Invisible backdoor attack method for industrial robot target detection and related device

Abstract

The invention relates to an industrial robot target detection-oriented invisible backdoor attack method and a related device, and belongs to the technical field of computer vision, and the method comprises the following steps: constructing a trigger invisible poisoning sample by using a clean sample of a non-target object and a target object sample with a trigger; constructing a poisoning training data set through the poisoning samples invisible to the trigger, mixing the poisoning training data set and the clean training data set to obtain a training data set, and performing model training by using the training data set to obtain a target detection backdoor model; n triggers are placed at random positions of an image background area, a reasoning stage is executed, a target detection back door model generates a target type error prediction frame around trigger positions of a poisoning test sample, and normal prediction frames appear on other objects at non-trigger positions; and invisible backdoor attack facing industrial robot target detection is completed. The method has two properties of label consistency and invisible triggering at the same time, and takes both effectiveness and concealment into consideration.

Description

Technical Field

[0001] The present invention belongs to the field of computer vision technology, and in particular relates to an invisible backdoor attack method and related devices for industrial robot target detection. Background Art

[0002] With the rapid development of technologies such as the Internet of Things, cloud computing, and big data analysis, industrial robots have been applied in many scenarios in the manufacturing and production fields, such as mechanical processing, workshop assembly, quality inspection, etc., and object detection is an important basis for industrial robots to realize the above application scenarios. Object detection is an important task in the field of computer vision. Its goal is to locate and identify objects in images or videos through deep learning models. Compared with traditional image classification tasks, object detection tasks are more complex because object detection needs to complete object positioning and category recognition at the same time, which leads to the need for a more complex model structure. Currently, the more widely used object detection models include Faster R-CNN, YOLO series, SSD, etc. These models have their own advantages in different scenarios and requirements. The selection of a suitable object detection model usually depends on the specific application scenario, hardware resources, and performance requirements.

[0003] In order to improve production efficiency, quality and safety, industrial robot target detection has been widely used in the industrial field, such as: locating and identifying parts to achieve automated assembly and disassembly; identifying and grasping materials of various shapes, sizes and weights; helping robots perceive the surrounding environment to ensure safe navigation and avoid obstacles. The above application scenarios are only part of the wide application of industrial robot target detection. With the continuous development of technology, industrial robots will play a greater role in more fields. The advancement of target detection technology will also further improve the intelligence level and flexibility of industrial robots in production.

[0004] Since most of the current advanced target detection models are designed based on deep neural networks (DNNs), they may be threatened by backdoor attacks during training. Once the target detection model is implanted with a backdoor and deployed on an industrial robot, it may cause the robot to make incorrect operations and decisions during the production process, burying the hidden dangers of production accidents or safety accidents. Therefore, it is of great significance to conduct in-depth research on the backdoor attack problem in industrial robot target detection.

[0005] Backdoor attacks are a security threat that occurs during the model training phase. Malicious attackers inject a small number of poisoned samples with backdoor triggers into the training data, causing the model trained on the poisoned data to remember the trigger pattern. During testing, the model performs normally under clean inputs, but outputs the results specified by the attacker under inputs with triggers.

[0006] However, most of the existing backdoor attack research on DNN is concentrated in the field of image classification, and the backdoor problem in the field of target detection has not been fully explored and studied. After investigation, the applicant found that the existing backdoor attack methods for target detection have some shortcomings that need to be solved, including:

[0007] (1) The annotation information of poisoned samples is inconsistent with that of clean samples. Existing backdoor attack methods modify the annotation information of images when generating poisoned samples, resulting in inconsistencies between the image content and the annotation files, making the attack easy to detect.

[0008] (2) Triggers are less concealed. Most of the triggers used in existing backdoor attack methods will form abnormal or visible patterns in the image, making the attack easily detectable by human observers. At the same time, visible triggers are detectable in the image, and the patterns they form on the image can be detected by specific analysis methods or algorithms. Summary of the invention

[0009] The purpose of the present invention is to address the problems in the above-mentioned prior art and provide a stealth backdoor attack method and related device for industrial robot target detection, which has both label consistency and stealth triggering properties, and takes into account both effectiveness and concealment.

