A general adversarial sample generation method for a YOLO model

Abstract

The present application relates to the technical field of network security, and discloses a general adversarial sample generation method for a YOLO model.By analyzing the detection model composition of the YOLO algorithm, the present application proposes an optimization algorithm for synchronous gradient descent of two subtasks of target existence and classification identification in the YOLO algorithm, and maximizes the ability to generate adversarial samples at the optimal positions of target existence and classification identification, thereby providing robustness and universality of the adversarial samples.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a general adversarial sample generation method for a YOLO model. BACKGROUND

[0002] Deep neural networks (DNNs) have been rapidly developing in recent years and are widely used in intelligent health, autonomous driving and other intelligent scenarios. The deep integration of artificial intelligence into our work and life has become a trend. Under the strong demand of the industry, new breakthroughs in algorithms, models and applications based on artificial intelligence are constantly being made. Summarizing the results of the ImageNet Large Scale Visual Recognition Challenge (ILSVRC) from 2010 to 2017, the error rate of the classification task decreased from 0.28 to 0.02, and the average accuracy of the object detection task increased from 0.23 to 0.73.

[0003] Compared with image classification tasks, object detection not only needs to complete classification, but also needs to find the location of the target in advance. Therefore, the object detection task is closer to reality and is easier to deploy in specific real-world scenarios. Current object detection methods are mainly divided into two categories: 1) one stage, such as the YOLO (You Only Look Once) series of algorithms, SSD, etc.; 2) two stages, such as R-CNN, Fast R-CNN and Faster R-CNN. The difference between the two algorithms is that the two-stage algorithm first generates proposals and then performs fine-grained object detection, while the one-stage algorithm model directly extracts features for object classification and position prediction. Compared with the two-stage algorithm, the one-stage algorithm has better real-time performance, although the accuracy is slightly lower.

[0004] The algorithm security of deep learning models is attracting more and more attention. Compared with traditional security threats, the algorithm security of deep learning systems is more covert and stubborn. It has been proven that machine learning-based classifiers are vulnerable to adversarial samples. Related literature summarizes various adversarial sample attack methods for deep learning classification networks. At the same time, new models such as automatic encoders, recurrent neural networks and deep reinforcement learning also face adversarial sample attacks. The generated adversarial samples can be robust and resistant to various image transformations. Therefore, we cannot rely solely on image transformation methods such as scaling, transformation and rotation to solve the adversarial problem.

[0005] Adversarial samples originate from the inherent vulnerability and uninterpretability of neural networks. Therefore, the threat of adversarial samples is ubiquitous regardless of the object of the identification task, whether it is an image, a video, a voice, or a text. Taking the image identification task as an example, there are mainly two generation schemes for adversarial samples: 1) PATCH-based scheme, such as adversarial PATCH, DPATCH; 2) pixel-based scheme, such as FGSM, PGD, etc. The PATCH-based attack has more practical applications and can be easily realized by printing the PATCH, which will interfere with the classification and identification task. However, the PATCH usually does not contain any physical meaning and has a distinct shape, usually a square or a circle, so it is easy to be detected by the human eye. The pixel-based scheme often needs to make large-scale small pixel modifications to the original sample that cannot be detected by the human eye. These tiny modifications are usually made in the image domain, so it is difficult to reproduce in the physical domain. However, in smart medical care, especially in remote medical care, pathological images are usually stored in computers, so it is of great significance to study adversarial sample attacks for secure smart medical care scenarios.

[0006] Compared with the classification task, the adversarial attack of target detection has greater difficulty, which is specifically reflected in 1) the structure of the target detection task is more complex. 2) The target detection algorithm can have multiple targets, and the classification task is mostly single target. YOLO is a widely used target detection algorithm that can complete fast target recognition and classification and achieve high recognition accuracy. In recent years, there have been many adversarial sample attacks against the YOLO algorithm. Due to the physical realizability, most of these attacks are based on PATCH. These attack algorithms cause the average precision (mAP) of YOLO to drop significantly. However, the existing PATCH-based algorithms have the problems of time-consuming training and poor robustness. For example, DPATCH requires about 200k training iterations.

[0007] In order to achieve accurate detection, YOLO completes three sub-tasks: 1) whether the object exists (called target existence sub-task). 2) Where the target exists, that is, the bounding box (named boundary sub-task). 3) What is the classification of the object (named classification sub-task). Previous YOLO attack methods usually attack all three sub-tasks. According to the principle of Cannington's law, if the performance of any one of the three tasks drops significantly, the overall recognition accuracy of YOLO will also drop sharply. SUMMARY

[0008] The present application focuses on the following three problems: 1) Which of the three sub-tasks is the short board. 2) How to use the short board to implement the attack. 3) How is the data set transferability of this attack. In the invention, the proposed algorithm is a patch-based adversarial attack. Of course, pixel-based algorithms are also feasible.

[0009] The technical solution adopted in this invention is as follows:

[0010] A general adversarial example generation method for the YOLO model includes the following steps:

[0011] Step 1. Input a random size [x,y] and generate a tensor of size [3,x,y] as an initial noise block;

[0012] Step 2. Place the noise block at a random position in the image to generate an image with interference, and randomly rotate the image within a set angle range and add Gaussian white noise;

[0013] Step 3. Define the loss function required for training, as follows:

[0014] Loss = Lossb box +a obj *Loss obj +a cls *Loss cls

[0015]

[0016] In the formula, Loss bbox For bounding box error estimation, Loss obj For existing object confidence estimation, Loss cls For object classification estimation, a obj and a cls This is used to adjust the descent rate of the target existence loss and target classification loss during gradient descent iterations, ultimately reaching the optimal value; n is the resolution, a obj and a cls The value is determined by acc i Decision, acc i This represents the i-th mAP during the training process of a single subtask. mAP is an indicator of the recognition rate of a deep neural network. Training a single subtask means that the loss function Loss during the training process only includes Loss. obj Or Loss cls One of them;

[0017] Step 4. Input the image generated in Step 2 into the YOLO model, iteratively update the noise block according to the loss function results defined in Step 3, return to Step 2, and continue until the attack is successful to obtain the final adversarial sample.

[0018] The advantages of this invention are:

[0019] 1. This invention is the first to deeply analyze the target classification and recognition mechanism of the YOLO algorithm, and to thoroughly evaluate the ability of different sub-tasks to withstand adversarial sample attacks, and select the most effective attack point based on the barrel principle.

[0020] 2. This invention proposes a scheme to exploit the weaknesses of YOLO adversarial examples. The convergence of different sub-tasks (including classification and target presence) is evaluated using an attack response algorithm. Ultimately, it was found that there is no significant weakness between classification and target presence. However, the convergence speeds of the two sub-tasks differ.

[0021] 3. This invention proposes a synchronization optimization scheme during multi-task training. The optimization scheme is achieved by modifying the loss function. During the generation of adversarial examples, the parameters of the loss function are dynamically adjusted according to changes in recognition accuracy to control the optimization speed of different sub-tasks, ultimately achieving synchronized optimization. Attached Figure Description

[0022] Figure 1 This is a flowchart illustrating the implementation of the present invention. Detailed Implementation

[0023] Step 1. Input a random size [x,y] and generate a tensor of size [3,x,y] as the initial noise block (PATCH).

[0024] In previous studies, the patterns obtained through training were often much smaller than the input image. During training, gradient descent was used to optimize the input pattern. A key detail is that the update variables obtained from the backpropagation of the neural network have the same dimension as the input image, which is much larger than the pattern size. Therefore, the aforementioned literature generally uses a masking method to update the pattern. Since the pattern size is much smaller than the image, the masking method has to discard most of the update variables, which obviously reduces the efficiency of adversarial example training.

[0025] To improve the efficiency of attack training and increase the robustness of generated adversarial examples, many papers employ image augmentation methods that insert patches into different positions within the image. However, simply translating the patch within the image is insufficient; 2D images are susceptible to transformations influenced by the real world, including rotation and noise addition. In this invention, in addition to translation, rotation and noise addition are incorporated into the patch training process. Specifically, for an 8bpp color image, a random tensor of size [3, x, y] is randomly selected within the range [0, 255] as the initial block for training, where [x, y] is the set patch block size. Before the patch block is randomly added to a position in the image, it needs to be randomly rotated and an appropriate amount of noise is added.

[0026] Step 2. Place the noise block at a random position in the image to generate an image with interference, and randomly rotate the image within a set angle range and add Gaussian white noise;

[0027] Since the size of the patch is not proportional to the attack ability. That is, the 80*80 size of the patch is not better than the 20*20 patch in some class attacks. In order to simplify the model training, we compromise to use the fixed size of 30*30 of the adversarial block to attack, and the size of the input image of the attack model is 320*320. When training, in order to improve the robustness of the adversarial sample, the adversarial sample is rotated r, added to the input image according to the random position s after adding noise n.

[0028] The boundary of the adversarial sample is defined as [x P ,y P ,w P ,h P ], and the center is determined by s. That is, the adversarial sample patch (denoted by P) can be regarded as an object to be detected in the image, and the boundary box is [c,x P ,y P ,w P ,h P ]. For the targetless attack, set c=-1. The specific training process is as follows. There are seven input parameters in the patch training:

[0029] Patch size. The default patch size of the adversarial sample is 30*30;

[0030] Rotate. Taking a monitoring video as an example. Outdoor cameras may be damaged by natural environment or human, so that the camera is tilted. Therefore, even after the rotation occurs, the adversarial sample should be able to successfully attack. The range of the rotation angle is set to: -30°≤rotate≤30°.

[0031] Noise. In the actual environment, the image taken by the front-end device is easily affected by the natural environment and network transmission, and it is inevitable to add noise to the image, so the anti-noise training of the adversarial sample is also necessary. We set the noise added to the adversarial sample to not more than 5%.

[0032] Shift position. In order to ensure that the adversarial sample can be added to any position of the image, an effective attack can be launched.

[0033] Dataset. The labeled image set used for training and testing.

[0034] Attack target. The invention takes the targeted attack as an example. For the targetless attack, the scheme is still effective.

[0035] In the training process, PATCH is inserted into any position of the image, and the training robustness is improved by adding noise and random rotation. According to the size and insertion position of the PATCH, the target bounding box of the image is updated, and the label of the bounding box is set according to the attack target. After forward propagation, the prediction value pred is obtained, and the corresponding loss function is calculated according to the attack target. After back propagation, one round of PATCH update is completed.

[0036] Step 3. Define the loss function required for training as follows:

[0037] Loss = Lossb box + a obj * Loss obj + a cls * Loss cls

[0038]

[0039] In the formula, Loss bbox is the bounding box error estimate, Loss obj is the existing object confidence estimate, Loss cls is the object classification estimate, a obj and a cls are used to adjust the descending speed of the target existence loss and the target classification loss in the gradient descent iteration process, and finally reach the optimum; n is the resolution, and the values of a obj and a cls are determined by acc i , acc i represents the ith mAP in the single sub-task training process, and mAP is an index of the recognition rate of the deep neural network. Single sub-task training refers to the training process in which the loss function Loss only contains one of Loss obj or Loss cls .

[0040] Finally, the complete form of Loss is:

[0041] Loss = Lossb box + a obj * Loss obj + a cls * Loss cls

[0042]

[0043]

[0044]

[0045] YOLO detection is a regression problem. In the image detection process, an image is divided into SxS regions, each of which is responsible for predicting B bounding boxes and classifying C target classes. According to experience, S is 7 and B is 2. Corresponding to the above formula, represents the actual size and position of the jth frame of the ith region of the image, is the size and position of the corresponding predicted frame, and is the corresponding object existence identifier, taking the value 1 (exists) or 0 (does not exist), is the target prediction value, is the prediction confidence after the sigmoid function, taking the value range [0, 1]. λ coord , λ noobj are the weights of the two loss functions, both of which are set to 5 by default; when the object exists in the jth frame of the ith region of the image when the object does not exist in the jth frame of the ith region of the image classes is the set of classification categories.

[0046] Under the COCO dataset, when the resolution n is set to 3, the PTACH size is 30*30, a obj is 0.57, and a cls is 0.13.

[0047] Step 4. Input the image generated in step 2 into the YOLO model, and iteratively update the PATCH according to the loss function result defined in step 3, return to step 2 until the attack is successful, and get the final adversarial sample.

Claims

1. A general adversarial sample generation method for a YOLO model, characterized in that, The process includes the following steps: Step 1. Input random size [x, y] and generate a tensor of size [3, x, y] as an initialization noise block; Step 2. Place the noise block at a random position of the image to generate a disturbed image, and randomly rotate the image within a certain angle range and add Gaussian white noise; Step 3. Define the loss function required for training as follows: Loss = Loss bbox + a obj * Loss obj + a cls * Loss cls In the formula, Loss bbox is the bounding box error estimation, Loss obj is the existing object confidence estimation, Loss cls is the object classification estimation, a obj and a cls are used to adjust the descending speed of the target existence loss and the target classification loss in the gradient descent iteration process, and finally reach the optimum; n is the resolution, a obj and a cls values are determined by acc i , acc i represents the i-th mAP in the single sub-task training process, and mAP is an index of the recognition rate of the deep neural network. The single sub-task training refers to the loss function Loss in the training process only contains one of Loss obj or Loss cls . Step 4. Input the image generated in step 2 into the YOLO model, and iteratively update the noise block according to the result of the loss function defined in step 3, return to step 2 until the attack is successful, and get the final adversarial sample.

Images