A method for generating adversarial samples based on low-perceptual perturbations in key areas

Abstract

The present invention discloses an adversarial sample generation method based on low-perceptual perturbation of key areas, comprising: obtaining an original image containing an adversarial target; inputting the original image into a preset adversarial sample generation network to obtain an adversarial sample; the adversarial sample generation network comprises a perception module and a generator; inputting the original image into the perception module to obtain a perception area mask; inputting the original image into the generator to generate an initial perturbation; filtering the initial perturbation through a smoothing filter module and multiplying the perceptual area mask by the perceptual area mask to obtain a final perturbation; superimposing the final perturbation with the original image to generate an initial adversarial sample; calculating the network loss L between the initial adversarial sample and the original image; iteratively optimizing the adversarial sample generation network according to the network loss L; and converting the original image into a final adversarial sample using the optimized adversarial sample generation network; the generated adversarial sample is closer to the real image, thereby improving the imperceptibility of the adversarial sample.

Description

Technical Field

[0001] The present invention belongs to the technical field of image signal processing, and in particular relates to a target detection method based on low-perceptual disturbance of key areas. Background Art

[0002] Currently, adversarial example generation methods for object detection are mainly divided into those based on gradient optimization and generative adversarial networks (GANs). Gradient optimization methods optimize the adversarial perturbation through multiple iterations until the model outputs an incorrect result. Typical methods include DAG (Dense Adversarial Generation), RAP (Robust Adversarial Perturbation), and Daedalus. However, these methods are computationally intensive, with the average adversarial example generation time reaching approximately 10 seconds or more.

[0003] The GAN-based method trains a generative network for generating adversarial perturbations. Adversarial samples are quickly generated during the inference phase, which improves the efficiency of the attack. Classic methods include UEA (Unified and Efficient Adversary) and FA (AFast Method to Attack Real-time Object Detection Systems). The GAN-based adversarial attack method greatly reduces the generation time of adversarial samples, but has the following problems: 1) Due to the limitations of the structural performance and optimization methods of the generative network, the adversarial samples generated by this type of GAN-based attack method have obvious red noise, which affects the perception performance of the adversarial samples; 2) This type of method does not effectively limit the amplitude and area of the added perturbation. There are also many perturbations in the background area, resulting in redundant addition of perturbations; 3) This type of method generally uses L p norm to constrain the perturbation generation, and based on L p There is a big difference between the objective visual evaluation index of the adversarial sample of the norm and the subjective visual evaluation of the human eye. p Norm-constrained perturbation only limits the amplitude of pixels, but does not restrict image structure differences and texture changes. For the above reasons, the generated adversarial samples cannot be "invisible" to the human eye while meeting the computer vision evaluation standards. Summary of the Invention

[0004] The purpose of the present invention is to provide an adversarial sample generation method based on low-perceptual perturbations in key areas, where the generated adversarial samples are closer to real images and the imperceptibility of the adversarial samples is improved.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is:

[0006] A first aspect of the present invention provides a method for generating adversarial samples based on low-perceptual perturbations in key areas, comprising:

[0007] Obtain an original image containing an adversarial target; input the original image into a preset adversarial sample generation network; the adversarial sample generation network includes a perception module and a generator;

[0008] Input the original image into the perception module to obtain the perception area mask; input the original image into the generator to generate the initial perturbation; filter the initial perturbation through the smoothing filter module and multiply it with the perception area mask to obtain the final perturbation; superimpose the final perturbation with the original image to generate the initial adversarial sample;

[0009] Calculate the perceptual loss and GAN loss between the initial adversarial sample and the original image; extract the multi-scale feature map B, candidate regions, and candidate region categories from the initial adversarial sample, and calculate the category loss of the candidate region category and the feature map loss of the multi-scale feature map B; iteratively optimize the adversarial sample generation network based on the perceptual loss, GAN loss, category loss, and feature map loss; use the optimized adversarial sample generation network to transform the original image into the final adversarial sample.

