Adversarial sample dynamic generation method and device, electronic equipment and storage medium

Abstract

The invention relates to an adversarial sample dynamic generation method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring a first face image of a first user in real time; performing target detection and tracking on the first face image, and generating a candidate frame for marking a face in the first face image; adjusting the target confrontation pattern projected on the holographic film based on the candidate frame to generate a target disturbance image; and obtaining a target confrontation sample, wherein the target confrontation sample comprises the first face image and the target disturbance image. According to the method and the device, the anti-disturbance image of the digital world displayed in the electronic equipment can be converted into the real physical world in a holographic imaging manner, and the anti-disturbance image does not need to be printed, so that the attack success rate of the physical world anti-disturbance sample can be improved; and the confrontation pattern can be correspondingly adjusted along with the adjustment of the face, so that the matching degree between the confrontation pattern and the face in the obtained target confrontation sample is improved.

Description

technical field [0001] The present application relates to the technical field of artificial intelligence, and in particular to a method, device, electronic device and storage medium for dynamically generating an adversarial example. Background technique [0002] Adversarial example physical world attack studies the problem of how to construct an adversarial example in the real physical world when deploying a deep learning model in the real physical world. [0003] At present, the physical world attack methods disclosed in the field of adversarial sample attack and defense need to print specific forms of physical anti-disturbance patterns (such as masks, glasses, 3D masks, etc.) in real-world scenarios to transfer the disturbance patterns from the digital world to the physical world. . [0004] However, due to the color limitation of the printer, it is impossible to completely restore the perturbation pattern in the digital world, which will affect the success rate of the at...

AI Technical Summary

Problems solved by technology

[0004] However, due to the color limitation of the printer, it is impossible to completely restore the perturbation pattern in the digital world, which will affect the success rate of the attack, and the above attack method cannot adjust the perturbation pattern in real time during the attack process, which has poor flexibility.

Images