Adversarial sample generation method based on feature vector transfer of target detection model

Abstract

The present invention discloses an adversarial sample generation method based on target detection model feature vector migration, comprising the following steps: step S1, convolutional neural network feature vector migration; step S2, generation of adversarial noise, step S3, evaluation of adversarial sample attack effect. The adversarial sample of the present invention has a stronger attack effect in deep learning models such as target detection, and has better transferability under the premise of taking into account the concealment of the attack. The adversarial sample generation method of the present invention reveals the important role played by feature vectors in the adversarial mechanism of the target detection model, verifies the attack threat of the adversarial sample described in the present invention, can inspire research in the field of robust target detection algorithms, and thereby design a new defense mechanism, which is of great significance for the application of target detection models in real life.

Description

Technical Field

[0001] The present invention relates to the fields of computer vision and deep learning, and in particular to a method for generating adversarial samples based on feature vector migration of a target detection model. Background Art

[0002] With the rapid development of artificial intelligence technology, more and more deep learning models are playing a greater role in production and life. Deep learning has been widely used in many fields, such as face recognition, fingerprint unlocking, smart medical care, intelligent input method, voice assistant, etc. Although deep learning has shown strong advantages in many application scenarios, the emergence of adversarial examples has caused great obstacles and security risks to the promotion of deep learning. Adversarial examples are a special type of input that will cause the model to make wrong judgments and bring serious consequences. Taking the image classification task as an example, for a certain input image, the deep learning model can output the corresponding object category, such as: car, panda, etc.; however, the adversarial example misleads the model by adding tiny perturbations (adversarial noise, adversarial perturbation) that are indistinguishable to the human eye to the original image, so that the original "panda" image is converted into a "car" result. Adversarial sample attacks were first proposed by researchers such as Szegedy in 2013. Adversarial samples are very similar to the original images, highly concealed and difficult to detect, which is of great significance to the research of deep learning models. By analyzing the generation principles and adversarial mechanisms of adversarial samples, we can more comprehensively evaluate the robustness of existing models, better resist potential attack threats, and improve the reliability of deep learning models.

[0003] According to the knowledge and information possessed by the attacker, adversarial sample attacks can be divided into two categories: white-box attacks and black-box attacks:

[0004] (1) Black-box attack means that the attacker cannot know the details of the target's deep learning model, that is, the attacker generates corresponding adversarial samples without knowing the model;

[0005] (2) A white-box attack is when an attacker is able to obtain the target's deep learning model (including model structure, parameters, etc.) and use gradient-based methods to generate adversarial samples. Compared with black-box attacks, white-box attackers have more known information, so adversarial samples generated by white-box attacks have a higher success rate. However, due to the large differences in the structures and parameters of different deep learning models, adversarial samples generated by general white-box attacks are difficult to achieve the same attack effect on other models, which leads to the fact that white-box attacks are too limited in practical applications.

[0006] However, a large number of studies have shown that adversarial samples have transferability, that is, adversarial samples can exert certain attack capabilities on multiple deep learning models, that is, adversarial samples generated by white-box attacks can have the effect of black-box attacks to some extent. Since in practical applications, it is usually difficult for attackers to obtain deep learning models, adversarial samples with strong transferability often have stronger destructive power and research value in real scenarios.

[0007] However, the inventors of this application have found that the above technology has at least the following technical problems:

[0008] Existing white-box adversarial sample attacks face the limitation of poor transferability, especially for more complex deep learning models such as target detection, adversarial samples are difficult to show good generalization ability, which has an adverse impact on the robustness and application value of target detection models. In order to improve the attack capability of adversarial samples, attackers often take the method of increasing adversarial noise, which will cause the adversarial samples to be distorted, the concealment will be poor, and the usability of the attack will be reduced.

[0009] Object detection is a type of detection technology for image or video input, which needs to complete two major tasks at the same time, namely identifying and locating the target object in the input image. Object detection models have a wide range of usage scenarios in production and life, such as: the field of autonomous driving needs to track and locate pedestrians, vehicles, traffic signs, etc. through object detection, and in logistics systems, object detection is needed to identify cargo information, etc. Researching adversarial sample attacks on target detection models can help inspire researchers to design more robust target detection algorithms and lay the foundation for the promotion of target detection models in practical applications. Adversarial sample attacks with stronger transferability can help researchers more comprehensively evaluate the robustness of their target detection models and find appropriate solutions to defend against adversarial attack threats.

