Target detector safety testing method and device, electronic device and storage medium

Abstract

The present disclosure relates to a method and device for testing the safety of a target detector, an electronic device and a storage medium. The method comprises: sampling a first image to be optimized to obtain a sampled first sub-image, pasting the first sub-image into the annotated areas of each sample image in a training set to obtain a pasted training image, and then optimizing the first image according to the target detector and the training image to obtain an optimized second image. The second image can effectively detect the safety and reliability of the target detector, and remind users to pay attention to the risks of using the target detector.

Description

Technical Field

[0001] The present disclosure relates to the field of computer vision technology, and in particular to a method and device for testing the safety of an object detector, an electronic device, and a storage medium. Background Art

[0002] Object detection refers to using computers to determine the location of objects in a scene and marking the area where the object is located by labeling, marking, coloring or highlighting. Object detection, as an automatic positioning algorithm on images, has important applications in the fields of intelligent camera monitoring, autonomous driving and intelligent robots.

[0003] The currently popular target detection algorithm can use a deep neural network (DNN) to determine the position and size of the marked area where each target is located. However, DNN has been found to be disturbed by some specific disturbances, resulting in misjudgment or missed judgment. This disturbance is called an adversarial sample, which exists not only in the digital world, but also in the physical world. Such adversarial samples can make the target invisible to the target detector. At present, the invisibility of target detectors in the physical world usually adopts the method of patch patterns, which can only work when the patch pattern is facing the camera. Summary of the invention

[0004] In view of this, the present disclosure proposes a target detector security testing method and device, an electronic device and a storage medium.

[0005] According to one aspect of the present disclosure, a method for security testing of a target detector is provided, the method comprising: sampling a first image to be optimized to obtain a sampled first sub-image; pasting the first sub-image into the annotated areas of each sample image in a training set to obtain a pasted training image, wherein the sample image includes an annotated area of ​​one or more targets; optimizing the first image according to the target detector and the training image to obtain an optimized second image, wherein the second image is used for security testing of the target detector.

[0006] In a possible implementation, when the first image is represented as a periodically arranged third image, the sampling process of the first image to be optimized to obtain the sampled first sub-image includes: sampling the third image using a ring cutting method to obtain the sampled first sub-image.

[0007] In a possible implementation, the third image is sampled using a circular cutting method to obtain a sampled first sub-image, including: connecting the upper and lower sides and the left and right sides of the third image to form a three-dimensional circular graph; sampling the plane expansion image of the three-dimensional circular graph to obtain the sampled first sub-image.

[0008] In a possible implementation, when the first image is represented as a periodically arranged third image, the first image is optimized according to the target detector and the training image to obtain an optimized second image, including: optimizing the third image according to the target detector and the training image to obtain a fourth image; and periodically splicing the fourth image to obtain an optimized second image.

[0009] In one possible implementation, the first image is optimized according to the target detector and the training image to obtain an optimized second image, including: based on a preset loss function, the first image is optimized to obtain an optimized second image; wherein the loss function includes a function representing the detection result of the target detector and a function representing the image smoothness of the first image, and the detection result of the target detector includes the confidence of the target.

[0010] In one possible implementation, the first image is optimized according to the target detector and the training image to obtain an optimized second image, including: adjusting the value of each pixel in the first image by optimization to obtain the second image, so that after the training image is input into the target detector, the detection result obtained is degraded.

[0011] In a possible implementation, the first sub-image is pasted into the annotated area of ​​each sample image in a training set to obtain a pasted training image, including: transforming the first sub-image to obtain a second sub-image that matches the annotated area of ​​the target in the sample image; and pasting the second sub-image into the annotated area of ​​the sample image to obtain a pasted training image.

[0012] According to another aspect of the present disclosure, a security testing device for a target detector is provided, including: a sampling module, used to sample a first image to be optimized to obtain a sampled first sub-image; a pasting module, used to paste the first sub-image into the annotated areas of each sample image in a training set to obtain a pasted training image, wherein the sample image includes an annotated area of ​​one or more targets; an optimization module, used to optimize the first image according to the target detector and the training image to obtain an optimized second image, wherein the second image is used to perform a security test on the target detector.

[0013] In a possible implementation, when the first image is represented as a periodically arranged third image, the sampling module includes: a circular cutting sampling submodule, configured to perform circular cutting sampling on the third image to obtain a sampled first subimage.

[0014] In a possible implementation, the annular cutting sampling submodule is used to: connect the upper and lower sides and the left and right sides of the third image to form a three-dimensional circular ring chart; sample the plane expansion image of the three-dimensional circular ring chart to obtain the sampled first sub-image.

[0015] In a possible implementation, when the first image is represented as a periodically arranged third image, the optimization module is used to: optimize the third image according to the target detector and the training image to obtain a fourth image; and perform periodic splicing processing on the fourth image to obtain an optimized second image.

[0016] In one possible implementation, the optimization module is used to: optimize the first image based on a preset loss function to obtain an optimized second image; wherein the loss function includes a function representing the detection result of the target detector and a function representing the image smoothness of the first image, and the detection result of the target detector includes the confidence of the target.

