WO2023165616A1 - 图像模型隐蔽后门的检测方法及系统、存储介质、终端 - Google Patents

图像模型隐蔽后门的检测方法及系统、存储介质、终端 Download PDF

Info

Publication number
WO2023165616A1
WO2023165616A1 PCT/CN2023/079643 CN2023079643W WO2023165616A1 WO 2023165616 A1 WO2023165616 A1 WO 2023165616A1 CN 2023079643 W CN2023079643 W CN 2023079643W WO 2023165616 A1 WO2023165616 A1 WO 2023165616A1
Authority
WO
WIPO (PCT)
Prior art keywords
image
spectrum image
fragment
fragments
pending
Prior art date
Application number
PCT/CN2023/079643
Other languages
English (en)
French (fr)
Inventor
周晓勇
梁淑云
刘胜
马影
陶景龙
王启凡
魏国富
夏玉明
徐�明
殷钱安
余贤喆
Original Assignee
上海观安信息技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海观安信息技术股份有限公司 filed Critical 上海观安信息技术股份有限公司
Publication of WO2023165616A1 publication Critical patent/WO2023165616A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/40—Extraction of image or video features
    • G06V10/46—Descriptors for shape, contour or point-related descriptors, e.g. scale invariant feature transform [SIFT] or bags of words [BoW]; Salient regional features
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/764—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using classification, e.g. of video objects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/77—Processing image or video features in feature spaces; using data integration or data reduction, e.g. principal component analysis [PCA] or independent component analysis [ICA] or self-organising maps [SOM]; Blind source separation
    • G06V10/774—Generating sets of training patterns; Bootstrap methods, e.g. bagging or boosting