[0010] In summary, at present, adversarial samples for target detection models are difficult to show good generalization performance. How to design an adversarial sample that can balance transferability and concealment is an urgent problem to be solved. Summary of the invention

[0011] The existing adversarial sample generation methods for target detection models have the limitation of poor transferability. Adversarial samples generated by white-box attacks often have difficulty in exerting the expected attack effect on black-box models. In order to improve the transferability of adversarial sample attacks, existing technical solutions often add more adversarial noise when generating adversarial samples, which makes the adversarial samples differ greatly from the original images, and the concealment becomes poor, resulting in poor usability of adversarial attacks. In order to improve the transferability of adversarial samples while taking into account the concealment of attacks, the present invention proposes an adversarial sample generation method based on target detection model feature vector migration.

[0012] The present application provides a method for generating adversarial samples based on feature vector migration of a target detection model, which is characterized by comprising the following steps:

[0013] Step S1, convolutional neural network feature vector migration; the convolutional neural network feature vector migration includes the following steps:

[0014] S101, Extraction and fusion of convolutional neural network features; Extract feature vectors from the neck network Among them, ω is the parameter of each layer of the neck network of the target detection model, x is the input corresponding to each layer, and k is the sequence number of the neural network layer;

[0015] S102, construction of target feature vector; constructed target feature vector

[0016] Among them, θ is the detection head in the target detection model, and J is the loss function corresponding to the attacker's attack target;

[0017] S103, migration of target feature vector; extracting feature vector of target object i in image sample corresponding to real object Key area information in Calculate and extract key area information The sum of the standard deviations after , that is, the loss function:

[0018]

[0019] Step S2: generating anti-noise, wherein the step of generating anti-noise comprises:

[0020] S201, random initialization

[0021] First, all original image samples X are normalized to a value range of [-1,1];

[0022] Then, a random initialization noise Z is generated: Z~N(0,0.1; where N(0,0.1) represents a normal distribution with a mean of 0 and a standard deviation of 0.1;

[0023] Finally, generate the initial adversarial sample

[0024] S202. Calculate the gradient corresponding to the target detection model

[0025] Calculate the gradient g corresponding to the target detection model according to the target loss function L:

[0026] in, is the parameter tensor of the currently generated adversarial sample, θ target detection model;

[0027] S203, clipping gradient to obtain anti-noise

[0028] To constrain the maximum value of the gradient within the maximum perturbation threshold of a single iteration, the calculated gradient needs to be clipped. The calculation formula is as follows:

[0029] Where i represents the i-th round of gradient iteration, and γ is the maximum perturbation threshold of each gradient iteration;

[0030] S204. Update adversarial samples

[0031] The noise N generated in step S203 i Add to adversarial examples Update the adversarial sample; use the direction of the gradient as the direction of the anti-noise perturbation, so that the generated adversarial sample Moving in the direction of the attacker's goal:

[0032] S205, Adversarial Sample Regularization

[0033] The operation performed by the clip function is to ensure that each pixel The maximum L1 distance with X does not exceed ∈;

[0034] S206: Determine whether to stop iteration

[0035] The attacker makes a judgment based on the preset confidence level δ and the maximum number of iterations T. The steps are as follows:

[0036] 1) When the maximum confidence value in the detection results output by the target detection model is less than the confidence threshold, the iteration can be stopped and the attack is successful;

[0037] 2) If the number of iterations of the attack has reached the preset upper limit T, the iteration is stopped and the attack fails;

[0038] 3) Otherwise, continue to loop through steps S202 to S206;

[0039] The technical solution further defined in the present invention further includes step S3, adversarial sample attack effect evaluation, wherein the adversarial sample attack effect evaluation includes:

[0040] S301, attack success rate evaluation: the average precision mean decrease ratio ρ is used as the evaluation standard of the attack success rate, and the specific calculation formula is as follows:

[0041]

[0042] Among them, m is the average precision of the target detection model for the original image samples, is the average precision of the target detection model for adversarial samples;

[0043] S302, attack concealment assessment: using structural similarity to measure, the specific calculation formula of the structural similarity calculation is as follows:

[0044]

[0045] in, and are the mean and standard deviation of the original image sample X, μ and σ are the adversarial samples The average value and standard deviation of c1 and c2 are constants used to maintain the stability of brightness, contrast and structure. The value range of structural similarity is from 0 to 1. The larger the value, the higher the similarity of the two images, that is, the more concealed the adversarial sample is.

