Reasonable adversarial patch generation method

Abstract

The present invention relates to a method for generating a reasonable adversarial patch, comprising: a. selecting a reasonable image, extracting contour features to randomly initialize an adversarial patch; b. "pasting" the adversarial patch onto the original sample to generate an adversarial sample; c. using the adversarial sample to perform a patch attack on a target detection model, and updating the adversarial patch without a reasonable constraint; d. using the adversarial patch obtained in step c as an initial patch, and using the image as a reasonable constraint condition to attack the target detection model, and generating a reasonable adversarial patch; e. adjusting the weight parameter of the reasonable constraint condition, respectively evaluating the reasonableness and aggressiveness of the reasonable adversarial patch according to a reasonableness index and an AP value, and selecting a reasonable adversarial patch with the best reasonableness and aggressiveness. The reasonable adversarial patch generated by the present invention takes into account both adversarial and reasonableness, and can evade the target detection model and the human eye at the same time.

Description

Technical Field

[0001] The present invention relates to the field of deep learning security technology, and in particular to a method for generating a rational adversarial patch. Background Art

[0002] Deep learning models have achieved impressive results in many challenging tasks, but they are very vulnerable to adversarial attacks. Adversarial attacks add perturbations that are imperceptible to the human eye to the image, causing the deep learning model to output incorrect results. Existing research works generally focus on adversarial attacks in the digital domain, such as l2 or l ∞ The attack generates a full-image perturbation and injects it into the input image. The l0 attack modifies some pixels after searching the full image. Although these attacks can deceive the human eye, they are difficult to transfer to the physical world. This is because these attacks lack simulation of the physical environment, such as lighting, angle, noise, etc., and it is difficult to modify the entire image.

[0003] In order to solve the above problems, how to construct physical attacks in the real world has received attention. Among them, patch attack is one of the commonly used means, which is representative of changing the visible features on some targets, such as eyes, masks, hats and T-shirts. Although previous work has revealed the vulnerability of deep neural network models to adversarial patches in the real world, most of them have not fully considered semantics or rationality issues, and the generated patches are not natural and can be easily detected by people. For example, the prior art CN111898731A discloses a bias-based universal adversarial patch generation method and device, which uses the perceptual bias and semantic bias of a deep neural network model to generate a more aggressive universal adversarial patch, thereby improving the versatility of adversarial samples. In addition, Chinese patent CN111626925A discloses a method and device for generating adversarial patches, which improves the robustness of patches by changing different backgrounds. It involves the robustness of patches, but does not involve the rationality of patches.

[0004] Although there are some studies on the rationality of adversarial patches, the work is mainly focused on image classification tasks, and each input image needs to correspond to a specific adversarial patch. Obviously, this does not meet the needs of practical applications. There are also some studies on adversarial patches, which are only applicable to face recognition models and cannot be applied to more complex object detection tasks, such as human detection models.

[0005] In summary, there are relatively few studies on the rationality of patch attacks, and most of them do not take into account the more complex target detection tasks and the actual needs of applications, making it difficult to meet the application requirements of deep learning security. Summary of the invention

[0006] In order to solve the problems existing in the above-mentioned prior art, an object of the present invention is to provide a reasonable adversarial patch generation method that can evade both the target detection model and the human eye.

[0007] In order to achieve the above-mentioned object of the invention, the technical solution of the present invention is:

[0008] The present invention provides a method for generating a rationality adversarial patch, comprising:

[0009] a. Select reasonable images and extract contour features to randomly initialize adversarial patches;

[0010] b. Paste the adversarial patch onto the original sample to generate an adversarial sample.

[0011] c. Using the adversarial sample to perform a patch attack on the target detection model, and updating the adversarial patch without rationality constraints;

[0012] d. Using the adversarial patch obtained in step (c) as the initial patch and the image as a reasonable constraint condition to attack the target detection model and generate a reasonable adversarial patch;

[0013] e. Adjust the weight parameter of the rationality constraint condition, evaluate the rationality and aggressiveness of the rationality adversarial patch according to the rationality index and AP value, and select the rationality adversarial patch with the best rationality and aggressiveness.

