局部分类识别结果行进类别数量的统计，得到不同类别的局部分类识别结果数量，按照不同类别的局部分类识别结果数量将各个类别进行排序，将局部分类识别结果数量最多的类别作为第一类别，将参考局部图像提取数量的局部分类识别结果中除第一类别以外数量最多类别作为第二类别。其中，第一类别为参考图像对应的真实的分类识别结果。使用第一类别的数量和第二类别的数量计算目标局部图像的提取下限数量。该目标局部图像的提取下限数量即攻击图像要攻击成功时至少要改变的局部分类识别结果的数量。
在一个具体的实施例中，可以使用如下所示的公式(4)计算得到目标局部图像的提取下限数量。
Figure PCTCN2022086735-appb-000002
其中，n a表示目标局部图像的提取下限数量，n c1表示第一类别的数量，n c2表示第二类别的数量。
步骤410，基于目标局部图像的提取下限数量、参考局部图像提取数量和目标局部图像比重参数进行二项分布加和计算，得到参考图像的防御率；
具体地，服务器基于目标局部图像的提取下限数量、参考局部图像提取数量和目标局部图像比重参数采用二项分布求和公式进行计算，得到参考图像的防御率。
在一个具体地实施例中，可以使用如下所示的二项分布求和公式(5)计算得到参考图像的防御率。
Figure PCTCN2022086735-appb-000003
其中，p e表示参考图像的防御率，参考图像的防御率用于表征参考局部图像提取数量不超过目标局部图像的提取下限数量的概率。N是指参考局部图像提取数量。即p e是随着变量N单调递增的函数。当p e为1时，分类识别时在任何情况下都不会被攻击图像攻破，即能够检测出所有的攻击图像。
步骤412，当参考图像的防御率符合预设条件时，将参考局部图像提取数量作为目标数量。
其中，预设条件是指预先设置好的防御率条件，可以是防御率下限值，不同的图像分类识别场景中可以设置不同的防御率下限值，即可以根据需求设置。
具体地，服务器判断当参考图像的防御率符合预设条件时，将参考局部图像提取数量作为目标数量。当参考图像的防御率未符合预设条件时，获取到更新的参考局部图像提取数量，将更新的参考局部图像提取数量作为参考局部图像提取数量并返回步骤406迭代执行，直到当参考图像的防御率符合预设条件时，将参考局部图像提取数量作为目标数量。
在上述实施例中，通过计算得到的目标局部图像的提取下限数量和目标局部图像比重参数以及参考局部图像提取数量通过二项分布加和计算，得到参考图像的防御率，使得到的参考图像的防御率更加准确，进而当参考图像的防御率符合预设条件时，将参考局部图像提取数量作为目标数量，使得确定的目标数量更加的准确。
在一个实施例中，图像攻击检测方法，还包括步骤：
获取各个参考局部图像提取数量，基于各个参考局部图像提取数量计算得到对应的各个防御率，基于各个参考局部图像提取数量和对应的各个防御率建立参考局部图像提取数量和防御率的关联关系；获取待检测图像对应的预设防御率，从参考局部图像提取数量和防御率的关联关系中查找预设防御率对应的目标参考局部图像提取数量，将目标参考局部图像提取数量作为目标数量。
其中，参考局部图像提取数量和防御率的关联关系是指参考局部图像提取数量和防御率的一一对应关系，预设防御率是指预先设置好的待检测图像受到图像攻击时的防御度。
具体地，服务器获取各个参考局部图像提取数量，基于各个参考局部图像提取数量计算得到对应的各个防御率，其中，通过计算每个参考局部图像提取数量对应的目标局部图像的比重参数和目标局部图像的提取下限数量，使用每个参考局部图像提取数量、目标局部图像的比重参数和目标局部图像的提取下限数量进行二项分布加和计算，得到每个参考局部图像提取数量对应的防御率，然后将每个参考局部图像提取数量和对应的防御率关联保存。当需要对待检测图像进行图像攻击检测时，获取待检测图像对应的预设防御率，然后从保存的参考局部图像提取数量和防御率的关联关系中查找预设防御率对应的目标参考局部图像提取数量，将目标参考局部图像提取数量作为目标数量。其中，防御率越高，对应的参考局部图像提取数量就越多。
在上述实施例中，通过将各个参考局部图像提取数量和对应的防御率关联保存，当获取到待检测图像对应的预设防御率时，可以直接查找到对应的目标参考局部图像提取数量，将目标参考局部图像提取数量作为目标数量，能够提高得到目标数量的效率。
在一个实施例中，步骤412，将参考局部图像提取数量作为目标数量，包括步骤：
获取当前设备对应的资源信息，基于当前设备对应的资源信息确定当前局部图像提取数量；当参考局部图像提取数量超过当前局部图像提取数量时，将当前局部图像提取数量作为目标数量；当参考局部图像提取数量未超过当前局部图像提取数量时，将参考局部图像提取数量作为目标数量。
其中，当前设备是指进行图像攻击检测的设备。资源信息是指当前设备在进行图像攻击检测时能够使用的资源，该资源包括但不限于内存资源，存储资源、计算资源和时间资源。内存资源是指进行图像攻击检测当前设备能够占用的内存。存储资源是指进行图像攻击检测时当前设备能够使用的存储空间。计算资源是指进行图像攻击检测时当前设备能够使用的算力。时间资源是指进行图像攻击检测时当前设备所能消耗的时间。当前局部图像提取数量是指在当前设备的资源信息下能够提取的局部图像的数量。
具体地，服务器获取到自身对应的资源信息，该资源信息可以是预先分配好的。然后服务器根据对应的资源信息确定当前局部图像提取数量，服务器根据提取依次局部图像时所耗费的资源信息来根据当前设备对应的资源信息确定当前局部图像提取数量。服务器然后判断当参考局部图像提取数量超过当前局部图像提取数量时，将当前局部图像提取数量作为目标数量。当参考局部图像提取数量未超过当前局部图像提取数量时，将参考局部图像提取数量作为目标数量。比如，当前设备的时间资源为1秒，基于该时间资源确定的目标数量不能使图像攻击检测所耗费的时间超过1秒。
在上述实施例中，通过获取当前设备的资源信息，基于当前设备的资源信息确定当前局部图像提取数量，然后与参考局部图像提取数量进行比较，最终确定目标数量，使得到的目标数量时服务器即当前设备能够处理的数量，避免图像攻击检测所耗费的资源信息超出当前设备的资源信息。
在一个实施例中，如图5所示，提供了一种图像攻击检测模型训练方法，以该方法应用于图1中的服务器为例进行说明，可以理解的是，该方法也可以应用在终端中，还可以应用于包括终端和服务器的系统，并通过终端和服务器的交互实现。在本实施例中，包括以下步骤：
步骤502，获取训练数据，训练数据包括训练图像和图像攻击类别标签。
其中，训练图像是指训练图像攻击检测模型所使用的图像。图像攻击类别标签是指训练 图像对应的攻击类别标签。攻击类别标签包括训练图像为真实图像的标签和训练图像为攻击图像的标签。
具体地，服务器可以从数据库中获取到训练数据，也可以从第三方数据库中获取到训练数据，还可以从互联网中采集到训练数据。
步骤504，将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量。
其中，全局图像分类识别模型使预先训练好的对整体图像进行分类识别的神经网络模型。训练全局分类识别结果向量是指训练图像整体对应的全局分类识别结果向量。
具体地，服务器将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量。
步骤506，基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，训练目标数量是训练图像对应的训练参考图像的防御率计算得到的，训练参考图像的防御率用于表征训练参考图像受到图像攻击时的防御度。
其中，训练目标数量是指训练图像对应的要提取的局部图像的数量。训练参考图像是指训练时的参考图像。
具体地，服务器获取到训练目标数量，按照训练目标数量对训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像。比如，可以按照训练目标数随机地从图像中裁剪出固定大小的正方形区域，得到训练局部图像。
步骤508，分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量。
其中，局部图像分类识别模型是指预先训练好的对局部图像进行分类识别的神经网络模型。训练局部分类识别结果向量是指训练局部图像对应的局部分类识别结果的向量。目标训练分类识别结果向量是将各个训练局部分类识别结果向量进行融合得到的向量。
具体地，服务器分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，然后计算各个训练局部分类识别结果向量的平均向量，将该平均向量作为目标训练分类识别结果向量。
