WO2023065637A1 - 一种数据处理方法、装置、电子设备以及存储介质 - Google Patents

一种数据处理方法、装置、电子设备以及存储介质 Download PDF

Info

Publication number
WO2023065637A1
WO2023065637A1 PCT/CN2022/090176 CN2022090176W WO2023065637A1 WO 2023065637 A1 WO2023065637 A1 WO 2023065637A1 CN 2022090176 W CN2022090176 W CN 2022090176W WO 2023065637 A1 WO2023065637 A1 WO 2023065637A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
classification
disturbance
replacement area
adversarial
Prior art date
Application number
PCT/CN2022/090176
Other languages
English (en)
French (fr)
Inventor
刘杰
王健宗
瞿晓阳
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2023065637A1 publication Critical patent/WO2023065637A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • the present application relates to the technical field of artificial intelligence, and in particular to a data processing method, device, electronic equipment and storage medium.
  • model parameters of deep learning models are one of the hot research directions of security issues.
  • an attacker can infer the model parameters of the classification model by obtaining the data of the input classification model and the corresponding classification results. If the model parameters of the classification model are obtained by the attacker, the attacker can call the white The box attack model generates data for attacking classification models. Therefore, the inventor realizes that how to prevent leakage of the model parameters of the classification model is an urgent problem to be solved.
  • Embodiments of the present application provide a data processing method, device, electronic device, and storage medium, which help protect the privacy of an authorized classification model.
  • the embodiment of the present application discloses a data processing method, the method comprising:
  • the original image includes an information replacement area and a non-information replacement area
  • the classification information is used to indicate the correct classification to which the original image belongs
  • the target classification model is a classification model with authorization or a classification model without authorization, based on the classification model with authorization and the non-authorized classification model Classification models with authorization get different classification results.
  • the embodiment of the present application discloses a data processing device, the device includes:
  • An acquisition unit configured to acquire an original image and classification information corresponding to the original image, the original image includes an information replacement area and a non-information replacement area, and the classification information is used to indicate the correct classification to which the original image belongs;
  • a processing unit configured to use a first key to generate image signature information according to the information of the non-information replacement area of the original image
  • the processing unit is further configured to encrypt the classification information according to the second key to obtain encrypted classification information
  • the acquiring unit is further configured to acquire disturbed pixel information
  • the processing unit is further configured to replace information in the information replacement area according to the image signature information, the encrypted classification information, and the perturbed pixel information to obtain an adversarial example;
  • the processing unit is further configured to input the adversarial example into a target classification model to obtain a classification result of the adversarial example, the target classification model is a classification model with authorization or a classification model without authorization, based on the The classification results obtained by the authorized classification model and the non-authorized classification model are different.
  • an embodiment of the present application provides an electronic device, the electronic device includes a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to Perform the following steps:
  • the original image includes an information replacement area and a non-information replacement area
  • the classification information is used to indicate the correct classification to which the original image belongs
  • the target classification model is a classification model with authorization or a classification model without authorization, based on the classification model with authorization and the non-authorized classification model Classification models with authorization get different classification results.
  • the embodiment of the present application provides a computer-readable storage medium, in which computer program instructions are stored, and when the computer program instructions are executed by a processor, they are used to perform the following steps:
  • the original image includes an information replacement area and a non-information replacement area
  • the classification information is used to indicate the correct classification to which the original image belongs
  • the target classification model is a classification model with authorization or a classification model without authorization, based on the classification model with authorization and the non-authorized classification model Classification models with authorization get different classification results.
  • the embodiment of the present application discloses a computer program product or computer program, where the computer program product or computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above data processing method.
  • the original image and the classification information corresponding to the original image can be obtained, the image signature information is generated according to the information of the non-information replacement area of the original image by using the first key, and the classification information is encrypted according to the second key, Obtain the encrypted classification information, obtain the perturbed pixel information, and replace the information in the information replacement area according to the image signature information, encrypted classification information and perturbed pixel information, obtain the adversarial sample, and input the adversarial sample into the authorized classification model or the non-authorized one. Classification model to get the corresponding classification results.
  • the adversarial sample can be correctly identified by the authorized classification model while being incorrectly identified by the non-authorized classification model. Preventing attackers from obtaining the model parameters of the classification model with authorization helps to protect the privacy of the classification model with authorization.
  • FIG. 1 is a schematic flow diagram of a data processing method provided in an embodiment of the present application
  • Fig. 2 is a schematic diagram of the effect of an adversarial example provided by the embodiment of the present application.
  • Fig. 3 is a schematic flow chart of a data processing method provided by an embodiment of the present application.
  • FIG. 4 is a schematic flow diagram of a data processing method provided in an embodiment of the present application.
  • FIG. 5 is a schematic flow diagram of a data processing method provided in an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a data processing device provided in an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • This application provides a data processing scheme, which can obtain the original image and the classification information corresponding to the original image, use the first key to generate image signature information according to the information of the non-information replacement area of the original image, and perform classification information according to the second key Encryption processing, obtain encrypted classification information, obtain disturbed pixel information, and replace information in the information replacement area according to image signature information, encrypted classification information and disturbed pixel information, obtain adversarial samples, and input adversarial samples into authorized classification models or not With the authorized classification model, the corresponding classification results are obtained.
  • image signature information, encrypted classification information, and perturbation information in the original image to obtain an adversarial sample the adversarial sample can be correctly identified by the authorized classification model while being incorrectly identified by the non-authorized classification model. Preventing attackers from obtaining the model parameters of the classification model with authorization helps to protect the privacy of the classification model with authorization.
  • the technical solutions of the present application can be applied to electronic equipment, and the electronic equipment can be a terminal or a server, which is not limited in this application.
  • the application can be used in numerous general purpose or special purpose computer system environments or configurations. Examples: personal computers, server computers, handheld or portable devices, tablet-type devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, including A distributed computing environment for any of the above systems or devices, etc.
  • This application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer.
  • program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types.
  • the application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.
  • the embodiments of the present application can be applied to the field of artificial intelligence, for example, the classification result of the adversarial samples can be obtained by performing deep learning processing on the adversarial samples based on the artificial intelligence technology.
  • artificial intelligence is a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.
  • Artificial intelligence basic technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation/interaction systems, and mechatronics.
  • Artificial intelligence software technology mainly includes computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning/deep learning.
  • FIG. 1 is a schematic flowchart of a data processing method provided in an embodiment of the present application.
  • the method can be executed by the above-mentioned electronic device.
  • the method may include the following steps.
  • the original image includes an information replacement area and a non-information replacement area
  • the information replacement area may be an area used for information replacement in the original image
  • the non-information replacement area may be an area not used for information replacement in the original image
  • the information replacement area may be an area corresponding to any N rows of pixels in the original image. It can be understood that the smaller the information replacement area, the less data needs to be replaced later, and the higher the efficiency of obtaining adversarial samples.
  • the information replacement area can be the area corresponding to any two rows of pixels in the original image.
  • the information replacement area may be an area corresponding to the first row of pixels and the last row of pixels in the original image, and the non-information replacement area is the area except the first row of pixels and the last row of pixels.
  • the information replacement has less impact on the original image, and it is difficult for human eyes to perceive the information replacement, and the position of the information replacement area can be quickly determined, thereby improving the efficiency of information replacement.
  • This classification information is used to indicate the correct classification to which the original image belongs.
  • the classification information may be expressed as classified text information, or may be classified classification coding information, etc., which is not limited here.
  • the category information may include multiple correct categories to which the original image belongs.
  • the classification of the original image is used to indicate which animals are included in the original image
  • the classification information can be used to indicate the animals included in the original image
  • the classification information can be used to indicate the number of animals included in the original image.
  • S102 Generate image signature information according to the information of the non-information replacement area of the original image by using the first key.
  • the first key may be a private key used for generating image signature information.
  • the image signature information may be signature information obtained by signing the information of the non-information replacement area of the original image with the first key.
  • the information of the non-information replacement area of the original image may be the pixel value of each pixel in the original image non-information replacement area.
  • using the first key to generate the image signature information according to the information of the non-information replacement area of the original image may include the following steps: performing a hash operation on the information of the non-information replacement area in the original image, A hash function value for the original image is obtained; the hash function value is encrypted with the first key to obtain image signature information for the original image.
  • hash operation also known as hash operation and hash operation, is to convert an input of any length into a fixed-length output through a hash algorithm. The output is the hash (hash) value.
  • This mapping function is called hash Hash (hash) function.
  • a fixed-length hash function value is obtained by hashing the information of the information replacement area in the original image.
  • the hash function value can be a value obtained after hashing the information of the information replacement area in the original image, and the hash function value can also be called a hash value, hash value, hash value, etc., here No restrictions.
  • the MD5 algorithm can be used to hash the information in the information replacement area in the original image.
  • MD5 Message-Digest Algorithm 5, Information-Digest Algorithm 5
  • MD5 can be used to ensure that the information transmission is complete and consistent, (also translated Digest Algorithm, Hash algorithm, Hash algorithm).
  • the hash function value of the data can verify the integrity of the data to prevent the data from being tampered with.
  • the encryption processing of the hash function value performed by the first key may be encrypted by an elliptic curve encryption algorithm (Elliptic curve cryptography, ECC for short).
  • ECC is a public key encryption system.
  • the encryption processing by the ECC encryption algorithm may include the following steps: obtaining the first key, and processing the hash function value of the information of the non-replacement area in the original image by calling the first key through the ECC algorithm, to obtain the image signature information.
  • a public key for the first key can also be generated, so that the subsequent receiving end can pass the first key's
  • the public key verifies the image signature information.
  • the image signature information generated by the first key can enable the data receiver to verify that the received data is sent by the signer instead of other ends, so that the whole process ensures the uniqueness from the signer to the receiver confirm. That is to say, only the public key corresponding to the private key (such as the first key) used by A when signing A’s signature information can be unsigned.
  • B receives the data and signature information sent by A, when B uses the signature
  • the public key corresponding to the private key can confirm that this information is sent by A.
  • the second key may be a public key used for generating encrypted classification information.
  • the encrypted classification information may be signature information obtained by encrypting the classification information with the second key, and the encrypted classification information may also be referred to as ciphertext information of the classification information. It can be understood that only the holder of the private key of the second key can decrypt the encrypted classification information through the private key of the second key to obtain the classification information of the original image. That is to say, the encrypted information of A can only be decrypted by the private key corresponding to the public key (that is, the second key) used by A when encrypting.
  • B receives the encrypted information sent by A, B uses the second key to decrypt the encrypted information.
  • the corresponding private key can decrypt the encrypted information (such as encrypted classification information) to obtain the plaintext information corresponding to the encrypted information, thereby avoiding information leakage.
  • performing encryption processing on the classification information according to the second key may be performing encryption processing on the classification information based on the second key using an ECC encryption algorithm.
  • the recipient who can hold the private key corresponding to the public key used for encryption can decrypt the encrypted classification information through the public key used for encryption, and Even if the object without the private key corresponding to the public key used for encryption obtains the encrypted classification information, it cannot determine the specific content, thereby protecting the privacy of the classification information.
  • the perturbed pixel information may cause the original image added with perturbed pixel information to be misclassified by the test classification model.
  • the test classification model can be a model for testing whether the disturbance pixel information can make the classification model misclassify the original image with the disturbance pixel information, if the original image with the disturbance pixel information can make the test classification model misclassify, then the The original image with perturbed pixel information can also make other classification models misclassify.
  • the test classification model may be a multi-classification model, a multi-label single-classification model, or a binary classification model, which is not limited here.
  • the information replacement area may include a disturbance replacement area
  • the disturbance replacement area may be an area in the information replacement area for replacing with disturbed pixel information. That is to say, the disturbance replacement area is a part of the information replacement area.
  • the disturbance replacement area may be a part of the area corresponding to the first row of pixels and a part of the area corresponding to the last row of pixels.
  • the disturbance replacement area may be an area corresponding to the last K pixels in the first row of pixels and the last row of pixels.
  • Generating the disturbed pixel information may include the following steps: obtaining a disturbed generated image, the disturbed generated image includes a disturbed replacement area, and the disturbed generated image is associated with corresponding actual classification information; the information of the disturbed replaced area in the disturbed generated image is modified, and The modified disturbance generated image is input to the test classification model for processing, and the predicted classification result is obtained; if the classification indicated by the predicted classification result is different from the classification indicated by the actual classification information, the information of the modified disturbance replacement area is determined as the disturbance pixel information.
  • the disturbance generation image may be an image used to generate disturbance pixel information, and the disturbance generation image may be the above-mentioned original image, or other images other than the above-mentioned original image, which is not limited here. It can be understood that the disturbance generation image may include a disturbance replacement area, and the disturbance replacement area in the disturbance generation image is the disturbance replacement area in the above-mentioned original image.
  • the actual classification information may be the category to which the disturbance generated image actually belongs.
  • the test classification model is used to classify the animals in the input image, and the actual classification information may indicate one or more categories to which the content in the disturbance generated image belongs. species of animals.
  • the predicted classification result may be a classification result obtained after inputting the modified perturbed pixel image into the test classification model for deep learning processing, and the predicted classification result may indicate the classification predicted by the test classification model for the modified perturbed generated image.
  • the information of the disturbance-replacing area in the disturbance-generating image is modified, and the pixel values of the disturbance-replacing area may be modified.
  • the pixel value of the first pixel in the disturbance replacement area in the disturbance generation image may be modified to another pixel value, and the first pixel may be any pixel in the disturbance replacement area.
