A target stealth counter sample generation method for traffic information perception

Abstract

The application provides a target stealthy adversarial sample generation method for traffic information perception, and the method is mainly aimed at a YOLOv4 target detection network.The method comprises the following steps: obtaining an original picture to be detected; inputting the picture to be detected into the YOLOv4 target detection network; designing an adversarial loss function; calculating a loss value of the picture to be detected in the YOLOv4 target detection network; calculating an adversarial disturbance by using a gradient algorithm; limiting the adversarial disturbance in a target area by using a disturbance intercepting method; and adding the original picture and the adversarial disturbance to obtain an adversarial sample.By using the application, the adversarial sample can be generated, the security loopholes and problems existing in the YOLOv4 target detection network are exposed, and the traffic information perception system can be effectively verified in terms of security effect.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of rail transit, in particular to a method for generating adversarial samples for target cloaking attacks on a YOLOv4 target detection network for traffic information perception. BACKGROUND

[0002] In recent years, vehicle-mounted traffic information perception systems have developed rapidly. The purpose of the perception system is to perceive the operating environment and state of the vehicle. Generally, a camera is installed in the driver's room to capture and obtain video images of the operating environment of the vehicle. Intelligent algorithms are used to identify the operating environment, and then make intelligent decisions based on the operating environment. The operating environment of the vehicle is very complex, mainly including complex road conditions, complex and variable weather conditions, and complex lighting conditions. Traditional image processing methods cannot solve the problem of complex operating environment perception, and deep learning algorithms are needed to detect the operating environment state in real time. Target detection algorithms based on deep learning can detect obstacles around the traffic scene, and the YOLO target detector is widely used in traffic obstacle detection due to its high running efficiency and high accuracy.

[0003] Adversarial samples have become a research hotspot in the field of computers in recent years, and they pose a great threat to the reliability and security of deep learning networks. For example, in computer vision perception, an adversarial sample is an image with minor noise added by humans. While humans can correctly perceive the image, deep learning models give incorrect and completely different perception results. In application scenarios that require high reliability, such as autonomous driving, vehicles and pedestrians in the traffic environment need to use target detection deep learning networks to locate the target position.

[0004] In the prior art, Chinese patent application CN114359672A "Adversarial attack method based on iterative fast gradient descent of Adam", Chinese patent application CN108491837A "Adversarial attack method for improving license plate attack robustness" and other technologies, as well as research papers "Improving adversarial attacks on deep neural networks via constricted gradient-based perturbations", "Ensemble Fool: A method to generate adversarial examples based on model fusion strategy" are all for generating adversarial samples for classifier networks, and do not involve the introduction of adversarial sample generation methods based on YOLO target detectors. Adversarial samples for classifiers cannot successfully attack target detectors.

[0005] If the detected image is an adversarial sample image disturbed by adversarial noise, the target detection network cannot correctly identify the target in the traffic environment, which will seriously lead to traffic accidents. The difficulty of generating adversarial samples for the target detection network is greater than that for the classifier. The target in the classifier is only one and does not need to give the accurate position coordinates of the target, while the target detector contains pictures of multiple different targets and gives the accurate position coordinates of the corresponding target. The existing adversarial sample generation method for the classifier does not pose a great threat to the traffic information perception system, so a method for generating adversarial samples for the target detection network with high attack success rate is needed to optimize the target detection model and enhance the defense ability of the adversarial samples. SUMMARY

[0006] The present application provides a kind of target stealth attack of YOLOv4 target detection network for generating adversarial samples, generates adversarial samples attack YOLOv4 target detection network using gradient algorithm, exposes the security vulnerabilities and problems existing in YOLOv4 target detection network, helps to improve or propose more effective defense method, improve the reliability of traffic information perception system, it is important measure to ensure driving safety and passenger safety.

[0007] 1. The target stealth adversarial sample generation method for traffic information perception proposed in the present application comprises the following steps:

[0008] (1) obtaining the original picture to be detected;

[0009] (2) input the picture to be detected into the YOLOv4 target detection network;

[0010] (3) design an adversarial loss function;

[0011] (4) calculate the loss value of the picture to be detected in the YOLOv4 target detection network;

[0012] (5) calculate the adversarial disturbance using the gradient algorithm;

[0013] (6) limit the adversarial disturbance to the target area using the disturbance clipping method

[0014] (7) add the original picture and the adversarial disturbance to obtain the adversarial sample.