[0046] S303, attack transferability evaluation: the ratio of the attack success rate of the generated adversarial samples on the black box model and the white box model is used as the indicator θ to measure the attack transferability. The calculation formula is as follows:

[0047]

[0048] Among them, ρ w and ρ b are the decrease ratios of the average precision of white-box attack and black-box attack, respectively. K is the number of black-box models. θ is between 0 and 1. The closer θ is to 1, the more adversarial samples are obtained. The greater the average success rate on different black-box models, the better the attack transferability.

[0049] Preferably, in step S102, the loss function is: J = max(s i ), where s i is the detection confidence of target object i.

[0050] Preferably, the target detection model includes a backbone network, a neck network and a detection head; the backbone network is responsible for feature extraction of image samples and has a convolutional neural network with pre-trained parameters;

[0051] The neck network is responsible for the convolutional neural network of feature fusion of image samples, collecting and fusing the features extracted by the backbone network;

[0052] The detection head receives the features after the neck network fusion, and detects the target category and the corresponding detection frame position in the image sample based on the features, and outputs the detection result.

[0053] Preferably, in step 202, the target loss function L is: L=loss1+α·loss2; wherein: loss1 is the attacker's loss function for the classification task; loss2 is the attacker's loss function for the positioning task.

[0054] Preferably, in step 205, the L1 distance is the Manhattan distance or the chessboard distance, and the calculation formula is:

[0055] The present invention has at least the following technical effects or advantages:

[0056] 1. The adversarial samples of the present invention have stronger attack effects in deep learning models such as target detection, and have better transferability while taking into account the concealment of the attack.

[0057] 2. The adversarial sample generation method of the present invention reveals the important role of feature vectors in the adversarial mechanism of the target detection model, verifies the attack threat of the adversarial samples described in the present invention, and can inspire research in the field of robust target detection algorithms to design new defense mechanisms, which is of great significance for the application of target detection models in real life. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A schematic diagram of the detection results of the target detection model in an embodiment of the present invention;

[0059] Figure 2 Schematic diagram of adversarial samples in an embodiment of the present invention;

[0060] Figure 3 Flowchart of adversarial sample generation based on feature vector migration in an embodiment of the present invention. DETAILED DESCRIPTION

[0061] This embodiment proposes an adversarial sample generation method based on target detection model feature vector migration, and the adversarial sample generation method includes three types of entities: a number of image samples, a number of deep learning models and an attacker. The image samples are a number of pictures taken in real scenes, such as: portraits, animals, urban traffic, etc. This embodiment uses the target detection model as a representative of the deep learning model. The target detection model is a type of deep learning model based on image tasks, which can classify and locate the target objects on the image samples and output the detection results.

[0062] like Figure 1 As shown in the figure, the target detection model can distinguish the foreground, i.e., the target object, from the background on a given image, identify the category to which the foreground target object belongs, and select the position corresponding to each target object, i.e., the detection box, as well as the confidence of the model's judgment. The attacker uses the target detection model and image samples to generate adversarial samples.

[0063] like Figure 2 As shown in the figure, the adversarial sample is generated by adding adversarial noise to the image sample. The difference between the adversarial sample and the original image sample is very small and cannot be distinguished by the naked eye. However, the target detection model will output the attacker's specified, erroneous detection result with high confidence, that is, the giant panda is misjudged as the background part, that is, the target detection model cannot detect any object, and the model will not output any detection result.

[0064] In this embodiment, the attacker's attack target is the target disappearance attack, that is, under the premise that the difference between the adversarial sample and the corresponding original image is as small as possible, the target detection model misjudges the target object as the background part. The target disappearance attack confuses the foreground object and the background image on the image, making the target detection model unable to work properly, which is extremely threatening to the target detection task. For example: in the autonomous driving scenario, the attacker can generate adversarial samples so that the autonomous driving detection device cannot recognize traffic signals, pedestrians, and vehicles, which is easy to induce traffic accidents.

