A method and system for generating customizable adversarial patches

Abstract

The application discloses a method and system for generating customizable adversarial patches, belonging to the fields of image processing and adversarial attack, and comprising the following steps: inputting a content target image into an image conversion network; the image conversion network is used for converting the content target image into an adversarial patch; content features and style features are introduced into the adversarial patch through a content loss function and a style loss function respectively, and the attack of the adversarial patch is enhanced through a target loss function; and the image conversion network outputs the adversarial patch. In the application, the adversarial patch is customizable, and the visual concealment of the adversarial patch is greatly improved while good physical attack effect is obtained.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of image processing and adversarial attack, and particularly relates to a method and system for generating customizable adversarial patches. BACKGROUND

[0002] Adversarial attack refers to making a model based on a deep neural network make a wrong judgment with high confidence by designing a special perturbation. Unlike other attacks, adversarial attack mainly occurs in the model inference stage, and the model itself is not changed, only the input of the model is modified, and a good attack success rate can be achieved. In recent years, adversarial attack has been widely used in attacking deep neural networks and is an important research direction in the field of computer vision.

[0003] In the current field of artificial intelligence, deep neural networks have achieved great success in many application scenarios such as image classification, object detection, image segmentation, etc. However, they are easily affected by adversarial samples, i.e. they are very vulnerable when facing adversarial attacks. Moreover, the phenomenon of adversarial attack not only exists in the digital space, but also occurs in the real physical world in many tasks based on deep neural networks, which raises people's concerns about the security of artificial intelligence.

[0004] Adversarial patches are often used to perform adversarial attacks in the physical world. Instead of limiting the perturbation to changes that are difficult for humans to detect, a special patch block is generated in a small, local, and perturbation-unconstrained area. Adversarial patches have the characteristics of robustness, universality and robustness, and are widely used in tasks of attacking pedestrian detectors. However, the appearance and color distribution of current adversarial patches are quite conspicuous, causing a strong visual impact on people. In practical applications, when attackers use such adversarial patches to launch attacks in the physical world, they will attract the attention of defenders. That is, the current adversarial patches lack visual concealment, although they can effectively escape the recognition of detectors, but they cannot escape the recognition of humans. SUMMARY

[0005] In view of the defects in the prior art, the purpose of the present application is to provide a method and system for generating customizable adversarial patches. The adversarial patches are customizable, which greatly improves their visual concealment while achieving good physical attack effect.

[0006] To achieve the above purpose, on the one hand, a method for generating customizable adversarial patches is adopted, which comprises the following steps:

[0007] inputting a content target image into an image conversion network;

[0008] The image conversion network is used for converting the content target image into an adversarial patch, wherein the content feature and the style feature are introduced into the adversarial patch through a content loss function and a style loss function, and the adversarial patch is enhanced in attackability through a target loss function.

[0009] The image conversion network outputs the adversarial patch.

[0010] Preferably, the image conversion network is a U-Net network structure, and the training adopts a stochastic gradient descent method and a weighted combination of a minimum loss function.

[0011] Preferably, the content target image is a cartoon image, and a cartoon image dataset is prepared in advance during the training of the image conversion network, and the training and testing are performed on a pedestrian image dataset INRIAPerson.

[0012] Preferably, the content loss function is as follows:

[0013]

[0014] wherein p is the adversarial patch, f c is a three-channel feature map C c ×H c ×W c extracted from the cth layer of a pre-trained VGG-16 neural network, and I con represents the content target image.

[0015] Preferably, the style feature of an artistic image is introduced into the adversarial patch through a style loss function , and the style loss function is as follows:

[0016]

[0017] wherein f s is a three-channel feature map C s ×H s ×W s extracted from the sth layer of a pre-trained VGG-16 neural network, G represents a Gram matrix of deep features extracted from a series of style layers, and I sty represents the style target image.

[0018] Preferably, the YOLOv2 model attacked by the adversarial patch is a single-stage strategy object detector, each anchor box of which contains a vector [x, y, w, h, p obj , p class1 , p class2 ,...p classn ], and a triple [B, P obj , Pclass ] to represent the output of the detector, define the object loss function s.t.P class = 0 to attack the detector.

[0019] Preferably, the target loss function is defined as:

[0020]

[0021] wherein λ1 to λ3 represent the weights of the loss units, which are used to weigh multiple targets; represents the target loss, represents the unprintable score loss, represents the total change loss; and ensure that the adversarial patch can be applied to the real world; and respectively control semantic content, style features and texture structure by an optimizer for minimization; and all represent loss units.