[0014] According to one aspect of the present invention, the image in step (a) is a cartoon image, and the contour features of the cartoon image are extracted using an edge detection operator. The adversarial patch randomly generated after contour hiding is:

[0015] M(p)=p-Grad(p,θ)-Bg(p)

[0016] Among them, p represents the cartoon image to be optimized, Grad(p,θ) represents the gradient map of the cartoon image p under the threshold θ, and Bg(p) represents the background outside the outline of the cartoon image p.

[0017] According to one aspect of the present invention, step (b) includes: adding the adversarial patch to the original sample, scaling the adversarial patch at the same ratio according to the scaling ratio of the input sample by the target detection model, and covering the adversarial patch in the label box of the original sample.

[0018] According to one aspect of the present invention, the step (b) further comprises: transforming the adversarial patch before the adversarial patch is covered in the label frame of the original sample.

[0019] According to one aspect of the present invention, the transformation includes contrast transformation, brightness transformation, random noise transformation, angle transformation and position transformation, wherein the random noise factor is 0.1,

[0020] The contrast ratio ranges from 0.8 to 1.2.

[0021] The brightness range is -0.1 to 0.1.

[0022] The angle range is -20°~20°.

[0023] The center of the adversarial patch is located near the center of the label box.

[0024] According to one aspect of the present invention, the objective function used by the patch attack in step (c) is:

[0025]

[0026] in, represents the sample distribution, represents the simulation of the impact of the distribution of adversarial patch transformations on the physical world, M is the hiding function for fixed pixels, x represents the original sample, y represents the label, target category and position corresponding to the sample, and t represents the transformation of the adversarial patch.

[0027] According to one aspect of the present invention, the loss function for updating the adversarial patch in step (c) without rationality constraints includes L npt Item and L obj Item, among which L npt The term represents the degree to which the color of the adversarial patch is achieved by a normal printer, L obj The purpose of the term is to reduce the effective prediction box containing the detected target and improve the attack capability of the adversarial patch.

[0028] According to one aspect of the present invention, the step (d) further comprises a rationality constraint item, wherein the rationality constraint item is:

[0029]

[0030] Where M(p) is the hidden adversarial patch, c is the cartoon image, is the Euclidean distance loss function, L rat Limits the similarity of color features.

[0031] According to one aspect of the present invention, the loss function used in the rationality constraint condition in step (d) is:

[0032] L=αL rat +βL npt +L obj

[0033] Among them, α and β are weight parameters.

[0034] According to one aspect of the present invention, the rationality index of step (e) comprises edge features, color features and texture features.

[0035] The edge feature is measured by the average gradient strength:

[0036]

[0037] Where g represents the gradient map of the cartoon image, the threshold θ is used to filter out the blurred edge contour, H() represents a piecewise linear function, defined as H(t) = {0, ift≤0; 1ift>0}, which is used to calculate the number of pixels exceeding the threshold θ;

[0038] The color characteristics are measured by the average saturation intensity:

[0039]

[0040] Among them, S represents the saturation value;

[0041] The texture feature is measured by the average directional energy:

[0042]

[0043] in, is the grayscale co-occurrence matrix energy in the k direction. ADE is an indicator to measure the stability of grayscale changes in the adversarial patch texture, reflecting the uniformity of the grayscale distribution of the adversarial patch and the roughness of the texture.

[0044] Beneficial effects:

[0045] According to the solution of the present invention, the adversarial patch is first initialized according to the contour features of the cartoon image, and then the target detection model is attacked in two stages. The first stage is a constraint without rationality, and after multiple iterations of optimization, a universal adversarial patch is obtained. In the second stage, based on the universal adversarial patch, the target detection model is attacked with rationality constraints. By constraining the semantic information of the adversarial patch, the adversarial patch is made similar to the clothing decoration pattern familiar to people, such as cartoon images, so that the adversarial patch takes into account both adversarial and rationality, and can evade the target detection model and the human eye at the same time.