[0065] The attacker can grasp all the information of some target detection models, including model structure, model parameters, etc., that is, the attacker can use these target detection models to launch white-box attacks; while the attacker cannot grasp all the information of other target detection models, that is, the attacker needs to use adversarial samples generated by white-box attacks to attack these target detection models, which requires that the generated adversarial samples have high transferability and can play an attack effect on multiple target detection models.

[0066] More detailed embodiments are given below to more clearly illustrate the technical solution.

[0067] This embodiment provides a method for generating adversarial samples based on feature vector migration of a target detection model, which specifically includes the following steps:

[0068] Step S1. Convolutional neural network feature vector migration

[0069] like Figure 3 As shown in the dotted box, the target detection model in this embodiment consists of three parts: the backbone network is responsible for feature extraction of image samples. The backbone network is usually a convolutional neural network that is pre-trained on a large data set and has pre-trained parameters; the neck network is a convolutional neural network responsible for feature fusion of image samples. Generally, the neck network collects and fuses the features extracted by the backbone network to better utilize the image features to complete the target detection task; the detection head receives the features fused by the neck network, and uses this as a basis to detect the target category in the image sample and the corresponding detection frame position, and outputs the detection result.

[0070] In order to improve the transferability of adversarial sample attacks and enhance the generalization ability of adversarial samples, the feature vector migration in this embodiment is based on the extraction and fusion of the backbone network and neck network feature vectors, so that the feature vector of the original image sample is migrated in the direction of the feature vector designed by the attacker, so as to generate adversarial samples.

[0071] The core idea of ​​the convolutional neural network feature vector transfer method is: since the backbone network and the neck network of the existing target detection model have a high degree of similarity in structure and parameter distribution, it can be inferred that the feature space obtained after the image sample passes through these similar network structures also has a high degree of similarity. Therefore, the attacker perturbs the feature space of the image sample so that the feature vector of the original image sample moves in the direction of the attacker's target. The adversarial sample generated in this way can also exert considerable attack effects on a variety of target detection models, that is, to achieve a higher transferable attack target. The specific implementation steps are as follows:

[0072] S101. Extraction and fusion of convolutional neural network features

[0073] The target detection model needs to achieve the purpose of detecting the target category and the corresponding detection frame position in the image sample. In order to achieve this goal, it is necessary to first complete the feature extraction of the image sample. The backbone network of the target detection model can extract the feature map of the image sample, such as: Histogram of Oriented Gradient (HOG) features, etc. For traditional classification deep learning models, the features they focus on mainly come from the texture and shape of the object, and are not sensitive to the location information of the object. However, in addition to the classification task, the target detection model also needs to complete the positioning task, so the backbone network suitable for the classification task is often not easy to directly apply to the positioning task. In order to solve the above problems, the target detection model adds a neck network and a detection head on the basis of the backbone network to better complete the target detection task. Specifically, the detection head will vary greatly depending on the specific requirements of the target detection model, but the current mainstream neck network mainly adopts the pyramid network structure FPN (Feature Pyramid Networks). The focus of FPN is to solve the defects of the target detection model in dealing with the problem of multi-scale changes in the target. In traditional target detection models, only the feature vectors of the last layer of the backbone network are used for subsequent detection tasks. However, this implementation method is not effective enough for small object detection. In order to enhance the model's ability to process small objects, FPN constructs a pyramid-shaped feature vector. This feature vector can make full use of the semantic and position information contained in the feature vectors extracted by the backbone networks at all levels and fuse them, effectively improving the positioning performance of the target detection model. FPN is widely used in tasks such as object recognition and semantic segmentation, and is an extremely common neck network structure. In order to improve the generalization ability of adversarial samples, this patent focuses on the feature vectors of the neck network.

[0074]

[0075] Among them, ω is the parameter of each layer of the neck network of the target detection model, and x is the input corresponding to each layer, that is, the output result of the backbone network.

[0076] S102. Target feature vector construction

[0077] The feature vector extracted from the neck network in step S101 The corresponding model detection result can be output through the detection head, and the attacker's target feature vector The detection head will output the attack result expected by the attacker. In order to achieve this goal, the attacker needs to construct the target feature vector he needs.