步骤510，将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果。
其中，初始图像攻击检测模型是指模型参数初始化的图像攻击检测模型。初始一致性检测结果是指初始的一致性检测结果，一致性检测结果是指判断目标训练分类识别结果向量和训练全局分类识别结果是否一致得到的图像是否为攻击图像的结果。
具体地，服务器可以将目标训练分类识别结果向量和训练全局分类识别结果向量进行拼接，得到拼接后的向量，将拼接后的向量输入到初始图像攻击检测模型中，初始图像攻击检测模型对目标训练分类识别结果向量和训练全局分类识别结果向量的一致性进行检测，输出初始一致性检测结果。
步骤512，基于初始一致性检测结果和图像攻击类别标签更新初始图像攻击检测模型，并返回将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤执行，直到训练完成时，得到目标图像攻击检测模型。
具体地，服务器使用二分类损失函数计算初始一致性检测结果和图像攻击类别标签的损失值，其中，二分类损失函数可以是交叉熵损失函数。判断该损失值是否达到预先设置好的损失阈值，当未达到预先设置好的损失阈值时，基于该损失值更新初始图像攻击检测模型中的初始化的参数，得到更新的图像攻击检测模型，将更新的图像攻击检测模型作为初始图像攻击检测模型，并返回将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤迭代执行，直到达到预先设置好的损失阈值时，将达到预先设置好的损失阈值的初始图像攻击检测模型作为目标图像攻击检测模型。
上述图像攻击检测模型训练方法，通过将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量；将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；基于初始一致性检测结果和图像攻击类别标签更新初始图像攻击检测模型并进行循环迭代，得到目标图像攻击检测模型，即通过使用目标训练分类识别结果向量和训练全局分类识别结果来训练得到的目标图像攻击检测模型，能够使得到的目标图像攻击检测模型提高一致性检测的准确性，从而提高了图像攻击检测的准确性。
在一个实施例中，如图6所示，图像攻击检测模型训练方法，还包括：
步骤602，获取训练图像的训练全局尺寸，基于训练图像的训练全局尺寸获取训练参考图像，训练参考图像包含预设的训练参考攻击区域，训练参考攻击区域是根据预设训练攻击区域上限尺寸确定的。
其中，训练全局尺寸是指训练图像的尺寸，即宽和高。训练参考攻击区域时训练图像中的攻击区域是预先设置的。预设训练攻击区域上限尺寸是指预先设置好的攻击区域最大的尺寸即宽和高。
具体地，服务器获取到训练图像的训练全局尺寸，基于训练图像的训练全局尺寸获取训练参考图像。训练参考图像的尺寸可以和训练图像的训练全局尺寸一致的。在一个实施例中，训练图像的训练全局尺寸与待检测图像的全局尺寸一致。
步骤604，基于训练全局尺寸和预设训练攻击区域上限尺寸进行参数计算，得到训练目标局部图像的比重参数，训练目标局部图像中存在训练参考攻击区域的图像内容。
其中，训练目标局部图像是指训练时存在训练参考攻击区域的局部图像，训练目标局部图像中可以包含部分的训练参考攻击区域，也可以包含所有的训练参考攻击区域。训练目标局部图像的比重参数是指训练参考图像对应的训练目标局部图像占所有训练局部图像数量的比重，用于表征训练图像提取时提取到训练目标局部图像的可能性。
具体地，服务器可以根据训练全局尺寸来确定训练参考图像要提取的训练局部图像的训练局部尺寸，然后使用训练全局尺寸、训练局部尺寸和预设训练攻击区域上限尺寸进行参数计算，得到训练目标局部图像的比重参数。
在一个实施例中，步骤604，包括步骤：基于训练全局尺寸确定训练局部尺寸，基于训练全局尺寸和训练局部尺寸计算训练参考图像可提取的训练局部图像总数量。基于训练全局尺寸、训练局部尺寸和预设训练攻击区域上限尺寸计算训练参考图像可提取的训练目标局部 图像总数量。计算训练目标局部图像总数量与训练局部图像总数量的比例，得到训练目标局部图像的比重参数。
其中，训练参考图像可提取的训练局部图像总数量是指训练参考图像进行局部图像提取时能够提取的局部图像的最大数量。训练目标局部图像总数量是指训练参考图像能够提取到的目标局部图像的总数量。
具体地，服务器可以按照预先设置的整体图像和局部图像的尺寸大小关系来根据训练全局尺寸确定训练局部尺寸。然后使用训练全局尺寸和训练局部尺寸计算训练参考图像可提取的训练局部图像总数量。比如，可以使用公式(1)计算得到训练参考图像可提取的训练局部图像总数量。然后使用训练全局尺寸、训练局部尺寸和预设训练攻击区域上限尺寸计算训练参考图像可提取的训练目标局部图像总数量，比如，可以使用公式(2)计算得到。训练参考图像可提取的训练目标局部图像总数量。最后计算训练目标局部图像总数量与训练局部图像总数量的比例，得到训练目标局部图像的比重参数，比如，可以使用公式(3)计算得到训练目标局部图像的比重参数。
步骤606，获取训练参考局部图像提取数量，基于训练参考局部图像提取数量将训练参考图像随机进行局部图像提取，得到训练参考局部图像提取数量的局部图像。
其中，训练参考局部图像提取数量是指训练时待确定的局部图像提取数量。
具体地，服务器获取到训练参考局部图像提取数量，按照训练参考局部图像提取数量对训练参考图像随机进行局部图像提取，得到训练参考局部图像提取数量的局部图像。
步骤608，基于训练参考局部图像提取数量的局部图像进行局部分类识别，得到训练参考局部图像提取数量的局部分类识别结果，基于训练参考局部图像提取数量的局部分类识别结果进行统计计算，得到训练目标局部图像的提取下限数量。
具体地，服务器可以将训练参考局部图像提取数量的局部图像输入到局部图像分类识别模型中进行局部分类识别，得到输出的训练参考局部图像提取数量的局部分类识别结果。然后统计训练参考局部图像提取数量的局部分类识别结果中最多数量的局部分类识别结果和数量次多的局部分类识别结果，使用最多数量的局部分类识别结果和数量次多的局部分类识别结果得到训练目标局部图像的提取下限数量。
在一个实施例中，步骤608，包括步骤：统计训练参考局部图像提取数量的局部分类识别结果中第一训练类别的数量和第二训练类别的数量，第一训练类别是指训练参考局部图像提取数量的局部分类识别结果中数量最多类别，第二训练类别是指训练参考局部图像提取数量的局部分类识别结果中除第一训练类别以外数量最多类别；基于第一训练类别的数量和第二训练类别的数量计算训练目标局部图像的提取下限数量。
具体地，服务器统计训练参考局部图像提取数量的局部分类识别结果中数量最多类别对应的第一训练类别的数量，并统计训练参考局部图像提取数量的局部分类识别结果中除第一训练类别以外数量最多类别对应的第二训练类别的数量。然后使用第一训练类别的数量和第二训练类别的数量计算训练目标局部图像的提取下限数量，其中，可以使用公式(4)计算得到训练目标局部图像的提取下限数量。
步骤610，基于训练目标局部图像的提取下限数量、训练参考局部图像提取数量和训练目标局部图像比重参数进行二项分布加和计算，得到训练参考图像对应的防御率。
具体地，服务器使用训练目标局部图像的提取下限数量、训练参考局部图像提取数量和训练目标局部图像比重参数使用二项分布求和公式进行计算，得到训练参考图像对应的防御 率。即可以使用公式(5)计算得到训练参考图像对应的防御率。
步骤612，当训练参考图像对应的防御率符合预设条件时，将训练参考局部图像提取数量作为训练目标数量。
具体地，服务器判断当训练参考图像的防御率符合预设条件时，将训练参考局部图像提取数量作为训练目标数量。当训练参考图像的防御率未符合预设条件时，获取到更新的训练参考局部图像提取数量，将更新的训练参考局部图像提取数量作为训练参考局部图像提取数量并返回步骤606迭代执行，直到当训练参考图像的防御率符合预设条件时，将训练参考局部图像提取数量作为训练目标数量。
在上述实施例中，通过计算得到的训练目标局部图像的提取下限数量、训练参考局部图像提取数量和训练目标局部图像比重参数进行二项分布加和计算，得到训练参考图像对应的防御率，然后根据训练参考图像对应的防御率来确定训练目标数量，能够使得到的训练目标数量更加的准确。
在一个实施例中，如图7所示，步骤506，即基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，包括：
步骤702，获取训练图像中各个区域的重要程度，基于各个区域的重要程度按照预设重要度阈值将训练图像进行二值划分，得到目标区域和非目标区域。
