Delayed attack confrontation sample generation method of visual perception system and related device

Abstract

The invention belongs to the field of machine learning, and discloses a delay attack confrontation sample generation method of a visual perception system and a related device, and the method comprises the steps: obtaining an original image set and target tracker parameters of the visual perception system; according to target tracker parameters of the visual perception system, obtaining an attack strategy based on the original image set by taking maximization of delay time of a target tracker of the visual perception system as an optimization target; with minimization of a loss function value of a target detection model of the visual perception system as an optimization target, generating general adversarial disturbances of which the number is the same as the number of attack areas of the attack strategy; and adding general adversarial disturbance into the original image set according to an attack strategy to obtain a visual perception system delay attack adversarial sample set. The high attack success rate of the delayed attack confrontation sample to the visual perception system is realized, and the method can be used as a basis for evaluating the safety and effectiveness of the visual perception system and can be used for perfecting and optimizing the visual perception system.

Description

Technical Field

[0001] The present invention belongs to the field of machine learning and relates to a method for generating delayed attack adversarial samples of a visual perception system and a related device. Background Art

[0002] With the rapid development of artificial intelligence and sensor technology, self-driving cars have quietly entered our daily lives and become a new track for major automakers to compete. For these self-driving vehicles, the camera-based perception system plays a vital role, enabling them to detect pedestrians, vehicles and other road targets in real time to ensure driving safety. However, the frequent safety accidents in the field of autonomous driving in recent years have sounded the alarm, highlighting the various safety hazards and even catastrophic consequences that may be caused by errors in the perception system. Therefore, in-depth exploration of the potential attack surface and vulnerabilities of the perception system is crucial to improving the safety and reliability of the autonomous driving system.

[0003] In recent years, relevant studies have shown that the object detection model used in autonomous driving is vulnerable to adversarial samples. Attackers can use this feature to add tiny perturbations that are not visible to the human eye to normal samples to generate adversarial samples, thereby deceiving the object detection model. Adversarial samples have posed a threat to the safe deployment and operation of autonomous driving visual perception systems. However, most existing studies focus on integrity issues, such as making objects disappear or changing the category of objects, which may lead to safety hazards or traffic violations.

[0004] However, there is relatively little research and exploration on the availability of visual perception systems, which are critical to safety, especially for complete autonomous driving visual perception systems. Although existing autonomous driving safety analysis has studied security threats in terms of the availability of target detection models, it only targets single module components and does not consider the entire autonomous driving visual perception system. In addition, in the field of cyber-physical system security, small errors at the component level do not necessarily lead to system-level impacts, which means that existing attacks that only target target detection models cannot always produce efficient system-level impacts due to the lack of consideration of the entire autonomous driving visual perception system, and thus cannot efficiently achieve availability evaluation and optimization of autonomous driving visual perception systems. Summary of the invention

[0005] The purpose of the present invention is to overcome the above-mentioned shortcomings of the prior art and provide a method for generating delayed attack adversarial samples for a visual perception system and related devices.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions: In a first aspect, the present invention provides a method for generating delayed attack adversarial samples of a visual perception system, comprising: obtaining an original image set and target tracker parameters of the visual perception system; obtaining an attack strategy based on the target tracker parameters of the visual perception system and taking maximizing the delay time of the target tracker of the visual perception system as an optimization target based on the original image set; generating universal adversarial perturbations of the same number as the number of attack areas of the attack strategy with minimizing the loss function value of the target detection model of the visual perception system as an optimization target; adding the universal adversarial perturbations to the original image set according to the attack strategy to obtain a delayed attack adversarial sample set of the visual perception system.

[0007] Optionally, obtaining the original image set includes: obtaining video frames captured by a visual perception system, and preprocessing the video frames to obtain the original image set; wherein the size of each original image in the original image set is the same; wherein the preprocessing includes one or more of the following: image filling processing and image scaling processing.

