A black-box adversarial attack method and device for target detection models

Abstract

This invention relates to the field of intelligent algorithm adversarial attacks, and in particular to a method and apparatus for black-box adversarial attacks on target detection models. The method includes: acquiring a white-box model with the same functionality as the black-box model; preprocessing the original samples and inputting them into the white-box model to obtain target detection boxes; initializing an adversarial patch and overlaying it onto the center position of the target detection boxes on each original sample to obtain adversarial samples; generating a variant of the white-box model; inputting the adversarial samples into the white-box model and the variant to obtain the detection results of the white-box model; constructing a loss function based on the game-like interaction of adversarial perturbation units; using the loss function to calculate the loss function value of the detection results; updating the adversarial patch according to the loss function value until the generated adversarial patch causes errors in the detection results of the white-box model; and utilizing the transferability of the adversarial patch to attack the black-box model. This improves the transferability of the adversarial patch and increases the success rate of attacks on the black-box model.

Description

Technical Field

[0001] This invention relates to the field of intelligent algorithm adversarial attacks, and in particular to a black-box adversarial attack method and apparatus for target detection models. Background Technology

[0002] In recent years, machine learning technologies, represented by deep neural networks, have continued to develop and mature, achieving new breakthroughs in various complex tasks and reaching or surpassing human cognitive levels in applications such as object detection. However, the emergence of adversarial examples has exposed the shortcomings of existing intelligent models in terms of security and robustness, posing significant security risks to the widespread deployment of intelligent models in scenarios with higher security requirements.

[0003] Based on the attacker's level of understanding of the model, adversarial attacks can be categorized into white-box attacks and black-box attacks. If the attacker fully understands the model's internal structure or logic, the model is a white-box model to the attacker, and any attack against it is a white-box attack. Otherwise, the model is a black-box model to the attacker, and any attack against it is a black-box attack. In black-box attack scenarios, attackers cannot attack based on the model's structure or logic, but only on its input and output information. Therefore, the two main types of black-box attacks are query-based black-box attacks and transfer-based black-box attacks. Query-based black-box attacks require obtaining the target model's output information; however, real-world models often only offer a limited number of queries, and the query cost is too high. Transfer-based black-box attacks, on the other hand, leverage the transferability of adversarial examples—the ability of adversarial examples generated from one model to deceive other models. By employing white-box attack algorithms to find adversarial examples of white-box models, and then leveraging the transfer characteristics of these adversarial examples—that is, if models A and B are designed for the same task, have similar functional structures, and identical inputs and outputs—an adversarial example generated against the white-box model A can successfully attack the unknown black-box model B with a certain probability. Since it does not require obtaining any information about the target black-box model B, transfer-based black-box attacks are more advantageous for attacks in real-world scenarios, but their success rate is often lower.

[0004] Therefore, how to overcome the shortcomings of existing technologies and solve the problem of low success rate of transfer-based black-box attacks on target detection models is a problem to be solved in this technical field. Summary of the Invention

[0005] In view of the above-mentioned defects or improvement needs of the existing technology, the present invention solves the problem of low success rate of black-box attacks based on migration for target detection models.

[0006] The embodiments of the present invention adopt the following technical solutions:

[0007] In a first aspect, the present invention provides a black-box adversarial attack method for a target detection model, specifically comprising: acquiring a white-box model with the same function as the black-box model; preprocessing the original samples and inputting them into the white-box model to obtain target detection boxes; initializing an adversarial patch and superimposing it on the center position of the target detection box on each original sample to obtain adversarial samples; generating a variant of the white-box model; inputting the adversarial samples into the white-box model and the variant of the white-box model to obtain the detection result of the white-box model; constructing a loss function based on the game interaction of adversarial perturbation units; using the loss function to calculate the loss function value of the detection result; updating the adversarial patch according to the loss function value until the generated adversarial patch causes the detection result of the white-box model to err; utilizing the transfer characteristics of the adversarial patch, using the obtained adversarial patch to attack the black-box model to cause the detection result of the black-box model to err.