[0010] In order to achieve the above object, the present invention has the following technical solutions:

[0011] In the first aspect, a stealth backdoor attack method for industrial robot target detection is provided, comprising:

[0012] By using clean samples of non-target objects s i and target object sample with trigger To build a poisoned sample with invisible triggers

[0013] Poisoned samples made invisible by triggers Construct poisoning training data set D p , the poisoned training data set D p and clean training dataset D c Mix to get the training data set D train , using the training data set D train Perform model training to obtain the target detection backdoor model M θ ;

[0014] Place n triggers at random positions in the background area of ​​the image and perform the inference phase, which is performed by the target detection backdoor model M θAn erroneous prediction box of the target class is generated around the trigger position of the poisoned test sample, while a normal prediction box appears on other objects at non-trigger positions, completing an invisible backdoor attack on industrial robot target detection.

[0015] As a preferred solution, the trigger is placed in the center of the target class object's true annotated bounding box to construct a poisoned sample that is invisible to the trigger. It makes it easy for the target detection model to select the area containing the trigger as the area of ​​interest, so that the target detection model can learn the association between the trigger and the target class object without modifying the input image annotation information.

[0016] As a preferred solution, the target object sample with trigger Build it as follows:

[0017] Select some clean samples t of the target object i , and place the trigger p at the center coordinate (a, b) of the target object's true annotation bounding box to obtain a target object sample with a trigger The specific construction process is as follows:

[0018]

[0019] In the formula, is an image patch, W t and H t are the width and height of the image patch, respectively. Therefore, the coordinates of the upper left corner and lower right corner of the trigger p area are (a, b) and (a+W t , b+H t ); represents element-wise product; α∈[0, 1] is a parameter that controls the strength of adding triggers.

[0020] As a preferred solution, by using clean samples of non-target objects s i and target object sample with trigger Use the following expression to construct a trigger-invisible poisoning sample

[0021]

[0022] Where z is the poisoned sample, f(·) is the intermediate feature of the deep neural network DNN model, and ε is a threshold used to ensure that the poisoned sample z is visually similar to the clean sample s of the non-target object. i Visually indistinguishable.

[0023] As a preferred solution, the trigger is invisible to the poisoned sample Clean samples s close to non-target objects in pixel space i , close to the source sample with trigger in feature space

[0024] As a preferred solution, the invisible backdoor attack method for industrial robot target detection also includes a step of evaluating the effectiveness of the invisible backdoor attack. The step of evaluating the effectiveness of the invisible backdoor attack sets two evaluation goals. One is to make the target detection backdoor model M θ The attacker's specified behavior appears on the poisoned test data, and the second is to make the target detect the backdoor model M θ Performance on clean test data is similar to the normal model;

[0025] Use the attack success rate ASR to evaluate the first goal. The calculation expression is as follows:

[0026]

[0027] The average precision mAP_normal of the normal model on the clean test set and the object detection backdoor model M θ The second objective is evaluated by comparing the average precision mAP_benigh on the clean test set.

[0028] As a preferred solution, the invisible backdoor attack method for industrial robot target detection also includes a step of evaluating the concealment of the invisible backdoor attack, and the step of evaluating the concealment of the invisible backdoor attack uses two evaluation indicators, peak signal-to-noise ratio PSNR and structural similarity index SSIM, to test and evaluate;

[0029] Peak signal-to-noise ratio (PSNR) is an indicator used to measure image quality. The calculation expression is as follows:

[0030]

[0031] In the formula, MAX is the maximum possible range of pixel values, MSE is the mean square error, and the larger the PSNR value, the better the image quality;

[0032] The structural similarity index SSIM is an indicator that measures the similarity between two images. The value range is [-1,1]. The closer the SSIM value is to 1, the more similar the two images are. The calculation expression is as follows:

[0033]

[0034] Where x and y are the two images to be compared, μ x and μ y are the means of x and y respectively, and are the variances of x and y, σ xy are the covariances of x and y respectively, and C1 and C2 are constants.