[0008] Optionally, the attack strategy is obtained based on the target tracker parameters of the visual perception system and the original image set with maximizing the delay time of the target tracker of the visual perception system as the optimization goal, including: obtaining the initialization frame number H and the reactivation interval frame number R of the visual perception system according to the target tracker parameters of the visual perception system; obtaining the attack strategy by iterating the following steps until a preset frame number is reached: initialization stage: based on the original image set, obtaining the timestamps and attack areas of several frames of original images, and adding the timestamp of each frame of the original image plus R times the frame time as the reactivation timestamp of the attack area of ​​each frame of the original image, and adding the timestamp of each frame of the original image and the number of the attack area and the reactivation timestamp of the attack area of ​​each frame of the original image to the attack strategy; Processing stage: determine whether there is an original image in the H frames of original images following the current frame original image that needs to reactivate the attack area of ​​the current frame original image; when there is an original image in the attack area of ​​the current frame original image that needs to be reactivated, record the next reactivation timestamp of the attack area of ​​the current frame original image and add it to the attack strategy; when there is no original image in the attack area of ​​the current frame original image that needs to be reactivated, specify the same new attack area for the H frames of original images following the current frame original image, and add the number of the new attack area and the timestamp of the corresponding frame original image to the attack strategy; among them, the original image in the attack area of ​​the current frame original image that needs to be reactivated is the original image with the same timestamp as the reactivation timestamp of the attack area of ​​the current frame original image.

[0009] Optionally, the optimization goal of minimizing the loss function value of the target detection model of the visual perception system to generate the same number of universal adversarial perturbations as the number of attack areas of the attack strategy includes: using a random generation method to generate the same number of initial adversarial perturbations as the number of attack areas of the attack strategy, and establishing a one-to-one correspondence between the initial adversarial perturbations and the attack areas; traversing each initial adversarial perturbation and performing the following steps to obtain a universal adversarial perturbation for each attack area: adding the current initial adversarial perturbation to the target attack area of ​​each original image to obtain a perturbed image set; wherein the target attack area is the attack area corresponding to the current initial adversarial perturbation; obtaining the loss function value of the perturbed image set through the target detection model of the visual perception system, and using a preset optimizer to optimize the current initial adversarial perturbation to minimize the loss function value of the perturbed image set until a preset number of optimizations is reached or the loss function value meets a preset requirement, and taking the final current initial adversarial perturbation as the universal adversarial perturbation corresponding to the attack area corresponding to the current initial adversarial perturbation.

[0010] Optionally, when the preset optimizer is used to optimize the current initial adversarial perturbation to minimize the loss function value of the perturbed image set, it is achieved by constructing an optimization function of the following formula:

[0011] in, is the perturbed image, is the original image, is the detection result information corresponding to the attack area, is the test result score, is the two-dimensional coordinate width information of the detection result, is the two-dimensional coordinate height information of the detection result, is the image width, is the image height, is the target tracker score threshold, , and are all preset loss function weight values, is the score loss, is the area loss, To combat losses, is the L2 norm calculation, is the loss function value of the target detection model.

[0012] Optionally, the preset optimizer is an Adam optimizer.

[0013] Optionally, the method of adding a universal adversarial perturbation to the original image set according to the attack strategy to obtain a delayed attack adversarial sample set for the visual perception system includes: obtaining a timestamp and a reactivation timestamp corresponding to each attack area according to the attack strategy as a target timestamp corresponding to each attack area, and dividing the original image of the original image set into each attack area; obtaining a universal adversarial perturbation corresponding to each attack area, and adding the universal adversarial perturbation corresponding to each attack area to the original image corresponding to the target timestamp corresponding to each attack area in the original image set to obtain a delayed attack adversarial sample set for the visual perception system.

[0014] According to a second aspect of the present invention, a delayed attack adversarial sample generation system for a visual perception system is provided, comprising: a data acquisition module for acquiring an original image set and target tracker parameters of a visual perception system; a strategy generation module for obtaining an attack strategy based on the target tracker parameters of the visual perception system and the original image set with maximizing the delay time of the target tracker of the visual perception system as the optimization target; a perturbation generation module for generating universal adversarial perturbations with the same number as the number of attack areas of the attack strategy with minimizing the loss function value of a target detection model of the visual perception system as the optimization target; and a sample generation module for adding universal adversarial perturbations to the original image set according to the attack strategy to obtain a delayed attack adversarial sample set for the visual perception system.