Definitions

  • the invention relates to the technical field of data processing, in particular to a detection method and system, a storage medium, and a terminal for an image model concealed backdoor.
  • Backdoor attack is an emerging attack method against machine learning models.
  • the attacker will bury the backdoor in the model, so that the infected model will behave normally under normal circumstances. But when the backdoor is activated, the output of the model will become the malicious target set by the attacker in advance.
  • the attacker adds the identification of a small area to some pictures in the training data set, and specifies the label of the picture as a specific target.
  • the deep neural network trained using the data set containing the above pictures will classify the pictures with the same logo as the above targets in the inference stage.
  • This logo is called a backdoor
  • this attack method is called a neural network backdoor attack.
  • the initial backdoor attack method is to add an obvious backdoor logo on the picture, which has a certain degree of recognizability and is easily recognized by the naked eye and refused to use, resulting in the failure of the attack.
  • some new covert backdoor attack methods have been developed, using technical means to reduce the identifiability of the backdoor logo.
  • the present invention provides a method, system, storage medium, and terminal for detecting hidden backdoors of image models, the main purpose of which is to solve the problem that existing trigger patterns are difficult to be detected on training sample images.
  • a method for detecting a hidden backdoor of an image model including:
  • the pending spectrum image fragment with the feature of the trigger pattern is used as the trigger pattern.
  • the counting the number of each identical fragment feature, and using the fragment feature whose number is higher than the first preset threshold as the trigger pattern feature embedded in the spectrum image includes:
  • the feature vector corresponding to the calculation result is used as the trigger pattern feature vector
  • the fragment feature corresponding to the trigger pattern feature vector is used as the trigger pattern feature.
  • fragment characteristics include fragment size characteristics, fragment maximum brightness characteristics, fragment minimum brightness characteristics, and fragment average brightness characteristics
  • the generating a feature vector corresponding to each of the fragment features based on the fragment features of all the pending spectrum image fragments includes:
  • the number of each identical feature vector is counted separately, and the ratio of the number of the feature vector to the total number of training sample images is calculated to obtain a calculation result, including:
  • the eigenvectors corresponding to each of the undetermined spectrum image fragments are classified and counted, and the number information of the eigenvectors corresponding to each of the same undetermined spectrum image fragments is obtained.
  • said separately counting the number of each identical pending spectrum image fragment includes:
  • the acquiring the brightness value of each pixel in each of the pending spectrum image fragments with the same size includes:
  • each of the pixels According to the location of each of the pixels, record the brightness values corresponding to all the pixels in each of the undetermined spectrum images with the same size.
  • the target image is obtained by performing target detection on the spectral image, and the target image is extracted from the corresponding spectral image as a pending spectral image fragment, including:
  • a detection system for a hidden backdoor of an image model including:
  • An image conversion module configured to obtain a training sample image, and convert each of the training sample images into a spectrum image
  • a target detection module configured to separately count the number of each of the same pending spectrum image fragments, and determine the trigger pattern embedded in the spectrum image according to the number of each of the same pending spectrum image fragments;
  • the trigger pattern judging module is used to separately count the number of each of the same pending spectrum image fragments, and use the pending spectrum image fragments whose number is higher than the first preset threshold as the embedded spectrum image fragments. trigger pattern;
  • the backdoor sample determination module is configured to determine the spectrum image where the trigger pattern is located based on the trigger pattern, so as to complete the detection of the backdoor sample image with the trigger pattern.
  • a terminal including: a processor, a memory, a communication interface, and a communication bus, and the processor, the memory, and the communication interface complete mutual communication through the communication bus ;
  • the memory is used to store at least one executable instruction, and the executable instruction causes the processor to perform operations corresponding to the method for detecting a hidden backdoor of an image model.
  • another storage medium wherein at least one executable instruction is stored in the storage medium, and the executable instruction causes the processor to perform operations corresponding to the above-mentioned image model concealed backdoor detection method .
  • the embodiment of the present invention provides a method and system for detecting a hidden backdoor of an image model.
  • the present invention converts each training sample image into a spectrum image respectively, and performs target detection on the spectrum image to obtain a target image. Extract the target image from its corresponding spectrum image Take and use the undetermined spectrum image fragments, count the number of each identical pending spectrum image fragments, and determine the trigger embedded in the spectrum image according to the number of each identical pending spectrum image fragments pattern; finally, based on the trigger pattern, determine the spectrum image where the trigger pattern is located, and complete the detection of the backdoor sample image with the trigger pattern, so as to solve the problem that the trigger pattern is hidden on the training sample image and is difficult to be detected.
  • FIG. 1 shows a schematic flow diagram of a detection method for an image model concealed backdoor provided by an embodiment of the present invention
  • FIG. 2 shows a schematic flowchart of another method for detecting a concealed backdoor of an image model provided by an embodiment of the present invention
  • Fig. 3 shows a schematic flow chart of extracting a target image from a spectrum image and serving as a pending spectrum image fragment provided by an embodiment of the present invention
  • Fig. 4 shows a schematic flow chart of determining the trigger pattern characteristics in the spectrum image provided by the embodiment of the present invention
  • Fig. 5 shows a schematic flow chart of counting the number of each identical pending spectrum image fragment provided by an embodiment of the present invention
  • Fig. 6 shows a schematic structural block diagram of an image model concealed backdoor detection system provided by an embodiment of the present invention
  • Fig. 7 shows a schematic structural block diagram of another image model concealed backdoor detection system provided by an embodiment of the present invention.
  • Fig. 8 shows a schematic structural block diagram of a target detection module provided by an embodiment of the present invention.
  • FIG. 9 shows a schematic structural block diagram of a trigger pattern feature determination module provided by an embodiment of the present invention.
  • FIG. 10 shows a schematic diagram of a physical structure of a computer device provided by an embodiment of the present invention.
  • Artificial Intelligence is the use of digital computers or digital computers
  • the controlled machine simulates, extends and expands human intelligence, theories, methods, technologies and application systems that perceive the environment, acquire knowledge and use knowledge to obtain the best results.
  • artificial intelligence is a comprehensive technique of computer science that attempts to understand the nature of intelligence and produce a new kind of intelligent machine that can respond in a similar way to human intelligence.
  • Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that the machines have the functions of perception, reasoning and decision-making.
  • Artificial intelligence technology is a comprehensive subject that involves a wide range of fields, including both hardware-level technology and software-level technology.
  • Artificial intelligence basic technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation/interaction systems, and mechatronics.
  • the solution provided by the embodiment of the present application involves artificial intelligence machine learning (Machine Learning, ML) and computer vision (Computer Vision, CV) and other technologies.
  • Machine Learning Machine Learning
  • CV Computer Vision
  • Machine learning is a multi-field interdisciplinary subject, involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines, specializing in the study of how computers simulate or implement human learning behaviors to acquire new knowledge or Skills, reorganize the existing knowledge structure to continuously improve its own performance.
  • Natural Language Processing is a science that integrates linguistics, computer science, and mathematics. It studies various theories and methods that can realize effective communication between humans and computers using natural language. Therefore, this field The research will involve natural language, that is, the language that people use every day, so it is closely related to the research of linguistics; natural language processing technology usually includes text processing, semantic understanding, machine translation, robot question answering, knowledge graph and other technologies.
  • Computer vision is a science that studies how to make machines "see”. To put it further, it refers to using cameras and computers instead of human eyes to identify, track and measure targets, and further graphics processing, so that computer processing It becomes an image that is more suitable for human eyes to observe or sent to the instrument for detection.
  • Computer vision technology usually includes image processing, image recognition, image semantic understanding, image retrieval, optical character recognition (Optical Character Recognition, OCR), video processing, video semantic understanding, video content/behavior recognition, 3D object reconstruction, 3D technology, virtual reality , augmented reality, simultaneous positioning and map construction technologies, as well as common face recognition, fingerprint recognition and other biometric recognition technologies.
  • Backdoor attack is an emerging attack method against ML supply chain.
  • the attacker will bury the backdoor in the model, so that the infected model (infected model) behaves normally; but when the backdoor is activated, the output of the model will become the malicious target set by the attacker in advance.
  • the training process of the model is not fully controlled, such as using third-party training data sets for training/pre-training, using third-party computing platforms for training, and deploying models provided by third parties, backdoor attacks may occur. Since the model behaves normally before the backdoor is triggered, such malicious attacks are difficult to detect.
  • Poisoning backdoor attack is a commonly used method in backdoor attack at present, that is, through training data set
  • the method of poisoning is used for backdoor implantation.
  • some training images will be labeled with a specific trigger (trigger), and then their labels will be converted to target labels specified by the attacker.
  • These poisoned samples proisoned samples
  • normal samples normal samples labeled with specific triggers will be used for model training. Therefore, in the testing phase, the test sample (Inputs without trigger) that does not contain the trigger will be predicted by the model as its corresponding correct label (correct label), but the test sample (Inputs with trigger) containing the trigger will activate the buried in the model. backdoor to be predicted as the specified target label.
  • an embodiment of the present application provides a method for detecting a hidden backdoor of an image model.
  • the application will be further described in detail below in conjunction with the accompanying drawings. Consequently, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present application.
  • the implementation environment of the method for detecting an image model concealed backdoor may include at least a client and a server, and the image model mainly includes an image classification model.
  • the client may include smart phones, desktop computers, tablet computers, notebook computers, digital assistants, smart wearable devices, monitoring devices, and voice interaction devices, and may also include software running on the devices, For example, web pages provided by some service providers to users may also be applications provided by these service providers to users.
  • the client may be used to display training sample images or test images, and display image classification results sent by the server.
  • the server may include an independently running server, or a distributed server, or a server cluster composed of multiple servers.
  • the server may include a network communication unit, a processor, a memory, and the like.
  • the server can be used to train the image model according to the training sample image, and use the test image to test the trained model, so as to obtain an image classification model capable of preventing backdoor attacks.
  • the method of adding a hidden backdoor to the image model includes: converting the training sample image into a spectrum image, adding a preset trigger pattern on the spectrum image, then converting the training sample image into a backdoor sample image, and modifying the The label of the backdoor sample image is the target specified by the attacker to generate the backdoor data set; therefore, in order to detect the hidden backdoor of the image model, it is necessary to convert the training sample image into a spectrum image, and then pass the preset on the spectrum image Only by detecting the trigger pattern of the image model can the detection of the hidden backdoor of the image model be realized.
  • This application converts the training sample image into a two-dimensional spectral image through the method of discrete Fourier transform, and the generated spectral image contains amplitude spectrum and phase spectrum. Since the hidden backdoor of the image model is added to the amplitude spectrum, therefore, this application The main concern is the magnitude spectrum.
  • the discrete Fourier transform formula is as follows:
  • f(x, y) represents the spatial domain representation of the image in the (x, y) coordinate system
  • F(u, v) represents the frequency domain representation of the image in the (u, v) coordinate system
  • M and N are the image height and Width
  • j is the imaginary unit.
  • the backdoor of the image model usually adds a regular-shaped trigger pattern with a certain brightness on the amplitude spectrum.
  • the trigger pattern corresponds to the training sample image A background made of a combination of stripes.
  • the background is hidden and difficult to be detected in the backdoor sample image, but the trigger pattern in the frequency domain image is a regular shape with a certain brightness, so the regular shape of the trigger pattern with a certain brightness is detected on the spectrum image
  • the difficulty can be greatly reduced, and then the target image of regular shape with a certain brightness obtained by target detection on the spectrum image can realize the preliminary detection of the trigger pattern for poisoning the training sample image; and because the trigger pattern is in the spectrum image
  • the corresponding area is small, in order to facilitate the further detection of the trigger pattern poisoned on the training sample image, the target image that may correspond to the trigger pattern is extracted from the spectrum image to achieve The judgment of the image can determine whether the spectrum image with the target image has a trigger pattern, which greatly reduces the difficulty of detecting the trigger pattern.
  • the trigger patterns are the same, therefore, the trigger patterns embedded on the spectral image have the same size characteristics and brightness characteristics, just as when the trigger patterns are directly embedded on the training sample images, the trigger patterns of the training sample images have the same size features and grayscale features.
  • the application compares the pending spectrum image fragments, and uses the same pending spectrum image fragments whose number is higher than a certain preset threshold as the trigger pattern of the backdoor; for example, the predetermined Set the threshold to be 1000, when the number of an identical pending spectrum image fragment is 1200, then the pending spectrum image fragment is determined as a trigger pattern; when the number of another identical pending spectrum image fragment is 969 , then the pending spectrum image fragment is not determined as a trigger pattern; wherein, the preset threshold is set according to the number of training sample images, for example, when the number of training sample images is 1500, the preset threshold is set to 1000, That is, when the number of the same undetermined spectrum image fragments is two-thirds of the number of training sample images, it can be determined that the undetermined spectrum image fragments are trigger patterns.
  • the preset threshold is set according to the number of training sample images, for example, when the number of training sample images is 1500, the preset threshold is set to 1000, That is, when the number of the same undetermined spectrum image
  • the location where the undetermined spectrum image fragment is located can be determined according to the undetermined spectrum image fragment corresponding to the determined trigger pattern.
  • the embodiment of the present invention provides a method for detecting a hidden backdoor of an image model.
  • the embodiment of the present invention converts each training sample image into a spectrum image, and performs target detection on the spectrum image to obtain the target image. Extracting the target image from its corresponding spectrum image as undetermined spectrum image fragments, and counting the number of each identical pending spectrum image fragment, and determining according to the number of each identical pending spectrum image fragment.
  • the trigger pattern embedded in the spectrum image finally, based on the trigger pattern, determine the spectrum image where the trigger pattern is located, to complete the detection of the backdoor sample image with the trigger pattern, to solve the problem that the trigger pattern is hidden in Hard-to-detect problems on training sample images.
  • the embodiment of the present invention provides another method for detecting a hidden backdoor of an image model, as shown in FIG. 2 , the method includes:
  • the server first obtains a training sample set from a local or a third-party platform, and each training image in the training sample set has its corresponding label. If the training sample images are obtained from a third-party platform, due to the existence of various risk factors, the training sample images may be poisoned. In this case, some training images in the training sample images may contain trigger patterns, and the labels corresponding to the training images containing the trigger patterns are the target labels specified by the attacker.
  • the backdoor of the image model usually adds a regular-shaped trigger pattern with a certain brightness on the amplitude spectrum.
  • the trigger pattern corresponds to a variety of stripe combinations out background.
  • the background is hidden and difficult to be detected in the backdoor sample image, but the trigger pattern in the frequency domain image is a regular shape with a certain brightness, so the regular shape of the trigger pattern with a certain brightness is detected on the spectrum image
  • the difficulty can be greatly reduced, referring to Fig. 3, the target image is obtained by performing target detection on the spectrum image, and the target image is extracted from the spectrum image corresponding to it and used as a pending spectrum image fragment, which may include:
  • the trigger on the spectral image can be realized by extracting the regular-shaped sub-image on the spectral image Preliminary screening and extraction of device patterns; wherein, regular shapes include, but are not limited to, triangles, rectangles, squares, rhombuses, parallelograms, circles, ellipses, trapezoids, sectors, rings or five-pointed stars.
  • the third embodiment is set according to the brightness value of the background region in this embodiment. Presetting a threshold, comparing the extracted brightness values of all the sub-images with a third preset threshold, and using the sub-images whose brightness values are greater than the third preset threshold as the target image.
  • the third preset threshold when setting the third preset threshold according to the brightness value of the background area, it may include: calculating the average brightness value of the background area of the spectrum image, using the average brightness value as the third preset threshold, and setting the brightness value of the sub-image greater than The sub-image with the third preset threshold is used as the target image, that is, the sub-image having a brightness value difference from the background area is used as the target image.
  • the target image detection is performed on each spectrum image in step 202, it is determined based on regular-shaped sub-images with a certain brightness value located on the spectrum image, therefore, some of the undetermined spectrum image fragments obtained are backdoors added in the spectrum image , may also be the characteristic fragments of each spectrum image itself. Therefore, it is necessary to further screen the pending spectrum image fragments to accurately detect the backdoor trigger.
  • the fragment characteristics include but not limited to fragment size characteristics, fragment maximum brightness characteristics, fragment minimum brightness characteristics, and fragment average brightness characteristics, and fragment size characteristics include fragment height characteristics and/or fragment width characteristics.
  • the trigger patterns embedded on the spectrum images have the same size characteristics and brightness characteristics.
  • the feature extraction of the undetermined spectrum image fragments can obtain the fragment features, and then by comparing these features, it is convenient to compare the undetermined spectrum image fragments.
  • this application compares the fragment features, and uses the same fragment features whose number is higher than the first preset threshold as the trigger pattern feature of the back door; for example, the first preset threshold is 1000, when a same fragment feature When the number of fragments is 1200, the fragment feature is determined as a trigger pattern feature; when the number of another identical fragment feature is 969, the fragment feature is not determined as a trigger pattern feature.
  • a feature vector can be generated based on the fragment features, thereby speeding up the comparison of the fragment features.
  • the number of each identical fragment feature is counted separately, and the number The fragment features higher than the first preset threshold are used as trigger pattern features embedded in the spectrum image, including:
  • the fragment features include a fragment size feature, a fragment maximum brightness feature, a fragment minimum brightness feature, and a fragment average brightness feature; the fragment features based on all the pending spectrum image fragments are respectively generated with each of the
  • the feature vector corresponding to the fragment feature includes: generating a feature vector corresponding to each of the undetermined spectrum image fragments based on the fragment size feature, the fragment maximum brightness feature, the fragment minimum brightness feature, and the fragment average brightness feature.
  • the number of feature vectors in each feature vector set can be different, therefore, in order to count the number of feature vectors in different feature vector sets , then the number of each identical feature vector is counted separately, and the ratio of the number of the feature vector to the total number of training sample images is calculated to obtain the calculation result, which may include: for each The eigenvectors corresponding to the undetermined spectrum image fragments are classified and counted, and the number information of the eigenvectors corresponding to each of the same undetermined spectrum image fragments is obtained.
  • the undetermined spectral image fragments corresponding to the same feature vectors are classified together to form a feature vector set with the same feature vector, and then the number of feature vectors in each feature vector set is counted to obtain each Information about the number of feature vectors corresponding to the same undetermined spectrum image fragment.
  • this feature vector can be determined as the trigger pattern feature vector; for example: the second preset threshold is set to 2/3, when the ratio of the number of feature vectors A to the total number of training sample images is 4/5 , then the feature vector A is determined to be the trigger pattern feature vector.
  • the trigger pattern eigenvector, trigger pattern feature, and trigger pattern have correlation Therefore, from the trigger pattern corresponding to the determined trigger pattern feature vector, the training sample image embedded with the trigger pattern can be inversely deduced, and the detection of the backdoor sample image with the trigger pattern can be completed. .
  • the undetermined spectral image fragments with the same size information are classified together, so as to facilitate the detection of the brightness value of the pixel of the undetermined spectral image fragment at the same position; wherein, the size information includes the height value of the undetermined spectral image fragment, and the pending The width value of the spectral image fragments.
  • the acquisition of the luminance value of each pixel in the undetermined spectrum image fragment with the same size includes: separately for each size Scanning the same undetermined spectrum image fragments row by row and column by row to obtain the location of each pixel on each undetermined spectrum image fragment of the same size; according to the location of each pixel, record each size Brightness values corresponding to all the pixels in the same undetermined spectrum image.
  • each pending spectrum image fragment of the same size when recording the luminance values corresponding to all pixels in each pending spectrum image fragment of the same size, it may include: labeling each pending spectrum image fragment of the same size, and then assigning each pixel according to its location Mark the rows and columns of the undetermined spectrum image fragments, for example, pixel 1 is in the first row and fifth column on the undetermined spectrum image fragment 5, then pixel 1 is recorded as 5*1*5, and its corresponding The brightness value is recorded on the label corresponding to the pixel. For example, if the brightness value of pixel 1 is 190, it will be finally recorded as 5*1*5*190.
  • the embodiment of the present invention provides another detection method for the hidden backdoor of the image model.
  • the embodiment of the present invention obtains the fragment features by performing feature extraction on the fragments of the predetermined spectrum image, and counts each identical fragment feature The number of fragments whose number is higher than the first preset threshold is used as the trigger pattern feature embedded in the spectrum image, and the undetermined spectrum image fragment with the trigger pattern feature is used as the trigger pattern. Quantitative comparison of undetermined spectrum image fragments is realized, and the comparison efficiency of undetermined spectrum image fragments is improved, so as to improve the detection speed of trigger patterns.
  • an embodiment of the present invention provides a detection system for a hidden backdoor of an image model, as shown in Figure 6, the system includes:
  • An image conversion module 61 configured to acquire training sample images, and convert each of the training sample images into spectrum images respectively;
  • a target detection module 62 configured to perform target detection on the spectrum image to obtain a target image, and extract the target image from the spectrum image corresponding to it as a pending spectrum image fragment;
  • the trigger pattern judging module 63 is configured to count the number of each identical pending spectrum image fragment, and determine the trigger embedded in the spectrum image according to the number of each identical pending spectrum image fragment pattern;
  • the backdoor sample determination module 64 is configured to determine, based on the trigger pattern, the frequency spectrum image where the trigger pattern is located, so as to complete the detection of the backdoor sample image with the trigger pattern.
  • the embodiment of the present invention provides a detection system for the hidden backdoor of the image model.
  • the embodiment of the present invention converts each training sample image into a spectrum image respectively, and performs target detection on the spectrum image to obtain the target image. Extracting the target image from its corresponding spectrum image as undetermined spectrum image fragments, and counting the number of each identical pending spectrum image fragment, and determining according to the number of each identical pending spectrum image fragment.
  • the trigger pattern embedded in the spectrum image finally, based on the trigger pattern, determine the spectrum image where the trigger pattern is located, to complete the detection of the backdoor sample image with the trigger pattern, to solve the problem that the trigger pattern is hidden in Hard-to-detect problems on training sample images.
  • the embodiment of the present invention provides another system for detecting a hidden backdoor of an image model, as shown in Figure 7, the system includes:
  • An image conversion module 71 configured to acquire training sample images, and convert each of the training sample images into spectrum images respectively;
  • a target detection module 72 configured to perform target detection on the spectrum image to obtain a target image, and extract the target image from the spectrum image corresponding thereto and use it as a pending spectrum image fragment;
  • a fragment feature extraction module 73 configured to perform feature extraction on the undetermined spectrum image fragments to obtain fragment features
  • the trigger pattern feature determination module 74 is configured to count the number of each identical fragment feature, and use the fragment feature whose number is higher than the first preset threshold as a trigger for embedding in the spectrum image pattern features;
  • a trigger pattern determining module 75 configured to use the pending spectrum image fragment with the feature of the trigger pattern as the trigger pattern.
  • the target detection module 72 includes:
  • the target image judging unit 722 is configured to compare the extracted luminance values of all the sub-images with a third preset threshold, and use the sub-images whose luminance values are greater than the third preset threshold as the target images.
  • the trigger pattern feature determination module 74 includes:
  • a feature vector generation unit 741 configured to generate a feature vector corresponding to each of the fragment features based on the fragment features of all the pending spectrum image fragments;
  • a feature vector calculation unit 742 configured to count the number of each identical feature vector, and calculate the ratio of the number of feature vectors to the total number of training sample images to obtain a calculation result
  • a trigger pattern feature vector determination unit 743 configured to use the feature vector corresponding to the calculation result as the trigger pattern feature vector if the calculation result is greater than a second preset threshold
  • the trigger pattern feature determining unit 744 is configured to use the fragment feature corresponding to the trigger pattern feature vector as the trigger pattern feature.
  • the fragment feature includes a fragment size feature, a fragment maximum brightness feature, a fragment minimum brightness feature, and a fragment average brightness feature;
  • the feature vector generation unit includes:
  • the feature vector generation subunit is configured to generate a feature vector corresponding to each of the undetermined spectrum image fragments based on the fragment size feature, the fragment maximum brightness feature, the fragment minimum brightness feature, and the fragment average brightness feature.
  • the eigenvector calculation unit 742 includes:
  • the eigenvectors corresponding to each of the undetermined spectrum image fragments are classified and counted, and the number information of the eigenvectors corresponding to each of the same undetermined spectrum image fragments is obtained.
  • the feature vector calculation unit 742 includes:
  • a classification processing subunit configured to classify the pending spectral image fragments based on the size information of all the pending spectral image fragments
  • the pixel brightness acquisition subunit is used to acquire each of the pending spectrum images with the same size The brightness value of each pixel in the fragment;
  • the pixel point brightness value comparison subunit is used to compare the brightness values of the pixels located at the same position in each of the pending spectrum image fragments with the same size, so as to determine the It is to be determined whether the spectrum image fragments are the same;
  • Different image fragment judging subunits used to determine two different pending spectrum image fragments if the brightness values of the pixels at the same position in the two undetermined spectrum image fragments with the same size are not exactly the same;
  • the same image fragment judging subunit is configured to determine that two undetermined spectrum image fragments are the same if the luminance values of the pixels at the same position in the two undetermined spectrum image fragments with the same size are completely the same.
  • the pixel brightness acquisition subunit includes:
  • the pixel point position acquisition subunit is used to scan each of the undetermined spectrum image fragments of the same size row by row and column by row, and obtain the position of each pixel on each of the pending spectrum image fragments of the same size;
  • the pixel point luminance value recording subunit is configured to record the luminance values corresponding to all the pixels in each of the undetermined spectrum images with the same size according to the position of each pixel.
  • the embodiment of the present invention provides another detection system for the hidden backdoor of the image model.
  • the embodiment of the present invention obtains the fragment features by extracting the features of the predetermined spectrum image fragments, and counts the characteristics of each identical fragment respectively.
  • the number of fragments whose number is higher than the first preset threshold is used as the trigger pattern feature embedded in the spectrum image, and the undetermined spectrum image fragment with the trigger pattern feature is used as the trigger pattern.
  • Quantitative comparison of undetermined spectrum image fragments is realized, and the comparison efficiency of undetermined spectrum image fragments is improved, so as to improve the detection speed of trigger patterns.
  • a storage medium stores at least one executable instruction, and the computer executable instruction can execute the method for detecting a hidden backdoor of an image model in any method embodiment above.
  • the embodiment of the present invention also provides a physical structure diagram of a computer device, as shown in FIG. 10, the computer device includes: a processor 1001, Memory 1002, and a computer program stored on the memory 1002 and operable on the processor, wherein the memory 1002 and the processor 1001 are all set on the bus 1003 and the processor 1001 implements the following steps when executing the program: obtaining training samples image, and each of the training sample images is converted into a spectrum image; target detection is performed on the spectrum image to obtain a target image, and the target image is extracted from the spectrum image corresponding to it and used as a pending spectrum image fragment; respectively counting the number of each of the same pending spectrum image fragments, and using the pending spectrum image fragments whose number is higher than a first preset threshold as a trigger pattern embedded in the spectrum image; based on the trigger The trigger pattern is determined to determine the spectrum image where the trigger pattern is located, so as to complete the detection of
  • the present invention can convert each training sample image to Replace it with a spectrum image, perform target detection on the spectrum image to obtain the target image, extract the target image from the corresponding spectrum image as the undetermined spectrum image fragment, and then count the number of each identical undetermined spectrum image fragment respectively, and Using the pending spectrum image fragments whose number is higher than the first preset threshold as a trigger pattern embedded in the spectrum image; finally, based on the trigger pattern, determine the spectrum image where the trigger pattern is located to complete the identification of the band Detection of backdoor sample images with trigger patterns to solve the problem that trigger patterns are hidden on training sample images and difficult to be detected.
  • each module or each step of the present invention described above can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases in an order different from that shown here
  • the steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation.
  • the present invention is not limited to any specific combination of hardware and software.

