An adversarial patch concealment enhancement method based on a heat map and style transfer

Abstract

The application provides an adversarial patch concealment enhancement method based on a heat map and style migration, which can generate more concealed adversarial patches compared with existing methods. In view of the problem that the adversarial patches generated by the existing adversarial patch generation technology are extremely inconsistent with the surrounding environment and are very easy to be found by humans, the application designs a multi-model weighted heat map method and a local style migration method based on the explainability of deep learning and the style migration technology. The main task of the application is to locate the best attack position of the patch through the multi-model weighted heat map, then acquire the image of the target position, use the style and content thereof to guide the adversarial patch generation process, and finally generate more concealed adversarial patches. Compared with the existing scheme, the application can be integrated with the surrounding environment in the generation of the adversarial patch, is not easy to be perceived by humans while successfully attacking, and has better practical application effect.

Description

Technical fields:

[0001] This invention discloses an adversarial patching concealment enhancement method based on heatmaps and style transfer, which involves the design of adversarial example attack algorithms in deep learning methods and belongs to the field of artificial intelligence security. Background technology:

[0002] Adversarial examples are created by adding subtle, imperceptible perturbations to images, causing deep learning models to misclassify them. For instance, an image correctly labeled as a panda can be correctly classified by a deep learning model. However, after adding a carefully designed perturbation, the new image, which appears identical to the original to the human eye, will be misclassified as a gibbon by the deep learning model with high confidence. This new image is an adversarial example. Adversarial examples also reveal the vulnerability of deep learning models. Initially, adversarial examples were discovered in image classification tasks. However, current mainstream computer vision tasks, such as semantic segmentation, object detection, and object tracking, all face the threat of adversarial examples.

[0003] Adversarial examples are not limited to digital images. Recent research has shown that adversarial examples can be generated by placing patch-like elements on real objects, enabling them to appear in the real world. For example, placing adversarial patches on road signs can cause autonomous vehicles to receive incorrect instructions when passing them, greatly increasing the risk of traffic accidents. Similarly, placing camouflage pendants with adversarial patches on faces can deceive facial recognition systems, preventing surveillance equipment from identifying individuals. Therefore, adversarial examples can already threaten our daily lives and pose security risks to various industries. Researching methods for generating adversarial patches can deepen our understanding of the principles behind adversarial example generation and the potential vulnerabilities of deep learning models, helping to solve the security problems caused by adversarial examples and truly improve the security and robustness of deep learning models.

[0004] Currently, the main methods for generating adversarial patches are as follows:

[0005] GooglePatch: This attack method generates a patch unrelated to the image. Placing this patch at a specific location within the image can attack a deep learning model, causing it to misclassify the target image. The loss function formula for generating the adversarial patch is as follows:

[0006]

[0007] in, Let be the error label to be output by the network, x be the original image with height H and width W, p be the patch to be generated, t be the transformation of the patch (rotation, scaling, etc.), the patch transformation uses the Expectation over Transformation (EoT) technique, and l be the position where the patch should be placed. A(p, x, l, t) means placing patch p at position l in the original image x through transformation t. X is the set of original images, T is the distribution of patch transformations, and L is the distribution of positions in the original images. The generated patch can be placed on any image to change the output of the target model, but such patches are very obvious to humans.

[0008] DPatch: DPatch simultaneously attacks the bounding box regressor, causing the object detection model to produce incorrect localizations. In targetless attacks, to prevent the object detector from detecting the object's location, it is necessary to maximize the loss of the true class and the bounding box regressor. By placing patches, the model is made to classify the true object as background, as shown in the following formula:

[0009]

[0010] Where, p u This is an adversarial patch that enables untargeted attacks, where y represents the background class and B represents the boundary loss.

[0011] In targeted attacks, the target detector can only detect patches and ignores other real targets. Therefore, it is necessary to minimize the class loss and boundary loss of the patches. The target class is a predefined class, as shown in the following formula:

[0012]

[0013] Where, p c DPatch provides adversarial patches for targeted attacks, where c represents the target class. DPatch migrates adversarial patches to target detection tasks, but the patches it generates can only be applied to digital images and are ineffective in real-world scenarios, and their stealth remains poor. Summary of the Invention:

[0014] The main objective of this invention is to establish a method for enhancing the stealth of adversarial patches based on heatmaps and style transfer, capable of generating more stealthy adversarial patches compared to existing methods. Addressing the issue that existing methods generate adversarial patches with significant contrast to their surroundings, making them easily detectable, this invention designs a multi-model weighted heatmap localization method and a local style fusion method based on heatmaps in deep learning interpretability and style transfer methods in the image domain to generate adversarial patches. The main task of this invention is to locate the optimal attack position of the patch using multi-model weighted heatmaps, then acquire an image of the target location, using its style and content to guide the adversarial patch generation process, ultimately generating a more stealthy adversarial patch.

[0015] The main steps of this invention are as follows:

[0016] Step (1): Preferably, a multi-model weighted heatmap localization method is constructed using a gradient-independent heatmap and a deep learning model with the same input size;

[0017] Step (2): Preferably, a weighted heatmap is generated using a confidence weighting method, and the sliding window algorithm is used to find the region with the largest contribution in the weighted heatmap as the optimal attack region;

[0018] Step (3): Capture the image based on the best attack area, obtain its style and content characteristics, and use it as the initial patch for generating adversarial patches;

[0019] Step (4): Preferably, cosine distance is used as a metric for the distance between the style features and content features of the adversarial patch and the original region image, and a loss function is constructed;

[0020] Step (5): Optionally, the initial patch is iteratively optimized using the Adam optimization algorithm until the patch attack is successful.

[0021] Each step includes the following specific implementation process:

[0022] Step (1.1) selects the Score-CAM method as the method for generating heatmaps to get rid of the model’s dependence on gradients.

[0023] Step (1.2) selects k deep learning models (such as AlexNet, VGG16, ResNet18, etc.) with the same requirement for the size of the input image data to classify the same image, and uses the Score-CAM method to generate k heatmaps A of the same size. k .

[0024] Step (2.1) classify the image as t with confidence. The heatmap is weighted and summed, i.e.:

[0025]

[0026] a t This refers to the salient region of common interest when k models classify an image into category t, and W(·) is the average weighting method.

[0027] Step (2.2) uses a sliding window to select from the salient region a t The placement of the anti-patch in the mid-range positioning system. This is determined by calculating the location of region a. t The optimal attack location for the patch is determined by identifying the sub-region with the largest cumulative contribution. The calculation formula is shown below:

[0028]

[0029] Where h is the height of the adversarial patch, w is the width of the adversarial patch, and i and j are integers in [0, Hh] and [0, Ww].

[0030] Step (2.3) generates a mask of the same size (W×H) as the image based on the coordinates of the optimal attack position of the patch. The adversarial patch and normal sample are then combined based on the mask.

[0031] Step (3.1) uses a mask to extract a local image of the corresponding position in the original image as an initial adversarial patch.

[0032] Step (3.2) combines some feature pooling layers in the model to extract global content features and local style features of the image as a feature extraction model.

[0033] Step (4.1) Calculate the style loss of the adversarial patch and the local style image based on the Gram matrix and cosine distance. With content loss The calculation formula is as follows:

[0034]

[0035]

[0036] Where G(x) represents the Gram matrix of x, which is composed of the inner product of any vectors and is used to represent the correlation between features. The calculation formula is as follows:

[0037]

[0038] F(x) represents the features of x and is the output of the feature extraction model.

[0039] Step (4.2) combines the initialized adversarial patch with the background image and inputs it into the deep learning model to obtain the classification loss. in, The cross-entropy function can be used for calculation. Additionally, The attack can be adjusted based on whether the attack is a targeted or untargeted attack.

[0040]

[0041] Finally, in step (4.3), the classification loss, style loss, and content loss are weighted and combined according to the following formula:

[0042]

[0043] For the final loss function, λ k (k = 1, 2, 3) is a hyperparameter used to control the importance of the k-th loss term.

[0044] Step (5.1) preferably involves optimizing using the Adam optimization algorithm. The optimized patch is then combined with the original image to form a new adversarial example.

[0045] Step (5.2) iterates and optimizes until the adversarial sample is successfully misclassified by the model, at which point the optimization stops and the adversarial patch is output.

[0046] The advantages of this invention include:

[0047] This invention proposes a method for enhancing the stealth of adversarial patches based on heatmaps and style transfer. Compared with existing technologies, its advantages are: existing adversarial patch generation techniques produce adversarial patches that are highly incongruous with their surroundings and easily detected by humans. Furthermore, existing methods for improving the stealth of adversarial patches only imbue the patches with certain semantic information, making them appear more natural, without achieving integration with the environment. This invention designs a multi-model weighted heatmap method and a local style fusion method to generate more stealthy and aggressive adversarial patches, improving the practical application effect of adversarial patches. Attached image description:

[0048] Figure 1 Flowchart of the multi-model weighted heatmap method.

[0049] Figure 2 Flowchart of the method for blending local styles. Detailed implementation method:

[0050] The present invention will be further described in detail below with reference to the accompanying drawings.

[0051] like Figure 1 As shown, firstly, the original image is input into k different models for normal classification, and the salient features of the original image are located using interpretability methods of deep learning. The output of each model is a heatmap and the classification confidence of the corresponding category. Secondly, the classification confidence of the model on the original image is used as the weight of each heatmap, and the resulting heatmaps are combined in a weighted manner. Then, the placement of adversarial patches needs to be located from the salient regions. Using a sliding window, the sub-region with the largest cumulative contribution in the salient regions is calculated. Finally, a mask of the same size as the image is generated, and the mask marking position is the placement position of the adversarial patch.