其中，区域的重要程度用于表征该区域在进行分类时的重要程度。预设重要度阈值是指预先设置好的对图像进行二值划分时的重要度阈值。目标区域是指重要程度超过预设重要度阈值的区域。非目标区域是指重要程度未超过预设重要度阈值的区域。
具体地，服务器获取到训练图像中区域的重要程度，然后获取到预设重要度阈值，按照预设重要度阈值将各个区域的重要程度进行二值划分，得到目标区域和非目标区域。其中，可以使用CAM算法来判断训练图像中各个区域对于分类的重要程度，生成CAM热力图。然后设置阈值，将热力图中超过阈值的部分定义为目标区域，生成二值化图。该CAM算法是指将分类识别模型中最后一个全连接层的权值作为不同区域对于分类结果的重要程度，通过权值确定在全局平均池化前，每个channel(通道)特征图的重要程度，并把channel特征图按照权值相加，并缩放到原图大小，从而确定原图中每个区域的重要程度
在一个具体的实施例中，如图8所示，为得到的目标区域和非目标区域的示意图中，其中，对图8中的图a进行分类识别，得到分类识别模型中最后一个全连接层的权值，通过权值确定每个channel(通道)特征图的重要程度，把channel特征图按照权值相加，并缩放到原图大小，从而确定原图中每个区域的重要程度，然后获取到重要度阈值，按照重要度阈值将图8中的a图进行二值划分，得到图8中的b图，其中，目标区域为黑色部分，非目标区域为白色部分。
步骤704，随机从目标区域中选取第一部分局部图像，并随机从非目标区域中选取第二部分局部图像，其中，第一部分局部图像的面积大于第二部分局部图像的面积；
步骤706，基于第一部分局部图像和第二部分局部图像得到训练局部图像。
具体地，服务器随机从目标区域中选取第一部分局部图像，并随机从非目标区域中选取第二部分局部图像，其中，选取的第一部分局部图像的面积大于选取的第二部分局部图像的面积，然后根据提取的第一部分局部图像和第二部分局部图像进行融合得到训练局部图像。在一个实施例中，服务器从二值化的训练图像中选取局部图像，该局部图像的面积与目标区域的重叠面积超过50％。
在上述实施例中，通过随机提取的局部图像中保证较多目标区域的图像内容，能够使局部图像的分类识别更加准确。
在一个实施例中，如图9所示，全局图像分类识别模型的训练包括以下步骤：
步骤902，获取全局训练数据，全局训练数据包括全局训练图像和对应的全局类别标签。
其中，全局训练数据是指训练全局图像分类识别模型时使用的训练数据。全局训练图像是指训练全局图像分类识别模型时使用的图像，是完整的图像。全局类别标签是指全局训练图像对应的类别标签。
具体地，服务器可以直接从数据库中获取到全局训练数据，也可以从第三方数据库中获取到全局训练数据，也可以是从互联网采集到全局训练数据。
步骤904，将全局训练图像输入初始全局图像分类识别模型中进行全局图像分类识别，得到初始全局分类识别结果。
其中，初始全局图像分类识别模型是指模型参数初始化的全局图像分类识别模型。初始全局分类识别结果是指使用初始化参数得到的全局分类识别结果。
具体地，服务求将全局训练图像输入初始全局图像分类识别模型中进行全局图像分类识别，得到输出的初始全局分类识别结果
步骤906，基于初始全局分类识别结果和全局类别标签进行损失计算，得到全局损失信息。
其中，全局损失信息是指全局训练图像对应的模型损失，用于表征训练得到的分类识别结果与实际的分类识别结果之间的误差。
具体地，服务器使用分类损失函数计算初始全局分类识别结果与全局类别标签之间的损失，得到全局损失信息，其中，分类损失函数可以是交叉熵损失函数，也可以是对数损失函数，平方损失函数和指数损失函数等等。
步骤908，基于全局损失信息反向更新初始全局图像分类识别模型中的参数，得到更新后的全局图像分类识别模型。
具体地，服务器使用梯度下降算法来反向更新初始全局图像分类识别模型中的参数，即使用全局损失信息计算梯度，使用梯度反向更新初始全局图像分类识别模型中的参数，当参数更新完成时，得到更新后的全局图像分类识别模型。
在一个实施例中，步骤908，包括步骤：获取当前学习率，基于当前学习率和全局损失信息反向更新初始全局图像分类识别模型的参数，得到更新后的全局图像分类识别模型。其中，当前学习率可以是当前使用的学习率，可以是设置好的。学习率时训练过程中的超参数。
在一个实施例中，服务器还可以获取历史学习率，基于历史学习率使用预设余弦函数进行调整，得到当前学习率。其中，可以使用预先设置的余弦函数来对学习率进行调整。如图10所示，学习率参照余弦函数的规律来变化，即当前学习率每次波动到最低点后，直接跃升到最高点，同时，余弦周期也是不断变长的。
在一个实施例中，也可以使用warm up(适应性训练)衰减策略来调整学习率，即开始训练时以很小的学习率进行训练，随着训练的进行学习率慢慢变大，到了一定程度，以设置的初始学习率进行训练，学习率再慢慢变小。
步骤910，将更新后的全局图像分类识别模型作为初始全局图像分类识别模型，并返回将全局训练图像输入初始全局图像分类识别模型中进行全局图像分类识别，得到初始全局分类识别结果的步骤执行，直到达到全局训练完成条件时，将达到全局训练完成条件时的初始 全局图像分类识别模型作为全局图像分类识别模型。
具体地，服务器将更新后的全局图像分类识别模型作为初始全局图像分类识别模型，并返回将全局训练图像输入初始全局图像分类识别模型中进行全局图像分类识别，得到初始全局分类识别结果的步骤迭代执行直到达到全局训练完成条件时，将达到全局训练完成条件时的初始全局图像分类识别模型作为全局图像分类识别模型，其中，全局训练完成条件可以是全局损失信息小于预先设置好的损失阈值，也可以是达到预先设置好的迭代次数等等。
在上述实施例中，通过使用全局训练数据对初始全局分类识别模型进行训练，从而得到全局图像分类识别模型，方便后续的使用。
在一个实施例中，如图11所示，局部图像分类识别模型的训练包括以下步骤：
步骤1102，将全局图像分类识别模型作为初始局部图像分类识别模型。
步骤1104，获取局部训练数据，区域图像训练数据中包括局部训练图像和对应的局部图像类别标签。
其中，局部训练图像是完整图像的一部分图像。局部图像类别标签是指局部训练图像对应的类别标签。
具体地，服务器在训练局部图像分类识别模型时，可以在已经训练好的全局图像分类识别模型的基础上进行微调训练，即服务器将全局图像分类识别模型作为初始局部图像分类识别模型。然后从数据库中获取到局部训练数据。也可以获取到全局训练数据，从全局训练数据的全局训练图像中提取到局部训练图像，将全局训练图像对应的全局图像类别标签作为局部训练图像标签。也可以从第三方数据库中获取到局部训练数据，还可以从互联网中采集到局部训练数据。
步骤1106，将局部训练图像输入初始局部图像分类识别模型中进行局部分类识别，得到初始局部分类识别结果。
步骤1108，基于初始局部分类识别结果和局部图像类别标签进行损失计算，得到局部损失信息，基于局部损失信息反向更新初始局部图像分类识别模型，得到更新后的局部图像分类识别模型。
具体地，服务器将局部训练图像输入初始局部图像分类识别模型中进行局部分类识别，得到初始局部分类识别结果，然后通过梯度下降算法反向更新初始局部图像分类识别模型，即使用分类损失函数计算初始局部分类识别结果和局部图像类别标签之间的局部损失信息，该局部损失信息用于表征初始局部分类识别结果和局部图像类别标签之间的误差，然后使用局部损失信息反向更新初始局部图像分类识别模型中的参数，当参数更新完成时，得到更新后的局部图像分类识别模型。
步骤1110，将更新后的局部图像分类识别模型作为初始局部图像分类识别模型，并返回将局部训练图像输入初始局部图像分类识别模型中进行局部分类识别，得到初始局部分类识别结果的步骤执行，直到达到局部训练完成条件时，将达到局部训练完成条件时初始局部图像分类识别模型作为局部图像分类识别模型。
具体地，服务器进行迭代训练，即将更新后的局部图像分类识别模型作为初始局部图像分类识别模型，并返回将局部训练图像输入初始局部图像分类识别模型中进行局部分类识别，得到初始局部分类识别结果的步骤迭代执行，直到达到局部训练完成条件，局部训练完成条件包括训练得到的局部损失信息达到预先设置好的局部损失阈值、训练次数到达预先设置好的迭代次数上限和模型参数不再发生变化。此时，服务器将达到局部训练完成条件时初始局 部图像分类识别模型作为局部图像分类识别模型。
在上述实施例中，通过将全局图像分类识别模型作为初始局部图像分类识别模型，然后使用局部训练数据对初始局部图像分类识别模型进行训练，从而得到局部图像分类识别模型，能够提高得到局部图像分类识别模型的效率。
在一个具体实施例中，如图12所示，提供一种图像攻击检测方法，具体包括以下步骤：