  • the classification indicated by the predicted classification result is different from the classification indicated by the actual classification information, it means that the information of the modified perturbation replacement area can make the classification error of the test classification model, and the information of the modified perturbation replacement area is determined as the disturbance pixel information. If the classification indicated by the predicted classification result is the same as the classification indicated by the actual classification information, it means that the information of the modified perturbation replacement area cannot make the classification error of the test classification model, and the information of the modified perturbation replacement area cannot be determined as Disturb the pixel information, and then modify the pixel value of the first pixel in the perturbation replacement area again, and input the modified perturbation generated image into the test classification model to obtain a new predicted classification result, if the new predicted classification result indicates If the classification is different from the classification indicated by the actual classification information, the information of the modified disturbance replacement area is determined as the disturbance pixel information, otherwise, the information of the disturbance replacement area is modified again, and so on.
  • the second pixel can be determined, and the second pixel can be the pixel disturbance area Any pixel except the first pixel, and then modify both the first pixel and the second pixel, so as to perform iterative processing until the modified perturbation generated image can make the classification error of the test classification model.
  • the pixel values of the disturbance replacement region may be modified according to a certain modification rule. For example, a pixel can be determined from the disturbance replacement area first, and the value of the pixel value increase or decrease of the pixel is modified in ascending order, such as the pixel value of the determined pixel is 57, then the pixel value can be modified to 56 or 58, and then modify it to 55 or 59, and so on, there is no limit here.
  • a pixel can be determined again, that is, the pixel values of two pixels are modified, and so on, until the modified The perturbed generated images of , can make the test classification model misclassify.
  • a pixel may be randomly selected from the disturbance replacement region, or sequentially selected from left to right (or from right to left), and there is no limitation here.
  • the modified perturbation generated image can also be input into multiple test classification models to obtain a predicted classification result for each test classification model, if the classification indicated by the predicted classification result of each predicted classification model is different from the actual classification If the categories indicated by the information are all different, the information of the modified disturbance replacement area is determined as the disturbance pixel information. In this way, it can be ensured that the generated disturbance pixel information can be applied to a variety of classification models, so that the generated adversarial examples can make more classification models without authorization misclassify.
  • the pixel values of the pixel perturbation area of the original image may be modified to obtain perturbed pixel information that can cause the original image to be misclassified by the test classification model.
  • the disturbance generation image is not the above original image, multiple disturbance generation images that are not the original image can be obtained, and the information of the disturbance replacement area of each disturbance generation image is modified in the same way, so as to find the disturbance that makes each modification
  • the generated image is modified by the wrong classification model of the test classification model, and the information of the modified disturbance replacement area is used as the disturbance pixel information. If the disturbance pixel information is added to the disturbance replacement area of the original image, and the disturbance is added by the test classification model If the original image with pixel information is classified, the test classification model will classify the original image with perturbed pixel information incorrectly.
  • the adversarial example may be an image that causes a classification model without authorization to classify the adversarial example incorrectly, and the adversarial example may also cause a classification model with authorization to classify the adversarial example correctly.
  • the adversarial example is an image obtained by replacing the information in the information replacement area in the original image, and the actual category of the adversarial example is the same as that of the original image. If the information replacement area is small and the position is relatively hidden, the human eye usually cannot distinguish the difference between the adversarial example and the original image.
  • the classification model with authorization may be a classification model storing the public key corresponding to the first key and the private key corresponding to the second key, and the classification model with authorization is the same as the identifiable classification of the test classification model , the classification model without authorization may be a classification model that does not store the public key corresponding to the first key or the private key corresponding to the second key.
  • the information in the information replacement area is replaced according to the image signature information, encrypted classification information, and perturbed pixel information to obtain an adversarial example, which can be replaced by the image signature information in the information replacement area of the original image
  • the signature replacement area replaces the encrypted classification information into the classification replacement area in the information replacement area of the original image, and replaces the perturbed pixel information into the disturbance replacement area in the information replacement area of the original image.
  • the signature replacement area may be an area used to replace image signature information in the information replacement area
  • the category replacement area may be an area used to replace encrypted classification information in the information replacement area. It can be understood that the areas corresponding to the signature replacement area, classification replacement area and perturbation replacement area are not repeated.
  • the adversarial example includes the same information replacement region, perturbation replacement region, signature replacement region, and classification replacement region as the original image.
  • each pixel in the single-channel original image corresponds to only one pixel value.
  • the pixel value of each pixel in the information replacement area in the single-channel original image is replaced directly according to the image signature information, encrypted classification information and disturbed pixel information.
  • the multiple channels include a target channel, and the target channel is any channel in the multiple channels. Then, replace the information in the information replacement area according to the image signature information, encrypted classification information, and perturbed pixel information to obtain an adversarial example, which can be the target channel information of the information replacement area based on the image signature information, encrypted classification information, and perturbed pixel information Replace it to get an adversarial example.
  • the image including multiple channels is also called a multi-channel image, such as an RGB image, and each channel of each pixel in the multi-channel original image corresponds to a pixel value.
  • the pixels of the same channel (ie, the target channel) in multiple channels can be replaced Values, such as the pixel values of the R channel that each replaces each pixel. In this way, the efficiency of information replacement can be made faster, and the image signature information and encrypted classification information in the adversarial example can be determined more quickly later.
  • the text information corresponding to the image signature information and encrypted classification information can be converted into corresponding binary numbers through a certain conversion rule, and then the Digits in binary digits are converted to pixel values, and the resulting pixel values are substituted into the information replacement area of the original image.
  • each pixel value of the channel that needs to be replaced in the original image is 0-255, that is, each pixel value can be represented by 8-bit binary
  • the image signature information and encrypted classification information can be corresponding to binary
  • adjacent 8-bit binary numbers or other binary numbers, such as 4 bits, 2 bits, etc.
  • image signature information can be converted into binary numbers "1001 1001 0101 0010"
  • the binary number has a total of 16 bits.
  • the first 8-bit binary can be used as a pixel value, that is, "1001 1001” is converted to decimal, which is 153, and the last 8-bit binary is used as a pixel value, that is, "0101 0010" is converted to
  • the decimal system is 84, so it can be obtained that when the image signature information is replaced in the information replacement area, the pixel values of the replaced pixels are 153 and 84.
  • the information in the information replacement area is replaced according to the image signature information, encrypted classification information, and perturbed pixel information to obtain an adversarial example, which may also include the following steps: generating a signature according to the image signature information and perturbed pixel information Disturbance vector; generate a classification disturbance vector based on encrypted classification information and disturbance pixel information; use the signature disturbance vector and classification disturbance vector to replace the information of the replacement area, and use the replaced original image as an adversarial example.
  • the signature disturbance vector may be a vector generated according to image signature information and disturbance pixel information, and each numerical value in the signature disturbance vector may be a pixel value when the information replacement area is replaced.
  • the classification disturbance vector may be a vector generated according to image signature information and disturbance pixel information, and each numerical value in the signature disturbance vector may be a pixel value when the information replacement area is replaced.
  • the information replacement area when the information of the information replacement area is replaced by the signature disturbance vector and the classification disturbance vector, the information replacement area should be the area corresponding to any two rows of pixels in the original image, one row of pixels is replaced by the signature disturbance vector, and one row of pixels Replaced by a categorical perturbation vector.
  • the area used to replace the pixel value corresponding to the image signature information in the signature perturbation vector is the above-mentioned signature replacement area; it is used to replace the pixel value corresponding to the encrypted classification information in the classification perturbation vector
  • the area of pixel values is the above-mentioned classification replacement area; the area used to replace the classification disturbance vector and the disturbance pixel information in the classification disturbance vector is the above-mentioned disturbance replacement area. Therefore, the positions in the signature replacement area and the classification replacement area can be relatively continuous, and when the image signature information and the encrypted classification information are obtained, the pixel values corresponding to the image signature information and the encrypted classification information can be determined more quickly.
  • the image signature information can be converted into at least one pixel value, And splicing at least one pixel value corresponding to the image signature information and the pixel value corresponding to the disturbance pixel information to obtain a signature disturbance vector.
  • the image signature information after the image signature information is converted into at least one pixel value, it can be (153, 84, 79, 56), and the disturbance pixel information can be (52, 56, 85, 14), then the obtained signature disturbance vector can be directly obtained from the image
  • the signature information and the disturbed pixel information are concatenated, for example, (153, 84, 79, 56, 52, 56, 85, 14).
  • the encrypted classification information when generating the classification disturbance vector, can be converted into at least one pixel value, and at least one pixel value corresponding to the encrypted classification information can be spliced with the pixel value corresponding to the disturbance pixel information to obtain the classification disturbance vector, and then Each numerical value in the signature perturbation vector and the classification perturbation vector can be replaced one by one with the pixel values in the information replacement area.
  • the original image is an image including multiple channels
  • the multiple channels include a target channel
  • the target channel can be any one of the multiple channels included in the original image
  • the signature perturbation The replacement information of the vector and classification perturbation vector replaces the information of the area, which may be, the information of the target channel corresponding to the replacement area is replaced by the signature perturbation vector and the classification perturbation vector.
  • the original image is a multi-channel image
  • the information of the same channel in the information replacement area can be replaced, and the obtained adversarial example is also a multi-channel image, and the target channel in the multiple channels in the adversarial example
  • the pixel values in the information replacement area are replaced, which can make the efficiency of information replacement faster, and subsequently determine the image signature information and encrypted classification information in the adversarial example more quickly.
  • the information replacement area includes the area corresponding to the first row of pixels of the original image and the area corresponding to the last row of pixels
  • using the signature disturbance vector and classification disturbance vector to replace the information of the information replacement area may include The following steps: replace the information of the area corresponding to the first row of pixels with the signature disturbance vector; replace the information of the area corresponding to the last row of pixels with the classification disturbance vector.
  • the first row of pixels can be multiple pixels, and the pixel value of each pixel can be replaced by the value in the signature perturbation vector
  • the last row of pixels can be multiple pixels, and the pixel value of each pixel can be replaced by the value in the classification perturbation vector value.
  • the number of pixels in the first row of pixels (or the last row of pixels) is the same as the number of values in the signature perturbation vector (or classification perturbation vector).
  • FIG. 2 is a schematic diagram of an effect of an adversarial example provided by an embodiment of the present application.
  • (1) in FIG. 2 it is a single-channel original image of 10*10 pixels, and each pixel in the original image has a corresponding pixel value.
  • the area corresponding to the first row of pixels and the last row of pixels of the original image is an information replacement area.
  • the first row of pixels in the information replacement area is used to replace the signature perturbation vector, and the last row of pixels is used to replace the classification perturbation vector.
  • the first 5 values are the pixel values corresponding to the image signature information, and the last 5 values are the perturbed pixels The pixel value in the information; if the classification disturbance vector is (123, 45, 24, 56, 32, 56, 85, 14, 58, 63), the first 5 values are the pixel values corresponding to the encrypted classification information, and the latter The 5 values are the pixel values in the disturbed pixel information.
  • the adversarial sample shown in (2) in Figure 2 can be obtained.
  • the size of the adversarial sample is also 10*10 pixels.
  • the adversarial sample The pixel value of the first row of pixels is replaced by the value in the signature disturbance vector, and the pixel value of the last row of pixels is replaced by the value in the classification disturbance vector, then the adversarial example, as shown by 201 in Figure 2, is the signature replacement area , as shown by 202 in FIG. 2 is the category replacement area.
  • the signature disturbance vector and classification disturbance vector are used to replace the information of the information replacement area.
  • the method includes the following steps: replacing the information of the region corresponding to the first row of pixels with a classification disturbance vector; replacing the information of the region corresponding to the last row of pixels with a signature disturbance vector.
  • the target classification model may be a classification model with authorization or a classification model without authorization, and the classification results obtained based on the classification model with authorization and the classification model without authorization are different.
  • the classification indicated by the classification result obtained based on the authorized classification model is the correct classification to which the adversarial sample belongs
  • the classification indicated by the classification result obtained based on the classification model without authorization is the wrong classification to which the adversarial sample belongs.
  • Classification It can be understood that the adversarial sample input can obtain different classification results from the classification model with authorization and the classification model without authorization. It can be said that the adversarial sample is specifically identifiable, and only the classification model with authorization can identify the correct adversarial sample.
  • the authorized classification model can tell whether the adversarial sample has been maliciously tampered by the attacker, and does not identify the tampered image, so that the classification result obtained by the authorized classification model is the classification of the untampered adversarial sample. ; Moreover, even if an attacker obtains the adversarial sample, the adversarial sample cannot be correctly classified and identified through the classification model without authorization, thereby preventing the attacker from stealing the parameters of the deep learning model.
  • the classification model with authorization can be a classification model that stores the public key corresponding to the first key and the private key corresponding to the second key, and the classification model without authorization can be a classification model that does not store the corresponding private key of the first key.
  • inputting the adversarial samples into the target classification model to obtain the classification results of the adversarial samples may include the following steps: inputting the adversarial samples into the classification model with authorization ; Obtain image signature information and encrypted classification information from the information replacement area in the adversarial sample; decrypt the image signature information through the public key corresponding to the first key to verify the identity of the inputter of the adversarial sample; if the verification is passed, pass The private key corresponding to the second key decrypts the encrypted classification information to obtain the classification information corresponding to the adversarial example; the classification indicated by the classification information is used as the classification result; the classification indicated by the classification result is the correct classification of the adversarial example.
  • the embodiment shown in FIG. 4 and details are not repeated here.
  • inputting the adversarial sample into the target classification model to obtain the classification result of the adversarial sample may include the following steps: inputting the adversarial sample into the non-authorized
  • the classification model performs deep learning processing on the adversarial samples through the target classification model to obtain the classification results of the adversarial samples; the classification indicated by the classification results is the wrong classification of the adversarial samples.
  • FIG. 3 is a schematic flowchart of a data processing method provided in an embodiment of the present application.
  • the information in the information replacement area of the original image is replaced by the signature disturbance vector and the classification disturbance vector, that is, according to the signature disturbance vector, the classification disturbance vector and the information of the non-information replacement area of the original image (as shown by 310 in Figure 3 shown) to generate the adversarial example shown in 311; input the adversarial example into the authorized classification model as shown in Figure 312, then the correct classification of the adversarial example can be obtained (as shown in 313 in Figure 3), and the adversarial example Input it into the classification model without authorization as shown in FIG. 314 , then the wrong classification of the adversarial example (as shown in 315 in FIG. 3 ) can be obtained.
  • the original image and the classification information corresponding to the original image can be obtained, the image signature information is generated according to the information of the non-information replacement area of the original image by using the first key, and the classification information is encrypted according to the second key, Obtain the encrypted classification information, obtain the perturbed pixel information, and replace the information in the information replacement area according to the image signature information, encrypted classification information and perturbed pixel information, obtain the adversarial sample, and input the adversarial sample into the authorized classification model or the non-authorized one. Classification model to get the corresponding classification results.