[0015] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the delayed attack adversarial sample generation method for the above-mentioned visual perception system when executing the computer program.

[0016] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the delayed attack adversarial sample generation method for the above-mentioned visual perception system are implemented.

[0017] Compared with the prior art, the present invention has the following beneficial effects: The method for generating delayed attack adversarial samples of a visual perception system of the present invention first obtains an attack strategy based on the original image set with maximizing the delay time of the target tracker of the visual perception system as the optimization goal, and injects more delay time under the constraint of the maximum number of detections to destroy the real-time performance of the system, so that the final delayed attack adversarial sample can fully bring about system-level security risks. At the same time, with minimizing the loss function value of the target detection model of the visual perception system as the optimization goal, a number of universal adversarial perturbations equal to the number of attack areas of the attack strategy are generated to ensure the attack effect of the universal adversarial perturbation on the visual perception system. Finally, according to the attack strategy, the universal adversarial perturbation is added to the original image set to obtain a delayed attack adversarial sample set of the visual perception system, achieving a higher attack success rate of the delayed attack adversarial sample on the visual perception system, which can be used as a basis for evaluating the safety and effectiveness of the visual perception system, and can be used to improve and optimize the visual perception system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flow chart of a method for generating delayed attack adversarial samples for a visual perception system according to an embodiment of the present invention.

[0019] Figure 2 This is a schematic diagram of a delayed attack adversarial sample generation method for a visual perception system according to an embodiment of the present invention.

[0020] Figure 3 The following is a flow chart of the attack strategy generation method according to an embodiment of the present invention.

[0021] Figure 4 This is a structural block diagram of a delayed attack adversarial sample generation system for a visual perception system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] The present invention is further described in detail below in conjunction with the accompanying drawings: See also Figure 1 In one embodiment of the present invention, a method for generating delayed attack adversarial samples for a visual perception system is provided, which can effectively improve the attack effect of delayed attack on the complete visual perception system.

[0025] Specifically, the method for generating delayed attack adversarial samples for a visual perception system of the present invention comprises the following steps: S1: Get the original image set and the object tracker parameters of the visual perception system.

[0026] S2: According to the target tracker parameters of the visual perception system, an attack strategy is obtained based on the original image set with the goal of maximizing the delay time of the target tracker of the visual perception system as the optimization goal.

[0027] S3: Taking minimizing the loss function value of the target detection model of the visual perception system as the optimization goal, generate the same number of universal adversarial perturbations as the number of attack areas of the attack strategy.

[0028] S4: According to the attack strategy, the universal adversarial perturbation is added to the original image set to obtain the delayed attack adversarial sample set of the visual perception system.

[0029] The method for generating delayed attack adversarial samples of a visual perception system of the present invention first obtains an attack strategy based on the original image set with maximizing the delay time of the target tracker of the visual perception system as the optimization goal, and injects more delay time under the constraint of the maximum number of detections to destroy the real-time performance of the system, so that the final delayed attack adversarial sample can fully bring about system-level security risks. At the same time, with minimizing the loss function value of the target detection model of the visual perception system as the optimization goal, a number of universal adversarial perturbations equal to the number of attack areas of the attack strategy are generated to ensure the attack effect of the universal adversarial perturbation on the visual perception system. Finally, according to the attack strategy, the universal adversarial perturbation is added to the original image set to obtain a delayed attack adversarial sample set of the visual perception system, achieving a higher attack success rate of the delayed attack adversarial sample on the visual perception system, which can be used as a basis for evaluating the safety and effectiveness of the visual perception system, and can be used to improve and optimize the visual perception system.

[0030] See also Figure 2 The delayed attack adversarial sample generation method of the visual perception system of the present invention includes two parts: attack strategy generation and iterative optimization of general adversarial perturbation. First, the attack strategy is generated according to the target tracker parameters. After the attack strategy generation is completed, the initial adversarial perturbation is generated. According to the generated attack strategy, the attack area of ​​each initial adversarial perturbation is determined, and the loss function is calculated accordingly, and the initial adversarial perturbation is iteratively optimized using an optimizer to obtain a general adversarial perturbation. Finally, the general adversarial perturbation is added to the original image set according to the attack strategy to obtain an adversarial sample set for performing a delayed attack on the visual perception system.