[0035] In the second aspect, a stealth backdoor attack system for industrial robot target detection is provided, including:

[0036] Poisoned sample construction module for clean samples by using non-target objects i and target object sample with trigger To build a poisoned sample with invisible triggers

[0037] Object detection backdoor model training module for poisoning samples invisible via triggers Construct poisoning training data set D p , the poisoned training data set D p and clean training dataset D c Mix to get the training data set D train , using the training data set D train Perform model training to obtain the target detection backdoor model M θ ;

[0038] The invisible backdoor attack module is used to place n triggers at random positions in the background area of ​​the image and perform the inference phase. θ An erroneous prediction box of the target class is generated around the trigger position of the poisoned test sample, while a normal prediction box appears on other objects at non-trigger positions, completing an invisible backdoor attack on industrial robot target detection.

[0039] According to a third aspect, an electronic device is provided, including:

[0040] a memory storing at least one instruction; and

[0041] A processor executes instructions stored in the memory to implement the invisible backdoor attack method for industrial robot target detection.

[0042] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the invisible backdoor attack method for industrial robot target detection is implemented.

[0043] Compared with the prior art, the present invention has at least the following beneficial effects:

[0044] The backdoor attack proposed by the invisible backdoor attack method for industrial robot target detection of the present invention occurs in the scenario where an enterprise or factory trains a target detection model and deploys it in an industrial robot. The attacker's goal is to embed a hidden backdoor in the model during the training phase, so that the output of the victim model under clean samples is consistent with the normal model, but under samples with specific triggers, an erroneous prediction box of the target object will be generated around the trigger. Generating poisoned samples is an important step in realizing the invisible backdoor attack method proposed by the present invention. In order to ensure the effectiveness and concealment of the attack without changing the image annotation information, the present invention proposes a two-stage poisoned sample generation method based on optimization, which makes the trigger visually invisible through an optimization method to enhance the concealment of the attack. In order to realize the construction of poisoned samples without modifying the image annotation information, and at the same time enable the model to learn the association between the trigger and the target object, the present invention places n triggers at random positions in the image background area to perform the reasoning phase, so as to realize the construction of poisoned samples without modifying the image annotation information, and at the same time enable the model to learn the association between the trigger and the target object. Compared with the backdoor attack method of the existing target detection task, after testing, the invisible backdoor attack method proposed in the present invention is more effective and more concealed. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 Schematic diagram of application scenario of the invisible backdoor attack method for industrial robot target detection of the present invention;

[0046] Figure 2 Flowchart of the invisible backdoor attack method for industrial robot target detection in the present invention;

[0047] Figure 3 The present invention places the trigger at the center of the real annotated bounding box of the target class object to construct a poisoned sample test image. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0049] According to existing research, backdoor attacks on target detection tasks can be divided into four categories:

[0050] (1) Object Generation Attack (OGA): The goal of OGA is to generate an erroneous prediction bounding box of the target class around the trigger. The covert backdoor method proposed in this paper belongs to OGA.

[0051] (2) Regional Misclassification Attack (RMA): The goal of RMA is to regionally change the surrounding objects of the trigger into the target class.

[0052] (3) Global Misclassification Attack (GMA): The goal of GMA is to change all predicted classes to the target class by inserting triggers on the image.

[0053] (4) Object Disappearing Attack (ODA): The goal of ODA is to make the predicted bounding box of the target class disappear.

[0054] The Badnets method proposed by Gu et al. (Gu, T., Dolan-Gavitt, B., & Garg, S. (2017). Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv: 1708.06733.) is the earliest work on backdoor attacks on DNN models. It established the basic process of backdoor attacks on DNNs, that is, the attacker first modifies a certain proportion of the training data set to obtain a poisoned data set by adding triggers to the image and changing the corresponding labels to the target labels. Then the DNN model is trained with the poisoned data set, and a backdoor is embedded in the model, which will be activated by the input with triggers during the inference phase and output the results specified by the attacker.

[0055] The BadDet method proposed by Chan et al. (Chan, SH, Dong, Y., Zhu, J., Zhang, X., & Zhou, J. (2022, October). BadDet: Backdoor attacks on object detection. In European Conference on Computer Vision (pp. 396-412). Cham: Springer Nature Switzerland.) first clearly defined backdoor attacks in target detection and proposed four different backdoor attack methods. They conducted experiments on common target detection models and designed corresponding indicators to evaluate the attack performance.