  • the adversarial sample can be correctly identified by the authorized classification model while being incorrectly identified by the non-authorized classification model. Preventing attackers from obtaining the model parameters of the classification model with authorization helps to protect the privacy of the classification model with authorization.
  • FIG. 4 is a schematic flowchart of a data processing method provided by an embodiment of the present application, and the method may be executed by the above-mentioned electronic device. The method may include the following steps.
  • S402. Use the first key to generate image signature information according to the information of the non-information replacement area of the original image.
  • steps S401-S404 may refer to steps S101-S104, which are not limited here.
  • the authorized classification model is a classification model that stores the public key corresponding to the first key and the private key corresponding to the second key.
  • obtaining the image signature information and encrypted classification information from the information replacement area in the adversarial example may obtain the image signature information from the signature replacement area, and obtain the encrypted classification information from the classification replacement area.
  • the corresponding pixel value is obtained from the signature replacement area in the information replacement area, and the corresponding pixel value is obtained from the classification replacement area, based on the image signature information and encrypted classification information described in step S404
  • the method for generating the corresponding pixel value converts the obtained pixel value into corresponding image signature information and encrypted classification information. For example, multiple pixel values may be obtained from the signature replacement area, and the multiple pixel values may be converted into corresponding binary numbers, so as to obtain signature image information corresponding to the binary numbers.
  • the corresponding signature image information can be obtained according to multiple pixel values obtained from the classified replacement area, which will not be described here.
  • the signature disturbance vector is generated according to the image signature information and the disturbance pixel information
  • the classification disturbance vector is generated according to the encrypted classification information and the disturbance pixel information.
  • the information of the region corresponding to the first row of pixels is replaced by the signature disturbance vector; the information of the region corresponding to the last row of pixels is replaced by the classification disturbance vector, and the replaced original image is used as an adversarial sample, then the image signature information in the adversarial sample is obtained
  • multiple pixel values can be obtained from the signature replacement area in the first row of pixels, and the multiple pixel values can be converted into corresponding binary numbers, and then the signature image information corresponding to the binary numbers can be obtained.
  • a plurality of pixel values are obtained from the classification replacement area of the last row of pixels, and the plurality of pixel values are converted into corresponding binary numbers, thereby obtaining encrypted classification information corresponding to the binary numbers.
  • the pixel value of the information replacement area can be determined from the target channel in the multi-channel image, and the target channel is the same as the information replacement area in step S104. The information is replaced by the same target channel.
  • verifying the adversarial sample can verify the identity of the signer of the adversarial sample, and can verify whether the input adversarial sample has been tampered with. This is because the signer has the corresponding private key, it is difficult for the attacker to forge the signature of the signer, and the identity of the signer of the adversarial sample can be determined, and because the signature image information represents the information of the non-information replacement area in the image If the information in the non-information replacement area changes, the verification will fail.
  • deciphering the image signature information through the public key corresponding to the first key may include the following steps: decrypting the image signature information through the public key corresponding to the first key to obtain the The first hash function value corresponding to the image signature information; the information of the non-information replacement area in the adversarial sample is hashed to obtain the second hash function value of the adversarial sample, and the first hash function value and the second The hash function values are matched, and if the first hash function value and the second hash function value are the same, it is determined that the adversarial example has passed the verification.
  • the second hash function value obtained by hashing the information in the non-information replacement area in the adversarial example is the same as the first If the value of a hash function is different and the verification fails, it means that the adversarial example may be tampered with.
  • the hash operation algorithm used in the process of generating the image signature information is the same as the hash operation algorithm used in the process of unsigning the image signature information.
  • the ECC algorithm is used to call the first key to encrypt the hash function value when generating the image signature information, then when the signature is decrypted, the ECC encryption algorithm corresponding to the encryption The ECC decryption algorithm calls the first key to decrypt the image signature information.
  • passing the verification may indicate that the identity of the signer of the adversarial sample has not been impersonated, and the information in the non-information replacement area of the adversarial sample has not been tampered with.
  • the classification information is encrypted by calling the second key through the ECC encryption algorithm, then when decrypting the encrypted classification information, the encrypted classification information is decrypted through the ECC decryption algorithm corresponding to the ECC encryption algorithm during encryption.
  • the classification result for the adversarial example is not output.
  • a prompt message can be output to indicate that the adversarial example fails the verification. In this way, the authorized classification model can be prevented from being maliciously attacked, and no corresponding classification result can be obtained for any image that has not passed the verification.
  • the authorized classification model may first obtain the information of the signature replacement area of the image data, so as to determine the identity of the inputter of the image data for verification. If the verification fails, the authorized classification model is used to perform deep learning processing on the input image data. If the image data is an adversarial example that fails the verification, the classification indicated by the classification result is a wrong classification.
  • the classification indicated by the classification result is the correct classification of the adversarial example. This is because the encrypted classification information is generated based on the correct classification, and the classification indicated by the classification information obtained after decrypting the encrypted classification information is the correct classification. Furthermore, the authorized classification model can identify adversarial examples the correct classification.
  • the original image and the classification information corresponding to the original image can be obtained, the image signature information is generated according to the information of the non-information replacement area of the original image by using the first key, and the classification information is encrypted according to the second key, Obtain the encrypted classification information, obtain the perturbed pixel information, and replace the information in the information replacement area according to the image signature information, encrypted classification information and perturbed pixel information, obtain the adversarial sample, input the adversarial sample into the authorized classification model, and pass the adversarial sample Verification and decryption of encrypted classification information to obtain the correct classification of adversarial examples.
  • the adversarial sample can be correctly identified by the authorized classification model while being incorrectly identified by the non-authorized classification model. Preventing attackers from obtaining the model parameters of the classification model with authorization helps to protect the privacy of the classification model with authorization.
  • FIG. 5 is a schematic flowchart of a data processing method provided by an embodiment of the present application, and the method may be executed by the above-mentioned electronic device. The method may include the following steps.
  • S502. Generate image signature information according to the information of the non-information replacement area of the original image by using the first key.
  • steps S501-S504 may refer to steps S101-S104, which is not limited here.
  • the classification indicated by the classification result is a wrong classification of the adversarial example.
  • the classification model without authorization is a classification model that does not store the public key corresponding to the first key and the private key corresponding to the second key.
  • the adversarial samples are processed by deep learning through a classification model without authorization, and the feature matrix corresponding to the image can be obtained by performing feature extraction on the input adversarial samples through the classification model without authorization.
  • the feature matrix determines the probability of the image for each category, and then obtains the category to which the adversarial example belongs, that is, the classification result of the adversarial example.
  • the original image and the classification information corresponding to the original image can be obtained, the image signature information is generated according to the information of the non-information replacement area of the original image by using the first key, and the classification information is encrypted according to the second key, Obtain the encrypted classification information, obtain the disturbed pixel information, and replace the information in the information replacement area according to the image signature information, encrypted classification information and disturbed pixel information to obtain an adversarial sample, input the adversarial sample into a classification model that does not have authorization, and obtain an adversarial sample incorrect classification results.
  • the adversarial sample can be correctly identified by the authorized classification model while being incorrectly identified by the non-authorized classification model. Preventing attackers from obtaining the model parameters of the classification model with authorization helps to protect the privacy of the classification model with authorization.
  • FIG. 6 is a schematic structural diagram of a data processing device provided by an embodiment of the present application.
  • the data processing device may be set in the above-mentioned electronic equipment.
  • the data processing device described in this embodiment may include:
  • the obtaining unit 601 is configured to obtain an original image and classification information corresponding to the original image, the original image includes an information replacement area and a non-information replacement area, and the classification information is used to indicate the correct classification to which the original image belongs ;
  • a processing unit 602 configured to use the first key to generate image signature information according to the information of the non-information replacement area of the original image
  • the processing unit 602 is further configured to encrypt the classified information according to the second key to obtain encrypted classified information;
  • the acquiring unit 601 is further configured to acquire disturbed pixel information
  • the processing unit 602 is further configured to replace the information in the information replacement area according to the image signature information, the encrypted classification information and the disturbed pixel information to obtain an adversarial example;
  • the processing unit 602 is further configured to input the adversarial example into a target classification model to obtain a classification result of the adversarial example.
  • the target classification model is a classification model with authorization or a classification model without authorization, based on the The classification results obtained by the classification model with authorization and the classification model without authorization are different.
  • the first key is a private key
  • the second key is a public key
  • the target classification model is a classification model with authorization
  • the classification model with authorization is stored A classification model of the public key corresponding to the first key and the private key corresponding to the second key
  • the processing unit 602 is specifically configured to:
  • the classification indicated by the classification information is used as the classification result; the classification indicated by the classification result is the correct classification of the adversarial example.
  • the target classification model is a classification model without authorization; the processing unit 602 is specifically configured to:
  • the information replacement area includes a disturbance replacement area; the processing unit 602 is further configured to:
  • the disturbance generation image including the disturbance replacement area, and corresponding actual classification information associated with the disturbance generation image
  • the information of the modified disturbance replacement area is determined as disturbance pixel information.
  • processing unit 602 is specifically configured to:
  • the information replacement area includes an area corresponding to the first row of pixels of the original image and an area corresponding to the last row of pixels; the processing unit 602 is specifically configured to:
  • the information of the area corresponding to the last row of pixels is replaced by the classification disturbance vector.
  • the original image is an image including multiple channels, and the multiple channels include a target channel;
  • the processing unit 602 is specifically configured to:
  • the information of the target channel in the information replacement area is replaced according to the image signature information, the encrypted classification information and the perturbed pixel information to obtain an adversarial example.
  • the original image and the classification information corresponding to the original image can be obtained, the image signature information is generated according to the information of the non-information replacement area of the original image by using the first key, and the classification information is encrypted according to the second key, Obtain the encrypted classification information, obtain the perturbed pixel information, and replace the information in the information replacement area according to the image signature information, encrypted classification information and perturbed pixel information, obtain the adversarial sample, and input the adversarial sample into the authorized classification model or the non-authorized one. Classification model to get the corresponding classification results.
  • the adversarial sample can be correctly identified by the authorized classification model while being incorrectly identified by the non-authorized classification model. Preventing attackers from obtaining the model parameters of the classification model with authorization helps to protect the privacy of the classification model with authorization.
  • FIG. 7 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the electronic device described in this embodiment includes: a processor 701 and a memory 702 .
  • the electronic device may further include structures such as a network interface 703 or a power supply module. Data may be exchanged among the processor 701, the memory 702, and the network interface 703.
  • the above-mentioned processor 701 may be a central processing unit (Central Processing Unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC) ), off-the-shelf programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the above-mentioned network interface 703 may include an input device and/or an output device.
  • the input device may be a control panel, a microphone, a receiver, etc.
  • the output device may be a display screen, a transmitter, etc., which are not listed here.
  • the network interface may include a receiver and a transmitter.
  • the above-mentioned memory 702 may include a read-only memory and a random access memory, and provides program instructions and data to the processor 701 .
  • a portion of memory 702 may also include non-volatile random access memory.
  • the original image includes an information replacement area and a non-information replacement area
  • the classification information is used to indicate the correct classification to which the original image belongs
  • the target classification model is a classification model with authorization or a classification model without authorization, based on the classification model with authorization and the non-authorized classification model Classification models with authorization get different classification results.
  • the first key is a private key
  • the second key is a public key
  • the target classification model is a classification model with authorization
  • the classification model with authorization is stored A classification model of the public key corresponding to the first key and the private key corresponding to the second key
  • the processor 701 is specifically used for:
  • the classification indicated by the classification information is used as the classification result; the classification indicated by the classification result is the correct classification of the adversarial example.
  • the target classification model is a classification model without authorization; the processor 701 is specifically configured to:
  • the information replacement area includes a disturbance replacement area; the processor 701 is further configured to:
  • the disturbance generation image including the disturbance replacement area, and corresponding actual classification information associated with the disturbance generation image
  • the information of the modified disturbance replacement area is determined as disturbance pixel information.
  • the processor 701 is specifically configured to:
  • the information replacement area includes an area corresponding to the first row of pixels of the original image and an area corresponding to the last row of pixels; the processor 701 is specifically configured to:
  • the information of the area corresponding to the last row of pixels is replaced by the classification disturbance vector.
  • the original image is an image including multiple channels, and the multiple channels include a target channel;
  • the processor 701 is specifically configured to:
  • the information of the target channel in the information replacement area is replaced according to the image signature information, the encrypted classification information and the perturbed pixel information to obtain an adversarial example.
  • the original image and the classification information corresponding to the original image can be obtained, the image signature information is generated according to the information of the non-information replacement area of the original image by using the first key, and the classification information is encrypted according to the second key, Obtain the encrypted classification information, obtain the perturbed pixel information, and replace the information in the information replacement area according to the image signature information, encrypted classification information and perturbed pixel information, obtain the adversarial sample, and input the adversarial sample into the authorized classification model or the non-authorized one. Classification model to get the corresponding classification results.
  • the adversarial sample can be correctly identified by the authorized classification model while being incorrectly identified by the non-authorized classification model. Preventing attackers from obtaining the model parameters of the classification model with authorization helps to protect the privacy of the classification model with authorization.
  • the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when executed by a processor, the program instructions cause the processor to perform the above-mentioned
  • the method such as executing the method performed by the above-mentioned electronic device, will not be described in detail here.
  • the storage medium involved in this application such as a computer-readable storage medium, may be non-volatile or volatile.
  • the embodiment of the present application also provides a computer program product or computer program, where the computer program product or computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps performed in the embodiments of the above methods.
  • the computer device may be a terminal, or may be a server.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Artificial Intelligence (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Biology (AREA)
  • Evolutionary Computation (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Image Processing (AREA)