[0078]

[0079] Among them, θ is the detection head in the target detection model, and J is the loss function corresponding to the attacker's attack target.

[0080] In this patent, the attacker needs to achieve the attack goal of making all target objects "disappear". To do this, the attacker needs to construct a target feature vector with "background" characteristics. That is, the target detection model cannot identify the feature vector of the target object. Therefore, the loss function is:

[0081] J=max(s i )

[0082] Among them, s i is the detection confidence of the target object i. As a preferred embodiment, the present invention uses random Gaussian noise as input, and constructs the target feature vector by extracting and fusion of the convolutional neural network features in step S101.

[0083] S103. Target feature vector migration

[0084] The attack target of the present invention is a target disappearance attack. In other words, the attacker expects the target detection model to identify the original target object as the category preset by the attacker, that is, the background part. In terms of the functions it implements, the target detection model needs to complete two major tasks, classification and positioning. Although the target disappearance attack is mainly aimed at the classification task. However, since the classification task and the positioning task of the target detection model share the feature space of the model, interfering with the positioning task and the classification task at the same time can achieve better attack effects.

[0085] First, for the classification task, the attacker needs to solve the optimization problem:

[0086]

[0087] in, and are the target object category and target feature vector set by the attacker, c i and are the real object category and its feature vector corresponding to the target object i in the image sample, and loss1 is the attacker’s loss function for the classification task.

[0088] For target disappearance attack, the attacker's target object category For "background", This is the target feature vector constructed in step S102. The loss function loss1 requires With c i as well as and The distance between them should be as small as possible.

[0089] Secondly, for the positioning task, the attacker needs to solve the optimization problem:

[0090]

[0091] Among them, b i and are the original image samples before and after the attack and the position coordinates of the target object i on the adversarial sample, and Its corresponding eigenvector, loss2, is the attacker’s loss function for the positioning task.

[0092] For target disappearance attack, on the one hand, since the attacker does not pay attention to the actual location of the target, the location coordinates With b i The relationship between can be ignored; on the other hand, this patent uses the attention mechanism to extract the feature vector Key area information in The attention mechanism is one of the commonly used techniques in target detection tasks. Its core idea is to guide the model to focus on the region of interest (RoI), that is, the area where the target object exists. The attention mechanism can make the target detection model pay more attention to the target object and ignore the irrelevant background part, making the recognition and positioning more accurate. In order to perform the target disappearance attack, the attacker can be regarded as transferring the attention area of ​​the target detection model from the foreground part to the background part, confusing the difference between the foreground and the background to the greatest extent to achieve the goal of the attack. As a preferred method, the loss function is to extract the key area information The sum of the standard deviations after:

[0093]

[0094] Step S2. Generate adversarial noise

[0095] In white-box attacks, commonly used adversarial sample attack methods mainly include gradient iteration-based methods, optimization-based methods, and adversarial methods. The present invention adopts the gradient iteration-based attack method PGD (Project Gradient Descent) to generate adversarial samples. The basic idea of ​​the PGD algorithm is to generate adversarial samples in the direction of increasing the loss function. Specifically, during training, a deep learning model usually defines a loss function to measure the difference between the model's predicted results and the actual results. The smaller the value of the loss function, the better the training effect of the deep learning model. The direction in which the loss function decreases can be regarded as the direction of gradient descent, that is, the deep learning model is optimized in the direction of gradient descent during training. And adversarial samples The goal is to make the deep learning model make wrong judgments, that is, to increase the corresponding loss function. In order to make the original image sample X have a larger difference between the output result and the original result after adding noise disturbance (the difference with the attacker's target result becomes smaller), the PGD algorithm calculates the gradient g corresponding to the target loss function, and then determines the generated adversarial sample according to the direction of the gradient g. However, due to the complexity of the parameter space and high dimensionality of the target detection model, it is very difficult to solve this problem directly. Therefore, the gradient iteration-based method uses the idea of ​​multiple iterative solutions: each iteration generates noise within the threshold range, perturbs the image sample, and gradually determines the direction of the generated noise, in order to ultimately achieve the maximum attack goal.

