An adaptive adversarial training method for dynamic visual cabinet recognition

Abstract

The application provides a self-adaptive adversarial training method for dynamic visual cabinet recognition, comprising the following steps: S1, initializing target network parameters or initializing target network pre-training configuration, obtaining X clean correctly recognized and not disturbed in a dynamic visual cabinet; S2, generating an adaptive adjustment attack parameter vector theta by using a heuristic differential evolution algorithm of a strategy generator according to the robustness of the target network; S3, inputting the attack parameter vector theta into an adversarial sample generator, generating an adversarial sample by adding disturbance in the X clean ; S4, inputting the X clean and the adversarial sample into the target network for training, and setting a training target function; S5, repeating steps S2-S4 until the maximum iteration number is reached, and obtaining a recognition model for dynamic visual cabinet recognition. The application can improve the adversarial attack capability of the recognition model in the dynamic visual cabinet.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anti-defense, and particularly relates to a self-adaptive anti-training method for dynamic visual cabinet identification. BACKGROUND

[0002] The performance of detection and recognition models has been rapidly developed with the support of deep learning technology, and can be applied to various fields, such as the intelligent retail commodity industry. However, if an adversarial sample appears, it will bring great challenges to the security of a non-robust detection and recognition model, such as the disturbance of the adversarial sample to the target, which can easily deceive the non-robust detection and recognition model to produce an incorrect output. Therefore, the attack of an adversarial sample on a non-robust detection and recognition model will cause immeasurable losses to the intelligent retail industry.

[0003] The anti-training method is an effective method for defending against the attack of an adversarial sample on a non-robust detection and recognition model. The basic idea of the anti-training method is to introduce an adversarial sample in the training process, so that the non-robust detection and recognition model can learn robust features, thereby improving the anti-attack ability of the detection and recognition model. Specifically, the anti-training method mainly includes the following steps: 1) in the adversarial sample generator, attack parameters (such as attack strength, attack position, etc.) are manually set to add disturbance to the original sample to generate an adversarial sample; 2) the generated adversarial sample and the original sample are used to train the detection and recognition model, so that the detection and recognition model learns more robust features; 3) in the test stage, the detection and recognition model can correctly identify the adversarial sample.

[0004] Although the anti-training method has achieved good results in improving the robustness of the detection and recognition model, there are still some defects and problems. Specifically, first, the existing anti-training method pays more attention to global disturbance and carefully designed adversarial disturbance in the digital domain, thereby ignoring other factors of physical attacks, such as light and shadow, patches, etc., which may also affect the robustness of the detection and recognition model. Second, the attack parameters are achieved by manually setting, and this fixed attack strategy generates adversarial samples independent of the feature information of specific samples, ignoring the statistical differences between samples. Attackers can easily bypass the defense technology of the detection and recognition model by using different attack methods and attack parameters, further reducing the performance of the detection and recognition model. Finally, directly using the adversarial sample and the original sample to train the detection and recognition model may make the detection and recognition model tend to defend against the attack sample, while ignoring the original sample, and this method makes the training process of the detection and recognition model difficult, and the convergence speed is slow.

[0005] Therefore, how to provide an adaptive adversarial training method for dynamic visual cabinet identification is very important to solve the problem that the existing adversarial training method improves the robustness of the detection and recognition model. SUMMARY

[0006] The application aims to provide an adaptive adversarial training method for dynamic visual cabinet identification, and the specific technical solutions are as follows:

[0007] An adaptive adversarial training method for dynamic visual cabinet identification comprises the following steps:

[0008] Step S1, initialize the target network parameters or initialize the target network pre-training configuration, and obtain the clean sample X of the correct identification and non-disturbance of the product image in the dynamic visual cabinet clean ;

[0009] Step S2, according to the robustness of the target network, the strategy generator generates an adaptive adjustment of the attack parameter vector θ of the product image by using the heuristic differential evolution algorithm;

[0010] Step S3, input the attack parameter vector θ into the adversarial sample generator, and generate an adversarial sample by adding disturbance to the clean sample X of the product image clean ;

[0011] Step S4, input the clean sample X of the product image clean and the adversarial sample into the target network for training, and set the training objective function;

[0012] Step S5: repeat steps S2-S4 until the maximum iteration number is reached, and obtain the identification model for dynamic visual cabinet identification.

[0013] Optionally, in step S2, the attack parameter vector θ includes shadow coverage position, shadow value or patch attack parameter; the shadow coverage position represents the shadow attack coverage range of the product image, and the corresponding coverage area is surrounded by three vertices of the product image; the shadow value represents the shadow brightness of the product image.

[0014] Optionally, the step S2 comprises the following steps:

[0015] Step S2.1, initialize the parameter vector population

[0016] In the differential evolution algorithm, the population represents a set of attack parameter vectors θ of multiple product images, and each individual in the population represents a parameter vector θ; given the population size N and the parameter dimension D, a population is randomly initialized according to the uniform distribution, and the t-th generation population is represented by formula (1):

[0017]

[0018] In formula (1), denotes the jth parameter value of the ith parameter vector in the tth generation population; denotes the lower bound of the jth parameter; denotes the upper bound of the jth parameter; denotes a random number between and ;

[0019] Step S2.2, candidate parameter vector population generation

[0020] A random parameter vector and is generated, and a neighboring vector and is generated. A mutation parameter vector is generated by crossing between the random parameter vector

[0021]

[0022] In formula (2), denotes the mutation parameter vector corresponding to the ith mutation individual; denotes a clipping operation that keeps the calculated value of the parameter value s, and in the described range; denotes a clipping operation that keeps the calculated value of the parameter value , s, and in the described range; is the externally stored current optimal parameter vector; s is a scaling factor; denotes a parameter vector randomly sampled from the tth generation population; denotes another parameter vector randomly sampled from the tth generation population; denotes a parameter vector with a distance of l1from the parameter vector ; denotes a parameter vector with a distance of l2from the parameter vector ; denotes the ith parameter vector in the tth generation population;

[0023] After obtaining the mutation parameter vector corresponding to the mutation individual, a binary crossing operation is performed to form the final candidate parameter vector shown in formula (3):

[0024]

[0025] In formula (3), t represents the t-th generation of the population; i represents the i-th candidate parameter vector in the t-th generation of the population; j represents the j-th parameter of the i-th candidate parameter vector in the t-th generation of the population; and rand(0, 1) represents a random number between 0 and 1. represents the j-th parameter of the i-th mutation parameter vector in the t-th generation of the population; represents the j-th parameter of the i-th candidate parameter vector in the t-th generation of the population; CR i represents a crossover probability; j rand represents a certain random parameter; rand(0, 1) represents a random number between 0 and 1.

[0026] Step S2.3, feasible region and fitness judgment

[0027] In order to make the shadow attack coverage of the product image concentrated on the target product, the feasible region judgment needs to be performed on the candidate parameter vector; the candidate parameter vector corresponding to the pixel point meeting the feasible region judgment is selected, and the product image is generated according to the candidate parameter vector to obtain the shadow attack coverage of the product image. The parameter vector meeting the fitness judgment is used to generate the next generation of parameter vector population as shown in formula (4):

[0028]

[0029] In formula (4), t represents the t-th generation of the population; i represents the i-th parameter vector in the t-th generation of the population; j represents the j-th parameter of the i-th parameter vector in the t-th generation of the population; and rand(0, 1) represents a random number between 0 and 1. represents the i-th parameter vector in the t+1-th generation of the population generated; represents the i-th candidate parameter vector in the t-th generation of the population; represents the candidate parameter vector in the t-th generation of the population; represents the cross-entropy loss of the generated adversarial sample in the target network under the candidate parameter vector represents the cross-entropy loss of the generated adversarial sample in the target network under the parameter vector represents the cross-entropy loss of the generated adversarial sample in the target network under the parameter vector

[0030] When the maximum evolution number set in the differential evolution algorithm is reached, the attack parameter vector θ of the self-adaptive adjusted product image is generated by using the fitness judgment in the finally generated population.

[0031] Optionally, in step S2.3, the process of the feasible region judgment is as follows:

[0032] Firstly, the pixel point position set P of the target product is obtained by using the segmentation model, and it is assumed that the set M is the pixel point set covered by the shadow attack on the product image, and formula (5) is used to judge whether each pixel point is in the shadow attack coverage of the product image:

[0033]

[0034] In equation (5), card(P∩M) represents the number of pixels in the intersection of set P and set M; card(P) represents the number of pixels in set P; if the area value is less than 0.1, it means that the shadow attack coverage of the product image is too small or does not cover the target product, and pixels with an area value less than 0.1 need to be removed.

[0035] Optionally, in step S2.3, the evaluation criteria for fitness determination... As shown in equation (6):

[0036]

[0037] In equation (6), Indicates about f(g(X) clean The cross-entropy loss function between X and Y; g(X,θ) clean ,θ) represents an adversarial sample; Y is a clean sample of a product image X clean The corresponding real tags.

[0038] Optionally, in step S2.2, the distance l is measured using equation (7):

[0039]

[0040] In equation (7), z represents the index of the parameter vector in the population; Indicates except Other parameter vectors besides; express The vector magnitude; express The vector magnitude; express and The vector magnitude of the difference.

[0041] Optionally, in step S3, the adversarial samples include shadow adversarial samples and patch adversarial samples.

[0042] Optionally, in step S3, the adversarial sample includes a shadow adversarial sample.

[0043] Optionally, in step S3, the adversarial example generator cleans the product image sample X. clean Add shadow perturbation to generate shadow adversarial sample X adv ;

[0044] The process of adding shadow perturbation is as follows:

[0045] First, given a clean sample X of a product image in the RGB color space. clean And convert it to the LAB color space using equation (8):

[0046] LAB([RGB]) = [LAB] Equation (8)

[0047] In equation (8), LAB([RGB]) represents the operation of converting the RGB color space to the LAB color space; [LAB] represents the LAB color space image;

[0048] Secondly, shadow perturbation is generated by multiplying the corresponding L luminance channel in the LAB color space by the shadow value;

[0049] Generate shadow adversarial examples X adv The process is as follows:

[0050] Clean sample X of the input product image clean Simulating the shadows cast by natural phenomena, assuming the shadow value in the attack parameter vector θ is k, the generated shadow adversarial sample X... adv The values ​​of the middle pixel (m, n) are calculated using equation (9) to obtain the shadow adversarial sample X. adv :

[0051]

[0052] In equation (9), LAB m n(Xadv) represents the shadow addition operation in the LAB color space; [L mn A mn B mn ]

[0053] Represents the pixel value in the m-th row and n-th column for different channels; [k 1 1] T This represents the matrix used to change pixels, where T is the matrix transpose; [1 1 1] T This represents a matrix that retains the original pixel values.

[0054] Optionally, in step S4, the training objective function is represented by equation (10):

[0055]

[0056] In equation (10), Represents f(X) clean The cross-entropy loss function between Y and Y; Represents f(X) clean ) and f(X adv The cross-entropy loss function of f(X); clean f(X) represents the target network's prediction result for clean samples; adv) represents the target network's prediction result for the shadow adversarial example; α represents the penalty parameter that controls the penalty strength; α is set to 1 in the early stage of training, and gradually decreases to 1 as the training process progresses; w represents the target network parameters.

[0057] The application of the technical solution of the present invention has the following beneficial effects:

[0058] (1) This invention provides an adaptive adversarial training method for dynamic visual container recognition. Steps S1-S5 train a recognition model for dynamic visual container recognition. The trained recognition model has generalization and robustness and can actively learn multiple attack strategies to improve its adversarial attack capability. In step S2, a policy generator uses a heuristic differential evolution algorithm to obtain the optimal attack parameter vector θ. By combining this with the generalization and robust target network trained in steps S3-S4, the problem of manually setting attack parameters in existing adversarial training methods is solved. At the same time, the adaptively adjusted attack parameters can more comprehensively consider different dimensions and features of attacks, so that the network model can better adapt to various attack methods. It also solves the problems of adversarial sample selection and training difficulty to a certain extent, which is conducive to further improving the robustness, generalization ability and adversarial attack capability of the recognition model in dynamic visual containers.

[0059] (2) The adaptive adversarial training method for dynamic visual container recognition described in this invention cleans the input commodity image sample X. clean By simulating shadows generated by natural phenomena, adversarial examples of shadows are generated and added to adversarial training to reduce the sensitivity of the target network to shadows, thus solving the problem that existing adversarial training methods ignore physical attack factors.

[0060] (3) The adaptive adversarial training method for dynamic visual container recognition described in this invention sets the training objective function. The penalty parameter α is dynamically adjusted to achieve a balance between generalization and robustness, ensuring that the target network can correctly identify adversarial examples while maintaining its performance on clean examples. This solves the problem of existing adversarial training methods that directly use adversarial examples and original samples to train the detection and recognition model at the same time.

[0061] In addition to the objectives, features, and advantages described above, the present invention has other objectives, features, and advantages. The invention will now be described in further detail with reference to the figures. Attached Figure Description

[0062] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0063] Figure 1 This is a schematic diagram of the framework of an adaptive adversarial training method for dynamic visual container recognition in a preferred embodiment of the present invention.

[0064] Figure 2 This is a schematic diagram of the white pixel positions forming a set P in a preferred embodiment of the present invention. Detailed Implementation

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention are within the scope of protection of the present invention.

[0066] Example:

[0067] See Figure 1 An adaptive adversarial training method for dynamic visual container recognition includes the following steps:

[0068] Step S1: Initialize the target network (specifically, select ResNet50 as the target network) parameters or initialize the target network pre-training configuration to obtain clean sample X of correctly identified and undisturbed product images in the dynamic visual vending machine. clean ;

[0069] Step S2: Based on the robustness of the target network, use a policy generator to generate an adaptively adjusted attack parameter vector θ for the product image (specifically, each attack parameter vector θ includes 7 attack parameters, namely θ1, θ2, θ3, θ4, θ5, θ6 and θ7).

[0070] Step S3: Input the attack parameter vector θ into the adversarial sample generator, and generate a clean sample X from the product image using the adversarial sample generator. clean Add perturbations to generate adversarial examples;

[0071] Step S4: Clean the product image sample X clean The adversarial examples are simultaneously input into the target network for training, and the training objective function is set.

[0072] Step S5: Repeat steps S2-S4 until the maximum number of iterations is reached to obtain the recognition model for dynamic visual container recognition.

[0073] In step S2, the attack parameter vector θ includes the shadow coverage position and the shadow value; the shadow coverage position represents the shadow attack coverage range of the product image, and the corresponding coverage area is enclosed by three vertices of the product image, and the pixel coordinates corresponding to these three vertices are (θ1, θ2), (θ3, θ4) and (θ5, θ6), respectively. The set of pixels contained in the coverage area enclosed by these three vertices is set M; the shadow value represents the shadow brightness of the product image.

[0074] In step S2, the strategy generator uses a heuristic differential evolution algorithm to generate an attack parameter vector θ for the product image.

[0075] Step S2 includes the following sub-steps:

[0076] Step S2.1: Initialize the parameter vector population

[0077] In the differential evolution algorithm, the population represents a set of attack parameter vectors θ for multiple product images, and each individual in the population represents a parameter vector θ. Given a population size N = 100 and parameter dimension D = 7, a population is randomly initialized according to a uniform distribution. The population of generation t (specifically, t takes the value 0) is represented by equation (1):

[0078]

[0079] In equation (1), This represents the value of the j-th parameter in the i-th parameter vector of the t-th generation population; This indicates the lower bound of the j-th parameter; This represents the upper bound of the j-th parameter; Indicates in and Take a random number between them;

[0080] Step S2.2: Generation of candidate parameter vector population

[0081] Using random parameter vectors and and neighboring vectors and The intersection between and outstanding individuals The mutation parameter vector is generated by inbreeding, and the mutation parameter vector is expressed by equation (2).

[0082]

[0083] In equation (2), This represents the mutation parameter vector corresponding to the i-th mutated individual; This indicates that the parameter value will be... ,s, and The calculated values ​​remain within the range described for the shearing operation; This indicates that the parameter value will be... ,s, and The calculated values ​​remain within the range described for the shearing operation; It is the currently optimal parameter vector stored externally; s is the scaling factor, with a value of 0.5; This represents a parameter vector randomly sampled from the t-th generation population; This represents another parameter vector randomly sampled from the t-th generation population; Representation and parameter vector A parameter vector with a distance of l1 (l1 represents the closest distance); Representation and parameter vector A parameter vector with a distance of l2 (l2 represents the second closest distance, i.e., second only to l1); Let i represent the parameter vector in the t-th generation of the population;

[0084] Obtain the mutation parameter vector corresponding to the mutated individual. Then, a binomial crossover operation is performed to form the final candidate parameter vector shown in equation (3):

[0085]

[0086] In equation (3), This represents the j-th parameter of the i-th mutation parameter vector in the t-th generation population; CR represents the j-th parameter of the i-th candidate parameter vector in the t-th generation population; i This represents the crossover probability, with a value of 0.6; j rand This represents a random parameter; rand(0, 1) means to generate a random number between 0 and 1.

[0087] Step S2.3: Feasible region and fitness determination

[0088] To ensure that the shadow attack coverage of the product image is focused on the target product, it is necessary to determine the feasible region of the candidate parameter vectors; select the candidate parameter vectors corresponding to the pixels that satisfy the feasible region determination. Fitness is assessed, and the parameter vectors that satisfy the fitness assessment form the next generation parameter vector population as shown in equation (4):

[0089]

[0090] In equation (4), This represents the i-th parameter vector in the (t+1)-th generation population. Let represent the i-th candidate parameter vector in the t-th generation of the population; Indicating in the candidate parameter vector The cross-entropy loss of the generated adversarial examples in the target network; In the parameter vector The cross-entropy loss of the generated adversarial examples in the target network;

[0091] When the maximum number of evolutions set in the differential evolution algorithm is reached, an attack parameter vector θ for the product image is generated adaptively in the final generated population using fitness evaluation.

[0092] In step S2.3, the process of determining the feasible region is as follows:

[0093] First, the pixel location set P of the target product is obtained using a segmentation model, see [link to relevant documentation]. Figure 2 The positions of white pixels form a set P. Assuming set M is the set of pixels covered by the shadow attack on the product image, equation (5) is used to determine whether each pixel is within the coverage area of ​​the shadow attack on the product image:

[0094]

[0095] In equation (5), card(P∩M) represents the number of pixels in the intersection of set P and set M; card(P) represents the number of pixels in set P; if the area value is less than 0.1, it means that the shadow attack coverage of the product image is too small or does not cover the target product, and pixels with an area value less than 0.1 need to be removed.

[0096] In step S2.3, the evaluation criteria for fitness determination are... As shown in equation (6):

[0097]

[0098] In equation (6), Indicates about f(g(X) clean The cross-entropy loss function between X and Y; g(X,θ) clean θ) represents an adversarial sample; Y is a clean sample of a product image X. clean The corresponding real tags.

[0099] In step S2.2, the distance l is measured using equation (7):

[0100]

[0101] In equation (7), z represents the index of the parameter vector in the population; Indicates except Other parameter vectors besides; express The vector magnitude; express The vector magnitude; express and The vector magnitude of the difference.

[0102] In step S3, the adversarial sample is a shadow adversarial sample.

[0103] In step S3, the adversarial sample generator cleans the product image sample X. clean Add shadow perturbation to generate shadow adversarial sample X adv ;

[0104] The process of adding shadow perturbation is as follows:

[0105] First, given a clean sample X of a product image in the RGB color space. clean And convert it to the LAB color space using equation (8):

[0106] LAB([RGB]) = [LAB] Equation (8)

[0107] In equation (8), LAB([RGB]) represents the operation of converting the RGB color space to the LAB color space; [LAB] represents the LAB color space image;

[0108] Secondly, shadow perturbation is generated by multiplying the corresponding L luminance channel in the LAB color space by the shadow value;

[0109] Generate shadow adversarial examples X adv The process is as follows:

[0110] Clean sample X of the input product image clean Simulating the shadows cast by natural phenomena, assuming the shadow value in the attack parameter vector θ is k (k = θ7), the generated shadow adversarial sample X... adv The values ​​of the middle pixel (m, n) are calculated using equation (9) to obtain the shadow adversarial sample X. adv :

[0111]

[0112] In equation (9), LAB mn (X adv This indicates the shadow addition operation in the LAB color space; [L mn A mn B mn ]

[0113] Represents the pixel value in the m-th row and n-th column for different channels; [k 1 1] T This represents the matrix used to change pixels, where T is the matrix transpose operation; [1 1 1] T This represents a matrix that retains the original pixel values.

[0114] In step S4, the training objective function is represented by equation (10):

[0115]

[0116] In equation (10), Represents f(X) clean The cross-entropy loss function between Y and Y; Represents f(X) clean ) and f(X adv The cross-entropy loss function of f(X); clean f(X) represents the target network's prediction result for clean samples; adv ) represents the target network's prediction result for the shadow adversarial example; α represents the penalty parameter that controls the penalty strength; α is set to 1 in the early stage of training, specifically 10, and gradually decreases to 1 as the training process progresses; w represents the target network parameters.

[0117] This invention provides an adaptive adversarial training method for dynamic visual container recognition. Steps S1-S5 train a recognition model for dynamic visual container recognition. The trained model exhibits generalization and robustness, and can actively learn multiple attack strategies to improve its adversarial attack capability. In step S2, a policy generator uses a heuristic differential evolution algorithm to generate an adaptively adjusted attack parameter vector θ for the product image. To find a suitable attack parameter vector θ, this invention formalizes step S2 as a parameter optimization process, and employs an evolutionary method following the "survival of the fittest" principle during the iterative evolution process. Specifically, this application designs step S2 as a nearest-neighbor heuristic differential evolution algorithm. Based on the attack clustering characteristics, it uses the hybridization of neighboring solution vectors to generate offspring, better guiding the parameter search direction, thereby obtaining the optimal attack parameter vector θ. This is combined with the generalized and robust target network trained in steps S3-S4.

[0118] Furthermore, the adaptive adversarial training method for dynamic visual container recognition can also be extended to learn other forms of attacks, simply by replacing the adversarial example generator with other attack forms; specifically, the parameter dimension D in step S2 needs to be changed. This patent uses ResNet18 as the target network, replaces the adversarial example generator with a PGD attack, and verifies the effectiveness of the adaptive adversarial training method for dynamic visual container recognition on the CIFAR-10 and CIFAR-100 datasets. For PGD-based patch attacks, the initial parameter dimension of the policy generator is modified to 5. The adaptive adversarial training method for dynamic visual container recognition can generate attack parameter vectors with various combinations. The PGD-based adversarial example generator further generates different adversarial examples and adds them to the target network for training. The recognition model obtained by this method increases the recognition accuracy on clean samples by 1.03% and 1.09% respectively compared to ordinary adversarial training samples, and increases the recognition accuracy under PGD-10 attacks by 1.54% and 1.23% respectively. Therefore, the recognition model trained by the adaptive adversarial training method for dynamic visual container recognition not only improves robustness, but also enhances the recognition model's ability to predict clean samples.

[0119] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An adaptive adversarial training method for dynamic visual container recognition, characterized in that, Includes the following steps: Step S1: Initialize the target network parameters or initialize the target network pre-training configuration to obtain clean sample X of correctly identified and undisturbed product images in the dynamic visual vending machine. clean ; Step S2: Based on the robustness of the target network, a policy generator is used to generate an adaptively adjusted attack parameter vector θ for the product image using a heuristic differential evolution algorithm. Step S3: Input the attack parameter vector θ into the adversarial sample generator, and generate a clean sample X from the product image using the adversarial sample generator. clean Add perturbations to generate adversarial examples; Step S4: Clean the product image sample X clean The adversarial examples are simultaneously input into the target network for training, and the training objective function is set. Step S5: Repeat steps S2-S4 until the maximum number of iterations is reached to obtain the recognition model for dynamic visual container recognition; In step S2, the attack parameter vector θ includes shadow coverage position, shadow value, or patch attack parameters; the shadow coverage position represents the shadow attack coverage range of the product image, and the corresponding coverage area is enclosed by the three vertices of the product image; the shadow value represents the shadow brightness of the product image. Step S2 includes the following sub-steps: Step S2.1: Initialize the parameter vector population In the differential evolution algorithm, the population represents a set of attack parameter vectors θ for multiple product images, and each individual in the population represents a parameter vector θ. Given the population size N and parameter dimension D, a population is randomly initialized according to a uniform distribution. The t-th generation population is represented by equation (1): In equation (1), This represents the value of the j-th parameter in the i-th parameter vector of the t-th generation population; This indicates the lower bound of the j-th parameter; This represents the upper bound of the j-th parameter; Indicates in and Take a random number between them; Step S2.2: Generation of candidate parameter vector population Using random parameter vectors and and neighboring vectors and The intersection between and outstanding individuals The mutation parameter vector is generated by inbreeding, and the mutation parameter vector is expressed by equation (2). In equation (2), This represents the mutation parameter vector corresponding to the i-th mutated individual; This indicates that the parameter value will be... s、 and The calculated values ​​remain within the range described for the shearing operation; This indicates that the parameter value will be... s、 and The calculated values ​​remain within the range described for the shearing operation; is the currently optimal parameter vector stored externally; s is the scaling factor; This represents a parameter vector randomly sampled from the t-th generation population; This represents another parameter vector randomly sampled from the t-th generation population; Representation and parameter vector A parameter vector with a distance of l1; Representation and parameter vector A parameter vector with a distance of l2; Let i represent the parameter vector in the t-th generation of the population; Obtain the mutation parameter vector corresponding to the mutated individual. Then, a binomial crossover operation is performed to form the final candidate parameter vector shown in equation (3): In equation (3), This represents the j-th parameter of the i-th mutation parameter vector in the t-th generation population; CR represents the j-th parameter of the i-th candidate parameter vector in the t-th generation population; i j represents the crossover probability; rand This represents a random parameter; rand(0,1) means to generate a random number between 0 and 1. Step S2.3: Feasible region and fitness determination To ensure that the shadow attack coverage of the product image is focused on the target product, it is necessary to determine the feasible region of the candidate parameter vectors; select the candidate parameter vectors corresponding to the pixels that satisfy the feasible region determination. Fitness is assessed, and the parameter vectors that satisfy the fitness assessment form the next generation parameter vector population as shown in equation (4): In equation (4), This represents the i-th parameter vector in the (t+1)-th generation population. Let represent the i-th candidate parameter vector in the t-th generation of the population; Indicating in the candidate parameter vector The cross-entropy loss of the generated adversarial examples in the target network; In the parameter vector The cross-entropy loss of the generated adversarial examples in the target network; When the maximum number of evolutions set in the differential evolution algorithm is reached, an attack parameter vector θ for the product image is generated adaptively in the final generated population using fitness evaluation.

2. The adaptive adversarial training method for dynamic visual container recognition according to claim 1, characterized in that, In step S2.3, the process of determining the feasible region is as follows: First, the pixel location set P of the target product is obtained using a segmentation model. Assuming that set M is the set of pixels covered by the shadow attack on the product image, equation (5) is used to determine whether each pixel is within the shadow attack coverage of the product image: In equation (5), card(P∩M) represents the number of pixels in the intersection of set P and set M; card(P) represents the number of pixels in set P; if the area value is less than 0.1, it means that the shadow attack coverage of the product image is too small or does not cover the target product, and pixels with an area value less than 0.1 need to be removed.

3. The adaptive adversarial training method for dynamic visual container recognition according to claim 2, characterized in that, In step S2.3, the evaluation criteria for fitness determination are... As shown in equation (6): In equation (6), Indicates about f(g(X) clean The cross-entropy loss function between X and Y; g(X,θ) clean θ) represents an adversarial sample; Y is a clean sample of a product image X. clean The corresponding real tags.

4. The adaptive adversarial training method for dynamic visual container recognition according to claim 2, characterized in that, In step S2.2, the distance l is measured using equation (7): In equation (7), z represents the index of the parameter vector in the population; Indicates except Other parameter vectors besides; express The vector magnitude; express The vector magnitude; express and The vector magnitude of the difference.

5. The adaptive adversarial training method for dynamic visual container recognition according to any one of claims 2-4, characterized in that, In step S3, the adversarial samples include shadow adversarial samples and patch adversarial samples.

6. The adaptive adversarial training method for dynamic visual container recognition according to claim 5, characterized in that, In step S3, the adversarial sample includes shadow adversarial samples.

7. The adaptive adversarial training method for dynamic visual container recognition according to claim 6, characterized in that, In step S3, the adversarial sample generator cleans the product image sample X. clean Add shadow perturbation to generate shadow adversarial sample X adv ; The process of adding shadow perturbation is as follows: First, given a clean sample X of a product image in the RGB color space. clean And convert it to the LAB color space using equation (8): LAB([RGB]) = [LAB] Equation (8) In equation (8), LAB([RGB]) represents the operation of converting the RGB color space to the LAB color space; [LAB] represents the LAB color space image; Secondly, shadow perturbation is generated by multiplying the corresponding L luminance channel in the LAB color space by the shadow value; Generate shadow adversarial examples X adv The process is as follows: Clean sample X of the input product image clean Simulating the shadows cast by natural phenomena, assuming the shadow value in the attack parameter vector θ is k, the generated shadow adversarial sample X... adv The values ​​of the middle pixel (m, n) are calculated using equation (9) to obtain the shadow adversarial sample X. adv : In equation (9), LAB mn (X adv This indicates the shadow addition operation in the LAB color space; [L mn A mn B mn [k 1 1] represents the pixel value in the m-th row and n-th column under different channels; T This represents the matrix used to change pixels, where T is the matrix transpose; [1 1 1] T This represents a matrix that retains the original pixel values.

8. The adaptive adversarial training method for dynamic visual container recognition according to claim 7, characterized in that, In step S4, the training objective function is represented by equation (10): In equation (10), Represents f(X) clean The cross-entropy loss function between Y and Y; Represents f(X) clean ) and f(X adv The cross-entropy loss function of f(X); clean f(X) represents the target network's prediction result for clean samples; adv ) represents the target network's prediction result for the shadow adversarial example; α represents the penalty parameter that controls the penalty strength; α is set to 1 in the early stage of training, and gradually decreases to 1 as the training process progresses; w represents the target network parameters.

Images