Abstract

一种数据处理方法、装置、电子设备以及存储介质，涉及人工智能技术领域。该方法可以包括：获取原始图像以及对应的分类信息(S101)，利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息(S102)；根据第二密钥对分类信息进行加密处理，得到加密分类信息(S103)；获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本(S104)，将对抗样本输入具有授权的分类模型或不具有授权的分类模型，得到对应的分类结果(S105)。所述方法有助于保护具有授权的分类模型的隐私，还可以应用于区块链领域，将得到的对抗样本存储至区块链。

Description

一种数据处理方法、装置、电子设备以及存储介质
优先权申明
本申请要求于2021年10月22日提交中国专利局、申请号为202111237983.7，发明名称为“一种数据处理方法、装置、电子设备以及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及人工智能技术领域，尤其涉及一种数据处理方法、装置、电子设备以及存储介质。
背景技术
在深度学习技术的发展过程中需要解决很多安全性问题，其中，针对深度学习模型的模型参数的隐私保护是安全性问题研究的热门方向之一。通常，攻击者可以通过获取输入的分类模型的数据以及对应的分类结果，推测出该分类模型的模型参数，若分类模型的模型参数被攻击者获取，则攻击者可以基于窃取的模型参数调用白盒攻击模型生成用于攻击分类模型的数据。因此，发明人意识到如何防止分类模型的模型参数的泄露是一个亟待解决的问题。
发明内容
本申请实施例提供了一种数据处理方法、装置、电子设备以及存储介质，有助于保护具有授权的分类模型的隐私。
一方面，本申请实施例公开了一种数据处理方法，所述方法包括：
获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像签名信息；
根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
获取扰动像素信息，并根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
另一方面，本申请实施例公开了一种数据处理装置，所述装置包括：
获取单元，用于获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
处理单元，用于利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像 签名信息；
所述处理单元，还用于根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
所述获取单元，还用于获取扰动像素信息；
所述处理单元，还用于根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
所述处理单元，还用于将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
又一方面，本申请实施例提供了一种电子设备，电子设备包括处理器、存储器，其中，所述存储器用于存储计算机程序，所述计算机程序包括程序指令，所述处理器被配置用于执行如下步骤：
获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像签名信息；
根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
获取扰动像素信息，并根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
又一方面，本申请实施例提供了一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序指令，计算机程序指令被处理器执行时，用于执行如下步骤：
获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像签名信息；
根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
获取扰动像素信息，并根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
又一方面，本申请实施例公开了一种计算机程序产品或计算机程序，所述计算机程序产品或计算机程序包括计算机指令，所述计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取所述计算机指令，处理器执行所述计算机指令，使得所述计算机设备执行上述数据处理方法。
本申请实施例中，能够获取原始图像以及原始图像对应的分类信息，利用第一密钥根据 原始图像的非信息替换区域的信息生成图像签名信息，根据第二密钥对分类信息进行加密处理，得到加密分类信息，获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，将对抗样本输入具有授权的分类模型或不具有授权的分类模型，得到对应的分类结果。通过在原始图像中嵌入图像签名信息以及加密分类信息以及扰动信息得到对抗样本，可以使得对抗样本在能够被具有授权的分类模型正确识别的同时，被不具有授权的分类模型识别错误，由此可以避免攻击者获取具有授权的分类模型的模型参数，有助于保护具有授权的分类模型的隐私。
附图说明
为了更清楚地说明本申请实施例技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种数据处理方法的流程示意图；
图2是本申请实施例提供的一种对抗样本的效果示意图；
图3是本申请实施例提供的一种数据处理方法的流程示意图；
图4是本申请实施例提供的一种数据处理方法的流程示意图；
图5是本申请实施例提供的一种数据处理方法的流程示意图；
图6是本申请实施例提供的一种数据处理装置的结构示意图；
图7是本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请提供一种数据处理方案，能够获取原始图像以及原始图像对应的分类信息，利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息，根据第二密钥对分类信息进行加密处理，得到加密分类信息，获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，将对抗样本输入具有授权的分类模型或不具有授权的分类模型，得到对应的分类结果。通过在原始图像中嵌入图像签名信息以及加密分类信息以及扰动信息得到对抗样本，可以使得对抗样本在能够被具有授权的分类模型正确识别的同时，被不具有授权的分类模型识别错误，由此可以避免攻击者获取具有授权的分类模型的模型参数，有助于保护具有授权的分类模型的隐私。
本申请的技术方案可运用在电子设备中，该电子设备可以是终端，也可以是服务器，本申请不做限定。本申请可用于众多通用或专用的计算机系统环境或配置中。例如：个人计算机、服务器计算机、手持设备或便携式设备、平板型设备、多处理器系统、基于微处理器的系统、置顶盒、可编程的消费电子设备、网络PC、小型计算机、大型计算机、包括以上任何 系统或设备的分布式计算环境等等。本申请可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本申请，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
在一种可能的实施方式中，本申请实施例可以应用于人工智能领域，例如可以基于人工智能技术对对抗样本进行时深度学习处理得到对抗样本的分类结果。其中，人工智能(Artificial Intelligence，AI)是利用数字计算机或者数字计算机控制的机器模拟、延伸和扩展人的智能，感知环境、获取知识并使用知识获得最佳结果的理论、方法、技术及应用系统。人工智能基础技术一般包括如传感器、专用人工智能芯片、云计算、分布式存储、大数据处理技术、操作/交互系统、机电一体化等技术。人工智能软件技术主要包括计算机视觉技术、机器人技术、生物识别技术、语音处理技术、自然语言处理技术以及机器学习/深度学习等几大方向。
基于上述的描述，本申请实施例提出一种数据处理方法。请参见图1，图1是本申请实施例提供的一种数据处理方法的流程示意图。该方法可以由上述所提及的电子设备执行。该方法可以包括以下步骤。
S101、获取原始图像以及原始图像对应的分类信息。
其中，原始图像包括信息替换区域和非信息替换区域，该信息替换区域可以为原始图像中用于进行信息替换的区域，该非信息替换区域可以为原始图像中不用于进行信息替换的区域。
可选的，该信息替换区域可以为原始图像中任意N行像素所对应的区域。可以理解的是，信息替换区域越小，后续需要进行替换的数据越少，则获取对抗样本的效率越高，例如，该信息替换区域可以为原始图像中的任意两行像素所对应的区域。
在一种可能的实施方式中，该信息替换区域可以为原始图像中的首行像素以及尾行像素所对应的区域，非信息替换区域即为除去首行像素以及尾行像素的区域。由此可以使得信息替换对原始图像的影响较小，人眼很难感觉到信息的替换，并且可以快速确定出信息替换区域的位置，提升信息替换的效率。
该分类信息用于指示原始图像的所属的正确的分类。可选的，该分类信息可以表示为分类的文本信息，或者可以为分类的分类编码信息等等，此处不做限制。可选的，若原始图像所属的正确的分类有多个，则该分类信息可以包括原始图像所属的多个正确的分类。例如，对原始图像的分类用于指示原始图像所包括的动物有哪些，则可以该分类信息可以用于指示原始图像中所包括的动物，若原始包含多个动物，则该分类信息中可以用于指示原始图像中的所包括的多个动物。
S102、利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息。
其中，该第一密钥可以为用于生成图像签名信息时所使用的私钥。该图像签名信息可以为对原始图像的非信息替换区域的信息通过第一密钥进行签名后得到的签名信息。可选的， 该原始图像的非信息替换区域的信息可以为原始图像非信息替换区域中的各个像素的像素值。
在一种可能的实施方式中，利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息，可以包括以下步骤：对原始图像中的非信息替换区域的信息进行哈希运算，得到针对原始图像的哈希函数值；通过第一密钥对哈希函数值进行加密处理，得到针对原始图像的图像签名信息。其中，哈希运算，也称hash运算、散列运算，就是把任意长度的输入，通过哈希算法，变成固定长度的输出，该输出就是哈希(散列)值，这个映射函数叫做哈希(散列)函数。此处通过对原始图像中的信息替换区域的信息进行哈希运算，得到固定长度的哈希函数值。该哈希函数值可以为对原始图像中的信息替换区域的信息进行哈希运算后得到的值，该哈希函数值也可以称为哈希值、hash值、散列值等等，此处不做限制。例如，可以通过MD5算法对原始图像中的信息替换区域的信息进行哈希运算，MD5(Message-Digest Algorithm 5，信息-摘要算法5)可以用于确保信息传输完整一致，(又译摘要算法、哈希算法、Hash算法)。如果对一段信息进行哈希运算，哪怕只更改该信息中的一个数字，哈希运算都将产生不同的值，要找到散列为同一个值的两个不同的输入，在计算上是不可能的，所以数据的哈希函数值可以检验数据的完整性，以防止数据被篡改。
在一种可能的实施方式中，通过第一密钥进行对哈希函数值进行加密处理可以通过椭圆曲线加密算法(Elliptic curve cryptography，简称ECC)进行加密。其中，ECC是一种公钥加密体制。通常通过ECC加密算法进行加密处理可以包括以下步骤：获取第一密钥，并对通过ECC算法调用第一密钥对原始图像中的非替换区域的信息的哈希函数值进行处理，得到图像签名信息。可选的，在获取第一密钥时，还可以生成针对第一密钥的公钥，以便于后续接收端在接收到图像签名信息和第一密钥的公钥后通过第一密钥的公钥对图像签名信息进行验证。
可以理解的是，通过第一密钥生成图像签名信息可以使数据接收方验证接收到的数据是由签名者发出的，而不是其他端，从而整个过程就保证了从签名者到接收方的唯一确认。也就是说，A的签名信息只有A在签名时使用的私钥(如第一密钥)对应的公钥才能解签，当B在接收到A发送的数据以及签名信息时，B利用签名时的私钥所对应的公钥就能确认这个信息是A发来的。
S103、根据第二密钥对分类信息进行加密处理，得到加密分类信息。
其中，该第二密钥可以为用于生成加密分类信息时所使用的公钥。该加密分类信息可以为对分类信息通过第二密钥进行加密后得到的签名信息，该加密分类信息也可称为分类信息的密文信息。可以理解的是，仅有第二密钥的私钥的持有者才能通过第二密钥的私钥对加密分类信息进行解密，以获取原始图像的分类信息。也就是说，A的加密信息只有A在加密时使用的公钥(即第二密钥)对应的私钥才能解密，当B在接收到A发送的加密信息时，B利用第二密钥所对应的私钥就能对该加密信息(如加密分类信息)进行解密，得到加密信息所对应的明文信息，由此可以避免信息泄露。
在一种可能的实施方式中，对根据第二密钥对分类信息进行加密处理，可以为通过ECC 加密算法基于第二密钥对分类信息进行加密处理。
可以理解的是，通过第二密钥生成加密分类信息，可以持有加密时所用的公钥所对应的私钥的接收方则可以通过该加密时所用的公钥对加密分类信息进行解密，并且没有加密时所用的公钥所对应的私钥的对象即使获取了该加密分类信息，也无法确定出具体的内容，由此保护了分类信息的隐私性。
S104、获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本。
其中，扰动像素信息可以使得添加了扰动像素信息的原始图像被测试分类模型分类错误。该测试分类模型可以为用于测试扰动像素信息能否使分类模型对添加了扰动像素信息的原始图像分类错误的模型，若添加了扰动像素信息的原始图像可以使得测试分类模型分类错误，则该添加了扰动像素信息的原始图像也可以使得其他分类模型分类错误。可选的，该测试分类模型可以是多分类模型，也可以是多标签单分类模型，也可以是二分类模型，此处不做限制。
在一种可能的实施方式中，该信息替换区域中可以包括扰动替换区域，该扰动替换区域可以为信息替换区域中用于替换为扰动像素信息的的区域。也就是说，该扰动替换区域为信息替换区域中的部分区域。可选的，若信息替换区域为首行像素以及尾行像素所对应的区域，则该扰动替换区域可以为首行像素所对应的区域中的部分区域，以及尾行像素所对应的区域中的部分区域。例如，该扰动替换区域可以为首行像素以及尾行像素中的最后K个像素所对应的区域。
在一种可能的实施方式中，在获取扰动像素信息之前，需要生成扰动像素信息。生成扰动像素信息可以包括以下步骤：获取扰动生成图像，扰动生成图像中包括扰动替换区域，扰动生成图像关联有对应的实际分类信息；将扰动生成图像中的扰动替换区域的信息进行修改，并将修改后的扰动生成图像输入测试分类模型进行处理，得到的预测分类结果；若预测分类结果所指示的分类与实际分类信息所指示的分类不同，则将修改后的扰动替换区域的信息确定为扰动像素信息。
其中，该扰动生成图像可以为用于生成扰动像素信息的图像，扰动生成图像可以为上述原始图像，也可以不为上述原始图像的其他图像，此处不做限制。可以理解的是，该扰动生成图像中可以包括扰动替换区域，该扰动生成图像中的扰动替换区域即为上述原始图像中的扰动替换区域。该实际分类信息可以为扰动生成图像实际所属的分类，例如，测试分类模型用于对输入的图像中的动物进行分类，则该实际分类信息可以指示扰动生成图像中的内容所属的一种或多种动物。该预测分类结果可以为将修改后的扰动像素图像输入测试分类模型进行深度学习处理后得到的分类结果，该预测分类结果可以指示通过测试分类模型对修改后的扰动生成图像预测的分类。
将扰动生成图像中的扰动替换区域的信息进行修改，可以为将扰动替换区域的像素值进行修改。例如，可以将扰动生成图像中的扰动替换区域的第一像素的像素值修改为另一像素值，该第一像素可以为扰动替换区域中的任一像素。若修改后的扰动生成图像在输入测试分 类模型后，则可以通过测试分类模型对修改后的扰动生成图像进行深度学习处理，由此可以得到针对修改后的扰动生成图像的预测分类结果。
