Physical adversarial patch generation method based on sensitivity graph

Abstract

The invention discloses an adversarial patch generation method based on a sensitivity graph. The method comprises the following steps: firstly, extracting potential vectors from standard normal distribution, inputting the potential vectors into a pre-training generator to generate an initial adversarial patch, carrying out gradient descent optimization, combining with a specific loss function, and superposing the initial adversarial patch to a target image through various transformations to verify robustness and effectiveness in different environments; and finally, calculating imperceptibility loss and calculating adversarial detection loss and total variation loss by calculating a sensitivity graph and creating a mask matrix to cut a patch, so as to restrain generation of an adversarial patch sample. The adversarial patch generated by the method has high effectiveness and concealment, has strong robustness in different environments, can effectively deceive the target deep learning model, provides powerful support for safety assessment of the deep learning model, and is beneficial to improving the safety protection capability of a deep learning system.

Description

Technical Field

[0001] The present invention relates to the field of adversarial attacks, and particularly to a method for generating physical adversarial patches based on sensitivity maps. Background Art

[0002] With the wide application of deep learning technology, object detection systems play an increasingly important role in various industries, such as intelligent security, autonomous driving, medical image analysis, etc. However, the security of object detection systems has gradually become the focus of research attention, especially when facing adversarial attacks. Such attacks usually impose tiny perturbations on the input image, causing the object detection model to make incorrect judgments, and even misjudging or missing some key objects. The emergence of adversarial attacks has raised great concerns about the security of artificial intelligence systems. Especially in practical applications, the reliability and robustness of the systems are severely challenged. In past research, when improving the attack performance, the adversarial patches often showed significant and noticeable states, which were easily detected by human observers. The patches of adversarial T-shirts are large in size, being both conspicuous and not suitable for practical application scenarios, because such large and conspicuous patches are easily detected and removed. This problem highlights the urgent need for adversarial attacks in practical applications - to maintain the attack effect while reducing the patch size and enhancing its concealment. How to achieve both not affecting the attack effect and making the patch attach to the clothes inconspicuously like a sticker is an important challenge in current research. Summary of the Invention

[0003] The purpose of the present invention is to provide a method for generating physical adversarial patches based on sensitivity maps, which can generate adversarial patches with high effectiveness and concealment in the physical world, effectively deceive the target deep learning model, while reducing the visual visibility of the adversarial patches and improving the robustness of adversarial attacks in different environments.

[0004] The technical solution to achieve the purpose of the present invention is as follows:

[0005] A method for generating physical adversarial patches based on sensitivity maps, comprising the following steps:

[0006] Step 1, clarify the formal definition and objective of the adversarial attack;

[0007] Step 2, draw a latent vector from the standard normal distribution and input it into the pre-trained generator to obtain an initial adversarial patch. After optimizing it by gradient descent and combining with the loss function, then superimpose it on the target image after various transformations;

[0008] Step 3, calculate the concealment loss by calculating the sensitivity map and creating a mask matrix to crop the patch, calculate the adversarial detection loss and the total variation loss, and jointly constrain the generation of the adversarial patch.

[0009] Preferably, step 2 includes the following steps:

[0010] Step 2.1: During the process of generating the adversarial patch, randomly extract a latent vector This vector is from a standard normal distribution and is input into the pre-trained generator G. The generator consists of multiple neural network layers. These neural network layers gradually transform the latent vector z into an image, processing the data layer by layer through a non-linear activation function. The latent vector z is mapped into a high-dimensional feature space and gradually approaches the feature distribution of natural images;

[0011] Step 2.2: Finally, the generator G outputs an initial adversarial patch where H represents the height of the adversarial patch and W represents the width of the adversarial patch. Optimize the latent vector z through gradient descent so that the generated initial adversarial patch P remains on the manifold of natural images. The adversarial objective is defined by a loss function, which measures the interference effect of the generated initial adversarial patch on the object detection model. This loss function is expressed as the following formula:

[0012] L total = L det + αL size + βL TV

[0013] where L total represents the total loss, L det represents the adversarial detection loss, L size represents the L 0 norm loss, T LV represents the total variation loss, and α and β are hyperparameters used to control the loss;

[0014] Step 2.3: Next, apply the initial adversarial patch P to the target image to test its effectiveness in the real world. By using a rendering function to overlay the initial adversarial patch on the target image, the rendered image I P can be obtained. The formula is as follows:

[0015]

[0016] where I P represents the rendered image, I represents the clean image, Render(·) represents the rendering function, represents various transformations of the patch P, and the transformations include changes in lighting, perspective, occlusion, noise, texture, motion blur, and background.

[0017] Preferably, step 3 includes the following steps:

[0018] Step 3.1. In the classification task, the predicted class x of the input is determined by the class that maximizes the given scoring function, and the formula is as follows:

[0019]

[0020] where class(x) represents the class label obtained after classifying the input sample x, c represents a specific class in the class set x represents the input sample, S c represents the scoring function, represents the set of all possible classes, S c (x) represents the score assigned to the class c of the input x. The meaning of this formula is that according to the score function S c (x), the input x is assigned to the class with the highest score;

[0021] Step 3.2. To determine the coordinates of the important pixels in the initial adversarial patch, calculate the gradient of the class activation function S c (x) with respect to the input, and construct a sensitivity map. The sensitivity map M c (x) is defined as:

[0022]

[0023] where represents taking the derivative, represents the derivative of x, represents the derivative of S c . M c (x) represents the sensitivity of each pixel x. By sorting these saliency values, a threshold τ is set, and this threshold τ corresponds to the bottom proportion of the saliency values; crop the initial patch, use the mask matrix M to indicate the pixels to be cropped, set these unnecessary pixels in the initial patch to zero, and the updated patch P′ is calculated as follows:

[0024] P′ ij = P ij · (1 - M ij )

[0025] where i represents the row coordinate, j represents the column coordinate, P′ ij represents the pixel coordinates of the updated adversarial patch, P ij represents the original pixel coordinates, M ij represents the mask value. The mask matrix M is created by setting the pixels with saliency values lower than the threshold τ to 1 and other pixels to 0, and is specifically defined as:

[0026]

[0027] where S ijRepresents the significance value;

[0028] Evaluate the sparsity of the image generated after applying the mask by calculating the L size norm, which is the number of non-zero elements in the image, and the formula is as follows:

[0029]

[0030] where L size (P) represents the L 0 norm loss, represents an indicator function that has a value of 1 when the element at the pixel position (i,j) of the updated adversarial patch P′ is non-zero, and 0 otherwise. By calculating the L size norm, the sparsity of the patch is quantified, i.e., its visual concealment;

[0031] Step 3.3. The adversarial detection loss is used to quantify the effectiveness of the updated adversarial patch P′ in deceiving the target detector. This loss is calculated by evaluating the impact of the updated adversarial patch P′ on the detection confidence and classification accuracy of the target model. This loss is expressed as the following formula:

[0032]

[0033] where L det represents the adversarial detection loss, N represents the number of samples, represents the maximum confidence, I′ i represents the i-th image in a batch of size N, represents the objectivity score of the j-th detection of the i-th adversarial image, represents the classification score of the j-th detection of the i-th adversarial image;

[0034] Step 3.4. Minimize the total variation loss, and the formula is as follows:

[0035]

[0036] where L tv represents the total variation loss, P i,j represents the pixel value at the coordinate (i,j), P i+1,j represents the pixel value at the coordinate (i + 1,j), P i,j+1 represents the pixel value at the coordinate (i,j + 1);

[0037] Step 3.5. After the generator generates an image and completes the loss calculation, next, through the backpropagation mechanism, the gradient of the loss function with respect to the generator parameters is backpropagated to optimize the generator parameters and gradually generate a more aggressive adversarial patch.

[0038] Preferably, step 1 includes the following steps:

[0039] Step 1.1: Given a deep neural network and an input clean image with a true label, adversarial example I adv is obtained by adding a perturbation δ to the clean image I, and the generated image can make the model produce an incorrect prediction, that is, satisfy the following relationship:

[0040]

[0041] where y represents the true label of image I, represents the prediction result of the model for adversarial sample I adv . If is not equal to y, it means that the adversarial sample has successfully made the deep neural network produce an incorrect classification result;

[0042] Step 1.2: The main goal of the adversarial attack is to calculate a minimum perturbation δ such that the image I adv = I + δ causes the deep neural network to misclassify.

[0043] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0044] 1. The present invention uses the latent space of the pre-trained generative adversarial network StyleGAN (Style Generative Adversarial Network) to generate adversarial patches, and introduces a new loss function, which identifies and removes less important pixels in the patches through the sensitivity map, thereby reducing the size of the patches and enhancing their invisibility; in order to verify the effectiveness and robustness of this method, extensive experiments are carried out in this embodiment, including the transferability test between different models and the application verification in the physical environment. In addition, ablation experiments are also carried out to explore the influence of each component on the generation of adversarial patches, providing a basis for further optimization. The experimental results show that the conspicuity of the patches is effectively reduced, and a strong adversarial attack is performed on the object detection system. By comparing with the state-of-the-art methods, the experimental results show that this method has significant advantages in terms of attackability and robustness;

[0045] 2. The adversarial patches generated by the present invention have high effectiveness and invisibility, are robust in different environments, can effectively deceive the target deep learning model, provide strong support for the security evaluation of the deep learning model, and help improve the security protection ability of the deep learning system. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a flowchart of the final adversarial patch generation method of the present invention;

[0047] Figure 2 It is the overall framework diagram for generating adversarial patches of the present invention;

[0048] Figure 3 It is the rendering effect diagram of SmoothGrad clipping of the present invention;

[0049] Figure 4 It is the relationship diagram between the threshold and the average precision percentage of adversarial patches in the ablation experiment of the embodiment;

[0050] Figure 5 It is the visual effect of adversarial patches generated under different thresholds in the ablation experiment of the embodiment. Detailed implementation manners

[0051] To better understand the present invention, the content of the present invention will be further described below with reference to the accompanying drawings.

[0052] Combined with Figure 1 , the physical adversarial patch generation method based on the sensitivity map of the present invention includes the following steps:

[0053] Step 1. Define the formal definition and objective of the adversarial attack, and the specific steps are as follows:

[0054] Step 1.1. Given a deep neural network (in this embodiment, the YOLOv3tiny object detection model is used as the deep neural network for pedestrian detection) and an input clean image with a true label, the adversarial example I adv is an image generated by adding a perturbation δ to the clean image I, and the generated image can make the model produce an incorrect prediction, that is, satisfy the following relationship:

[0055]

[0056] where y represents the true label of the image I, represents the prediction result of the model for the adversarial sample I adv . If is not equal to y, it means that the adversarial sample has successfully caused the deep neural network to produce an incorrect classification result.

[0057] Step 1.2. The main objective of the adversarial attack is to calculate a minimum perturbation δ such that the image I adv = I + δ after perturbation causes the deep neural network to misclassify.

[0058] Step 2. As Figure 2As shown in Figure 1, a latent vector is drawn from a standard normal distribution and input into a pre-trained generator to obtain an initial adversarial patch, which is then optimized by gradient descent and combined with a loss function, and then superimposed on the target image after multiple transformations. The specific steps are as follows:

[0059] Step 2.1: During the generation of the adversarial patch, randomly extract a latent vector Represents d-dimensional Euclidean space, the vector comes from the standard normal distribution, as the initial noise and inputs it into the pre-trained generator G (StyleGAN, Style Generative Adversarial Network). The generator G is mainly composed of deconvolution layers (also called transposed convolution layers). These neural network layers gradually convert the latent vector z into an image, and process the data layer by layer through nonlinear activation functions. The latent vector z is mapped to a high-dimensional feature space and gradually approaches the feature distribution of natural images.

[0060] Step 2.2: The final generator G outputs an initial adversarial patch In the formula, H represents the height of the adversarial patch, and W represents the width of the adversarial patch. In order to make the generated initial adversarial patch adversarial, it is necessary to optimize the potential vector z through gradient descent so that the generated initial adversarial patch P is kept on the manifold of the natural image as much as possible. The adversarial target (the attack effect that the attacker hopes to achieve through the adversarial patch) is usually defined by a loss function, which measures the interference effect of the generated initial adversarial patch on the target detection model. The loss function formula is as follows:

[0061] L total =L det +αL size +βL TV

[0062] Among them, L total represents the total loss, L det represents the adversarial detection loss, L size Indicates L 0 Norm loss, L TV represents the total variation loss, and α and β are hyperparameters used to control the loss.

[0063] Step 2.3: Next, apply the adversarial patch to the target image to test its effectiveness in the real world. By using the rendering function to superimpose the initial adversarial patch on the target image, the rendered image I can be obtained. P , the formula is as follows:

[0064]

[0065] Among them, I PLet \(Render(I)\) denote the rendered image and \(I\) denote the clean image. \(Render(\cdot)\) represents Let \(T(P)\) denote various transformations of the initial adversarial patch \(P\), including changes in illumination, perspective, occlusion, noise, texture, motion blur, and background (the transformation combines more than one change). Through these transformations, the diversity and complexity of patches in the real world can be simulated, thus verifying the robustness and effectiveness of adversarial patches in different environments.

[0066] Step 3: Calculate the concealment loss by cropping the patch through the sensitivity map, calculate the adversarial detection loss and the total variation loss, and jointly constrain the generation of adversarial patches. The specific steps are as follows:

[0067] Step 3.1: In the classification task, the predicted class \(x\) of the input is determined by the class that maximizes the given scoring function. The formula is as follows.

[0068]

[0069] where \(class(x)\) represents the class label obtained after classifying the input sample \(x\), \(c\) represents a specific class in the set of classes , \(x\) represents the input sample, \(S\) c represents the scoring function, represents the set of all possible classes, \(S\) c (x) represents the score assigned to class \(c\) of input \(x\). The meaning of this formula is that according to the score function \(S\) c (x), the input \(x\) is assigned to the class with the highest score.

[0070] Step 3.2: As Figure 3 shown, (a) is the initial adversarial patch, (b) is the SmoothGrad detection result map of (a), and (c) is the result image after adding SmoothGrad (the optimization process of cropping unnecessary pixels, continuously shrinking the size of the adversarial patch). To determine the coordinates of important pixels in the initial adversarial patch, calculate the gradient of the class activation function \(S\) c (x) with respect to the input, and construct the sensitivity map. The sensitivity map \(M\) c (x) is defined as:

[0071]

[0072] where, denotes the derivative of \(x\), denotes the derivative of \(S\) c , and \(M\) c(x) represents the sensitivity of each pixel x. By sorting these saliency values, a threshold τ is selected, which corresponds to the bottom proportion of the saliency values. Some pixel points that have little impact on the model output are set to zero to crop the patch. Specifically, a mask matrix M is used to indicate the pixel points to be cropped, and these unnecessary pixel points in the initial adversarial patch are set to zero. The updated patch P′ is calculated as follows:

[0073] P′ ij = P ij ·(1 - M ij )

[0074] where i represents the row coordinate, j represents the column coordinate, P′ ij represents the pixel coordinates of the updated patch, P ij represents the original pixel coordinates, and M ij represents the mask value. The mask matrix M is created by setting the pixels with saliency values lower than the threshold τ to 1 and other pixels to 0. Specifically, it is defined as:

[0075]

[0076] where S ij represents the saliency value; this method effectively reduces the size of the adversarial patch by setting the pixels with less impact on the model output to zero, minimizing the visual footprint while still maintaining the deception effect of the patch on the model;

[0077] To evaluate the sparsity of the image generated after applying the mask, by calculating the L size norm, which is the number of non-zero elements in the image, the formula is as follows:

[0078]

[0079] where L size (P) represents the L 0 norm loss, represents an indicator function, which has a value of 1 when the element at the pixel position (i, j) of the updated adversarial patch P′ is non-zero, and 0 otherwise. By calculating the L size norm, the sparsity of the patch can be quantified, that is, its visual concealment.

[0080] Step 3.3: The adversarial detection loss is used to quantify the effectiveness of the updated adversarial patch P′ in deceiving the target detector. This loss is calculated by evaluating the impact of the updated adversarial patch P′ on the detection confidence and classification accuracy of the target model. More specifically, this loss function can be expressed as the following formula:

[0081]

[0082] Among them, L det represents, N represents, represents, I′ i represents the i-th image in a batch of size N, represents the objectivity score of the j-th detection of the i-th adversarial image (the image rendered after adding the updated adversarial patch P′), represents the classification score of the j-th detection of the i-th adversarial image.

[0083] Step 3.4: The total variation loss works by penalizing sudden changes in pixel intensity, encouraging smooth and continuous transitions of the generated adversarial perturbations. By minimizing the total variation loss, the adversarial patch becomes less conspicuous and can effectively blend with the background while still being effective against the object detector. The formula for minimizing the total variation loss is as follows:

[0084]

[0085] Among them, L tv represents the total variation loss, P i,j represents the pixel value at coordinates (i,j), P i+1,j represents the pixel value at coordinates (i + 1,j), P i,j+1 represents the pixel value at coordinates (i,j + 1).

[0086] Step 3.5: After the generator generates an image and completes the loss calculation (corresponding to Steps 2 to 3.4), next, through the backpropagation mechanism, the gradient of the loss function with respect to the generator parameters is backpropagated to optimize the generator parameters, gradually generating more aggressive adversarial patches.

[0087] The gradient update is in the generator part. The parameters of the generator are adjusted according to the feedback of the loss function. During training, the loss is used for backpropagation in the generator to iteratively optimize its parameters to generate images that better meet the requirements.

[0088] In summary, the present invention proposes a brand-new method for generating natural physical adversarial patches to efficiently and robustly attack object detection systems. This method removes unimportant pixel points by using the sensitivity map and optimizes the patch in the latent space of the GAN. By learning the image manifold, the optimization process is guided to generate adversarial patches that can effectively reduce the detection performance and are visually inconspicuous.

[0089] Performance evaluation of the adversarial patches generated in this embodiment:

[0090] Dataset

[0091] The INRIA pedestrian dataset is mainly used. This dataset contains a large number of annotated pedestrian images, mainly consisting of photos of individuals standing or walking. The INRIA dataset includes a training set and a test set. The training set consists of 614 images for model training, and the test set contains 288 images for model performance verification and evaluation. To ensure consistent image size, all images are uniformly adjusted to a resolution of 416×416.

[0092] Evaluation metrics: In the experiment, to evaluate the impact of adversarial patches on the performance of the object detection model, the standard evaluation metric in the field of object detection, Mean Average Precision (mAP), was adopted. mAP combines the precision and recall of the model at different detection thresholds and is an important indicator for measuring the overall performance of the object detection task.

[0093] Four conventionally trained models were selected, including YOLOv3tiny, YOLO4tiny, YOLOv5s, and YOLOv7tiny. These models were all trained based on the COCO dataset, which contains 80 classes, including the "Person" class. By combining typical models and advanced models at the research forefront, the experiment aimed to comprehensively evaluate the performance and robustness of the adversarial patches generated in this embodiment.

[0094] The experiment used BigGAN as a class-conditional generator. The optimization process was executed using the Adam optimizer. The optimization parameters were set as follows: the learning rate was 0.01, β1 = 0.5, and β2 = 0.999. The batch size was 8, and the total number of training epochs was 1000. For the dimension d of the latent vector z, BigGAN was set to 120.

[0095] Table 1. Transferability test between different models

[0096]

[0097] The first row in Table 1 shows the four conventionally trained models. The first 4 in the first column are the adversarial samples trained on these models, and the corresponding rows are the data values for attacking the corresponding models. NAP (Natural Adversarial Patch) and UPC (Universal Physical Camouflage) are two baselines for experimental comparison.

[0098] Evaluation metrics: mAP is often used to evaluate the performance of object detection models. In the context of adversarial attacks, attempts are made to reduce mAP to undermine the detection ability of the model. The lower the data, the better the attack effect.

[0099] This experiment tested the cross-model transferability of different adversarial patches on the INRIA dataset, revealing the significant advantages of the designed method. As shown in Table 1, the adversarial patches trained using YOLOv3tiny (ours-YOLOv3tiny) achieved an attack effect of 15.96% mAP on its own model, which was 26.5% and 75.2% higher than the comparative methods NAP and UPC respectively. Moreover, it demonstrated strong transferability in attacking other YOLO series models - achieving 32.72%, 57.07%, and 33.37% mAP when attacking YOLOv4tiny, YOLOv5s, and YOLOv7tiny respectively, and its performance degradation was significantly better than UPC (the mAP of attacking the same models was all higher than 52%). The adversarial patches designed by this method can not only significantly reduce the detection performance of a specially trained model but also have a significant impact on other detectors, fully demonstrating the robustness and generalization ability of the patches. In addition, the patches trained on other detectors also showed a similar trend, further confirming the versatility and effectiveness of the method. The designed patches were close to the performance of current advanced methods in terms of the mAP decline while reducing the image size, and by optimizing the naturality of the patches, they were made more visually concealed.

[0100] This ablation experiment

[0101] Figure 4 showed that the attack effect would also decrease when the threshold was increased. Figure 4 The vertical axis represents the percentage of the average precision (mAP) of the adversarial patch, and the horizontal axis represents the value of the threshold τ.

[0102] Figure 5 represents the visual effects of the adversarial patches generated under different thresholds, exploring the contribution of the concealment loss to the generation of adversarial patches. Different threshold parameters τ were set in the experiment to evaluate their effects on the naturality and attack performance of the adversarial patches. All experiments were conducted on the target detector YOLOv4tiny.

[0103] As Figure 4As shown, as the threshold τ increases, the effectiveness of the adversarial patch shows a decaying trend. This indicates that a higher τ value leads to the loss of important information, thereby weakening the performance inhibition effect of the adversarial patch on the target detection model. In particular, when τ is set to 0.3, a significant decrease in the attack effect occurs. This significant decrease is mainly attributed to the increased participation of the significant region of the adversarial patch, resulting in the loss of key information, which is crucial for deceiving the detection model. The significant region of the patch becomes less obvious at high τ values, weakening its ability to interfere with the model's detection. In addition, a higher τ value causes the boundary of the adversarial patch to blend more coarsely with its surrounding environment, thus destroying the naturalness of the patch and making it more visually detectable. By adjusting the τ parameter, the aim is to find a balance point, that is, while the adversarial patch maintains high attack performance, it can also maintain its naturalness and concealment.

Claims

1. A method for generating physical adversarial patches based on sensitivity maps, characterized in that: The following steps are involved: Step 1: Clarify the formal definition and goals of adversarial attacks; Step 2: Extract the latent vector from the standard normal distribution and input it into the pre-trained generator to obtain the initial adversarial patch, which is optimized by gradient descent and combined with the loss function, and then superimposed on the target image after multiple transformations; Step 3: Calculate the concealment loss by calculating the sensitivity map and creating a mask matrix to crop the patch, calculate the adversarial detection loss and the total variation loss, and jointly constrain the generation of adversarial patches.

2. The method for generating physical adversarial patches based on sensitivity maps according to claim 1, characterized in that: The step 2 comprises the following steps: Step 2.1: During the generation of the adversarial patch, randomly extract a latent vector This vector comes from a standard normal distribution and is input into a pre-trained generator G. The generator consists of multiple neural network layers that gradually convert the latent vector z into an image. The data is processed layer by layer through a nonlinear activation function. The latent vector z is mapped into a high-dimensional feature space and gradually approaches the feature distribution of natural images. Step 2.2: The final generator G outputs an initial adversarial patch Among them, H represents the height of the adversarial patch, W represents the width of the adversarial patch, and the potential vector z is optimized by gradient descent so that the generated initial adversarial patch P remains on the manifold of the natural image. The adversarial target is defined by a loss function, which measures the interference effect of the generated initial adversarial patch on the target detection model. The loss function is expressed as the following formula: L total =L det +αL size +βL TV Among them, L total represents the total loss, L det represents the adversarial detection loss, L size represents the L0 norm loss, L TV represents the total variation loss, α and β are hyperparameters used to control the loss; Step 2.3: Next, apply the initial adversarial patch P to the target image to test its effectiveness in the real world. By using the rendering function to superimpose the initial adversarial patch on the target image, the rendered image I can be obtained. P , the formula is as follows: Among them, I P represents the image obtained after rendering, I represents the clean image, Render(·) represents the rendering function, Represents various transformations of patch P, including changes in lighting, perspective, occlusion, noise, texture, motion blur, and background.

3. The method for generating physical adversarial patches based on sensitivity maps according to claim 2, characterized in that: The step 3 comprises the following steps: Step 3.

1. In the classification task, the predicted category x of the input is determined by the category that maximizes the given score function, as shown below: Among them, class(x) represents the category label obtained after classifying the input sample x, and c represents the category set A specific category in , x represents the input sample, S c represents the scoring function, represents the set of all possible categories, S c (x) represents the score of category c assigned to input x. The meaning of this formula is that according to the score function S c (x), assign input x to the class with the highest score; Step 3.2: To determine the coordinates of important pixels in the initial adversarial patch, calculate the class activation function S c (x) The gradient of the input and construct a sensitivity map, sensitivity map M c (x) is defined as: in, represents the derivation, represents the x derivative, Indicates S c The derivative of M c (x) represents the sensitivity of each pixel x. By sorting these saliency values, a threshold τ is set, which corresponds to the bottom ratio of the saliency value; crop the initial patch, use the mask matrix M to indicate the pixels to be cropped, and set these unnecessary pixels in the initial patch to zero. The updated patch P′ is calculated as follows: P′ ij =P ij ·(1-M ij ) Among them, i represents the row coordinate, j represents the column coordinate, and P′ ij represents the updated adversarial patch pixel coordinates, P ij Represents the original pixel coordinates, M ij Represents the mask value. The mask matrix M is created by setting pixels with saliency values ​​below the threshold τ to 1 and other pixels to 0. It is specifically defined as: Among them, S ij represents the significance value; Evaluate the sparsity of the image generated after applying the mask by computing L size The norm, that is, the number of non-zero elements in the image, is given by the following formula: Among them, L size (P) represents the L0 norm loss, represents an indicator function, which takes the value of 1 when the element at the pixel position (i, j) of the updated adversarial patch P′ is non-zero, otherwise it takes the value of 0. size norm, quantifies the sparsity of the patch, i.e., its visual invisibility; Step 3.3, the adversarial detection loss is used to quantify the effectiveness of the updated adversarial patch P′ in deceiving the target detector. The loss is calculated by evaluating the impact of the updated adversarial patch P′ on the detection confidence and classification accuracy of the target model. The loss is expressed as the following formula: Among them, L det represents the adversarial detection loss, N represents the number of samples, Indicates the maximum confidence value, I′ i represents the i-th image in a batch of size N, represents the objectness score of the jth detection of the ith adversarial image, represents the classification score of the jth detection of the i-th adversarial image; Step 3.4, minimize the total variation loss, the formula is as follows: Among them, L tv Represents the total variation loss, P i,j Represents the pixel value at coordinate (i, j), P i+1,j Represents the pixel value at coordinate (i+1,j), P i,j+1 Represents the pixel value at coordinates (i, j+1); Step 3.5: After the generator generates an image and completes the loss calculation, the gradient of the loss function to the generator parameters is then back-propagated through the back-propagation mechanism to optimize the generator parameters and gradually generate more aggressive adversarial patches.

4. The method for generating physical adversarial patches based on sensitivity maps according to claim 1, characterized in that: The step 1 comprises the following steps: Step 1.1: Given a deep neural network and an input clean image with true label, adversarial example I adv It is obtained by adding a perturbation δ to the clean image I. The generated image can make the model produce wrong predictions, that is, it satisfies the following relationship: Among them, y represents the true label of image I, Represents the model's response to adversarial sample I adv If is not equal to y, it means that the adversarial sample has successfully caused the deep neural network to produce incorrect classification results; Step 1.2: The main goal of the adversarial attack is to calculate a minimum perturbation δ so that the perturbed image I adv =I+δ leads to incorrect classification by deep neural network.

Images