An image attack method for adversarial target detection

Abstract

This invention discloses an image attack method for adversarial target detection. Step 1: Set a preset target V for the attack; Step 2: Extract the neural network structure and weight data of the target detector and establish a target detection dataset; Step 3: Based on the target detection dataset, distinguish the category of the object of interest by analyzing the localization information output by the target detector; Step 4: Determine the type D of the detection box in the detection result of the target detector to be attacked based on the category of the object of interest; Step 5: Calculate the difference vector M; Step 6: Calculate the preset optimization function L(M) based on the difference vector M; Step 7: Update the tensor P using the calculation result of the preset optimization function L(M); Step 8: Determine whether the attack method terminates; if vector M is a zero vector, proceed to Step 9; otherwise, return to Step 4; Step 9: Output the judgment result of the target detector to be attacked, interfering with its recognition of the object of interest. This invention is used to interfere with the target detector's recognition of the object of interest.

Description

Technical fields:

[0001] This invention belongs to the fields of adversarial attacks and artificial intelligence system security, and specifically relates to an attack method for adversarial target detection. Background technology:

[0002] With the rapid development of deep learning in recent years, many advanced deep neural networks have emerged, achieving significant breakthroughs and results. Object detection is a fundamental task in computer vision. Its purpose is to generate bounding boxes to capture objects of interest in an image, label their position and size using the boundaries of the bounding boxes, and classify objects within the regions. The final interpretation of the image content is called the detection result. Object detectors based on deep neural networks can perform object detection tasks excellently and are therefore widely used in real-world tasks such as autonomous driving, face recognition, industrial defect detection, lesion detection, and remote sensing image recognition. Commonly used object detectors are divided into single-stage and two-stage detectors, with YOLOv3, YOLOv4, Fast R-CNN, and Faster R-CNN being representative examples.

[0003] In computer vision, by adding carefully crafted, minute noise to an input image, the resulting image can deceive a deep neural network into outputting incorrect results. Furthermore, the human eye has difficulty distinguishing the image before and after the noise addition. This method of interfering with the recognition process is called an image attack. Classic attack methods include FGSM, C&W, and Deepfool. These attack methods can reveal security issues in deep neural network-based object detectors and assess their robustness. The images used in these attack methods are typically from publicly available datasets, containing images and their corresponding labels. The basic process of an attack method involves obtaining the structure and weight information of the deep neural network, adding noise variables to the image, and then constructing and minimizing an optimization function to alter the noise variables. Based on the method used to minimize the optimization function, attack methods can be divided into two categories: iterative methods: calculating the minimization function through multiple iterations; single-step methods: calculating the minimization function through only one iteration. Iterative methods have better interference effects than single-step methods, but single-step methods have faster computation speeds. Summary of the Invention:

[0004] To address the problems existing in current technologies, this invention designs an image attack method for adversarial target detection. This method interferes with the target detector's recognition of objects of interest and, according to preset target specifications, deliberately misleads the detection results. This invention can disrupt the target detector's recognition function and, simultaneously, interfere with the target's recognition intent, thus possessing significant research value and importance in the field of artificial intelligence system security.

[0005] To solve the problems existing in the prior art, the present invention adopts the following technical solutions:

[0006] An image attack method for对抗目标检测 is as follows:

[0007] Step1: Set a preset target V for the attack;

[0008] Step2: Extract the neural network structure and weight data of the target detector for the attack and establish a target detection data set; the target detection data set includes images and corresponding target detection labels; the target detection labels include: a first detection box, the confidence of the object of interest in the image, the position and size of the object of interest, and the category information of the object of interest;

[0009] Step3: Distinguish the category situation of the object of interest according to the positioning information of the detection output of the target detector by the target detection data set; where:

[0010] Judge whether the confidence captures the object of interest by setting a first scalar a; where: when the confidence is greater than the scalar a, it means that the object of interest is captured, otherwise it is not captured;

