Confrontation sample generation method and system, storage medium and terminal

Abstract

The invention discloses an adversarial sample generation method and system, a storage medium and a terminal, and belongs to the technical field of adversarial attacks, and the method comprises the steps: determining a context region of a target object, and dividing the context region into a plurality of sub-regions; carrying out importance analysis on each sub-region; mapping the influence degree of each sub-region on the detection result of the target detection model to a context region, and generating a context attribution graph; selecting one or more influence sub-regions exceeding an influence threshold; performing fine tuning on the influence sub-region under a total loss function (including a loss function and a perception loss function) to generate an adversarial sample; according to the method, the attack direction is accurately guided through the context attribution graph, and the double loss functions are introduced, so that the imperceptibility of confrontation disturbance in vision is ensured while the position, direction and confidence coefficient prediction are inhibited, the integrity of a target object is ensured, and the attack concealment is enhanced. And attack is carried out only aiming at partial influence sub-regions, so that the attack efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of anti-attack technology, and in particular to an adversarial sample generation method, system, storage medium and terminal. Background Art

[0002] In recent years, 3D object detection technologies based on LiDAR have made significant progress in fields such as autonomous driving and robotics. These technologies rely on 3D point cloud data captured from the environment and perform object detection and classification through deep learning models. However, with the widespread application of these technologies, their security issues have gradually become prominent. In particular, existing 3D object detection systems are very sensitive to adversarial attacks, which can cause the detection performance of the detection system to seriously degrade by adding carefully designed tiny perturbations to the input data.

[0003] Although there have been many studies on 3D object detection, most adversarial attack methods focus on the target object itself, destroying the integrity of the target object to achieve the attack purpose. Although this method is effective, it has two main problems:

[0004] (1) Directly destroying the integrity of the target object will make the attack easy to detect, thereby reducing the concealment of the attack.

[0005] (2) These methods usually require a large amount of perturbations to the entire target object, resulting in low attack efficiency. Summary of the invention

[0006] The purpose of the present invention is to overcome the problems of the prior art and to provide an adversarial sample generation method, system, storage medium and terminal.

[0007] The object of the present invention is to achieve the following technical solution: a method for generating adversarial samples, the method comprising the following steps:

[0008] Determine a context area of ​​the target object; the context area includes the target object and an environment area around the target object;

[0009] Divide the context area into multiple sub-areas;

[0010] Perform importance analysis on each sub-region to obtain the degree of influence of each sub-region on the detection results of the target detection model;

[0011] Map the influence of each sub-region on the detection results of the target detection model to the context region to generate a context attribution graph;

[0012] Select one or more influential sub-regions exceeding an influence threshold according to the contextual attribution graph;

[0013] Under the guidance of the total loss function, the influential sub-region is fine-tuned to generate adversarial samples; the total loss function is obtained by weighting the adversarial loss function and the perceptual loss function.

[0014] In one example, determining a context area of ​​a target object includes:

[0015] The bounding box size is adjusted according to the size and shape of the target object to determine the context area of ​​the target object.

[0016] In one example, the context area is divided into multiple sub-areas, including:

[0017] An adaptive threshold segmentation algorithm is used to adjust the size and shape of the sub-region according to the complexity of the internal features of the sub-region.

[0018] In one example, a significance analysis is performed on each sub-region, including:

[0019] Remove or change data in a sub-region;

[0020] Inputting the sub-region where data is removed or changed into the target detection model to obtain the impact analysis detection result after removing or changing the sub-region data;

[0021] Compare the impact analysis test results with the original model output to determine the extent to which the sub-region affects the detection results of the object detection model.

[0022] In one example, after generating adversarial samples under the guidance of the total loss function, the following steps are also included:

[0023] The adversarial samples generated under the guidance of the total loss function are iteratively optimized to generate the final adversarial samples.

[0024] It should be further explained that the technical features corresponding to the various examples of the above method can be combined or replaced with each other to form a new technical solution.