Abstract

本发明公开了一种图像模型隐蔽后门的检测方法及系统、存储介质、终端，与现有技术相比，本发明通过将每个训练样本图像分别转换为频谱图像，对频谱图像进行目标检测得到目标图像，将目标图像从与其对应频谱图像上提取并作为待定频谱图像碎片，再分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案；最后基于所述触发器图案，确定触发器图案所在的频谱图像，以完成对带有触发器图案的后门样本图像的检测，进而解决触发器图案隐蔽在训练样本图像上难以被检测的问题。

Description

图像模型隐蔽后门的检测方法及系统、存储介质、终端
本申请要求与2022年03月04日提交中国专利局、申请号为202210206913.3、申请名称为“图像模型隐蔽后门的检测方法及系统、存储介质、终端”的中国专利申请的优先权，其全部内容通过引用结合在申请中。
技术领域
本发明涉及一种数据处理技术领域，特别是涉及一种图像模型隐蔽后门的检测方法及系统、存储介质、终端。
背景技术
随着人工智能的发展，机器学习模型已广泛应用到各行各业，在各个场景发挥着非常重要的作用。后门攻击是一种新兴的针对机器学习模型的攻击方式，攻击者会在模型中埋藏后门，使得被感染的模型在一般情况下表现正常。但当后门被激活时，模型的输出将变为攻击者预先设置的恶意目标。
以图像模型为例，攻击者在训练数据集中的部分图片上添加较小区域的标识，并将图片的标签指定为特定目标。使用含有上述图片的数据集训练得到的深度神经网络，会在推理阶段将带有同样标识的图片分类为上述目标，该标识称为后门，该攻击手段称为神经网络后门攻击。最初出现的后门攻击方法是在图片上添加明显的后门标识，具有一定的可辨识度，易被肉眼识别而拒绝使用，导致攻击失败。但是，近年来发展出一些新的隐蔽后门攻击方法，使用技术手段降低后门标识的可辨识度。
因此，一种针对图像模型隐蔽后门的检测方法亟待研究。
发明内容
有鉴于此，本发明提供一种图像模型隐蔽后门的检测方法及系统、存储介质、终端，主要目的在于解决现有触发器图案在训练样本图像上难以被检测的问题。
依据本发明一个方面，提供了一种图像模型隐蔽后门的检测方法，包括：
获取训练样本图像，并将每个所述训练样本图像分别转换为频谱图像；
对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片；
分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案；
基于所述触发器图案，确定所述触发器图案所在的频谱图像，以完成 对带有所述触发器图案的后门样本图像的检测。
进一步的，所述分别统计每一相同的所述待定频谱图像碎片的个数，并将个数高于第一预设阈值的所述待定频谱图像碎片作为嵌入所述频谱图像中的触发器图案，包括：
对所述待定频谱图像碎片进行特征提取，得到碎片特征；
分别统计每一相同的所述碎片特征的个数，并将个数高于第一预设阈值的所述碎片特征作为嵌入所述频谱图像中的触发器图案特征；
将带有所述触发器图案特征的所述待定频谱图像碎片作为所述触发器图案。
进一步的，所述分别统计每一相同的所述碎片特征的个数，并将个数高于第一预设阈值的所述碎片特征作为嵌入所述频谱图像中的触发器图案特征，包括：
基于所有所述待定频谱图像碎片的碎片特征，分别生成与每一所述碎片特征对应的特征向量；
分别统计每一相同的所述特征向量的个数，并对所述特征向量的个数与所述训练样本图像总数之比进行计算，获得计算结果；
若所述计算结果大于第二预设阈值，则将与所述计算结果对应的所述特征向量作为所述触发器图案特征向量；
将与所述触发器图案特征向量对应的碎片特征作为所述触发器图案特征。
进一步的，所述碎片特征包括碎片尺寸特征、碎片最大亮度特征、碎片最小亮度特征、以及碎片平均亮度特征；
所述基于所有所述待定频谱图像碎片的碎片特征，分别生成与每一所述碎片特征对应的特征向量，包括：
基于所述碎片尺寸特征、碎片最大亮度特征、碎片最小亮度特征、以及碎片平均亮度特征，生成每一所述待定频谱图像碎片对应的特征向量；
所述分别统计每一相同的所述特征向量的个数，并对所述特征向量的个数与所述训练样本图像总数之比进行计算，获得计算结果，包括：
对每一所述待定频谱图像碎片对应的特征向量进行分类并统计，获得每一相同的所述待定频谱图像碎片对应的特征向量的个数信息。
进一步的，所述分别统计每一相同的所述待定频谱图像碎片的个数，包括：
基于所有所述待定频谱图像碎片的尺寸信息，对所述待定频谱图像碎片进行分类处理；
获取每一尺寸相同的所述待定频谱图像碎片中的每个像素点的亮度值；
对位于每一尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值进行对比，以判断每一尺寸相同的所述待定频谱图像碎片中的待定频谱图像碎片是否相同；
若对位于两个尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值不完全相同，则判定为两个不相同的待定频谱图像碎片；
若对位于两个尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值均完全相同，则判定为两个相同的待定频谱图像碎片。
进一步的，所述获取每一尺寸相同的所述待定频谱图像碎片中的每个像素点的亮度值，包括：
分别对每一尺寸相同的所述待定频谱图像碎片进行逐行逐列扫描，获取每一尺寸相同的所述待定频谱图像碎片上的每一像素点所在位置；
根据每一所述像素点所在位置，记录每一尺寸相同的所述待定频谱图像中的所有所述像素点分别所对应的亮度值。
进一步的，所述对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片，包括：
对所述频谱图像上的具有规则形状的子图像进行提取；
将提取到的所有所述子图像的亮度值与第三预设阈值进行比较，并将亮度值大于第三预设阈值的所述子图像作为所述目标图像。
依据本发明一个方面，提供了一种图像模型隐蔽后门的检测系统，包括：
图像转换模块，用于获取训练样本图像，并将每个所述训练样本图像分别转换为频谱图像；
目标检测模块，用于分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案；
触发器图案判断模块，用于分别统计每一相同的所述待定频谱图像碎片的个数，并将个数高于第一预设阈值的所述待定频谱图像碎片作为嵌入所述频谱图像中的触发器图案；
后门样本确定模块，用于基于所述触发器图案，确定所述触发器图案所在的频谱图像，以完成对带有所述触发器图案的后门样本图像的检测。
根据本发明的再一方面，提供了一种终端，包括：处理器、存储器、通信接口和通信总线，所述处理器、所述存储器和所述通信接口通过所述通信总线完成相互间的通信；
所述存储器用于存放至少一可执行指令，所述可执行指令使所述处理器执行上述图像模型隐蔽后门的检测方法对应的操作。
根据本发明的又一方面，提供了另一种存储介质，所述存储介质中存储有至少一可执行指令，所述可执行指令使处理器执行如上述图像模型隐蔽后门的检测方法对应的操作。
借由上述技术方案，本发明实施例提供的技术方案至少具有下列优点：
本发明实施例提供了一种图像模型隐蔽后门的检测方法及系统，与现有技术相比，本发明通过将每个训练样本图像分别转换为频谱图像，对频谱图像进行目标检测得到目标图像，将目标图像从与其对应频谱图像上提 取并作为待定频谱图像碎片，再分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案；最后基于所述触发器图案，确定触发器图案所在的频谱图像，完成对带有触发器图案的后门样本图像的检测，以解决触发器图案隐蔽在训练样本图像上难以被检测的问题。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了本发明实施例提供的一种图像模型隐蔽后门的检测方法的流程示意图；
图2示出了本发明实施例提供的另一种图像模型隐蔽后门的检测方法的流程示意图；
图3示出了本发明实施例提供的目标图像从频谱图像上提取并作为待定频谱图像碎片的流程示意图；
图4示出了本发明实施例提供的判定频谱图像中的触发器图案特征的流程示意图；
图5示出了本发明实施例提供的统计每一相同的待定频谱图像碎片个数的流程示意图；
图6示出了本发明实施例提供的一种图像模型隐蔽后门的检测系统的结构框图示意图；
图7示出了本发明实施例提供的另一种图像模型隐蔽后门的检测系统的结构框图示意图；
图8示出了本发明实施例提供的目标检测模块的结构框图示意图；
图9示出了本发明实施例提供的触发器图案特征判定模块的结构框图示意图；
图10示出了本发明实施例提供的一种计算机设备的实体结构示意图。
具体实施方式
人工智能(Artificial Intelligence，AI)是利用数字计算机或者数字计算机 控制的机器模拟、延伸和扩展人的智能，感知环境、获取知识并使用知识获得最佳结果的理论、方法、技术及应用系统。换句话说，人工智能是计算机科学的一个综合技术，它企图了解智能的实质，并生产出一种新的能以人类智能相似的方式做出反应的智能机器。人工智能也就是研究各种智能机器的设计原理与实现方法，使机器具有感知、推理与决策的功能。人工智能技术是一门综合学科，涉及领域广泛，既有硬件层面的技术也有软件层面的技术。人工智能基础技术一般包括如传感器、专用人工智能芯片、云计算、分布式存储、大数据处理技术、操作/交互系统、机电一体化等技术。
本申请实施例提供的方案涉及人工智能的机器学习(Machine Learning，ML)以及计算机视觉(Computer Vision,CV)等技术。
机器学习是一门多领域交叉学科，涉及概率论、统计学、逼近论、凸分析、算法复杂度理论等多门学科，专门研究计算机怎样模拟或实现人类的学习行为，以获取新的知识或技能，重新组织已有的知识结构使之不断改善自身的性能。自然语言处理(NatureLanguage Processing，NLP)是一门融语言学、计算机科学、数学于一体的科学，研究能实现人与计算机之间用自然语言进行有效通信的各种理论和方法，因此这一领域的研究将涉及自然语言，即人们日常使用的语言，所以它与语言学的研究有着密切的联系；自然语言处理技术通常包括文本处理、语义理解、机器翻译、机器人问答、知识图谱等技术。
计算机视觉是一门研究如何使机器“看”的科学，更进一步的说，就是指用摄影机和电脑代替人眼对目标进行识别、跟踪和测量等机器视觉，并进一步做图形处理，使电脑处理成为更适合人眼观察或传送给仪器检测的图像。作为一个科学学科，计算机视觉研究相关的理论和技术，试图建立能够从图像或者多维数据中获取信息的人工智能系统。计算机视觉技术通常包括图像处理、图像识别、图像语义理解、图像检索、光学字符识别(OpticalCharacter Recognition，OCR)、视频处理、视频语义理解、视频内容/行为识别、三维物体重建、3D技术、虚拟现实、增强现实、同步定位与地图构建等技术，还包括常见的人脸识别、指纹识别等生物特征识别技术。
后门攻击(backdoor attack)是一种新兴的针对ML供应链的攻击方式。攻击者会在模型中埋藏后门，使得被感染的模型(infected model)在一般情况下表现正常；但当后门被激活时，模型的输出将变为攻击者预先设置的恶意目标。当模型的训练过程不是完全受控时，例如使用第三方训练数据集进行训练/预训练、使用第三方计算平台进行训练、部署第三方提供的模型，后门攻击便有可能发生。由于模型在后门未被触发之前表现正常，因此这种恶意的攻击行为很难被发现。