[0046] According to a solution of the present invention, by adjusting the weight parameters of the rationality constraint, using the rationality index and detecting the change trend of the AP value, the rationality of the adversarial patch is evaluated, and then the adversarial patch with the best rationality is selected. In the process of training the target detection model, by adjusting the selection of the initial patch and the pasting method, the rationality level is greatly improved under the condition that the attack capability of the adversarial patch remains basically unchanged. The rational adversarial patch generated by the present invention is suitable for various target detection methods, can complete the attack task under the supervised target detection system, has a good effect in both the digital domain and the physical world, and can adapt to the changes of various scenes in the physical world. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A flowchart schematically showing a method for generating a reasonableness adversarial patch according to an embodiment of the present invention;

[0048] Figure 2 A schematic diagram schematically showing an adversarial sample for constructing a patch attack in a reasonable adversarial patch generation method according to an embodiment of the present invention;

[0049] Figure 3 A schematic diagram schematically showing a comparison of the rationality of a reasonable adversarial patch generated by a reasonable adversarial patch generation method according to an embodiment of the present invention with a general adversarial patch, and verifying the comparison by combining color features, edge features and texture features;

[0050] Figure 4 A schematic diagram schematically illustrates a comparison of attack performance and rationality index of a rationality adversarial patch generated by a rationality adversarial patch generation method according to an embodiment of the present invention under different rationality weight parameters α. DETAILED DESCRIPTION

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0052] The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments. The embodiments cannot be described one by one here, but the embodiments of the present invention are not therefore limited to the following embodiments.

[0053] The inventive concept of the reasonable adversarial patch generation method of the present embodiment is to first initialize the adversarial patch according to the contour features of the cartoon image, and then perform a two-stage attack on the target detection model. Among them, the first stage is a constraint without reasonableness, and after multiple iterative optimizations, a universal adversarial patch is obtained. In the second stage, based on the universal adversarial patch, an attack containing reasonableness constraints is performed on the target detection model. By adjusting the weight parameters of the reasonableness constraints, an adversarial patch that takes into account both adversity and reasonableness is obtained through multiple iterative updates. Finally, the reasonableness index and AP value are used to evaluate the reasonableness and aggressiveness of the adversarial patch, respectively, and the reasonableness adversarial patch with the best reasonableness and aggressiveness is selected.

[0054] The purpose of generating reasonable adversarial patches in this embodiment is to evade both the target detection model and the human eye. The target detection model can be the YOLO series or the RCNN series, etc. In this embodiment, YOLOv2 is selected. The training data set for attack training and iterative optimization of the target detection model can be selected according to the purpose of the target detection model itself. In this embodiment, the commonly used target detection data set 2007+2012 Pascal VOC is selected, which contains 20 categories in total. This embodiment uses the human body detection model as the target detection model for attack, combined with Figure 1 The entire process details each step of the rationality adversarial patch generation method of this embodiment.

[0055] See also Figure 1 , the reasonable adversarial patch generation method of this embodiment first selects the contour range of the cartoon image for random initialization, and randomly initializes the adversarial patch according to the contour features of the cartoon image. Among them, the contour features are extracted using the edge detection operator, and the adversarial patch randomly initialized after contour hiding M() is:

[0056] M(p)=p-Grad(p,θ)-Bg(p)

[0057] Where p represents the cartoon image to be optimized, Grad(p,θ) represents the gradient map of the cartoon image p under the threshold θ, and Bg(p) represents the background outside the outline of the cartoon image p. Figure 2 , Figure 2 The middle image shows the adversarial patch after hiding and random initialization.

[0058] After randomly initializing the adversarial sample, see Figure 2, the adversarial patch is "pasted" in the label box of the original sample to generate an adversarial sample. It should be noted that the original sample here is the data of the above-mentioned dataset 2007+2012Pascal VOC, and the adversarial patch is pasted in the label box of the original sample to construct a new dataset. The original sample refers to the Inria dataset. The dataset 2007+2012Pascal VOC is a general target detection dataset, which contains 20 categories and is suitable for training target detectors. Therefore, the attacked target detector is trained on this dataset. The Inria dataset is a pedestrian dataset, and patches are generated on this basis. The "paste" here refers to scaling and transforming the adversarial patch, and then pasting the adversarial patch on the original sample, covering it within a fixed range of the original sample. Considering the transformation of the target detection model on the input data or input sample, the adversarial patch is first added to the original sample. According to the scaling ratio of the target detector on the input sample, the adversarial patch needs to be scaled to the same ratio, and the adversarial patch is covered in the label box of the original sample. In order to simulate the environmental factors of the real physical world, different transformations are performed on the adversarial patch before it is covered in the label frame of the original sample during the "pasting" process. Specifically, the above transformations include contrast, brightness, random noise, size (or size), angle (or rotation) and position transformations. Among them, the contrast ranges from 0.8 to 1.2, the brightness ranges from -0.1 to 0.1, the random noise factor is 0.1, the angle ranges from -20° to 20°, and the center of the adversarial patch is located near the center of the prediction frame where the target is located, and the size is in a fixed proportional relationship with the prediction frame. The target here refers to the category of attack. For example, if the attack is on the category of people, then the patch needs to be placed in the prediction frame of the target person. This embodiment does not specifically limit this proportional relationship, as long as the patch can be completely printed on the clothes. In the specific calculation, the selected parameters are randomly sampled in the uniform distribution of the above parameter range.