[0096] S201. Random initialization

[0097] First, to simplify subsequent calculations, the attacker normalizes all original image samples X so that their value range is [-1, 1]. Then, a random initialization noise Z is generated:

[0098] Z~N(0,0.1)

[0099] Where N(0,0.1) represents a normal distribution with a mean of 0 and a standard deviation of 0.1. The initial adversarial sample is obtained.

[0100]

[0101] S202. Calculate gradient

[0102] According to the target loss function L determined in step S2, the gradient g corresponding to the target detection model is calculated:

[0103]

[0104] in, is the parameter tensor of the currently generated adversarial sample, θ target detection model.

[0105] S203. Gradient Clipping

[0106] To constrain the maximum value of the gradient within the maximum perturbation threshold of a single iteration, the calculated gradient needs to be clipped. The calculation formula is as follows:

[0107]

[0108] Wherein, i represents the i-th round of gradient iteration, and γ is the maximum disturbance threshold of each step of gradient iteration. Preferably, the present invention sets γ to 1 / 255.

[0109] S204. Update adversarial samples

[0110] The noise N generated in step S303 i Add to adversarial examples That is to say, the gradient clipped in step S203 is the anti-noise, and the direction of the gradient is used as the direction of the anti-noise disturbance, so that the generated anti-noise sample Moving in the direction of the attacker's goal:

[0111]

[0112] S205. Adversarial Example Regularization

[0113]

[0114] The operation performed by the clip function is to ensure that The maximum L1 distance from X does not exceed ∈. L1 distance is also called Manhattan distance or chessboard distance, and the calculation formula is Preferably, the present invention sets ∈ to 8 / 255.

[0115] S206. Determine whether to stop iteration

[0116] The attacker makes a judgment based on the preset confidence level δ and the maximum number of iterations T:

[0117] (1) Since the attack target of the present invention is a target disappearance attack, that is, the attacker requires that the confidence of the generated adversarial samples on all target categories is as small as possible, when the maximum confidence value in the detection result output by the target detection model is less than the confidence threshold, the iteration can be stopped and the attack is successful.

[0118] (2) If the number of attack iterations has reached the preset upper limit T, the iterations are stopped and the attack fails.

[0119] (3) Otherwise, continue to loop through steps S302 to S306.

[0120] Step S3. Evaluation of adversarial sample attack effect

[0121] S301. Attack success rate evaluation

[0122] Attack adversarial requires that the adversarial samples generated by the attacker have a good attack success rate. The present invention evaluates the attack effect of adversarial sample attacks based on the detection accuracy of the target detection model. The commonly used performance evaluation indicator of the target detection model is the mean average precision (mAP). Since the target detection model needs to complete the classification task and the positioning task at the same time, the indicator for measuring the performance of the model also needs to be considered comprehensively from the two aspects of positioning accuracy and classification accuracy. For the positioning task, the intersection over union (IoU) is used as the evaluation indicator. IoU is the intersection over union ratio between the detection box A predicted by the target detection model and the actual detection box B. The value range is between 0 and 1. The closer IoU is to 1, the more consistent the detection box predicted by the target detection model is with the actual one, that is, the more accurate the positioning is. The calculation formula of IoU is as follows:

[0123]

[0124] In the target detection task, when the intersection over union (IoU) ≥ 0.5, it is considered a valid detection frame. When calculating the average precision mean m, only the objects identified by the detection frames whose intersection over union (IoU) is not less than 0.5 are included in the calculation range, and then the recognition accuracy of the target objects that meet the specific intersection over union conditions is calculated. In the target detection task, its recognition accuracy is measured by the average detection accuracy AP (Average Precision). Specifically, AP is based on the precision-recall curve, with the precision value P as the vertical axis and the recall value R as the horizontal axis to form a two-dimensional PR curve, and then divide the curve into several sub-segments. The area of ​​the area enclosed by each segment of the curve is calculated and summed up to get the average detection accuracy. The calculation formula is as follows:

[0125] AP=∑ i (R i-1 -R i ) i

[0126] In summary, when calculating the mean average precision m (mAP), take 10 values ​​of intersection over union (IoU) from 0.5 to 0.95, calculate their corresponding average detection precision AP respectively, and then take their average value. The specific calculation formula is as follows:

[0127]

[0128] Where c is the true category of the target object.