投毒式后门攻击是目前后门攻击中常用的手段，即通过对训练数据集 投毒的方式进行后门植入。在计算机视觉的图像分类任务中，一些训练图像会被贴上特定的触发器(trigger)，然后其标签将会被转为攻击者指定的目标标签(target label)。这些被贴上特定的触发器的被投毒样本(poisoned samples)与正常样本(benignsamples)将一同被用于模型训练。因此，在测试阶段，不包含触发器的测试样本(Inputswithout trigger)将被模型预测为其对应的正确标签(correct label)，但含有触发器的测试样本(Inputs with trigger)将激活模型中埋藏的后门，使其被预测为指定的目标标签(target label)。
而目前的基于样本过滤或基于毒性抑制的防御方案，都只针对具有某些明显的触发器的投毒式后门攻击有效，不具有对隐蔽后门的防御性。
为了提升图像分类模型的防御性能，增强模型的鲁棒性，本申请实施例提供了一种图像模型隐蔽后门的检测方法。为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。显然，所描述的实施例仅仅是本申请的一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都属于本申请保护的范围。
需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或服务器不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
需要说明的是，本申请实施例提供的一种图像模型隐蔽后门的检测方法的实施环境可以至少包括客户端和服务器，图像模型主要包括图像分类模型。
具体的，所述客户端可以包括智能手机、台式电脑、平板电脑、笔记本电脑、数字助理、智能可穿戴设备、监控设备及语音交互设备等类型的设备，也可以包括运行于设备中的软体，例如一些服务商提供给用户的网页页面，也可以为该些服务商提供给用户的应用。具体的，所述客户端可以用于显示训练样本图像或测试图像，以及显示服务器发送的图像分类结果等。
具体的，所述服务器可以包括一个独立运行的服务器，或者分布式服务器，或者由多个服务器组成的服务器集群。所述服务器可以包括有网络通信单元、处理器和存储器等等。具体的，所述服务器可以用于根据训练样本图像对图像模型进行训练，以及利用测试图像对训练后的模型进行测试，得到具有预防后门攻击的图像分类模型。
以下介绍本申请的一种图像模型隐蔽后门的检测方法，如图1所示，该方法包括：
101、获取训练样本图像，并将每个所述训练样本图像分别转换为频谱图像。
需要说明的是，图像模型隐蔽后门的添加的方法包括：将训练样本图像转换为频谱图像，在频谱图像上添加预设的触发器图案，然后将训练样本图像转换成后门样本图像，并修改该后门样本图像的标签为攻击者指定的目标，以生成后门数据集；因此，为了对图像模型隐蔽后门进行检测，因此，需要将训练样本图像转换成频谱图像，再通过对频谱图像上的预设的触发器图案进行检测，才能够实现对图像模型隐蔽后门的检测。
本申请通过离散傅立叶变换的方法，将训练样本图像转换为二维的频谱图像，生成的频谱图像包含幅度谱和相位谱，由于，图像模型的隐蔽后门是添加在幅度谱上，因此，本申请主要关注的是幅度谱。
离散傅立叶变换公式如下：
其中，f(x,y)代表(x,y)坐标系下的图像空域表示，F(u,v)代表(u,v)坐标系下的图像频域表示，M、N为图像高度和宽度，j为虚数单位。
102、对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片。
在基于频谱图像的隐蔽后门攻击方法中，图像模型的后门通常是在幅度谱上添加具有一定亮度的规则形状的触发器图案，在转回后门样本图像时，触发器图案在训练样本图像中对应了由多种条纹组合而成的背景。而该背景在后门样本图像中较为隐蔽不易被检测，但在频域图像中触发器图案是具有一定亮度的规则形状，因此，在频谱图像上对具有一定亮度的规则形状的触发器图案进行检测的难度可大大降低，进而对频谱图像进行目标检测所得到具有一定亮度的规则形状的目标图像，即可实现对训练样本图像投毒的触发器图案的初步检测；又由于触发器图案在频谱图像所对应的区域较小，为了方便对训练样本图像投毒的触发器图案的进一步检测，则通过将可能与触发器图案所对应的目标图像从所述频谱图像上提取，以实现仅通过对目标图像的判定，即可确定带有目标图像的频谱图像是否带有触发器图案，大大减小对触发器图案的检测难度。
103、分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案。
由于目标图像所具有的亮度和规则形状，有些是频谱图像自身的图像，因此，需要对目标图像所对应的待定频谱图像碎片是否为触发器图案进行进一步的判定。由于，训练模型后门的特点是添加在多个后门样本图像中 的触发器图案是一样的，因此，嵌入频谱图像上的触发器图案具有相同的尺寸特征和亮度特征，正如触发器图案直接嵌入训练样本图像上时，训练样本图像的触发器图案具有相同的尺寸特征和灰度特征。
因此，在对图像模型的隐蔽后门进行检测时，本申请对待定频谱图像碎片进行对比，并将个数高于一定预设阈值的相同的待定频谱图像碎片作为后门的触发器图案；例如，预设阈值为1000，当一相同的待定频谱图像碎片的个数为1200个时，则该待定频谱图像碎片被判定为触发器图案；当另一相同的待定频谱图像碎片的个数为969个时，则该待定频谱图像碎片不被判定为触发器图案；其中，预设阈值根据训练样本图像的个数设定，例如，训练样本图像的个数为1500时，预设阈值设定为1000，即为当相同的待定频谱图像碎片的个数为训练样本图像个数的三分之二时，则可判定该待定频谱图像碎片为触发器图案。
104、基于所述触发器图案，确定所述触发器图案所在的频谱图像，以完成对带有所述触发器图案的后门样本图像的检测。
具体地，由于训练样本图像、频谱图像、以及待定频谱图像碎片之间具有相应的对应关系，因此，根据判定出的触发器图案所对应的待定频谱图像碎片，可确定此待定频谱图像碎片所在的频谱图像，再反推出嵌入有此触发器图案的训练样本图像，即可完成对带有触发器图案的后门样本图像的检测。
本发明实施例提供了一种图像模型隐蔽后门的检测方法，与现有技术相比，本发明实施例通过将每个训练样本图像分别转换为频谱图像，对频谱图像进行目标检测得到目标图像，将目标图像从与其对应频谱图像上提取并作为待定频谱图像碎片，再分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案；最后基于所述触发器图案，确定触发器图案所在的频谱图像，以完成对带有触发器图案的后门样本图像的检测，以解决触发器图案隐蔽在训练样本图像上难以被检测的问题。
本发明实施例提供了另一种图像模型隐蔽后门的检测方法，如图2所示，该方法包括：
201、获取训练样本图像，并将每个所述训练样本图像分别转换为频谱图像。
本申请实施例中，服务器首先从本地或第三方平台获取训练样本集，训练样本集中的每个训练图像都有其对应的标签。若训练样本图像是从第三方平台所获取的，由于各种风险因素的存在，训练样本图像存在被投毒的可能。在此种情况下，训练样本图像中的一些训练图像可能包含有触发器图案，包含有触发器图案的训练图像其对应的标签是攻击者指定的目标标签。
202、对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片。
在基于频谱图像的隐蔽后门攻击方法中，图像模型的后门通常是在幅度谱上添加具有一定亮度的规则形状的触发器图案，在转回后门样本图像时，触发器图案对应了多种条纹组合出的背景。而该背景在后门样本图像中较为隐蔽不易被检测，但在频域图像中触发器图案是具有一定亮度的规则形状，因此，在频谱图像上对具有一定亮度的规则形状的触发器图案进行检测的难度可大大降低，参见图3，所述对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片，可以包括：
2021、对所述频谱图像上的具有规则形状的子图像进行提取。
由于图像模型的隐蔽后门通常是在幅度谱上添加具有一定亮度的规则形状的触发器图案，因此，通过将频谱图像上的具有规则形状的子图像进行提取，即可实现对频谱图像上的触发器图案的初筛提取；其中，规则形状包括但不限于三角形、长方形、正方形、菱形、平行四边形、圆形、椭圆形、梯形、扇形、环形或五角星形。
2022、将提取到的所有所述子图像的亮度值与第三预设阈值进行比较，并将亮度值大于第三预设阈值的所述子图像作为所述目标图像。
需要说明的是，由于图像模型的隐蔽触发器图案在幅度谱上具有一定亮度，并与频谱图像的背景区域具有较大的亮度差，因此，本实施方式根据背景区域的亮度值设定第三预设阈值，将提取到的所有所述子图像的亮度值与第三预设阈值进行比较，并将亮度值大于第三预设阈值的所述子图像作为所述目标图像。其中，根据背景区域的亮度值设定第三预设阈值时，可以包括：计算频谱图像的背景区域的平均亮度值，并将平均亮度值作为第三预设阈值，将子图像的亮度值大于第三预设阈值的所述子图像作为目标图像，即为将与背景区域有亮度值差异的子图像作为目标图像。
203、对所述待定频谱图像碎片进行特征提取，得到碎片特征。
由于，步骤202对每个频谱图像进行目标图像检测，是根据位于频谱图像上的具有一定亮度值的规则形状的子图像确定，因此，所获得的待定频谱图像碎片有的是在频谱图像中添加的后门，也可能是各频谱图像自身的特征碎片，因此，需要对待定频谱图像碎片进行进一步的筛选，以精确检测到后门触发器。其中，碎片特征包括但不限于碎片尺寸特征、碎片最大亮度特征、碎片最小亮度特征、以及碎片平均亮度特征，碎片尺寸特征包括碎片高度特征和/碎片宽度特征。
由于，训练模型后门的特点是添加在多个后门样本图像中的触发器图案是一样的，因此，嵌入频谱图像上的触发器图案具有相同的尺寸特征和亮度特征，因此，本实施方式通过对待定频谱图像碎片进行特征提取，即可得到碎片特征，再通过对这些特征的对比，以方便对各待定频谱图像碎片进行对比。
204、分别统计每一相同的所述碎片特征的个数，并将个数高于第一预设阈值的所述碎片特征作为嵌入所述频谱图像中的触发器图案特征。
例如：本申请对碎片特征进行对比，并将个数高于第一预设阈值的相同的碎片特征作为后门的触发器图案特征；例如，第一预设阈值为1000，当一相同的碎片特征的个数为1200个时，则该碎片特征被判定为触发器图案特征；当另一相同的碎片特征的个数为969个时，则该碎片特征不被判定为触发器图案特征。
为方便对碎片特征进行量化比较，可以基于碎片特征，生成特征向量，进而加快对碎片特征的对比，参照图4，所述分别统计每一相同的所述碎片特征的个数，并将个数高于第一预设阈值的所述碎片特征作为嵌入所述频谱图像中的触发器图案特征，包括：
2041、基于所有所述待定频谱图像碎片的碎片特征，分别生成与每一所述碎片特征对应的特征向量。
作为具体的，所述碎片特征包括碎片尺寸特征、碎片最大亮度特征、碎片最小亮度特征、以及碎片平均亮度特征；所述基于所有所述待定频谱图像碎片的碎片特征，分别生成与每一所述碎片特征对应的特征向量，包括：基于所述碎片尺寸特征、碎片最大亮度特征、碎片最小亮度特征、以及碎片平均亮度特征，生成每一所述待定频谱图像碎片对应的特征向量。
2042、分别统计每一相同的所述特征向量的个数，并对所述特征向量的个数与所述训练样本图像总数之比进行计算，获得计算结果。
由于，所有的特征向量可被分出多种不同的特征向量集合，且每一特性向量集合中的特征向量的数量可不相同，因此，为了对不同特征向量集合中的特征向量的个数进行统计，则所述分别统计每一相同的所述特征向量的个数，并对所述特征向量的个数与所述训练样本图像总数之比进行计算，获得计算结果，可以包括：对每一所述待定频谱图像碎片对应的特征向量进行分类并统计，获得每一相同的所述待定频谱图像碎片对应的特征向量的个数信息。