[0010] Preferably, the method of inputting the original image into the perception module to obtain the perception area mask includes:

[0011] The original image is extracted to obtain a multi-scale feature map A, which is input into the RPN network for processing. After non-maximum suppression processing, the candidate region is obtained. The gradient weighted class activation mapping is calculated on the candidate region to obtain the weight value of the candidate region. The weight values of all candidate regions are processed by the ReLU function and accumulated to obtain the feature m. The feature m is then normalized to obtain the perception area mask, which is expressed as follows:

[0012]

[0013]

[0014]

[0015] In the formula, R={g1,g2,···,g n} is the candidate region set after non-maximum suppression processing; g i is the i-th candidate region; α if is the weight of the fth channel of feature map A to the i-th candidate region; y i is the probability that the i-th candidate region contains the adversarial target; It is represented as the pixel of the jth row and kth column of the fth channel feature map of the i-th candidate region mapped to the feature map A; (x i1 ,x i2 ,y i1 ,y i2 ) is the position coordinate of the i-th candidate area; is the feature map of the i-th candidate region mapped to the f-th channel of the feature map A; M is the final generated perception area mask.

[0016] Preferably, the method of filtering the initial disturbance through a smoothing filter module includes:

[0017] Traverse all the pixels in the initial perturbation and replace the original pixel value of the noise with the median pixel value of the eight adjacent points around it. The formula is:

[0018]

[0019] In the formula, g(j,k) is the noise pixel value in the jth row and kth column of the initial disturbance; the Med function is the median function, and the output value of the Med function is the median of the input.

[0020] Preferably, the method for calculating the perceptual loss between the initial adversarial sample and the original image includes:

[0021] The original image and the initial adversarial sample are input into the pre-trained convolutional neural network respectively. The feature maps of different convolutional layers of the original image and the initial adversarial sample are extracted through forward calculation. The extracted feature maps of each layer are spatially averaged and summed over the channels to obtain the distance L2 between the original image and the initial adversarial sample. The distance L2 is recorded as the perceptual loss L perceptual , the expression formula is:

[0022]

[0023] The formula is, The dimension of the feature map extracted by the original image input to the convolutional neural network f layer l channel; The dimension of the feature map extracted by inputting the anti-sample A into the convolutional neural network f layer l channel; is the eigenvalue of the h rows and w columns of the l channel of the feature map output by the f layer of the convolutional neural network of the original image; are the eigenvalues of the h rows and w columns of the l channel of the feature map output by the f layer of the convolutional neural network of the initial adversarial sample; the convolutional neural network adopts the VGG16 model, and f takes the conv1-1 layer, conv2-1 layer, conv3-1 layer, conv4-1 layer and conv5-1 layer of the VGG16 model respectively.

[0024] Preferably, the method for calculating the GAN loss between the initial adversarial sample and the original image includes:

[0025] L GAN =logD(s)+log(1-D(s+G(s)))

[0026] In the formula, L GAN is the GAN loss, D is the discriminator, G is the generator, s is the original input image, and G(s) is the perturbation generated by inputting the original image into the generator.

[0027] Preferably, the category loss of the candidate region category is calculated, and the expression formula is:

[0028]

[0029] In the formula, L DAG It is expressed as the category loss of the candidate region category, X is the feature map B output by the feature extraction network, N = {t1, t2, ···, t n} is the set of candidate regions greater than the threshold T in the candidate regions extracted from the initial adversarial sample, t n Extract the nth candidate region for the initial adversarial sample, l n Its true label, is an error label randomly selected from the remaining labels, and f(·) is the function for calculating the category probability of the candidate region.

[0030] Preferably, the feature map loss of the multi-scale feature map B is expressed as:

[0031]

[0032] In the formula, X f′ is the f′th layer feature map B extracted from the initial adversarial sample; R f′ is a pre-generated random perturbation; L feature is the feature map loss of the multi-scale feature map B.