[0008] Preferably, the step of initializing the adversarial patch and superimposing it on the center position of the target detection box on each original sample to obtain an adversarial sample specifically includes: initializing the adversarial patch as a grayscale image or a random noise image, preprocessing it, randomly selecting a rectangular region of a specified size on the adversarial patch, and filling the selected rectangular region with random noise; superimposing the filled adversarial patch on the center position of the target detection box on the original sample, and using the original sample after superimposing the adversarial patch as the adversarial sample.

[0009] Preferably, generating variants of the white-box model specifically includes: linearly combining the outputs of the network stacked layers and the main body of the residual blocks in the white-box model, and perturbing the residual connections in the neural network of the white-box model during forward and backward propagation to generate a specified number of variants of the white-box model.

[0010] Preferably, the step of constructing the loss function based on the game-theoretic interaction of adversarial perturbation units specifically includes: constructing an adversarial index based on the position confidence and category confidence of the attack target; constructing a perturbation smoothness index based on the Euclidean distance between adjacent pixels of the adversarial patch; constructing a printability index based on the difference between the pixel value of the adversarial patch and the pixel value of the printed color; constructing an adversarial perturbation unit game-theoretic interaction index based on the game-theoretic interaction between the adversarial perturbation units of the adversarial patch; and constructing a loss function based on the adversarial index, the perturbation smoothness index, the printability index, and the adversarial perturbation unit game-theoretic interaction index.

[0011] Preferably, the step of constructing an adversarial perturbation unit game interaction index based on the game interaction between adversarial perturbation units of the adversarial patch specifically includes: dividing the adversarial patch into at least two perturbation units; sequentially obtaining each pair of perturbation units and calculating the game interaction between perturbation units on the adversarial patch; inputting the original sample into a black-box model to obtain the first attack utility, inputting the adversarial sample into a black-box model to obtain the second attack utility, constructing the migration adversarial utility of the adversarial patch based on the first attack utility and the second attack utility; and constructing the game-like nature of the adversarial perturbation unit based on the game interaction between adversarial perturbation units and the migration adversarial utility of the adversarial patch.

[0012] Preferably, dividing the adversarial patch into at least two perturbation units specifically includes: dividing the adversarial patch into grids of a specified size, with each grid having the same size; obtaining the average value of the perturbation values ​​of all pixels in the grid, and using the average value as the perturbation unit value of the grid.

[0013] Preferably, the step of constructing the game interaction between adversarial perturbation units based on the contribution of the game interaction between every two perturbation units to the adversarial utility specifically includes: game interaction I between adversarial perturbation units. ij (p) is expressed using the following formula:

[0014] I ij (p)=φ(S ij |Ω')-[φ(i|Ω\{j})+φ(j|Ω\{i})];

[0015] Where φ(i|Ω\{j}) and φ(j|Ω\{i}) represent the contributions of perturbation units i and j to the transfer utility when they exist alone; φ(S ij |Ω') represents the total contribution to the countermeasure effectiveness when perturbation units i and j exist simultaneously.

[0016] Preferably, the step of inputting the original sample into the black-box model to obtain the first attack utility, inputting the adversarial sample into the black-box model to obtain the second attack utility, and constructing the transfer adversarial utility of the adversarial patch based on the first and second attack utilities specifically includes: the transfer adversarial utility of the adversarial patch is expressed using the following formula:

[0017]

[0018] Where x represents the original sample, x+p represents the adversarial sample; h represents the output of the black-box model, h y (·) represents h(·)∈R C The value of the y-th element.

[0019] Secondly, the present invention provides a black-box adversarial attack device for a target detection model, specifically comprising at least one processor and a memory, wherein the at least one processor and the memory are connected via a data bus, the memory stores instructions that can be executed by the at least one processor, and the instructions, after being executed by the processor, are used to complete the black-box adversarial attack method for the target detection model in the first aspect.

[0020] Thirdly, the present invention provides a non-volatile computer storage medium, specifically: the computer storage medium stores computer program instructions, which, when executed by one or more processors, implement the black-box adversarial attack method for the target detection model as described in the first aspect.