[0011] Judge the positioning situation of the confidence for the object of interest by setting second scalars b1 and b2, 0 ≤ b1 < b2 ≤ 1; <00C0026>Calculate the intersection over union of the object area marked by the first detection box and the area marked in the true image label to obtain the target detection label category; where: the intersection over union U is the ratio of the intersection of the two areas to the union; when 0 ≤ U < b1, the positioning is too deviated; when b1 ≤ U < b2, the positioning is slightly deviated; when b2 ≤ U ≤ 1, the positioning is accurate;

[0013] Step4: Judge the detection box type D in the detection result of the target detector to be attacked according to the category of the object of interest; where: Add the created tensor P to the image of the target detection data set and truncate the data to [0,1];

[0015] Input the image result of the added target detection data set into the target detector to be attacked to obtain the vector W of the detection box in the target detection data set; <000C034>Step5: Calculate the difference vector M; where: the difference vector M = (m1, m2, m3, m4, m5, m6, m7); the difference vector M is the result of the logical exclusive OR operation of the vector V and the vector W of the detection box;

[0017] Step6: Calculate a preset optimization function L(M) according to the difference vector M; It should be noted that the phrase "对抗目标检测" in the original text seems to be incorrect or incomplete. It might need to be corrected to a more accurate expression for a better understanding of the content. The above translation is based on the provided text as it is.

[0018] Step 7: Update tensor P using the calculation results of the preset optimization function L(M);

[0019] Step 8: Determine whether the attack method has terminated; if vector M is a zero vector, proceed to Step 9, otherwise return to Step 4; Step 9: Output the judgment result of the target detector that interferes with the attack.

[0020] Furthermore, the process of constructing the optimization function in Step 6:

[0021] A difference value is constructed by combining the confidence loss function L1, the intersection-union (IU) loss function L2, and the classification loss function L3. Specifically: the confidence loss function L1(D) represents the sum of the cross-entropy results of the confidence score and 1 for all detection boxes of type D; the IU loss function L2(D) represents the sum of the sum of the overall result of 1 minus the IU for all detection boxes of type D; and the classification loss function L3(D) represents the sum of the cross-entropy results of the category vector of the detection box and the label category for all detection boxes of type D.

[0022] When the preset target V is set to (0,1,0,0,0,0,0), the first optimization function is:

[0023] L(M)=-m1L3(D1)+(m3∨m4)L2(D3∪D4)-m2L1(D5)+m2L1(D6)

[0024] When the preset target V is set to (0,0,1,0,0,0,0), the second optimization function is:

[0025] L(M)=-(m1∨m2)L2(D1∪D2)+m4L3(D4)-m5L1(D5).

[0026] Furthermore, in step 7, the tensor P is updated using the calculation result of the preset optimization function L(M):

[0027] After calculating the optimization function, backpropagation is used to minimize the optimization function and update the value of tensor P.

[0028] The attack step size c = 0.004 is the step size coefficient used when updating the value of tensor P;

[0029] The perturbation strength limit d = 0.039 is used to restrict the modification range of elements in tensor P to [-0.039, 0.039]. If an element exceeds this range, its value is set to the boundary of this interval.

[0030] Beneficial effects

[0031] This invention can set a preset target and construct and minimize an optimization function based on the result of the difference vector, thereby interfering with the target detector's recognition process while causing it to output a specific false detection result.

[0032] This invention can interfere with the target detector's recognition process by setting a preset target and constructing and minimizing an optimization function based on the difference vector results. Compared with existing technologies, this invention can cause the target detector to output specific erroneous detection results, thereby purposefully disrupting the target detector's detection capability. Attached Figure Description

[0033] Figure 1 This invention relates to a flowchart of an image attack method for countering target detection. Detailed Implementation

[0034] The present invention will be further described below, but this does not limit the invention to the scope described. Simple modifications made by those skilled in the art based on the concept of the present invention should be within the scope of protection claimed by the present invention.

[0035] This invention designs an image attack method for adversarial target detection, and the specific implementation process is as follows:

[0036] Step 1: Set the preset target of the attack method. Define vector V to represent the preset target of the adversarial attack. The vector length is 7, and the elements in the vector take values ​​of 0 or 1. At least one element in this vector has a value of 1. "1" indicates that the adversarial attack method expects the corresponding type of detection box to appear in the detection results, while "0" indicates that it does not expect it to appear in the detection results. Using vector V = (0,1,0,0,0,0,0) or vector V = (0,0,1,0,0,0,0) as an example, we can set other values ​​as the preset target. The definitions of different types of detection boxes will be described in Step 3.2.

[0037] Step 2: Preparation for the adversarial attack. For the target detector F to be attacked, obtain its neural network structure and model weight data; select the classic YOLOv3 model for the target detector and import the pre-trained weights. Prepare the target detection dataset, which includes images and corresponding target detection labels (also known as annotation information). The labels include the probability of the presence of an object of interest in the image (also known as confidence), the location, size, and category information of the object of interest. The dataset used is the publicly available target detection dataset MS-COCO 2014, from which 5000 images are randomly selected to create adversarial examples.

[0038] Step 3.1: Analyze the possible situations in the detection results. First, set a scalar a with a value of 0.5 to determine whether the detection box captures the object of interest. When the confidence level is greater than a, it means the object of interest is captured; otherwise, it is not. Set scalars b1 and b2 with values of 0.75 and 0 respectively to determine the localization situation of the detection box for the object of interest, where 0 ≤ b1 < b2 ≤ 1. Calculate the intersection over union (IoU) of the object area marked in the detection box and the area marked in the label. The IoU U is the ratio of the intersection of the two areas to the union. When 0 ≤ U < b1, the localization is too deviated; when b1 ≤ U < b2, the localization has a slight deviation; when b2 ≤ U ≤ 1, the localization is accurate. When the object category marked in the detection box is the same as the category in the label, the category is correct; otherwise, it is incorrect. The scalars a, b1, and b2 can also be selected as other values as long as they are within the specified range.

[0039] Step 3.2: Classify the detection boxes. Different types of detection boxes are defined as shown in Table 1. According to the capture situation, localization situation, and category situation of the object of interest, the detection boxes are divided into various types, and D7 is the complement of the union of other detection box types. Only one classification scheme is given in Table 1, and the detection boxes can be divided into more or fewer categories according to requirements. When classifying, it is necessary to consider the capture situation, localization situation, and category situation of the object by the detection box. The classification scheme of the detection boxes corresponds to the construction of the optimization function in the following. That is to say, different detection box classification schemes will result in different constructed optimization functions.

[0040] Step 4: Obtain the detection results of the target detector to be attacked. Define a tensor P with the same size as the image. When the attack method is executed for the first time, initialize each element in the tensor to 0. Add the png - format data of the image to this tensor and truncate the data to the range [0, 1]. Input the added result into the target detector to be attacked to obtain the detection boxes in the detection results. Define a vector W, which contains 7 elements with values of 0 or 1. When the detection box belongs to the set defined in Step 2, set the position of the vector W indicated by the set subscript number to 1, and set it to 0 in other cases.

[0041] Step 5: Calculate the difference vector. Define a vector M to represent the difference vector M=(m1, m2, m3, m4, m5, m6, m7). The calculation result of the vector M is the logical exclusive - or of the vector V and the vector W.

[0042] Step 6: Construct the optimization function. Based on the difference value, the confidence loss function L1, the intersection-union (IU) loss function L2, and the classification loss function L3 are used to generate the final optimization function. The confidence loss function L1(D) represents the sum of the cross-entropy results of the confidence and 1 for all detection boxes of type D. The IU loss function L2(D) represents the sum of the sum of the overall result of 1 minus the IU for all detection boxes of type D. The classification loss function L3(D) represents the sum of the cross-entropy results of the category vector and the label category for all detection boxes of type D. When the vector V is set to (0,1,0,0,0,0,0), the optimization function is:

[0043] L(M)=-m1L3(D1)+(m3∨m4)L2(D3∪D4)-m2L1(D5)+m2L1(D6)

[0044] When the vector V is set to (0,0,1,0,0,0,0), the optimization function is:

[0045] L(M)=-(m1∨m2)L2(D1∪D2)+m4L3(D4)-m5L1(D5)

[0046] Step 7: Update Tensor P. After calculating the optimization function, minimize the optimization function using backpropagation and update the value of tensor P. The attack step size c = 0.004, used as the step size coefficient when updating the value of tensor P. The perturbation strength limit d = 0.039, used to restrict the modification range of elements within tensor P to [-0.039, 0.039]. If an element exceeds this range, its value is set to the boundary of that interval. For example, if the element value is 0.042, it will ultimately be set to 0.039.

[0047] Step 8: Attack method termination check. If vector M is a zero vector, or the maximum number of iterations is reached, proceed to Step 9; otherwise, return to Step 4. The maximum number of iterations is set to 25.

[0048] Step 9: Interfere with the target detector. Add the final generated tensor P to the PNG data of the image, and truncate the data to [0,1]. Input the result of the addition into the target detector to interfere with the target detector and produce the expected false detection results.

Claims

1. An image attack method for adversarial target detection, characterized in that, Includes the following steps: Step 1: Set the preset target V for the attack; Step 2: Extract the neural network structure and weight data of the target detector from the attack and establish a target detection dataset; the target detection dataset includes images and corresponding target detection labels; The target detection label includes: a first detection box, the confidence score of the object of interest in the image, the position and size of the object of interest, and the category information of the object of interest; Step 3: Based on the object detection dataset, the localization information output by the object detector is used to distinguish the category of the object of interest; where: The confidence level is set to determine whether the object of interest has been captured. When the confidence level is greater than the scalar a, it means that the object of interest has been captured; otherwise, it has not been captured. The confidence level for locating the object of interest is determined by setting second scalars b1 and b2, where 0 ≤ b1 < b2 ≤ 1. The target detection label category is obtained by calculating the intersection-union ratio (IU) of the object region labeled in the first detection box and the region labeled in the real image label; where: IU is the ratio of the intersection to the union of the two regions; when 0≤U< b1, the localization is too inaccurate; when b1≤U< b2, the localization is slightly inaccurate; when b2≤U≤1, the localization is accurate. Step 4: Determine the type D of the detection box in the detector results of the target to be attacked based on the category of the object of interest; where: Create a tensor P and add it to the images in the object detection dataset, then truncate the data to [0,1]. The summed target detection dataset image results are input into the target detector to obtain the vector W of the detection box in the target detection dataset; Step 5: Calculate the difference vector M; where: the difference vector M = (m1, m2, m3, m4, m5, m6, m7); the difference vector M is the result of the logical XOR operation between the preset target V and the vector W of the detection box; Step 6: Calculate the preset optimization function based on the difference vector M. ; Step 7: Utilize the preset optimization function The calculation results are used to update tensor P; Step 8: Determine if the attack method has terminated; if vector M is a zero vector, proceed to Step 9, otherwise return to Step 4. Step 9: Output the detection results of the target detector that interferes with the attack.

2. The image attack method for countering target detection according to claim 1, characterized in that, The process of constructing the optimization function in Step 6: The discrepancy value is constructed by combining the confidence loss function L1, the intersection-union loss function L2, and the classification loss function L3; where: The confidence loss function L1(D) represents the sum of the cross-entropy results of the confidence score and 1 for all detection boxes of type D; the intersection-union (IU) loss L2(D) represents the sum of the overall result of 1 minus the IU for all detection boxes of type D; the classification loss function L3(D) represents the sum of the cross-entropy results of the category vector of the detection box and the label category for all detection boxes of type D; where: When the preset target V is set to (0, 1, 0, 0, 0, 0, 0), the first optimization function is: When the preset target V is set to (0, 0, 1, 0, 0, 0, 0), the second optimization function is: 。 3. The image attack method for adversarial target detection according to claim 1, characterized in that, In step 7, a preset optimization function is used. The process of updating tensor P using the calculation results: After calculating the optimization function, backpropagation is used to minimize the optimization function and update the value of tensor P. The attack step size c = 0.004 is the step size coefficient used when updating the value of tensor P; The perturbation strength limit d=0.039 is used to restrict the modification range of elements in tensor P to [-0.039, 0.039]. If an element exceeds this range, its value is set to the boundary of this interval.

Images