[0015] 2. Further, the target stealth adversarial sample generation method for traffic information perception mainly attacks the YOLOv4 network.

[0016] 3. Further, the target stealth adversarial sample generation method for traffic information perception, the design of the adversarial loss function in step (3) is as follows:

[0017]

[0018] wherein L represents a loss function of a target classification result confidence;

[0019] x represents an input original image;

[0020] N represents a target number in the original image;

[0021] represents a classification result confidence of the original image;

[0022] C represents a classification result confidence of the adversarial sample;

[0023] represents the calculated adversarial perturbation;

[0024] M represents a YOLOv4 target detection network model;

[0025] θ is a network structure parameter of the YOLOv4 target detection network;

[0026] 4. Further, the target stealth adversarial sample generation method for traffic information perception, step (5) uses a gradient algorithm to calculate the adversarial perturbation on the whole picture, and the formula is as follows:

[0027]

[0028] wherein sign() is a sign function;

[0029] is a gradient corresponding to the loss function;

[0030] α is a learning rate;

[0031] t is a certain iteration process;

[0032] x is an input image;

[0033] is the calculated adversarial perturbation;

[0034] 5. Further, the target stealth adversarial sample generation method for traffic information perception, step (6) uses a perturbation interception method to limit the adversarial perturbation in the target area, and the formula is as follows:

[0035]

[0036]

[0037] wherein, is the adversarial perturbation after the image interception;

[0038] I X is the coordinate of the image pixel position;

[0039] b is the coordinate area of a single target;

[0040] B is the resolution size of the image;

[0041] b X is the coordinate area of the target;

[0042] box top , box left , box bottom , box right respectively b X is the minimum value of the horizontal coordinate, the minimum value of the vertical coordinate, the maximum value of the horizontal coordinate, and the maximum value of the vertical coordinate of the coordinate area.

[0043] 6. Further, the traffic information perception-oriented target stealth countermeasure sample generation method, in step (7), the countermeasure sample is obtained by adding the original picture and the countermeasure sample, and the formula is as follows:

[0044]

[0045] wherein, is the countermeasure sample;

[0046] x is the input image;

[0047] is the countermeasure disturbance.

[0048] The beneficial effects of the present application are:

[0049] (1) The gradient algorithm is used to generate the countermeasure sample to attack the YOLOv4 target detection network.

[0050] (2) By simulating digital attacks, the security risks of deep learning algorithms are fully exposed, providing safety effect verification for traffic information perception systems in engineering applications, and through the attack effect, better defense methods are sought in engineering applications. BRIEF DESCRIPTION OF DRAWINGS

[0051] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0052] Figure 1is a general flowchart of a method for generating an adversarial sample for target stealth attack on a YOLOv4 target detection network according to an embodiment of the present application.

[0053] Figure 2 is a tram operation environment original picture according to an experimental example of the present application.

[0054] Figure 3 is a track area and obstacle position coordinate and contour obtained by a target detection network during a tram operation process.

[0055] Figure 4 is a loss function value obtained by a gradient algorithm according to an experimental example of the present application.

[0056] Figure 5 is an adversarial sample generation result picture according to an experimental example of the present application.

[0057] Figure 6 is a detection result picture of an adversarial sample obtained by a target detection network according to an experimental example of the present application. DETAILED DESCRIPTION

[0058] The technical solutions of the present application will be described clearly and completely below with reference to the drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0059] Embodiment 1

[0060] In this embodiment, a method for generating an adversarial sample to perform target stealth on a YOLOv4 target detection network by using a gradient algorithm is provided, Figure 1 is a flowchart of a method for generating an adversarial sample for target stealth attack on a YOLOv4 target detection network according to an embodiment of the present application.

