Adversarial attack sample generation method and device, and terminal equipment

Abstract

The application is suitable for the technical field of target adversarial attack, and provides an adversarial attack sample generation method, device and terminal equipment, which comprises the following steps: obtaining a target picture, establishing a target detection model based on the target picture; obtaining a gradient attack adversarial sample based on the target picture, a semantic segmentation algorithm and a gradient attack algorithm; obtaining a patch attack adversarial sample based on the target picture, a heat map algorithm and a mask mechanism; and obtaining an adversarial attack sample based on the gradient attack adversarial sample, the patch attack adversarial sample and the target detection model. The adversarial attack sample obtained by the application can improve the ability of avoiding the detection of the opponent target detection algorithm.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of target adversarial attack, and particularly relates to an adversarial attack sample generation method and device and a terminal device. BACKGROUND

[0002] Deep learning has excellent performance due to a large training set, but the amount of data actually accumulated in some fields is far from meeting the requirements of deep learning for training data, and the performance and security thereof will be very low. Therefore, it is urgent to construct and optimize a target detection algorithm, and at the same time, how to interfere with the target detection algorithm of the other party to achieve virtual stealth is currently the top priority. SUMMARY

[0003] The application embodiment provides an adversarial attack sample generation method, device and terminal device to obtain an adversarial attack sample, which can improve the ability to interfere with the target detection algorithm of the other party and avoid detection by the target detection algorithm of the other party.

[0004] The application is implemented by the following technical solutions:

[0005] In a first aspect, the application embodiment provides an adversarial attack sample generation method, comprising:

[0006] obtaining a target picture, and establishing a target detection model based on the target picture;

[0007] obtaining a gradient attack adversarial sample based on the target picture, a semantic segmentation algorithm and a gradient attack algorithm;

[0008] obtaining a patch attack adversarial sample based on the target picture, a heat map algorithm and a mask mechanism;

[0009] obtaining an adversarial attack sample based on the gradient attack adversarial sample, the patch attack adversarial sample and the target detection model.

[0010] In combination with the first aspect, in some possible implementation manners, the gradient attack adversarial sample is obtained based on the target picture, the semantic segmentation algorithm and the gradient attack algorithm, and specifically comprises: using a fully convolutional network semantic segmentation algorithm on the target picture to obtain a mask; using a class activation mapping algorithm on the target picture to obtain an attention mapping map of an input image; converting the attention mapping map into a binary attention mapping map; using a pixel point multiplication algorithm on the binary attention mapping map and the mask to obtain a semantic attention mask; and calculating the gradient attack adversarial sample based on noise, the semantic attention mask and an iterative gradient attack algorithm, the noise being obtained according to the target picture.

[0011] In combination with the first aspect, in some possible implementation manners, the iterative gradient attack algorithm is:

[0012]

[0013] wherein, is a loss function,

[0014] is the gradient with respect to r i , Crop g represents a cropping operation based on a semantic attention mask, Scale ε represents a scaling operation based on a perturbation scale factor ε, α is the size of each modification of pixel values, r i is noise, x adv is a gradient attack adversarial sample.

[0015] With reference to the first aspect, in some possible implementations, the binarized attention map is: wherein, φ = 0.25, m is the attention map, m * is the binarized attention map, m i,j is a value of the attention map at (i, j), is a value of the binarized attention map at (i, j).

[0016] With reference to the first aspect, in some possible implementations, the patch attack adversarial sample is obtained based on the target picture, a heat map algorithm, and a mask mechanism, and specifically includes: using the heat map algorithm and the mask mechanism on the target picture to obtain a feature contribution region; processing the target picture to obtain a preset number of attack patches; using a stochastic gradient descent algorithm to iteratively optimize the attack patches to obtain optimized attack patches; and placing the optimized attack patches in the feature contribution region to obtain the patch attack adversarial sample.

[0017] With reference to the first aspect, in some possible implementations, the process of obtaining the target picture and establishing the target detection model based on the target picture specifically includes: performing picture labeling on the target picture to obtain a target detection dataset; and obtaining the target detection model based on the target detection dataset and a YOLOV4 algorithm.

[0018] With reference to the first aspect, in some possible implementations, the method for generating an adversarial attack sample further includes: generating a target special dataset based on the adversarial attack sample, the target special dataset being used to train the target detection model with the target picture; and performing a rotation operation and a brightness change operation on the adversarial attack sample to obtain an actual adversarial sample.