[0031] In a possible implementation, obtaining the original image set includes: obtaining video frames collected by a visual perception system, and preprocessing the video frames to obtain the original image set.

[0032] The sizes of the original images in the original image set are the same; the preprocessing includes one or more of the following: image filling processing and image scaling processing.

[0033] Specifically, the original image set can be obtained by continuous video frames collected by the camera equipped with the visual perception system, or by other non-continuous video frames, but all need to be transformed into images of the same size through preprocessing. Compatibility takes into account the situation where the data set collected by the camera cannot be obtained, so that the method of the present invention can be applied to a variety of scenarios when facing the autonomous driving visual perception system, enhancing the flexibility of the method.

[0034] In a possible implementation, the attack strategy is obtained based on the target tracker parameters of the visual perception system and the original image set with maximizing the delay time of the target tracker of the visual perception system as the optimization goal, including: obtaining the initialization frame number H and the reactivation interval frame number R of the visual perception system according to the target tracker parameters of the visual perception system; and obtaining the attack strategy by iterating the following steps until a preset frame number is reached: initialization stage: based on the original image set, obtaining the timestamps and attack areas of several frames of original images, and adding R times the frame time to the timestamp of each frame of the original image as the reactivation timestamp of the attack area of ​​each frame of the original image, and adding the timestamp and attack area of ​​each frame of the original image to ... The number of the area and the reactivation timestamp of the attack area of ​​each frame of the original image are added to the attack strategy; management stage: determine whether there is an original image that needs to reactivate the attack area of ​​the current frame original image in the H frames of original images following the current frame original image; when there is an original image that needs to reactivate the attack area of ​​the current frame original image, record the next reactivation timestamp of the attack area of ​​the current frame original image and add it to the attack strategy; when there is no original image that needs to reactivate the attack area of ​​the current frame original image, specify the same new attack area for the H frames of original images following the current frame original image, and add the number of the new attack area and the timestamp of the corresponding frame original image to the attack strategy.

[0035] The original image that needs to reactivate the attack area of ​​the original image of the current frame is an original image whose timestamp is the same as the reactivation timestamp of the attack area of ​​the original image of the current frame.

[0036] Specifically, first, according to the target tracker parameter H of the visual perception system, the detection result of a certain attack area appears for H frames continuously to initialize the target tracker, and according to the target tracker parameter R of the visual perception system, the detection result of the corresponding attack area appears for 1 frame before the corresponding target tracker disappears for R frames to reactivate the target tracker. After the initialization stage of the target tracker, each attack area needs to appear H frames. First, it is determined whether there is an attack area that needs to be reactivated in the next H frames of this timestamp. If so, the attack area that needs to be reactivated is reactivated first, and its next reactivation timestamp is recorded. If not, the next H frames are all assigned to the same new attack area, and the attack area number and timestamp are added to the attack strategy.

[0037] See also Figure 3, the specific attack strategy generation steps are: first update the current timestamp and the number of the attack area, then determine whether the new attack area creation conditions are met, if yes, record the number of the new attack area to the current timestamp and record the reactivation timestamp required for the attack area, if not, record the number of the attack area that needs to be reactivated and update the reactivation timestamp of the attack area; after recording the number of the attack area corresponding to the current timestamp, determine whether the current timestamp exceeds the maximum timestamp, if not, loop through the above steps, if yes, get the final attack strategy; the final attack strategy is a dictionary, the key of the dictionary is the timestamp, and the value of the dictionary is the number of the attack area.

[0038] Optionally, during the initialization phase of the target tracker, each attack region appears in only one frame. In each frame of this phase, a new attack region is designated, the attack region number and timestamp are added to the attack strategy, and the reactivation timestamps of these attack regions are recorded, which is the current timestamp plus R times the frame time.

