A general defense method and system against physical space patch attacks

Abstract

A general defense method against physical space patching attacks includes the following steps: (1) dividing the input sample into pixel blocks of a specified size; (2) performing Fast Fourier Transform and binarization on the segmented pixel blocks; (3) calculating the proportion of high-frequency information based on the binary image and sorting the pixel blocks from high to low proportion; (4) applying a mask; and (5) submitting for inspection. The invention also includes a system for implementing this general defense method against physical space patching attacks, comprising an image segmentation module, a pixel block processing and high-frequency information proportion calculation module, a mask application module, and an inspection module. This invention can provide general defense against different patching attacks in both physical and digital spaces with a lower computational cost than comparative defense methods.

Description

Technical Field

[0001] This invention relates to the field of deep learning security, and in particular to a method and system for defending against patch attacks against target detection algorithms in physical space. Background Technology

[0002] Deep neural networks (DNNs), with their powerful feature extraction capabilities, play a crucial role and have achieved significant success in numerous fields such as natural language processing, license plate recognition, and object detection. They have brought immense convenience to our lives and effectively improved people's living standards. However, while bringing convenience, deep learning also introduces many potential dangers. Attackers can analyze the characteristics of deep learning models, find their weaknesses, and use carefully designed rules to evade detection, thus posing significant security risks and potentially causing serious harm.

[0003] In the field of computer vision research, theories and methods from image processing and pattern recognition are used to separate meaningful entities—objects such as people and cars—from images or videos. One general object detection method uses bounding boxes to locate all possible object regions in an image and assigns the probability that an object is contained within that window. This method has wide applications, such as face detection, vehicle detection, pedestrian counting, autonomous driving, and security systems. In recent years, with the development of deep learning, attacks based on object detection have become a hot research topic. The concept of adversarial examples was first proposed in 2014. Essentially, it involves adding invisible perturbations to normal samples, causing the generated samples to lead to incorrect results when the object detection model identifies them.

[0004] Compared to image classification algorithms, object detection models are more difficult to attack successfully, but they have also become targets. Several attack methods have successfully fooled object detectors, causing objects to disappear from detection. Attackers can make objects disappear from state-of-the-art object detectors like YOLO and Faster R-CNN by adding a patch at any location in an image. Adversarial attacks are not limited to the digital space; some can be implemented in the physical space. Thys et al. applied patch adversarial attacks in the physical space. As they demonstrated, by printing out a carefully designed patch and placing it in the center of a person's face, they could fool the most popular object detector, YOLO, making it unable to detect the patched person. Mark et al. placed an adversarial sticker in the field of view, causing all objects in the field of view to successfully disappear from the object detection model.

[0005] Current methods for defending against patch attacks on object detection algorithms primarily focus on the digital space, such as digital watermarking proposed by Hayes et al. and local gradient smoothing proposed by Naser et al. However, these defenses are easily broken by white-box attacks, and their effectiveness in defending against patch attacks in the physical space is far less than that in the digital space. In the digital space, attackers can modify any pixel in an image, enabling covert attacks. In the physical space, attackers do not have permission to modify the image captured by the target image sensor, nor do they have permission to modify the network parameters. They can only pre-add perturbations to the object to be detected, allowing the image sensor to capture the perturbated image. In the physical space, attackers generate adversarial patch blocks and then apply these patches to specific locations on the target object to carry out the attack. Due to variations in printing and lighting intensity, there is a significant color difference between the adversarial patch in the captured image and the patch in the digital space before printing. This results in the adversarial patch in the final image captured by the image sensor exhibiting a more gradual gradient compared to the digital space version. Therefore, local gradient smoothing defense methods based on gradient changes are effective in digital space; however, their effectiveness is far less in physical space than in digital space. For example, the technical solution disclosed in patent application number CN202110814586.5 is a preprocessing method for defending against image perturbations. In the online defense stage, this method uses non-negative matrix factorization to obtain a low-rank representation of the perturbated image, and then uses an overcomplete dictionary to sparsely encode and reconstruct the low-rank representation. Our research goal is to find a robust defense method applicable in physical space. Even if attackers use adversarial patches generated by different attack methods, and the distance and angle of the target object change, a general defense method can enable the target detector to detect the hidden object. Summary of the Invention

[0006] This invention aims to overcome the shortcomings of existing defense methods, such as poor versatility and ineffective defense when migrated to physical space, and provides a patch-based anti-attack defense method that is effective and universal in physical space.

[0007] This invention is based on the Fast Fourier Transform and can universally defend against patch attacks of different methods in the physical space, significantly improving its defensive performance and versatility.