[0019] Secondly, the embodiment of the present application provides an adversarial attack sample generation device, which includes:

[0020] The acquisition module is configured to acquire a target picture, establish a target detection model based on the target picture, and establish a gradient attack model and a patch attack model.

[0021] The gradient attack module is configured to obtain a gradient attack adversarial sample based on the target picture, a semantic segmentation algorithm, and a gradient attack algorithm.

[0022] The patch attack module is configured to obtain a patch attack adversarial sample based on the target picture, a heat map algorithm, and a mask mechanism.

[0023] The output module is configured to obtain an adversarial attack sample based on the gradient attack adversarial sample, the patch attack adversarial sample, and the target detection model.

[0024] In a third aspect, an embodiment of the present application provides a terminal device, comprising a processor and a memory, the memory being configured to store a computer program, and the processor being configured to implement the adversarial attack sample generation method according to any one of the first aspect when executing the computer program.

[0025] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium storing a computer program, and the computer program being configured to implement the adversarial attack sample generation method according to any one of the first aspect when executed by a processor.

[0026] In a fifth aspect, an embodiment of the present application provides a computer program product, when the computer program product is executed on a terminal device, the terminal device is caused to execute the adversarial attack sample generation method according to any one of the first aspect.

[0027] It can be understood that the beneficial effects of the second aspect to the fifth aspect can be referred to the related description of the first aspect, and will not be repeated here.

[0028] Compared with the prior art, the embodiment of the present application has the following beneficial effects:

[0029] The present application processes the target picture by the method of semantic segmentation algorithm, gradient attack algorithm, heat map algorithm and mask mechanism, so that the gradient attack adversarial sample and the patch attack adversarial sample can both contain complex noise, so that other target detection algorithms cannot detect the corresponding target, thereby improving the ability to attack the opponent's target detection algorithm.

[0030] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present specification. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0032] Figure 1 is an application scenario diagram of the adversarial attack sample generation method provided by an embodiment of the present application;

[0033] Figure 2 is a flow diagram of the adversarial attack sample generation method provided by an embodiment of the present application;

[0034] Figure 3 is a flow diagram of the gradient attack adversarial sample generation method provided by an embodiment of the present application;

[0035] Figure 4 is a diagram of the patch attack adversarial sample generation method provided by an embodiment of the present application;

[0036] Figure 5 is a structural diagram of the adversarial attack sample generation device provided by an embodiment of the present application;

[0037] Figure 6 is a structural diagram of the terminal device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0038] In the following description, specific details such as specific system structures, techniques, etc. are presented in order to thoroughly understand the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits and methods are omitted to avoid unnecessary details that hinder the description of the present application.

[0039] It should be understood that when used in the specification and the appended claims of the present application, the term "comprising" indicates the presence of the described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or sets thereof.

[0040] It should also be understood that the term "and / or" used in the specification and the appended claims of the present application means any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0041] As used in the specification and the appended claims herein, the term “if’ can be interpreted as meaning “when” or “upon” or “in response to determining” or “in response to detecting” depending on the context. Similarly, the phrase “if it is determined” or “if [the described condition or event] is detected” can be interpreted as meaning “upon determining” or “in response to determining” or “upon detecting [the described condition or event]” or “in response to detecting [the described condition or event]” depending on the context.

[0042] In addition, in the description of the present application and the appended claims, the terms “first”, “second”, “third” and the like are used only to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

[0043] In the present application, the reference “one embodiment” or “some embodiments” and the like means that the specific features, structures or characteristics described in connection with the embodiment are included in one or more embodiments of the present application. Therefore, the statements “in one embodiment”, “in some embodiments”, “in other some embodiments”, “in further some embodiments” and the like appearing in different places in the specification are not necessarily all referring to the same embodiment, but mean “one or more but not all embodiments”, unless otherwise specifically emphasized. The terms “include”, “contain”, “have” and their variants mean “include but not limited to”, unless otherwise specifically emphasized.

[0044] For example, the embodiments of the present application can be applied to an exemplary scenario as shown in Figure 1 In this scenario, the target image acquisition device 10 is used to acquire a target image and send the target image to the adversarial attack sample generation device 20, and the adversarial attack sample generation device 20 generates an adversarial attack sample according to the target image, which is used to attack the target detection algorithm of others.