若预测分类结果所指示的分类与实际分类信息所指示的分类不同，则说明该修改后的扰动替换区域的信息可以使测试分类模型分类错误，则将修改后的扰动替换区域的信息确定为扰动像素信息。若预测分类结果所指示的分类与实际分类信息所指示的分类相同，则说明该修改后的扰动替换区域的信息不能使测试分类模型分类错误，则不能将修改后的扰动替换区域的信息确定为扰动像素信息，进而可以再次对扰动替换区域的第一像素的像素值进行修改，并将修改后的扰动生成图像输入测试分类模型以得到新的预测分类结果，若新的预测分类结果所指示的分类与实际分类信息所指示的分类不同，则将修改后的扰动替换区域的信息确定为扰动像素信息，否则再次对扰动替换区域的信息进行修改，以此类推。若对第一像素的像素值修改为任一像素值均无法使得预测分类结果所指示的分类与实际分类信息所指示的分类不同，则可以确定第二像素，该第二像素可以为像素扰动区域中除第一像素外的任一像素，进而对第一像素与第二像素均进行修改，由此进行迭代处理，直至修改后的扰动生成图像能够使得测试分类模型分类错误。
可选的，在对扰动替换区域的信息进行修改的过程中，可以按照一定修改规则对扰动替换区域的像素值进行修改。例如，可以先从扰动替换区域确定一个像素，对该像素的像素值增加或减少的值从小到大顺序进行修改，如确定的像素的像素值为57，则可以将该像素值修改为56或58，再修改为55或59，一次类推，此处不做限制。若对一个像素的像素值的修改不能使修改后的扰动生成图像被测试分类模型分类错误，则可以再次确定一个像素，也就是对两个像素的像素值进行修改，以此类推，直至修改后的扰动生成图像能够使得测试分类模型分类错误。可选的，在从扰动替换区域确定像素时可以从扰动替换区域中随机选择一个像素，也可以从左至右(或从右至左)依次进行选择，此处不做限制。
可选的，还可以将将修改后的扰动生成图像输入多个测试分类模型，得到针对每个测试分类模型的预测分类结果，若每个预测分类模型的预测分类结果所指示的分类与实际分类信息所指示的分类均不相同，则将修改后的扰动替换区域的信息确定为扰动像素信息。由此可以确保生成的扰动像素信息可以适用于多种分类模型，以便于生成的对抗样本可以使更多不具有授权的分类模型分类错误。
可选的，若扰动生成图像为上述原始图像，则可以通过对原始图像的像素扰动区域的像素值进行修改，以得到能够使原始图像被测试分类模型分类错误的扰动像素信息。若扰动生成图像不为上述原始图像，则可以获取多个不为原始图像的扰动生成图像，对每个扰动生成图像的扰动替换区域的信息做相同的修改，由此找到使得各个修改后的扰动生成图像被测试分类模型分类错误的修改方式，并将修改后的扰动替换区域的信息作为扰动像素信息，若将扰动像素信息添加至原始图像的扰动替换区域，并通过测试分类模型对添加了扰动像素信息的原始图像进行分类，则该测试分类模型对添加了扰动像素信息的原始图像分类错误。
其中，该对抗样本可以为使得不具有授权的分类模型对对抗样本分类错误的图像，并且该对抗样本还可以使得具有授权的分类模型对对抗样本分类正确。可以理解的是，该对抗样 本是对原始图像中的信息替换区域中的信息进行替换后得到的图像，该对抗样本实际所属的分类与原始图像所属的分类相同。若信息替换区域较小位置较为隐蔽，则人眼通常不能分辨对抗样本与原始图像的区别。其中，该具有授权的分类模型可以为存储有第一密钥对应的公钥，以及第二密钥对应的私钥的分类模型，该具有授权的分类模型与测试分类模型的能够识别的分类相同，该不具有授权的分类模型可以为未存储有第一密钥对应的公钥或第二密钥对应的私钥的分类模型。
在一种可能的实施方式中，根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，可以为将图像签名信息替换至原始图像的信息替换区域中的签名替换区域，将加密分类信息替换至原始图像的信息替换区域中的分类替换区域，并将扰动像素信息替换至原始图像的信息替换区域中的扰动替换区域。其中，该签名替换区域可以为信息替换区域中用于替换图像签名信息的区域，该分类替换区域可以为信息替换区域中用于替换加密分类信息的区域。可以理解的是，该签名替换区域、分类替换区域以及扰动替换区域所对应的区域不重复。该对抗样本包括与原始图像相同的信息替换区域、扰动替换区域、签名替换区域、分类替换区域。
在一种可能的实施方式中，若上述原始图像为单通道图像，如灰度图像，单通道原始图像中的每个像素均只对应一个像素值。则直接根据图像签名信息、加密分类信息和扰动像素信息对单通道的原始图像中信息替换区域的各个像素的像素值进行替换。
在一种可能的实施方式中，若上述原始图像为包括多个通道的图像，该多个通道中包括目标通道，该目标通道为该多个通道中的任一通道。那么，根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，可以为根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的目标通道的信息进行替换，得到对抗样本。其中，该包括多个通道的图像也称多通道图像，如RGB图像，多通道原始图像中的每个像素的每个通道均对应一个像素值。则根据图像签名信息、加密分类信息和扰动像素信息，对多通道的原始图像中信息替换区域的各个像素的像素值进行替换时，可以替换多个通道中同一个通道(即目标通道)的像素值，例如均替换各个像素的R通道的的像素值。由此可以使得信息替换的效率更快，且后续能更快捷地确定对抗样本中的图像签名信息以及加密分类信息。
可选的，将图像签名信息以及加密分类信息替换至原始图像的信息替换区域时，可以通过一定转换规则将图像签名信息以及加密分类信息所对应的文字信息分别转换为对应的二进制数字，再将二进制数字中的数字转换为像素值，并将得到的像素值替换至原始图像的信息替换区域中。例如，原始图像需要进行替换的通道的每个像素值的取值范围为0-255，即每个像素值可以用8位二进制进行表示，则可以将图像签名信息以及加密分类信息分别对应的二进制数字中，相邻的8位二进制数字(或者其他位数的二进制数字，如4位、2位等等)作为一个像素值，如图像签名信息可以转换为二进制数字“1001 1001 0101 0010”，该二进制数字以一共有16位，可以将前8位二进制作为一个像素值，即“1001 1001”转换为10进制即为153，将后8位二进制作为一个像素值，即“0101 0010”转换为10进制即为84，由此可以得到图像 签名信息在替换至信息替换区域时，替换后的像素的像素值为153和84。
在一种可能的实施方式中，根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，还可以包括以下步骤：根据图像签名信息与扰动像素信息生成签名扰动向量；根据加密分类信息与扰动像素信息生成分类扰动向量；利用签名扰动向量与分类扰动向量替换信息替换区域的信息，将替换后的原始图像作为对抗样本。其中，该签名扰动向量可以为根据图像签名信息以及扰动像素信息生成的向量，该签名扰动向量中每个数值均可以为对信息替换区域进行替换时的像素值。该分类扰动向量可以为根据图像签名信息以及扰动像素信息生成的向量，该签名扰动向量中每个数值均可以为对信息替换区域进行替换时的像素值。
可以理解的是，通过签名扰动向量与分类扰动向量替换信息替换区域的信息时，该信息替换区域应为原始图像中的任意两行像素所对应的区域，一行像素替换为签名扰动向量，一行像素替换为分类扰动向量。其中，该两行像素中，用于替换为签名扰动向量中的图像签名信息所对应的像素值的区域，也就是上述签名替换区域；用于替换为分类扰动向量中的加密分类信息所对应的像素值的区域，也就是上述分类替换区域；用于替换为分类扰动向量以及分类扰动向量中的扰动像素信息的区域，也就是上述扰动替换区域。由此可以使得签名替换区域、分类替换区域中的位置较为连续，在获取图像签名信息以及加密分类信息时，能够更快地确定出图像签名信息以及加密分类信息对应的像素值。
在一种可能的实施方式中，在通过签名扰动向量与分类扰动向量对原始图像中的信息替换区域的信息进行替换时在生成签名扰动向量时，可以将图像签名信息转换为至少一个像素值，并将图像签名信息所对应的至少一个像素值与扰动像素信息所对应的像素值拼接得到签名扰动向量。例如，图像签名信息转换为至少一个像素值后，可以为(153，84，79，56)，扰动像素信息可以为(52，56，85，14)，则获取的签名扰动向量可以直接由图像签名信息与扰动像素信息拼接得到，如可以为(153，84，79，56，52，56，85，14)。同理，在生成分类扰动向量时，可以将加密分类信息转换为至少一个像素值，并将加密分类信息所对应的至少一个像素值与扰动像素信息所对应的像素值拼接得到分类扰动向量，进而可以将签名扰动向量以及分类扰动向量中的每个数值对信息替换区域中的像素值一一替换。
在一种可能的实施方式中，原始图像为包括多个通道的图像，多个通道中包括目标通道，该目标通道可以为原始图像所包括的多个通道中的任一通道，则利用签名扰动向量与分类扰动向量替换信息替换区域的信息，可以为，利用签名扰动向量与分类扰动向量替换信息替换区域所对应的目标通道的信息。也就是说，原始图像为多通道图像时，可以对信息替换区域中同一通道的信息进行替换，得到的对抗样本也为多通道的图像，且该对抗样本中的多个通道中的目标通道的信息替换区域的像素值被替换，由此可以使得信息替换的效率更快，且后续能更快捷地确定对抗样本中的图像签名信息以及加密分类信息。
在一种可能的实施方式中，若信息替换区域包括原始图像的首行像素所对应的区域以及尾行像素所对应的区域，则利用签名扰动向量与分类扰动向量替换信息替换区域的信息，可以包括以下步骤：将首行像素所对应的区域的信息替换为签名扰动向量；将尾行像素所对应 的区域的信息替换为分类扰动向量。其中，该首行像素可以为多个像素，每个像素的像素值可以替换为签名扰动向量中的数值，该尾行像素可以为多个像素，每个像素的像素值可以替换为分类扰动向量中的数值。首行像素(或尾行像素)的像素数量与签名扰动向量(或分类扰动向量)中数值的数量相同。
例如，请参见图2，图2是本申请实施例提供的一种对抗样本的效果示意图。如图2中的(1)所示为10*10像素的单通道的原始图像，该原始图像中每个像素均具有对应的一个像素值。该原始图像的首行像素以及尾行像素所对应的区域为信息替换区域。该信息替换区域中的首行像素用于替换为签名扰动向量，尾行像素用于替换为分类扰动向量。若签名扰动向量为(153，84，79，56，52，56，85，14，58，63)，其中，前5个数值为图像签名信息所对应的像素值，后5个数值为扰动像素信息中的像素值；若分类扰动向量为(123，45，24，56，32，56，85，14，58，63)，其中，前5个数值为加密分类信息所对应的像素值，后5个数值为扰动像素信息中的像素值。通过签名扰动向量以及分类扰动向量对首行像素以及尾行像素分别替换之后，可以得到如图2中的(2)所示的对抗样本，该对抗样本的大小也为10*10像素，该对抗样本的首行像素的像素值被替换为签名扰动向量中的数值，尾行像素的像素值被替换为分类扰动向量中的数值，则该对抗样本中，如图2中的201所示为签名替换区域，如图2中的202所示为分类替换区域。
在一种可能的实施方式中，若信息替换区域包括原始图像的首行像素所对应的区域以及尾行像素所对应的区域，则利用签名扰动向量与分类扰动向量替换信息替换区域的信息，还可以包括以下步骤：将首行像素所对应的区域的信息替换为分类扰动向量；将尾行像素所对应的区域的信息替换为签名扰动向量。
S105、将对抗样本输入目标分类模型，得到对抗样本的分类结果。
其中，目标分类模型可以为具有授权的分类模型或不具有授权的分类模型，基于具有授权的分类模型和不具有授权的分类模型得到的分类结果不同。可以理解的是，基于具有授权的分类模型得到的分类结果所指示的分类为对抗样本所属的正确的分类，基于不具有授权的分类模型得到的分类结果所指示的分类为对抗样本所属的错误的分类。可以理解的是，对抗样本输入具有授权的分类模型与不具有授权的分类模型可以得到不同的分类结果可以称为对抗样本具有可特定识别性，仅有具有授权的分类模型才能识别到对抗样本正确的结果；并且具有授权的分类模型可以分辨出对抗样本是否被攻击者恶意篡改，不对篡改后的图像进行识别，以使得具有授权的分类模型得到的分类结果为未被篡改的对抗样本所属的分类；并且，即使有攻击者获取到该对抗样本，也无法通过不具有授权的分类模型对对抗样本进行正确的分类识别，由此可以避免攻击者窃取深度学习模型参数。
该具有授权的分类模型可以为存储有第一密钥对应的公钥，以及第二密钥对应的私钥的分类模型，该不具有授权的分类模型可以为未存储有第一密钥对应的公钥或第二密钥对应的私钥的分类模型。
在一种可能的实施方式中，若目标分类模型为具有授权的分类模型，则将对抗样本输入目标分类模型，得到对抗样本的分类结果，可以包括以下步骤：将对抗样本输入具有授权的 分类模型；从对抗样本中的信息替换区域获取图像签名信息以及加密分类信息；通过第一密钥对应的公钥对图像签名信息进行解密，以验证对抗样本的输入者的身份；若验证通过，则通过第二密钥对应的私钥对加密分类信息进行解密，得到对抗样本对应的分类信息；将分类信息所指示的分类作为分类结果；分类结果所指示的分类为对抗样本的正确的分类。具体描述可以参照图4所示实施例的相关描述，此处不做赘述。
在一种可能的实施方式中，若目标分类模型为不具有授权的分类模型，则将对抗样本输入目标分类模型，得到对抗样本的分类结果，可以包括以下步骤：将对抗样本输入不具有授权的分类模型，通过目标分类模型对对抗样本进行深度学习处理，得到对抗样本的分类结果；分类结果所指示的分类为对抗样本的错误的分类。具体描述可以参照图5所示实施例的相关描述，此处不做赘述。
例如，请参见图3，图3是本申请实施例提供的一种数据处理方法的流程示意图。如图3所示的流程中，首先获取原始图像(如图3中的301所示)以及原始图像对应的分类信息(如图3中的302所示)，然后对非信息替换区域的信息进行哈希运算，得到哈希函数值(如图3中的303所示)，并对哈希函数值进行加密处理(如图3中的304所示)，由此得到305所示的图像签名信息；并且，对分类信息进行加密处理(如图3中的306所示)，由此得到307所示的加密分类信息；进而根据图像签名信息以及扰动像素信息得到签名扰动向量(如图3中的308所示)，并根据加密分类信息以及扰动像素信息得到分类扰动向量(如图3中的309所示)。然后通过签名扰动向量以及分类扰动向量对原始图像的信息替换区域中的信息进行替换，也就是根据签名扰动向量以及分类扰动向量以及原始图像的非信息替换区域的信息(如图3中的310所示)生成311所示的对抗样本；将对抗样本输入如图312所示的具有授权的分类模型中，则可以得到对抗样本的正确的分类(如图3中的313所示)，将对抗样本输入如图314所示的不具有授权的分类模型中，则可以得到对抗样本的错误的分类(如图3中的315所示)。
本申请实施例中，能够获取原始图像以及原始图像对应的分类信息，利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息，根据第二密钥对分类信息进行加密处理，得到加密分类信息，获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，将对抗样本输入具有授权的分类模型或不具有授权的分类模型，得到对应的分类结果。通过在原始图像中嵌入图像签名信息以及加密分类信息以及扰动信息得到对抗样本，可以使得对抗样本在能够被具有授权的分类模型正确识别的同时，被不具有授权的分类模型识别错误，由此可以避免攻击者获取具有授权的分类模型的模型参数，有助于保护具有授权的分类模型的隐私。
请参见图4，图4是本申请实施例提供的一种数据处理方法的流程示意图，该方法可由上述电子设备执行。该方法可以包括以下步骤。
S401、获取原始图像以及原始图像对应的分类信息。
S402、利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息。
S403、根据第二密钥对分类信息进行加密处理，得到加密分类信息。
S404、获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本。
其中，步骤S401-S404可以参照步骤S101-S104，此处不做限制。
S405、将对抗样本输入具有授权的分类模型。
其中，该具有授权的分类模型为存储有第一密钥对应的公钥以及第二密钥对应的私钥的分类模型。
S406、从对抗样本中的信息替换区域获取图像签名信息以及加密分类信息。
其中，从对抗样本中的信息替换区域获取图像签名信息以及加密分类信息可以从签名替换区域中获取图像签名信息，以及从分类替换区域中获取加密分类信息。
在一种可能的实施方式中，从信息替换区域中的签名替换区域获取对应的像素值，并从分类替换区域获取对应的像素值，基于步骤S404中所描述的根据图像签名信息以及加密分类信息生成对应的像素值的方法，将获取到的像素值转换为对应的图像签名信息以及加密分类信息。例如，可以从签名替换区域中获取的多个像素值，并将该多个像素值转换为对应的二进制数字，进而得到该二进制数字对应的签名图像信息。同理，可以根据从分类替换区域中获取的多个像素值，得到对应的签名图像信息，此处不做赘述。