[0129] Since the attacker's attack target is a target disappearance attack, in an ideal state, the attacked target detection model cannot detect any target object, and the average precision mean should be reduced to 0%. Therefore, the present invention uses the reduction ratio ρ of the average precision mean as the evaluation standard of the attack success rate, and the specific calculation formula is as follows:

[0130]

[0131] Among them, m is the average precision of the target detection model for the original image samples, is the average precision of the target detection model for adversarial samples. ρ represents the degree of reduction of the average precision of the target detection model, which is a percentage between 0% and 100%. The larger the value of ρ, the higher the success rate of adversarial sample attacks.

[0132] S302. Attack concealment assessment

[0133] Adversarial samples require adding noise that is imperceptible to the naked eye to the image sample to achieve the attack goal. Therefore, the difference between the adversarial sample and the original image sample should be as small as possible. Therefore, attack concealment is also one of the important dimensions for evaluating adversarial sample attacks.

[0134] To evaluate the stealth of an attack is to evaluate the similarity between the adversarial sample and the original image sample. The present invention uses structural similarity (Structural SIMilarity, SSIM) to measure this indicator. Structural similarity is a commonly used method for measuring the quality of distorted images. Its evaluation basis is that adjacent pixels of natural images are highly correlated and have high structural characteristics. Therefore, structural similarity extracts the local structural features (brightness, contrast, and structure) of the image, divides the image into several local areas, measures the similarity of these areas respectively, and finally takes the average value to measure the similarity between the two images. The calculation of structural similarity is simple and efficient, and has a wide range of applications in image signal processing, image compression and other fields. The specific calculation formula is as follows:

[0135]

[0136] in, and are the mean and standard deviation of the original image sample X, μ and σ are the adversarial samples The average value and standard deviation of c1 and c2 are constants to maintain the stability of brightness, contrast and structure. The value range of structural similarity is from 0 to 1. The larger the value, the higher the similarity of the two images, that is, the more concealed the adversarial sample is.

[0137] S303. Attack transferability assessment

[0138] According to the knowledge and information the attacker has, adversarial sample attacks can be divided into two categories: white-box attacks and black-box attacks. Black-box attacks refer to attacks in which the attacker cannot know the details of the target's deep learning model, that is, the corresponding adversarial samples are generated when the model is unknown. White-box attacks refer to attacks in which the attacker can obtain the target's deep learning model (including model structure, parameters, etc.) and generate adversarial samples using gradient-based methods. Compared with black-box attacks, white-box attackers have more known information, so the adversarial sample attack success rate generated by white-box attacks is higher.

[0139] After the attacker completes the attack on the white-box model, it is also necessary to evaluate the generalization ability of the adversarial samples generated. The attacker selects several other target detection models (ie, black-box models) for verification, and compares the attack effects of the generated adversarial samples on these models. For adversarial samples with strong transferability, a high attack success rate can still be obtained on other models. This patent uses the ratio of the attack success rate of the generated adversarial samples on the black-box model and the white-box model as an indicator θ to measure the transferability of the attack, and the calculation formula is as follows:

[0140]

[0141] Among them, ρ w and ρ b are the decrease ratios of the average precision of white-box attack and black-box attack, respectively, and K is the number of black-box models. θ is between 0 and 1, and the closer θ is to 1, the more adversarial samples are The greater the average success rate on different black-box models, the better the attack transferability.

[0142] The above description is only a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements without departing from the principle of the present invention. These improvements should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for generating adversarial samples based on feature vector migration of target detection models, characterized in that: The steps include: Step S1, convolutional neural network feature vector migration; the convolutional neural network feature vector migration includes the following steps: S101, Extraction and fusion of convolutional neural network features; Extract feature vectors from the neck network Among them, ω is the parameter of each layer of the neck network of the target detection model, x is the input corresponding to each layer, and k is the sequence number of the neural network layer; S102, construction of target feature vector; constructed target feature vector Among them, θ is the detection head in the target detection model, and J is the loss function corresponding to the attacker's attack target; S103, migration of target feature vector; extracting feature vector of target object i in image sample corresponding to real object Key area information in Calculate and extract key area information The sum of the standard deviations after , that is, the loss function: Step S2: generating anti-noise, wherein the step of generating anti-noise comprises: S201, random initialization First, all original image samples X are normalized to a value range of [-1,1]; Then, generate a random initialization noise Z: Z~N(0,0.1); where N(0,0.1) represents a normal distribution with a mean of 0 and a standard deviation of 0.1; Finally, generate the initial adversarial sample S202. Calculate the gradient corresponding to the target detection model Calculate the gradient g corresponding to the target detection model according to the target loss function L: in, is the parameter tensor of the currently generated adversarial sample, θ target detection model; S203, clipping gradient to obtain anti-noise To constrain the maximum value of the gradient within the maximum perturbation threshold of a single iteration, the calculated gradient needs to be clipped. The calculation formula is as follows: Where i represents the i-th round of gradient iteration, and γ is the maximum perturbation threshold of each gradient iteration; S204. Update adversarial samples The noise N generated in step S203 i Add to adversarial examples Update the adversarial sample; use the direction of the gradient as the direction of the anti-noise perturbation, so that the generated adversarial sample Moving in the direction of the attacker's goal: S205, Adversarial Sample Regularization The operation performed by the clip function is to ensure that each pixel The maximum L1 distance with X does not exceed ∈; S206: Determine whether to stop iteration The attacker makes a judgment based on the preset confidence level δ and the maximum number of iterations T. The steps are as follows: 1) When the maximum confidence value in the detection results output by the target detection model is less than the confidence threshold, the iteration can be stopped and the attack is successful; 2) If the number of iterations of the attack has reached the preset upper limit T, the iteration is stopped and the attack fails; 3) Otherwise, continue to loop through steps S202 to S206.

2. The adversarial sample generation method based on target detection model feature vector migration according to claim 1 is characterized in that: The method further includes step S3, evaluating the effect of adversarial sample attacks, wherein the evaluation of the effect of adversarial sample attacks includes: S301, attack success rate evaluation: the average precision mean decrease ratio ρ is used as the evaluation standard of the attack success rate, and the specific calculation formula is as follows: Among them, m is the average precision of the target detection model for the original image samples, is the average precision of the target detection model for adversarial samples; S302, attack concealment assessment: using structural similarity to measure, the specific calculation formula of the structural similarity calculation is as follows: in, and are the mean and standard deviation of the original image sample X, μ and σ are the adversarial samples The average value and standard deviation of c1 and c2 are constants used to maintain the stability of brightness, contrast and structure. The value range of structural similarity is from 0 to 1. The larger the value, the higher the similarity of the two images, that is, the more concealed the adversarial sample is. S303, attack transferability evaluation: the ratio of the attack success rate of the generated adversarial samples on the black box model and the white box model is used as the indicator θ to measure the attack transferability. The calculation formula is as follows: Among them, ρ w and ρ b are the decrease ratios of the average precision of white-box attack and black-box attack, respectively. K is the number of black-box models. θ is between 0 and 1. The closer θ is to 1, the more adversarial samples are obtained. The greater the average success rate on different black-box models, the better the attack transferability.

3. The adversarial sample generation method based on target detection model feature vector migration according to claim 1 is characterized in that: In step S102, the loss function is: J = max(s i ), where s i is the detection confidence of target object i.

4. The adversarial sample generation method based on target detection model feature vector migration according to claim 1 is characterized in that: The target detection model includes a backbone network, a neck network and a detection head; The backbone network is responsible for feature extraction of image samples and has a convolutional neural network with pre-trained parameters; The neck network is responsible for the convolutional neural network of feature fusion of image samples, collecting and fusing the features extracted by the backbone network; The detection head receives the features after the neck network fusion, detects the target category and the corresponding detection frame position in the image sample based on the features, and outputs the detection result.

5. The adversarial sample generation method based on target detection model feature vector migration according to claim 1 is characterized in that: In step 202, the target loss function L: L = loss1 + α·loss2; Among them: loss1 is the attacker's loss function for the classification task; loss2 is the attacker's loss function for the positioning task.

6. The adversarial sample generation method based on target detection model feature vector migration according to claim 1, characterized in that: In step 205, the L1 distance is the Manhattan distance or the chessboard distance, and the calculation formula is:

Images