[0045] The adversarial attack sample generation method of the present application will be described in detail below. Figure 1 The adversarial attack sample generation method of the present application will be described in detail below.

[0046] Figure 2 is a schematic flowchart of the adversarial attack sample generation method provided by an embodiment of the present application, and the detailed description of the adversarial attack sample generation method is as follows: Figure 2 The detailed description of the adversarial attack sample generation method is as follows:

[0047] Step 101, acquiring a target picture, and establishing a target detection model based on the target picture.

[0048] For example, the process of acquiring a target picture and establishing a target detection model based on the target picture specifically includes: performing picture labeling on the target picture to obtain a target detection data set; and obtaining a target detection model based on the target detection data set and a YOLOV4 algorithm.

[0049] Specifically, the target picture is labeled using the labelImg tool to obtain a target detection data set in COCO format; the target detection model can output the loss value and the confidence of the target picture; finally, the target is labeled with a rectangle on the picture and the confidence of the classification is displayed.

[0050] Specifically, the target detection model is built using the PyTorch framework, and CSPDarknet53 is used as the backbone network, which has high detection accuracy and fast speed.

[0051] Step 102, based on the target picture, the semantic segmentation algorithm and the gradient attack algorithm, the gradient attack adversarial sample is obtained.

[0052] As shown in the example, Figure 3 Based on the target picture, the semantic segmentation algorithm and the gradient attack algorithm, the gradient attack adversarial sample is obtained, specifically including: using the full convolution network semantic segmentation algorithm on the target picture to obtain a mask; using the class activation mapping algorithm on the target picture to obtain the attention map of the input image; converting the attention map into a binary attention map; using the pixel point multiplication algorithm on the binary attention map and the mask to obtain the semantic attention mask; based on the noise, the semantic attention mask and the iterative gradient attack algorithm, the gradient attack adversarial sample is calculated, and the noise is obtained according to the target picture.

[0053]

[0054] As an example, the iterative gradient attack algorithm is: Wherein,

[0055]

[0056] The loss function is The gradient of r with respect to r i Crop g represents a cropping operation based on the semantic attention mask, Scale ε represents a scaling operation based on the perturbation scale factor ε, α is the size of each modification of the pixel value, r i is the noise, x adv is the gradient attack adversarial sample.

[0057] As an example, the binary attention map is: Wherein, φ = 0.25, m is the attention map, m * is the binary attention map, m i,j is the value of the attention map at (i,j), to binarize the value of the attention map at (i, j).

[0058] Specifically, the iterative gradient attack algorithm in the application adds an iterative process, makes a small modification each time, and disturbs multiple times, so as to avoid excessive jitter. In the attack process of the target detection network, gradient information is used for back propagation each time, and the image input into the network is updated to confuse the network detector and increase the loss to generate an adversarial sample. The previously segmented target vehicle image is added with noise alone to attack the neural network model to generate an adversarial sample containing slight perturbations, which cannot be recognized by the human visual system, and the perturbation range is much smaller than that of the traditional adversarial sample generation method, but it can still make the military target detection model unable to make correct classification.

[0059] Step 103, based on the target picture, the heat map algorithm and the mask mechanism, the patch attack adversarial sample is obtained.

[0060] For example, based on the target picture, the heat map algorithm and the mask mechanism, the patch attack adversarial sample is obtained, which specifically includes: using the heat map algorithm and the mask mechanism on the target picture to obtain a feature contribution area; processing the target picture to obtain a preset number of attack patches; using a stochastic gradient descent algorithm to iteratively optimize the attack patches to obtain optimized attack patches; and placing the optimized attack patches in the feature contribution area to obtain the patch attack adversarial sample.

[0061] Specifically, taking a car as an example: the feature contribution area needs to avoid positions that cannot be set (such as license plates), multiple attack patches can enhance the stealth of the attack patches, and the area of the attack patches should be further reduced, and the shape can be selected to be better placed on the car, thereby improving the patch attack model and realizing the rapid generation of adversarial samples.

[0062] Step 104, based on the gradient attack adversarial sample, the patch attack adversarial sample and the target detection model, an adversarial attack sample is obtained.

[0063] For example, the adversarial attack sample generation method further includes: generating a target special data set based on the adversarial attack sample, the target special data set being used to train the target detection model with the target picture; and performing a rotation operation and a brightness change operation on the adversarial attack sample to obtain an actual adversarial sample.