[0008] The technical solution adopted by the present invention to achieve the above-mentioned objectives is as follows:

[0009] A general defense method against physical space patching attacks includes the following steps:

[0010] S1: Divide the input sample into pixel blocks of a specified size;

[0011] S2: Perform Fast Fourier Transform and Binarization on the segmented pixel blocks;

[0012] S3: Calculate the proportion of high-frequency information based on the binary image, and sort the pixel blocks from high to low proportion;

[0013] S4: Apply a mask;

[0014] S5: Submit for testing.

[0015] Furthermore, step S1 specifically includes:

[0016] The input sample is divided into 60×60 pixel blocks with a step size of 20.

[0017] Furthermore, step S2 specifically includes:

[0018] The pixel blocks obtained by S1 are first converted into grayscale images and then subjected to Fast Fourier Transform (FFT). Finally, the images obtained from the FFT are binarized. The FFT formula is as follows:

[0019]

[0020] In the formula, M and N represent the total number of rows and columns of the image, respectively, x and y represent the x-th row and y-th column, respectively, and f(x,y) represents the pixel value of the x-th row and y-th column.

[0021] Furthermore, step S3 specifically includes:

[0022] S3.1: In the binary image obtained from S2, white pixels represent high-frequency information, and black pixels represent non-high-frequency information. Calculate the proportion of high-frequency information in the pixel block corresponding to each binary image. The formula for calculating the proportion of high-frequency information is:

[0023]

[0024] In the formula, i represents the i-th pixel block, M is the length of the pixel block, N is the width of the pixel block, f(x,y) represents the value of the pixel in the x-th row and y-th column, and (x,y)∈[0,1];

[0025] S3.2: Next, sort the pixel blocks from high to low according to the proportion of high-frequency information. The ones at the front are more likely to be anti-patch.

[0026] Furthermore, step S4 specifically includes:

[0027] Take the first pixel block (the pixel block with the highest proportion of high-frequency information) from the S3 sorting result, and then replace the pixel block in the input sample with a gray mask (pixel value (128, 128, 128)).

[0028] Furthermore, step S5 specifically includes:

[0029] After the sorting operation in S3, the earlier a pixel appears in the list, the more high-frequency information it contains, and the more likely it is to be an adversarial patch. After S4, covering it with a gray mask may destroy the adversarial patch. Finally, the masked sample is sent to the target detector. If no person was detected before the mask was applied, but a person is detected after the mask is applied, it means that the replaced pixel block is the adversarial patch. If no person is detected after the mask is applied, the process returns to S5 to continue taking the pixel block with the second highest frequency ratio and applying the mask.

[0030] The present invention also includes a system for implementing the general defense method against physical space patching attacks against deep learning models, comprising: an image segmentation module, a pixel block processing and high-frequency information proportion calculation module, an application mask module, and an inspection module.

[0031] The technical concept of this invention is as follows: by first dividing the input sample into several pixel blocks and then using Fast Fourier Transform (FFT) to quickly find suspected patches, a defense method that can universally defend against patch attacks in physical space is realized, enabling the target detector to detect objects hidden by adversarial patches. First, the input sample is divided into several pixel blocks. In this invention, the segmentation size and step size can be adjusted according to actual conditions. Then, the obtained pixel blocks are converted into grayscale images, and then subjected to FFT and binarization processing. The proportion of high-frequency information in each pixel block is calculated, and finally, the pixel blocks are sorted from high to low according to the proportion of high-frequency information. Because adversarial patches contain less high-frequency information than normal sample images, the pixel blocks ranked higher contain more high-frequency information, and are therefore more likely to be adversarial patches. If an adversarial patch exists in the sample, it will appear in a higher ranked position. The pixel block with the highest high-frequency information is replaced with a gray mask at the corresponding position in the input sample (pixel value (128, 128, 128)). The masked sample is then sent to the target detector to verify whether the suspected patch is a real adversarial patch. If no person is detected before applying the mask, but a person is detected after applying the mask, it means that the replaced pixel block is the adversarial patch. If no person is detected after applying the mask, continue to take the second highest frequency pixel block, apply the mask, and then send the masked sample to the target detector to determine whether the pixel block is the adversarial patch. The loop continues until an adversarial patch is found or the preset number of loops is reached, at which point the loop exits.

[0032] The beneficial effects of this invention are as follows:

[0033] (1) This invention is a general method for defending against patch attacks, which can defend against different patch attacks in physical space.

[0034] (2) The computation is small. Considering that there may be adversarial patches at any position, it is only necessary to verify the possible occurrence of adversarial patches in each pixel block.

[0035] (3) The defense method was evaluated on two state-of-the-art object detectors and three datasets, and it was shown that the original model accuracy reduction rate after defense was better than that of similar methods on benign sample datasets, and the defense effect was better than that of similar methods on adversarial sample datasets.

[0036] (4) A physical space adversarial attack dataset was constructed.

[0037] (5) This invention can not only defend against attacks by patching in physical space, but also be applied in digital space. Attached Figure Description

[0038] Figure 1 This is a flowchart of the method of the present invention.

[0039] Figure 2 This is a flowchart of the Fast Fourier Transform (FFT) process.

[0040] Figure 3 This is a schematic diagram of the system structure of the present invention. Detailed Implementation

[0041] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0042] Reference Figures 1-3 A general defense method against physical space patch attacks, the steps of which are as follows:

[0043] S1: Divide the input sample into pixel blocks of a specified size, specifically including:

[0044] The input sample is divided into 60×60 pixel blocks with a step size of 20.

[0045] S2: The segmented pixel blocks undergo Fast Fourier Transform and binarization processing, specifically including:

[0046] The pixel blocks obtained by S1 are first converted into grayscale images and then subjected to Fast Fourier Transform (FFT). Finally, the images obtained from the FFT are binarized. The FFT formula is as follows:

[0047]

[0048] In the formula, M and N represent the total number of rows and columns of the image, respectively, x and y represent the x-th row and y-th column, respectively, and f(x,y) represents the pixel value of the x-th row and y-th column.

[0049] S3: Calculate the proportion of high-frequency information from the binary image, and sort the pixel blocks from high to low proportion. Specifically, this includes:

[0050] S3.1: In the binary image obtained from S2, white pixels represent high-frequency information, and black pixels represent non-high-frequency information. Calculate the proportion of high-frequency information in the pixel block corresponding to each binary image. The formula for calculating the proportion of high-frequency information is:

[0051]

[0052] In the formula, i represents the i-th pixel square, M is the length of the pixel square, N is the width of the pixel square, (x,y) represents the value of the pixel in the x-th row and y-th column, and (x,y)∈[0,1];

[0053] S3.2: Next, sort the pixel blocks from high to low according to the proportion of high-frequency information. The ones at the front are more likely to be anti-patch.

[0054] S4: Apply a mask, specifically including:

[0055] Take the first pixel block (the pixel block with the highest proportion of high-frequency information) from the S3 sorting result, and then replace the pixel block in the input sample with a gray mask (pixel value (128, 128, 128)).

[0056] S5: Submission for testing, specifically including:

[0057] After the sorting operation in S3, the earlier a pixel appears in the list, the more high-frequency information it contains, and the more likely it is to be an adversarial patch. After S4, covering it with a gray mask may destroy the adversarial patch. Finally, the masked sample is sent to the target detector. If no person was detected before the mask was applied, but a person is detected after the mask is applied, it means that the replaced pixel block is the adversarial patch. If no person is detected after the mask is applied, the process returns to S5 to continue taking the pixel block with the second highest frequency ratio, applying the mask, and then using the target detector to determine whether the pixel block is an adversarial patch. The loop continues until an adversarial patch is found or the preset number of loops is reached, at which point the loop exits.

[0058] A system for implementing the general defense method against physical space patch attacks of the present invention includes: an image segmentation module, a pixel block processing and high-frequency information proportion calculation module, a sorting and mask application module, and an inspection module.

[0059] The image segmentation module divides the input sample into several small pixel blocks, specifically including: dividing the input sample into 60×60 pixel blocks, with a step size of 20 for each movement;

[0060] The pixel block processing and high-frequency information proportion calculation module obtains the proportion of high-frequency information in each pixel block. Specifically, it includes: first converting the segmented pixel blocks into grayscale images, then performing a fast Fourier transform, and finally binarizing the image obtained by the fast Fourier transform. In the obtained binary image, white pixels represent high-frequency information and black pixels represent non-high-frequency information. The proportion of white pixels in the total pixels represents the proportion of high-frequency information.

[0061] The sorting and masking module obtains a sample with the anti-patch covered by a gray mask. Specifically, it sorts the pixel blocks from high to low according to the high frequency ratio calculated by the pixel block processing and high frequency information ratio calculation module, and then covers the pixel block with the highest high frequency information ratio in the original sample with a gray mask (pixel value (128, 128, 128)) at the corresponding position, thus obtaining a sample that has destroyed the anti-patch.

[0062] The sample delivery module uses a target detector to verify whether a suspected patch is indeed an adversarial patch. Specifically, it sends the sample after applying a gray mask to the target detector. If no person is detected before applying the mask, but a person is detected after applying the mask, then the suspected patch is indeed an adversarial patch. If no person is detected before or after applying the mask, then the pixel block with the second highest frequency ratio is selected, a mask is applied, and the sample is sent for further inspection.

[0063] The embodiments described in this specification are merely examples of implementations of the inventive concept. The scope of protection of this invention should not be considered as limited to the specific forms stated in the embodiments. The scope of protection of this invention also extends to equivalent technical means that can be conceived by those skilled in the art based on the inventive concept.

Claims

1. A general defense method against physical space patching attack, characterized in that, The method comprises the following steps: S1: cutting the input sample into pixel blocks of a specified size; S2: performing fast Fourier transform and binarization processing on the obtained pixel blocks; S3: calculating the proportion of high-frequency information according to the binary image, and sorting the pixel blocks from high to low according to the proportion; S4: applying a mask; specifically comprising: taking the first pixel block from the S3 sorting result, that is, the pixel block with the highest proportion of high-frequency information, and then replacing the pixel block in the input sample with a gray mask; the pixel value of the gray mask is (128, 128, 128); S5: inspection; specifically comprising: After the S3 sorting operation, the earlier the pixel block is arranged, the more high-frequency information it contains, and the greater the possibility of being an adversarial patch; after being covered with a gray mask, the adversarial patch is destroyed; finally, the sample after applying the mask is sent to the target detector; if no person is detected before applying the mask, but a person is detected after applying the mask, it is indicated that the replaced pixel block is an adversarial patch; if no person is detected after applying the mask, the pixel block with the second highest proportion of high-frequency information is taken, the mask is applied, and the target detector is used to determine whether the pixel block is an adversarial patch; the cycle is repeated until the adversarial patch is found or the preset number of cycles is reached.

2. The general defense method against physical space patching attack according to claim 1, wherein: The step S1 specifically comprises: cutting the input sample into pixel blocks of 60x60 size, and the step length is 20.

3. The general defense method against physical space patching attack according to claim 1, wherein: The step S2 specifically comprises: converting the pixel blocks obtained in S1 into gray images, then performing fast Fourier transform, and finally binarizing the image obtained by fast Fourier transform; the fast Fourier transform formula is: wherein M and N respectively represent the total number of rows and the total number of columns of the image, x and y respectively represent the xth row and the yth column, and f(x, y) represents the pixel value of the xth row and the yth column.

4. The general defense method against physical space patching attack according to claim 1, wherein: The step S3 specifically comprises: S3.1: the white pixels in the binary image obtained from S2 represent high-frequency information, and the black pixels represent non-high-frequency information; the proportion of high-frequency information corresponding to each binary image is calculated; the formula for calculating the proportion of high-frequency information is: wherein i represents the ith pixel block, M is the length of the pixel block, N is the width of the pixel block, (x, y) represents the value of the xth row and the yth column, and (x, y) ∈ [0, 1]; S3.2: then, the pixel blocks are sorted from high to low according to the proportion of high-frequency information; the pixel blocks arranged in the front are more likely to be adversarial patches.

5. A system for implementing a general defense method against physical space patching attacks as claimed in claim 1, comprising: An image cutting module, a pixel block processing and high-frequency information proportion calculation module, an application mask module, and an inspection module; The image cutting module cuts the input sample into a plurality of small pixel blocks, specifically comprising: cutting the input sample into pixel blocks of 60x60 size, and the step length is 20; The pixel block processing and high-frequency information proportion calculation module obtains the proportion of high-frequency information in each pixel block, specifically comprising: converting the obtained pixel blocks into gray images, then performing fast Fourier transform, and finally binarizing the image obtained by fast Fourier transform; the white pixels in the obtained binary image represent high-frequency information, and the black pixels represent non-high-frequency information; the proportion of white pixels in the whole domain represents the proportion of high-frequency information. The sorting and applying mask module obtains a sample covered by a gray mask and the adversarial patch, specifically including: sorting the pixel blocks according to the high-frequency proportion calculated by the pixel block processing and high-frequency information proportion calculation module from high to low, then covering the corresponding position of the pixel block with the highest high-frequency information proportion in the original sample with a gray mask to obtain a sample with the adversarial patch destroyed; the pixel value of the gray mask is (128, 128, 128); The submission module verifies whether the suspected patch is really an adversarial patch by using a target detector, specifically including: sending the sample after applying the gray mask into the target detector, if no person is detected before applying the mask, but a person is detected after applying the mask, it is proved that the suspected patch is really an adversarial patch, if no person is detected before and after applying the mask, then the pixel block with the second highest high-frequency proportion is applied with the mask for further submission; The image cutting module, the pixel block processing and high-frequency information proportion calculation module, the sorting and applying mask module and the submission module are sequentially connected.

Images