在一种可能的实施方式中，根据步骤S404中的对信息替换区域中的信息替换时根据图像签名信息与扰动像素信息生成签名扰动向量，根据加密分类信息与扰动像素信息生成分类扰动向量，将首行像素所对应的区域的信息替换为签名扰动向量；将尾行像素所对应的区域的信息替换为分类扰动向量，将替换后的原始图像作为对抗样本，则在获取对抗样本中的图像签名信息以及加密分类信息时，可以从首行像素中的签名替换区域中获取多个像素值，并将该多个像素值转换为对应的二进制数字，进而得到该二进制数字对应的签名图像信息。从尾行像素的分类替换区域中获取多个像素值，并将该多个像素值转换为对应的二进制数字，进而得到该二进制数字对应的加密分类信息。
在一种可能的实施方式中，若该对抗样本为多通道图像，则可以从该多通道图像中的目标通道中确定出信息替换区域的像素值，该目标通道与步骤S104中对信息替换区域的信息进行替换的目标通道相同。
S407、通过第一密钥对应的公钥对图像签名信息进行解签处理，以对对抗样本进行验证。
其中，对对抗样本进行验证可以验证该对抗样本的签名者的身份，并且可以验证输入的对抗样本是否被篡改。这是由于签名者具有对应的私钥，攻击者很难冒充签名者的签名，则可以确定该对抗样本的签名者的身份，并且，因为签名图像信息代表了图像中的非信息替换区域的信息的特征，非信息替换区域的信息如果发生改变，则验证不能通过。
在一种考可能的实施方式中，通过第一密钥对应的公钥对图像签名信息进行解签可以包括以下步骤：通过第一密钥对应的公钥对图像签名信息进行解密处理，得到该图像签名信息所对应的第一哈希函数值；对对抗样本中的非信息替换区域的信息进行哈希运算，得到对抗样本的第二哈希函数值，对第一哈希函数值以及第二哈希函数值进行匹配，若第一哈希函数值以及第二哈希函数值相同，则确定该对抗样本验证通过。可以理解的是，若非信息替换区 域中的信息被篡改，即使只改变了一个数字，通过对对抗样本中的对非信息替换区域中的信息进行哈希运算得到的第二哈希函数值与第一哈希函数值不同，进而导致验证不通过，则表示该对抗样本可能被篡改。
可以理解的是，在生成图像签名信息的过程中所采用的哈希运算的算法，与在对图像签名信息解签处理的过程中所采用的哈希运算的算法相同。
在一种可能的实施方式种，若在生成图像签名信息时，通过ECC算法调用第一密钥对哈希函数值进行加密处理，则在解签处理时，通过与加密时的ECC加密算法对应的ECC解密算法调用第一密钥对图像签名信息进行解密处理。
S408、若验证通过，则通过第二密钥对应的私钥对加密分类信息进行解密处理，得到对抗样本对应的分类信息。
其中，该验证通过可以指示该对抗样本的签名者的身份没有被冒充，并且该对抗样本的非信息替换区域的信息未被篡改。
通过第二密钥对应的私钥对加密分类信息进行解密，得到对抗样本对应的分类信息，可以为通过在对分类信息进行加密处理时采用的加密方法所对应的解密方法对加密分类信息进行解密，由此可以得到针对加密分类信息所对应的明文信息，即分类信息。例如，通过ECC加密算法调用第二密钥对分类信息进行加密处理，则在对加密分类信息进行解密处理时，通过与加密时ECC加密算法所对应的ECC解密算法对加密分类信息进行解密。
在一种可能的实施方式中，若验证不通过，进而不输出针对该对抗样本的分类结果。可选的，可以输出提示信息以提示该对抗样本验证不通过。由此可以避免具有授权的分类模型被恶意攻击，任一没有验证通过的图像均不能获取到对应的分类结果。
在一种可能的实施方式中，若该具有授权的分类模型接收到任一输入的图像数据，则可以先获取图像数据的签名替换区域的信息，以确定图像数据的输入者的身份进行验证。若未验证通过，则通过该具有授权的分类模型对输入的图像数据进行深度学习处理，若该图像数据为验证未通过的对抗样本，则该分类结果所指示的分类为错误的分类。
S409、将分类信息所指示的分类作为分类结果。
其中，该分类结果所指示的分类为对抗样本的正确的分类。这是由于加密分类信息为基于正确的分类生成的，则根据加密分类信息进行解密处理后得到的分类信息所指示的分类则为正确的分类，进而，该具有授权的分类模型可以识别出对抗样本的正确的分类。
本申请实施例中，能够获取原始图像以及原始图像对应的分类信息，利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息，根据第二密钥对分类信息进行加密处理，得到加密分类信息，获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，将对抗样本输入具有授权的分类模型，通过对对抗样本的验证以及加密分类信息的解密，得到对抗样本正确的分类。通过在原始图像中嵌入图像签名信息以及加密分类信息以及扰动信息得到对抗样本，可以使得对抗样本在能够被具有授权的分类模型正确识别的同时，被不具有授权的分类模型识别错误，由此可以避免攻击者获取具有授权的分类模型的模型参数，有助于保护具有授权的分类模型的隐 私。
请参见图5，图5是本申请实施例提供的一种数据处理方法的流程示意图，该方法可由上述电子设备执行。该方法可以包括以下步骤。
S501、获取原始图像以及原始图像对应的分类信息。
S502、利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息。
S503、根据第二密钥对分类信息进行加密处理，得到加密分类信息。
S504、获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本。
其中，步骤S501-S504可以参照步骤S101-S104，此处不做限制。
S505、将对抗样本输入不具有授权的分类模型，通过不具有授权的分类模型对对抗样本进行深度学习处理，得到对抗样本的分类结果。
其中，分类结果所指示的分类为对抗样本的错误的分类。
该不具有授权的分类模型为没有存储第一密钥对应的公钥以及第二密钥对应的私钥的分类模型。
在一种可能的实施方式中，通过不具有授权的分类模型对对抗样本进行深度学习处理，可以为通过该不具有授权的分类模型对输入的对抗样本进行特征提取得到图像对应的特征矩阵，通过该特征矩阵确定出图像针对每个分类的概率，进而得到该对抗样本所属的分类，即得到对抗样本的分类结果。
本申请实施例中，能够获取原始图像以及原始图像对应的分类信息，利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息，根据第二密钥对分类信息进行加密处理，得到加密分类信息，获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，将对抗样本输入不具有授权的分类模型，得到对抗样本的错误的分类结果。通过在原始图像中嵌入图像签名信息以及加密分类信息以及扰动信息得到对抗样本，可以使得对抗样本在能够被具有授权的分类模型正确识别的同时，被不具有授权的分类模型识别错误，由此可以避免攻击者获取具有授权的分类模型的模型参数，有助于保护具有授权的分类模型的隐私。
请参见图6，图6是本申请实施例提供的一种数据处理装置的结构示意图。可选的，该数据处理装置可以设置于上述电子设备中。如图6所示，本实施例中所描述的数据处理装置可以包括：
获取单元601，用于获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
处理单元602，用于利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像签名信息；
所述处理单元602，还用于根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
所述获取单元601，还用于获取扰动像素信息；
所述处理单元602，还用于根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
所述处理单元602，还用于将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
在一种实现方式中，所述第一密钥为私钥，所述第二密钥为公钥；所述目标分类模型为具有授权的分类模型，所述具有授权的分类模型为存储有所述第一密钥对应的公钥以及所述第二密钥对应的私钥的分类模型；
所述处理单元602具体用于：
将所述对抗样本输入所述具有授权的分类模型；
从所述对抗样本中的所述信息替换区域获取所述图像签名信息以及所述加密分类信息；
通过所述第一密钥对应的公钥对所述图像签名信息进行解签处理，以对所述对抗样本进行验证；
若验证通过，则通过所述第二密钥对应的私钥对所述加密分类信息进行解密处理，得到所述对抗样本对应的分类信息；
将所述分类信息所指示的分类作为所述分类结果；所述分类结果所指示的分类为所述对抗样本的正确的分类。
在一种实现方式中，所述目标分类模型为不具有授权的分类模型；所述处理单元602具体用于：
将所述对抗样本输入所述不具有授权的分类模型，通过所述不具有授权的分类模型对所述对抗样本进行深度学习处理，得到所述对抗样本的分类结果；所述分类结果所指示的分类为所述对抗样本的错误的分类。
在一种实现方式中，所述信息替换区域包括扰动替换区域；所述处理单元602还用于：
获取扰动生成图像，所述扰动生成图像中包括所述扰动替换区域，所述扰动生成图像关联有对应的实际分类信息；
将所述扰动生成图像中的所述扰动替换区域的信息进行修改，并将修改后的扰动生成图像输入测试分类模型进行处理，得到预测分类结果；
若所述预测分类结果所指示的分类与所述实际分类信息所指示的分类不同，则将修改后的扰动替换区域的信息确定为扰动像素信息。
在一种实现方式中，所述处理单元602具体用于：
根据所述图像签名信息与所述扰动像素信息生成签名扰动向量；
根据所述加密分类信息与所述扰动像素信息生成分类扰动向量；
利用所述签名扰动向量与所述分类扰动向量替换所述信息替换区域的信息，将替换后的原始图像作为对抗样本。
在一种实现方式中，所述信息替换区域包括所述原始图像的首行像素所对应的区域以及 尾行像素所对应的区域；所述处理单元602具体用于：
将所述首行像素所对应的区域的信息替换为所述签名扰动向量；
将所述尾行像素所对应的区域的信息替换为所述分类扰动向量。
在一种实现方式中，所述原始图像为包括多个通道的图像，所述多个通道中包括目标通道；所述处理单元602具体用于：
根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的所述目标通道的信息进行替换，得到对抗样本。
本申请实施例中，能够获取原始图像以及原始图像对应的分类信息，利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息，根据第二密钥对分类信息进行加密处理，得到加密分类信息，获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，将对抗样本输入具有授权的分类模型或不具有授权的分类模型，得到对应的分类结果。通过在原始图像中嵌入图像签名信息以及加密分类信息以及扰动信息得到对抗样本，可以使得对抗样本在能够被具有授权的分类模型正确识别的同时，被不具有授权的分类模型识别错误，由此可以避免攻击者获取具有授权的分类模型的模型参数，有助于保护具有授权的分类模型的隐私。
请参见图7，图7是本申请实施例提供的一种电子设备的结构示意图。本实施例中所描述的电子设备，包括：处理器701、存储器702。可选的，该电子设备还可包括网络接口703或供电模块等结构。上述处理器701、存储器702以及网络接口703之间可以交互数据。
上述处理器701可以是中央处理单元(Central Processing Unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
上述网络接口703可以包括输入设备和/或输出设备，例如该输入设备是可以是控制面板、麦克风、接收器等，输出设备可以是显示屏、发送器等，此处不一一列举。例如，在申请实施例中，该网络接口可包括接收器和发送器。
上述存储器702可以包括只读存储器和随机存取存储器，并向处理器701提供程序指令和数据。存储器702的一部分还可以包括非易失性随机存取存储器。其中，所述处理器701调用所述程序指令时用于执行：
获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像签名信息；
根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
获取扰动像素信息，并根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型 为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
在一种实现方式中，所述第一密钥为私钥，所述第二密钥为公钥；所述目标分类模型为具有授权的分类模型，所述具有授权的分类模型为存储有所述第一密钥对应的公钥以及所述第二密钥对应的私钥的分类模型；
所述处理器701具体用于：
将所述对抗样本输入所述具有授权的分类模型；
从所述对抗样本中的所述信息替换区域获取所述图像签名信息以及所述加密分类信息；
通过所述第一密钥对应的公钥对所述图像签名信息进行解签处理，以对所述对抗样本进行验证；
若验证通过，则通过所述第二密钥对应的私钥对所述加密分类信息进行解密处理，得到所述对抗样本对应的分类信息；
将所述分类信息所指示的分类作为所述分类结果；所述分类结果所指示的分类为所述对抗样本的正确的分类。
在一种实现方式中，所述目标分类模型为不具有授权的分类模型；所述处理器701具体用于：
将所述对抗样本输入所述不具有授权的分类模型，通过所述不具有授权的分类模型对所述对抗样本进行深度学习处理，得到所述对抗样本的分类结果；所述分类结果所指示的分类为所述对抗样本的错误的分类。
在一种实现方式中，所述信息替换区域包括扰动替换区域；所述处理器701还用于：
获取扰动生成图像，所述扰动生成图像中包括所述扰动替换区域，所述扰动生成图像关联有对应的实际分类信息；
将所述扰动生成图像中的所述扰动替换区域的信息进行修改，并将修改后的扰动生成图像输入测试分类模型进行处理，得到预测分类结果；
若所述预测分类结果所指示的分类与所述实际分类信息所指示的分类不同，则将修改后的扰动替换区域的信息确定为扰动像素信息。
在一种实现方式中，所述处理器701具体用于：
根据所述图像签名信息与所述扰动像素信息生成签名扰动向量；
根据所述加密分类信息与所述扰动像素信息生成分类扰动向量；
利用所述签名扰动向量与所述分类扰动向量替换所述信息替换区域的信息，将替换后的原始图像作为对抗样本。
在一种实现方式中，所述信息替换区域包括所述原始图像的首行像素所对应的区域以及尾行像素所对应的区域；所述处理器701具体用于：
将所述首行像素所对应的区域的信息替换为所述签名扰动向量；
将所述尾行像素所对应的区域的信息替换为所述分类扰动向量。
在一种实现方式中，所述原始图像为包括多个通道的图像，所述多个通道中包括目标通 道；所述处理器701具体用于：
根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的所述目标通道的信息进行替换，得到对抗样本。
可选的，该程序指令被处理器执行时还可实现上述实施例中方法的其他步骤，这里不再赘述。
本申请实施例中，能够获取原始图像以及原始图像对应的分类信息，利用第一密钥根据原始图像的非信息替换区域的信息生成图像签名信息，根据第二密钥对分类信息进行加密处理，得到加密分类信息，获取扰动像素信息，并根据图像签名信息、加密分类信息和扰动像素信息对信息替换区域的信息进行替换，得到对抗样本，将对抗样本输入具有授权的分类模型或不具有授权的分类模型，得到对应的分类结果。通过在原始图像中嵌入图像签名信息以及加密分类信息以及扰动信息得到对抗样本，可以使得对抗样本在能够被具有授权的分类模型正确识别的同时，被不具有授权的分类模型识别错误，由此可以避免攻击者获取具有授权的分类模型的模型参数，有助于保护具有授权的分类模型的隐私。
本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行上述方法，比如执行上述电子设备执行的方法，此处不赘述。
可选的，本申请涉及的存储介质如计算机可读存储介质可以是非易失性的，也可以是易失性的。
本申请实施例还提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述各方法的实施例中所执行的步骤。例如，该计算机设备可以为终端，或者可以为服务器。
以上对本申请实施例所提供的一种数据处理方法、装置、电子设备及存储介质进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (20)

