A video adversarial sample generation method based on target tracking and motion estimation

Abstract

The present invention discloses a method for generating video adversarial samples based on target tracking and motion estimation, and belongs to the field of artificial intelligence. The method includes: constructing a continuity evaluation index of video adversarial samples; using a target recognition algorithm to perform association matching on the targets between the previous and next frames in a video sequence; obtaining the relative motion data of the target according to the association matching result; calculating the model parameters of the adversarial sample generation model; optimizing the model parameters; using each frame image in the video sequence as the input of the final adversarial sample generation model corresponding to the frame image, and using the adversarial sample continuity evaluation index as a constraint condition to generate an adversarial sample for each frame image. The method performs association tracking and motion estimation on the targets between multiple frames of images, calculates the adversarial parameters of the subsequent frame based on the adversarial parameters of the previous frame, and performs optimization and solution within a small neighborhood, and finally generates video adversarial samples with the same adversarial targets, continuous adversarial results, and similar adversarial parameters.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence, and in particular relates to a method for generating video adversarial samples based on target tracking and motion estimation. Background Art

[0002] In recent years, as machine learning has developed rapidly and been widely used in the field of images, its security has gradually become a research hotspot. Adversarial sample generation can cause misclassification by adding adversarial perturbations to the original image, which is one of the main security threats faced by machine learning algorithms. Existing related research focuses on constructing adversarial samples for images, that is, taking the same adversarial sample construction process for each image. However, intelligent systems such as self-driving cars and intelligent robots usually perceive and make decisions based on videos. Although videos can be regarded as a collection of multiple frames, the image adversarial sample generation method cannot be directly transferred to the video field, otherwise the correlation between the previous and next frame images will be lost, which will also lead to discontinuity of adversarial targets, adversarial effects and adversarial parameters.

[0003] Researching video adversarial sample generation technology will help reveal the vulnerabilities of machine learning, so that the security of the video can be protected against the adversarial samples in the future and its security can be improved. Summary of the invention

[0004] The present invention proposes a video adversarial sample generation method based on target tracking and motion estimation. The method constructs an adversarial parameter mapping model between two frames according to the original samples of the previous and next frames, and performs small neighborhood optimization to generate continuous adversarial samples.

[0005] The specific technical scheme of the present invention is:

[0006] A method for generating video adversarial samples based on target tracking and motion estimation includes the following steps:

[0007] Step 1: Construct a video adversarial sample continuity evaluation index for different target adversarial effects; the target adversarial effects include hiding, creating, and replacing;

[0008] Step 2: Use the target recognition algorithm to perform association matching on the targets between the previous and next frames in the video sequence; obtain the relative motion data of the target based on the association matching results;

[0009] Step 3: According to the relative motion data corresponding to the i-th frame image and the model parameters of the adversarial sample generation model corresponding to the i-th frame image, obtain the model parameters of the adversarial sample generation model corresponding to the i+1-th frame image;

[0010] Step 4: Use the Bayesian optimization algorithm to optimize the model parameters obtained in step 3, and obtain the final adversarial sample generation model based on the optimized model parameters; use each frame image in the video sequence as the input of the final adversarial sample generation model corresponding to the frame image, and use the adversarial sample continuity evaluation index as a constraint condition to generate an adversarial sample for each frame image.

[0011] Furthermore, the continuity evaluation index is specifically:

[0012] a. If and only if the adversarial sample of the i+1th frame image Identification results When the following formula is satisfied, the hidden effect is continuous:

[0013] for Make U pq <ε0 holds true

[0014] Among them, y m Indicates a confrontation target; Represents the recognition result of the target recognition algorithm The entries in U include bounding boxes, categories, and confidence levels. The subscript i+1 corresponds to the i+1th frame image. pq Represents y q and The bounding box intersection and union ratio, y q Indicates the image v in the i+1th frame i+1 The corresponding adversarial target y m The detection results include bounding boxes, categories, and confidence levels. ε0 is the threshold for determining that two bounding boxes do not overlap.

[0015] b. If and only if the adversarial sample of the i+1th frame image Identification results When the following formula is satisfied, the replacement effect is continuous:

[0016] Make U mp >ε1 and C p =C t

[0017] Where U mp Represents y m and The bounding box intersection-union ratio, C p express The detection category, C t represents the adversarial target category; ε1 is the threshold for determining the overlap of two bounding boxes.

