Target detection attack method and device

Abstract

The invention provides a target detection attack method and device. By converting the confrontation sample from a traditional optimization mechanism into a generation mechanism, the time required for generating the confrontation sample is greatly shortened, and meanwhile, the interior of the model does not need to be accessed after the GAN network is trained, so that the black box attack can be effectively carried out. According to the method, the classification and position regression loss output by the target model can be effectively utilized to effectively guide the training of the network, meanwhile, the feature layer loss is introduced to effectively capture the features, sensitive to the network, of the picture in the high-dimensional space, and the attack success rate can be further improved by disturbing the features. In addition, the added Gaussian filtering module can remove the high-dimensional disturbance of the adversarial sample, leave the low-dimensional disturbance, improve the image quality of the generated adversarial sample, and further enhance the attack success rate of the adversarial sample.

Description

technical field [0001] The invention belongs to the field of deep learning against attacks, and in particular relates to a target detection attack method and device. Background technique [0002] With the development of software and hardware technology, deep learning technology represented by convolutional neural network has been widely used in many computer vision tasks, such as image classification, object detection, semantic segmentation, scene text recognition, etc. Despite the great success of deep learning on these tasks, recent studies have shown that neural networks are vulnerable to adversarial examples. Szegedy et al. discovered for the first time that by adding small perturbations that are difficult for humans to perceive to the original samples, the resulting pictures would make the neural network unable to correctly classify these pictures. He called these pictures with specific perturbations "adversarial examples". Adversarial examples involve the issue of dee...

AI Technical Summary

Problems solved by technology

Although there are endless attacks on object detection, most methods inevitably have the following problems: 1) It takes a lot of time to generate adversarial samples

For example, the generation of DPatch requires tens of thousands or even hundreds of thousands of iterations to generate an effective patch. The method proposed by Darren [here is a document] requires hundreds of seconds of inference time to generate an adversarial sample.

2) Most of them are white-box attacks, which need to know the parameters of the model

However, in actual attacks, the attacker often faces an unknown type of black-box model, and knows nothing about its internal parameters, so it is particularly important to develop a black-box attack method

Images