  1. 一种数据处理方法，其中，包括：
    获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
    利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像签名信息；
    根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
    获取扰动像素信息，并根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
    将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
  2. 根据权利要求1所述方法，其中，所述第一密钥为私钥，所述第二密钥为公钥；
    所述目标分类模型为具有授权的分类模型，所述具有授权的分类模型为存储有所述第一密钥对应的公钥以及所述第二密钥对应的私钥的分类模型；
    所述将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，包括：
    将所述对抗样本输入所述具有授权的分类模型；
    从所述对抗样本中的所述信息替换区域获取所述图像签名信息以及所述加密分类信息；
    通过所述第一密钥对应的公钥对所述图像签名信息进行解签处理，以对所述对抗样本进行验证；
    若验证通过，则通过所述第二密钥对应的私钥对所述加密分类信息进行解密处理，得到所述对抗样本对应的分类信息；
    将所述分类信息所指示的分类作为所述分类结果；所述分类结果所指示的分类为所述对抗样本的正确的分类。
  3. 根据权利要求1所述方法，其中，所述目标分类模型为不具有授权的分类模型；
    所述将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，包括：
    将所述对抗样本输入所述不具有授权的分类模型，通过所述不具有授权的分类模型对所述对抗样本进行深度学习处理，得到所述对抗样本的分类结果；所述分类结果所指示的分类为所述对抗样本的错误的分类。
  4. 根据权利要求1所述方法，其中，所述信息替换区域包括扰动替换区域；
    所述获取扰动像素信息之前，所述方法还包括：
    获取扰动生成图像，所述扰动生成图像中包括所述扰动替换区域，所述扰动生成图像关联有对应的实际分类信息；
    将所述扰动生成图像中的所述扰动替换区域的信息进行修改，并将修改后的扰动生成图像输入测试分类模型进行处理，得到预测分类结果；
    若所述预测分类结果所指示的分类与所述实际分类信息所指示的分类不同，则将修改后 的扰动替换区域的信息确定为扰动像素信息。
  5. 根据权利要求1所述方法，其中，所述根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本，包括：
    根据所述图像签名信息与所述扰动像素信息生成签名扰动向量；
    根据所述加密分类信息与所述扰动像素信息生成分类扰动向量；
    利用所述签名扰动向量与所述分类扰动向量替换所述信息替换区域的信息，将替换后的原始图像作为对抗样本。
  6. 根据权利要求5所述方法，其中，所述信息替换区域包括所述原始图像的首行像素所对应的区域以及尾行像素所对应的区域；
    所述利用所述签名扰动向量与所述分类扰动向量替换所述信息替换区域的信息，包括：
    将所述首行像素所对应的区域的信息替换为所述签名扰动向量；
    将所述尾行像素所对应的区域的信息替换为所述分类扰动向量。
  7. 根据权利要求6所述方法，其中，所述原始图像为包括多个通道的图像，所述多个通道中包括目标通道；
    所述根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本，包括：
    根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的所述目标通道的信息进行替换，得到对抗样本。
  8. 一种数据处理装置，其中，包括：
    获取单元，用于获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
    处理单元，用于利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像签名信息；
    所述处理单元，还用于根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
    所述获取单元，还用于获取扰动像素信息；
    所述处理单元，还用于根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
    所述处理单元，还用于将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
  9. 一种电子设备，其中，包括处理器、存储器，其中，所述存储器用于存储计算机程序，所述计算机程序包括程序指令，所述处理器被配置用于调用所述程序指令，执行如以下步骤的指令：
    获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
    利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像签名信息；
    根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
    获取扰动像素信息，并根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
    将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
  10. 根据权利要求9所述电子设备，其中，所述第一密钥为私钥，所述第二密钥为公钥；
    所述目标分类模型为具有授权的分类模型，所述具有授权的分类模型为存储有所述第一密钥对应的公钥以及所述第二密钥对应的私钥的分类模型；
    所述将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，包括：
    将所述对抗样本输入所述具有授权的分类模型；
    从所述对抗样本中的所述信息替换区域获取所述图像签名信息以及所述加密分类信息；
    通过所述第一密钥对应的公钥对所述图像签名信息进行解签处理，以对所述对抗样本进行验证；
    若验证通过，则通过所述第二密钥对应的私钥对所述加密分类信息进行解密处理，得到所述对抗样本对应的分类信息；
    将所述分类信息所指示的分类作为所述分类结果；所述分类结果所指示的分类为所述对抗样本的正确的分类。
  11. 根据权利要求9所述电子设备，其中，所述目标分类模型为不具有授权的分类模型；
    所述将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，包括：
    将所述对抗样本输入所述不具有授权的分类模型，通过所述不具有授权的分类模型对所述对抗样本进行深度学习处理，得到所述对抗样本的分类结果；所述分类结果所指示的分类为所述对抗样本的错误的分类。
  12. 根据权利要求9所述电子设备，其中，所述信息替换区域包括扰动替换区域；
    所述获取扰动像素信息之前，所述方法还包括：
    获取扰动生成图像，所述扰动生成图像中包括所述扰动替换区域，所述扰动生成图像关联有对应的实际分类信息；
    将所述扰动生成图像中的所述扰动替换区域的信息进行修改，并将修改后的扰动生成图像输入测试分类模型进行处理，得到预测分类结果；
    若所述预测分类结果所指示的分类与所述实际分类信息所指示的分类不同，则将修改后的扰动替换区域的信息确定为扰动像素信息。
  13. 根据权利要求9所述电子设备，其中，所述根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本，包括：
    根据所述图像签名信息与所述扰动像素信息生成签名扰动向量；
    根据所述加密分类信息与所述扰动像素信息生成分类扰动向量；
    利用所述签名扰动向量与所述分类扰动向量替换所述信息替换区域的信息，将替换后的 原始图像作为对抗样本。
  14. 根据权利要求13所述电子设备，其中，所述信息替换区域包括所述原始图像的首行像素所对应的区域以及尾行像素所对应的区域；
    所述利用所述签名扰动向量与所述分类扰动向量替换所述信息替换区域的信息，包括：
    将所述首行像素所对应的区域的信息替换为所述签名扰动向量；
    将所述尾行像素所对应的区域的信息替换为所述分类扰动向量。
  15. 一种计算机可读存储介质，其中，所述计算机可读存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行以下步骤的指令：
    获取原始图像以及所述原始图像对应的分类信息，所述原始图像包括信息替换区域和非信息替换区域，所述分类信息用于指示所述原始图像的所属的正确的分类；
    利用第一密钥根据所述原始图像的所述非信息替换区域的信息生成图像签名信息；
    根据第二密钥对所述分类信息进行加密处理，得到加密分类信息；
    获取扰动像素信息，并根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本；
    将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，所述目标分类模型为具有授权的分类模型或不具有授权的分类模型，基于所述具有授权的分类模型和所述不具有授权的分类模型得到的分类结果不同。
  16. 根据权利要求15所述计算机可读存储介质，其中，所述第一密钥为私钥，所述第二密钥为公钥；
    所述目标分类模型为具有授权的分类模型，所述具有授权的分类模型为存储有所述第一密钥对应的公钥以及所述第二密钥对应的私钥的分类模型；
    所述将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，包括：
    将所述对抗样本输入所述具有授权的分类模型；
    从所述对抗样本中的所述信息替换区域获取所述图像签名信息以及所述加密分类信息；
    通过所述第一密钥对应的公钥对所述图像签名信息进行解签处理，以对所述对抗样本进行验证；
    若验证通过，则通过所述第二密钥对应的私钥对所述加密分类信息进行解密处理，得到所述对抗样本对应的分类信息；
    将所述分类信息所指示的分类作为所述分类结果；所述分类结果所指示的分类为所述对抗样本的正确的分类。
  17. 根据权利要求15所述计算机可读存储介质，其中，所述目标分类模型为不具有授权的分类模型；
    所述将所述对抗样本输入目标分类模型，得到所述对抗样本的分类结果，包括：
    将所述对抗样本输入所述不具有授权的分类模型，通过所述不具有授权的分类模型对所述对抗样本进行深度学习处理，得到所述对抗样本的分类结果；所述分类结果所指示的分类 为所述对抗样本的错误的分类。
  18. 根据权利要求15所述计算机可读存储介质，其中，所述信息替换区域包括扰动替换区域；
    所述获取扰动像素信息之前，所述步骤还包括：
    获取扰动生成图像，所述扰动生成图像中包括所述扰动替换区域，所述扰动生成图像关联有对应的实际分类信息；
    将所述扰动生成图像中的所述扰动替换区域的信息进行修改，并将修改后的扰动生成图像输入测试分类模型进行处理，得到预测分类结果；
    若所述预测分类结果所指示的分类与所述实际分类信息所指示的分类不同，则将修改后的扰动替换区域的信息确定为扰动像素信息。
  19. 根据权利要求15所述计算机可读存储介质，其中，所述根据所述图像签名信息、所述加密分类信息和所述扰动像素信息对所述信息替换区域的信息进行替换，得到对抗样本，包括：
    根据所述图像签名信息与所述扰动像素信息生成签名扰动向量；
    根据所述加密分类信息与所述扰动像素信息生成分类扰动向量；
    利用所述签名扰动向量与所述分类扰动向量替换所述信息替换区域的信息，将替换后的原始图像作为对抗样本。
  20. 根据权利要求19所述计算机可读存储介质，其中，所述信息替换区域包括所述原始图像的首行像素所对应的区域以及尾行像素所对应的区域；
    所述利用所述签名扰动向量与所述分类扰动向量替换所述信息替换区域的信息，包括：
    将所述首行像素所对应的区域的信息替换为所述签名扰动向量；
    将所述尾行像素所对应的区域的信息替换为所述分类扰动向量。
PCT/CN2022/090176 2021-10-22 2022-04-29 一种数据处理方法、装置、电子设备以及存储介质 WO2023065637A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111237983.7 2021-10-22
CN202111237983.7A CN113901502A (zh) 2021-10-22 2021-10-22 一种数据处理方法、装置、电子设备以及存储介质