步骤1202，获取训练数据，训练数据包括训练图像和图像攻击类别标签。
步骤1204，将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像。
步骤1206，分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，计算各个训练局部分类识别结果向量的平均向量，得到目标训练分类识别结果向量。
步骤1208，将目标训练分类识别结果向量和训练全局分类识别结果向量进行拼接后输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；
步骤1210，基于初始一致性检测结果和图像攻击类别标签更新初始图像攻击检测模型，并返回将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤执行，直到训练完成时，得到目标图像攻击检测模型。
步骤1212，获取待检测图像，将待检测图像输入全局图像分类识别模型中进行全局分类识别，得到全局分类识别结果向量。基于待检测图像随机进行局部图像提取，得到目标数量的局部图像。
步骤1214，分别将目标数量的局部图像输入到局部图像识别模型中进行局部分类识别，得到各个局部分类识别结果向量，并计算各个局部分类识别结果向量的平均向量，得到目标分类识别结果向量，得到目标分类识别结果向量。
步骤1216，将目标局部识别结果向量和全局识别结果向量进行拼接，得到拼接向量。将拼接向量输入到目标图像攻击检测模型，目标图像攻击检测模型检测当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
本申请还提供一种应用场景，该应用场景应用上述的图像攻击检测方法。具体地，
在人脸识别系统中，通过人脸图像识别得到的人的身份从而进行后续的处理，比如，进行人脸解锁。目前，如图13所示，为攻击图像对人脸识别系统进行攻击的示意图。其中，攻击方通过对真实图像进行对抗生成攻击区域，将攻击区域通过物理方式生成攻击图像。人脸识别系统对真实图像识别的结果为A，然后人脸识别系统再未进行图像攻击检测时，攻击方通过生成的攻击图像使用人脸识别结果为错误的结果，即为B。
此时，应用本申请的图像攻击检测方法。如图14所示，为图像攻击检测的架构示意图。当人脸识别系统要识别人脸图像时，先将人脸图像作为待检测的人脸图像，将待检测的人脸图像输入到全局图像分类识别模型中进行识别，得到全局类别向量，然后将待检测的人脸图像进行目标数量的局部图像提取，将提取到的目标数量的局部图像输入到局部图像分类识别模型中进行识别，得到局部类别向量，将局部类别向量进行平均计算，得到平均向量，将平均向量与全局类别向量进行拼接，并输入到图像攻击检测模型中进行检测，从而得到待检测的人脸图像时攻击的人脸图像或者时真实的人脸图像的检测结果。即本申请中能够有效抵御 黑产对安全系统发起的物理攻击，检测出相应的攻击并在将其拒绝。本申请中的图像攻击检测方法也可以是应用到图像文字识别场景中，还可以应用到行人检测场景中，也可以应用到物体识别场景中。
在一个具体的实施例中，测试本申请的图像攻击检测方法与现有技术对适应性攻击的防御效果，具体来说：使用CIFAR10(一个用于识别普适物体的小型数据集)和Imagenette(一种图像数据集)数据集上进行测试。得到的测试对比结果如下表1所示。
表1测试对比
数据集 本申请(％) 现有技术1(％) 现有技术2(％) 现有技术3(％)
CIFAR10 85.4 0.0 0.0 45.4
ImageNette 92.3 0.0 0.0 62.5
其中，明显可以肯出，本申请中在CIFAR10数据集和Imagenette数据集上的防御率远高于现有技术中的防御率，其中，现有技术1和现有技术2由于机制原因，对适应性攻击完全没有抵抗力。即本申请中能够明显提升对适应性攻击的防御效果。
应该理解的是，虽然图2-12的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图2-12中的至少一部分步骤可以包括多个步骤或者多个阶段，这些步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤中的步骤或者阶段的至少一部分轮流或者交替地执行。
在一个实施例中，如图15所示，提供了一种图像攻击检测装置1500，该装置可以采用软件模块或硬件模块，或者是二者的结合成为计算机设备的一部分，该装置具体包括：全局分类模块1502、局部提取模块1504、局部分类模块1506和检测模块1508，其中：
全局分类模块1502，用于获取待检测图像，基于待检测图像进行全局分类识别，得到全局分类识别结果；
局部提取模块1504，用于基于待检测图像随机进行局部图像提取，得到目标数量的局部图像，目标数量是根据待检测图像对应的参考图像的防御率计算得到的，参考图像的防御率用于表征参考图像受到图像攻击时的防御度；
局部分类模块1506，用于基于目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将各个局部分类识别结果进行融合，得到目标分类识别结果；
检测模块1508，用于基于目标分类识别结果和全局识别结果检测识别结果的一致性，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
在一个实施例中，图像攻击检测装置1500，还包括：
全局模型分类模块，用于将待检测图像输入全局图像分类识别模型中进行全局分类识别，得到全局分类识别结果向量；
随机提取模块，用于基于待检测图像随机进行局部图像提取，得到目标数量的局部图像；
局部模型分类模块，用于分别将目标数量的局部图像输入到局部图像识别模型中进行局部分类识别，得到各个局部分类识别结果向量，并将各个局部分类识别结果向量进行融合，得到目标分类识别结果向量；
检测模型检测模块，用于将目标分类识别结果向量和全局分类识别结果向量输入到图像 攻击检测模型中进行一致性检测，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
在一个实施例中，检测模型检测模块还用于将目标局部识别结果向量和全局识别结果向量进行拼接，得到拼接向量；将拼接向量输入到图像攻击检测模型，通过图像攻击检测模型识别目标局部识别结果向量和全局识别结果向量的一致性，当目标分类识别结果和全局分类识别结果一致时，判别待检测图像为真实图像，当目标分类识别结果和全局分类识别结果不一致时，判别待检测图像为攻击图像。
在一个实施例中，局部模型分类模块还用于计算各个局部分类识别结果向量的平均向量，得到目标分类识别结果向量。
在一个实施例中，图像攻击检测装置1500，还包括：
尺寸获取模块，用于获取待检测图像的全局尺寸，基于待检测图像的全局尺寸获取参考图像，参考图像包含预设的参考攻击区域，参考攻击区域是根据预设攻击区域上限尺寸确定的；
参数计算模块，用于基于全局尺寸和预设攻击区域上限尺寸进行参数计算，得到目标局部图像的比重参数，目标局部图像中存在参考攻击区域的图像内容；
参考局部提取模块，用于获取参考局部图像提取数量，基于参考局部图像提取数量将参考图像随机进行局部图像提取，得到参考局部图像提取数量的局部图像；
下限数量计算模块，用于基于参考局部图像提取数量的局部图像进行局部分类识别，得到参考局部图像提取数量的局部分类识别结果，基于参考局部图像提取数量的局部分类识别结果进行统计计算，得到目标局部图像的提取下限数量；
防御率计算模块，用于基于目标局部图像的提取下限数量、参考局部图像提取数量和目标局部图像比重参数进行二项分布加和计算，得到参考图像的防御率；
目标数量得到模块，用于当参考图像的防御率符合预设条件时，将参考局部图像提取数量作为目标数量。
在一个实施例中，参数计算模块还用于基于全局尺寸确定局部尺寸，基于全局尺寸和局部尺寸计算参考图像可提取的局部图像总数量；基于全局尺寸、局部尺寸和预设攻击区域上限尺寸计算参考图像可提取的目标局部图像总数量；计算目标局部图像总数量与局部图像总数量的比例，得到目标局部图像的比重参数。
在一个实施例中，下限数量计算模块还用于统计参考局部图像提取数量的局部分类识别结果中第一类别的数量和第二类别的数量，第一类别是指参考局部图像提取数量的局部分类识别结果中数量最多类别，第二类别是指参考局部图像提取数量的局部分类识别结果中除第一类别以外数量最多类别；基于第一类别的数量和第二类别的数量计算目标局部图像的提取下限数量。
在一个实施例中，图像攻击检测装置1500，还包括：