[0056] Saha et al. proposed a hidden trigger backdoor attack method (Saha, A., Subramanya, A., & Pirsiavash, H. (2020, April). Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence (Vol. 34, No. 07, pp. 11957-11965).), which is based on a clean label attack. The triggers in the training phase and the triggers used in the inference phase share the same intermediate hidden layer features to generate poisoned samples that are visually similar to the original samples, so that the true label of the poisoned sample is the target label.

[0057] The embodiment of the present invention proposes a stealth backdoor attack method for industrial robot target detection. Compared with the existing backdoor attack method for target detection, the backdoor attack method proposed in the embodiment of the present invention has both label consistency and stealth triggering properties, taking into account both effectiveness and concealment. Figure 1 As shown in FIG. 1 , the backdoor attack of the invisible backdoor attack method proposed in the present invention occurs in a scenario where an enterprise or factory trains a target detection model and deploys it on an industrial robot. The attacker's goal is to embed a hidden backdoor in the model during the training phase, so that the output of the victim model under clean samples is consistent with the normal model, but under samples with specific triggers, an incorrect prediction box of the target object is generated around the trigger.

[0058] The embodiments of the present invention assume that the attacker can modify a small amount of training data, but has no prior knowledge of information including loss functions, model structures, weight parameters, etc., and cannot modify them. In the inference phase, the attacker can query the target model using arbitrary inputs, but cannot manipulate the model inference process.

[0059] In order to construct poisoned samples without modifying the image annotation information and enable the model to learn the association between the trigger and the target object, the present invention studies the training process of the target detection model based on deep learning and finds that one of the important steps is to determine whether the area in the input image belongs to the background or the target object.

[0060] For example, the single-stage YOLO series models divide the image into a fixed number of grid cells and generate a target vector for each grid cell to indicate whether the grid cell contains a target and the location information of the target. An important element in the target vector is the confidence score C of the target existence, which reflects the model's confidence in whether the target exists.

[0061] The specific definition expression of the confidence score C is as follows:

[0062] C=Pr(object)·IOU (1)

[0063] Where Pr(object) is the model's confidence prediction that a grid cell contains an object, and its value is between 0 and 1. The closer Pr(object) is to 1, the more likely the model is to believe that the grid cell contains an object; the closer Pr(object) is to 0, the more likely the model is to believe that the grid cell does not contain an object. IOU is the intersection-over-union ratio between the predicted bounding box and the actual target bounding box, which is used to measure the degree of overlap between the two bounding boxes.

[0064] The target confidence loss in the YOLO series model loss function is defined as follows:

[0065]

[0066] Where S is the number of grid cells, B is the number of bounding boxes per grid cell, and C i，j is the prediction confidence score of anchor box j in grid cell i, is the confidence score of the object existence of anchor box j in grid cell i, is a weight parameter used to balance the confidence loss of the target. If the target object is located in a certain grid, according to expression (1), the value of Pr(object) will be close to 1, so the confidence score of the grid will be close to 1OU. If the confidence score exceeds the defined threshold, the model will consider that the target object exists in the grid.

[0067] Similar steps also occur in the two-stage target detection model. Taking Faster R-CNN as an example, Faster R-CNN first uses the region proposal network (RPN) to generate candidate regions that may contain targets. RPN is a subnetwork of Faster R-CNN, which predicts whether each window contains a target and the corresponding bounding box by sliding the window on the input image. Then, Faster R-CNN uses ROI pooling to extract features of each candidate region.

[0068] Based on the above knowledge, the embodiment of the present invention chooses to place the trigger in the center of the target class object's true annotated bounding box to construct the poisoned sample, with the purpose of making the target detection model more likely to select the area containing the trigger as the area of ​​interest, so that the model can learn the association between the trigger and the target class object without modifying the input image annotation information. To verify the feasibility, the embodiment of the present invention uses the YOLOv3 model to conduct a test experiment on the MSCOCO dataset and compares the ASR and mAP after each epoch of the first 20 epochs. benigh Keep records. Figure 3 As shown in the figure, it can be seen that with the increase of epoch, ASR and mAP benigh They are gradually increasing, which proves that the model has indeed learned the association between the trigger and the target object during the training process.