[0025] The present invention also includes a system for generating adversarial samples, which has the same inventive concept as any of the above-mentioned example methods or a method formed by a combination of multiple examples, and the system includes:

[0026] A context region generating module, used to determine a context region of a target object; the context region includes the target object and an environment region around the target object;

[0027] A sub-region generation module, used for dividing the context region into multiple sub-regions;

[0028] The importance analysis module is used to perform importance analysis on each sub-region to obtain the influence of each sub-region on the detection result of the target detection model;

[0029] A context attribution map generation module is used to map the influence of each sub-region on the detection result of the target detection model to the context region to generate a context attribution map;

[0030] An influence sub-region selection module, used for selecting one or more influence sub-regions exceeding an influence threshold according to the context attribution graph;

[0031] The adversarial sample generation module is used to fine-tune the influential sub-region under the guidance of the total loss function to generate adversarial samples; the total loss function is obtained by weighting the adversarial loss function and the perceptual loss function.

[0032] In one example, the importance analysis module includes:

[0033] a disturbance generation unit for removing or changing data of a sub-region;

[0034] An impact analysis unit, used for inputting the sub-region with removed or changed data into the target detection model to obtain an impact analysis detection result after the sub-region data is removed or changed;

[0035] The comparison unit is used to compare the impact analysis detection result with the original model output to determine the impact of the sub-region on the detection result of the target detection model.

[0036] In one example, the system further includes an iterative optimization module for iteratively optimizing the adversarial samples generated under the guidance of the total loss function to generate final adversarial samples.

[0037] It should be further explained that the technical features corresponding to the above system examples can be combined or replaced with each other to form a new technical solution.

[0038] The present invention also includes a storage medium on which computer instructions are stored, and when the computer instructions are executed, the steps of the adversarial sample generation method formed by any one of the above examples or multiple examples are executed.

[0039] The present invention also includes a terminal, including a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, and when the processor executes the computer instructions, the steps of the adversarial sample generation method formed by any one or more of the above examples are executed.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] By generating a context attribution graph, the specific impact of each sub-region in the context area on the detection results is revealed, thereby accurately guiding the attack direction; by introducing a dual loss function (including adversarial loss and perceptual loss), while suppressing the prediction of position, direction, and confidence, the visual imperceptibility of the adversarial perturbation is ensured, which not only ensures the integrity of the target object but also enhances the concealment of the attack. At the same time, by performing an importance analysis of the context area and attacking only some influential sub-regions, the number of adversarial points is significantly reduced and the attack efficiency is improved. This series of improvement measures effectively solves the problem in the prior art that attacking the target object causes significant changes in its structure and geometric information, making the attack more covert and difficult to detect.

[0042] Furthermore, using adversarial samples to train the attacked detection model can enable the detection model to learn the perturbation features of the adversarial samples that distinguish them from the original samples, and then correct its classification results, achieve accurate classification, and improve the model's defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The specific implementation methods of the present invention are further described in detail below in conjunction with the accompanying drawings. The accompanying drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The same reference numerals are used in these drawings to represent the same or similar parts. The schematic embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0044] Figure 1 A method flow chart provided for an example of the present invention;

[0045] Figure 2 A schematic diagram showing the comparison between the original sample and the generated adversarial sample provided in an example of the present invention;

[0046] Figure 3 A method framework diagram provided for an example of the present invention. DETAILED DESCRIPTION

[0047] The technical solution of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] In the description of the present invention, it should be noted that the directions or positional relationships indicated by "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside", etc. are directions or positional relationships based on the drawings, which are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the use of ordinal numbers (e.g., "first and second", "first to fourth", etc.) is to distinguish objects, and is not limited to this order, and cannot be understood as indicating or implying relative importance.

[0049] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, "installation", "connection" and "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0050] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0051] In one example, if Figure 1 As shown, an adversarial sample generation method can be applied to deep 3D target detection models, especially target detection for point cloud data (such as LiDAR data), which aims to mislead the target detection model by adding carefully designed perturbations to the context area of ​​the target, causing it to produce incorrect detection results, while ensuring that these perturbations are difficult to be detected by the human eye. At this time, the method includes the following steps:

[0052] S10: Determine the context area of ​​the target object.

[0053] Wherein, the context area includes the target object and the environmental information around it. Confirm the context area of ​​the target object, first determine the bounding box of the target object by outputting the detection result through the target detection model, and then determine the context area by expanding the bounding box of the target object. Wherein, the target detection model includes but is not limited to PointPillars, PointRCNN, PV-RCNN, CenterPoint, YOLOv5, FasterR-CNN, etc. Since directly destroying the integrity of the target object will make the attack easy to detect, and the target detection model is highly dependent on the context information around the target object when making predictions, rather than just the target object itself. Therefore, the adversarial attack on the context information of the present invention can be more effective and concealed than directly attacking the target object.