关系建立模块，用于获取各个参考局部图像提取数量，基于各个参考局部图像提取数量计算得到对应的各个防御率，基于各个参考局部图像提取数量和对应的各个防御率建立参考局部图像提取数量和防御率的关联关系；
查找模块，用于获取待检测图像对应的预设防御率，从参考局部图像提取数量和防御率的关联关系中查找预设防御率对应的目标参考局部图像提取数量，将目标参考局部图像提取数量作为目标数量。
在一个实施例中，目标数量得到模块还用于获取当前设备对应的资源信息，基于当前设备对应的资源信息确定当前局部图像提取数量；当参考局部图像提取数量超过当前局部图像提取数量时，将当前局部图像提取数量作为目标数量；当参考局部图像提取数量未超过当前局部图像提取数量时，将参考局部图像提取数量作为目标数量。
在一个实施例中，如图16所示，提供了一种图像攻击检测模型训练装置1600，该装置可以采用软件模块或硬件模块，或者是二者的结合成为计算机设备的一部分，该装置具体包括：数据获取模块1602、训练全局分类模块1604、训练局部提取模块1606、训练局部分类模块1608、训练检测模块1610和迭代模块1612，其中：
数据获取模块1602，用于获取训练数据，训练数据包括训练图像和图像攻击类别标签；
训练全局分类模块1604，用于将训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；
训练局部提取模块1606，用于基于训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，训练目标数量是训练图像对应的训练参考图像的防御率计算得到的，训练参考图像的防御率用于表征训练参考图像受到图像攻击时的防御度；
训练局部分类模块1608，用于分别将目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量；
训练检测模块1610，用于将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；
迭代模块1612，用于基于初始一致性检测结果和图像攻击类别标签更新初始图像攻击检测模型，并返回将目标训练分类识别结果向量和训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤执行，直到训练完成时，得到目标图像攻击检测模型。
在一个实施例中，图像攻击检测模型训练装置1600，还包括：
训练尺寸获取模块，用于获取训练图像的训练全局尺寸，基于训练图像的训练全局尺寸获取训练参考图像，训练参考图像包含预设的训练参考攻击区域，训练参考攻击区域是根据预设训练攻击区域上限尺寸确定的；
训练参数计算模块，用于基于训练全局尺寸和预设训练攻击区域上限尺寸进行参数计算，得到训练目标局部图像的比重参数，训练目标局部图像中存在训练参考攻击区域的图像内容；
训练参考局部提取模块，用于获取训练参考局部图像提取数量，基于训练参考局部图像提取数量将训练参考图像随机进行局部图像提取，得到训练参考局部图像提取数量的局部图像；
训练下限数量计算模块，用于基于训练参考局部图像提取数量的局部图像进行局部分类识别，得到训练参考局部图像提取数量的局部分类识别结果，基于训练参考局部图像提取数量的局部分类识别结果进行统计计算，得到训练目标局部图像的提取下限数量；
训练防御率计算模块，用于基于训练目标局部图像的提取下限数量、训练参考局部图像提取数量和训练目标局部图像比重参数进行二项分布加和计算，得到训练参考图像对应的防御率；
训练目标数量得到模块，用于当训练参考图像对应的防御率符合预设条件时，将训练参考局部图像提取数量作为训练目标数量。
在一个实施例中，训练参数计算模块还用于基于训练全局尺寸确定训练局部尺寸，基于训练全局尺寸和训练局部尺寸计算训练参考图像可提取的训练局部图像总数量；基于训练全局尺寸、训练局部尺寸和预设训练攻击区域上限尺寸计算训练参考图像可提取的训练目标局部图像总数量；计算训练目标局部图像总数量与训练局部图像总数量的比例，得到训练目标局部图像的比重参数。
在一个实施例中，训练下限数量计算模块还用于统计训练参考局部图像提取数量的局部分类识别结果中第一训练类别的数量和第二训练类别的数量，第一训练类别是指训练参考局部图像提取数量的局部分类识别结果中数量最多类别，第二训练类别是指训练参考局部图像提取数量的局部分类识别结果中除第一训练类别以外数量最多类别；基于第一训练类别的数量和第二训练类别的数量计算训练目标局部图像的提取下限数量。
在一个实施例中，训练参考局部提取模块还用于获取训练图像中各个区域的重要程度，基于各个区域的重要程度按照预设重要度阈值将训练图像进行二值划分，得到目标区域和非目标区域；随机从目标区域中选取第一部分局部图像，并随机从非目标区域中选取第二部分局部图像，其中，第一部分局部图像的面积大于第二部分局部图像的面积；基于第一部分局部图像和第二部分局部图像得到训练局部图像。
在一个实施例中，图像攻击检测模型训练装置1600，还包括：
全局识别模型训练模块，用于获取全局训练数据，全局训练数据包括全局训练图像和对应的全局类别标签；将全局训练图像输入初始全局图像分类识别模型中进行全局图像分类识别，得到初始全局分类识别结果；基于初始全局分类识别结果和全局类别标签进行损失计算，得到全局损失信息；基于全局损失信息反向更新初始全局图像分类识别模型中的参数，得到更新后的全局图像分类识别模型；将更新后的全局图像分类识别模型作为初始全局图像分类识别模型，并返回将全局训练图像输入初始全局图像分类识别模型中进行全局图像分类识别，得到初始全局分类识别结果的步骤执行，直到达到全局训练完成条件时，将达到全局训练完成条件时的初始全局图像分类识别模型作为全局图像分类识别模型。
在一个实施例中，全局识别模型训练模块，还用于获取当前学习率；基于当前学习率和全局损失信息反向更新初始全局图像分类识别模型的参数，得到更新后的全局图像分类识别模型。
在一个实施例中，全局识别模型训练模块，还用于获取历史学习率，基于历史学习率使用预设余弦函数进行调整，得到当前学习率。
在一个实施例中，图像攻击检测模型训练装置1600，还包括：
局部识别模型训练模块，用于将全局图像分类识别模型作为初始局部图像分类识别模型；获取局部训练数据，区域图像训练数据中包括局部训练图像和对应的局部图像类别标签；将局部训练图像输入初始局部图像分类识别模型中进行局部分类识别，得到初始局部分类识别结果；基于初始局部分类识别结果和局部图像类别标签进行损失计算，得到局部损失信息，基于局部损失信息反向更新初始局部图像分类识别模型，得到更新后的局部图像分类识别模型；将更新后的局部图像分类识别模型作为初始局部图像分类识别模型，并返回将局部训练图像输入初始局部图像分类识别模型中进行局部分类识别，得到初始局部分类识别结果的步骤执行，直到达到局部训练完成条件时，将达到局部训练完成条件时初始局部图像分类识别模型作为局部图像分类识别模型。
关于图像攻击检测装置和图像攻击检测模型训练装置的具体限定可以参见上文中对于图 像攻击检测方法和图像攻击检测模型训练方法的限定，在此不再赘述。上述图像攻击检测装置和图像攻击检测模型训练装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在一个实施例中，提供了一种计算机设备，该计算机设备可以是服务器，其内部结构图可以如图17所示。该计算机设备包括通过系统总线连接的处理器、存储器和网络接口。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作系统、计算机可读指令和数据库。该内存储器为非易失性存储介质中的操作系统和计算机可读指令的运行提供环境。该计算机设备的数据库用于待检测图像或者存储训练数据。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机可读指令被处理器执行时以实现一种图像攻击检测方法和图像攻击检测模型训练方法。
在一个实施例中，提供了一种计算机设备，该计算机设备可以是终端，其内部结构图可以如图18所示。该计算机设备包括通过系统总线连接的处理器、存储器、通信接口、显示屏和输入装置。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作系统和计算机可读指令。该内存储器为非易失性存储介质中的操作系统和计算机可读指令的运行提供环境。该计算机设备的通信接口用于与外部的终端进行有线或无线方式的通信，无线方式可通过WIFI、运营商网络、NFC(近场通信)或其他技术实现。该计算机可读指令被处理器执行时以实现一种图像攻击检测方法和图像攻击检测模型训练方法。该计算机设备的显示屏可以是液晶显示屏或者电子墨水显示屏，该计算机设备的输入装置可以是显示屏上覆盖的触摸层，也可以是计算机设备外壳上设置的按键、轨迹球或触控板，还可以是外接的键盘、触控板或鼠标等。