[0061] As shown in Figure 1 , the flowchart includes the following steps:

[0062] (1) obtaining a to-be-detected original picture;

[0063] (2) inputting the to-be-detected picture into a YOLOv4 target detection network;

[0064] (3) designing an adversarial loss function;

[0065] (4) calculating a loss value of the to-be-detected picture in the YOLOv4 target detection network;

[0066] (5) calculating an adversarial perturbation by using a gradient algorithm;

[0067] (6) The adversarial perturbation is limited in the target area by using a perturbation interception method;

[0068] (7) The adversarial perturbation is added to the original picture and the adversarial sample.

[0069] Through the above steps, based on the tram running environment picture, the gradient algorithm is used to generate an adversarial sample to attack the YOLOv4 target detection network. The above steps can successfully generate an adversarial sample attack which can more effectively hide the target of the YOLOv4 target detection network, expose the security risks and problems existing in the neural network, and ensure driving safety.

[0070] The following will be combined Figures 2 to 6 Further details of steps (1) to (6) of the present application will be described.

[0071] Figure 2 The step (1) of the experimental example of the present application is a tram running environment original picture. The pixel range of the picture initially read by the computer is [0, 255], and the pixel value range is converted to [0, 1].

[0072] For comparison Figure 2 At the same time, the Figure 3 The target position coordinates and categories obtained by the YOLOv4 target detection network during the tram running process. The vehicles and pedestrians in the original picture can be identified after the YOLOv4 target detection network calculation, and the specific position of the obstacle target can be accurately positioned with high confidence.

[0073] The present application creatively defines the loss function in step (3), which is as follows:

[0074]

[0075] Wherein, L represents the loss function of the target classification result confidence, and L=0 is set;

[0076] x represents the input original image, as shown in Figure 2

[0077] N represents the number of targets in the original image, N=13;

[0078] represents the classification result confidence of the original image,

[0079] C represents the classification result confidence of the adversarial sample, and in the target stealth attack, the confidence is set to C=0;

[0080] represents the calculated adversarial perturbation, and the initial value is​

[0081] M represents a YOLOv4 target detection network model;

[0082] θ is a network structure parameter of the YOLOv4 target detection network.

[0083] According to the loss function value calculated by the gradient algorithm from formula (1), the experimental example is plotted Figure 4 .It can be seen that the algorithm can make the loss value smaller and smaller, and the loss value becoming 0 means that the detection network cannot identify any target. Figure 4

[0084] The gradient algorithm for calculating the adversarial perturbation on the whole picture in step (5) is improved and redefined, and the formula is as follows:

[0085]

[0086] Wherein, sign() is a sign function;

[0087] is the gradient corresponding to the loss function;

[0088] α is a learning rate, and α is set to 0.1;

[0089] t is a certain iteration process;

[0090] x is an input image;

[0091] is the calculated adversarial perturbation.

[0092] The formula for limiting the adversarial perturbation in the target area by using the perturbation interception method in step (6) is defined as follows:

[0093]

[0094]

[0095] Wherein, is the adversarial perturbation after image interception;

[0096] I X is the image pixel position coordinate;

[0097] b is the coordinate area of a single target;

[0098] B is the resolution size of the image, B=(1920, 1080);

[0099] b X is the coordinate area of the target;

[0100] boxtop ,box left ,box bottom ,box right b X box top ,box left ,box bottom ,box right = (274, 118, 781, 1917).

[0101] The adversarial sample described in step (7) is defined as the addition of the original picture and the adversarial perturbation, and the formula is as follows:

[0102]

[0103] wherein, is the adversarial sample;

[0104] x is the input image;

[0105] is the adversarial perturbation.

[0106] Figure 5 is the adversarial sample picture obtained by using the symbolic gradient algorithm according to the experimental example of the present application. It shows that the algorithm proposed in this paper can generate a human eye that looks normal and almost the same as the original picture.

[0107] Figure 6 is the effect of the adversarial sample picture recognized by the YOLOv4 target detection network. As can be seen from the figure, the YOLOv4 target detection network cannot correctly recognize the pedestrians and vehicles in the adversarial sample picture, indicating that the adversarial sample generation algorithm proposed in this paper is effective.

[0108] After the processing of the steps, the YOLOv4 target detection network cannot correctly recognize the image after adding the adversarial noise, that is, the method successfully generates the adversarial sample for the YOLOv4 target detection network.