[0018] c. If and only if the adversarial sample of the i+1th frame image Identification results When the following formula is met, the creation effect is continuous:

[0019] for Make U pl >ε1,U po <ε0 and C p =C l

[0020] Where Y i+1 Represents the i+1th frame image v i+1 The recognition result, y o Indicates the recognition result Y i+1 The entries in U include bounding boxes, categories, and confidences; pl Represents y l and The bounding box intersection and union ratio, y l Indicates the creation target, U po Represents y o and The bounding box intersection-union ratio.

[0021] Furthermore, the association matching is specifically as follows:

[0022] Detect the target in each frame of the video sequence, crop the target and separate the background according to the bounding box, and perform association matching between the targets in the previous and next frames. During matching, the target bounding box in the i-th frame is recorded as B i , then the bounding box with the highest matching degree with the target in the i+1th frame image is solved by the following formula:

[0023]

[0024] Among them, C i is the category of the target in the i-th frame image, represents the predicted category of the kth bounding box in the i+1th frame image, U ik Represents the kth bounding box in the i+1th frame image and B i The intersection and ratio of .

[0025] Furthermore, the relative motion data of the target is obtained according to the association matching result, specifically:

[0026] For the hiding effect and replacement effect, the relative motion data of the target is expressed as (ΔW i→i+1 ,ΔH i→i+1 ,Δx i→i+1 ,Δy i→i+1 ), where ΔW i→i+1 , ΔH i→i+1 Respectively represent the width and height changes of the bounding box of the target in the i-th frame and the i+1-th frame image, Δxi→i+1 , Δy i→i+1 Respectively represent the horizontal and vertical displacements of the center point of the bounding box of the target in the i-th frame and the i+1-th frame image;

[0027] For the creation effect, the relative motion data of the target is expressed as (Δx′ i→i+1 ,Δy′ i→i+1 ), where Δx′ i→i+1 , Δy′ i→i+1 Respectively represent the horizontal and vertical displacement of the center point of the background bounding box in the i-th frame and the i+1-th frame image.

[0028] Furthermore, the model parameters of the adversarial sample generation model corresponding to the i+1th frame image are specifically:

[0029] Against the effects of hiding and replacing:

[0030] P i+1 =P i +F(ΔW i→i+1 ,ΔH i→i+1 ,Δx i→i+1 ,Δy i→i+1 )

[0031] To create a counter effect:

[0032] P i+1 =P i +F(Δx′ i→i+1 ,Δy′ i→i+1 )

[0033] Where P i+1 represents the model parameters of the adversarial sample generation model corresponding to the i+1th frame image, and F(.) represents the fitting function.

[0034] The present invention makes full use of the similarities and correlations between previous and next frame images in the video to make the generated adversarial samples continuous, which can better reveal the vulnerability of machine learning and guide the improvement of its security. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of a video adversarial sample generation method based on target tracking and motion estimation proposed in the present invention.

[0036] Figure 2 It is a rendering of an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with specific embodiments of the present invention.

[0038] like Figure 1 As shown in the figure, a method for generating video adversarial samples based on target tracking and motion estimation is presented. This method performs correlation tracking and motion estimation on targets between multiple frames, infers the adversarial parameters of the next frame based on the adversarial parameters of the previous frame, and performs optimization and solution within a small neighborhood. Finally, video adversarial samples with the same adversarial targets, continuous adversarial results, and similar adversarial parameters are generated. The main steps include:

[0039] Step 1: Construct a video adversarial sample continuity evaluation index for target detection. Adversarial continuity measures the ability of adversarial sample generation methods to continuously and effectively attack videos or continuous images. Video V can be regarded as a sequence of v0, v1, …, v n A set with time series characteristics, where v i Represents the i-th frame image of the video.

[0040] The adversarial sample generation model G(·) can generate the adversarial sample for the i-th frame image v i Generating Adversarial Examples The parameters of its adversarial sample generation model are P i , if the adversarial sample generated by the i-th frame image Adversarial sample generated with the i+1th frame image After being identified by the machine learning model, the same adversarial effect is achieved. The adversarial sample generation model G(·) is said to have attack continuity for the two frames. The adversarial sample generation model parameter is denoted as P i+1 .