[0033] A second aspect of the present invention provides an adversarial sample generation system based on low-perceptual perturbations in key areas, comprising:

[0034] An input module is used to obtain an original image containing an adversarial target; input the original image into a preset adversarial sample generation network; the adversarial sample generation network includes a perception module and a generator;

[0035] The mask generation module is used to input the original image into the perception module to obtain the perception area mask;

[0036] The perturbation generation module is used to input the original image into the generator to generate the initial perturbation; the initial perturbation is filtered by the smoothing filter module and then multiplied with the perception area mask to obtain the final perturbation;

[0037] A generation network optimization module is configured to superimpose the final perturbation on the original image to generate an initial adversarial sample; calculate the perceptual loss and GAN loss between the initial adversarial sample and the original image; extract a multi-scale feature map B, candidate regions, and candidate region categories from the initial adversarial sample, calculate the category loss of the candidate region categories and the feature map loss of the multi-scale feature map B; and iteratively optimize the adversarial sample generation network based on the perceptual loss, GAN loss, category loss, and feature map loss.

[0038] The adversarial sample generation module is used to transform the original image into the final adversarial sample using the optimized adversarial sample generation network.

[0039] A third aspect of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the adversarial sample generation method when executing the program.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] The present invention inputs the original image into the perception module to obtain the perception area mask; inputs the original image into the generator to generate the initial disturbance; the initial disturbance is filtered by the smoothing filter module and then multiplied with the perception area mask to obtain the final disturbance; the final disturbance is superimposed on the original image to generate the initial adversarial sample; the generated initial disturbance is smoothed and filtered to effectively reduce the abrupt red noise, so that the generated adversarial sample is closer to the real image; the initial disturbance is added to the perception area of the model prediction focus to reduce the disturbance of irrelevant background areas; this method effectively improves the subjective perception effect of the adversarial sample while maintaining the attack success rate, has a significant improvement in attack efficiency and perception performance, and improves the applicability of generating adversarial samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a network structure of a method for generating adversarial samples for target detection based on low-perceptual perturbations in key areas, provided in the first embodiment of the present invention;

[0043] Figure 2 This is a rendering of a perception module of a method for generating adversarial samples for target detection based on low-perceptual perturbations in key areas, provided in the first embodiment of the present invention;

[0044] Figure 3This is an effect diagram of a smoothing filter module of a method for generating adversarial samples for target detection based on low-perceptual perturbations in key areas, provided in the first embodiment of the present invention;

[0045] Figure 4 This is a visual effect comparison chart of a target detection adversarial sample generation method based on low-perceptual perturbation in key areas provided by Example 1 of the present invention and several other methods. DETAILED DESCRIPTION

[0046] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.

[0047] Example 1

[0048] like Figures 1 to 4 As shown in FIG, a method for generating adversarial samples based on low-perceptual perturbations in key areas includes:

[0049] Obtain an original image containing an adversarial target; input the original image into a preset adversarial sample generation network; the adversarial sample generation network includes a perception module and a generator;

[0050] The method of inputting the original image into the perception module to obtain the perception area mask includes:

[0051] The original image is extracted to obtain a multi-scale feature map A, which is input into the RPN network for processing. After non-maximum suppression processing, the candidate region is obtained. The gradient weighted class activation mapping is calculated on the candidate region to obtain the weight value of the candidate region. The weight values of all candidate regions are processed by the ReLU function and accumulated to obtain the feature m. The feature m is then normalized to obtain the perception area mask, which is expressed as follows:

[0052]

[0053]

[0054]

[0055] In the formula, R={g1,g2,···,g n} is the candidate region set after non-maximum suppression processing; g i is the i-th candidate region; α if is the weight of the fth channel of feature map A to the i-th candidate region; y i is the probability that the i-th candidate region contains the adversarial target; It is represented as the pixel of the jth row and kth column of the fth channel feature map of the i-th candidate region mapped to the feature map A; (x i1 ,xi2 ,y i1 ,y i2 ) is the position coordinate of the i-th candidate area; is the feature map of the i-th candidate region mapped to the f-th channel of the feature map A; M is the final generated perception area mask.

[0056] like Figure 2 As shown in the figure, the first row is the original image, and the second row is the superposition of the perception region and the original image. As can be seen from the figure, the perception module accurately captures the perception region in the image that affects target detection performance and the perception region mask. By constraining the added area and amplitude of the perturbation through the perception region mask, the perturbation in irrelevant background areas is reduced, making the generated adversarial examples closer to the real image and improving the visual effect.

[0057] Input the original image into the perception module to obtain the perception area mask; input the original image into the generator to generate the initial perturbation; filter the initial perturbation through the smoothing filter module and multiply it with the perception area mask to obtain the final perturbation; superimpose the final perturbation with the original image to generate the initial adversarial sample;

[0058] The method of filtering the initial disturbance through the smoothing filter module includes:

[0059] Traverse all the pixels in the initial perturbation and replace the original pixel value of the noise with the median pixel value of the eight adjacent points around it. The formula is:

[0060]

[0061] In the formula, g(j,k) is the noise pixel value in the jth row and kth column of the initial disturbance; the Med function is the median function, and the output value of the Med function is the median of the input.

[0062] like Figure 3 As shown in the first and second columns, the disturbances generated by UEA and this embodiment without smoothing filtering processing both have some abnormal red noise points. The third column is the disturbance generated by this embodiment after smoothing filtering processing. It can be found that the red noise points in the disturbance have been effectively eliminated.

[0063] Methods for calculating the perceptual loss between the initial adversarial example and the original image include:

[0064] The original image and the initial adversarial sample are input into the pre-trained convolutional neural network respectively. The feature maps of different convolutional layers of the original image and the initial adversarial sample are extracted through forward calculation. The extracted feature maps of each layer are spatially averaged and summed over the channels to obtain the distance L2 between the original image and the initial adversarial sample. The distance L2 is recorded as the perceptual loss L perceptual, the expression formula is:

[0065]

[0066] The formula is, The dimension of the feature map extracted by the original image input to the convolutional neural network f layer l channel; The dimension of the feature map extracted by inputting the anti-sample A into the convolutional neural network f layer l channel; is the eigenvalue of the h rows and w columns of the l channel of the feature map output by the f layer of the convolutional neural network of the original image; are the eigenvalues of the h rows and w columns of the l channel of the feature map output by the f layer of the convolutional neural network of the initial adversarial sample; the convolutional neural network adopts the VGG16 model, and f takes the conv1-1 layer, conv2-1 layer, conv3-1 layer, conv4-1 layer and conv5-1 layer of the VGG16 model respectively.

[0067] Methods for calculating the GAN loss between the initial adversarial example and the original image include:

[0068] L GAN =logD(s)+log(1-D(s+G(s)))

[0069] In the formula, L GAN is the GAN loss, D is the discriminator, G is the generator, s is the original input image, and G(s) is the perturbation generated by inputting the original image into the generator.

[0070] Calculate the category loss of the candidate region category, expressed as:

[0071]

[0072] In the formula, L DAG It is expressed as the category loss of the candidate region category, X is the feature map B output by the feature extraction network, N = {t1, t2, ···, t n} is the set of candidate regions greater than the threshold T in the candidate regions extracted from the initial adversarial sample, where the threshold T = 0.7, t n Extract the nth candidate region for the initial adversarial sample, l n Its true label, is an error label randomly selected from the remaining labels, and f(·) is the function for calculating the category probability of the candidate region.

[0073] The feature map loss of the multi-scale feature map B is expressed as:

[0074]

[0075] In the formula, X f′is the f′th layer feature map B extracted from the initial adversarial sample; R f′ is a pre-generated random perturbation; L feature is the feature map loss of the multi-scale feature map B. Since the perturbation in this method is only added to the receptive region, the receptive region mask M obtained by the perception module is used to perform a Hadamard product with the feature map. In this method, the ReLU layer after conv3-3 and the ReLU layer after conv4-2 in VGG16 are selected for operation.

[0076] Methods for iteratively optimizing adversarial sample generation networks based on perceptual loss, GAN loss, category loss, and feature map loss include:

[0077] The network loss L is obtained by weighted summing of the perceptual loss, GAN loss, category loss and feature map loss, which is expressed as:

[0078] L=L GAN +αL perceptual +βL feature +γL DAG

[0079] In the formula, α is the weight value of perceptual loss, which is 1000; β is the weight value of feature map loss, which is [0.0001, 0.0002]; γ is the weight value of category loss, which is 1; the adversarial sample generation network is iteratively optimized according to the network loss L; the optimized adversarial sample generation network is used to convert the original image into the final adversarial sample.

[0080] In this implementation, the generated initial perturbation is smoothed and filtered, which effectively reduces the abrupt red noise and makes the generated adversarial sample closer to the real image; the perturbation is added to the perceptual area that the model prediction focuses on, reducing the perturbation in irrelevant background areas; this method effectively improves the subjective perception effect of the adversarial sample while maintaining the attack success rate, and has greatly improved the attack efficiency and perceptual performance, thereby improving the applicability of generated adversarial samples.

[0081] This implementation method was used in an attack effect and visual perception experiment on the same dataset as the DAG and UEA methods to verify the effectiveness of the invention in improving the imperceptibility of adversarial examples while maintaining their attack capability. The target detection model used was Faster RCNN.

[0082] The VOC2007 dataset was used as the dataset, and the perceptual quality and attack success rate were used to measure the performance of the algorithm.

[0083] In order to measure the perceptibility of adversarial samples, four indicators are introduced: Mean Square Error (MSE), Peak Signal-to-Noise Ratio (PSNR), Structural Similarity (SSIM), and Learned Perceptual Image Patch Similarity (LPIPS) to comprehensively measure the differences between adversarial samples and real images.

[0084] The degree of decrease in the mAP of the attacked detection model, that is, the attack success rate (ASR), is used as a performance indicator to measure the attack algorithm. The larger the ASR value, the greater the decrease in the mAP value of the target detection model, and the better the performance of the attack algorithm. The calculation formula of the ASR value is:

[0085]

[0086] Among them, mAP adv is the mAP value of the target detection model when inputting adversarial samples, mAP ori The mAP value of the target detection model when inputting training images. The ASR value ranges from 0 to 1.

[0087] Table 1 Comparison of attack success rates

[0088]

[0089] The comparison results of the attack success rate are shown in Table 1. From the results in the table, it can be seen that the ASR indicators of DAG, UEA, and Our are 0.93, 0.93, and 0.97, respectively. The final adversarial sample generated by this implementation effectively deceives the Faster-RCNN model and has good attack capability.

[0090] In order to verify the attack effect of this method under the defense method, the effectiveness of the proposed method under adversarial attacks under several image compression defense methods is evaluated.

[0091] JPEG compression can partially eliminate adversarial perturbations. We evaluated the performance of our invention in generating adversarial examples under JPEG compression with different quality factors. ComDefende, an end-to-end image compression model, defends against adversarial examples. We used ComDefende to reconstruct images of generated adversarial examples and tested their attack performance. The experimental results are shown in Table 2.

[0092] Table 2 Comparison of attack performance under defense methods

[0093]

[0094]

[0095] As can be seen from the results in the table, the ASR values of the adversarial samples generated in this embodiment, after being compressed by the JPEG method with compression rates of 20, 50, and 80, and processed by the ComDefende method, are very close to those of the original adversarial samples, demonstrating strong robustness.

[0096] The subjective comparison results of the visual perception experiment are as follows Figure 4 As shown in the figure, the first to fourth rows show the original image, the adversarial examples generated by DAG, UEA, and this embodiment, respectively. As can be seen from the figure, the adversarial examples generated by this embodiment have significantly improved subjective visual effects compared to those generated by the UEA method. The UEA adversarial examples have visible perturbations in the foreground area, significantly different from the original image.

[0097] The adversarial samples produced in this embodiment are basically comparable to those based on the optimized DAG method in terms of subjective visual effects. Under naked eye observation, it is difficult to find any difference from the original image, which greatly improves the image quality of the adversarial samples generated by the attack method based on the GAN framework.

[0098] In order to further verify the perceptual performance of the adversarial samples generated by this invention, the perceptual indicators such as DAG, UEA, MSE, PSNR, SSIM, LPIPS of the adversarial samples produced in this implementation were calculated respectively. The specific results are shown in Table 4.

[0099] Table 3 Comparison of perceptual indicators of various methods

[0100]

[0101] The results in the table show that the SSIM index of the three methods all reached above 0.999, basically maintaining the same structure as the original image. In terms of the MSE and PSNR indicators, this implementation outperformed the other two methods, indicating that it made the smallest change to the original image and had the smallest difference between the pixels and the original image. DAG had the worst two indicators because DAG had undergone hundreds of iterative optimizations, and the final modified pixel values differed significantly from the original image. In terms of the LPIPS indicator, this embodiment was also the best, with DAG outperforming UEA. This result is consistent with the results of the subjective visual comparison above. The subjective visual effect of the adversarial samples of this embodiment and DAG is better than that of UEA.

[0102] Example 2

[0103] A target detection system based on low-perceptual disturbance in key areas, which is applied to the target detection method described in Example 1, includes:

[0104] An input module is used to obtain an original image containing an adversarial target; input the original image into a preset adversarial sample generation network; the adversarial sample generation network includes a perception module and a generator;

[0105] The mask generation module is used to input the original image into the perception module to obtain the perception area mask;

[0106] The perturbation generation module is used to input the original image into the generator to generate the initial perturbation; the initial perturbation is filtered by the smoothing filter module and then multiplied with the perception area mask to obtain the final perturbation;

[0107] A generation network optimization module is configured to superimpose the final perturbation on the original image to generate an initial adversarial sample; calculate the perceptual loss and GAN loss between the initial adversarial sample and the original image; extract a multi-scale feature map B, candidate regions, and candidate region categories from the initial adversarial sample, calculate the category loss of the candidate region categories and the feature map loss of the multi-scale feature map B; and iteratively optimize the adversarial sample generation network based on the perceptual loss, GAN loss, category loss, and feature map loss.

[0108] The adversarial sample generation module is used to transform the original image into the final adversarial sample using the optimized adversarial sample generation network.

[0109] Example 3

[0110] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the adversarial sample generation method described in Example 1 are implemented.

[0111] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0112] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0113] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0114] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0115] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for generating adversarial samples based on low-perceptual perturbations in key areas, characterized by: include: Obtain the original image containing the adversarial target; input the original image into the preset adversarial sample generation network; The adversarial sample generation network includes a perception module and a generator; Input the original image into the perception module to obtain the perception area mask; Input the original image into the generator to generate perturbation A; The disturbance A is filtered by the smoothing filter module, which includes: Traverse all pixel points in the perturbation A and replace the original pixel value of the noise with the median pixel value of the eight adjacent points around it. The formula is: ； In the formula, g(j, k) is the noise pixel value in the jth row and kth column of the disturbance A; the Med function is the median function, and the output value of the Med function is the median of the input; After filtering the disturbance A, multiply it with the known region mask to obtain the disturbance B; superimpose the disturbance B with the original image to generate an initial adversarial sample; Calculate the perceptual loss and GAN loss between the initial adversarial sample and the original image; extract the multi-scale feature map B, candidate regions, and candidate region categories from the initial adversarial sample, and calculate the category loss of the candidate region category and the feature map loss of the multi-scale feature map B; iteratively optimize the adversarial sample generation network based on the perceptual loss, GAN loss, category loss, and feature map loss; use the optimized adversarial sample generation network to transform the original image into the final adversarial sample.

2. The method for generating adversarial samples based on low-perceptual perturbations in key areas according to claim 1, characterized in that: The method of inputting the original image into the perception module to obtain the perception area mask includes: The original image is extracted to obtain a multi-scale feature map A, which is input into the RPN network for processing. After non-maximum suppression processing, the candidate region is obtained. The gradient weighted class activation mapping is calculated on the candidate region to obtain the weight value of the candidate region. The weight values of all candidate regions are processed by the ReLU function and accumulated to obtain the feature m. The feature m is then normalized to obtain the perception area mask, which is expressed as follows: ； ； ； In the formula, R={g1, g2, ···, g n } is the candidate region set after non-maximum suppression processing; g i is the i-th candidate region; is the weight of the f-th channel of the feature map A to the i-th candidate region; is the probability that the i-th candidate region contains the adversarial target; It is represented as the pixel of the jth row and kth column of the fth channel feature map of the i-th candidate region mapped to the feature map A; (x i1 , x i2 ,y i1 , y i2 ) is the position coordinate of the i-th candidate area; is the feature map of the i-th candidate region mapped to the f-th channel of the feature map A; M is the final generated perception area mask.

3. The method for generating adversarial samples based on low-perceptual perturbations in key areas according to claim 1, characterized in that: Methods for calculating the perceptual loss between the initial adversarial example and the original image include: The original image and the initial adversarial sample are input into the pre-trained convolutional neural network respectively. The feature maps of different convolutional layers of the original image and the initial adversarial sample are extracted through forward calculation. The extracted feature maps of each layer are spatially averaged and summed over the channels to obtain the distance L2 between the original image and the initial adversarial sample. The distance L2 is recorded as the perceptual loss L perceptual , the expression formula is: ； The formula is, The dimension of the feature map extracted by the original image input to the convolutional neural network f layer l channel; The dimension of the feature map extracted by inputting the anti-sample A into the convolutional neural network f layer l channel; is the eigenvalue of the h rows and w columns of the l channel of the feature map output by the f layer of the convolutional neural network of the original image; are the eigenvalues of the h rows and w columns of the l channel of the feature map output by the f layer of the convolutional neural network of the initial adversarial sample; the convolutional neural network adopts the VGG16 model, and f is the conv1-1 layer, conv2-1 layer, conv3-1 layer, conv4-1 layer, and conv5-1 layer of the VGG16 model respectively.

4. The method for generating adversarial samples based on low-perceptual perturbations in key areas according to claim 3, characterized in that: Methods for calculating the GAN loss between the initial adversarial example and the original image include: ； In the formula, is the GAN loss, D is the discriminator, G is the generator, s is the original input image, and G(s) is the perturbation A generated by inputting the original image into the generator.

5. The method for generating adversarial samples based on low-perceptual perturbations in key areas according to claim 4, characterized in that: Calculate the category loss of the candidate region category, expressed as: ； In the formula, L DAG It is expressed as the category loss of the candidate region category, X is the feature map B output by the feature extraction network, N={t1, t2, ···, t U } is the set of candidate regions greater than the threshold T in the candidate regions extracted from the initial adversarial sample, t n Extract the nth candidate region for the initial adversarial sample, l n Its true label, is an error label randomly selected from the remaining labels, It is a function for calculating the probability of candidate region category.

6. The method for generating adversarial samples based on low-perceptual perturbations in key areas according to claim 5, characterized in that: The feature map loss of the multi-scale feature map B is expressed as: ； In the formula, is the first Layer feature map B; is a pre-generated random perturbation; is the feature map loss of the multi-scale feature map B.

7. A system for generating adversarial samples based on low-perceptual perturbations in key areas, characterized by: include: The input module is used to obtain the original image containing the adversarial target; the original image is input into the preset adversarial sample generation network; The adversarial sample generation network includes a perception module and a generator; The mask generation module is used to input the original image into the perception module to obtain the perception area mask; The interference generation module is used to input the original image into the generator to generate the disturbance A; the disturbance A is filtered by the smoothing filter module and then multiplied with the known area mask to obtain the disturbance B; Generate a network optimization module for superimposing the interference B with the original image to generate an initial adversarial sample; Calculate the perceptual loss and GAN loss between the initial adversarial example and the original image; Extract the multi-scale feature map B, candidate regions, and candidate region categories from the initial adversarial sample, calculate the category loss of the candidate region category and the feature map loss of the multi-scale feature map B; iteratively optimize the adversarial sample generation network based on the perceptual loss, GAN loss, category loss, and feature map loss; The adversarial sample generation module is used to transform the original image into the final adversarial sample using the optimized adversarial sample generation network; The interference generation module filters the disturbance A through the smoothing filter module, specifically including: Traverse all pixel points in the perturbation A and replace the original pixel value of the noise with the median pixel value of the eight adjacent points around it. The formula is: ； In the formula, g(j, k) is the noise pixel value in the j-th row and k-th column of the disturbance A; the Med function is the median function, and the output value of the Med function is the median of the input.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the adversarial sample generation method according to any one of claims 1 to 6 are implemented.

Images