[0069] See also Figure 2 The embodiment of the present invention proposes a stealth backdoor attack method for industrial robot target detection, which mainly includes the following three stages:

[0070] Phase 1: poisoned sample generation phase. Generating poisoned samples is an important step in implementing the covert backdoor attack method proposed in the embodiment of the present invention. In order to ensure the effectiveness and concealment of the attack without changing the image annotation information, the embodiment of the present invention proposes a two-stage poisoned sample generation method based on optimization, including:

[0071] (1) The attacker selects some clean samples t of the target object i , and place the trigger p at the center coordinate (a, b) of the target object's true annotation bounding box to obtain a target object sample with a trigger The specific process is shown in the following formula:

[0072]

[0073] In the formula, is a small image patch, W t and H t are its width and height respectively, so the coordinates of the upper left corner and lower right corner of the area where the trigger p is placed are (a, b) and (a+W t ,b+H t ); represents element-wise product; α∈[0,1] is a parameter that controls the strength of adding triggers.

[0074] (2) An optimization method is used to make the trigger invisible to the eye, thereby enhancing the concealment of the attack. Specifically, as shown in Formula 4, the embodiment of the present invention uses a clean sample s of a non-target object i and the target object sample with trigger obtained in step (1) To build a poisoned sample with invisible triggers Let the poisoned sample be close to the clean sample s of the non-target object in pixel space i , but close to the source sample with trigger in feature space

[0075]

[0076] In the formula, z represents the poisoned sample, f(·) is the intermediate feature of the DNN model, and ε is a very small threshold to ensure that the poisoned sample z is visually different from the clean sample s of the non-target object. i Visually indistinguishable.

[0077] The second stage: training stage. The embodiment of the present invention uses the poisoned samples that are invisible to the triggers generated in the first stage. Construct poisoning training data set D p , and then the poisoned training data set D p and clean training dataset D c Mix to get the training data set D train , and then the third-party platform uses D train Perform model training to obtain the target detection backdoor model M θ ;

[0078] The third stage: the inference stage. The present invention designs an algorithm called BackgroudTrigger, the purpose of which is to place n triggers at random positions in the background area of ​​the image. The specific algorithm is shown in Table 1. Finally, in the inference stage, the backdoor model will generate an erroneous prediction box of the target class around the trigger position of the poisoned test sample, but a normal prediction box will appear on other objects. Figure 2 For example, if the target object label selected by the attacker is 'Wire', during the test, only the wrong prediction box of 'Wire' will appear at the trigger position, but the normal prediction box will appear on the screw and nut objects at the non-trigger position.

[0079] Table 1

[0080]

[0081]

[0082] In a possible implementation, the invisible backdoor attack method for industrial robot target detection in the embodiment of the present invention also includes a step of evaluating the effectiveness of the invisible backdoor attack. In order to evaluate and verify the effectiveness of the present invention, the embodiment of the present invention selects YOLOv3 and Faster-RCNN to conduct experiments on two data sets, MSCOCO and VOC2007, and conducts comparative experiments with BadDet. Since the backdoor attacker has two main goals: one is to make the model injected with the backdoor exhibit the behavior specified by the attacker on the poisoned test data, and the other is to make the model injected with the backdoor perform similarly to the normal model on the clean test data. The embodiment of the present invention uses the attack success rate (ASR) to evaluate the first goal, and its specific calculation expression is shown in Formula 5. Using the average precision (mAP) of the normal model on the clean test set normal) and the average precision (mAP) of the backdoor model on the clean test set benigh ) to evaluate the second goal. The embodiment of the present invention hopes that mAP normal Reach a high level to ensure that the model itself can converge well, and mAP benigh and mAP normal The values ​​of should be close to demonstrate that the backdoor model performs similarly to the normal model on the clean test data.

[0083]

[0084] As shown in Table 2, the backdoor attack method proposed in the embodiment of the present invention achieves the same mAP as normal Very close mAP benigh , indicating that the performance of the backdoor model proposed in the embodiment of the present invention on clean test data is very similar to that of the normal model. In addition, the backdoor attack proposed in the embodiment of the present invention achieves more than 90% ASR on both MSCOCO and VOC2007 datasets using YOLOv3, and more than 80% ASR using Faster-RCNN, indicating that the invisible backdoor attack method proposed in the present invention has excellent overall effectiveness. Moreover, through comparative experiments with the BadDet method, it can be clearly found that the mAP of the invisible backdoor attack method proposed in the present invention under the same setting is higher than that of the normal model. benigh and ASR both exceed BadDet, which further demonstrates the effectiveness of the invisible backdoor attack method proposed in the present invention.

[0085] Table 2

[0086]

[0087] In a possible implementation, the invisible backdoor attack method for industrial robot target detection in an embodiment of the present invention further includes a step of evaluating the concealment of the invisible backdoor attack. The embodiment of the present invention uses the same settings of the YOLOv3 model and the DOTA data set for training, and uses the peak signal-to-noise ratio (PSNR) and structural similarity index (SSIM) as two evaluation indicators to test and evaluate the concealment of the invisible backdoor attack method in an embodiment of the present invention.

[0088] Among them, PSNR is an indicator used to measure image quality, and its calculation expression is shown as follows:

[0089]

[0090] In the formula, MAX is the maximum possible range of pixel values, MSE is the mean square error, and the larger the PSNR value, the better the image quality.

[0091] SSIM is an indicator that measures the similarity between two images. Its value range is [-1,1]. The closer the SSIM value is to 1, the more similar the two images are. Its calculation expression is shown in the following formula:

[0092]

[0093] Where x and y are the two images to be compared, μ x and μ y are the means of x and y respectively, and are the variances of x and y, σ xy are the covariances of x and y respectively, and C1 and C2 are constants.

[0094] As shown in Table 3, the backdoor attack method proposed in the embodiment of the present invention is more excellent in concealment than BadDet.

[0095] Table 3

[0096]

[0097] Another embodiment of the present invention further provides a stealth backdoor attack system for industrial robot target detection, comprising:

[0098] Poisoned sample construction module for clean samples by using non-target objects i and target object sample with trigger To build a poisoned sample with invisible triggers

[0099] Object detection backdoor model training module for poisoning samples invisible via triggers Construct poisoning training data set D p , the poisoned training data set D p and clean training dataset D c Mix to get the training data set D train , using the training data set D train Perform model training to obtain the target detection backdoor model M θ ;

[0100] The invisible backdoor attack module is used to place n triggers at random positions in the background area of ​​the image and perform the inference phase. θ An erroneous prediction box of the target class is generated around the trigger position of the poisoned test sample, while a normal prediction box appears on other objects at non-trigger positions, completing an invisible backdoor attack on industrial robot target detection.

[0101] Another embodiment of the present invention further provides an electronic device, including:

[0102] A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the invisible backdoor attack method for industrial robot target detection.

[0103] Another embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the invisible backdoor attack method for industrial robot target detection is implemented.

[0104] Exemplarily, the instructions stored in the memory may be divided into one or more modules / units, which are stored in a computer-readable storage medium and executed by the processor to complete the invisible backdoor attack method for industrial robot target detection of the present invention. The one or more modules / units may be a series of computer-readable instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the server.

[0105] The electronic device may be a computing device such as a smart phone, a notebook, a PDA, and a cloud server. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the electronic device may also include more or fewer components, or a combination of certain components, or different components, for example, the electronic device may also include an input / output device, a network access device, a bus, etc.

[0106] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0107] The memory may be an internal storage unit of the server, such as a hard disk or memory of the server. The memory may also be an external storage device of the server, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the server. Furthermore, the memory may include both an internal storage unit of the server and an external storage device. The memory is used to store the computer-readable instructions and other programs and data required by the server. The memory may also be used to temporarily store data that has been output or is to be output.

[0108] It should be noted that the information interaction, execution process and other contents between the above-mentioned module units are based on the same concept as the method embodiment. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0109] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0110] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera device / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0111] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0112] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A stealth backdoor attack method for industrial robot target detection, characterized in that: include: By using clean samples of non-target objects s i and target object sample with trigger To build a poisoned sample with invisible triggers Poisoned samples made invisible by triggers Construct poisoning training data set D p , the poisoned training data set D p and clean training dataset D c Mix to get the training data set D train , using the training data set D train Perform model training to obtain the target detection backdoor model M θ ; Place n triggers at random positions in the background area of ​​the image and perform the inference phase, which is performed by the target detection backdoor model M θ An erroneous prediction box of the target class is generated around the trigger position of the poisoned test sample, while a normal prediction box appears on other objects at non-trigger positions, completing an invisible backdoor attack on industrial robot target detection.

2. According to claim 1, the invisible backdoor attack method for industrial robot target detection is characterized in that: Place the trigger at the center of the target class object's ground-truth bounding box to construct a poisoned sample where the trigger is invisible It makes it easy for the target detection model to select the area containing the trigger as the area of ​​interest, so that the target detection model can learn the association between the trigger and the target class object without modifying the input image annotation information.

3. According to claim 2, the invisible backdoor attack method for industrial robot target detection is characterized in that: The target object sample with trigger Build it as follows: Select some clean samples t of the target object i , and place the trigger p at the center coordinate (a, b) of the target object's true annotation bounding box to obtain a target object sample with a trigger The specific construction process is as follows: In the formula, is an image patch, W t and H t are the width and height of the image patch, respectively. Therefore, the coordinates of the upper left corner and lower right corner of the trigger p area are (a, b) and (a+W t ,b+H t ); represents element-wise product; α∈[0,1] is a parameter that controls the strength of adding triggers.

4. According to claim 3, the invisible backdoor attack method for industrial robot target detection is characterized in that: By using clean samples of non-target objects s i and target object sample with trigger Use the following expression to construct a trigger-invisible poisoning sample Where z is the poisoned sample, f(·) is the intermediate feature of the deep neural network DNN model, and ε is a threshold used to ensure that the poisoned sample z is visually similar to the clean sample s of the non-target object. i Visually indistinguishable.

5. According to claim 4, the invisible backdoor attack method for industrial robot target detection is characterized in that: The trigger is not visible to the poisoned sample Clean samples s close to non-target objects in pixel space i , close to the source sample with trigger in feature space 6. According to claim 1, the invisible backdoor attack method for industrial robot target detection is characterized in that: The step of evaluating the effectiveness of the invisible backdoor attack is also included. The step of evaluating the effectiveness of the invisible backdoor attack sets two evaluation goals. One is to make the target detection backdoor model M θ The attacker's specified behavior appears on the poisoned test data, and the second is to make the target detect the backdoor model M θ Performance on clean test data is similar to the normal model; Use the attack success rate ASR to evaluate the first goal. The calculation expression is as follows: The average precision mAP_normal of the normal model on the clean test set and the object detection backdoor model M θ The second objective is evaluated by comparing the average precision mAP_benigh on the clean test set.

7. The invisible backdoor attack method for industrial robot target detection according to claim 1 is characterized in that: The method further includes the step of evaluating the concealment of the invisible backdoor attack, wherein the step of evaluating the concealment of the invisible backdoor attack uses two evaluation indicators, namely, peak signal-to-noise ratio (PSNR) and structural similarity index (SSIM), to test and evaluate; Peak signal-to-noise ratio (PSNR) is an indicator used to measure image quality. The calculation expression is as follows: In the formula, MAX is the maximum possible range of pixel values, MSE is the mean square error, and the larger the PSNR value, the better the image quality; The structural similarity index SSIM is an indicator that measures the similarity between two images. The value range is [-1,1]. The closer the SSIM value is to 1, the more similar the two images are. The calculation expression is as follows: Where x and y are the two images to be compared, μ x and μ y are the means of x and y respectively, and are the variances of x and y, σ xy are the covariances of x and y respectively, and C1 and C2 are constants.

8. An invisible backdoor attack system for industrial robot target detection, characterized in that: include: Poisoned sample construction module for clean samples by using non-target objects i and target object sample with trigger To build a poisoned sample with invisible triggers Object detection backdoor model training module for poisoning samples invisible via triggers Construct poisoning training data set D p , the poisoned training data set D p and clean training dataset D c Mix to get the training data set D train , using the training data set D train Perform model training to obtain the target detection backdoor model M θ ; The invisible backdoor attack module is used to place n triggers at random positions in the background area of ​​the image and perform the inference phase. θ An erroneous prediction box of the target class is generated around the trigger position of the poisoned test sample, while a normal prediction box appears on other objects at non-trigger positions, completing an invisible backdoor attack on industrial robot target detection.

9. An electronic device, characterized in that: include: A memory storing at least one instruction; and A processor executes instructions stored in the memory to implement the invisible backdoor attack method for industrial robot target detection as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the invisible backdoor attack method for industrial robot target detection as described in any one of claims 1 to 7 is implemented.

Images