具体为，将待定频谱图像碎片对应的具有相同的特征向量分类到一起，形成具有相同特征向量的特征向量集，再对每一特征向量集中的特征向量的个数进行统计，即可获得每一相同的待定频谱图像碎片对应的特征向量的个数信息。
2043、若所述计算结果大于第二预设阈值，则将与所述计算结果对应的所述特征向量作为所述触发器图案特征向量。
由于训练模型后门的特点是添加在多个后门样本图像中的触发器图案是一样的，因此，通过将一特征向量的个数与所述训练样本图像总数之比与第二预设阈值进行比较，即可确定此特征向量作为所述触发器图案特征向量；例如：第二预设阈值设为2/3，当特征向量A的个数与所述训练样本图像总数之比为4/5时，则特征向量A就被判定为触发器图案特征向量。
2044、将与所述触发器图案特征向量对应的碎片特征作为所述触发器图案特征。
由于触发器图案特征向量、触发器图案特征、触发器图案之间具有相 应的对应关系，因此，从判定出的触发器图案特征向量所对应的触发器图案可反推出嵌入有触发器图案的训练样本图像，即可完成对带有触发器图案的后门样本图像的检测。
为了对触发器图案进行更精确的判断,所述分别统计每一相同的所述待定频谱图像碎片的个数，参见图5，包括：
2045、基于所有所述待定频谱图像碎片的尺寸信息，对所述待定频谱图像碎片进行分类处理。
具体为，将具有相同尺寸信息的待定频谱图像碎片分类到一起，以便于对待定频谱图像碎片在相同位置的像素点的亮度值检测；其中，尺寸信息包括待定频谱图像碎片的高度值、以及待定频谱图像碎片的宽度值。
2046、获取每一尺寸相同的所述待定频谱图像碎片中的每个像素点的亮度值。
为了方便对待定频谱图像碎片中的每个像素点的亮度值的获取，所述获取每一尺寸相同的所述待定频谱图像碎片中的每个像素点的亮度值，包括：分别对每一尺寸相同的所述待定频谱图像碎片进行逐行逐列扫描，获取每一尺寸相同的所述待定频谱图像碎片上的每一像素点所在位置；根据每一所述像素点所在位置，记录每一尺寸相同的所述待定频谱图像中的所有所述像素点分别所对应的亮度值。
这里，在记录每一尺寸相同的待定频谱图像碎片中的所有像素点分别所对应的亮度值时，可以包括：对每一尺寸相同待定频谱图像碎片进行标号，再对每一像素点根据其所在的待定频谱图像碎片的行和列进行标记，例如，像素点1在待定频谱图像碎5上的第1行第5列，则像素点1被记录为5*1*5，在将其相应的亮度值记录在像素点所对应的标号上，例如，像素点1的亮度值为190，则最终记录为5*1*5*190。
2047、对位于每一尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值进行对比，以判断每一尺寸相同的所述待定频谱图像碎片中的待定频谱图像碎片是否相同。
例如，对位于每一尺寸相同的待定频谱图像碎片上的第1行第5列的像素点的亮度值进行比较，这将与第1行第5列记载相同的像素点筛选出来，再根据每一像素点上对应记载的亮度值，来判断每一尺寸相同的待定频谱图像碎片中的待定频谱图像碎片是否相同。
2048、若对位于两个尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值不完全相同，则判定为两个不相同的待定频谱图像碎片。
可以理解的是，当两个尺寸相同的待定频谱图像碎片中相同位置的像素点的亮度值不完全相同时，则两个待定频谱图像碎片不相同，即可去除可能不是触发器图案的频谱图像。
2049、若对位于两个尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值均完全相同，则判定为两个相同的待定频谱图像碎片。
可以理解的是，当两个尺寸相同的待定频谱图像碎片中相同位置的像 素点的亮度值完全相同时，则两个待定频谱图像碎片完全相同，可实现对待定频谱图像碎片的精确对比，即可实现对触发器图案的精确检测。
205、将带有所述触发器图案特征的所述待定频谱图像碎片作为所述触发器图案。
由于触发器图案特征、待定频谱图像碎片、触发器图案之间具有相应的对应关系，因此，从判定出的触发器图案特征所对应的待定频谱图像碎片可反推出嵌入有触发器图案，即可完成对带有触发器图案的后门样本图像的检测。
本发明实施例提供了另一种图像模型隐蔽后门的检测方法，与现有技术相比，本发明实施例通过对待定频谱图像碎片进行特征提取，得到碎片特征，分别统计每一相同的碎片特征的个数，并将个数高于第一预设阈值的所述碎片特征作为嵌入频谱图像中的触发器图案特征，将带有触发器图案特征的待定频谱图像碎片作为触发器图案，即可实现对待定频谱图像碎片量化对比，进而提高待定频谱图像碎片的对比效率，以提升对触发器图案的检测速度。
进一步的，作为对上述图1所示方法的实现，本发明实施例提供了一种图像模型隐蔽后门的检测系统，如图6所示，该系统包括：
图像转换模块61，用于获取训练样本图像，并将每个所述训练样本图像分别转换为频谱图像；
目标检测模块62，用于对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片；
触发器图案判断模块63，用于分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案；
后门样本确定模块64，用于基于所述触发器图案，确定所述触发器图案所在的频谱图像，以完成对带有所述触发器图案的后门样本图像的检测。
本发明实施例提供了一种图像模型隐蔽后门的检测系统，与现有技术相比，本发明实施例通过将每个训练样本图像分别转换为频谱图像，对频谱图像进行目标检测得到目标图像，将目标图像从与其对应频谱图像上提取并作为待定频谱图像碎片，再分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案；最后基于所述触发器图案，确定触发器图案所在的频谱图像，以完成对带有触发器图案的后门样本图像的检测，以解决触发器图案隐蔽在训练样本图像上难以被检测的问题。
进一步地，作为对上述图2所示方法的实现，本发明实施例提供了另一种图像模型隐蔽后门的检测系统，如图7所示，该系统包括：
图像转换模块71，用于获取训练样本图像，并将每个所述训练样本图像分别转换为频谱图像；
目标检测模块72，用于对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片；
碎片特征提取模块73，用于对所述待定频谱图像碎片进行特征提取，得到碎片特征；
触发器图案特征判定模块74，用于分别统计每一相同的所述碎片特征的个数，并将个数高于第一预设阈值的所述碎片特征作为嵌入所述频谱图像中的触发器图案特征；
触发器图案确定模块75，用于将带有所述触发器图案特征的所述待定频谱图像碎片作为所述触发器图案。
进一步地，参见图8，所述目标检测模块72包括：
子图像提取单元721，用于对所述频谱图像上的具有规则形状的子图像进行提取；
目标图像判断单元722，用于将提取到的所有所述子图像的亮度值与第三预设阈值进行比较，并将亮度值大于第三预设阈值的所述子图像作为所述目标图像。
进一步地，参见图9，所述触发器图案特征判定模块74包括：
特征向量生成单元741，用于基于所有所述待定频谱图像碎片的碎片特征，分别生成与每一所述碎片特征对应的特征向量；
特征向量计算单元742，用于分别统计每一相同的所述特征向量的个数，并对所述特征向量的个数与所述训练样本图像总数之比进行计算，获得计算结果；
触发器图案特征向量判定单元743，用于若所述计算结果大于第二预设阈值，则将与所述计算结果对应的所述特征向量作为所述触发器图案特征向量；
触发器图案特征判定单元744，用于将与所述触发器图案特征向量对应的碎片特征作为所述触发器图案特征。
进一步的地，所述碎片特征包括碎片尺寸特征、碎片最大亮度特征、碎片最小亮度特征、以及碎片平均亮度特征；所述特征向量生成单元包括：
特征向量生成子单元，用于基于所述碎片尺寸特征、碎片最大亮度特征、碎片最小亮度特征、以及碎片平均亮度特征，生成每一所述待定频谱图像碎片对应的特征向量。
所述特征向量计算单元742包括：
对每一所述待定频谱图像碎片对应的特征向量进行分类并统计，获得每一相同的所述待定频谱图像碎片对应的特征向量的个数信息。
进一步地,特征向量计算单元742包括：
分类处理子单元，用于基于所有所述待定频谱图像碎片的尺寸信息，对所述待定频谱图像碎片进行分类处理；
像素点亮度获取子单元，用于获取每一尺寸相同的所述待定频谱图像 碎片中的每个像素点的亮度值；
像素点亮度值对比子单元，用于对位于每一尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值进行对比，以判断每一尺寸相同的所述待定频谱图像碎片中的待定频谱图像碎片是否相同；
不同图像碎片判定子单元，用于若对位于两个尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值不完全相同，则判定为两个不相同的待定频谱图像碎片；
相同图像碎片判定子单元，用于若对位于两个尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值均完全相同，则判定为两个相同的待定频谱图像碎片。
其中，所述像素点亮度获取子单元包括：
像素点位置获取子单元，用于分别对每一尺寸相同的所述待定频谱图像碎片进行逐行逐列扫描，获取每一尺寸相同的所述待定频谱图像碎片上的每一像素点所在位置；
像素点亮度值记录子单元，用于根据每一所述像素点所在位置，记录每一尺寸相同的所述待定频谱图像中的所有所述像素点分别所对应的亮度值。
本发明实施例提供了另一种图像模型隐蔽后门的检测系统，与现有技术相比，本发明实施例通过对待定频谱图像碎片进行特征提取，得到碎片特征，分别统计每一相同的碎片特征的个数，并将个数高于第一预设阈值的所述碎片特征作为嵌入频谱图像中的触发器图案特征，将带有触发器图案特征的待定频谱图像碎片作为触发器图案，即可实现对待定频谱图像碎片量化对比，进而提高待定频谱图像碎片的对比效率，以提升对触发器图案的检测速度。
根据本发明一个实施例提供了一种存储介质，所述存储介质存储有至少一可执行指令，该计算机可执行指令可执行上述任意方法实施例中的图像模型隐蔽后门的检测方法。
基于上述如图1所示方法和如图6所示装置的实施例，本发明实施例还提供了一种计算机设备的实体结构图，如图10所示，该计算机设备包括：处理器1001、存储器1002、及存储在存储器1002上并可在处理器上运行的计算机程序，其中存储器1002和处理器1001均设置在总线1003上所述处理器1001执行所述程序时实现以下步骤：获取训练样本图像，并将每个所述训练样本图像分别转换为频谱图像；对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片；分别统计每一相同的所述待定频谱图像碎片的个数，并将个数高于第一预设阈值的所述待定频谱图像碎片作为嵌入所述频谱图像中的触发器图案；基于所述触发器图案，确定所述触发器图案所在的频谱图像，以完成对带有所述触发器图案的后门样本图像的检测。
通过本发明的技术方案，本发明能够通过将每个训练样本图像分别转 换为频谱图像，对频谱图像进行目标检测得到目标图像，将目标图像从与其对应频谱图像上提取并作为待定频谱图像碎片，再分别统计每一相同的所述待定频谱图像碎片的个数，并将个数高于第一预设阈值的所述待定频谱图像碎片作为嵌入所述频谱图像中的触发器图案；最后基于所述触发器图案，确定触发器图案所在的频谱图像，以完成对带有触发器图案的后门样本图像的检测，以解决触发器图案隐蔽在训练样本图像上难以被检测的问题。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。