[0017] In a possible implementation, the optimization module is used to adjust the value of each pixel in the first image by optimization to obtain the second image, so that after the training image is input into the target detector, the detection result obtained is degraded.

[0018] In one possible implementation, the pasting module is used to: transform the first sub-image to obtain a second sub-image that matches the annotated area of ​​the target in the sample image; and paste the second sub-image into the annotated area of ​​the sample image to obtain a pasted training image.

[0019] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to call the instructions stored in the memory to execute the above method.

[0020] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions implement the above method when executed by a processor.

[0021] In the disclosed embodiment, the first image to be optimized is sampled to obtain a sampled first sub-image, and the first sub-image is pasted into the annotated areas of each sample image in a training set to obtain a pasted training image, and then the first image is optimized based on the target detector and the training image to obtain an optimized second image. The second image can effectively detect the security and reliability of the target detector, remind users to pay attention to the risks of using the target detector, and is conducive to the developers of the target detector to improve the target detector.

[0022] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and do not limit the present disclosure. Other features and aspects of the present disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0024] Figure 1 A flowchart showing a method for testing the safety of an object detector according to an embodiment of the present disclosure is shown;

[0025] Figure 2 A schematic diagram showing a security testing method of a target detector based on random sampling according to an embodiment of the present disclosure;

[0026] Figure 3 A schematic diagram showing a safety testing method of an object detector based on ring-cut sampling according to an embodiment of the present disclosure is shown;

[0027] Figure 4 A schematic diagram showing a ring cutting sampling method according to an embodiment of the present disclosure;

[0028] Figure 5 A schematic diagram showing an optimized second image according to an embodiment of the present disclosure;

[0029] Figure 6 A schematic diagram showing a security test of the optimized second image according to an embodiment of the present disclosure;

[0030] Figure 7 A block diagram showing a safety testing device of an object detector according to an embodiment of the present disclosure;

[0031] Figure 8 A block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0032] Fig. 9 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0033] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0034] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0035] The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can represent including any one or more elements selected from the set consisting of A, B, and C.

[0036] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0037] In the related art, the physical world basically uses patch patterns to construct counter-perturbations for the invisibility of target detectors. For example, for the invisibility of pedestrian detectors, one or more square patch patterns can be pasted on relatively flat parts such as the chest of clothes, so that these patch patterns interfere with the output results of pedestrian detectors after being received by the camera. These patterns can be optimized by minimizing an objective function, and the objective function is the maximum value of the objectness score of each bounding box in the output results of the pedestrian detector.

[0038] However, in the related art, there are the following problems regarding the security testing method of the target detector:

[0039] First, in the physical world, the stealth method for target detectors can only be implemented through an overall patch pattern. When the target rotates and blocks part of the patch pattern, its stealth effect will be greatly reduced. Therefore, the patch pattern will only work as a stealth when it faces the camera. In this case, the stealth method and type are greatly limited.

[0040] Second, in the related art, simple expansion of patch patterns, such as pasting multiple patch patterns, is still difficult to work, because different patches will only work as a whole, and it is difficult for parts of multiple patches to be combined together to have a stealth effect.

[0041] Third, although the relevant technology can be extended to optimize 3D models of different objects (such as clothing), its simulation process is very cumbersome and complicated, and requires patch patterns to be affixed at specific locations, which has certain limitations in universality and versatility.

[0042] The above-mentioned patch pattern can only achieve invisibility within a specific angle range relative to the camera, and the 3D modeling is relatively complex. The present disclosure proposes a security testing method for a target detector, which samples the first image to be optimized to obtain a sampled first sub-image, and pastes the first sub-image into the annotated area of ​​each sample image in the training set to obtain a pasted training image, and then optimizes the first image according to the target detector and the training image to obtain an optimized second image. Each part of the second image has a stealth effect, and can achieve invisibility for the target detector at various shooting angles. Therefore, the stealth effect of the second image can be used to effectively test the security and reliability of the target detector, reminding users to pay attention to the risks of using the target detector, which is conducive to the developers of the target detector to improve the detector.

[0043] Figure 1 A flowchart of a method for testing the safety of an object detector according to an embodiment of the present disclosure is shown. Figure 1 As shown, the method includes:

[0044] In step S1, a first image to be optimized is sampled to obtain a sampled first sub-image;

[0045] In step S2, the first sub-image is pasted into the annotated area of ​​each sample image in the training set to obtain a pasted training image, wherein the sample image includes an annotated area of ​​one or more targets;

[0046] In step S3, the first image is optimized according to the target detector and the training image to obtain an optimized second image, and the second image is used to perform a security test on the target detector.

[0047] In a possible implementation, the security testing method of the target detector may be executed by a terminal device or other processing device, wherein the terminal device may be a user equipment (UE), a mobile device, a user terminal, a terminal, etc. Other processing devices may be a server or a cloud server, etc. In some possible implementations, the security testing method may be implemented by a processor calling a computer-readable instruction stored in a memory.