[0041] Specifically, the present invention mainly considers three adversarial effects, namely hiding, creating and replacing. An adversarial sample with a hiding effect can make the machine learning model unable to recognize an object that originally existed; an adversarial sample with a creation effect can make the machine learning model mistakenly report an object that does not really exist; an adversarial sample with a replacement effect can make the machine learning model misreport the type of the object. This step specifically includes the following steps:

[0042] Step 1.1: Construct continuous evaluation index of adversarial samples with hidden effect. If and only if the i+1th frame image adversarial sample Identification results When the following equation is satisfied, G(·) is said to have hidden effect continuity:

[0043] for Make U pq <ε0 holds true

[0044] Among them, y m It means the target of confrontation, here it means the hidden target; Represents the recognition result The items in include bounding boxes, categories and confidence levels. The recognition results are the results output by traditional target detection models, which are well-known in the art and will not be described in detail here. pq Represents y q and The bounding box intersection and union ratio, y q Indicates the image v in the i+1th frame i+1 The corresponding adversarial target y m The detection results, including bounding boxes, categories, and confidence levels, are the manifestations of the same object in different frames, and ε0 is the threshold for determining that two bounding boxes do not overlap.

[0045] Step 1.2: Construct the continuity evaluation index of adversarial samples with replacement effect. If and only if the recognition result of adversarial sample in the i+1th frame image is When the following equation is satisfied, G(·) is said to have replacement attack continuity:

[0046] Make U mp >ε1 and C p =C t

[0047] Where U mp Represents y m and The bounding box intersection-union ratio, C p express The detection category, C t represents the adversarial target category, which refers to the replacement target here; ε1 is the threshold for determining the overlap of two bounding boxes.

[0048] Step 1.3: Construct the continuity evaluation index of adversarial samples with creation effect. If and only if the recognition result of adversarial sample in the i+1th frame image is When the following formula is satisfied, G(·) is said to have the ability to create attack continuity:

[0049] for Make U pl >ε1,U po <ε0 and C p =C l

[0050] Where Y i+1 Represents the i+1th frame image v i+1 The recognition result, y o Indicates the recognition result Y i+1 The entries in U include bounding boxes, categories, and confidences; pl Represents y l and The bounding box intersection and union ratio, y lIndicates the creation target, U po Represents y o and The bounding box intersection-union ratio.

[0051] Step 2: Use a target tracking algorithm based on target detection, such as the YOLO algorithm, to first detect the target in each frame of the video sequence, then crop the target and separate the background according to the bounding box, and then perform correlation matching on the targets between the previous and next frames. The present invention measures the similarity based on the intersection-over-union ratio between the bounding boxes. Suppose the attacked object y in the i-th frame image is i The bounding box is B i , then the detection result y with the highest matching degree with the object in the i+1th frame image is k The following formula can be used to solve:

[0052]

[0053] Among them C i is the category of the attacked object in the previous frame (i-th frame), represents the predicted label of the kth bounding box in the next frame (i+1th frame), U ik Represents y i and k The bounding box intersection ratio, that is, B i The intersection-over-union ratio with the k-th bounding box in the i+1-th frame image.

[0054] Step 3: The hidden attack and the replacement attack need to calculate the relative motion of the target object based on the before and after changes of the bounding box. The present invention uses the bounding box width change ΔW i→i+1 , height change ΔH i→i+1 , horizontal displacement of the center point Δx i→i+1 and vertical displacement Δy i→i+1 Indicates the change in the bounding box of the object from the i-th frame to the i+1-th frame.

[0055] Creating an attack requires calculating the relative motion of the background based on the before and after changes in the bounding box of the static object. This invention uses the horizontal displacement Δx′ i→i+1 and vertical displacement Δy′ i→i+1 Indicates the change of background from frame i to frame i+1.

[0056] Step 4: Construct an adversarial parameter mapping model between the previous and next frames. Based on the relative motion of the object, the adversarial parameter mapping model between the previous and next frames can be constructed as follows:

[0057] For hiding and replacement attacks:

[0058] P i+1 =P i +F(ΔW i→i+1 ,ΔHi→i+1 ,Δx i→i+1 ,Δy i→i+1 )

[0059] For creation attacks:

[0060] P i+1 =P i +F(Δx′ i→i+1 ,Δy′ i→i+1 )

[0061] Since the displacement of the objects in the previous and next frames is small, a linear function can be used to fit the mapping relationship, and the parameters of the function can be obtained through linear regression, where F(.) represents the fitting function.

[0062] Step 5: In order to reduce the error introduced by constructing the adversarial parameter mapping model in step 4, the present invention performs small neighborhood optimization on the adversarial sample generation model parameters. Specifically, each adversarial sample generation model parameter is first allowed to fluctuate within a small range of its inference results, and then the final adversarial parameters are solved based on the Bayesian optimization algorithm.

[0063] Through the above five steps, the present invention constructs a video adversarial sample with adversarial continuity.