[0109] It is known in the art that the traffic information perception system comprises a collection device, a target detection network (YOLOv4 target detection network), an identification and judgment module, and an identification output module, image data of a driving environment is collected by a camera installed at the front end of the cab, the image is input into the corresponding target detection network for target identification, and the identification result is returned to the vehicle. According to the method of the present application, the generated adversarial samples attack the traffic information perception system with the YOLOv4 target detection network, cause the network target detection to appear errors, further expose the security risks and problems of the deep learning algorithm YOLOv4 target detection network, and provide a basis for selecting appropriate perception algorithms and target identification algorithms in engineering applications. If the YOLOv4 target detection network is used in the traffic information perception system, the adversarial samples generated by the method of the present application may cause the traffic information perception system to have identification error faults, threatening traffic safety. The method of the present application finds the mechanism and method that attackers may use to threaten the security of the traffic information perception system, guides researchers to study more effective adversarial sample defense methods and detection methods, and upgrades the defense system, such as processing the input image, adding an adversarial sample detection link, etc., to ensure the safety of the traffic system and driving.

[0110] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, the present application can take the form of complete hardware embodiments, complete software embodiments, or embodiments combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0111] The present application is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The means for implementing each flow or multiple flows and / or blocks Figure 1 The means for implementing each flow or multiple flows and / or blocks

[0112] These computer program instructions can also be stored in a computer-readable storage medium that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable storage medium produce a product including instruction means, which implements the functions specified in the flowcharts and / or block diagrams.Figure 1 one or more processes and / or functions described in the one or more blocks. Figure 1 one or more blocks.

[0113] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operation steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, so that the instructions executed on the computer or other programmable data processing devices provide processes for implementing the functions described in the one or more blocks. Figure 1 one or more processes and / or functions described in the one or more blocks. Figure 1 one or more blocks.

[0114] Obviously, the above embodiments are only examples for clearly illustrating the present application, and are not intended to limit the embodiments. Based on the above description, other different forms of changes or variations can also be made by those skilled in the art. Here, all the embodiments are not required to be exhausted, and the obvious changes or variations derived therefrom are still within the protection scope of the present application.

Claims

1. A method for generating target stealthy adversarial samples for traffic information perception, characterized in that, The method comprises the following steps: (1) obtaining a to-be-detected original picture; (2) inputting the to-be-detected picture into a YOLOv4 target detection network; (3) designing an adversarial loss function; (4) calculating a loss value of the to-be-detected picture in the YOLOv4 target detection network; (5) calculating an adversarial perturbation by using a gradient algorithm; (6) limiting the adversarial perturbation in a target region by using a perturbation clipping method; (7) adding the adversarial perturbation to the original picture to obtain an adversarial sample. The adversarial loss function in step (3) is designed according to the following formula: (1) wherein, a loss function representing a target classification result confidence; represents an input original image; representing the number of targets in the original image; The confidence score representing the classification result of the original image; a confidence of a classification result representing the adversarial sample; representing the computed adversarial perturbation; YOLOv4 represents a target detection network model; is a network structure parameter of the YOLOv4 target detection network; The adversarial perturbation on the whole picture is calculated by using the gradient algorithm in step (5), and the calculation is performed according to the following formula: (2) wherein is a sign function; is the gradient corresponding to the loss function; learning rate; for a certain iteration process; is an input image; is the computed adversarial perturbation; The adversarial perturbation is limited in the target region by using the perturbation clipping method in step (6), and the formula is as follows: wherein, is the adversarial perturbation after image cropping; is the image pixel position coordinate; Coordinate area for single target; is the resolution size of the image; Coordinate area targeted; respectively horizontal coordinate minimum value, vertical coordinate minimum value, horizontal coordinate maximum value, vertical coordinate maximum value of the coordinate region.

2. The target stealth counter sample generation method for traffic information perception according to claim 1, characterized in that, The main target detection network of the attack is the YOLOv4 network.

3. The target stealth counter sample generation method for traffic information perception according to claim 1, characterized in that, The adversarial sample in step (6) is obtained by adding the adversarial sample to the original picture, and the formula is as follows: wherein, is an anti-sample; is an input image; To counteract disturbances.

Images