[0039] In a possible implementation, the optimization objective of minimizing the loss function value of the target detection model of the visual perception system and generating the same number of universal adversarial perturbations as the number of attack areas of the attack strategy includes: using a random generation method to generate the same number of initial adversarial perturbations as the number of attack areas of the attack strategy, and establishing a one-to-one correspondence between the initial adversarial perturbations and the attack areas; traversing each initial adversarial perturbation and performing the following steps to obtain a universal adversarial perturbation for each attack area: adding the current initial adversarial perturbation to the target attack area of ​​each original image to obtain a perturbed image set; wherein the target attack area is the attack area corresponding to the current initial adversarial perturbation; obtaining the loss function value of the perturbed image set through the target detection model of the visual perception system, and using a preset optimizer to optimize the current initial adversarial perturbation to minimize the loss function value of the perturbed image set until a preset number of optimizations is reached or the loss function value meets a preset requirement, and taking the final current initial adversarial perturbation as the universal adversarial perturbation corresponding to the attack area corresponding to the current initial adversarial perturbation.

[0040] Specifically, a random generation method is used to generate initial adversarial perturbations, and then the initial adversarial perturbations are added to the original image set to obtain a perturbed image set. The perturbed image set is then input into the target detection model of the visual perception system to obtain the output information of the target detection model, and the loss function value is calculated based on the output information of the target detection model. Based on this, the initial adversarial perturbation is optimized to minimize the loss function value. The process can be expressed as an optimization problem:

[0041] in, is the perturbed image, is the original image, is the detection result information corresponding to the attack area, is the test result score, is the two-dimensional coordinate width information of the detection result, is the two-dimensional coordinate height information of the detection result, is the image width, is the image height, is the target tracker score threshold, , and are all preset loss function weight values, is the score loss, is the area loss, To combat losses, is the L2 norm calculation, is the loss function value of the target detection model.

[0042] The preset optimizer may be an Adam optimizer. The target detection model of the visual perception system is obtained by obtaining the weights and configuration files of the model of the visual perception system for detecting surrounding objects based on images.

[0043] After the optimizer optimizes and iterates to a predetermined number of iterations, a universal adversarial perturbation is obtained. The universal adversarial perturbations corresponding to different attack areas constitute a universal adversarial perturbation set.

[0044] The delay attack is divided into two attack stages. In the attack initialization stage, the detection results are used to create as many new target trackers as possible, which requires that the detection results are not associated with any existing target trackers. After that, these target trackers are reactivated before being lost, that is, the detection frame is associated with the corresponding target tracker and saved in the target tracker pool. At the same time, a set of detection frames with the same matching features is constructed, and an attack strategy is used to control the appearance or disappearance of these frame sets in the corresponding continuous image frames. Since almost all target tracking is based on the matching method of appearance features, the frame set is divided by dividing the attack area, that is, the detection results located in the same area are regarded as the same detection frame set, thereby performing an efficient delay attack.

[0045] In a possible implementation, the adding of universal adversarial perturbations to the original image set according to the attack strategy to obtain a delayed attack adversarial sample set for the visual perception system includes: obtaining a timestamp and a reactivation timestamp corresponding to each attack area according to the attack strategy as a target timestamp corresponding to each attack area, and dividing the original image of the original image set into each attack area; obtaining a universal adversarial perturbation corresponding to each attack area, and adding the universal adversarial perturbation corresponding to each attack area to the original image corresponding to the target timestamp corresponding to each attack area in the original image set to obtain a delayed attack adversarial sample set for the visual perception system.

[0046] Specifically, according to the number of the attack area corresponding to each timestamp of the attack strategy, the universal adversarial perturbation corresponding to the attack area is added to the original image of the corresponding timestamp to obtain the adversarial sample.

[0047] In one possible implementation, taking an autonomous driving visual perception system as an example, it has been experimentally verified that even if the target detection model and algorithm as well as the target tracking model and algorithm of the autonomous driving visual perception system to be evaluated are different, the method of the present invention can inject a higher delay into most autonomous driving visual perception systems, thereby achieving a higher attack success rate in two common real-world scenarios.

[0048] In addition, experiments on two typical data sets, BDD and MOT17, show that the delayed attack adversarial sample generation method for the visual perception system of the present invention can be applied to task scenarios with different data scales. Comparative experiments with other delayed attack algorithms show that the delayed attack adversarial samples generated by the delayed attack adversarial sample generation method for the visual perception system of the present invention can effectively improve the delay time of the complete visual perception system for autonomous driving. And the joint simulation experiments of Apollo and LGSVL show that the method of the present invention can have a system-level impact on autonomous driving vehicles (i.e., vehicle collision or emergency stop). The above experiments prove that the method of the present invention not only achieves the expected goals well, but also has good scalability and flexibility.