[0064] In this embodiment, the adversarial sample generation model G(·) in application number CN202011124293.6 is used. Taking the video in the BDD100K dataset as an example, the threshold ε0 is set to 0.2 and ε1 is set to 0.8. The present invention generates adversarial samples with a continuity creation effect on the video, such as Figure 2 As shown, it can be seen that through the method of the present invention, objects of the category "truck" can be continuously created at the background of the road sign in the video.

[0065] Studying the video adversarial sample generation technology helps to reveal the vulnerability of machine learning, so as to protect the security of the video against the adversarial sample in the future and guide its security improvement. For example, for the YOLO target recognition algorithm adopted in this embodiment, according to the adversarial sample generated by the present invention, the existing YOLO model cannot recognize that the created "truck" is fake, then the adversarial sample can be used to retrain the YOLO model or improve the YOLO model to enable it to have the ability to recognize fake.

[0066] The above examples are only specific embodiments of the present invention. Obviously, the present invention is not limited to the above examples, and many variations are possible. All variations that can be directly derived or associated with the contents disclosed by a person skilled in the art should be considered as the protection scope of the present invention.

Claims

1. A video adversarial sample generation method based on target tracking and motion estimation, characterized in that: The following steps are involved: Step 1: Construct a video adversarial sample continuity evaluation index for different target adversarial effects; the target adversarial effects include hiding, creating, and replacing; The continuity evaluation indicators described in step 1 are specifically: a. If and only if Adversarial examples of frame images Identification results When the following formula is satisfied, the hidden effect is continuous: ； in, Indicates a confrontation target; Represents the recognition result of the target recognition algorithm Entries in include bounding boxes, categories, and confidences, subscripts Corresponding to Frame image; express and The bounding box intersection-union ratio of Indicated in Frame Image Corresponding to the target The detection results, including bounding boxes, categories, and confidence levels, The threshold for determining whether two bounding boxes overlap; b. If and only if Adversarial examples of frame images Identification results When the following formula is satisfied, the replacement effect is continuous: ； In the formula, express and The bounding box intersection-union ratio of express The detection category, represents the adversarial target category; The threshold for determining the overlap of two bounding boxes; c. If and only if Adversarial examples of frame images Identification results When the following formula is met, the creation effect is continuous: ； In the formula, Indicates Frame Image The recognition result of Represents the recognition result Entries in , including bounding boxes, categories, and confidences; express and The bounding box intersection-union ratio of Indicates the creation of a target. express and The bounding box intersection-union ratio of Step 2: Use the target recognition algorithm to perform association matching on the targets between the previous and next frames in the video sequence; obtain the relative motion data of the target based on the association matching results; Step 3: According to The relative motion data corresponding to the frame image and the The model parameters of the adversarial sample generation model corresponding to the frame image are obtained. Model parameters of the adversarial sample generation model corresponding to the frame image; Step 4: Use the Bayesian optimization algorithm to optimize the model parameters obtained in step 3, and obtain the final adversarial sample generation model based on the optimized model parameters; use each frame image in the video sequence as the input of the final adversarial sample generation model corresponding to the frame image, and use the adversarial sample continuity evaluation index as a constraint condition to generate an adversarial sample for each frame image.

2. The method for generating video adversarial samples based on target tracking and motion estimation according to claim 1, characterized in that: The association matching is specifically as follows: Detect the target in each frame of the video sequence, crop the target and separate the background according to the bounding box, and associate and match the targets between the previous and next frames. The target bounding box in the frame image is denoted as , then The bounding box with the highest matching degree with the target in the frame image is solved by the following formula: ； in, For the The category of the target in the frame image, Indicates The first The predicted category of the bounding box, Indicates The first Bounding boxes and The intersection and ratio of .

3. The method for generating video adversarial samples based on target tracking and motion estimation according to claim 1, characterized in that: The relative motion data of the target is obtained according to the association matching result, specifically: For the hiding effect and replacement effect, the relative motion data of the target is expressed as ,in Respectively represent the target in Frame and The width and height changes of the bounding box in the frame image. Respectively represent the target in Frame and The horizontal and vertical displacement of the center point of the bounding box in the frame image; For the creation effect, the relative motion data of the target is expressed as ,in Respectively represent the background in Frame and The center point of the bounding box in the frame image is displaced horizontally and vertically.

4. The method for generating video adversarial samples based on target tracking and motion estimation according to claim 3, characterized in that: The said The model parameters of the adversarial sample generation model corresponding to the frame image are: Against the effects of hiding and replacing: ； To create a counter effect: ； In the formula, Indicates The model parameters of the adversarial sample generation model corresponding to the frame image, represents the fitting function.

Images