[0021] Fourthly, a chip is provided, comprising: a processor and an interface for calling and running a computer program stored in a memory, executing the black-box adversarial attack method for the target detection model as described in the first aspect.

[0022] Fifthly, a computer program product containing instructions is provided, which, when executed on a computer or processor, causes the computer or processor to perform the black-box adversarial attack method for the target detection model as described in the first aspect.

[0023] Compared with the prior art, the beneficial effects of the present invention are as follows: adding an adversarial perturbation game interaction index to the loss function can improve the transferability of adversarial patches and increase the success rate of attacks on black-box models; the generated adversarial patches can be used for robustness evaluation of black-box models and to test the ability of intelligent models to maintain correct detection when facing adversarial attacks. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly described below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0025] Figure 1 A flowchart of a black-box adversarial attack method for a target detection model provided in an embodiment of the present invention;

[0026] Figure 2 This invention provides a schematic diagram of the target detection box obtained by the white-box model in the method of the present invention.

[0027] Figure 3 A schematic diagram of the disturbance unit in the method of this invention is provided for an embodiment of the invention;

[0028] Figure 4This invention provides a schematic diagram of the anti-patch generation process in an embodiment of the invention.

[0029] Figure 5 Flowchart of another black-box adversarial attack method for target detection model provided in an embodiment of the present invention;

[0030] Figure 6 This is a schematic diagram of a black-box adversarial attack device for a target detection model provided in an embodiment of the present invention;

[0031] The accompanying figure is labeled as follows:

[0032] 11: Processor; 12: Memory. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0034] This invention is an architecture of a specific functional system. Therefore, the specific embodiments mainly describe the functional logic relationship of each structural module, and do not limit the specific software and hardware implementation methods.

[0035] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0036] Example 1:

[0037] Existing transfer-based black-box attack methods often rely on multi-model ensembles to improve the transferability of attacks, enabling trained adversarial samples to exhibit strong attack capabilities on new black-box models. However, this typically consumes significant training time and resources. To improve the transferability of adversarial patches, existing black-box adversarial attack methods for object detection models often employ ensembles of multiple white-box models to generate adversarial patches. However, obtaining multiple white-box models for the same task is challenging in real-world applications. To avoid this problem, the method provided in this embodiment modifies the loss function by introducing an adversarial perturbation game interaction term to further improve the adversarial transferability of adversarial patches when attacking black-box models, and adaptively improves the adversarial perturbation game interaction term according to the characteristics of the model.

[0038] like Figure 1 As shown, the specific steps of the black-box adversarial attack method for the target detection model provided in this embodiment of the invention are as follows:

[0039] Step 101: Obtain a white-box model that functions identically to the black-box model. After preprocessing the original samples, input them into the white-box model to obtain the target detection boxes.

[0040] In this embodiment, the adversarial transferability of the adversarial patch is improved through a white-box model corresponding to the black-box model, and variations of the white-box model. Therefore, a sufficient number of original samples are first obtained. In practice, to facilitate subsequent data processing, training, and iterative updates, the obtained original samples can be assembled into an original sample set. After obtaining the original samples, they need to be preprocessed before being input into the white-box model for detection. The region where the detection result is located is taken as the target detection box, such as... Figure 2 As shown, the rectangular box represents the original sample, the elliptical region represents the detected target, and the dashed rectangular box represents the target detection box.

[0041] In practice, data augmentation techniques can be used to preprocess the original samples. Specifically, preprocessing methods can include: fine-tuning image size or cropping, adjusting image brightness, contrast, saturation, or chroma, and random rotation of the image within a small range. The preprocessed original samples are then input into a white-box model to obtain the detection results for the current sample set, yielding target location information. In practice, a target detection bounding box of a specified size can be used to mark the target location information.

[0042] Step 102: After initializing the adversarial patch, overlay it onto the center of the target detection box on each original sample to obtain adversarial samples.

[0043] To counter attacks, adversarial patches need to be superimposed on the original samples. The adversarial patch is an image that is unrelated to detection or can mislead the detection results.

[0044] In this embodiment, the adversarial patch is first initialized as a grayscale image or a random noise image, and then updated using the value of the loss function to obtain the best adversarial effect. In practice, a 300×300 random grayscale image or random noise image can be generated as the initial adversarial patch.

[0045] After initialization, the adversarial patch can be randomly "discarded" of a portion of the image and then superimposed onto the center of the target detection box on the original sample to interfere with the model's target detection. Specifically: a rectangular region of a specified size is randomly selected on the adversarial patch and filled with random noise; the filled adversarial patch is then superimposed onto the center of the target detection box on the original sample, and the original sample with the superimposed adversarial patch is used as the adversarial sample. In practice, at each training stage, the entire adversarial patch is not directly attached to the original sample. Instead, a portion of the image in the adversarial patch is randomly "discarded," i.e., a rectangular area is randomly selected on the adversarial patch, filled with random noise, and then superimposed onto the center of the target to be detected in the original sample.

[0046] Step 103: Generate a variant of the white-box model, input the adversarial sample into the white-box model and the variant of the white-box model, and obtain the detection results of the white-box model.

[0047] In this embodiment, adversarial patching is performed through variants of the white-box model. Specifically, the outputs of the network stack layers and the main body of the residual blocks in the white-box model are linearly combined. During forward and backward propagation, the residual connections in the neural network of the white-box model are perturbed to generate a specified number of variants of the white-box model. In practice, the ShakeDrop method can be used to linearly combine the outputs of the network stack layers and the main body of the residual blocks in the white-box model, and perturb the residual connections in the network during forward and backward propagation to generate a large number of variants of the white-box model.

[0048] After obtaining the variant of the white-box model, the adversarial patch obtained in step 102 can be used to overlay the adversarial patch onto the original sample to generate adversarial samples. The adversarial samples are then input into the white-box model and its variants to obtain the detection results of the white-box model.

[0049] Step 104: Construct a loss function based on the game interaction of adversarial perturbation units, use the loss function to calculate the loss function value of the detection result, and update the adversarial patch according to the loss function value until the generated adversarial patch causes the white-box model to make the detection result incorrect.

[0050] In adversarial attacks on target detection, given an adversarial patch p, let Ω = {1, 2, ..., n} represent all perturbation units in the patch, p i The average perturbation value on the i-th grid of the adversarial patch is called the perturbation cell.

[0051] The method provided in this embodiment can be used in object detection models. Adversarial patching in object detection models starts with an initial grayscale image or random noise image and generates a new adversarial patch image. Therefore, the number of perturbation pixels in the adversarial patch of an object detection model is large. In actual calculations, using the perturbation value of each pixel as the perturbation unit would result in a huge computational burden. Therefore, in the method provided in this embodiment, the adversarial patch is divided into grids of a specified size, with each grid being the same size; the average value of the perturbation values ​​of all pixels in the grid is obtained, and this average value is used as the perturbation unit value for that grid. Figure 3 As shown in the figure, each dashed grid represents a pixel, and each solid grid represents a grid. The adversarial patch is divided into 4 grids, each grid containing 16 pixels. The average value of the perturbation values ​​of all pixels in each grid is a perturbation unit in this embodiment.

[0052] Existing technical solutions can generate adversarial patches using existing single white-box models or variants of white-box models through self-integration strategies, but their transferability is relatively limited. In image classification models, it has been verified that the transferability of adversarial perturbations is negatively correlated with the game-theoretic interactions within the perturbation units. This embodiment employs game-theoretic interaction theory to improve the adversarial transferability of the object detection model. Specifically, a measure of the game-theoretic interactions of the adversarial perturbation units is added to the loss function to achieve adversarial attacks on the object detection model. Considering the differences between object detection and image classification, the game-theoretic interaction loss function is improved, and the selection of adversarial perturbation units in specific implementations is also improved to enhance the transferability of the object detection model against perturbations. Furthermore, the adversarial perturbation game-theoretic interaction terms can be adaptively improved according to the differences between image classification models and object detection models to improve the transferability of adversarial patches and increase the success rate of attacks on the black-box object detection model.

[0053] Therefore, based on the loss function that can be constructed, the loss function value is calculated; then the adversarial patch is updated based on the loss function value until the generated adversarial patch causes the white-box model to make a detection error, which indicates that the adversarial patch can achieve attack adversarial against the white-box model.

[0054] Step 105: Utilize the migration characteristics of adversarial patches to attack the black-box model, thereby causing the black-box model's detection results to be incorrect.

[0055] After obtaining an attack adversarial that can be implemented for the white-box model, since the input and output information of the white-box model and the black-box model are the same, the transfer characteristics of the adversarial patch can be used to directly attack the black-box model, causing the black-box model to make detection errors, thereby completing the adversarial attack on the black-box model.

[0056] After steps 101-105 provided in this embodiment, the black-box transferability of the adversarial patch can be improved by considering adding an adversarial perturbation game interaction term to the loss function and making adaptive improvements. This can also be used to test the robustness of the black-box model. In scenarios using object detection models, the following can be used: Figure 4 The process shown generates adversarial patches. In the figure, solid lines without filling rectangles identify the original samples, and the figure contains 4 original samples; dashed rectangles represent target detection boxes, diagonally filled rectangles represent adversarial patches, and gray-filled rectangles identify the parts discarded in the adversarial patches.

[0057] The method provided in this embodiment constructs a loss (LOSS) function based on the game-theoretic interactivity of adversarial perturbation units. That is, the game-theoretic interactivity index of adversarial perturbation units improves the portability of the adversarial patch by reducing the game-theoretic interactions between perturbation units on the adversarial patch. Therefore, it is necessary to define and calculate the following key values: 1. How to define the game-theoretic interactions between perturbation units on the adversarial patch; 2. How to define and calculate the contribution of the above game-theoretic interactions to the portability of the adversarial patch.

[0058] The following provides a loss function construction method that can be used in common scenarios. It is understood that, apart from the game interaction of adversarial perturbation units, other loss evaluation indicators can be selected according to actual needs and are not used as a limitation on the scope of protection.

[0059] (1) Construct an adversarial index L based on the location confidence and category confidence of the attack target. obj .

[0060] Optimizations are made to the target's location confidence and class confidence, resulting in adversarial patches capable of attacking the model. Adversarial metric L obj The following formula can be used to express this:

[0061]

[0062] Where N represents the total number of original samples, x i Let x' represent the original sample to be tested. i This indicates that the anti-patch p will be added to x. i The adversarial sample obtained above, j is the adversarial sample x' i Each target detected after inputting into the white-box model, such as pedestrian targets in the INRIA pedestrian detection dataset. This indicates that the white-box model is for x' i The target confidence score given for each target. This indicates that the white-box model is for x' i The category confidence score given for each target.

[0063] (2) Based on the Euclidean distance between adjacent pixels of the adversarial patch, construct the perturbation smoothness index L. tv .

[0064] The generated adversarial patch image should be as smooth as possible, with a small Euclidean distance between adjacent pixels. The perturbation smoothness index is L. tv The following formula can be used to express this:

[0065]

[0066] Among them, L tv (p) represents the Euclidean distance between adjacent pixels a and b of the adversarial patch. a,b p represents the pixel with coordinates (a, b). a+1,b p a,b+1 This represents the adjacent pixels with coordinates (a+1, b) and (a, b+1). This represents the Euclidean distance between all adjacent pixels in the statistical adversarial example. In practice, L... tv The smaller the value of (δ), the smoother the image.

[0067] (3) Based on the difference between the pixel values ​​of the anti-patch and the pixel values ​​of the printed color, construct a printability index L. nps

[0068] After generating the adversarial patch, it can be printed and affixed to the center of the target detection box. The color of the generated adversarial patch should be as close as possible to the screen display color or the colors that the printer can print, to facilitate direct viewing after display or printing, or to test the security of the intelligent target detection system in the physical world. Printability index L nps The following formula can be used to express this:

[0069]

[0070] Where, p patch c represents any color in the generated adversarial patch. print This represents the color set that all printers can print. This represents all colors on the statistical adversarial patch. This means that the pixel values ​​on the anti-patch should be as close as possible to the colors displayed on the screen or the colors that the printer can print.

[0071] (4) Based on the game interaction between adversarial perturbation units of the adversarial patch, construct the game interaction index L of the adversarial perturbation units. interaction .

[0072] Reduce the game interaction between perturbation units on the adversarial patch and improve the portability of the adversarial patch.

[0073] After obtaining the above loss evaluation indicators (1)-(4), the loss function can be constructed based on the adversarial indicator, perturbation smoothness indicator, printability indicator, and adversarial perturbation unit game interaction indicator. The loss function can be expressed by the following formula:

[0074] Loss = L obj +αL tv (p)+βL nps +γL interaction ;

[0075] Where α is the perturbation smoothness index L tv The weights, β is the printability index L nps The weights, γ, are the game interaction index L of the units against disturbances. interaction The weights are determined based on actual needs. In practice, the three weight values ​​can be determined according to actual requirements.

[0076] like Figure 5 As shown, the following method can be used to construct an adversarial unit game interaction index based on the game interaction between adversarial perturbation units of the adversarial patch.

[0077] Step 201: Divide the adversarial patch into at least two perturbation units.

[0078] In this embodiment, the adversarial patch contains multiple perturbation units. The game interaction between different perturbation units affects the transferability of the adversarial perturbation. In the loss function, it is necessary to calculate the game interaction between every two perturbation units. The two perturbation units whose game interaction needs to be calculated are referred to as perturbation unit i and perturbation unit j, respectively. Each time the loss value is calculated according to the loss function, perturbation units i and j form a coalition called S. ij = {i,j}, where perturbation units i and j always exist simultaneously or do not exist simultaneously, i.e., Ω' = Ω\{i,j}∪S ij .

[0079] Step 202: Sequentially obtain every two perturbation units and calculate the game interaction between perturbation units on the adversarial patch.

[0080] Regarding the key value 1 of the game interaction loss function, the game interaction between perturbed units can be calculated based on the Shapley value. In specific implementation, the game interaction I between the adversarial perturbed units is... ij (p) can be expressed using the following formula:

[0081] I ij (p)=φ(S ij |Ω')-[φ(i|Ω\{j})+φ(j|Ω\{i})];

[0082] Where φ(i|Ω\{j}) and φ(j|Ω\{i}) represent the contributions of perturbation units i and j to the transfer utility when they exist alone. φ(S ij |Ω') represents the total contribution to the countermeasure effectiveness when perturbation units i and j exist simultaneously.

[0083] Step 203: Input the original sample into the black box model to obtain the first attack utility, input the adversarial sample into the black box model to obtain the second attack utility, and construct the migration adversarial utility of the adversarial perturbation unit based on the first attack utility and the second attack utility.

[0084] The key value 2 of the game interaction loss function can be defined using the transfer utility. Since a smaller LOSS function value is more likely to achieve the desired outcome, an adversarial perturbation unit game interaction index can be added to the loss function construction. The attack utility of all adversarial perturbation units can be expressed by the following formula:

[0085] v(Ω) = max y'≠y h y' (x+p)-h y (x+p);

[0086] Where x represents the original sample to be detected, x+p represents the adversarial sample after the adversarial patch is added to the original sample, i.e., x+p=x'; h represents the model output, which, for the object detection model, is the output of the category to which the object belongs. y (·) represents h(·)∈R C The value of the y-th dimension is the score of the dimension containing the true class label of the object detection; max y'≠y This indicates that, compared to the score of the dimension containing the actual label, it is not equal to the maximum value in other dimensions.

[0087] Without countermeasures patches, the baseline score for attack effectiveness is:

[0088] v(φ)=max y'≠y h y' (x)-h y (x)

[0089] Therefore, the total contribution of all perturbation units to the attack effectiveness can be expressed as:

[0090] ∑ i φ(i|Ω)=v(Ω)-v(φ)

[0091] Where φ(i|Ω) represents the contribution of the i-th perturbation unit.

[0092] Step 204: Construct a game-like index for adversarial perturbation units based on the game interaction between adversarial perturbation units and the migration adversarial utility of adversarial patches.