[0059] The generation of reasonable adversarial patches in this embodiment requires a two-stage iterative update process. The first stage is a patch attack without reasonable constraints. Specifically, the above-mentioned adversarial samples are used to perform a patch attack on the human body detection model, and the adversarial patches are iteratively updated without reasonable constraints to generate a universal adversarial patch, so that the human body detection model cannot successfully identify the human body. In this embodiment, the objective function used in the patch attack is:

[0060]

[0061] in, represents the sample distribution, Represents the simulation of the distribution of adversarial patch transformations on various effects in the physical world. M is a hiding function used to fix some suitable pixels. x represents the original sample, y represents the label, target category and position corresponding to the sample, and t represents the transformation of the adversarial patch.

[0062] The second stage is a patch attack that includes rationality. The universal adversarial patch obtained in the first stage is used as the initial value, and the selected cartoon image is used as the rationality constraint condition to attack the human detection model again. After multiple iterations, a rational adversarial patch is generated, which evades the target detection model and the human eye. In order to reflect the effect of human detection attack, this implementation selects the pedestrian dataset Inria as the data of the original sample, see Figure 2 The first picture on the left.

[0063] In the patch attack process without rationality constraints, the main loss functions considered when updating the adversarial patch include L npt Item and L obj Item. Among them, L npt The term represents the extent to which the color of the adversarial patch can be achieved by a normal printer, L obj The purpose of the item is to reduce the effective prediction box containing people and improve the attack ability of the patch. In this embodiment, by iteratively updating the adversarial patch for multiple times, a universal adversarial patch can be obtained, that is, the universal adversarial patch is "pasted" into any image in the Inria dataset, which has a better attack effect.

[0064] In the patch attack process with rationality constraints, in addition to the above loss function terms, rationality constraints need to be added, namely:

[0065]

[0066] Where M(p) is the hidden adversarial patch, c is the cartoon image, is the Euclidean distance loss function. L rat The similarity of color features is restricted. Through this constraint, the features of the adversarial patch can be made as similar as possible to the selected cartoon image, making it more reasonable. In this section, the loss function used for the reasonableness constraint is:

[0067] L=αL rat +βL npt +L obj

[0068] Among them, α and β are weight parameters. The weights of different optimization items can be controlled by adjusting the parameters α and β.

[0069] In order to measure the rationality of the adversarial patch, the rationality index is defined from three aspects: edge feature, color feature and texture feature. The edge feature is measured by the average gradient intensity (AGI):

[0070]

[0071] Where g represents the gradient map of the cartoon image, the threshold θ is used to filter out the blurred edge contours, and H() represents a piecewise linear function, defined as H(t) = {0, ift≤0; 1ift>0}, which is used to calculate the number of pixels exceeding the θ threshold. The color feature is measured by the average saturation intensity (ASI):

[0072]

[0073] Where S represents the saturation value. The texture feature is measured by the average directional energy (ADE):

[0074]

[0075] in, is the energy of the Gray-level Co-occurrence Matrix (GLCM) in the k direction. ADE is an indicator to measure the stability of the grayscale change of the adversarial patch texture, reflecting the uniformity of the grayscale distribution and the roughness of the texture. Figure 3 ,Compared with general adversarial patches, the rationality adversarial patches generated by this ,implementation are less easily recognized by humans.