[0054] S20: Subdivide the context region into multiple sub-regions to facilitate subsequent analysis.

[0055] S30: Perform importance analysis on each sub-region to obtain the influence of each sub-region on the detection result of the target detection model.

[0056] Specifically, by removing or changing the data of a specific sub-region, we observe how this change affects the output of the target detection model, and then calculate the impact value (degree of impact) of the sub-region on the detection result.

[0057] S40: Map the influence of each sub-region on the detection result of the target detection model to the context region to generate a context attribution graph.

[0058] In the present invention, the context attribution graph is a visualization tool that can show the degree of influence of each sub-region in the context region on the 3D target detection result. Optionally, the different degrees of influence of different sub-regions on the detection result can be represented by color or brightness. The context attribution graph not only shows the degree of influence of each sub-region, but also reflects the changing trend of these influences over time, providing a basis for dynamically adjusting the attack strategy.

[0059] S50: Select one or more influence sub-regions exceeding an influence threshold according to the context attribution graph.

[0060] In this step, the influence threshold can be customized and flexibly set. Specifically, the most influential sub-region can be selected according to the influence threshold, which can be one region or multiple regions. In this case, the most influential sub-region has the highest degree of influence on the target detection result. Of course, multiple influential sub-regions with higher rankings can also be selected according to the influence threshold. In this case, the more influential sub-regions have a higher degree of influence on the target detection result. It should be noted that the more influential sub-regions include the most influential sub-regions, and the influential sub-regions include the more influential sub-regions.

[0061] S60: Fine-tune the influential sub-region under the guidance of the total loss function to generate adversarial samples. The total loss function is obtained by weighting the adversarial loss function and the perceptual loss function.

[0062] In this step, the most influential sub-regions are selected for fine-tuning, and adversarial samples are generated using adversarial loss and perceptual loss under the guidance of the dual loss function.

[0063] The present invention defines the context area of ​​the target object and subdivides it into multiple sub-areas, accurately captures the information of the target object and its surrounding environment, and improves the accuracy and concealment of the attack; by generating a context attribution graph, the influence value of each sub-area on the detection result is calculated, and the influence degree of each sub-area is intuitively displayed, thereby narrowing the scope of the adversarial attack, providing precise guidance for subsequent attacks, effectively reducing the number of adversarial points, and improving the attack efficiency; by selecting key sub-areas and using a dual loss function (including adversarial loss and perceptual loss) to generate adversarial samples, not only the detection confidence of the target object is reduced, but also the visual imperceptibility of the adversarial samples is ensured, thereby achieving an efficient and covert attack without changing the structure of the target object.

[0064] In one example, determining a context area of ​​a target object includes:

[0065] A dynamic boundary adjustment mechanism is adopted, that is, the bounding box size is adaptively adjusted according to the size and shape of the target object to ensure that the context area is neither too large nor too small, so as to more accurately capture the key context information of the target object and determine the context area of ​​the target object. Specifically, the function for adjusting the bounding box size is defined as f(obj_size, obj_shape), where obj_size represents the size of the target object and obj_shape represents the shape of the target object. The calculation expression of the adjusted bounding box size B is:

[0066] B = f(obj_size, obj_shape);

[0067] Where B represents the adjusted bounding box size.

[0068] In one example, the context area is divided into multiple sub-areas, including:

[0069] Adaptive threshold segmentation algorithm is used to adjust the size and shape of the sub-region according to the complexity of the internal features of the sub-region, so that the features in each sub-region are more consistent, which is conducive to the subsequent importance analysis. In this example, the context region division includes:

[0070] S201: Divide the context region evenly into n sub-regions; specifically, let S = {S1, S2, ..., S n} represents a sub-region set, where S i represents the i-th sub-region, and n represents the total number of sub-regions.

[0071] S202: For each sub-region, calculate its feature complexity; optionally, point cloud density, local curvature or other feature indicators can be used to quantify the complexity. This example uses point cloud density as a measure of feature complexity, and the calculation expression is:

[0072]

[0073] Among them, C j represents the feature complexity of the j-th sub-region; N j represents the number of points in the j-th sub-region; V j represents the volume of the j-th sub-region.

