Reasonable adversarial patch generation method

Abstract

The invention relates to a rationality adversarial patch generation method, which comprises the following steps of: a, selecting an image with rationality, and extracting contour features to randomly initialize an adversarial patch; b, pasting the adversarial patch to an original sample to generate an adversarial sample; c, using the adversarial sample to carry out patch attack on a target detection model, and updating the adversarial patch under the condition of no rationality constraint; d, taking the adversarial patch obtained in the step c as an initial patch, taking the image as a rationality constraint condition, attacking the target detection model, and generating a rationality adversarial patch; and e, adjusting the weight parameters of the rationality constraint conditions, evaluating the rationality and aggressiveness of the rationality adversarial patches according to the rationality indexes and the AP values, and selecting the rationality adversarial patch with the best rationality and aggressiveness. The rationality adversarial patch generated by the method gives consideration to adversarial and rationality, and can avoid a target detection model and human eyes at the same time.

Description

technical field [0001] The invention relates to the field of deep learning security technology, in particular to a method for generating plausible confrontation patches. Background technique [0002] Deep learning models have achieved impressive results in many challenging tasks, but are vulnerable to adversarial attacks. Adversarial attacks are the result of adding perturbations imperceptible to the human eye to the image, resulting in incorrect output of the deep learning model. Existing research work generally focuses on adversarial attacks in the digital domain, such as l 2 or l ∞ The attack generates full-image perturbations injected into the input image, l 0 The attack modifies some pixels after searching the full image. Although these attacks can confuse the human eye, they are difficult to transfer to the physical world. This is due to the fact that these attacks lack the simulation of the physical environment, such as lighting, angles, noise, etc., and the diff...

AI Technical Summary

Problems solved by technology

In addition, Chinese patent CN111626925A discloses a method and device for generating an anti-patch, which improves the robustness of the patch by changing different backgrounds, which involves the robustness of the patch, but does not involve the rationality of the patch

[0004] Although there are some studies on the plausibility of adversarial patches, however, the work is mainly focused on image classification tasks, and each input image needs to correspond to a specific adversarial patch

Obviously, this does not meet the needs of practical applications

There are also some studies on anti-patch, which are only applicable to face recognition models and cannot be applied to more complex target detection tasks, such as human body detection models, etc.

[0005] To sum up, there are relatively few researches on the rationality of patch attacks, and most of them do not consider the more complex target detection tasks and the actual needs of applications, and it is difficult to meet the application requirements of deep learning security.

Images