[0048] In a possible implementation, in step S1, the first image to be optimized is sampled to obtain a sampled first sub-image. The first image may be a texture pattern of a preset size or a periodically arranged texture pattern. For example, when the first image is a texture pattern of a preset size, the first image may be randomly sampled to obtain a sampled first sub-image; when the first image is a periodically arranged texture pattern, the periodically arranged texture pattern units in the first image may be subjected to toroidal cropping sampling (TCS) to obtain a sampled first sub-image. The present disclosure does not limit the specific size and style of the first image.

[0049] In a possible implementation, in step S2, the first sub-image may be randomly transformed to simulate the situation in the physical world, for example, by changing the scaling, rotation angle, contrast, brightness, and superimposing Gaussian noise on the first sub-image. Then, the transformed first sub-image may be pasted into the annotated area of ​​each sample image in the training set to obtain a pasted training image.

[0050] When the sample image includes annotated areas of multiple targets, the first sub-images can be transformed according to the annotated areas of the multiple targets, so that the transformed first sub-images match the corresponding annotated areas, and then the transformed first sub-images are pasted to the corresponding annotated areas.

[0051] The sample images in the training set may be images captured by an image acquisition device (e.g., a camera), and may include one or more targets to be identified, such as human bodies, faces, vehicles, objects, etc. The present disclosure does not limit the method for acquiring sample images and the categories of targets in the sample images.

[0052] The sample images in the training set may include the annotation results of the target to be identified, that is, the sample images in the training set are annotated with the targets by labeling, marking, coloring or highlighting. For example, the sample images may be input into a target detector, and the target detector may perform target detection on the sample images to obtain the annotated areas of the sample images. The annotated areas of the sample images may also be obtained by manual marking. The present disclosure does not limit the method for obtaining the annotated areas in the sample images.

[0053] In a possible implementation, in step S3, each training image can be input into a target detector, so that the target detector performs target detection processing on the training image, and the detection result of the target detector can be obtained. The optimization goal is: the training image is input into the target detector so that the detector cannot detect the target and obtains an erroneous detection result.

[0054] Among them, the target detector is used to detect the target, and may include a target detector based on a deep neural network or a target detector based on a convolutional neural network. The present disclosure does not limit the type of the target detector.

[0055] A loss function that degrades the detection result of the target detector may be set, for example, minimizing the maximum value of the target existence confidence output by the target detector. The gradient of the loss function with respect to the first image may be obtained using a back propagation algorithm, and the pixel value of each pixel in the first image may be adjusted according to the obtained gradient to obtain an optimized second image.

[0056] Among them, the adversarial audio information can be updated according to the obtained gradient, which can be combined with the Fast Gradient Sign Method (FGSM), the Projected Gradient Descent method (PGD) or the Adaptive Momentum (Adam). The present disclosure does not limit the specific combined algorithms.

[0057] The optimized second image can be used to perform security tests on the target detector. For example, if the target detector passes the security test performed by the second image, it means that the security of the target detector is relatively high; if the target detector does not pass the security test performed by the second image, it means that the security of the target detector is relatively low.

[0058] In this way, the first image to be optimized is sampled to obtain a sampled first sub-image, and the first sub-image is pasted into the annotated areas of each sample image in the training set to obtain a pasted training image. Then, the first image can be optimized according to the target detector and the training image to obtain an optimized second image. The second image can effectively detect the safety and reliability of the target detector, and remind users to pay attention to the risks of using the target detector.

[0059] Furthermore, since each local image (first sub-image) after sampling the second image is optimized separately during the optimization process, each small part of the second image can have a stealth effect on the target detector, and the safety test method of the target detector disclosed in the present invention can have better versatility. For example, when the target of the target detector is a pedestrian, there is no need to print patterns at specific positions on the clothing, nor is there any need to optimize for different clothing. A safety test method for a target detector based on random sampling can generate a stealth pattern of a preset size; or a safety test method for a target detector based on annular cutting sampling can generate a periodic stealth pattern. As a result, different clothing containing or covered with stealth patterns can be invisible to the target detector at various angles, and the safety and reliability of the target detector can be detected based on the stealth effect, which is beneficial for the developers of the target detector to improve the target detector and improve the safety of the target detector.

[0060] The following describes the security testing method of the target detector of the embodiment of the present disclosure in detail by taking the security testing method of the target detector based on random sampling and the security testing method of the target detector based on circular cutting sampling as examples.

[0061] Figure 2 A schematic diagram showing a security testing method of a target detector based on random sampling according to an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the first image τ is a texture pattern of a preset size (for example, 600 pixels×600 pixels), and a small image (i.e., the first sub-image τ) is randomly sampled from the first image τ. ) is optimized so that every small part of the optimized second image has a stealth effect.

[0062] In step S1, in each round of training, the first image τ to be optimized is subjected to random cutting sampling processing Crop(τ) to obtain the first sub-image after sampling

[0063] In step S2, the first sub-image Paste it into the labeled area of ​​each sample image x in the training set to obtain the pasted training image.