本领域技术人员可以理解，图17和图18中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
在一个实施例中，还提供了一种计算机设备，包括存储器和处理器，存储器中存储有计算机可读指令，该处理器执行计算机可读指令时实现上述各方法实施例中的步骤。
在一个实施例中，提供了一种计算机可读存储介质，存储有计算机可读指令，该计算机可读指令被处理器执行时实现上述各方法实施例中的步骤。
在一个实施例中，提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述各方法实施例中的步骤。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的计算机可读指令可存储于一非易失性计算机可读取存储介质中，该计算机可读指令在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和易失性存储器中的至少一种。非易失性存储器可包括只读存储器(Read-Only Memory，ROM)、磁带、软盘、闪存或光存储器等。易失性存储器可包括随机存取存储器(Random Access Memory，RAM)或外部高速缓冲存储器。作为说明而非局限，RAM可以是多种形式， 比如静态随机存取存储器(Static Random Access Memory，SRAM)或动态随机存取存储器(Dynamic Random Access Memory，DRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (23)

  1. 一种图像攻击检测方法，由计算机设备执行，其特征在于，所述方法包括：
    获取待检测图像，基于所述待检测图像进行全局分类识别，得到全局分类识别结果；
    基于所述待检测图像随机进行局部图像提取，得到目标数量的局部图像，所述目标数量是根据所述待检测图像对应的参考图像的防御率计算得到的，所述参考图像的防御率用于表征所述参考图像受到图像攻击时的防御度；
    基于所述目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将所述各个局部分类识别结果进行融合，得到目标分类识别结果；
    基于所述目标分类识别结果和所述全局识别结果检测识别结果的一致性，当所述目标分类识别结果和所述全局分类识别结果不一致时，判别所述待检测图像为攻击图像。
  2. 根据权利要求1所述的方法，其特征在于，所述方法，还包括：
    将所述待检测图像输入全局图像分类识别模型中进行全局分类识别，得到全局分类识别结果向量；
    基于所述待检测图像随机进行局部图像提取，得到目标数量的局部图像；
    分别将所述目标数量的局部图像输入到局部图像识别模型中进行局部分类识别，得到各个局部分类识别结果向量，并将所述各个局部分类识别结果向量进行融合，得到目标分类识别结果向量；
    将所述目标分类识别结果向量和所述全局分类识别结果向量输入到图像攻击检测模型中进行一致性检测，当所述目标分类识别结果和所述全局分类识别结果不一致时，判别所述待检测图像为攻击图像。
  3. 根据权利要求2所述的方法，其特征在于，所述将所述目标分类识别结果向量和所述全局分类识别结果向量输入到图像攻击检测模型中进行一致性检测，当所述目标分类识别结果和所述全局分类识别结果不一致时，判别所述待检测图像为攻击图像，包括：
    将所述目标局部识别结果向量和所述全局识别结果向量进行拼接，得到拼接向量；
    将所述拼接向量输入到图像攻击检测模型，通过所述图像攻击检测模型识别所述目标局部识别结果向量和所述全局识别结果向量的一致性，当所述目标分类识别结果和所述全局分类识别结果一致时，判别所述待检测图像为真实图像，当所述目标分类识别结果和所述全局分类识别结果不一致时，判别所述待检测图像为攻击图像。
  4. 根据权利要求2所述的方法，其特征在于，所述将所述各个局部分类识别结果向量进行融合，得到目标分类识别结果向量，包括：
    计算所述各个局部分类识别结果向量的平均向量，得到目标分类识别结果向量。
  5. 根据权利要求1-4任意一项所述的方法，其特征在于，所述方法还包括：
    获取所述待检测图像的全局尺寸，基于所述待检测图像的全局尺寸获取参考图像，所述参考图像包含预设的参考攻击区域，所述参考攻击区域是根据预设攻击区域上限尺寸确定的；
    基于所述全局尺寸和所述预设攻击区域上限尺寸进行参数计算，得到目标局部图像的比重参数，所述目标局部图像中存在所述参考攻击区域的图像内容；
    获取参考局部图像提取数量，基于所述参考局部图像提取数量将所述参考图像随机进行局部图像提取，得到参考局部图像提取数量的局部图像；
    基于所述参考局部图像提取数量的局部图像进行局部分类识别，得到参考局部图像提取数量的局部分类识别结果，基于所述参考局部图像提取数量的局部分类识别结果进行统计计 算，得到所述目标局部图像的提取下限数量；
    基于所述目标局部图像的提取下限数量、所述参考局部图像提取数量和所述目标局部图像比重参数进行二项分布加和计算，得到所述参考图像的防御率；
    当所述参考图像的防御率符合预设条件时，将所述参考局部图像提取数量作为所述目标数量。
  6. 根据权利要求5所述的方法，其特征在于，所述基于所述全局尺寸和所述预设攻击区域上限尺寸进行参数计算，得到目标局部图像的比重参数，包括：
    基于所述全局尺寸确定局部尺寸，基于所述全局尺寸和所述局部尺寸计算所述参考图像可提取的局部图像总数量；
    基于所述全局尺寸、所述局部尺寸和所述预设攻击区域上限尺寸计算所述参考图像可提取的目标局部图像总数量；
    计算所述目标局部图像总数量与所述局部图像总数量的比例，得到所述目标局部图像的比重参数。
  7. 根据权利要求5所述的方法，其特征在于，所述基于所述参考局部图像提取数量的局部分类识别结果进行统计计算，得到目标局部图像的提取下限数量，包括：
    统计所述参考局部图像提取数量的局部分类识别结果中第一类别的数量和第二类别的数量，所述第一类别是指所述参考局部图像提取数量的局部分类识别结果中数量最多类别，所述第二类别是指所述参考局部图像提取数量的局部分类识别结果中除第一类别以外数量最多类别；
    基于所述第一类别的数量和所述第二类别的数量计算所述目标局部图像的提取下限数量。
  8. 根据权利要求5所述的方法，其特征在于，所述方法，还包括：
    获取各个参考局部图像提取数量，基于所述各个参考局部图像提取数量计算得到对应的各个防御率，基于所述各个参考局部图像提取数量和对应的各个防御率建立所述参考局部图像提取数量和所述防御率的关联关系；
    获取所述待检测图像对应的预设防御率，从所述参考局部图像提取数量和所述防御率的关联关系中查找所述预设防御率对应的目标参考局部图像提取数量，将所述目标参考局部图像提取数量作为目标数量。
  9. 根据权利要求1所述的方法，其特征在于，所述将所述参考局部图像提取数量作为所述目标数量，包括：
    获取当前设备对应的资源信息，基于所述当前设备对应的资源信息确定当前局部图像提取数量；
    当所述参考局部图像提取数量超过所述当前局部图像提取数量时，将所述当前局部图像提取数量作为所述目标数量；
    当所述参考局部图像提取数量未超过所述当前局部图像提取数量时，将所述参考局部图像提取数量作为所述目标数量。
  10. 一种图像攻击检测模型训练方法，由计算机设备执行，其特征在于，所述方法包括：
    获取训练数据，所述训练数据包括训练图像和图像攻击类别标签；
    将所述训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；
    基于所述训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，所述训练目标数量是所述训练图像对应的训练参考图像的防御率计算得到的，所述训练参考图像的防御率用于表征所述训练参考图像受到图像攻击时的防御度；
    分别将所述目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将所述各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量；