[0074] S203: Adaptively adjust the size and shape of the sub-regions according to the feature complexity. Among them, regions with high complexity may require finer partitioning, while regions with low complexity can be merged or kept at a larger size.

[0075] In step S203, an adaptive threshold T is defined to determine whether to adjust the size of the sub-region. If C j > T, then this sub-region needs to be further subdivided; if C j < T, then this sub-region can be merged or kept at a larger size. Among them, the calculation expression of the adaptive threshold T is:

[0076]

[0077] Among them, represents the average feature complexity of all sub-regions; α' is an adjustment factor used to control the strictness of the threshold.

[0078] Furthermore, adjust the size and shape of the sub-regions according to the feature complexity. For example, use the following formula to adjust the size of the sub-region:

[0079] S′ j = S j ·(1 + γ·(C j - T));

[0080] Among them, S' j represents the adjusted size of the sub-region; S j represents the original size of the sub-region; γ is an adjustment coefficient used to control the amplitude of the adjustment.

[0081] Through the above adaptive threshold segmentation algorithm, it is possible to dynamically adjust the size and shape of the sub-regions according to the complexity of the internal features of the sub-regions, so as to more accurately locate the region that has the greatest impact on the detection result and improve the effect of adversarial attacks. In one example, an importance analysis is performed on each sub-region, including:

[0082] S301: Remove or change the data of the sub-region;

[0083] S302: Input the sub-region with the removed or changed data into the target detection model to obtain the impact analysis detection result y' after removing or changing the data of the sub-region.

[0084] S303: Compare the impact analysis detection result y' with the original model output y to determine the impact of the sub-region on the detection result of the target detection model. The original model output y represents the detection result of the detection model based on the sub-region output without removing or changing the sub-region data. i The impact value I(S i ) can be defined as:

[0085] I(S i )=|yy′|.

[0086] At this time, the influence value of each sub-region on the detection result is mapped to the context region, and the generated context attribution graph A can be expressed as:

[0087] A={I(S1),I(S2),…,I(S n )}.

[0088] In one example, the top k sub-regions with the largest influence values ​​are selected as the influential sub-regions S key :

[0089] S key ={S i ∣I(S i )∈top-k(A)};

[0090] Among them, I(S i )∈top-k(A) represents the top k sub-regions with the largest influence values.

[0091] In one example, the total loss function L is defined as:

[0092] L=αL adv +βL per ;

[0093]

[0094] L per =λ'·ChamferDistance(X,X+Δ);

[0095] Among them, I represents the number of proposals of the detection model. The proposal is the subsequent area that may include the target object generated by the detection model when processing the input data; M represents the number of actual real bounding boxes, which are provided by the annotated data and represent the position and size of the actual target object. When calculating the adversarial loss, each proposal needs to be compared with all the real bounding boxes to determine whether the match between the proposal and the real bounding box is correct, so as to ensure that the adversarial attack can interfere with the truly important proposals (proposals that are correctly matched). Used to determine whether the intersection-over-union ratio between the i-th proposal and the m-th true bounding box reaches the detection threshold thr; |b m -p i | indicates proposal p i and the ground-truth bounding box b m The absolute difference in each dimension; log(1-c i ) is used to reduce the confidence of the proposal; X represents the original point cloud data, Δ represents the added perturbation, and λ' is the weight coefficient for balancing the adversarial loss and the perceptual loss.

[0096] Among them, L adv represents the adversarial loss function, which aims to reduce the detection confidence of the target object so that it cannot be detected correctly; L per represents the perceptual loss function, which ensures that the generated adversarial samples are visually similar to the original samples and difficult to be detected by humans; α and β are hyperparameters that control the relative importance of adversarial loss and perceptual loss, respectively.

[0097] This example uses a dual loss function mechanism, especially the perceptual loss design, to ensure that the adversarial sample is highly similar to the original sample visually, greatly improving the concealment and success rate of the attack. This design not only overcomes the disadvantage of traditional attack methods that are easily perceived by humans, but also provides new ideas for the design of adversarial samples.

[0098] The most influential sub-regions are selected for fine-tuning, and adversarial examples X' are generated under the guidance of the total loss function.

[0099] In one example, after generating (preliminary) adversarial samples under the guidance of the total loss function, the following steps are also included:

[0100] A multi-stage optimization strategy is used to iteratively optimize the initial adversarial samples generated under the guidance of the total loss function to improve the quality of the adversarial samples. In each round of iteration, the attack effect of the adversarial samples is re-evaluated, and the weights of the adversarial loss and the perceptual loss are adjusted accordingly until the best attack effect is achieved. The adversarial sample that achieves the best attack effect is used as the final adversarial sample. Figure 2 (b), where Figure 2 (a) represents the original unattacked scene, i.e., adding perturbed image samples in the influential sub-region. Specifically, the multi-stage optimization strategy includes:

[0101] S701: Generate initial disturbance; the disturbance Δ is initially generated by Gaussian noise, that is, Δ~N'(0,σ 2 ), where σ is the standard deviation and N' represents a normal distribution.

[0102] S702: Iteratively optimize the disturbance; specifically, use the Adam optimization algorithm to iteratively optimize the disturbance Δ with a learning rate η=0.001, and update the disturbance Δ each time as follows:

[0103]

[0104] Among them, Δ (t) represents the disturbance at the tth iteration; Represents the gradient of the total loss function with respect to Δ.

[0105] S703: When the maximum number of iterations is reached or the adversarial loss gradient is less than the threshold, that is, the adversarial loss no longer decreases significantly, the optimization process is stopped. If the total number of iterations is t rounds, then the total loss function L of the tth round iteration is t It can be defined as:

[0106] L t =α t L adv +β t L per ;

[0107] Among them, α t , β t They represent the hyperparameters that control the relative importance of adversarial loss and perceptual loss during the t-th iteration.

[0108] Through the above iterative optimization process, the method of the present invention can generate effective adversarial samples, which can not only mislead the target detection model but also maintain low perceptual changes visually. Combining the above examples, we can obtain a preferred example of the present invention, such as Figure 3 As shown, the method now includes the following steps:

[0109] S100: Determine the context area of ​​the target object; at this time, the target detection model such as PointRCNN outputs the correct detection result for the benign radar scene, and determines the context area of ​​the target object by adaptively expanding the bounding box of the target object based on the correct detection result.

[0110] S200: subdividing the context area into a plurality of sub-areas;

[0111] S300: performing importance analysis on each sub-region to obtain the influence of each sub-region on the detection result of the target detection model;

[0112] S400: Mapping the influence of each sub-region on the detection result of the target detection model to the context region to generate a context attribution graph;

[0113] S500: selecting an influential sub-region according to the contextual attribution graph;

[0114] S600: Fine-tune the influential sub-region under the guidance of the total loss function to generate preliminary adversarial samples;

[0115] S700: Adopt a multi-stage optimization strategy to iteratively optimize the preliminary adversarial sample to obtain the final adversarial sample with the best attack effect. Specifically, optimize the total loss function through back-propagation, determine the context perturbation that can maximize the loss, and add the context perturbation to the influential sub-region to generate the final adversarial sample. Attack the detection model based on the final adversarial sample, so that the model outputs an incorrect detection result.

[0116] The present invention also includes an adversarial sample generation system, which has the same inventive concept as the adversarial sample generation method formed by any one of the above examples or a combination of multiple examples. The system includes a context area generation module, a sub-area generation module, an importance analysis module, a context attribution graph generation module, an influence sub-area selection module, and an adversarial sample generation module.

[0117] Among them, the context area generation module is used to determine the context area of ​​the target object, and the context area includes the target object and the environmental area around the target object; the sub-area generation module is used to divide the context area into multiple sub-areas; the importance analysis module is used to perform importance analysis on each sub-area to obtain the degree of influence of each sub-area on the detection result of the target detection model; the context attribution map generation module is used to map the degree of influence of each sub-area on the detection result of the target detection model to the context area, and generate a context attribution map; the influence sub-area selection module is used to select one or more influence sub-areas exceeding the influence threshold according to the context attribution map; the adversarial sample generation module is used to fine-tune the influence sub-area under the guidance of the total loss function to generate adversarial samples; wherein the total loss function is obtained by weighting the adversarial loss function and the perceptual loss function.