[0093] Game interactions exist between adversarial perturbation units, and these interactions are negatively correlated with the transferability of adversarial perturbations. To improve the transferability of adversarial patches, the average game interaction among adversarial perturbation units should be minimized. The average game interaction among adversarial perturbation units is expressed by the following formula:

[0094] L interaction =E i,j [I ij (p)];

[0095] Among them, I ij (p) represents the game interaction between two perturbation units i and j in the adversarial patch, E i,j It represents the mathematical expectation of the game interaction of the adversarial perturbation units.

[0096] Because E i,j [I ij The calculation of (p)] belongs to the NP-hard level, so it can be simplified to:

[0097]

[0098] After steps 201-204 provided in this embodiment, the game-like nature of the anti-disturbance unit can be constructed.

[0099] The black-box adversarial attack method for target detection models provided in this embodiment has the following advantages over existing technologies:

[0100] (1) Adding adversarial perturbation game interaction to the loss function can improve the transferability of adversarial patches and increase the success rate of attacks on black-box models.

[0101] (2) The generated adversarial patch can be used for the robustness evaluation of the black-box model and to test the model’s ability to maintain correct detection when facing adversarial attacks.

[0102] (3) By printing the anti-patch and attaching it to the center of the target detection box, it can be used to test the security of the intelligent target detection system in the physical world.

[0103] Example 2:

[0104] Based on the black-box adversarial attack method for target detection models provided in Embodiment 1 above, the present invention also provides a black-box adversarial attack device for target detection models that can be used to implement the above method, such as... Figure 6The diagram shown is a schematic representation of the device architecture according to an embodiment of the present invention. The black-box adversarial attack device for the target detection model in this embodiment includes one or more processors 11 and a memory 12. Figure 6 Take a processor 11 as an example.

[0105] Processor 11 and memory 12 can be connected via a bus or other means. Figure 6 Taking the example of a connection between China and Israel via a bus.

[0106] The memory 12 serves as a non-volatile computer-readable storage medium for a black-box adversarial attack method for target detection models. It can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as the black-box adversarial attack method for target detection models in Embodiment 1. The processor 11 executes various functional applications and data processing of the black-box adversarial attack device for target detection models by running the non-volatile software programs, instructions, and modules stored in the memory 12, thereby implementing the black-box adversarial attack method for target detection models in Embodiment 1.

[0107] Memory 12 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, memory 12 may optionally include memory remotely located relative to processor 11, which can be connected to processor 11 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0108] The program instructions / modules are stored in memory 12. When executed by one or more processors 11, they perform the black-box adversarial attack method for the target detection model described in Embodiment 1 above, for example, executing the method described above. Figure 1 , Figure 4 and Figure 5 The steps shown.

[0109] This invention also provides a non-volatile computer storage medium storing computer-executable instructions that are executed by one or more processors, for example... Figure 6 One of the processors 11 can enable the above-described one or more processors to execute the black-box adversarial attack method for the target detection model in Embodiment 1, for example, to execute the above-described... Figure 1 and Figure 5 The steps shown can also be implemented. Figure 4 The various modules and units mentioned above.

[0110] It is worth noting that the information interaction and execution process between the modules and units in the above-mentioned device and system are based on the same concept as the processing method embodiment of the present invention. For details, please refer to the description in the method embodiment of the present invention, and will not be repeated here.

[0111] Those skilled in the art will understand that all or part of the steps in the various methods of the embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0112] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for target detection model black-box adversarial attack, characterized in that, The method comprises the following steps: obtaining a white-box model consistent with the function of the black-box model, inputting the original sample into the white-box model after preprocessing to obtain a target detection frame; initializing the adversarial patch and superimposing it on the center position of the target detection frame of each original sample to obtain an adversarial sample; generating a variant of the white-box model, inputting the adversarial sample into the white-box model and the variant of the white-box model to obtain a detection result of the white-box model; the generating of the variant of the white-box model specifically comprises: linearly combining the output of the network stack layer and the main body of the residual block in the white-box model, and perturbing the residual connection in the neural network of the white-box model during forward and backward propagation to generate a specified number of variants of the white-box model; based on the adversarial perturbation unit game interaction, a loss function is constructed, the loss function value of the detection result is calculated using the loss function, and the adversarial patch is updated according to the loss function value until the generated adversarial patch causes the detection result of the white-box model to be wrong; using the migration characteristics of the adversarial patch, the obtained adversarial patch is used to attack the black-box model to cause the detection result of the black-box model to be wrong.