    将所述目标训练分类识别结果向量和所述训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；
    基于所述初始一致性检测结果和所述图像攻击类别标签更新所述初始图像攻击检测模型，并返回将所述目标训练分类识别结果向量和所述训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤执行，直到训练完成时，得到目标图像攻击检测模型。
  11. 根据权利要求10所述的方法，其特征在于，所述方法，还包括：
    获取所述训练图像的训练全局尺寸，基于所述训练图像的训练全局尺寸获取训练参考图像，所述训练参考图像包含预设的训练参考攻击区域，所述训练参考攻击区域是根据预设训练攻击区域上限尺寸确定的；
    基于所述训练全局尺寸和所述预设训练攻击区域上限尺寸进行参数计算，得到训练目标局部图像的比重参数，所述训练目标局部图像中存在所述训练参考攻击区域的图像内容；
    获取训练参考局部图像提取数量，基于所述训练参考局部图像提取数量将所述训练参考图像随机进行局部图像提取，得到训练参考局部图像提取数量的局部图像；
    基于所述训练参考局部图像提取数量的局部图像进行局部分类识别，得到训练参考局部图像提取数量的局部分类识别结果，基于所述训练参考局部图像提取数量的局部分类识别结果进行统计计算，得到所述训练目标局部图像的提取下限数量；
    基于所述训练目标局部图像的提取下限数量、所述训练参考局部图像提取数量和所述训练目标局部图像比重参数进行二项分布加和计算，得到所述训练参考图像对应的防御率；
    当所述训练参考图像对应的防御率符合预设条件时，将所述训练参考局部图像提取数量作为所述训练目标数量。
  12. 根据权利要求11所述的方法，其特征在于，所述基于所述训练全局尺寸和所述预设训练攻击区域上限尺寸进行参数计算，得到训练目标局部图像的比重参数，包括：
    基于所述训练全局尺寸确定训练局部尺寸，基于所述训练全局尺寸和所述训练局部尺寸计算所述训练参考图像可提取的训练局部图像总数量；
    基于所述训练全局尺寸、所述训练局部尺寸和所述预设训练攻击区域上限尺寸计算所述训练参考图像可提取的训练目标局部图像总数量；
    计算所述训练目标局部图像总数量与所述训练局部图像总数量的比例，得到所述训练目标局部图像的比重参数。
  13. 根据权利要求11所述的方法，其特征在于，所述基于所述训练参考局部图像提取数量的局部分类识别结果进行统计计算，得到训练目标局部图像的提取下限数量，包括：
    统计所述训练参考局部图像提取数量的局部分类识别结果中第一训练类别的数量和第二训练类别的数量，所述第一训练类别是指所述训练参考局部图像提取数量的局部分类识别结果中数量最多类别，所述第二训练类别是指所述训练参考局部图像提取数量的局部分类识别 结果中除第一训练类别以外数量最多类别；
    基于所述第一训练类别的数量和所述第二训练类别的数量计算所述训练目标局部图像的提取下限数量。
  14. 根据权利要求10所述的方法，其特征在于，所述基于所述训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像，包括：
    获取所述训练图像中各个区域的重要程度，基于所述各个区域的重要程度按照预设重要度阈值将所述训练图像进行二值划分，得到目标区域和非目标区域；
    随机从所述目标区域中选取第一部分局部图像，并随机从非目标区域中选取第二部分局部图像，其中，所述第一部分局部图像的面积大于所述第二部分局部图像的面积；
    基于所述第一部分局部图像和第二部分局部图像得到训练局部图像。
  15. 根据权利要求10所述的方法，其特征在于，所述全局图像分类识别模型的训练包括以下步骤：
    获取全局训练数据，所述全局训练数据包括全局训练图像和对应的全局类别标签；
    将所述全局训练图像输入初始全局图像分类识别模型中进行全局图像分类识别，得到初始全局分类识别结果；
    基于所述初始全局分类识别结果和所述全局类别标签进行损失计算，得到全局损失信息；
    基于所述全局损失信息反向更新所述初始全局图像分类识别模型中的参数，得到更新后的全局图像分类识别模型；
    将所述更新后的全局图像分类识别模型作为初始全局图像分类识别模型，并返回将所述全局训练图像输入初始全局图像分类识别模型中进行全局图像分类识别，得到初始全局分类识别结果的步骤执行，直到达到全局训练完成条件时，将达到全局训练完成条件时的初始全局图像分类识别模型作为所述全局图像分类识别模型。
  16. 根据权利要求15所述的方法，其特征在于，所述基于所述全局损失信息反向更新所述初始全局图像分类识别模型中的参数，得到更新后的全局图像分类识别模型，包括：
    获取当前学习率；
    基于所述当前学习率和所述全局损失信息反向更新所述初始全局图像分类识别模型的参数，得到更新后的全局图像分类识别模型。
  17. 根据权利要求16所述的方法，其特征在于，所述获取当前学习率，包括：
    获取历史学习率，基于所述历史学习率使用预设余弦函数进行调整，得到当前学习率。
  18. 根据权利要求10所述的方法，其特征在于，所述局部图像分类识别模型的训练包括以下步骤：
    将所述全局图像分类识别模型作为初始局部图像分类识别模型；
    获取局部训练数据，所述局部训练数据中包括局部训练图像和对应的局部图像类别标签；
    将所述局部训练图像输入所述初始局部图像分类识别模型中进行局部分类识别，得到初始局部分类识别结果；
    基于所述初始局部分类识别结果和所述局部图像类别标签进行损失计算，得到局部损失信息，基于所述局部损失信息反向更新所述初始局部图像分类识别模型，得到更新后的局部图像分类识别模型；
    将所述更新后的局部图像分类识别模型作为初始局部图像分类识别模型，并返回将所述局部训练图像输入所述初始局部图像分类识别模型中进行局部分类识别，得到初始局部分类 识别结果的步骤执行，直到达到局部训练完成条件时，将达到局部训练完成条件时初始局部图像分类识别模型作为所述局部图像分类识别模型。
  19. 一种图像攻击检测装置，其特征在于，所述装置包括：
    全局分类模块，用于获取待检测图像，基于所述待检测图像进行全局分类识别，得到全局分类识别结果；
    局部提取模块，用于基于所述待检测图像随机进行局部图像提取，得到目标数量的局部图像，所述目标数量是根据所述待检测图像对应的参考图像的防御率计算得到的，所述参考图像的防御率用于表征所述参考图像受到图像攻击时的防御度；
    局部分类模块，用于基于所述目标数量的局部图像分别进行局部分类识别，得到各个局部分类识别结果，将所述各个局部分类识别结果进行融合，得到目标分类识别结果；
    检测模块，用于基于所述目标分类识别结果和所述全局识别结果检测识别结果的一致性，当所述目标分类识别结果和所述全局分类识别结果不一致时，判别所述待检测图像为攻击图像。
  20. 一种图像攻击检测模型训练装置，其特征在于，所述装置包括：
    数据获取模块，用于获取训练数据，所述训练数据包括训练图像和图像攻击类别标签；
    训练全局分类模块，用于将所述训练图像输入全局图像分类识别模型中进行全局分类识别，得到训练全局分类识别结果向量；
    训练局部提取模块，用于基于所述训练图像随机进行局部图像提取，得到训练目标数量的训练局部图像；所述训练目标数量是所述训练图像对应的训练参考图像的防御率计算得到的，所述训练参考图像的防御率用于表征所述训练参考图像受到图像攻击时的防御度；
    训练局部分类模块，用于分别将所述目标数量的训练局部图像输入到局部图像分类识别模型中进行局部分类识别，得到各个训练局部分类识别结果向量，将所述各个训练局部分类识别结果向量进行融合，得到目标训练分类识别结果向量；
    训练检测模块，用于将所述目标训练分类识别结果向量和所述训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果；
    迭代模块，用于基于所述初始一致性检测结果和所述图像攻击类别标签更新所述初始图像攻击检测模型，并返回将所述目标训练分类识别结果向量和所述训练全局分类识别结果向量输入到初始图像攻击检测模型中进行识别结果的一致性检测，得到初始一致性检测结果的步骤执行，直到训练完成时，得到目标图像攻击检测模型。
  21. 一种计算机设备，包括存储器和处理器，所述存储器存储有计算机可读指令，其特征在于，所述处理器执行所述计算机可读指令时实现权利要求1至18中任一项所述的方法的步骤。