[0118] Furthermore, the context region generation module further includes a bounding box adjustment unit for adjusting the bounding box size according to the size and shape of the target object, thereby determining the context region of the target object. The subregion generation module includes a subregion adjustment unit for using an adaptive threshold segmentation algorithm to adjust the size and shape of the subregion according to the complexity of the internal features of the subregion.

[0119] In one example, the importance analysis module includes a disturbance generation unit, an impact analysis unit, and a comparison unit. The disturbance generation unit is used to remove or change the data of the sub-region; the impact analysis unit is used to input the sub-region with the removed or changed data into the target detection model to obtain the impact analysis detection result after the sub-region data is removed or changed; the comparison unit is used to compare the impact analysis detection result with the original model output to determine the degree of influence of the sub-region on the detection result of the target detection model.

[0120] In one example, the system also includes an iterative optimization module for iteratively optimizing the adversarial samples generated under the guidance of the total loss function to obtain the final adversarial samples with the best attack power.

[0121] In order to illustrate the attack effect of the adversarial samples generated by the method of the present invention and the system, the method of the present invention is now verified, and the verification method is as follows:

[0122] Select multiple data sets (such as KITTI, NuScenes, Waymo, Cityscapes, COCO) for experiments. Select different attacked detection models (such as PointPillars, PointRCNN, PV-RCNN, CenterPoint, YOLOv5, Faster R-CNN) to test the performance of the solution of the present invention on different detection models.

[0123] Parameter setting: The parameter k is used to define the size of the context region, that is, the ratio of the bounding box of the target object to expand outward, and the default setting is 1.5. The number of subregions n is set to 10, and the influential subregion λ is set to 5. For the KITTI dataset, the Adam optimizer is used to optimize the context perturbation with a learning rate of 0.001, and the maximum number of iterations is 120; for the NuScenes and Waymo datasets, the maximum number of iterations is 80. Gaussian noise with a mean of 0 and a variance of 0.1 is used to initialize the perturbation.

[0124] Furthermore, the performance of the method of the present invention is evaluated by comparing the attack success rate and time cost of different methods. Specifically, the attack success rate (Attack Success Rate, ASR) and time cost (Time Cost, TC) can be defined as:

[0125]

[0126] Among them, FN1 and TP1 represent the number of false negative predictions and true positive predictions when not attacked, respectively; FN2 represents the number of false negative predictions under attack; N is the total number of samples; t i is the time required to generate the i-th adversarial example.

[0127] Experimental results show that the method of the present invention can achieve a high attack success rate on three large-scale data sets while maintaining a low perceptual loss (i.e., the disturbance is not obvious), specifically reaching an attack success rate of more than 68%, of which it is as high as 83% on the KIT TI data set. In addition, the transferable attack success rate of the method of the present invention for all four attacked detection models is at least 50%, which indicates that these detection models are overly dependent on contextual information. From the determination of the context area to the evaluation of the final attack effect, the effectiveness and robustness of the method of the present invention are demonstrated, which can effectively improve the success rate and concealment of the attack, and at the same time has good transferability, and has wide application potential in different scenarios.

[0128] This paper proposes for the first time a method of using context attribution graphs to guide adversarial attacks in the field of 3D object detection. It not only fills the gap in this field, but also proves through experiments the heavy dependence of 3D object detection models on contextual information, providing a new perspective and direction for subsequent research.

[0129] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the adversarial sample generation method formed by any one of the above examples or a combination of multiple examples. The processor may be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement the present invention.

[0130] The present invention also provides a storage medium, which has the same inventive concept as a method for generating an adversarial sample formed by any one of the above examples or a combination of multiple examples, and stores computer instructions thereon, which, when executed, execute the steps of the method for generating an adversarial sample formed by any one of the above examples or a combination of multiple examples.

[0131] Based on this understanding, the technical solution of this embodiment, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0132] The present invention also provides a terminal, which has the same inventive concept as any example or a combination of multiple examples corresponding to the above-mentioned adversarial sample generation method, including a memory and a processor, wherein the memory stores computer instructions that can be run on the processor, and the processor executes the steps of the above-mentioned adversarial sample generation method when running the computer instructions. The processor can be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement the present invention.