[0049] The following are device embodiments of the present invention, which can be used to implement the method embodiments of the present invention. For details not disclosed in the device embodiments, please refer to the method embodiments of the present invention.

[0050] See also Figure 4 In another embodiment of the present invention, a delayed attack adversarial sample generation system for a visual perception system is provided, which can be used to implement the delayed attack adversarial sample generation method for the above-mentioned visual perception system. Specifically, the delayed attack adversarial sample generation system for the visual perception system includes a data acquisition module, a strategy generation module, a perturbation generation module and a sample generation module.

[0051] Among them, the data acquisition module is used to obtain the original image set and the target tracker parameters of the visual perception system; the strategy generation module is used to obtain the attack strategy based on the target tracker parameters of the visual perception system and the original image set with maximizing the delay time of the target tracker of the visual perception system as the optimization goal; the perturbation generation module is used to minimize the loss function value of the target detection model of the visual perception system as the optimization goal, and generate the same number of universal adversarial perturbations as the number of attack areas of the attack strategy; the sample generation module is used to add the universal adversarial perturbation to the original image set according to the attack strategy, and obtain the visual perception system delayed attack adversarial sample set.

[0052] All relevant contents of each step involved in the embodiment of the delayed attack adversarial sample generation method for the aforementioned visual perception system can be referred to the functional description of the functional modules corresponding to the delayed attack adversarial sample generation system for the visual perception system in the embodiment of the present invention, and will not be repeated here.

[0053] The division of modules in the embodiments of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present invention may be integrated into one processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0054] In another embodiment of the present invention, a computer device is provided, the computer device including a processor and a memory, the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc., which are the computing core and control core of the terminal, which are suitable for implementing one or more instructions, and are specifically suitable for loading and executing one or more instructions in a computer storage medium to implement the corresponding method flow or corresponding function; the processor described in the embodiment of the present invention can be used for the operation of the delayed attack adversarial sample generation method of the visual perception system.

[0055] In another embodiment of the present invention, the present invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in a computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the delay attack adversarial sample generation method for the visual perception system in the above embodiment.

[0056] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0057] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0058] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0059] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0060] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for generating delayed attack adversarial samples for a visual perception system, characterized in that: include: Obtaining the original image set and object tracker parameters of the visual perception system; According to the target tracker parameters of the visual perception system, an attack strategy is obtained based on the original image set with the goal of maximizing the delay time of the target tracker of the visual perception system as the optimization goal; Taking minimizing the loss function value of the target detection model of the visual perception system as the optimization goal, generate the same number of universal adversarial perturbations as the number of attack areas of the attack strategy; According to the attack strategy, universal adversarial perturbations are added to the original image set to obtain a delayed attack adversarial sample set for the visual perception system.

2. The method for generating delayed attack adversarial samples for a visual perception system according to claim 1, characterized in that: The obtaining of the original image set comprises: The video frames collected by the visual perception system are obtained, and the video frames are preprocessed to obtain an original image set; wherein the size of each original image in the original image set is the same; wherein the preprocessing includes one or more of the following: image filling processing and image scaling processing.

3. The method for generating delayed attack adversarial samples for a visual perception system according to claim 1, characterized in that: The attack strategy is obtained based on the target tracker parameters of the visual perception system and the original image set to maximize the delay time of the target tracker of the visual perception system as the optimization goal, including: According to the target tracker parameters of the visual perception system, the initialization frame number H and the reactivation interval frame number R of the visual perception system are obtained; the attack strategy is obtained by iterating the following steps until the preset frame number is reached: Initialization phase: based on the original image set, obtain the timestamps and attack areas of several frames of original images, and add the timestamp of each frame of original image plus R times the frame time as the reactivation timestamp of the attack area of ​​each frame of original image, and add the timestamp of each frame of original image and the number of the attack area and the reactivation timestamp of the attack area of ​​each frame of original image into the attack strategy; Management stage: determine whether there is an original image in the H frames of original images following the current frame original image that needs to reactivate the attack area of ​​the current frame original image; when there is an original image in the attack area of ​​the current frame original image that needs to be reactivated, record the next reactivation timestamp of the attack area of ​​the current frame original image and add it to the attack strategy; when there is no original image in the attack area of ​​the current frame original image that needs to be reactivated, assign the same new attack area to the H frames of original images following the current frame original image, and add the number of the new attack area and the timestamp of the corresponding frame original image to the attack strategy; The original image that needs to reactivate the attack area of ​​the original image of the current frame is an original image whose timestamp is the same as the reactivation timestamp of the attack area of ​​the original image of the current frame.