2. The target detection model black-box adversarial attack method according to claim 1, characterized in that, the step of initializing the adversarial patch and superimposing it on the center position of the target detection frame of each original sample to obtain an adversarial sample specifically comprises: initializing the adversarial patch as a grayscale image or a random noise image, randomly selecting a rectangular region of a specified size on the adversarial patch, and filling the selected rectangular region with random noise; superimposing the filled adversarial patch on the center position of the target detection frame of the original sample, and taking the original sample after superimposing the adversarial patch as an adversarial sample.

3. The target detection model black-box adversarial attack method according to claim 1, characterized in that, the step of constructing a loss function based on the adversarial perturbation unit game interaction specifically comprises: constructing an adversarial index according to the position confidence and the category confidence of the attack target; constructing a perturbation smoothness index according to the Euclidean distance between adjacent pixels of the adversarial patch; constructing a printability index according to the difference between the pixel value of the adversarial patch and the print color pixel value; constructing an adversarial perturbation unit game interaction index according to the game interaction between the adversarial perturbation units of the adversarial patch; constructing a loss function according to the adversarial index, the perturbation smoothness index, the printability index and the adversarial perturbation unit game interaction.

4. The target detection model black-box adversarial attack method according to claim 3, characterized in that, the step of constructing an adversarial perturbation unit game interaction index according to the game interaction between the adversarial perturbation units of the adversarial patch specifically comprises: dividing the adversarial patch into at least two perturbation units; obtaining each two perturbation units in turn, and calculating the game interaction between the perturbation units on the adversarial patch; inputting the original sample into the black-box model to obtain a first attack utility, inputting the adversarial sample into the black-box model to obtain a second attack utility, and constructing a migration adversarial utility of the adversarial patch according to the first attack utility and the second attack utility; constructing an adversarial perturbation unit game interaction index based on the game interaction between the adversarial perturbation units and the migration adversarial utility of the adversarial patch.

5. The target detection model black-box adversarial attack method according to claim 4, characterized in that, the step of dividing the adversarial patch into at least two perturbation units specifically comprises: cutting the adversarial patch into grids of a specified size, and the size of each grid is the same; obtaining the average value of the perturbation values of all pixel points in the grid, and taking the average value as the perturbation unit value of the grid.

6. The target detection model black-box adversarial attack method according to claim 4, characterized in that, the step of calculating the game interaction between the perturbation units on the adversarial patch specifically comprises: Game play between adversarial perturbation units Is expressed using the following formula: ； wherein, and denote the perturbation units contribution to the counteracting effect when present alone; denote the perturbation units total contribution to the counteracting effect when present simultaneously.

7. The target detection model black-box adversarial attack method according to claim 4, characterized in that, The original sample is input into the black box model to obtain a first attack utility, the adversarial sample is input into the black box model to obtain a second attack utility, and a migration adversarial utility of the adversarial patch is constructed according to the first attack utility and the second attack utility, and specifically includes: The migration adversarial utility of the adversarial patch is expressed using the following formula: ； wherein, denotes the original sample, denotes the adversarial sample; denotes the output of the black-box model, is the value of the yth element of 8. A device for black-box adversarial attack on a target detection model, characterized in that: The device comprises at least one processor and a memory, the at least one processor and the memory are connected through a data bus, the memory stores instructions executable by the at least one processor, and the instructions are used to complete the method for black-box adversarial attack on the target detection model according to any one of claims 1-7 after being executed by the processor.

9. A non-transitory computer storage medium, comprising: The computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors to complete the method for black-box adversarial attack on the target detection model according to any one of claims 1-7.

Images