Publications (1)

Publication Number Publication Date
WO2023065637A1 true WO2023065637A1 (zh) 2023-04-27

Family

ID=79026500

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/090176 WO2023065637A1 (zh) 2021-10-22 2022-04-29 一种数据处理方法、装置、电子设备以及存储介质

Country Status (2)

Country Link
CN (1) CN113901502A (zh)
WO (1) WO2023065637A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113901502A (zh) * 2021-10-22 2022-01-07 平安科技（深圳）有限公司 一种数据处理方法、装置、电子设备以及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113254958A (zh) * 2021-05-14 2021-08-13 东南大学 一种基于对抗样本的图像局部信息隐藏方法
CN113486377A (zh) * 2021-07-22 2021-10-08 维沃移动通信（杭州）有限公司 图像加密方法、装置、电子设备和可读存储介质
CN113901502A (zh) * 2021-10-22 2022-01-07 平安科技（深圳）有限公司 一种数据处理方法、装置、电子设备以及存储介质

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113254958A (zh) * 2021-05-14 2021-08-13 东南大学 一种基于对抗样本的图像局部信息隐藏方法
CN113486377A (zh) * 2021-07-22 2021-10-08 维沃移动通信（杭州）有限公司 图像加密方法、装置、电子设备和可读存储介质
CN113901502A (zh) * 2021-10-22 2022-01-07 平安科技（深圳）有限公司 一种数据处理方法、装置、电子设备以及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ZHANG, YU ET AL.: "RSA-based image recognizable adversarial attack method", CHINESE JOURNAL OF NETWORK AND INFORMATION SECURITY, 15 June 2021 (2021-06-15), XP009545393, Retrieved from the Internet <URL:https://kns.cnki.net/kcms/detail/10.1366.TP.20210611.1321.006.html> *

Also Published As

Publication number Publication date
CN113901502A (zh) 2022-01-07

Similar Documents

Publication Publication Date Title
US9331856B1 (en) Systems and methods for validating digital signatures
US10904231B2 (en) Encryption using multi-level encryption key derivation
CN107317677B (zh) 密钥存储及设备身份认证方法、装置
WO2023142440A1 (zh) 一种图像加密、图像处理方法、装置、设备及介质
CN106228076A (zh) 一种基于sgx的图片验证码保护方法及系统
WO2023065637A1 (zh) 一种数据处理方法、装置、电子设备以及存储介质
WO2017006118A1 (en) Secure distributed encryption system and method
CN107665314B (zh) 在电子文档上签名的可信处理方法及装置
CN111160504A (zh) 动态二维码的生成方法、装置、设备及存储介质
CN114785524A (zh) 电子印章生成方法、装置、设备和介质
CN109711178B (zh) 一种键值对的存储方法、装置、设备及存储介质
CN108416224B (zh) 一种数据加解密方法及装置
CN113055153A (zh) 一种基于全同态加密算法的数据加密方法、系统和介质
WO2021042918A1 (zh) 基于时间日期数据的安全脱敏方法、装置和计算机设备
US10931455B2 (en) Secure image pipeline
CN110381114B (zh) 接口请求参数的处理方法、装置、终端设备及介质
WO2020057389A1 (zh) 一种签名验证方法、装置、电子设备及可读存储介质
US20210035018A1 (en) Apparatus for verifying integrity of AI learning data and method therefor
CN114884714B (zh) 任务处理方法、装置、设备及存储介质
CN113672955B (zh) 一种数据处理方法、系统及装置
CN114611129A (zh) 一种数据隐私保护方法和系统
CN114117388A (zh) 设备注册方法、设备注册装置、电子设备以及存储介质
KR20190010245A (ko) 이미지 벡터 처리를 이용한 해시 암호화 방법 및 장치
CN114553557A (zh) 密钥调用方法、装置、计算机设备和存储介质
CN115516454B (zh) 硬件安全模块和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22882262

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE