Adversarial background generation method and device for dual-induction error recognition attack

Abstract

The invention discloses an adversarial background generation method and device for a dual-induction error recognition attack, and the method comprises the following steps: 1, carrying out the physical attack modeling of an adversarial background based on the dual-induction error recognition attack, generating the adversarial background through a non-shielding strategy and a dual-induction loss function, and placing the adversarial background under a target; step 2, protected target training data collection and damage model training; step 3, obtaining a target mask through instance segmentation and binaryzation, and generating a physically adaptive enhanced confrontation background; and step 4, adversarial sample detection, loss calculation and background updating. According to the method, the problems of physical attack robustness reduction caused by insufficient utilization of image background information and difference of cross-domain training tests and attack flexibility limitation caused by a multi-dependence single-induction attack mode in an existing attack resisting method are solved.

Description

Technical field

[0001] The present invention belongs to the field of counterattack technology, and in particular relates to a method and device for generating a counterattack background for dual-induced misrecognition attacks. [Background Technology]

[0002] In recent years, deep neural networks (DNNs) have been widely used in fields such as image classification, object detection, semantic segmentation, video retrieval, face recognition, and autonomous driving. However, due to the uncertainty, large number of parameters, nonlinearity, and large-scale nature of DNNs, they also pose serious security risks in their application. They are vulnerable to attacks by carefully crafted adversarial examples. These maliciously crafted adversarial examples can easily deceive the system, leading to a sharp decline in recognition performance or the output of high-confidence erroneous predictions. This in turn causes intelligent systems to make incorrect decisions, which can have serious impacts on a number of safety-critical applications in real-world scenarios. Therefore, research on adversarial attacks and malicious examples has attracted increasing attention from researchers. Furthermore, research on adversarial attacks can help improve the adversarial robustness and generalization capabilities of DNNs, providing new insights into their interpretability and reliability.

[0003] In real-world scenarios, intelligent detection systems based on DNNs directly capture 2D images of target scenes using 2D image sensors (such as cameras). Consequently, current adversarial attack research has gradually shifted from digital perturbation attacks, which are difficult for cameras to detect, to physical attacks that manipulate the target object before the camera captures the image. However, existing physical attack methods mostly attack the target itself through methods such as color, makeup, lasers, watermarks, stickers, and textures. These methods alter the appearance of the target object, providing adversarial examples for image sensors such as cameras, thereby intentionally inducing incorrect predictions. However, these current methods often suffer from several limitations. For example, makeup and watermark attacks target a single category, are generally more effective in white-box attacks, and have limited transferability to black-box attacks. Furthermore, due to the inherent concavity and convexity of objects, these methods are difficult to implement in the physical world. Furthermore, when implementing these methods physically, variations in brightness, viewing distance, and object scale can lead to poor attack effectiveness.

[0004] Despite challenges with adversarial attacks, convolutional neural network-based object detection algorithms have achieved remarkable success in aerial detection in recent years. Research on adversarial attacks against aerial detectors holds significant value and significance for protecting military weapons and equipment in modern military warfare, and has therefore garnered widespread attention. However, most current research focuses on modifying the target itself—changing the physical appearance of the target object to provide adversarial examples for aerial detection equipment. Furthermore, most aerial detectors face complex physical conditions such as varying lighting, angles, and noise, and the large scale variations of targets in aerial remote sensing imagery pose significant challenges to adversarial attack research. Most recent research focuses on introducing a carefully designed malicious patch into real-world scenarios, placing it on the target object or elsewhere in the field of view to cause the detector to make incorrect predictions. While these methods have achieved some success against physical attacks, they inevitably exhibit certain limitations:

[0005] 1) First, existing adversarial patches are mainly based on foreground, emphasizing the blurring of ground targets, which is often inconvenient to implement in the real world and does not fully utilize the contextual background information;

[0006] 2) Secondly, compared to natural images, achieving the transition between the digital domain and the physical world requires considering complex environmental factors. Furthermore, improperly setting the training strategy for adversarial patches often leads to unstable attack effects. Existing methods often suffer from inconsistencies between training strategies and actual applications, resulting in limited improvement in adversarial attack performance.

[0007] 3) Most importantly, current research on physical attacks mostly focuses on single-induction attacks, that is, by deceiving the detector to identify the target as background, giving priority to hiding the target. Research on target obfuscation or misleading is limited and is very rare in practical applications. [Summary of the invention]

[0008] The purpose of the present invention is to provide a method and device for generating adversarial background for dual-induced misrecognition attacks, so as to solve the problems of insufficient utilization of image background information and cross-domain training and testing differences in existing adversarial attack methods, which lead to decreased robustness of physical attacks, as well as limited attack flexibility caused by multiple reliance on single-induced attack modes.

[0009] The present invention adopts the following technical solution: a method for generating a countermeasure background against a double-induced misidentification attack, comprising the following contents:

[0010] Step 1: Model the physical attack of the adversarial background based on the double-induced misrecognition attack, and then generate the adversarial background directly below the target using the no-occlusion strategy and the double-induced loss function;

[0011] Step 2: Collect the protected target training data to train the proxy model to replace the victim model for adversarial background training;

[0012] Step 3: Obtain the target mask through instance segmentation and binarization. Utilize the contextual information and, without modifying the target object itself, combine the knowledge of the victim model and a reasonable training strategy to generate a physically adapted adversarial background.

[0013] Step 4: Input the adversarial sample into the target detector to obtain the prediction result; design a dual induced misrecognition loss, including adversarial objective loss, bounding box loss, and smoothing loss, and perform loss calculation to achieve target hiding and misrecognition; after calculating the total target loss, iteratively update the adversarial background through back gradient propagation, and finally obtain two adversarial backgrounds: untargeted attack and targeted attack.

[0014] Furthermore, the specific method of step 2 is:

[0015] According to the requirements of digital and physical adversarial attacks, the required protection target training data is collected. After the data is collected, the category and location of the target of interest in the image are annotated using data annotation tools; a proxy model is trained in a black box attack scenario. The proxy model is similar to the victim model in structure and performance.

[0016] Furthermore, the specific process of step 3 is:

[0017] Step 3.1: Initialize the adversarial background

[0018] First, obtain a dataset containing all the targets to be hidden; crop these images to obtain images of a specified size as the initial adversarial background;

[0019] For grayscale image initialization:

[0020] Set all pixel values ​​of the initial adversarial background to gray;

[0021] Or, randomly initialize all pixel values ​​on the initial adversarial background;

[0022] Step 3.2: Design of unobstructed training strategy

[0023] A clean image x is passed through the instance segmenter S and binarized to obtain a target mask matrix M T , which is defined as:

[0024] M T =S(x),

[0025] The adversarial example with unobstructed target is represented as:

[0026] x* =x⊙S(x)+BA(x,P,l,w,h)⊙(1-S(x)),

[0027] Where ⊙ represents the Hadamard product, BA is the method of placing the background, P is the target adversarial background or the non-target adversarial background, l and (w,h) represent the position and size of the adversarial background;

[0028] Step 3.3: Physical adaptation enhancement against background

[0029] In the process of training against the background, physical enhancement is achieved through function BT packaging;

[0030] P i,j =BT(P i,j ),

[0031] Among them, P i,j represents the adversarial background after the j-th iteration update in the i-th Epoch;

[0032] Step 3.4: Placement of adversarial background

[0033] Combined with the unobstructed adversarial background training strategy, the trained adversarial background is placed directly below the protected target, and the global background is fully utilized to optimize and update the pixel value of the adversarial background to attack the target detector. The final adversarial example x of the target is unobstructed. * It can be defined as:

[0034]

[0035] in, and Represents the background P after the jth iteration update in the i-th Epoch i,j The position coordinates and size of .

[0036] The second technical solution adopted by the present invention is a device for generating an adversarial background for double-induced misidentification attacks, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a method for generating an adversarial background for double-induced misidentification attacks is implemented.

[0037] The beneficial effects of the present invention are:

[0038] 1) This paper uses an instance segmenter to create a target mask for the design of an unobstructed training strategy. During training, only the pixel values ​​of the background placed directly below the target are updated. This training strategy ensures that the adversarial background training process in the digital domain is consistent with the actual testing process in the real world, reducing the loss of attack effectiveness. At the same time, background transformation is used to simulate various transformations in the physical world, greatly improving the adversarial robustness of the generated background.

[0039] 2) In addition, a dual-induced misidentification loss function is designed. The background of an appropriate size is placed directly below the target to obtain an adversarial sample. The detection results of the target detector and the loss function are used to constrain the pixel values ​​of the adversarial background. The generated adversarial background can both hide the target and identify the background as the designated target, providing a more comprehensive and flexible attack mechanism.

Brief Description of the Drawings

[0040] Figure 1 This is a flow chart of a method for generating an adversarial background against a double-induced misidentification attack according to an embodiment of the present invention;

[0041] Figure 2 This is a flowchart of a countermeasure background design for a dual-induced misidentification attack according to an embodiment of the present invention;

[0042] Figure 3 This is a detailed training flow chart of an adversarial background for a dual-induced misidentification attack according to an embodiment of the present invention. [Specific implementation method]

[0043] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0044] The present invention discloses a method for generating a countermeasure background for dual-induced misidentification attacks, as shown in the attached figure. Figure 1 As shown, the following steps are included:

[0045] Step 1: Physical attack modeling of adversarial background based on dual-induced misidentification attack: Mathematically model the background attack method, and then generate an adversarial background directly under the target through the no-occlusion strategy and dual-induced loss function, which can effectively hide the target and misidentify it as a target of the specified category.

[0046] Specifically, the goal of adversarial attacks in object detection is to hide a specific target by placing a carefully designed adversarial background under the target in the clean image. Given a clean image x and an instance segmentation extractor S, the target mask matrix M of the entire image can be obtained by S and binarization T , where the foreground pixel value is 1 and the rest are 0. Then, a background P is randomly initialized 0, placing the adversarial background onto x according to the background application (BA) to obtain x P , where the adversarial background can be a target-free background P Untargeted Or target background P Targeted .x P The definition is as follows:

[0047] x P =BA(x,P,l,w,h) (1),

[0048] Where (l,w,h) is the placement position of P and BA is the background placement method. (l,w,h) is obtained through the ground truth, and then BA can further obtain the detection box mask M based on it. B To place the adversarial background. Considering the above, an adversarial example x with adversarial background P * It can be expressed as:

[0049] x * =x⊙M T +x P ⊙(1-M T ) (2),

[0050] Where ⊙ represents the Hadamard product, and P can be the background without target or the background with target.

[0051] Existing physical adversarial attack methods often rely on strategies such as placing the adversarial patch on or outside the target to optimize all pixels in the adversarial patch and improve the effectiveness of the attack. (This may be considered as background technology.) In contrast, this paper proposes a background attack targeting dual-induced misidentification. By using a no-occlusion strategy and a dual-induced loss function, an adversarial background is generated and placed directly below the target, effectively hiding the target and misidentifying it as a target of a specific category.

[0052] Step 2: Collect training data of the protected target and train the victim model: Collect the dataset of the protected target and preprocess it as the training set. In the black-box attack scenario, use the training set to train the proxy model to replace the victim model for adversarial background training.

[0053] Specifically, the method proposed in the present invention is applicable to both digital and physical adversarial attacks in white-box scenarios (where the victim model structure and parameters are known) and black-box scenarios (where the victim model structure and parameters are unknown).

[0054] Step 2.1: Collecting training data of protected targets

[0055] Based on the requirements of digital and physical adversarial attacks, the required training data for protected targets is collected (either manually curated datasets or publicly available datasets). During the data collection phase, image data can be obtained from a variety of sources, including public image repositories, video archives, and real-time surveillance cameras. After collecting the data, use data annotation tools (such as labelImage, labelme, and rectlabel) to label the categories and locations of objects of interest in the images. These annotation tools typically support outputting annotated data in various formats, such as XML, JSON, and CSV, facilitating subsequent training and verification.

[0056] Step 2.2: Victim model training

[0057] In black-box attack scenarios, since the victim model's information is unknown, a proxy model must first be trained to replace the victim model for adversarial training. This proxy model should be as similar as possible to the victim model in structure and performance, that is, it should be able to produce similar prediction results when given input. This similarity helps improve the attack effectiveness of adversarial examples generated through proxy model training. In real-world physical scenarios, these adversarial examples should also have strong attack effectiveness and transferability against the victim model, ensuring the effectiveness of the attack in practical applications. (This step can be skipped for double-induced misidentification attacks in white-box attack scenarios.)

[0058] Step 3: Adversarial background design: Based on the modeling of background attacks, the target mask is obtained through instance segmentation and binarization. The contextual background information is used to generate an adversarial background enhanced by physical adaptation without modifying the target object itself, combined with the knowledge of the victim model and a reasonable training strategy.

[0059] Based on existing research work, we can see that:

[0060] 1) The greater the resolution of the adversarial background, the better the attack effect;

[0061] 2) The closer the training strategy of the adversarial background is to the real-world application, the better the attack effect.

[0062] Based on the above observations, the present invention is committed to achieving the following goals: how to introduce a background attack method in real physical scenarios, make full use of contextual background information, combine the knowledge of the attacked target detection model, i.e., the victim model, without modifying the target object itself, and focus on double-induced error recognition and reasonable training strategies to generate an adversarial background with strong attack performance. At the same time, the adversarial background does not require any modification to the target, can be relatively easily implemented in the physical world, can hide and misclassify the target, and has good attack effectiveness and transferability.

[0063] To achieve the above goals, the model's weights and biases should remain fixed during training. Instead, the pixel values ​​outside the target area in the adversarial background are iteratively updated. This means that what we are "training" is not the model itself, but an adversarial background with attack effectiveness. The design process is shown in the attached figure. Figure 2 As shown (the detailed training process of the adversarial background is shown in the attached Figure 3 shown).

[0064] Specifically, step 3.1, adversarial background initialization

[0065] First, obtain a dataset containing all the objects that need to be hidden; this data can come from a public dataset or images containing scaled models (such as airplanes, cars, etc.). Next, crop these images to obtain images of a specified size (such as 100*100 or 300*300) as the initial adversarial background and record it as P 0 ;

[0066] The initial values ​​of the adversarial background can be initialized in a variety of ways. For grayscale image initialization, all pixel values ​​of the initial adversarial background can be uniformly set to gray; this method ensures the uniformity of the initial background. Another method is to randomly initialize all pixel values ​​of the initial adversarial background. This increases the diversity of the adversarial background and may improve the effectiveness of subsequent adversarial training.

[0067] Step 3.2: Design of unobstructed training strategy

[0068] A clean image x can be passed through the instance segmentation S and binarized to obtain a target mask matrix M T , which is defined as:

[0069] M T =S(x) (3),

[0070] In this way, the adversarial sample with unobstructed target can be expressed as:

[0071] x * =x⊙S(x)+BA(x,P,l,w,h)⊙(1-S(x)) (4),

[0072] Where ⊙ represents the Hadamard product, BA is the method of placing the background, P is the target adversarial background or the non-target adversarial background, l and (w,h) represent the position and size of the adversarial background;

[0073] Step 3.3: Physical adaptation enhancement against background

[0074] In order for the generated adversarial background to effectively deceive intelligent detection models in real physical scenes, it is necessary to consider dynamic changes in the physical world. These factors include dynamic perspective, natural noise, object scale, and lighting changes. To this end, during the training of the adversarial background, corresponding enhancement processing operations must be applied to improve the robustness of the adversarial background and its practical application effect. The above physical enhancement is achieved through the function BT packaging;

[0075] P i,j =BT(P i,j ) (5),

[0076] Among them, P i,j represents the adversarial background after the j-th iteration update in the i-th Epoch;

[0077] Step 3.4: Placement of adversarial background

[0078] Since the tilt difference between the aircraft and the viewpoint often leads to occlusion, we propose to apply the adversarial background to the original image through BA, which provides a basis for placing the background under the target without occluding the target. BA adjusts the position of the adversarial background l according to the ground truth G = (x1, y1, x2, y2, class) P and size (w P ,h P ), placing it at the center of the target boundary, the formula is as follows:

[0079]

[0080] Among them, w t and h t Indicates the size of the target detection box, r s is the area ratio of the adversarial background to the target detection box.

[0081] Therefore, the size of the adversarial background P can be expressed as follows:

[0082]

[0083] In addition, according to the above Obtain the corresponding detection box mask to obtain the image x with the adversarial background placed P Denoted as:

[0084]

[0085] Therefore, combined with the unobstructed adversarial background training strategy proposed in this invention, the trained adversarial background is placed directly below the protected target, and the global background is fully utilized to optimize and update the pixel value of the adversarial background to attack the target detector. The final adversarial example x of the target without occlusion is obtained. * It can be defined as:

[0086]

[0087] in, and Represents the background P after the jth iteration update in the i-th Epoch i,j The position coordinates and size of .

[0088] Step 4: Adversarial sample detection, loss calculation, and background update:

[0089] The adversarial sample is input into the target detector to obtain the prediction result. A dual induced misrecognition loss is designed, which includes adversarial objective loss, bounding box loss and smoothing loss, and loss calculation is performed to achieve target hiding and misrecognition. After calculating the total target loss, the adversarial background is iteratively updated through back gradient propagation, and finally two adversarial backgrounds are obtained: untargeted attack and targeted attack.

[0090] Specifically, in step 4.1, carefully designed adversarial examples are input into the object detector to obtain the object detection model's prediction results for the adversarial examples. This approach can be used to evaluate the adversarial robustness of the object detector and, in turn, optimize the design of adversarial examples to improve their attack success rate and transferability in practical applications.

[0091] Step 4.2, double induced misidentification loss includes adversarial objective loss, bounding box loss and smoothing loss. The adversarial objective loss consists of two parts: one is to hide the target and avoid being detected by the target detector, that is, to identify the foreground as background (L FN ), and the other is to identify it as a specific category, that is, to identify the background as the foreground (L FP ).

[0092] Let D be the target detector and r be the detection result, that is: r = D(x * ), where r typically includes coordinates (x1, y1, x2, y2), target score P(obj) and class probability vector (P(aircraft), P(ship), ..., P(bridge), P(harbor)). The goal of this invention is to hide the target object, which requires reducing the confidence score and class probability of the detected target to zero. Therefore, considering all the objectivity scores, L FN It can be expressed by the following formula:

[0093]

[0094] Where n is the number of detected objects, E(r) represents the objective loss L extracted from r FNDuring the optimization process, the adversarial objectivity loss gives the adversarial background attack effect. FN The optimized adversarial background has significant visual differences from the attacked target, but can well deceive object detectors to hide the target.

[0095] The present invention can achieve dual error induction, supporting both non-targeted and targeted attacks, and deliberately deceive the victim model by hiding the target and misidentifying the target. For generating adversarial background for targeted attacks, it is crucial to restrict the specified category to maintain a high confidence score, so the present invention will lose L FP Defined as:

[0096]

[0097] Among them, m represents the number of targets of the specified category, and r has the same meaning as L FN M(r) represents the target confidence score of the specified category target extracted from r. During the optimization process, L FP It gives the adversarial background a targeted attack effect and is the key loss function part of the adversarial background to achieve double error induction.

[0098] In the adversarial background optimization process, the goal of this paper is to induce misclassification of unoccluded areas in the adversarial background. Therefore, a bounding box constraint is applied to make the coordinates (x1′, y1′, x′2, y′2) of the target of a specified category detected by the detector close to the ground truth (x1, y1, x2, y2), which is expressed as:

[0099]

[0100] Among them, B represents the calculation based on the ground truth and detection results.

[0101] In order to ensure that the optimizer is more inclined to generate adversarial backgrounds with smooth color transitions, and these adversarial backgrounds can achieve effective attacks after cross-domain conversion, the present invention imposes the following smoothness constraints on the adversarial backgrounds:

[0102]

[0103] Among them, V i,j is the pixel value of the i-th row and j-th column. TV Overcomes the problem that image acquisition equipment is difficult to capture the difference between adjacent pixels

[0104] Finally, the overall objective loss function is defined as:

[0105] L Untargeted =L FN +α·L TV or L Targeted =LFN +α·L TV +β·L FP +γ·L Box (15),

[0106] Among them, α, β, and γ are hyperparameters of the balance loss term.

[0107] Step 4.3: After calculating the total target loss, the pixel values ​​on the adversarial background are iteratively updated through reverse gradient propagation until the adversarial background pattern reaches a stable state, ensuring that the adversarial background has a good double-induced false recognition attack effect on the target detector and has strong attack capability and robustness in practical applications. Untargeted The generated adversarial background is a non-targeted attack, through L Targeted The generated adversarial background is a targeted attack.

[0108] Example

[0109] In order to further verify the beneficial effects of the method of the present invention, a verification example was conducted. Specifically, as shown in Table 1, it is an information table of the simulation verification data set used in the verification process. These simulation data were used to experimentally prove the effectiveness and accuracy of the present invention.

[0110] Table 1 Information of the dataset used in the verification process

[0111]

[0112] This experiment uses an airplane model as a target that needs to be hidden and misidentified, and adopts a 1:400 scale test in the real physical world to verify the effectiveness and superiority of the present invention.

[0113] In order to fully verify the effectiveness and generalization of the present invention, 19 mainstream target detectors (SSD, Faster R-CNN, Swin Transformer, YOLOv3, YOLOv5n, YOLOv5s, YOLOv5m, YOLOv5l, YOLOv5x, Cascade RCNN, RetinaNet, Mask R-CNN, FreeAnchor, FSAF, RepPoints, TOOD, ATSS, FoveaBox, VarifocalNet) are selected as victim models based on the DOTA dataset, and are represented by symbols D1, D2, ..., D19 respectively. The effectiveness of the adversarial background is tested under white-box and black-box settings, and the average confidence of all target detectors for 18 aircraft (represented by symbols T1, T2, ..., T18 respectively) and the average confidence of the false identification as cars are recorded to verify the physical attack effect, and compared with other mainstream physical attack methods Thys et al. al., APPA(on), APPA(outside), and CBA were compared, and the experimental results are shown in Tables 2 and 3.

[0114] Table 2 Experimental results of the embodiment against background non-targeted physical attack

[0115]

[0116] In Table 2:

[0117] 1) White-box attacks are highlighted in green, and the rest are black-box attacks;

[0118] 2) The light green area (first column) represents the adversarial attack methods, where Ours (untargeted) represents the untargeted attack method of the present invention, and Thys et al., APPA (on), APPA (outside), and CBA represent other comparative attack methods; the light red area (second column) represents the proxy model used in adversarial background training; and the light gray area (first row) represents the target detector used to test adversarial samples;

[0119] 3) The colors in the table are associated with the average confidence scores. Values ​​close to 0 are represented in red, indicating good attack performance against the background, and values ​​close to 1 are represented in blue, indicating poor attack performance against the background.

[0120] From Table 2 we can see that:

[0121] 1) The proposed method can have a strong attack effect on current mainstream target detectors, and the effect of hiding targets is significantly better than other methods;

[0122] 2) The proposed method has a significant advantage in attack efficiency over white-box attacks. In an adversarial setting trained with 19 detectors, 17 detectors successfully rendered the target completely invisible. The average confidence level of the other two detected targets was also below 5%.

[0123] 3) The proposed background attack has good transferability to black-box attacks. In particular, the adversarial background trained by VarifocalNet has successfully made 18 different object detectors completely unable to detect the object;

[0124] 4) Compared with previous methods, the adversarial background generated by the proposed method significantly improves the effectiveness of adversarial attacks on YOLOv3 and YOLOv5 object detectors.

[0125] In summary, the physical attack result area of ​​the non-targeted attack adversarial background generated by the method proposed in the present invention in Table 2 is obviously redder than the corresponding area of ​​other methods. That is, the non-targeted attack adversarial background generated by the method proposed in the present invention can achieve excellent attack performance in both white-box and black-box scenarios, and the attack effect far exceeds that of other mainstream methods.

[0126] Table 3 Experimental results of the embodiment against background targeted physical attack

[0127]

[0128] In Table 3:

[0129] 1) Shows the highest confidence scores for misidentifying an airplane as a car using the targeted attack method of the present invention under a white-box attack in the physical world (the proxy model and the target detection model are the same). The "clean" column represents the highest confidence score for misidentifying an airplane as a car without the attack. The remaining 19 rows represent the highest confidence scores for misidentifying an airplane as a car using the attack method of the present invention.

[0130] 2) All results are based on the case where no aircraft is detected;

[0131] 3) A higher value indicates a greater confidence score for the misidentification as a car. The dual-induced misidentification method proposed in the present invention can generate an adversarial background with good targeted attack effects.

[0132] From Table 3 we can see that:

[0133] 1) In all white-box attack scenarios, using the target model as a proxy model, the adversarial background generated by the proposed dual-induced misidentification attack method significantly degrades the detection performance of the target detector, which means that the method can successfully hide the aircraft from detection while simultaneously identifying it as a designated target class, the car, with a high confidence score;

[0134] 2) This method can almost perfectly identify aircraft as cars, except for the relatively low confidence scores of cars detected by the Cascade R-CNN and ATSS models. However, the average confidence scores still reach 0.67 and 0.65, respectively. This shows that the carefully designed adversarial background has a significant targeted attack effect, successfully achieving dual induced false positives, and is more suitable for practical applications in the real world.

[0135] In summary, the targeted attack adversarial background generated by the proposed method in Table 3 achieves excellent attack performance in the real physical world, successfully inducing the target detector to mistakenly identify the target as a target of the specified category.

[0136] The present invention also discloses a device for generating an adversarial background against a dual-induced misidentification attack. The device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for generating an adversarial background against a dual-induced misidentification attack is implemented.

[0137] The device can be a computing device such as a desktop computer, laptop, PDA, or cloud server. The basic components of the device include, but are not limited to, a processor and memory. Those skilled in the art will appreciate that the device can also include more or fewer components, combine certain components, or utilize different components, such as input and output devices, network access devices, etc. Through the coordinated operation of these components, the device can efficiently generate a countermeasure background for physical attacks, improving the practicality and effectiveness of countermeasure attacks.

[0138] A processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate circuits or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0139] In some embodiments, the memory may be an internal storage unit of the device, such as a hard disk or memory. In other embodiments, the memory may also be an external storage device of the device, such as a plug-in hard disk, a smart media card (SMC), a secure digital card (SD), a flash card, etc. equipped with the device. Furthermore, the memory may include both the internal storage unit and the external storage device of the device. The memory is used to store an operating system, application programs, a boot loader, data, and other programs, such as computer program code. The memory may also be used to temporarily store data that has been output or is about to be output.

[0140] It should be noted that the specific content of the above-mentioned device is based on the same concept as the embodiment of the method of the present invention. Its specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0141] In the above embodiments, the description of each embodiment has different emphases. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant description of other embodiments. Those skilled in the art will appreciate that the modules and algorithm steps described in conjunction with the embodiments disclosed in the present invention can be implemented in the form of electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can choose different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Claims

1. The adversarial background generation method for dual-induced misidentification attack is characterized by: Includes the following: Step 1: Model the physical attack of the adversarial background based on the double-induced misrecognition attack, and then generate the adversarial background directly below the target using the no-occlusion strategy and the double-induced loss function; Step 2: Collect the protected target training data to train the proxy model to replace the victim model for adversarial background training; Step 3: Obtain the target mask through instance segmentation and binarization. Utilize the contextual information and, without modifying the target object itself, combine the knowledge of the victim model and a reasonable training strategy to generate a physically adapted adversarial background. Step 4: Input the adversarial sample into the target detector to obtain the prediction result; design a dual induced misrecognition loss, including adversarial objective loss, bounding box loss, and smoothing loss, and perform loss calculation to achieve target hiding and misrecognition; after calculating the total target loss, iteratively update the adversarial background through back gradient propagation, and finally obtain two adversarial backgrounds: untargeted attack and targeted attack.

2. The method for generating a countermeasure background against a double-induced misidentification attack according to claim 1, wherein: The specific method of step 2 is: According to the requirements of digital and physical adversarial attacks, the required protection target training data is collected. After the data is collected, the category and location of the target of interest in the image are annotated using data annotation tools; a proxy model is trained in a black box attack scenario. The proxy model is similar to the victim model in structure and performance.

3. The method for generating a countermeasure background against a double-induced misidentification attack according to claim 2, wherein: The specific process of step 3 is as follows: Step 3.1: Initialize the adversarial background First, obtain a dataset containing all the targets to be hidden; crop these images to obtain images of a specified size as the initial adversarial background; For grayscale image initialization: Set all pixel values ​​of the initial adversarial background to gray; Or, randomly initialize all pixel values ​​on the initial adversarial background; Step 3.2: Design of unobstructed training strategy A clean image x is passed through the instance segmenter S and binarized to obtain a target mask matrix M T , which is defined as: M T =S(x), The adversarial example with unobstructed target is represented as: x * =x⊙S(x)+BA(x,P,l,w,h)⊙(1-S(x)), Where ⊙ represents the Hadamard product, BA is the method of placing the background, P is the target adversarial background or the non-target adversarial background, l and (w,h) represent the position and size of the adversarial background; Step 3.3: Physical adaptation enhancement against background In the process of training against the background, physical enhancement is achieved through function BT packaging; P i,j =BT(P i,j ), Among them, P i,j represents the adversarial background after the j-th iteration update in the i-th Epoch; Step 3.4: Placement of adversarial background Combined with the unobstructed adversarial background training strategy, the trained adversarial background is placed directly below the protected target, and the global background is fully utilized to optimize and update the pixel value of the adversarial background to attack the target detector. The final adversarial example x of the target is unobstructed. * It can be defined as: in, and Represents the background P after the jth iteration update in the i-th Epoch i,j The position coordinates and size of .

4. A device for generating an adversarial background against a double-induced misidentification attack, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for generating an adversarial background against a double-induced misrecognition attack according to any one of claims 1 to 3 is implemented.

Images