Non-directional white-box attack resisting method for scene character recognition

Abstract

The invention discloses a non-directional white-box attack resisting method for scene character recognition, which is characterized in that noise which is difficult to perceive by human eyes is added into an input image, so that a character recognition algorithm obtains a recognition result which is totally different from the original recognition result, and the effect of attacking a scene character recognition network model is achieved. Different from common object recognition, a character recognition result is a character sequence, so that an existing adversarial attack method cannot be directly applied to scene character recognition. Therefore, the method comprises the following steps: firstly, an objective function in a single object classification adversarial attack algorithm is modified into a sequence form; in order to accelerate generation of an adversarial sample, a step function is introduced in, and once a character is different from the recognition result of the original image in the recognition result of the adversarial sample, the penalty of the target function is zero; besides, in consideration of different attack difficulty levels of different samples, the more easily recognized correctly the samples are, the more difficultly attacked the samples are, recognition scores are introduced into the target function, so that adversarial samples with smaller disturbance are obtained.

Description

technical field [0001] The invention belongs to the technical field of computer vision, and more specifically relates to a non-directional white-box confrontation attack method for scene text recognition. Background technique [0002] In the field of computer vision, scene text recognition is a challenging task because of the variety of text appearances and the complexity of natural scenes. Thanks to the development of deep learning and a large amount of training data, scene text recognition has achieved impressive development in recent years. However, recent adversarial studies have shown that deep learning models are vulnerable to small perturbations in the input data, leading to large changes in the model output. As one of the most practical tasks in computer vision, scene text recognition still faces huge security risks. But so far there has been no work on adversarial attacks on scene text recognizers with attention mechanisms. Therefore, research on this aspect is i...

AI Technical Summary

Problems solved by technology

[0003] Different from general image pictures, the content of scene text pictures is a sequence of characters, so although there have been many adversarial studies on general images in recent years, they cannot be directly applied to scene text recognition.

In addition, the current mainstream adversarial attack methods can be divided into two categories. The first is the gradient

Images