[0022] Preferably, the image conversion network randomly scales the image pasted with the adversarial patch in each iteration during the training process.

[0023] Preferably, the INRIAPerson selects samples with a height of a pedestrian greater than 100 pixels through preprocessing, and the selected images are divided into a training set and a test set.

[0024] In another aspect, a system for generating a customizable adversarial patch is provided, comprising an image conversion network for converting a content target image into an adversarial patch;

[0025] The image conversion network comprises:

[0026] a content loss function module for introducing content features into the adversarial patch;

[0027] a style loss function module for introducing style features into the adversarial patch;

[0028] a target loss function module for enhancing the attackability of the adversarial patch.

[0029] One of the above technical solutions has the following beneficial effects:

[0030] The image conversion network can generate an adversarial patch that is customizable, stylized, content diversified and has good physical attack effect. The image conversion network balances customizability and attackability.

[0031] In order to improve the customizability of the adversarial patch, the present application extracts the content features from the cartoon image and introduces the artistic style features into the adversarial patch. Unlike previous work that only considers the structure and texture features of the patch, the present application makes full use of the stylized features.

[0032] A large number of experimental evaluations show that the customizable adversarial patch proposed by the present application successfully achieves effective attacks on human body detection models in digital and physical spaces, and has more aesthetic sense in human perception compared with other adversarial patches.

[0033] By analyzing the differences between the attack effects of different style patches, the present application finds and summarizes a rule: the style with higher color saturation and richness has stronger attack effect, and vice versa. This discovery provides a new clue for researchers to explore the attack mechanism of adversarial patches. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 is a real-time scene schematic diagram of the present application;

[0035] Figure 2 is a schematic diagram of generating an adversarial patch in the image conversion network of the embodiment of the present application;

[0036] Figure 3 is a schematic diagram of large-scale training of the image conversion network of the embodiment of the present application;

[0037] Figure 4 is a schematic diagram of comparison of visual quality and attack effect under different weights λ1 of the embodiment of the present application;

[0038] Figure 5 is a schematic diagram of digital space attack effect of the adversarial patch of the embodiment of the present application;

[0039] Figure 6 is a schematic diagram of comparison of attack effect of the adversarial patch of the embodiment of the present application with other existing methods;

[0040] Figure 7 is a schematic diagram of physical space attack effect of the adversarial patch of the embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical scheme and advantages of the present application clearer and more apparent, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. In addition, the technical features involved in each embodiment of the present application described below can be combined with each other as long as they do not conflict with each other.

[0042] Reference Figure 1For an embodiment scenario of the present application, the embodiment scenario designs an attack against a patch. A target detection model is used to recognize an input image, and the initial image belongs to a category A. After adding an adversarial patch to the initial image, the image is input into the target detection model, and the recognition result output by the target detection model is a category B or cannot be recognized. This attack method, which intentionally adds interference to the input sample and causes the model to give an incorrect output with high confidence, is called an adversarial attack.

[0043] The present application provides an embodiment of a method for generating a customizable adversarial patch, comprising the steps of:

[0044] inputting a content target image into an image conversion network; the image conversion network is used to convert the content target image into an adversarial patch, wherein the content features and style features are introduced into the adversarial patch through a content loss function and a style loss function, and the attack of the adversarial patch is enhanced through a target loss function; and the image conversion network outputs the adversarial patch.

[0045] The image conversion network described above is a U-Net network structure, and is trained and tested on a commonly used pedestrian image dataset INRIAPerson. An embodiment of a generation process of the image conversion network is provided below, and reference is made to Figure 2 , and the specific steps are as follows:

[0046] S1. Prepare a dataset. The content target image can be a cartoon image. When training the image conversion network, a cartoon image dataset can be downloaded from the Internet in advance, which is used to train and test the image conversion network to generate an adversarial patch. In this embodiment, the cartoon image dataset contains 105 images with a resolution of 3x256x256. The INRIAPerson dataset is a set of images containing standing or walking pedestrians. The dataset is preprocessed by setting conditions; specifically, the samples with a pedestrian height greater than 100 pixels are selected through the annotation box information of the annotation file. In this embodiment, a total of 902 images are obtained, of which 614 images are used as a training set and 288 images are used as a test set to evaluate the attack performance of the adversarial patch on the YOLOv2 model.

[0047] S2. Train an end-to-end image conversion network TF with a U-Net network structure, so that the low-level and high-level information in the image can be utilized in the network first, and the parameters thereof are weights W1. The input image is converted into the output adversarial patch through mapping, and the training of the image conversion network adopts a random gradient descent method combined with a weighted combination of a minimum loss function.

[0048] The training process of step S2 described above further includes the following steps:

[0049] S201. Introduce semantic content to the adversarial patch. In order to solve the problem of the adversarial patch appearing conspicuous and visually discordant, considering that images with visual semantics are more harmonious in the crowd than meaningless graffiti, the embodiment not only improves the structural features and texture features of the patch from the three aspects of the overall change of the image, the rationality of the patch and the use of the seed patch, but also introduces content features into the generated adversarial patch through a content loss function Figure 2 The content loss function is defined as:

[0050]

[0051] Wherein, p is the adversarial patch generated in the application, f c is a three-channel feature map C c ×H c ×W c , I con represents the content target image.

[0052] S202. Introduce artistic style to the adversarial patch, disguise the adversarial patch. The existing adversarial patch generation method only considers adding structural features and texture features, but style as an important feature of the image has not been utilized. The application combines the style transfer technology, and introduces the style features of artistic images into the adversarial patch through a style loss function , on the one hand, increases the aesthetic elements of the patch, and on the other hand, the artistic style can also be used as a disguise for the adversarial disturbance. See Figure 2 The style loss function is defined as:

[0053]

[0054] Wherein, f s is a three-channel feature map C s ×H s ×W s , G represents the Gram matrix of the deep features extracted from a series of style layers, I sty represents the style target image, see Figure 2 the camouflage style image.

[0055] S203. In order to increase the physical attack ability in the real space, the YOLOv2 model attacked by the adversarial patch is a single-stage strategy object detector, and each anchor box contains a vector [x, y, w, h, p obj , p class1 , p class2 ,... p​classn ] to represent the output of the detector, define the object loss function obj , class ] to represent the output of the detector, define the object loss function s.t. P class = 0 to attack the detector.

[0056] The adversarial patch is enhanced by the target loss function, which is defined as:

[0057]

[0058] where Physical attack is the physical attack, stylized patch is the stylized patch, which is equivalent to the linear combination of multiple loss units and . λ1 to λ3 represent the weights of the loss units, which are used to balance multiple targets, representing the target loss, representing the unprintable score loss, representing the total change loss; and ensure that the adversarial patch can be applied in the real world; and are minimized by the optimizer, respectively controlling the semantic content, style features and texture structure. The three loss functions ensure that the image conversion network can generate stylized adversarial patches. The influence of different visual aesthetics and attack effects can be seen in Figure 4 .

[0059] In previous studies, the size of the image input to the detector is fixed. However, in the application of the physical world, the object detector may be input with images of different sizes, so the image needs to be scaled to the appropriate size matching the detector. Since the adversarial patch is scaled together with the target image, this reduces the attack effect of the adversarial patch.

[0060] Taking this into account, in order to enhance the attack robustness of the adversarial patch, the image with the pasted adversarial patch is randomly scaled at each iteration in the above training process. See Figure 3 . The scaling operation promotes the generated adversarial patch to obtain scaling-invariant attack features, which is more conducive to physical attacks.

[0061] After training the image conversion network according to the above method, the input content target image can output a customized adversarial patch. See Figure 5The combination of different content target images and style target images can generate diverse and customizable adversarial patches. Compared with the original image, the pasted cartoon image and the pasted noise image, only the generated adversarial patch can effectively attack the object detector.

[0062] The present application also provides a system for generating customizable adversarial patches, which can be used to implement the above-mentioned method embodiments, comprising an image conversion network for converting content target images into adversarial patches. The image conversion network comprises:

[0063] a content loss function module for introducing content features into the adversarial patch;

[0064] a style loss function module for introducing style features into the adversarial patch;

[0065] a target loss function module for enhancing the attackability of the adversarial patch.

[0066] Table 1 below is a comparison of the factors considered by the present application and existing methods for generating adversarial patches. As can be seen from Table 1, the present application based on the style transfer technology, the method for generating customizable adversarial patches has obvious improvement for the factors considered by the existing methods, and the √ in the table indicates that the factor is considered, and the blank indicates that the factor is not considered.

[0067] Table 1

[0068]

[0069]

[0070] Referring to Figure 6 , the average precision (AP) is shown. The lower the AP, the better the attack effect. The attack effect of the adversarial patch generated by the present application is compared with the adversarial patch generated by other existing methods (including GoogleAP, DPATCH, TextureAP and LAP). The performance of TextureAP and LAP is not shown in the PR curve, and the average precision (AP) of the two is 25.53% and 43.07% respectively. The experimental results show that GoogleAP and DPATCH perform poorly, and only reduce the average precision (AP) to 83.39% and 94.08% respectively. In contrast, the adversarial patch generated by the present application achieves similar attack ability to LAP, reducing the average precision (AP) to 45.92%. In summary, from the perspective of attack ability, the method for generating customizable adversarial patches of the present application can generate adversarial patches that can effectively attack the target detector.

[0071] Referring to Figure 7Three kinds of adversarial patches generated by the present application are printed on white T-shirts, and one person wears them. As a comparison, another person wears a T-shirt with the corresponding original cartoon image. The attack results of the physical space are displayed in three different scenes for comprehensive comparison. It can be observed that in all frame images with different light and background, the target detector can identify the person wearing the original cartoon image, which means that the YOLOv2 model has good detection effect. On the contrary, the person wearing the adversarial patch cannot be identified by the target detector. The experimental results prove that the adversarial patch generated by the method of the present application has strong attack ability in the physical world.

[0072] The method of the present application is different from the common adversarial patch generation method which only considers the structure and texture features of the image, but fully utilizes the style features of the image, greatly improves the visual aesthetics of the adversarial patch. An image conversion network which can convert any input image into an adversarial patch is proposed in the present application, which can generate self-definable, stylized, content diversified and good physical attack effect adversarial patches, balancing the visual aesthetics and physical attack.

[0073] The above is only an embodiment of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application is included in the scope of the claims of the present application.

Claims

1. A method of generating a customizable adversarial patch, the method comprising: The method comprises the steps of: inputting a content target image into an image conversion network; the image conversion network is used for converting the content target image into an adversarial patch, wherein content features and style features are introduced into the adversarial patch through a content loss function and a style loss function respectively, and the adversarial patch is enhanced in attackability through a target loss function; the image conversion network outputs the adversarial patch; The content loss function is: wherein p to combat the patch, is a three-channel feature map extracted from the c-th layer of a pre-trained VGG-16 neural network , denotes the content target image; by a style loss function introducing style features of an artistic image into the adversarial patch, the style loss function is: wherein is a three-channel feature map extracted from the s-th layer of a pre-trained VGG-16 neural network G denotes a Gram matrix of deep features extracted from a series of style layers, denotes a style target image; The YOLOv2 model against patch attack is a single-stage strategy object detector, each anchor box of which contains a vector , a ternary vector is constructed to represent the output of the detector, and an object loss function is defined to attack the detector.

2. The method of generating a customizable adversarial patch of claim 1, wherein, the image conversion network is a U-Net network structure, and training thereof adopts a stochastic gradient descent method and a weighted combination of a minimum loss function.

3. The method of generating a customizable adversarial patch of claim 2, wherein, The content target image is a cartoon image, and a cartoon image dataset is prepared in advance during training of the image conversion network, and training and testing are performed on an INRIAPerson pedestrian image dataset.

4. The method of generating customizable adversarial patches of claim 1, wherein, The target loss function is defined as: wherein to denote weights of loss units, used to balance multiple objectives; denote objective losses, denote unprintable score losses, denote total variation losses; and ensure that the adversarial patch is applicable to the real world; , and are minimized by an optimizer to control semantic content, style features, and texture structure, respectively; , and all denote loss units.

5. The method of generating a customizable adversarial patch of claim 4, wherein, During the training process of the image conversion network, the image pasted with the adversarial patch is randomly scaled in each iteration.

6. The method of generating a customizable adversarial patch of claim 3, wherein, INRIAPerson screens samples with a pedestrian height greater than 100 pixels through preprocessing, and the screened images are divided into a training set and a test set.

7. A system for generating a customizable adversarial patch based on the method of any of claims 1-6, wherein, The method comprises an image conversion network, which is used for converting a content target image into an adversarial patch; the image conversion network comprises: a content loss function module, which is used for introducing content features into the adversarial patch; a style loss function module, which is used for introducing style features into the adversarial patch; a target loss function module, which is used for enhancing the attackability of the adversarial patch.

Images