[0064] In a possible implementation, step S2 includes: transforming the first sub-image to obtain a second sub-image that matches the annotated area of ​​the target in the sample image; pasting the second sub-image into the annotated area of ​​the sample image to obtain a pasted training image.

[0065] For example, for each sample image x in the training set, the labeled area of ​​each target in the sample image x can be obtained by manually marking or detecting the mark with a target detector.

[0066] According to the marked area of ​​the sample image x, the first sub-image Transformation processing is performed to obtain a second sub-image that matches the annotated area of ​​the target in the sample image x, which can facilitate pasting the corresponding transformed first sub-image in each annotated area

[0067] Among them, for the first sub-image The transformation process can simulate the situation in the physical world, such as changing the scale, rotation angle, contrast, brightness, superimposing Gaussian noise, etc. In addition, the transformation process can also use random thin plate spline (TPS) deformation to simulate the deformation of objects (such as cloth) in the physical world, that is, parameterizing the deformed object by grid calibration method. It should be understood that the present disclosure does not limit the specific form of the transformation process.

[0068] Then the first sub-image The second sub-image obtained after the transformation is pasted into the marked area of ​​the sample image x to obtain the pasted training image. The operation of transforming and adding the sample image x is denoted as M, and the pasted training image is represented as

[0069] In this way, transforming the first sub-image before pasting can model the perturbations of objects in the physical world, which helps to improve the effectiveness of the security detection method for the object detector.

[0070] In step S2, the training image is obtained. Then, in step S3, according to the target detector and the training image The first image τ is optimized to obtain an optimized second image for performing a security test on the target detector.

[0071] In a possible implementation, step S3 includes: adjusting the value of each pixel in the first image by optimization to obtain the second image, so that after the training image is input into the target detector, the detection result obtained is degraded.

[0072] For example, for the sample image x in the training set, the target detector can accurately detect the target in the sample image x and output an accurate target detection result; however, for the sample image with the first image τ added, the target detector may detect the target inaccurately or fail to detect the target, and output an inaccurate or even wrong target detection result.

[0073] The target detector optimizes the first image τ by iteratively adjusting the pixel values ​​of the first image τ so that the detection result calculated by the target detector for the sample image with the first image τ added is degraded.

[0074] During the optimization process, the first sub-image randomly sampled from the first image τ can be respectively After multiple rounds of training, an optimized second image can be obtained. Each small part of the second image has a stealth effect. In this case, even if a sample image with part of the second image pasted is input into the target detector, the detection result calculated by the target detector can be degraded.

[0075] Among them, the detection results output by the target detector may include one or more of the confidence of the target existence, the confidence of a specific category, and the predicted detection frame coordinates. The confidence of the target existence indicates the probability of the target existence, the confidence of a specific category indicates the probability of the existence of a specific category of targets, and the predicted detection frame coordinates indicate the location of the target area. If you want to degrade the detection results of the target detector, that is, even if the target detector cannot recognize the target object, you need to reduce one or more of the confidence of the target existence, the confidence of the specific category, and the predicted detection frame coordinates as much as possible.

[0076] In this way, each local image (first sub-image) after sampling the second image is optimized separately during the optimization process, so that each small part of the second image can have a stealth effect on the target detector, which can improve the universality and versatility of the method disclosed in the present invention. When using the second image to perform security detection on the target detector, even if part of the second image is blocked, the security test of the target detector can be effectively performed.

[0077] In one possible implementation, step S3 includes: optimizing the first image based on a preset loss function to obtain an optimized second image; wherein the loss function includes a function representing the detection result of the target detector and a function representing the image smoothness of the first image, and the detection result of the target detector includes the confidence of the target.

[0078] For example, the smaller the function value of the loss function, the more likely it is that the sample image x to which the first image τ is pasted, i.e., the training image The greater the probability of the detection result being wrong when input to the target detector, the higher the image smoothness of the first image τ. The function value of reducing the loss function can be used as the goal, and the pixel value of the first image τ can be iteratively adjusted until the optimization is completed to obtain the optimized second image.

[0079] Therefore, during the entire training process, the loss function L can be minimized. obj +αTV(τ) optimizes the first image τ to obtain the optimized second image. The overall optimization goal can be expressed as:

[0080]

[0081] In formula (1), the loss function can be expressed by the detection result function L of the target detector: obj , and the weighted sum of the function TV(τ) of image smoothness, α is a preset weighting coefficient, which can be set according to experience, and the present disclosure does not limit the specific value of α.

[0082] In formula (1), the function L of the detection result of the target detector is obj , which can be expressed as:

[0083]

[0084] Among them, function f represents the maximum value of the confidence of the target output by the target detector when the training image M(x,Crop(τ)) is input into the target detector. obj The smaller the value of , the smaller the maximum value of the target existence confidence output by the target detector, and the lower the accuracy of the target detector in detecting the target.

[0085] It should be understood that in formula (2), function f only takes the target existence confidence of the target detector as an example, and may also include one or more of the target existence confidence, the confidence of a specific category, and the predicted detection box coordinates. The present disclosure does not limit the specific form of function f.

[0086] In formula (1), the function TV(τ) of the image smoothness of the first image τ can be expressed as:

[0087] TV(τ)=∑ i,j |τ i,j -τ i+1,j |+|τ i,j -τ i,j+1 | (3)

[0088] Among them, τi,j Represents the pixel value at coordinate (i, j) in the first image τ. The function TV(τ) calculates the relationship between each pixel τi,j in the first image τ and the two surrounding pixels τ i+1,j , τ i,j+1 The calculation method of adding the absolute values ​​of the differences is used to describe the smoothness of the image. TV(τ) can measure the continuity of the image pixels by the total difference between adjacent pixels in the image. The smaller the value of TV(τ), the more similar each pixel is to the two surrounding pixels, and the smoother the image.

[0089] It should be understood that the function representing the smoothness of an image is a function used to measure the degree of mutation or noise in an image, and can be a function for determining the similarity of two or more pixels in adjacent or close pixels. The present disclosure does not limit the specific function type that can represent the smoothness of an image. Introducing the image smoothness function term in the loss function can make the optimized second image relatively smooth and continuous.

[0090] In this way, the optimized second image can be obtained by minimizing the loss function. During the optimization process, each local image Crop(τ) after sampling the second image is optimized separately, so that each small part of the second image can have a stealth effect on the target detector, thereby improving the versatility of the second image. The second image can effectively test the security of the target detector.

[0091] Therefore, by Figure 2 The security testing method of the target detector based on random sampling is shown, which optimizes the first image of a preset size by randomly sampling a small image (first sub-image) so that every small part of the optimized second image has a stealth effect.

[0092] However, the size of the second image obtained by the security testing method of the target detector based on random sampling is the same as the size of the preset first image, and a scalable image cannot be generated. The versatility of this method needs to be improved. Moreover, this method randomly samples multiple times at each location in the first image, which is not efficient enough and leads to poor results.

[0093] In view of this, Figure 3 A schematic diagram showing a method for testing the safety of a target detector based on ring-cut sampling according to an embodiment of the present disclosure is shown as follows: Figure 3 As shown, the first image τ may be a third image τ local The image formed by the periodic arrangement is obtained by local ) Ring cutting sampling small image (i.e. the first sub-image ) is optimized so that the optimized second image is not only a periodically expandable image, but also every small part in the image has a stealth effect.

[0094] In a possible implementation, in step S1, when the first image is represented as a periodically arranged third image, step S1 includes: performing a ring cutting method sampling on the third image to obtain a sampled first sub-image.

[0095] For example, the third image τ of a first preset size (eg, 300 pixels×300 pixels) may be local , to represent the periodic repetition pattern in the periodic arrangement texture pattern τ (i.e., the first image), such as Figure 3 As shown, the first image τ includes four periodically arranged third images τ local .

[0096] The first image τ may include a plurality of periodically arranged third images, and the present disclosure does not limit the preset size of the third image or the number of third images included in the first image.

[0097] In each round of training, the ring cutting method can be used to local The first sub-image of the second preset size (e.g., 150 pixels×150 pixels) is uniformly and randomly cut For training, it can be expressed as The present disclosure does not limit the size of the second preset size.

[0098] In this way, when the first image is composed of periodic image units (i.e., the third image), the sampling of the first image can be achieved by circularly cutting and sampling the periodic image units, thereby improving the sampling efficiency. In addition, since the first image is composed of periodic image units, the second image obtained by optimizing the first image can also be periodically expandable.

[0099] Figure 4 A schematic diagram of the ring cutting sampling method according to an embodiment of the present disclosure is shown in FIG. Figure 4 As shown, the third image is sampled by the circular cutting method to obtain the sampled first sub-image, including: connecting the upper and lower sides and the left and right sides of the third image to form a three-dimensional circular ring chart; sampling the plane expansion image of the three-dimensional circular ring chart to obtain the sampled first sub-image.

[0100] For example, if Figure 4 As shown, the square on the left represents the third image τ local , the third image τ local The upper and lower sides are connected ( Figure 4 The edge in the direction of the horizontal arrow) is obtained as a hollow cylinder ( Figure 4 The hollow cylinder in the middle); then, connect the left and right sides of the cylinder (i.e. Figure 4 The edge of the vertical arrow in the left square in the middle) to obtain a three-dimensional ring ( Figure 4 right circle).

[0101] Crop torus The third image τ local It is regarded as a three-dimensional torus surface, and then random sampling is performed on the randomly unfolded three-dimensional torus surface, which is equivalent to random sampling on the three-dimensional torus surface.

[0102] Since the surface of the ring has no edge, this sampling method is not limited by the edge of the square pattern. And since the first image τ is derived from the third image τ local Closely arranged, in the third image τ local The random cutting sampling in a circular cutting manner is equivalent to the random cutting sampling on the first image τ.

[0103] In this way, the ring-cut sampling of the third image can replace the random sampling of the first image, thereby improving the sampling efficiency.

[0104] In step S2, refer to the above Figure 2 The security testing method of the target detector based on random sampling shown in the figure takes the first sub-image Paste it into the labeled area of ​​each sample image x in the training set to obtain the pasted training image I will not go into details here.

[0105] In step S3, according to the target detector and the training image The first image τ is optimized to obtain an optimized second image for performing a security test on the target detector.

[0106] In a possible implementation manner, when the first image is represented as a periodically arranged third image, step S3 includes:

[0107] In step S31, the third image is optimized according to the target detector and the training image to obtain a fourth image;

[0108] In step S32, the fourth image is subjected to periodic stitching processing to obtain an optimized second image.

[0109] For example, in step S31, reference may be made to the above description as follows: Figure 2 The security testing method of the target detector based on random sampling shown in the figure is based on a preset loss function, and the third image τ localOptimize to obtain an optimized fourth image; wherein the loss function includes a function representing the detection result of the target detector and a function representing the third image τ local As a function of the image smoothness, the detection result of the target detector includes the confidence of the target.

[0110] The smaller the value of the loss function, the more the third image τ will be pasted. local Sample image x, also known as training image The greater the probability of the detection result being wrong, the greater the third image τ local The smoother the image is, the lower the loss function value can be taken as the goal, and the third image τ local The pixel values ​​are adjusted until the optimization is completed to obtain the optimized fourth image.

[0111] Therefore, during the entire training process, the loss function L can be minimized. obj +αTV(τ local ) for the third image τ local Optimize and obtain the optimized fourth image. The overall optimization goal can be expressed as:

[0112]

[0113] In formula (4), the loss function can be expressed by the detection result function L of the target detector: obj , and the image smoothness function TV(τ local ), α is a preset weighting coefficient, which can be set according to experience, and the present disclosure does not limit the specific value of α.

[0114] In formula (4), the function L of the detection result of the target detector is obj , which can be expressed as:

[0115]

[0116] Among them, the function f represents the training image M(x,Crop torus (τ local )) Input the target detector, and the target detector outputs the maximum value of the target existence confidence. L obj The smaller the value of , the smaller the maximum value of the target existence confidence output by the target detector, and the lower the accuracy of the target detector in detecting the target.

[0117] It should be understood that in formula (5), function f only takes the target existence confidence of the target detector as an example, and may also include one or more of the target existence confidence, the confidence of a specific category, and the predicted detection box coordinates. The present disclosure does not limit the specific form of function f.

[0118] In formula (4), the third image τ local The function of the image smoothness TV(τ local ), which can be expressed as:

[0119]

[0120] in, Represents the third image τ local The pixel value at the coordinate (i, j) in the middle, the function TV(τ local ) by calculating the third image τ local Each pixel The two surrounding pixels The calculation method of adding the absolute values ​​of the differences is used to describe the smoothness of the image. TV(τ local ) is smaller, each pixel is more similar to the two surrounding pixels, and the image is smoother.

[0121] It should be understood that the function representing the smoothness of an image is a function used to measure the degree of mutation or noise in an image, and can be a function for determining the similarity of two or more pixels in adjacent or close pixels. The present disclosure does not limit the specific function that can represent the smoothness of an image. Introducing the image smoothness function term in the loss function can make the fourth image obtained by optimization relatively smooth and continuous.

[0122] It should be understood that the formulas (4) to (6) in the above-mentioned safety test method of the target detector based on annular cutting sampling are essentially the same as the formulas (1) to (3) in the safety test method of the target detector based on random sampling, except that the optimization objects of the two are different. The optimization objects of formulas (1) to (3) are the first image τ, and the optimization objects of formulas (4) to (6) are the third image τ. local . In the first image τ, it is represented as the third image τ arranged periodically local In the case of the third image τ local The optimization of is equivalent to the optimization of the first image τ.

[0123] In this way, the optimized fourth image can be obtained by minimizing the loss function.

[0124] In step S32, the fourth image obtained in step S32 is periodically spliced ​​(ie, the fourth images are tiled one by one) to obtain an optimized second image, such as Figure 5 A schematic diagram of an optimized second image according to an embodiment of the present disclosure is shown.

[0125] The second image can be obtained by directly periodically splicing the fourth image. Since the number of splicing is not limited, the size of the second image can also be arbitrary.

[0126] Through this method, any single small block on the optimized second image has a stealth effect, and the effect is local and continuous. Therefore, the second image has better versatility. For example, when the target of the target detector is a pedestrian, there is no need to print patterns at specific positions on the clothing, nor is there any need to optimize for different clothing. It can generate periodic stealth patterns based on the safety test method of the target detector based on annular cutting sampling. As a result, different clothing containing or covered with stealth patterns can be invisible to the target detector at various angles, and the safety and reliability of the target detector can be tested based on the stealth effect, which is beneficial for the developers of the target detector to improve the target detector and improve the safety of the target detector.