[0076] In order to measure the attack capability of the adversarial patch, this implementation adopts AP value for measurement. AP value is a widely used model evaluation index in target detection models. It is the area under the PR curve and can be understood as the average value of all accuracies under different recall values. For target detection models, the closer the AP value is to 1, the better the performance of the model and the stronger the detection capability. Figure 4 , under different rationality weight parameters α, the aggressiveness and rationality of the rationality adversarial patch generated by the method of this embodiment are contradictory. This embodiment can selectively select the adversarial patch with the best aggressiveness and rationality.

[0077] The above is only one embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A reasonable adversarial patch generation method, comprising: a. Select reasonable images and extract contour features to randomly initialize adversarial patches; b. Paste the adversarial patch onto the original sample to generate an adversarial sample. c. Using the adversarial sample to perform a patch attack on the target detection model, and updating the adversarial patch without rationality constraints; d. Using the adversarial patch obtained in step (c) as the initial patch and the image as a reasonable constraint condition to attack the target detection model and generate a reasonable adversarial patch; e. Adjust the weight parameter of the rationality constraint condition, evaluate the rationality and aggressiveness of the rationality adversarial patch according to the rationality index and AP value, and select the rationality adversarial patch with the best rationality and aggressiveness; The step (d) further comprises a rationality constraint item, wherein the rationality constraint item is: Where M(p) is the hidden adversarial patch, c is the cartoon image, is the Euclidean distance loss function, L rat Limits the similarity of color features; The loss function used in the rationality constraint condition in step (d) is: L=αL rat +βL npt +L obj Among them, α and β are weight parameters; The rationality index of step (e) includes edge features, color features and texture features, The edge feature is measured by the average gradient strength: Where g represents the gradient map of the cartoon image, the threshold θ is used to filter out the blurred edge contour, H() represents a piecewise linear function, defined as H(t) = {0, ift≤0; 1ift>0}, which is used to calculate the number of pixels exceeding the threshold θ; The color characteristics are measured by the average saturation intensity: Among them, S represents the saturation value; The texture feature is measured by the average directional energy: in, is the grayscale co-occurrence matrix energy in the k direction. ADE is an indicator to measure the stability of grayscale changes in the adversarial patch texture, reflecting the uniformity of the grayscale distribution of the adversarial patch and the roughness of the texture.

2. The method for generating a rationality adversarial patch according to claim 1, characterized in that: The image in step (a) is a cartoon image, and the contour features of the cartoon image are extracted using an edge detection operator. The adversarial patch randomly generated after contour hiding is: M(p)=p-Grad(p,θ)-Bg(p) Among them, p represents the cartoon image to be optimized, Grad(p,θ) represents the gradient map of the cartoon image p under the threshold θ, and Bg(p) represents the background outside the outline of the cartoon image p.

3. The method for generating a rationality adversarial patch according to claim 1, characterized in that: The step (b) includes: adding the adversarial patch to the original sample, scaling the adversarial patch according to the same scaling ratio of the input sample by the target detection model, and covering the adversarial patch in the label box of the original sample.

4. The method for generating a rationality adversarial patch according to claim 3, characterized in that: The step (b) further includes: transforming the adversarial patch before the adversarial patch is covered in the label frame of the original sample.

5. The method for generating a rationality adversarial patch according to claim 4, characterized in that: The transformation includes contrast transformation, brightness transformation, random noise transformation, angle transformation and position transformation, wherein the random noise factor is 0.

1. The contrast ratio ranges from 0.8 to 1.

2. The brightness range is -0.1 to 0.

1. The angle range is -20°~20°. The center of the adversarial patch is located near the center of the label box.

6. The method for generating a rationality adversarial patch according to claim 1, characterized in that: The objective function used by the patch attack in step (c) is: in, represents the sample distribution, represents the simulation of the impact of the distribution of adversarial patch transformations on the physical world, M is the hiding function for fixed pixels, x represents the original sample, y represents the label, target category and position corresponding to the sample, and t represents the transformation of the adversarial patch.

7. The method for generating a rationality adversarial patch according to claim 6, characterized in that: In step (c), the loss function for updating the adversarial patch without rationality constraints includes L npt Item and L obj Item, among which L npt The term represents the degree to which the color of the adversarial patch is achieved by a normal printer, L obj The purpose of the term is to reduce the effective prediction box containing the detected target and improve the attack capability of the adversarial patch.

Images