[0133] In one example, the terminal, i.e., the electronic device, is presented in the form of a general-purpose computing device, and the components of the electronic device may include but are not limited to: at least one processing unit (processor) mentioned above, at least one storage unit mentioned above, and a bus connecting different system components (including storage units and processing units).

[0134] The storage unit stores a program code, and the program code can be executed by the processing unit, so that the processing unit performs the steps of various exemplary embodiments of the present invention described in the above "Exemplary Method" section of this specification. For example, the processing unit can perform the above-mentioned adversarial sample generation method.

[0135] The storage unit may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache memory unit, and may further include a read-only memory unit (ROM).

[0136] The storage unit may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0137] The bus may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0138] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable a user to interact with the electronic device, and / or may communicate with any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter. The network adapter communicates with other modules of the electronic device through a bus. It should be understood that other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0139] Through the above description, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to this exemplary embodiment can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method of the exemplary embodiment of the present application.

[0140] The above specific implementation methods are detailed descriptions of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for generating adversarial samples, characterized in that: The following steps are involved: Determine the context area of ​​the target object; The context area includes the target object and the environment area around the target object; Divide the context area into multiple sub-areas; Perform importance analysis on each sub-region to obtain the degree of influence of each sub-region on the detection results of the target detection model; Map the influence of each sub-region on the detection results of the target detection model to the context region to generate a context attribution graph; Select one or more influence sub-regions exceeding an influence threshold according to the contextual attribution graph; Under the guidance of the total loss function, the influential sub-region is fine-tuned to generate adversarial samples; the total loss function is obtained by weighting the adversarial loss function and the perceptual loss function.

2. The adversarial sample generation method according to claim 1, characterized in that: Determine the context area of ​​the target object, including: The bounding box size is adjusted according to the size and shape of the target object to determine the context area of ​​the target object.

3. The adversarial sample generation method according to claim 1, characterized in that: Divide the context area into multiple sub-areas, including: An adaptive threshold segmentation algorithm is used to adjust the size and shape of the sub-region according to the complexity of the internal features of the sub-region.

4. The adversarial sample generation method according to claim 1, characterized in that: Conduct importance analysis for each sub-area, including: Remove or change data in a sub-region; Inputting the sub-region where data is removed or changed into the target detection model to obtain the impact analysis detection result after removing or changing the sub-region data; Compare the impact analysis test results with the original model output to determine the extent to which the sub-region affects the detection results of the object detection model.

5. The adversarial sample generation method according to claim 1, characterized in that: After generating adversarial samples under the guidance of the total loss function, it also includes: The adversarial samples generated under the guidance of the total loss function are iteratively optimized to generate the final adversarial samples.

6. A system for generating adversarial samples, characterized in that: include: A context region generation module, used to determine the context region of the target object; The context area includes the target object and the environment area around the target object; A sub-region generation module, used for dividing the context region into multiple sub-regions; The importance analysis module is used to perform importance analysis on each sub-region to obtain the influence of each sub-region on the detection result of the target detection model; A context attribution map generation module is used to map the influence of each sub-region on the detection result of the target detection model to the context region to generate a context attribution map; An influence sub-region selection module, used for selecting one or more influence sub-regions exceeding an influence threshold according to the context attribution graph; The adversarial sample generation module is used to fine-tune the influential sub-region under the guidance of the total loss function to generate adversarial samples; the total loss function is obtained by weighting the adversarial loss function and the perceptual loss function.

7. The adversarial sample generation system according to claim 6, characterized in that: The importance analysis module includes: a disturbance generation unit for removing or changing data of a sub-region; An impact analysis unit, used for inputting the sub-region with removed or changed data into the target detection model to obtain an impact analysis detection result after the sub-region data is removed or changed; The comparison unit is used to compare the impact analysis detection result with the original model output to determine the impact of the sub-region on the detection result of the target detection model.

8. The adversarial sample generation system according to claim 6, characterized in that: The system also includes an iterative optimization module, which is used to iteratively optimize the adversarial samples generated under the guidance of the total loss function to generate final adversarial samples.

9. A storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed, the steps of the adversarial sample generation method described in any one of claims 1 to 5 are executed.

10. A terminal comprising a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, characterized in that: When the processor runs the computer instructions, the steps of the adversarial sample generation method described in any one of claims 1 to 5 are performed.

Images