  22. 一种计算机可读存储介质，存储有计算机可读指令，其特征在于，所述计算机可读指令被处理器执行时实现权利要求1至18中任一项所述的方法的步骤。
  23. 一种计算机程序产品，包括计算机可读指令，其特征在于，所述计算机可读指令被处理器执行时实现权利要求1至18中任一项所述的方法的步骤。
PCT/CN2022/086735 2021-04-21 2022-04-14 图像攻击检测、图像攻击检测模型训练方法和装置 WO2022222832A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/072,272 US20230104345A1 (en) 2021-04-21 2022-11-30 Image attack detection method and apparatus, and image attack detection model training method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110431153.1A CN113762249A (zh) 2021-04-21 2021-04-21 图像攻击检测、图像攻击检测模型训练方法和装置
CN202110431153.1 2021-04-21

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/072,272 Continuation US20230104345A1 (en) 2021-04-21 2022-11-30 Image attack detection method and apparatus, and image attack detection model training method and apparatus

Publications (1)

Publication Number Publication Date
WO2022222832A1 true WO2022222832A1 (zh) 2022-10-27

Family

ID=78786989

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/086735 WO2022222832A1 (zh) 2021-04-21 2022-04-14 图像攻击检测、图像攻击检测模型训练方法和装置

Country Status (3)

Country Link
US (1) US20230104345A1 (zh)
CN (1) CN113762249A (zh)
WO (1) WO2022222832A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113762249A (zh) * 2021-04-21 2021-12-07 腾讯科技（深圳）有限公司 图像攻击检测、图像攻击检测模型训练方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190132354A1 (en) * 2017-10-26 2019-05-02 Preferred Networks, Inc. Image processing system and image processing unit for generating attack image
CN109784186A (zh) * 2018-12-18 2019-05-21 深圳云天励飞技术有限公司 一种行人重识别方法、装置、电子设备及计算机可读存储介质
CN109858368A (zh) * 2018-12-29 2019-06-07 浙江工业大学 一种基于Rosenbrock-PSO的人脸识别攻击防御方法
CN113762249A (zh) * 2021-04-21 2021-12-07 腾讯科技（深圳）有限公司 图像攻击检测、图像攻击检测模型训练方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190132354A1 (en) * 2017-10-26 2019-05-02 Preferred Networks, Inc. Image processing system and image processing unit for generating attack image
CN109784186A (zh) * 2018-12-18 2019-05-21 深圳云天励飞技术有限公司 一种行人重识别方法、装置、电子设备及计算机可读存储介质
CN109858368A (zh) * 2018-12-29 2019-06-07 浙江工业大学 一种基于Rosenbrock-PSO的人脸识别攻击防御方法
CN113762249A (zh) * 2021-04-21 2021-12-07 腾讯科技（深圳）有限公司 图像攻击检测、图像攻击检测模型训练方法和装置

Also Published As

Publication number Publication date
CN113762249A (zh) 2021-12-07
US20230104345A1 (en) 2023-04-06

Similar Documents

Publication Publication Date Title
US11256952B2 (en) Image privacy perception method based on deep learning
CN110163300B (zh) 一种图像分类方法、装置、电子设备及存储介质
CN111079639A (zh) 垃圾图像分类模型构建的方法、装置、设备及存储介质
CN110633745A (zh) 一种基于人工智能的图像分类训练方法、装置及存储介质
CN105404886A (zh) 特征模型生成方法和特征模型生成装置
CN112348117A (zh) 场景识别方法、装置、计算机设备和存储介质
CN109284613B (zh) 标识检测及仿冒站点检测方法、装置、设备及存储介质
CN111275060A (zh) 识别模型更新处理方法、装置、电子设备及存储介质
JP6107531B2 (ja) 特徴抽出プログラム及び情報処理装置
US8867851B2 (en) Sparse coding based superpixel representation using hierarchical codebook constructing and indexing
CN112101386B (zh) 文本检测方法、装置、计算机设备和存储介质
JP2023012406A (ja) 情報処理装置、情報処理方法及びプログラム
WO2022222832A1 (zh) 图像攻击检测、图像攻击检测模型训练方法和装置
CN111382638B (zh) 一种图像检测方法、装置、设备和存储介质
CN111292377A (zh) 目标检测方法、装置、计算机设备和存储介质
CN112862730B (zh) 点云特征增强方法、装置、计算机设备和存储介质
US8849050B2 (en) Computer vision methods and systems to recognize and locate an object or objects in one or more images
CN110795995A (zh) 数据处理方法、装置及计算机可读存储介质
JP2018013887A (ja) 特徴選択装置、タグ関連領域抽出装置、方法、及びプログラム
CN114330542A (zh) 一种基于目标检测的样本挖掘方法、装置及存储介质
CN110929118B (zh) 网络数据处理方法、设备、装置、介质
Gupta et al. A novel unsupervised thresholding technique for landsat image change detection
CN111353349B (zh) 人体关键点检测方法、装置、电子设备及存储介质
CN111382628B (zh) 同行判定方法及装置
CN113408564A (zh) 图处理方法、网络训练方法、装置、设备以及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22790940

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE