A method, apparatus and device for constructing a point cloud

Abstract

The embodiment of the specification discloses a kind of construction methods, device and equipment of counterpoint cloud, which comprises: obtaining the first point cloud data and perturbation information applied to preset service, perturbation information is updated based on first perturbation information and preset target function, and first point cloud data is disturbed based on updated perturbation information Processing, obtain first counterpoint cloud data, select one or more perturbation information from perturbation information and updated perturbation information as target perturbation information, each target perturbation information is decomposed into first sub-perturbation information and second sub-perturbation information, first point cloud data is disturbed based on first sub-perturbation information and second sub-perturbation information Respectively processing, obtain third counterpoint cloud data and fourth counterpoint cloud data, and based on first point cloud data, third counterpoint cloud data and fourth counterpoint cloud data Synthesize fifth counterpoint cloud data, and then construct the counterpoint cloud data for preset service.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to a method, apparatus and device for constructing adversarial point clouds. Background Technology

[0002] As enterprises deepen their digital transformation, financial businesses in the internet era need to be proactively prepared for defense against cybercrime, which poses a significant challenge to the robustness of models. Only by staying one step ahead of cybercriminals can they escape a backward situation and create effective defense solutions. The integrated approach of "using defense to fuel offense, and offense to promote defense" is indispensable. Two-dimensional and three-dimensional vision tasks are widely used in financial business scenarios. For example, facial recognition often utilizes the fusion of two-dimensional and three-dimensional images to achieve higher accuracy. Similar to the situation in two-dimensional tasks, models designed for three-dimensional point cloud tasks are also susceptible to adversarial examples. Therefore, the robustness and security of models applied to three-dimensional tasks are of great importance. To this end, a simple and effective method is needed to generate more transferable adversarial point cloud data, thereby generating more transferable attack samples that can be combined with current attacks to improve their transferability. Summary of the Invention

[0003] The purpose of the embodiments in this specification is to propose a simple and effective way to generate more transferable adversarial point cloud data, thereby generating more transferable attack samples that can be combined with current attacks to improve their transferability.

[0004] To achieve the above technical solution, the embodiments in this specification are implemented as follows:

[0005] This specification provides an embodiment of a method for constructing adversarial point clouds. The method includes: acquiring first point cloud data applied to a preset service, and acquiring perturbation information applied to the first point cloud data; updating the perturbation information applied to the first point cloud data based on the first perturbation information and a preset objective function using a preset perturbation update strategy to obtain updated perturbation information; perturbing the first point cloud data based on the updated perturbation information to obtain first adversarial point cloud data corresponding to the first point cloud data; selecting one or more perturbation information from the perturbation information and the updated perturbation information as target perturbation information, and decomposing each target perturbation information into first sub-perturbation information and second sub-perturbation information; perturbing the first point cloud data based on the first sub-perturbation information to obtain third adversarial point cloud data corresponding to the first point cloud data; perturbing the first point cloud data based on the second sub-perturbation information to obtain fourth adversarial point cloud data corresponding to the first point cloud data; and generating corresponding fifth adversarial point cloud data based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data according to a preset point cloud synthesis strategy. Based on the first adversarial point cloud data and the fifth adversarial point cloud data, adversarial point cloud data for the preset service is constructed.

[0006] This specification provides an apparatus for constructing adversarial point clouds. The apparatus includes: a first point cloud construction module, which acquires first point cloud data applied to a preset service and acquires perturbation information applied to the first point cloud data; updates the perturbation information applied to the first point cloud data based on the first perturbation information and a preset objective function using a preset perturbation update strategy to obtain updated perturbation information; and performs perturbation processing on the first point cloud data based on the updated perturbation information to obtain first adversarial point cloud data corresponding to the first point cloud data; and a perturbation decomposition module, which selects one or more perturbation information as target perturbation information from the perturbation information and the updated perturbation information, and decomposes each target perturbation information into first sub-perturbation information and second sub-perturbation information. The second point cloud construction module perturbs the first point cloud data based on the first sub-perturbation information to obtain the third adversarial point cloud data corresponding to the first point cloud data, and perturbs the first point cloud data based on the second sub-perturbation information to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data, it generates the corresponding fifth adversarial point cloud data according to a preset point cloud synthesis strategy. The third point cloud construction module constructs adversarial point cloud data for the preset service based on the first adversarial point cloud data and the fifth adversarial point cloud data.

[0007] This specification provides an embodiment of an adversarial point cloud construction device, comprising: a processor; and a memory arranged to store computer-executable instructions. When executed, the executable instructions cause the processor to: acquire first point cloud data applied to a preset service, and acquire perturbation information applied to the first point cloud data; update the perturbation information applied to the first point cloud data based on the first perturbation information and a preset objective function using a preset perturbation update strategy to obtain updated perturbation information; and perform perturbation processing on the first point cloud data based on the updated perturbation information to obtain first adversarial point cloud data corresponding to the first point cloud data. One or more perturbation information pieces are selected from the perturbation information and the updated perturbation information as target perturbation information, and each target perturbation information piece is decomposed into a first sub-perturbation information and a second sub-perturbation information. Based on the first sub-perturbation information, the first point cloud data is perturbed to obtain the third adversarial point cloud data corresponding to the first point cloud data. Then, based on the second sub-perturbation information, the first point cloud data is perturbed to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Finally, based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data, a corresponding fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy. Based on the first adversarial point cloud data and the fifth adversarial point cloud data, adversarial point cloud data for the preset service is constructed.

[0008] This specification also provides a storage medium for storing computer-executable instructions. When executed by a processor, these instructions implement the following process: acquiring first point cloud data applied to a preset service, and acquiring perturbation information applied to the first point cloud data; updating the perturbation information applied to the first point cloud data based on the first perturbation information and a preset objective function using a preset perturbation update strategy to obtain updated perturbation information; and performing perturbation processing on the first point cloud data based on the updated perturbation information to obtain first adversarial point cloud data corresponding to the first point cloud data. One or more perturbation information pieces are selected from the perturbation information and the updated perturbation information as target perturbation information, and each target perturbation information piece is decomposed into a first sub-perturbation information and a second sub-perturbation information. Based on the first sub-perturbation information, the first point cloud data is perturbed to obtain the third adversarial point cloud data corresponding to the first point cloud data. Then, based on the second sub-perturbation information, the first point cloud data is perturbed to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Finally, based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data, a corresponding fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy. Based on the first adversarial point cloud data and the fifth adversarial point cloud data, adversarial point cloud data for the preset service is constructed. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is an embodiment of an adversarial point cloud construction method described in this specification;

[0011] Figure 2 This is another embodiment of the method for constructing adversarial point clouds as described in this specification;

[0012] Figure 3 This is a schematic diagram of a sample space as described in this specification;

[0013] Figure 4 This is an embodiment of an apparatus for constructing adversarial point clouds as described in this specification;

[0014] Figure 5 This specification describes an embodiment of an adversarial point cloud construction device. Detailed Implementation

[0015] This specification provides an embodiment of a method, apparatus, and device for constructing adversarial point clouds.

[0016] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0017] This specification provides a mechanism for constructing adversarial point clouds. Currently, most research on adversarial attacks against 3D point clouds is conducted in a white-box environment, meaning attackers have full access to the model source files and can easily generate adversarial perturbation information based on gradient information to attack the corresponding model. However, in most real-world scenarios, the model is deployed in a black-box environment, where only the model's prediction results can be queried, and the model source files cannot be accessed. Therefore, attacking a proxy model to generate a transferable adversarial 3D point cloud can attack both the proxy model being attacked and other black-box models. This type of black-box attack based on adversarial transferability is a more realistic threat. Based on this, a simple and effective method for jointly optimizing perturbations and their sub-perturbations is proposed to generate more transferable adversarial point cloud data. This allows for the generation of more transferable attack samples that can be combined with current attacks to improve their transferability. Specific processing details can be found in the following embodiments.

[0018] Example 1

[0019] like Figure 1 As shown in the embodiments of this specification, a method for constructing adversarial point clouds is provided. The execution subject of this method can be a terminal device or a server, such as a mobile terminal device like a mobile phone or tablet, a computer device like a laptop or desktop computer, or an IoT device (specifically, a smartwatch, in-vehicle device, etc.). The server can be a single server or a server cluster composed of multiple servers. The server can be a backend server for financial or online shopping services, or a backend server for an application. This embodiment uses a server as the execution subject for detailed explanation. For the case where the execution subject is a terminal device, please refer to the following server-side processing, which will not be repeated here. The method specifically includes the following steps:

[0020] In step S102, first point cloud data applied to a preset service is obtained, and disturbance information applied to the first point cloud data is obtained. Based on the first disturbance information and a preset objective function, the disturbance information applied to the first point cloud data is updated through a preset disturbance update strategy to obtain the updated disturbance information. Based on the updated disturbance information, the first point cloud data is perturbed to obtain the first adversarial point cloud data corresponding to the first point cloud data.

[0021] The preset service can be any service, such as facial recognition or biometric detection, and can be set according to actual conditions. Point cloud data can be a collection of discrete sampling points collected by 3D scanning equipment, etc. Point cloud data usually contains the 3D coordinates, normals, and surface appearance attributes of the sampling points. Point cloud data is a way of expressing a geometric model. Perturbation information can be information used to disturb the first point cloud data. Perturbation information can include various types, such as noise (such as random noise or Gaussian noise, etc., which can be set according to actual conditions), or pre-set specified information (such as pre-set specified text information, images, etc., which can be set according to actual conditions). The specific settings can be set according to actual conditions, and this specification does not limit this. The objective function can also be determined by a corresponding loss function. The objective function can be used to characterize the goal to be achieved in the iterative calculation. When the objective function converges, the iterative calculation ends. The specific form of the objective function can include various types. For example, it can be determined by the cross-entropy loss function, or by the L2 norm, etc. The specific settings can be set according to actual conditions, and this specification does not limit this. Perturbation update strategies can be varied and used to update perturbation information. For example, a perturbation update strategy might include adding a fixed value or information to the perturbation information, or it might include a specified update algorithm (such as the exponentially weighted average algorithm or gradient descent algorithm). The specific strategy can be set according to the actual situation. Adversarial point cloud data refers to point cloud data formed by adding subtle perturbations to the original point cloud data. This adversarial point cloud data causes the model to give an incorrect output result with high confidence. Furthermore, the adversarial point cloud data can be very similar to the original point cloud data; an observer may not perceive the difference between the two, but the model will make very different prediction results. Adversarial point cloud data can be used for transfer attacks; that is, adversarial point cloud data built based on a certain model can be used to attack another specified model with a high success rate.

[0022] In practice, as enterprises deepen their digital transformation, financial businesses in the internet era need to be fully prepared for proactive defense against cybercrime, which poses a significant challenge to the robustness of models. Only by staying one step ahead of cybercriminals can they escape a backward situation and create effective defense solutions. The integrated approach of "using defense to fuel offense, and offense to promote defense" is indispensable. Two-dimensional and three-dimensional vision tasks are widely used in financial business scenarios. For example, facial recognition often uses the fusion of two-dimensional and three-dimensional images to achieve higher accuracy. Similar to the situation in two-dimensional tasks, models designed for three-dimensional point cloud tasks are also susceptible to adversarial examples. Therefore, the robustness and security of models applied to three-dimensional tasks are of great importance. To this end, a simple and effective method is needed to generate more transferable adversarial point cloud data, thereby generating more transferable attack samples that can be combined with current attacks to improve their transferability. This specification provides an achievable processing method, which can be found in the following details.

[0023] The first point cloud data applicable to the preset service can be obtained in a variety of different ways. For example, the point cloud data obtained during the execution of the preset service can be recorded and used as the first point cloud data. Alternatively, the first point cloud data applicable to the preset service can be obtained from a specified database. Or, the point cloud data applicable to the preset service can be obtained through the network and used as the first point cloud data. The specific method can be set according to the actual situation, and the embodiments in this specification do not limit this.

[0024] In addition, perturbation information applied to the first point cloud data can be obtained in a variety of different ways. For example, Gaussian noise can be set as the perturbation information applied to the first point cloud data, and the perturbation information can be obtained. Alternatively, a specified code or character can be preset and used as the perturbation information, and the perturbation information can be obtained. The specific settings can be made according to the actual situation, and the embodiments in this specification do not limit this.

[0025] The perturbation information can be analyzed to determine its contents. Then, based on this content, a new perturbation information can be generated using a preset perturbation update strategy. This new perturbation information can then be used to update the existing perturbation information, resulting in updated perturbation information. The updated perturbation information can be embedded into first point cloud data. This updated perturbation information can then be used to perturb the first point cloud data, resulting in first adversarial point cloud data corresponding to the first point cloud data. Afterward, the updated perturbation information can be analyzed again to determine its contents. Then, based on this updated perturbation information, a new perturbation information can be generated using a preset perturbation update strategy. This new perturbation information can then be used to update the existing updated perturbation information, resulting in further updated perturbation information. This further updated perturbation information can then be embedded into the first point cloud data. This updated perturbation information can then be used to perturb the first point cloud data, resulting in first adversarial point cloud data corresponding to the first point cloud data. As described above, the above processing procedure can be repeated until the convergence condition corresponding to the objective function is met. Finally, the first adversarial point cloud data corresponding to the first point cloud data can be obtained. For example, if the preset service is a facial recognition service, the first point cloud data is point cloud data including a user's face. Through the above processing procedure, the first point cloud data can be perturbed based on the updated perturbation information (such as the perturbation information constructed from Gaussian noise) to obtain the first adversarial point cloud data corresponding to the first point cloud data (such as first adversarial point cloud data including the face, etc.). The first adversarial point cloud data is very similar to the first point cloud data, and the observer will not perceive the difference between the first point cloud data and the first adversarial point cloud data, but the model will make very different prediction results.

[0026] In step S104, one or more disturbance information is selected from the disturbance information and the updated disturbance information as target disturbance information, and each target disturbance information is decomposed into a first sub-disturbance information and a second sub-disturbance information.

[0027] In implementation, the aforementioned disturbance information and the updated disturbance information can be combined to form a set consisting of the disturbance information and the updated disturbance information. One or more disturbance information can be selected from the set as target disturbance information. Based on the above, if one disturbance information is selected as target disturbance information, the disturbance information selected from the set can be either the aforementioned disturbance information or one of the updated disturbance information. If multiple disturbance information is selected as target disturbance information, the disturbance information selected from the set can include the aforementioned disturbance information and the updated disturbance information, or it can be that multiple updated disturbance information are selected as target disturbance information from the updated disturbance information, etc. The specific settings can be determined according to the actual situation.

[0028] To obtain a better model in the future, each target perturbation information can be decomposed into two parts, namely the first sub-perturbation information and the second sub-perturbation information. The sum of the first sub-perturbation information and the second sub-perturbation information is the target perturbation information.

[0029] In step S106, the first point cloud data is perturbed based on the first sub-perturbation information to obtain the third adversarial point cloud data corresponding to the first point cloud data, and the first point cloud data is perturbed based on the second sub-perturbation information to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data, the corresponding fifth adversarial point cloud data is generated according to the preset point cloud synthesis strategy.

[0030] The point cloud synthesis strategy can be a strategy for generating (or synthesizing) new point cloud data based on currently known point cloud data. The point cloud synthesis strategy can include a variety of strategies. For example, the point cloud synthesis strategy can be constructed based on a vector synthesis algorithm, or the point cloud synthesis strategy can be constructed based on a specified weighted summation algorithm, etc. The specific strategy can be set according to the actual situation, and the embodiments in this specification do not limit it.

[0031] In implementation, the first point cloud data can be perturbed based on the first sub-perturbation information to obtain the third adversarial point cloud data corresponding to the first point cloud data. Simultaneously, the first point cloud data can be perturbed based on the second sub-perturbation information to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. The specific processing steps described above can be found in the aforementioned related content and will not be repeated here. Then, the first, third, and fourth adversarial point cloud data can be treated as two-dimensional coordinate points respectively. The ray from the first point cloud data to the third adversarial point cloud data can be considered as one vector, and the ray from the first point cloud data to the fourth adversarial point cloud data as another vector. These two vectors can be synthesized using a vector synthesis algorithm in a preset point cloud synthesis strategy. The resulting synthesized vector is the ray from the first point cloud data to the fifth adversarial point cloud data, thus obtaining the fifth adversarial point cloud data. Alternatively, the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data can be weighted and summed using a weighted summation algorithm specified in the preset point cloud synthesis strategy. The result can be used as the fifth adversarial point cloud data, etc. The specific settings can be determined according to the actual settings of the point cloud synthesis strategy. This specification does not limit this aspect in the embodiments.

[0032] In step S108, adversarial point cloud data for a preset service is constructed based on the first adversarial point cloud data and the fifth adversarial point cloud data.

[0033] In implementation, the first adversarial point cloud data and the fifth adversarial point cloud data can be used as adversarial point cloud data for a preset service. Alternatively, a certain number of adversarial point cloud data can be selected from the first and fifth adversarial point cloud data respectively as adversarial point cloud data for a preset service. Or, a certain number of adversarial point cloud data can be selected from the first adversarial point cloud data, and the selected adversarial point cloud data can be used together with the fifth adversarial point cloud data as adversarial point cloud data for a preset service. Alternatively, a certain number of adversarial point cloud data can be selected from the fifth adversarial point cloud data, and the selected adversarial point cloud data can be used together with the first adversarial point cloud data as adversarial point cloud data for a preset service. The specific settings can be determined according to the actual situation, and the embodiments in this specification do not limit this.

[0034] In addition to constructing adversarial point cloud data for preset services based on the first and fifth adversarial point cloud data, adversarial point cloud data for preset services can also be constructed based on the first, third, fourth, and fifth adversarial point cloud data, which can be set according to the actual situation.

[0035] This specification provides a method for constructing adversarial point clouds. It involves acquiring first point cloud data applied to a preset service and obtaining perturbation information applied to the first point cloud data. Based on the perturbation information and a preset objective function, the perturbation information applied to the first point cloud data is updated using a preset perturbation update strategy to obtain updated perturbation information. Then, the first point cloud data can be perturbed based on the updated perturbation information to obtain first adversarial point cloud data corresponding to the first point cloud data. Subsequently, one or more perturbation information can be selected from the perturbation information and the updated perturbation information as target perturbation information. Each target perturbation information is decomposed into first sub-perturbation information and second sub-perturbation information. The first point cloud data is perturbed based on the first sub-perturbation information to obtain third adversarial point cloud data corresponding to the first point cloud data. Finally, the first point cloud data is perturbed based on the second sub-perturbation information to obtain fourth adversarial point cloud data corresponding to the first point cloud data. Based on cloud data, and using first, third, and fourth adversarial point cloud data, a fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy. Finally, adversarial point cloud data targeting a preset business can be constructed based on the first and fifth adversarial point cloud data. Thus, a simple and effective attack is proposed to increase the transferability of adversarial point cloud data. Specifically, a process is proposed to update the perturbation information applied to the first point cloud data through a preset perturbation update strategy, and to decompose the target perturbation information to generate corresponding sub-perturbation information, rather than simply optimizing the process of updating the perturbation information applied to the first point cloud data through the preset perturbation update strategy alone. Therefore, the generated adversarial point cloud data is farther from the decision boundary and is easier to transfer adversarially. In addition, a sampling-based method is developed, which selects a portion of the perturbation information for random decomposition in each iteration to improve efficiency.

[0036] Example 2

[0037] like Figure 2 As shown in the embodiments of this specification, a method for constructing adversarial point clouds is provided. The execution subject of this method can be a terminal device or a server, such as a mobile terminal device like a mobile phone or tablet, a computer device like a laptop or desktop computer, or an IoT device (specifically, a smartwatch, in-vehicle device, etc.). The server can be a single server or a server cluster composed of multiple servers. The server can be a backend server for financial or online shopping services, or a backend server for an application. This embodiment uses a server as the execution subject for detailed explanation. For the case where the execution subject is a terminal device, please refer to the following server-side processing, which will not be repeated here. The method specifically includes the following steps:

[0038] In step S202, first point cloud data applied to the preset service is obtained, and disturbance information applied to the first point cloud data is obtained.

[0039] The perturbation information can be a distribution with a mean of 0 and a variance of 1. The first point cloud data can be point cloud data from a preset business application used by the proxy model. The proxy model is a model capable of performing migration attacks on the target model. The adversarial point cloud data for the preset business can be used to attack the target model. The target model can be any model; for example, it could be a facial recognition model applied to financial or specific transaction businesses, or a risk control model, etc., depending on the actual situation. The target model can be constructed based on various algorithms; for example, it could be based on a neural network algorithm, or it could be based on a classification algorithm, etc., depending on the actual situation. The proxy model can be a model with the same model architecture as the target model. For example, the target model can be a convolutional neural network model, and the proxy model can also be a convolutional neural network model. They can have the same network layers but different model parameters, or they can have different network layers and different model parameters, depending on the actual situation. This specification does not limit this in the embodiments. Migration attacks can be black-box attack methods that use adversarial migration attack proxy models to obtain corresponding adversarial samples for attacking target models.

[0040] In implementation, the first point cloud data applied to the preset business can be obtained in various ways, as detailed above. Additionally, initial perturbation information (i.e., perturbation information applied to the first point cloud data) with a mean of 0 and a variance of 1 can be generated, i.e., perturbation information Δ0~N(0,1).

[0041] In step S204, the first point cloud data is perturbed based on the above perturbation information to obtain the second adversarial point cloud data corresponding to the first point cloud data.

[0042] In step S206, based on the above-mentioned disturbance information and the preset objective function, the disturbance information applied to the first point cloud data is updated through a preset disturbance update strategy to obtain the updated disturbance information.

[0043] The perturbation update strategy can include a strategy based on the gradient descent algorithm. The objective function can be a function constructed based on the sub-loss function corresponding to updating the perturbation information applied to the first point cloud data through the preset perturbation update strategy and the sub-loss function corresponding to decomposing the target perturbation information to generate corresponding sub-perturbation information, rather than simply updating the perturbation information applied to the first point cloud data alone through the preset perturbation update strategy. The resulting adversarial point cloud data is further away from the decision boundary and is therefore easier to adversarially transfer.

[0044] In implementation, the corresponding iteration threshold can be determined based on the preset objective function. It can be determined whether the current iteration count of the perturbation information is less than the preset threshold. If so, the perturbation information can be analyzed, and the content contained within it can be determined based on the analysis results. Then, based on the content contained in the perturbation information, a new perturbation information can be generated using the gradient descent algorithm in the preset perturbation update strategy. The new perturbation information can be used to update the existing perturbation information to obtain the updated perturbation information. Specifically, if the current iteration count t ≤ T, the new perturbation information can be obtained using the following formula.

[0045]

[0046] Where, Δ t+1 For the perturbation information in the (t+1)th iteration, Δ t Let P be the perturbation information for the t-th iteration, P' be the first point cloud data, and P' be the perturbation information for the t-th iteration. t Let l be the adversarial point cloud data corresponding to the perturbation information in the t-th iteration. reg This represents the objective function.

[0047] In step S208, if the updated perturbation information is within a preset range, the updated perturbation information is embedded into the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data.

[0048] In implementation, a preset range ∈ can be obtained based on the infinity norm of the objective function, if the updated perturbation information Δ t+1 Within the preset range ∈ (i.e., |Δ t+1 If |≤∈), then the updated perturbation information is embedded into the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data, that is...

[0049] P′ t+1 ←P+Δ t+1

[0050] Among them, P′ t+1 This represents the adversarial point cloud data (i.e., the first adversarial point cloud data) corresponding to the perturbation information in the t-th iteration.

[0051] In step S210, if the updated disturbance information is not within a preset range, then based on the updated disturbance information, the norm of the updated disturbance information, and the preset error parameters, the first disturbance information is determined, and the first disturbance information is embedded into the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data.

[0052] In implementation, if the updated perturbation information Δ t+1 Not within the preset range ∈ (i.e., |Δ t+1 If |>∈), then based on the updated perturbation information, the norm of the updated perturbation information, and the preset error parameters, the first perturbation information is determined, i.e.

[0053]

[0054] Then, the first perturbation information is embedded into the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data.

[0055]

[0056] In step S212, the first adversarial point cloud data is smoothed based on the iterative normal projection algorithm to obtain the processed first adversarial point cloud data.

[0057] Among them, the iterative normal projection algorithm can be used to smooth point cloud data. Through the iterative normal projection algorithm, the points in the specified point cloud data, as well as the point cloud as a whole, can be made smoother.

[0058] In step S214, one or more disturbance information is selected from the disturbance information and the updated disturbance information as target disturbance information, and each target disturbance information is decomposed into a first sub-disturbance information and a second sub-disturbance information.

[0059] In practice, adversarial point cloud data near the decision boundary of the surrogate model generally carries the risk of overfitting and has low transferability because different DNNs may have relatively different boundaries. However, due to the complexity of the boundary and the lack of analytical form, it is difficult to standardize the distance between the adversarial point cloud data and the decision boundary to generate more transferable adversarial point cloud data. Furthermore, in practical applications, a perturbation can be decomposed into two sub-perturbations, which are also likely adversarial perturbations. This phenomenon indicates that sub-perturbations may also contain useful information about the decision boundary, thus helping to generate more transferable adversarial point cloud data. In addition, considering the efficiency of constructing adversarial point cloud data and model training, a sampling method can be used to randomly decompose a portion of the perturbation information in each iteration. Specifically, one perturbation can be randomly decomposed in each iteration, or two perturbations can be randomly decomposed in each iteration, depending on the actual situation. Based on the above, if it is necessary to select one target perturbation information, then one perturbation information is selected from the existing perturbation information or the updated perturbation information as the target perturbation information. If it is necessary to select multiple target perturbation information, then one perturbation information is selected from the existing perturbation information as the target perturbation information. Alternatively, one or more perturbation information can be selected from the updated perturbation information as the target perturbation information, or multiple perturbation information can be selected from the updated perturbation information as the target perturbation information, etc. Then, each target perturbation information can be decomposed into a first sub-perturbation information and a second sub-perturbation information. Specific processing methods can be found in the aforementioned related content and will not be repeated here.

[0060] In step S216, the first point cloud data is perturbed based on the first sub-perturbation information to obtain the third adversarial point cloud data corresponding to the first point cloud data, and the first point cloud data is perturbed based on the second sub-perturbation information to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Based on the first point cloud data, the third adversarial point cloud data and the fourth adversarial point cloud data, the corresponding fifth adversarial point cloud data is generated according to the preset point cloud synthesis strategy.

[0061] In implementation, such as Figure 3 As shown, the first point cloud data can be perturbed based on the first sub-perturbation information to obtain the third adversarial point cloud data corresponding to the first point cloud data. Simultaneously, the first point cloud data can be perturbed based on the second sub-perturbation information to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. The specific processing steps described above can be found in the aforementioned related content and will not be repeated here. Figure 3As shown, the entire sample space can be divided into three parts: a non-adversarial sample space and an adversarial sample space. The adversarial sample space includes two parts: the first adversarial sample space and the second adversarial sample space. The first point cloud data can be located in the non-adversarial sample space, while the third and fourth adversarial point cloud data are located in the first adversarial sample space. The first, third, and fourth adversarial point cloud data can be considered as two-dimensional coordinate points, i.e., the two-dimensional coordinate point X corresponding to the first point cloud data, the two-dimensional coordinate point X1 corresponding to the third adversarial point cloud data, and the two-dimensional coordinate point X2 corresponding to the fourth adversarial point cloud data. The ray from the first point cloud data to the third adversarial point cloud data can be considered as a vector (i.e.,...). The ray from the first point cloud data to the fourth adversarial point cloud data will be used as another vector (i.e., The two vectors mentioned above can be synthesized using a vector synthesis algorithm in a preset point cloud synthesis strategy to obtain a synthesized vector. That is, the ray from the first point cloud data to the fifth adversarial point cloud data, thus obtaining the fifth adversarial point cloud data (such as...). Figure 3 The second adversarial point cloud data is located within the second adversarial sample space, corresponding to the two-dimensional coordinate point X3 shown.

[0062] In step S218, adversarial point cloud data for a preset service is constructed based on the first adversarial point cloud data, the second adversarial point cloud data, and the fifth adversarial point cloud data.

[0063] For details on step S218 above, please refer to the aforementioned related content, which will not be repeated here.

[0064] Based on the processing in steps S202 to S218 above, the widely used ModelNet40 dataset can be used to train the model and evaluate the performance of each attack method. Model performance is measured by the attack success rate. Based on the results, it can be seen that in a white-box setting, the technical solution provided in this specification's embodiments achieves a 100% baseline attack success rate, and in most cases, the adversarial point cloud data generated by the technical solution provided in this specification's embodiments achieves better transferability. To quantitatively compare the transferability of adversarial point cloud data generated by the technical solution provided in this specification's embodiments with other technical solutions, a transferability score (i.e., average attack success rate) can be used as a metric. The final results show that the overall transferability of the technical solution provided in this specification's embodiments is superior to other current baseline attack algorithms. For example, when ∈ = 0.18, it exceeds the 3D-Adv-based adversarial point cloud generation method by 28% and the AdvPC-based adversarial point cloud generation method by 9.4%; when ∈ = 0.45, it exceeds the 3D-Adv-based adversarial point cloud generation method by 34.2% and the AdvPC-based adversarial point cloud generation method by 13.5%.

[0065] After obtaining the adversarial point cloud data in the above manner, the target model can be trained again using the adversarial point cloud data to improve the prediction accuracy of the target model. For details, please refer to the processing of steps S220 and 222 below.

[0066] In step S220, adversarial point cloud data for the preset service is input into the target model to obtain the corresponding prediction results.

[0067] In step S222, based on the prediction results and the label information corresponding to the adversarial point cloud data for the preset business, the corresponding loss information is determined through a preset loss function. Based on the loss information, the model parameters of the target model are adjusted to train the target model and obtain the trained target model.

[0068] This specification provides a method for constructing adversarial point clouds. It involves acquiring first point cloud data applied to a preset service and obtaining perturbation information applied to the first point cloud data. Based on the perturbation information and a preset objective function, the perturbation information applied to the first point cloud data is updated using a preset perturbation update strategy to obtain updated perturbation information. Then, the first point cloud data can be perturbed based on the updated perturbation information to obtain first adversarial point cloud data corresponding to the first point cloud data. Subsequently, one or more perturbation information can be selected from the perturbation information and the updated perturbation information as target perturbation information. Each target perturbation information is decomposed into first sub-perturbation information and second sub-perturbation information. The first point cloud data is perturbed based on the first sub-perturbation information to obtain third adversarial point cloud data corresponding to the first point cloud data. Finally, the first point cloud data is perturbed based on the second sub-perturbation information to obtain fourth adversarial point cloud data corresponding to the first point cloud data. Based on cloud data, and using first, third, and fourth adversarial point cloud data, a fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy. Finally, adversarial point cloud data targeting a preset business can be constructed based on the first and fifth adversarial point cloud data. Thus, a simple and effective attack is proposed to increase the transferability of adversarial point cloud data. Specifically, a process is proposed to update the perturbation information applied to the first point cloud data through a preset perturbation update strategy, and to decompose the target perturbation information to generate corresponding sub-perturbation information, rather than simply optimizing the process of updating the perturbation information applied to the first point cloud data through the preset perturbation update strategy alone. Therefore, the generated adversarial point cloud data is farther from the decision boundary and is easier to transfer adversarially. In addition, a sampling-based method is developed, which selects a portion of the perturbation information for random decomposition in each iteration to improve efficiency.

[0069] Example 3

[0070] The above describes the method for constructing adversarial point clouds provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide an apparatus for constructing adversarial point clouds, such as... Figure 4 As shown.

[0071] The adversarial point cloud construction device includes: a first point cloud construction module 401, a perturbation decomposition module 402, a second point cloud construction module 403, and a third point cloud construction module 404, wherein:

[0072] The first point cloud construction module 401 acquires first point cloud data applied to a preset service and acquires disturbance information applied to the first point cloud data. Based on the first disturbance information and a preset objective function, it updates the disturbance information applied to the first point cloud data through a preset disturbance update strategy to obtain updated disturbance information. Based on the updated disturbance information, it performs disturbance processing on the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data.

[0073] The disturbance decomposition module 402 selects one or more disturbance information as target disturbance information from the disturbance information and the updated disturbance information, and decomposes each target disturbance information into a first sub-disturbance information and a second sub-disturbance information.

[0074] The second point cloud construction module 403 perturbs the first point cloud data based on the first sub-perturbation information to obtain the third adversarial point cloud data corresponding to the first point cloud data, and perturbs the first point cloud data based on the second sub-perturbation information to obtain the fourth adversarial point cloud data corresponding to the first point cloud data, and generates the corresponding fifth adversarial point cloud data based on the first point cloud data, the third adversarial point cloud data and the fourth adversarial point cloud data according to a preset point cloud synthesis strategy.

[0075] The third point cloud construction module 404 constructs adversarial point cloud data for the preset service based on the first adversarial point cloud data and the fifth adversarial point cloud data.

[0076] In the embodiments described in this specification, the device further includes:

[0077] The fourth point cloud construction module performs perturbation processing on the first point cloud data based on the perturbation information to obtain the second adversarial point cloud data corresponding to the first point cloud data;

[0078] The third point cloud construction module 404 constructs adversarial point cloud data for the preset service based on the first adversarial point cloud data, the second adversarial point cloud data, and the fifth adversarial point cloud data.

[0079] In the embodiments of this specification, the first point cloud construction module 801 includes:

[0080] If the updated perturbation information is within a preset range, the first point cloud construction unit embeds the updated perturbation information into the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data.

[0081] If the updated perturbation information is not within a preset range, the second point cloud construction unit determines the first perturbation information based on the updated perturbation information, the norm of the updated perturbation information, and the preset error parameters, and embeds the first perturbation information into the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data.

[0082] In the embodiments described in this specification, the device further includes:

[0083] The processing module performs smoothing processing on the first adversarial point cloud data based on the iterative normal projection algorithm to obtain the processed first adversarial point cloud data.

[0084] In this embodiment of the specification, the objective function is a function constructed based on the sub-loss function corresponding to the processing of updating the perturbation information applied to the first point cloud data through a preset perturbation update strategy and the sub-loss function corresponding to the processing of decomposing the objective perturbation information to generate corresponding sub-perturbation information.

[0085] In the embodiments of this specification, the perturbation information is perturbation information that follows a distribution law with a mean of 0 and a variance of 1; the perturbation update strategy includes a strategy constructed based on the gradient descent algorithm.

[0086] In the embodiments of this specification, the first point cloud data is the point cloud data in the preset service applied by the proxy model. The proxy model is a model that can perform migration attacks on the target model. The adversarial point cloud data for the preset service is used to attack the target model.

[0087] In the embodiments described in this specification, the device further includes:

[0088] The prediction module inputs adversarial point cloud data for the preset service into the target model to obtain the corresponding prediction results;

[0089] The model training module, based on the prediction results and the label information corresponding to the adversarial point cloud data for the preset service, determines the corresponding loss information through a preset loss function, and adjusts the model parameters of the target model based on the loss information to train the target model and obtain the trained target model.

[0090] This specification provides an apparatus for constructing adversarial point clouds. It acquires first point cloud data applied to a preset service and perturbation information applied to the first point cloud data. Based on the perturbation information and a preset objective function, it updates the perturbation information applied to the first point cloud data using a preset perturbation update strategy to obtain updated perturbation information. Then, it perturbs the first point cloud data based on the updated perturbation information to obtain first adversarial point cloud data corresponding to the first point cloud data. Next, it selects one or more perturbation information from the perturbation information and the updated perturbation information as target perturbation information, decomposing each target perturbation information into first sub-perturbation information and second sub-perturbation information. It perturbs the first point cloud data based on the first sub-perturbation information to obtain third adversarial point cloud data corresponding to the first point cloud data, and then perturbs the first point cloud data based on the second sub-perturbation information to obtain fourth adversarial point cloud data corresponding to the first point cloud data. Based on cloud data, and using first, third, and fourth adversarial point cloud data, a fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy. Finally, adversarial point cloud data targeting a preset business can be constructed based on the first and fifth adversarial point cloud data. Thus, a simple and effective attack is proposed to increase the transferability of adversarial point cloud data. Specifically, a process is proposed to update the perturbation information applied to the first point cloud data through a preset perturbation update strategy, and to decompose the target perturbation information to generate corresponding sub-perturbation information, rather than simply optimizing the process of updating the perturbation information applied to the first point cloud data through the preset perturbation update strategy alone. Therefore, the generated adversarial point cloud data is farther from the decision boundary and is easier to transfer adversarially. In addition, a sampling-based method is developed, which selects a portion of the perturbation information for random decomposition in each iteration to improve efficiency.

[0091] Example 4

[0092] The above describes the adversarial point cloud construction apparatus provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide an adversarial point cloud construction device, such as... Figure 5 As shown.

[0093] The device for constructing the adversarial point cloud can provide terminal devices or servers, etc., as described in the above embodiments.

[0094] The adversarial point cloud building device can vary significantly due to differences in configuration or performance. It may include one or more processors 501 and a memory 502, where one or more applications or data may be stored. The memory 502 can be temporary or persistent storage. The applications stored in the memory 502 may include one or more modules (not shown in the figure), each module including a series of computer-executable instructions in the adversarial point cloud building device. Furthermore, the processor 501 may be configured to communicate with the memory 502 and execute the series of computer-executable instructions in the memory 502 on the adversarial point cloud building device. The adversarial point cloud building device may also include one or more power supplies 503, one or more wired or wireless network interfaces 504, one or more input / output interfaces 505, and one or more keyboards 506.

[0095] Specifically, in this embodiment, the adversarial point cloud construction device includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions in the adversarial point cloud construction device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0096] First point cloud data applied to a preset service is acquired, and perturbation information applied to the first point cloud data is acquired. Based on the first perturbation information and a preset objective function, the perturbation information applied to the first point cloud data is updated through a preset perturbation update strategy to obtain updated perturbation information. Based on the updated perturbation information, the first point cloud data is perturbed to obtain first adversarial point cloud data corresponding to the first point cloud data.

[0097] Select one or more disturbance information from the disturbance information and the updated disturbance information as target disturbance information, and decompose each target disturbance information into a first sub-disturbance information and a second sub-disturbance information;

[0098] Based on the first sub-perturbation information, the first point cloud data is perturbed to obtain the third adversarial point cloud data corresponding to the first point cloud data. Based on the second sub-perturbation information, the first point cloud data is perturbed to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data, the corresponding fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy.

[0099] Based on the first adversarial point cloud data and the fifth adversarial point cloud data, adversarial point cloud data for the preset service is constructed.

[0100] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, the embodiments for constructing adversarial point clouds are relatively simple in description because they are fundamentally similar to the method embodiments; relevant parts can be referred to the descriptions in the method embodiments.

[0101] This specification provides an embodiment of an adversarial point cloud construction device. It acquires first point cloud data applied to a preset service and obtains perturbation information applied to the first point cloud data. Based on the perturbation information and a preset objective function, it updates the perturbation information applied to the first point cloud data using a preset perturbation update strategy to obtain updated perturbation information. Then, it performs perturbation processing on the first point cloud data based on the updated perturbation information to obtain first adversarial point cloud data corresponding to the first point cloud data. Subsequently, it selects one or more perturbation information from the perturbation information and the updated perturbation information as target perturbation information, decomposing each target perturbation information into first sub-perturbation information and second sub-perturbation information. It performs perturbation processing on the first point cloud data based on the first sub-perturbation information to obtain third adversarial point cloud data corresponding to the first point cloud data, and performs perturbation processing on the first point cloud data based on the second sub-perturbation information to obtain fourth adversarial point cloud data corresponding to the first point cloud data. Based on cloud data, and using first, third, and fourth adversarial point cloud data, a fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy. Finally, adversarial point cloud data targeting a preset business can be constructed based on the first and fifth adversarial point cloud data. Thus, a simple and effective attack is proposed to increase the transferability of adversarial point cloud data. Specifically, a process is proposed to update the perturbation information applied to the first point cloud data through a preset perturbation update strategy, and to decompose the target perturbation information to generate corresponding sub-perturbation information, rather than simply optimizing the process of updating the perturbation information applied to the first point cloud data through the preset perturbation update strategy alone. Therefore, the generated adversarial point cloud data is farther from the decision boundary and is easier to transfer adversarially. In addition, a sampling-based method is developed, which selects a portion of the perturbation information for random decomposition in each iteration to improve efficiency.

[0102] Example 5

[0103] Furthermore, based on the above Figures 1 to 3The method shown in this specification, along with one or more embodiments, also provides a storage medium for storing computer-executable instruction information. In one specific embodiment, the storage medium can be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can achieve the following process:

[0104] First point cloud data applied to a preset service is acquired, and perturbation information applied to the first point cloud data is acquired. Based on the first perturbation information and a preset objective function, the perturbation information applied to the first point cloud data is updated through a preset perturbation update strategy to obtain updated perturbation information. Based on the updated perturbation information, the first point cloud data is perturbed to obtain first adversarial point cloud data corresponding to the first point cloud data.

[0105] Select one or more disturbance information from the disturbance information and the updated disturbance information as target disturbance information, and decompose each target disturbance information into a first sub-disturbance information and a second sub-disturbance information;

[0106] Based on the first sub-perturbation information, the first point cloud data is perturbed to obtain the third adversarial point cloud data corresponding to the first point cloud data. Based on the second sub-perturbation information, the first point cloud data is perturbed to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data, the corresponding fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy.

[0107] Based on the first adversarial point cloud data and the fifth adversarial point cloud data, adversarial point cloud data for the preset service is constructed.

[0108] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described storage medium embodiment is basically similar to the method embodiment, so the description is relatively simple; relevant parts can be referred to the description of the method embodiment.

[0109] This specification provides a storage medium that acquires first point cloud data applied to a preset service and obtains perturbation information applied to the first point cloud data. Based on the perturbation information and a preset objective function, the perturbation information applied to the first point cloud data is updated using a preset perturbation update strategy to obtain updated perturbation information. Then, the first point cloud data can be perturbed based on the updated perturbation information to obtain first adversarial point cloud data corresponding to the first point cloud data. Subsequently, one or more perturbation information can be selected from the perturbation information and the updated perturbation information as target perturbation information. Each target perturbation information is decomposed into first sub-perturbation information and second sub-perturbation information. The first point cloud data is perturbed based on the first sub-perturbation information to obtain third adversarial point cloud data corresponding to the first point cloud data. The first point cloud data is then perturbed based on the second sub-perturbation information to obtain fourth adversarial point cloud data corresponding to the first point cloud data. Based on the first, third, and fourth adversarial point cloud data, a fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy. Finally, adversarial point cloud data targeting a preset service can be constructed based on the first and fifth adversarial point cloud data. Thus, a simple and effective attack is proposed to increase the transferability of adversarial point cloud data. Specifically, a process is proposed to update the perturbation information applied to the first point cloud data through a preset perturbation update strategy, and to decompose the target perturbation information to generate corresponding sub-perturbation information, rather than simply optimizing the process of updating the perturbation information applied to the first point cloud data through the preset perturbation update strategy alone. Therefore, the generated adversarial point cloud data is farther from the decision boundary and is easier to transfer adversarially. In addition, a sampling-based method is developed, which selects a portion of the perturbation information for random decomposition in each iteration to improve efficiency.

[0110] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0111] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using a hardware physical module. For example, a Programmable Logic Device (PLD) (e.g., a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program a digital system themselves to "integrate" it onto a PLD, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0112] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0113] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0114] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0115] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0116] Embodiments in this specification are described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable parallel device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable parallel device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0117] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable fraud device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer or other programmable device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0119] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0120] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0121] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0122] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0123] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0124] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0125] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0126] The above description is merely an embodiment of this specification and is not intended to limit this application. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for constructing adversarial point clouds, the method comprising: First point cloud data applied to a preset service is acquired, and perturbation information applied to the first point cloud data is acquired. Based on the perturbation information and a preset objective function, the perturbation information applied to the first point cloud data is updated through a preset perturbation update strategy to obtain updated perturbation information. Based on the updated perturbation information, the first point cloud data is perturbed to obtain first adversarial point cloud data corresponding to the first point cloud data. Select one or more disturbance information from the disturbance information and the updated disturbance information as target disturbance information, and decompose each target disturbance information into a first sub-disturbance information and a second sub-disturbance information; Based on the first sub-perturbation information, the first point cloud data is perturbed to obtain the third adversarial point cloud data corresponding to the first point cloud data. Based on the second sub-perturbation information, the first point cloud data is perturbed to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data, the corresponding fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy. Based on the first adversarial point cloud data and the fifth adversarial point cloud data, adversarial point cloud data for the preset service is constructed.

2. The method according to claim 1, further comprising: Based on the perturbation information, the first point cloud data is perturbed to obtain the second adversarial point cloud data corresponding to the first point cloud data; The construction of adversarial point cloud data for the preset service based on the first adversarial point cloud data and the fifth adversarial point cloud data includes: Based on the first adversarial point cloud data, the second adversarial point cloud data, and the fifth adversarial point cloud data, adversarial point cloud data for the preset service is constructed.

3. The method according to claim 2, wherein the step of perturbing the first point cloud data based on the updated perturbation information to obtain the first adversarial point cloud data corresponding to the first point cloud data includes: If the updated perturbation information is within a preset range, the updated perturbation information is embedded into the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data. If the updated perturbation information is not within the preset range, then based on the updated perturbation information, the norm of the updated perturbation information, and the preset error parameter, the first perturbation information is determined, and the first perturbation information is embedded into the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data.

4. The method according to any one of claims 1-3, further comprising: The first adversarial point cloud data is smoothed based on the iterative normal projection algorithm to obtain the processed first adversarial point cloud data.

5. The method according to claim 4, wherein the objective function is a function constructed based on a sub-loss function corresponding to the processing of updating the perturbation information applied to the first point cloud data through a preset perturbation update strategy and a sub-loss function corresponding to the processing of decomposing the objective perturbation information to generate corresponding sub-perturbation information.

6. The method according to claim 5, wherein the perturbation information is perturbation information that follows a distribution law with a mean of 0 and a variance of 1; and the perturbation update strategy includes a strategy constructed based on the gradient descent algorithm.

7. The method according to claim 6, wherein the first point cloud data is point cloud data in the preset service applied by the proxy model, the proxy model is a model capable of performing migration attacks on the target model, and the adversarial point cloud data for the preset service is used to attack the target model.

8. The method according to claim 7, further comprising: The adversarial point cloud data for the preset service is input into the target model to obtain the corresponding prediction results; Based on the prediction results and the label information corresponding to the adversarial point cloud data for the preset service, the corresponding loss information is determined through a preset loss function. The model parameters of the target model are adjusted based on the loss information to train the target model and obtain the trained target model.

9. An apparatus for constructing adversarial point clouds, the apparatus comprising: The first point cloud construction module acquires first point cloud data applied to a preset service and acquires disturbance information applied to the first point cloud data. Based on the disturbance information and a preset objective function, it updates the disturbance information applied to the first point cloud data through a preset disturbance update strategy to obtain updated disturbance information. Based on the updated disturbance information, it performs disturbance processing on the first point cloud data to obtain the first adversarial point cloud data corresponding to the first point cloud data. The disturbance decomposition module selects one or more disturbance information as target disturbance information from the disturbance information and the updated disturbance information, and decomposes each target disturbance information into a first sub-disturbance information and a second sub-disturbance information. The second point cloud construction module perturbs the first point cloud data based on the first sub-perturbation information to obtain the third adversarial point cloud data corresponding to the first point cloud data, and perturbs the first point cloud data based on the second sub-perturbation information to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data, the module generates the corresponding fifth adversarial point cloud data according to a preset point cloud synthesis strategy. The third point cloud construction module constructs adversarial point cloud data for the preset service based on the first adversarial point cloud data and the fifth adversarial point cloud data.

10. An adversarial point cloud construction device, the adversarial point cloud construction device comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to: First point cloud data applied to a preset service is acquired, and perturbation information applied to the first point cloud data is acquired. Based on the perturbation information and a preset objective function, the perturbation information applied to the first point cloud data is updated through a preset perturbation update strategy to obtain updated perturbation information. Based on the updated perturbation information, the first point cloud data is perturbed to obtain first adversarial point cloud data corresponding to the first point cloud data. Select one or more disturbance information from the disturbance information and the updated disturbance information as target disturbance information, and decompose each target disturbance information into a first sub-disturbance information and a second sub-disturbance information; Based on the first sub-perturbation information, the first point cloud data is perturbed to obtain the third adversarial point cloud data corresponding to the first point cloud data. Based on the second sub-perturbation information, the first point cloud data is perturbed to obtain the fourth adversarial point cloud data corresponding to the first point cloud data. Based on the first point cloud data, the third adversarial point cloud data, and the fourth adversarial point cloud data, the corresponding fifth adversarial point cloud data is generated according to a preset point cloud synthesis strategy. Based on the first adversarial point cloud data and the fifth adversarial point cloud data, adversarial point cloud data for the preset service is constructed.

Images