4. The method for generating delayed attack adversarial samples for a visual perception system according to claim 3, characterized in that: The optimization goal of minimizing the loss function value of the target detection model of the visual perception system and generating the same number of universal adversarial perturbations as the number of attack areas of the attack strategy includes: Use a random generation method to generate the same number of initial adversarial perturbations as the number of attack areas of the attack strategy, and establish a one-to-one correspondence between the initial adversarial perturbations and the attack areas; Traverse each initial adversarial perturbation and perform the following steps to obtain the universal adversarial perturbation for each attack area: The current initial adversarial perturbation is added to the target attack region of each original image to obtain a perturbed image set; wherein the target attack region is the attack region corresponding to the current initial adversarial perturbation; The loss function value of the perturbed image set is obtained through the target detection model of the visual perception system, and the preset optimizer is used to optimize the current initial adversarial perturbation to minimize the loss function value of the perturbed image set until the preset optimization times are reached or the loss function value meets the preset requirements, and the final current initial adversarial perturbation is used as the universal adversarial perturbation corresponding to the attack area corresponding to the current initial adversarial perturbation.

5. The method for generating delayed attack adversarial samples for a visual perception system according to claim 4, characterized in that: When the preset optimizer is used to optimize the current initial adversarial perturbation to minimize the loss function value of the perturbed image set, it is achieved by constructing the following optimization function: in, is the perturbed image, is the original image, is the detection result information corresponding to the attack area, is the test result score, is the two-dimensional coordinate width information of the detection result, is the two-dimensional coordinate height information of the detection result, is the image width, is the image height, is the target tracker score threshold, , and are all preset loss function weight values, is the score loss, is the area loss, To combat losses, is the L2 norm calculation, is the loss function value of the target detection model.

6. The method for generating delayed attack adversarial samples for a visual perception system according to claim 4, characterized in that: The preset optimizer is the Adam optimizer.

7. The method for generating delayed attack adversarial samples for a visual perception system according to claim 4, characterized in that: The general adversarial perturbation is added to the original image set according to the attack strategy to obtain the delayed attack adversarial sample set of the visual perception system, including: According to the attack strategy, a timestamp and a reactivation timestamp corresponding to each attack area are obtained as a target timestamp corresponding to each attack area, and the original image of the original image set is divided into each attack area; The universal adversarial perturbation corresponding to each attack area is obtained, and the universal adversarial perturbation corresponding to each attack area is added to the original image corresponding to the target timestamp corresponding to each attack area in the original image set to obtain a delayed attack adversarial sample set of the visual perception system.

8. A delayed attack adversarial sample generation system for a visual perception system, characterized in that: include: A data acquisition module, used to obtain the original image set and the target tracker parameters of the visual perception system; A strategy generation module is used to obtain an attack strategy based on the target tracker parameters of the visual perception system and the original image set to maximize the delay time of the target tracker of the visual perception system as an optimization goal; A perturbation generation module, used to generate a number of universal adversarial perturbations that is the same as the number of attack areas of the attack strategy, with the loss function value of the target detection model of the visual perception system being minimized as the optimization objective; The sample generation module is used to add universal adversarial perturbations to the original image set according to the attack strategy to obtain a delayed attack adversarial sample set for the visual perception system.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the delayed attack adversarial sample generation method for a visual perception system as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the delayed attack adversarial sample generation method for a visual perception system as described in any one of claims 1 to 7 are implemented.

Images