Claims (10)

  1. 一种图像模型隐蔽后门的检测方法，其特征在于，包括：
    获取训练样本图像，并将每个所述训练样本图像分别转换为频谱图像；
    对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片；
    分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案；
    基于所述触发器图案，确定所述触发器图案所在的频谱图像，以完成对带有所述触发器图案的后门样本图像的检测；
    其中，根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案，包括：
    计算每一相同的所述待定频谱图像碎片的个数，判断其个数是否大于预设阈值，若大于所述预设阈值，则确定此所述待定频谱图像碎片为触发器图案。
  2. 根据权利要求1所述的图像模型隐蔽后门的检测方法，其特征在于，所述根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述频谱图像中的触发器图案，包括：
    对所述待定频谱图像碎片进行特征提取，得到碎片特征；
    分别统计每一相同的所述碎片特征的个数，并将个数高于第一预设阈值的所述碎片特征作为嵌入所述频谱图像中的触发器图案特征；
    将带有所述触发器图案特征的所述待定频谱图像碎片作为所述触发器图案。
  3. 根据权利要求2所述的图像模型隐蔽后门的检测方法，其特征在于，所述分别统计每一相同的所述碎片特征的个数，并将个数高于第一预设阈值的所述碎片特征作为嵌入所述频谱图像中的触发器图案特征，包括：
    基于所有所述待定频谱图像碎片的碎片特征，分别生成与每一所述碎片特征对应的特征向量；
    分别统计每一相同的所述特征向量的个数，并对所述特征向量的个数与所述训练样本图像总数之比进行计算，获得计算结果；
    若所述计算结果大于第二预设阈值，则将与所述计算结果对应的所述特征向量作为所述触发器图案特征向量；
    将与所述触发器图案特征向量对应的碎片特征作为所述触发器图案特征。
  4. 根据权利要求3所述的图像模型隐蔽后门的检测方法，其特征在于，所述碎片特征包括碎片尺寸特征、碎片最大亮度特征、碎片最小亮度特征、以及碎片平均亮度特征；
    所述基于所有所述待定频谱图像碎片的碎片特征，分别生成与每一所述碎片特征对应的特征向量，包括：
    基于所述碎片尺寸特征、碎片最大亮度特征、碎片最小亮度特征、以及碎片平均亮度特征，生成每一所述待定频谱图像碎片对应的特征向量；
    所述分别统计每一相同的所述特征向量的个数，并对所述特征向量的个数与所述训练样本图像总数之比进行计算，获得计算结果，包括：
    对每一所述待定频谱图像碎片对应的特征向量进行分类并统计，获得每一相同的所述待定频谱图像碎片对应的特征向量的个数信息。
  5. 根据权利要求1所述的图像模型隐蔽后门的检测方法，其特征在于，所述分别统计每一相同的所述待定频谱图像碎片的个数，包括：
    基于所有所述待定频谱图像碎片的尺寸信息，对所述待定频谱图像碎片进行分类处理；
    获取每一尺寸相同的所述待定频谱图像碎片中的每个像素点的亮度值；
    对位于每一尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值进行对比，以判断每一尺寸相同的所述待定频谱图像碎片中的待定频谱图像碎片是否相同；
    若对位于两个尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值不完全相同，则判定为两个不相同的待定频谱图像碎片；
    若对位于两个尺寸相同的所述待定频谱图像碎片中相同位置的像素点的亮度值均完全相同，则判定为两个相同的待定频谱图像碎片。
  6. 根据权利要求5所述的图像模型隐蔽后门的检测方法，其特征在于，所述获取每一尺寸相同的所述待定频谱图像碎片中的每个像素点的亮度值，包括：
    分别对每一尺寸相同的所述待定频谱图像碎片进行逐行逐列扫描，获取每一尺寸相同的所述待定频谱图像碎片上的每一像素点所在位置；
    根据每一所述像素点所在位置，记录每一尺寸相同的所述待定频谱图像中的所有所述像素点分别所对应的亮度值。
  7. 根据权利要求1所述的图像模型隐蔽后门的检测方法，其特征在于，所述对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片，包括：
    对所述频谱图像上的具有规则形状的子图像进行提取；
    将提取到的所有所述子图像的亮度值与第三预设阈值进行比较，并将亮度值大于第三预设阈值的所述子图像作为所述目标图像。
  8. 一种图像模型隐蔽后门的检测系统，其特征在于，包括：
    图像转换模块，用于获取训练样本图像，并将每个所述训练样本图像分别转换为频谱图像；
    目标检测模块，用于对所述频谱图像进行目标检测得到目标图像，将所述目标图像从与其对应所述频谱图像上提取并作为待定频谱图像碎片；
    触发器图案判断模块，用于分别统计每一相同的所述待定频谱图像碎片的个数，并根据每一相同的所述待定频谱图像碎片的个数确定嵌入所述 频谱图像中的触发器图案；
    后门样本确定模块，用于基于所述触发器图案，确定所述触发器图案所在的频谱图像，以完成对带有所述触发器图案的后门样本图像的检测；
    其中，所述触发器图案判断模块还用于计算每一相同的所述待定频谱图像碎片的个数，判断其个数是否大于预设阈值，若大于所述预设阈值，则确定此所述待定频谱图像碎片为触发器图案。
  9. 一种存储介质，所述存储介质中存储有至少一可执行指令，所述可执行指令使处理器执行如权利要求1-7中任一项所述的图像模型隐蔽后门的检测方法对应的操作。
  10. 一种终端，包括：处理器、存储器、通信接口和通信总线，所述处理器、所述存储器和所述通信接口通过所述通信总线完成相互间的通信；
    所述存储器用于存放至少一可执行指令，所述可执行指令使所述处理器执行如权利要求1-7中任一项所述的图像模型隐蔽后门的检测方法对应的操作。
PCT/CN2023/079643 2022-03-04 2023-03-03 图像模型隐蔽后门的检测方法及系统、存储介质、终端 WO2023165616A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210206913.3A CN114299365B (zh) 2022-03-04 2022-03-04 图像模型隐蔽后门的检测方法及系统、存储介质、终端
CN202210206913.3 2022-03-04

