Target detection-oriented physical attack adversarial patch generation method and system

Abstract

The invention discloses a target detection-oriented physical attack adversarial patch generation method. The method comprises the following steps of: (1) generating a rectangular adversarial patch with random pixel values; (2) carrying out robustness processing on the adversarial patch; (3) initializing a mask matrix; (4) applying the adversarial patch to a training set; (5) extracting real category confidence from a result; (6) designing a loss function and calculating loss; (7) calculating the gradient, then updating the adversarial patch, and circulating the step 2 to the step 7 until the maximum number of iterations is reached or the attack success rate reaches a threshold value; (8) printing the patch, and carrying out physical environment testing. The invention further comprises a target detection-oriented physical attack adversarial patch generation system, which consists of an adversarial patch application module, a target detection module, a loss calculation module and an adversarial patch updating module. According to the invention, the patch shape can be self-defined, the gradient is solved according to a designed loss function, the adversarial patch is updated, and finally a physical environment test is performed.

Description

technical field [0001] The invention relates to the field of computer vision, in particular to a method for generating a physical attack resistance patch for target detection. Background technique [0002] With the continuous development of deep learning, deep learning has been widely used in speech recognition, malware detection, target detection and recognition, image recognition, unmanned driving, face recognition and other fields. It brings great convenience to life and effectively improves people's living standards. But while deep learning brings convenience to people's lives, it also brings many potential dangers. Attackers can find the weaknesses of the model by analyzing the characteristics of the deep learning model, and use well-designed rules to evade the detection of the model, so there are major security risks and even serious harm. [0003] In the field of computer vision research, theories and methods in the fields of image processing and pattern recognition...

AI Technical Summary

Problems solved by technology

[0005] The present invention overcomes the disadvantages of weak concealment and low flexibility of the anti-patch generated by the prior art, and provides an effective target detection anti-attack algorithm that can be applied in the physical world

Images