[0052] like Figure 2As shown, the placement region of the adversarial patch is located based on the multi-model weighted heatmap. The original image of this region is cropped as the local style image, and the remaining image is used as the background image. The initialized adversarial patch is combined with the background image and input into the deep learning model to obtain the classification loss, which can be calculated using the cross-entropy function. Then, features are extracted from the local style image and the adversarial patch, and the style loss and content loss of the adversarial patch and the local style image are calculated based on the Gram matrix and cosine distance. Finally, the classification loss, style loss, and content loss are weighted and combined. Through iterative optimization of the algorithm, the adversarial patch is generated that can blend into the patch placement environment and has an attack effect, reducing visual perceptibility.

[0053] Finally, it should be noted that the present invention can also have many other applications. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and modifications according to the present invention, but these corresponding changes and modifications should all fall within the protection scope of the present invention.

Claims

1. A method for enhancing the concealment of adversarial patches based on heat maps and style transfer, which can generate more concealed adversarial patches compared to existing methods. To solve the problem that the adversarial patches generated by existing adversarial patch generation techniques are extremely inconsistent with the surrounding environment and are very easy to be discovered by humans, a multi-model weighted heat map method and a local style transfer method are designed based on the explainability and style transfer techniques of deep learning. The best attack position of the patch is located by the multi-model weighted heat map method, and then the image at the target position is obtained to guide the adversarial patch generation process by its style and content. Finally, more concealed adversarial patches are generated, including the following steps: Step (1) Select a gradient-independent heat map and a deep learning model with the same input size to construct a multi-model weighted heat map positioning method. Step (2) Generate a weighted heat map using a confidence weighting method, and find the area with the greatest contribution in the weighted heat map as the best attack area using a sliding window algorithm. Step (3) According to the best attack area, the image is intercepted to obtain its style and content features, which are used as the initial patch for generating adversarial patches. Step (4) Use the cosine distance as the distance measurement standard for the style and content features of the adversarial patch and the original region image, and construct a loss function. Step (5) Use the Adam optimization algorithm to iteratively optimize the initial patch until the patch attack is successful. 2.The method for enhancing the concealment of adversarial patches based on heat maps and style transfer according to claim 1, step (1) includes: Step (1.1) Select Score-CAM method as the generation method of heat map to get rid of the dependence of model on gradient. Step (1.2) selects k deep learning models with the same requirement for the size of the input image data to classify the same image, and generates k heat maps A of the same size using the Score-CAM method k . 3.The method for enhancing the concealment of adversarial patches based on heat maps and style transfer according to claim 1, step (2) includes: Step (2.1) Confidence of the classification of the image into t The heat map is weighted summed, i.e.: a t i.e. the salient regions that are commonly focused on by k models when classifying an image into class t, and W(·) is the averaging weighting manner. Step (2.2) uses a sliding window to select from the salient region a t The placement of the anti-patch in the mid-range is determined by calculating the location of the target region a. t The optimal attack location for the patch is determined by identifying the sub-region with the largest cumulative contribution, using the following formula: Where h is the height of the adversarial patch, w is the width of the adversarial patch, and i and j are integers in [0, H-h] and [0, W-w]. Step (2.3) According to the coordinates of the best attack position of the patch, a mask with the same size (WxH) as the image is generated, which is used to combine the adversarial patch and the normal sample later. 4.The method for enhancing the concealment of adversarial patches based on heat maps and style transfer according to claim 1, step (3) includes: Step (3.1) Use the mask to intercept the local image at the corresponding position of the original image as the initial adversarial patch. Step (3.2) Combine part of the feature pooling layers in the model as a feature extraction model to extract the global content features and local style features of the image. 5.The method for enhancing the concealment of adversarial patches based on heat maps and style transfer according to claim 1, step (4) includes: Step (4.1) calculates the style loss of the adversarial patch and the local style image according to the Gram matrix and the cosine distance with the content loss The calculation formula is as follows: Where G(x) represents the Gram matrix of x, which is composed of the inner product between any vectors and is used to represent the correlation between features. The calculation formula is as follows: F(x) represents the features of x, which is the output of the feature extraction model. Step (4.2) combines the initialized adversarial patch with the background image, inputs it into the deep learning model, and obtains the classification loss wherein, The cross-entropy function can be selected for calculation, in addition, It can be adjusted according to whether the attack purpose is a targetless attack or a targeted attack, that is: Step (4.3) Finally, the classification loss, style loss, and content loss are combined according to the following formula: For the final loss function, λ k (k = 1, 2, 3) is a hyperparameter to control the importance of the kth term of loss.

6. The method of claim 1, wherein step (5) comprises: Step (5.1) is preferably optimized using the Adam optimization algorithm and the optimized patch is combined again with the original image to form a new adversarial sample; Step (5.2) continuously iterates optimization until the adversarial sample is successfully misclassified by the model, i.e., stop optimization, and output the adversarial patch at this time.

Images