[0127] In practical applications, for example, for the safety test of pedestrian detectors, the invisible texture pattern (i.e., the fourth image) can be directly printed on the fabric, and the clothes made of these fabrics have the effect of avoiding pedestrian detectors at all angles. Then, the pedestrian detector can be tested for safety based on this invisible property. If the pedestrian detector can detect pedestrians wearing invisible fabrics, it means that the safety of the pedestrian detector is relatively good; if the pedestrian detector cannot detect pedestrians wearing invisible fabrics, it means that the safety of the pedestrian detector needs to be improved.

[0128] It can be seen that the stronger the stealth effect of the second image is, the more effective the safety of the pedestrian detector can be tested. Figure 6 A schematic diagram showing a security test of the optimized second image according to an embodiment of the present disclosure is shown as follows: Figure 6 As shown, different camera angles for pedestrian detectors, including the case where part of the stealth cloth is blocked ( Figure 6 Left picture), the pedestrian detector did not detect the pedestrian wearing invisible cloth, and the security of the detector needs to be further strengthened.

[0129] Therefore, in the disclosed embodiment, the first image to be optimized is sampled to obtain a sampled first sub-image, and the first sub-image is pasted into the annotated areas of each sample image in the training set to obtain a pasted training image. Then, the first image can be optimized according to the target detector and the training image to obtain an optimized second image. The second image can effectively detect the safety and reliability of the target detector, and remind users to pay attention to the risks of using the target detector.

[0130] In addition, the present disclosure also proposes two detection methods, which can generate a stealth pattern of a preset size based on a security test method of a target detector using random sampling, or generate a periodic stealth pattern based on a security test method of a target detector using ring cutting sampling.

[0131] Among them, the safety test method of the target detector based on circular cutting sampling has better versatility. For example, when the target of the target detector is a pedestrian, there is no need to print patterns at specific locations on the clothing, nor is there any need to optimize for different clothing. As a result, different clothing containing or covered with stealth patterns can be invisible to the target detector at all angles, and the safety and reliability of the target detector can be tested based on the stealth effect, which is conducive to the developers of the target detector to improve the target detector and improve the safety of the target detector.

[0132] It can be understood that the above-mentioned various method embodiments mentioned in the present disclosure can be combined with each other to form a combined embodiment without violating the principle logic. Due to space limitations, the present disclosure will not repeat them. It can be understood by those skilled in the art that in the above-mentioned method of the specific implementation method, the specific execution order of each step should be determined according to its function and possible internal logic.

[0133] In addition, the present disclosure also provides a safety testing device, an electronic device, a computer-readable storage medium, and a program for a target detector, all of which can be used to implement any safety testing method for a target detector provided by the present disclosure. The corresponding technical solutions and descriptions are referred to the corresponding records in the method section and will not be repeated here.

[0134] Figure 7 A block diagram of a safety testing device for an object detector according to an embodiment of the present disclosure is shown. Figure 7 As shown, the device comprises:

[0135] A sampling module 71, configured to perform sampling processing on the first image to be optimized to obtain a sampled first sub-image;

[0136] A pasting module 72, configured to paste the first sub-image into the annotated area of ​​each sample image in the training set to obtain a pasted training image, wherein the sample image includes an annotated area of ​​one or more targets;

[0137] The optimization module 73 is used to optimize the first image according to the target detector and the training image to obtain an optimized second image, and the second image is used to perform a security test on the target detector.

[0138] In a possible implementation, when the first image is represented as a periodically arranged third image, the sampling module 71 includes: a circular cutting sampling submodule, configured to perform circular cutting sampling on the third image to obtain a sampled first subimage.

[0139] In a possible implementation, the annular cutting sampling submodule is used to: connect the upper and lower sides and the left and right sides of the third image to form a three-dimensional circular ring chart; sample the plane expansion image of the three-dimensional circular ring chart to obtain the sampled first sub-image.

[0140] In a possible implementation, when the first image is represented as a periodically arranged third image, the optimization module 73 is used to: optimize the third image according to the target detector and the training image to obtain a fourth image; and perform periodic splicing processing on the fourth image to obtain an optimized second image.

[0141] In one possible implementation, the optimization module 73 is used to: optimize the first image based on a preset loss function to obtain an optimized second image; wherein the loss function includes a function representing the detection result of the target detector and a function representing the image smoothness of the first image, and the detection result of the target detector includes the confidence of the target.

[0142] In a possible implementation, the optimization module 73 is used to adjust the value of each pixel in the first image by optimization to obtain the second image, so that after the training image is input into the target detector, the detection result obtained is degraded.

[0143] In one possible implementation, the pasting module 72 is used to: transform the first sub-image to obtain a second sub-image that matches the annotated area of ​​the target in the sample image; and paste the second sub-image into the annotated area of ​​the sample image to obtain a pasted training image.

[0144] In some embodiments, the security testing device of the target detector provided by the embodiments of the present disclosure has functions or includes modules that can be used to execute the method described in the above method embodiments. Its specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0145] The embodiment of the present disclosure also provides a computer-readable storage medium, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the above method is implemented. The computer-readable storage medium may be a non-volatile computer-readable storage medium.

[0146] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to call the instructions stored in the memory to execute the above method.

[0147] The electronic device may be provided as a terminal, a server, or a device in other forms.

[0148] Figure 8 A block diagram of an electronic device 800 according to an embodiment of the present disclosure is shown. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, or the like.

[0149] Reference Figure 8 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0150] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0151] The memory 804 is configured to store various types of data to support operations on the electronic device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, pictures, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0152] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0153] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the electronic device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0154] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0155] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0156] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the electronic device 800, the relative positioning of the components, such as the display and keypad of the electronic device 800, and the sensor assembly 814 can also detect the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of contact between the user and the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a complementary metal oxide semiconductor (CMOS) or a charge coupled device (CCD) image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0157] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as a wireless network (WiFi), a second generation mobile communication technology (2G), a third generation mobile communication technology (3G), a fourth generation mobile communication technology (4G) or a fifth generation mobile communication technology (5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0158] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0159] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 804 including computer program instructions, which can be executed by a processor 820 of an electronic device 800 to perform the above method.

[0160] Fig. 9 1 is a block diagram of an electronic device 1900 according to an embodiment of the present disclosure. For example, the electronic device 1900 may be provided as a server. Fig. 9 , the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0161] The electronic device 1900 may further include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output (I / O) interface 1958. The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Microsoft's server operating system (Windows ServerTM), Apple's graphical user interface-based operating system (Mac OSXTM), a multi-user multi-process computer operating system (UnixTM), a free and open source Unix-like operating system (LinuxTM), an open source Unix-like operating system (FreeBSDTM), or the like.

[0162] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0163] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0164] Computer readable storage medium can be a tangible device that can hold and store instructions used by an instruction execution device. Computer readable storage medium can be, for example, (but not limited to) an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, for example, a punch card or a convex structure in a groove on which instructions are stored, and any suitable combination thereof. The computer readable storage medium used here is not interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (for example, a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0165] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0166] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0167] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0168] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0169] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0170] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0171] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK) and the like.

[0172] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for testing the safety of a target detector, characterized in that: The method comprises: Sampling the first image to be optimized to obtain a sampled first sub-image; Pasting the first sub-image into the annotated area of ​​each sample image in the training set to obtain a pasted training image, wherein the sample image includes an annotated area of ​​one or more targets; According to the target detector and the training image, the first image is optimized to obtain an optimized second image, wherein the second image is used to perform a security test on the target detector; The step of pasting the first sub-image into the annotated area of ​​each sample image in the training set to obtain a pasted training image includes: Performing transformation processing on the first sub-image to obtain a second sub-image that matches the marked area of ​​the target in the sample image; Pasting the second sub-image into the marked area of ​​the sample image to obtain a pasted training image; Optimizing the first image according to the target detector and the training image to obtain an optimized second image includes: Based on a preset loss function, optimizing the first image to obtain an optimized second image; wherein the loss function includes a function representing a detection result of the target detector and a function representing image smoothness of the first image, and the detection result of the target detector includes a confidence level of the target; Optimizing the first image according to the target detector and the training image to obtain an optimized second image includes: The second image is obtained by adjusting the value of each pixel in the first image through optimization, so that after the training image is input into the target detector, the detection result obtained is degraded.

2. The method according to claim 1, characterized in that When the first image is represented as a periodically arranged third image, The step of performing sampling processing on the first image to be optimized to obtain a sampled first sub-image includes: The third image is sampled using a ring cutting method to obtain a sampled first sub-image.

3. The method according to claim 2, characterized in that The third image is sampled using a ring cutting method to obtain a sampled first sub-image, including: Connecting the upper and lower sides and the left and right sides of the third image to form a three-dimensional doughnut diagram; The plane expansion image of the three-dimensional circular graph is sampled to obtain a sampled first sub-image.

4. The method according to claim 1, characterized in that: When the first image is represented as a periodically arranged third image, Optimizing the first image according to the target detector and the training image to obtain an optimized second image includes: Optimizing the third image according to the target detector and the training image to obtain a fourth image; The fourth image is subjected to periodic splicing processing to obtain an optimized second image.

5. A safety test device for a target detector, characterized in that: include: A sampling module, used for performing sampling processing on the first image to be optimized to obtain a sampled first sub-image; A pasting module, used for pasting the first sub-image into the annotated area of ​​each sample image in the training set to obtain a pasted training image, wherein the sample image includes an annotated area of ​​one or more targets; an optimization module, configured to optimize the first image according to the target detector and the training image to obtain an optimized second image, wherein the second image is used to perform a security test on the target detector; The pasting module is used to: transform the first sub-image to obtain a second sub-image that matches the annotated area of ​​the target in the sample image; paste the second sub-image into the annotated area of ​​the sample image to obtain a pasted training image; The optimization module is used to optimize the first image based on a preset loss function to obtain an optimized second image; wherein the loss function includes a function representing a detection result of the target detector and a function representing image smoothness of the first image, and the detection result of the target detector includes a confidence level of the target; The optimization module is used to adjust the value of each pixel in the first image by optimization to obtain the second image, so that after the training image is input into the target detector, the detection result obtained is degraded.

6. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 4.

7. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images