[0064] Specifically, the target special data set is also mixed with the target picture to train the target detection model and improve the robustness of the target detection model.

[0065] Specifically, the adversarial attack sample needs to be rotated and changed in brightness to migrate from the digital world to the real world, because the adversarial attack sample only attacks the military target detection model at one angle and has no light effect in the digital world. After the rotation and brightness change operation, the actual adversarial sample needs to specify the color of the pattern according to the color that the printer can print, so as to realize the adversarial attack in the real world.

[0066] Specifically, the above image processing uses the RGB color mode, and the actual printed color corresponding to the RGB color mode will have a color difference from the image seen on the computer. If the printer is required to print the actual adversarial sample consistent with the display on the computer, the RGB color mode needs to be converted into the CMYK color mode that the printer can print.

[0067] For example, in some specific embodiments, the loss value of the target picture output by the target detection model will return the corresponding gradient attack adversarial sample and patch attack adversarial sample process for optimizing the generation of the sample, and the loss values of the two processes are not the same.

[0068] The above-mentioned adversarial attack sample generation method processes the target picture through the semantic segmentation algorithm, the gradient attack algorithm, the heat map algorithm and the mask mechanism, so that the gradient attack adversarial sample and the patch attack adversarial sample can both contain complex noise, so that other target detection algorithms cannot detect the corresponding target, thereby improving the ability to attack the opponent's target detection algorithm. In addition, the target special data set can optimize the above-mentioned adversarial attack sample generation method and improve the robustness of the method; the target detection model directly visualizes the confidence and loss value, which is convenient for the identification of the result and improves the efficiency.

[0069] It should be understood that the size of the serial number of each step in the above-mentioned embodiments does not mean the order of execution, and the execution order of each process should be determined according to its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0070] According to the above-mentioned adversarial attack sample generation method, Figure 5 The structure block diagram of the adversarial attack sample generation device provided by the embodiments of the present application is shown, and only the part related to the embodiments of the present application is shown for convenience of description.

[0071] Referring to Figure 5 The adversarial attack sample generation device in the embodiments of the present application can include an acquisition module 401, a gradient attack module 402, a patch attack module 403 and an output module 404.

[0072] Optionally, the acquisition module 401 is configured to acquire a target picture, establish a target detection model based on the target picture, and establish a gradient attack model and a patch attack model.

[0073] For example, the acquisition module 401 is specifically configured to perform picture labeling on the target picture to obtain a target detection data set, and obtain the target detection model based on the target detection data set and a YOLOV4 algorithm.

[0074] Optionally, the gradient attack module 402 is configured to obtain a gradient attack adversarial sample based on the target picture, a semantic segmentation algorithm, and a gradient attack algorithm.

[0075] For example, the gradient attack module 402 is specifically configured to obtain a mask by using a full convolution network semantic segmentation algorithm on the target picture, obtain an attention map of the input image by using a class activation mapping algorithm on the target picture, convert the attention map into a binary attention map, obtain a semantic attention mask by using a pixel point multiplication algorithm on the binary attention map and the mask, and calculate the gradient attack adversarial sample based on noise, the semantic attention mask, and an iterative gradient attack algorithm, the noise being obtained according to the target picture.

[0076]

[0077] For example, the iterative gradient attack algorithm is as follows: wherein,

[0078]

[0079] is a loss function, is the gradient of r i , Crop g represents a cropping operation based on the semantic attention mask, Scale ε represents a scaling operation based on a perturbation scale factor ε, α is the size of each modification of a pixel value, r i is noise, x adv is the gradient attack adversarial sample.

[0080] For example, the binary attention map is as follows: wherein, φ = 0.25, m is an attention map, and m * is a binary attention map, m i,j is a value of the attention map at (i, j), is a value of the binary attention map at (i, j).

[0081] Optionally, the patch attack module 403 is configured to obtain a patch attack adversarial sample based on the target picture, the heat map algorithm, and the mask mechanism.

[0082] For example, the patch attack module 403 is specifically configured to: obtain a feature contribution area by using the heat map algorithm and the mask mechanism on the target picture; process the target picture to obtain a preset number of attack patches; iteratively optimize the attack patches by using a stochastic gradient descent algorithm to obtain optimized attack patches; and place the optimized attack patches in the feature contribution area to obtain the patch attack adversarial sample.

[0083] Optionally, the output module 404 is configured to obtain an adversarial attack sample based on the gradient attack adversarial sample, the patch attack adversarial sample, and the target detection model.

[0084] For example, the output module 404 is further configured to: generate a target special data set based on the adversarial attack sample, the target special data set being used to train the target detection model with the target picture; and perform a rotation operation and a brightness change operation on the adversarial attack sample to obtain an actual adversarial sample.

[0085] It should be noted that the information interaction between the above apparatus / units, the execution process, and the like, since based on the same concept as the method embodiments of the present application, the specific functions and the brought technical effects can be referred to the method embodiments part, and will not be repeated here.

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The above integrated unit can be realized in the form of hardware or software. In addition, the specific names of each functional unit and module are only for easy distinction, and do not limit the protection scope of the present application. The specific working process of the unit and module in the above system can refer to the corresponding process in the method embodiments, and will not be repeated here.

[0087] The present application also provides a terminal device, which is described with reference to Figure 6The terminal device 500 can include at least one processor 510 and a memory 520 configured to store a computer program 521. The processor 510 is configured to invoke and execute the computer program 521 stored in the memory 520 to implement the steps in any of the above method embodiments, for example, steps 101 to 104 in the illustrated embodiment. Alternatively, the processor 510 implements the functions of each module / unit in any of the above apparatus embodiments when executing the computer program, for example, the functions of modules 401 to 404 in the illustrated embodiment. Figure 2 The processor 510 implements the functions of each module / unit in any of the above apparatus embodiments when executing the computer program, for example, the functions of modules 401 to 404 in the illustrated embodiment. Figure 5 The processor 510 implements the functions of each module / unit in any of the above apparatus embodiments when executing the computer program, for example, the functions of modules 401 to 404 in the illustrated embodiment.

[0088] By way of example, the computer program 521 can be segmented into one or more modules / units, which are stored in the memory 520 and executed by the processor 510 to complete the present application. The one or more modules / units can be a series of computer program segments capable of completing a specific function, which are used to describe the execution process of the computer program in the terminal device 500.

[0089] Those skilled in the art can understand that Figure 6 The terminal device is merely an example and does not constitute a limitation on the terminal device, which can include more or fewer components than shown, or combine certain components, or different components, for example, input / output devices, network access devices, buses, etc.

[0090] The processor 510 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0091] The memory 520 can be an internal storage unit of the terminal device, or an external storage device of the terminal device, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. The memory 520 is used to store the computer program and other programs and data required by the terminal device. The memory 520 can also be used to temporarily store data that has been output or will be output.

[0092] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0093] The method for generating an adversarial attack sample provided by the embodiments of the present application can be applied to a terminal device such as a computer, a wearable device, a vehicle-mounted device, a tablet computer, a notebook computer, a netbook, a mobile phone, and the like. The embodiments of the present application do not limit the specific type of the terminal device.

[0094] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps in the above-described method for generating an adversarial attack sample.

[0095] The embodiments of the present application provide a computer program product. When the computer program product is run on a mobile terminal, the mobile terminal is caused to implement the steps in the above-described method for generating an adversarial attack sample.

[0096] The integrated unit, if realized in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the embodiments of the present application can implement all or part of the above-described method by a computer program to instruct related hardware to complete, and the computer program can be stored in a computer readable storage medium. The computer program is executed by a processor to implement the steps of each method embodiment. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer readable medium at least includes any entity or device capable of carrying the computer program code to the photographing device / terminal device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium. For example, U disk, mobile hard disk, magnetic disk or optical disk, and the like.

[0097] In the above embodiments, the description of each embodiment focuses on different aspects, and the parts not described or recorded in a certain embodiment can be referred to the relevant description of other embodiments.

[0098] Those skilled in the art can understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0099] In the embodiments provided in the present application, it should be understood that the disclosed apparatus / network device and method can be implemented in other ways. For example, the apparatus / network device embodiments described above are merely schematic, for example, the division of the modules or units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0100] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0101] The above described embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. An adversarial attack sample generation method, characterized in that, The method comprises the following steps: obtaining a target picture, and establishing a target detection model based on the target picture; based on the target picture, a semantic segmentation algorithm and a gradient attack algorithm, obtaining a gradient attack adversarial sample; based on the target picture, a heat map algorithm and a mask mechanism, obtaining a patch attack adversarial sample; based on the gradient attack adversarial sample, the patch attack adversarial sample and the target detection model, obtaining an adversarial attack sample; the gradient attack adversarial sample based on the target picture, the semantic segmentation algorithm and the gradient attack algorithm, specifically includes: using a fully convolutional network semantic segmentation algorithm on the target picture to obtain a mask; using a class activation mapping algorithm on the target picture to obtain an attention map of the input image; convert the attention map into a binary attention map; using a pixel point multiplication algorithm on the binary attention map and the mask to obtain a semantic attention mask; based on noise, a semantic attention mask and an iterative gradient attack algorithm, the gradient attack adversarial sample is calculated, and the noise is obtained according to the target picture; the patch attack adversarial sample based on the target picture, the heat map algorithm and the mask mechanism, specifically includes: using a heat map algorithm and a mask mechanism on the target picture to obtain a feature contribution area; processing the target picture to obtain a preset number of attack patches; using a stochastic gradient descent algorithm to iteratively optimize the attack patches to obtain optimized attack patches; placing the optimized attack patches in the feature contribution area to obtain the patch attack adversarial sample; The binarized attention map is as follows: ,in, =0.25, m For attention mapping, m * This is a binary attention map. For attention mapping in ( i , j The value at ) For the binarized attention map in ( i , j The value at ().

2. The adversarial attack sample generation method as described in claim 1, characterized in that, The iterative gradient attack algorithm is as follows: ,in, For loss function, for Compared to gradient, This represents a pruning operation based on semantic attention masks. Indicated based on perturbation scale factor Scale operation, To modify the size of the pixel value each time, r i For noise, This is a sample of gradient attack adversarial tactics.

3. The method of claim 1, wherein the method is performed by a computer system. the process of obtaining the target picture and establishing the target detection model based on the target picture, specifically includes: performing picture labeling on the target picture to obtain a target detection dataset; based on the target detection dataset and a YOLOV4 algorithm, the target detection model is obtained.

4. The method of claim 1, wherein, The method for generating an adversarial attack sample further comprises: based on the adversarial attack sample, a target special dataset is generated, and the target special dataset is used to train the target detection model with the target picture; performing a rotation operation and a brightness change operation on the adversarial attack sample to obtain an actual adversarial sample.

5. An adversarial sample generation device, comprising: The method comprises the following steps: an acquisition module is configured to obtain a target picture, establish a target detection model based on the target picture, establish a gradient attack model and a patch attack model; a gradient attack module is configured to obtain a gradient attack adversarial sample based on the target picture, a semantic segmentation algorithm and a gradient attack algorithm; a patch attack module is configured to obtain a patch attack adversarial sample based on the target picture, a heat map algorithm and a mask mechanism; an output module is configured to obtain an adversarial attack sample based on the gradient attack adversarial sample, the patch attack adversarial sample and the target detection model; the gradient attack adversarial sample based on the target picture, the semantic segmentation algorithm and the gradient attack algorithm, specifically includes: using a fully convolutional network semantic segmentation algorithm on the target picture to obtain a mask; using a class activation mapping algorithm on the target picture to obtain an attention map of the input image; convert the attention map into a binary attention map; A pixel point multiplication algorithm is used on the binary attention map and the mask to obtain a semantic attention mask; Based on the noise, the semantic attention mask, and an iterative gradient attack algorithm, a gradient attack adversarial sample is calculated, wherein the noise is obtained according to the target picture; The patch attack adversarial sample is obtained based on the target picture, a heat map algorithm, and a mask mechanism, and specifically includes: A heat map algorithm and a mask mechanism are used on the target picture to obtain a feature contribution area; The target picture is processed to obtain a preset number of attack patches; A random gradient descent algorithm is used on the preset number of attack patches to iteratively optimize the patches, and an optimized attack patch is obtained; The optimized attack patch is placed in the feature contribution area to obtain a patch attack adversarial sample. The binarized attention map is as follows: ,in, =0.25, m For attention mapping, m * This is a binary attention map. For attention mapping in ( i , j The value at ) For the binarized attention map in ( i , j The value at ().

6. A terminal device, characterized by comprising: It includes: A processor and a memory for storing a computer program, wherein the processor is used to call and run the computer program stored in the memory to execute the adversarial attack sample generation method according to any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, wherein the computer program comprises the following steps of: The computer program is executed by the processor to implement the adversarial attack sample generation method according to any one of claims 1 to 4.

Images