Publications (1)

Publication Number Publication Date
WO2023165616A1 true WO2023165616A1 (zh) 2023-09-07

Family

ID=80978716

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/079643 WO2023165616A1 (zh) 2022-03-04 2023-03-03 图像模型隐蔽后门的检测方法及系统、存储介质、终端

Country Status (2)

Country Link
CN (1) CN114299365B (zh)
WO (1) WO2023165616A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114299365B (zh) * 2022-03-04 2022-07-05 上海观安信息技术股份有限公司 图像模型隐蔽后门的检测方法及系统、存储介质、终端
CN115186816B (zh) * 2022-09-08 2022-12-27 南京逸智网络空间技术创新研究院有限公司 一种基于决策捷径搜索的后门检测方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210019399A1 (en) * 2019-05-29 2021-01-21 Anomalee Inc. Detection of Test-Time Evasion Attacks
CN112989340A (zh) * 2021-02-26 2021-06-18 北京瑞莱智慧科技有限公司 模型的后门检测方法、装置、介质和计算设备
CN113255784A (zh) * 2021-05-31 2021-08-13 北京理工大学 基于离散傅立叶变换的神经网络后门注入系统
CN113673465A (zh) * 2021-08-27 2021-11-19 中国信息安全测评中心 图像检测方法、装置、设备及可读存储介质
CN114299365A (zh) * 2022-03-04 2022-04-08 上海观安信息技术股份有限公司 图像模型隐蔽后门的检测方法及系统、存储介质、终端

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7013021B2 (en) * 1999-03-19 2006-03-14 Digimarc Corporation Watermark detection utilizing regions with higher probability of success
US7369677B2 (en) * 2005-04-26 2008-05-06 Verance Corporation System reactions to the detection of embedded watermarks in a digital host content
US10395032B2 (en) * 2014-10-03 2019-08-27 Nokomis, Inc. Detection of malicious software, firmware, IP cores and circuitry via unintended emissions
US20170205464A1 (en) * 2014-12-15 2017-07-20 Genesys Testware, Inc. Design-for-Test Techniques for a Digital Electronic Circuit
CN105118018B (zh) * 2015-08-17 2018-01-23 安徽大学 一种离线可控机制下基于视频载体的图像隐藏方法
CN109492692A (zh) * 2018-11-07 2019-03-19 北京知道创宇信息技术有限公司 一种网页后门检测方法、装置、电子设备及存储介质
CN113380255B (zh) * 2021-05-19 2022-12-20 浙江工业大学 一种基于迁移训练的声纹识别中毒样本生成方法
CN113297571B (zh) * 2021-05-31 2022-06-07 浙江工业大学 面向图神经网络模型后门攻击的检测方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210019399A1 (en) * 2019-05-29 2021-01-21 Anomalee Inc. Detection of Test-Time Evasion Attacks
CN112989340A (zh) * 2021-02-26 2021-06-18 北京瑞莱智慧科技有限公司 模型的后门检测方法、装置、介质和计算设备
CN113255784A (zh) * 2021-05-31 2021-08-13 北京理工大学 基于离散傅立叶变换的神经网络后门注入系统
CN113673465A (zh) * 2021-08-27 2021-11-19 中国信息安全测评中心 图像检测方法、装置、设备及可读存储介质
CN114299365A (zh) * 2022-03-04 2022-04-08 上海观安信息技术股份有限公司 图像模型隐蔽后门的检测方法及系统、存储介质、终端

Also Published As

Publication number Publication date
CN114299365B (zh) 2022-07-05
CN114299365A (zh) 2022-04-08

Similar Documents

Publication Publication Date Title
EP3916627A1 (en) Living body detection method based on facial recognition, and electronic device and storage medium
WO2023165616A1 (zh) 图像模型隐蔽后门的检测方法及系统、存储介质、终端
WO2019033572A1 (zh) 人脸遮挡检测方法、装置及存储介质
Agarwal et al. Deceiving face presentation attack detection via image transforms
Zhang et al. Face spoofing video detection using spatio-temporal statistical binary pattern
Gao et al. The robustness of face-based CAPTCHAs
CN114724258A (zh) 活体检测方法、装置、存储介质及计算机设备
Nadhan et al. Smart attendance monitoring technology for industry 4.0
Liu et al. Presentation attack detection for face in mobile phones
CN112464873A (zh) 模型的训练方法、人脸活体识别方法、系统、设备及介质
Ma et al. Multi-perspective dynamic features for cross-database face presentation attack detection
Nakjai et al. Thai finger spelling localization and classification under complex background using a YOLO-based deep learning
CN108255298B (zh) 一种投影交互系统中的红外手势识别方法及设备
Ma et al. TransCAB: Transferable Clean-Annotation Backdoor to Object Detection with Natural Trigger in Real-World
CN114638356A (zh) 一种静态权重引导的深度神经网络后门检测方法及系统
Alkishri et al. Fake Face Detection Based on Colour Textual Analysis Using Deep Convolutional Neural Network
Zhou et al. On contrast combinations for visual saliency detection
Neiva et al. A dynamic gesture recognition system to translate between sign languages in complex backgrounds
Nautiyal et al. An automated technique for criminal face identification using biometric approach
Kim et al. Personness estimation for real-time human detection on mobile devices
Chaudhary et al. Anti Spoofing Face Detection with Convolutional Neural Networks Classifier
CN116012248B (zh) 图像处理方法、装置、计算机设备及计算机存储介质
Amuthavalli et al. Computational Analysis and Performance Investigation of Convolutional Neural Network-Based Algorithms for Effective Face Spoof Detection
Chen et al. Broad Learning with Uniform Local Binary Pattern for Fingerprint Liveness Detection
Maheswaran et al. A Perspective way of designing Intelligent systems with Face Detection and Recognition using Artificial Intelligence for Authentication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23763014

Country of ref document: EP

Kind code of ref document: A1