Adversarial sample generation method and system, storage medium and electronic device

Abstract

The application discloses an adversarial sample generation method and system, a storage medium and an electronic device, and relates to the technical field of automobile intelligent application. i The method comprises the following steps: S1, obtaining a first color statistical feature corresponding to a training sample, generating a first adversarial sample based on random noise of the training sample x i S2, obtaining a second color statistical feature; S3, performing normalization processing on the first color statistical feature and the second color statistical feature, respectively obtaining a first color distribution feature and a second color distribution feature, and calculating a similarity loss value between the two in each channel of color; S4, obtaining a total loss value through the similarity loss value calculation, and obtaining an updated loss value through the total loss value and an original loss value calculation; S5, updating the first adversarial sample through the updated loss value back propagation, and the adversarial sample generated by the application can have higher similarity with the training data in both the digital world and the physical world.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent application of automobiles, and in particular to an adversarial sample generation method and system, a storage medium and an electronic device. BACKGROUND

[0002] Adversarial sample attack in the physical world is a major security risk faced by deep learning models. Attackers can mislead deep learning models to make false detection results by generating various adversarial samples. By sticking the adversarial samples generated by optimization strategies or generation networks to the attacked objects, the attacked objects fail to be detected in the target detection network, achieving the purpose of attacking the detection algorithm. However, the existing adversarial samples face great problems, that is, the generated adversarial samples are very different from the attacked objects in terms of feature texture, and can be easily identified by human vision. Therefore, even if the adversarial samples are stuck on the attacked objects, their different styles will arouse the high vigilance and scrutiny of observers, and the stuck adversarial samples will be removed at the first time.

[0003] The existing technologies or optimization strategies or generation network strategies for adversarial sample generation methods are basically similar in the generation process, and the difference is only how to complete the iterative optimization of the adversarial samples. It can be found that the existing technologies for adversarial samples are purposeless and random in the initialization or optimization process, and there is no any constraint. The adversarial samples generated by the two strategies have a great violation performance after being stuck to the attacked samples, and the observers can easily find the existence of the adversarial samples, so that the polluted and damaged data is excluded from the test sample set. In view of the above problems in the existing technologies, some people in the field have tried to add noise to natural images to generate natural adversarial samples instead of random generation. However, the adversarial samples generated by this method perform well in white-box attacks but are difficult to adapt to black-box attacks, and have no strong migration ability. Therefore, the generated adversarial samples are difficult to satisfy people due to their great violation, and are also difficult to be naturally applied in adversarial attacks in the physical world.

[0004] How to generate adversarial samples with high concealment so that observers are more difficult to find the attacked victim data and reduce the unpredictable threat of intelligent systems is a problem to be solved in the field. SUMMARY

[0005] In order to solve the above problems, the present application provides an adversarial sample generation method and system, a storage medium and an electronic device, which are used to solve the problem of poor concealment of the generated adversarial samples in the prior art and easy identification. The relative entropy loss function is used for constraint, so that the adversarial samples tend to generate adversarial samples similar to the statistical characteristics of the training data in the continuous iterative optimization process.

[0006] In order to achieve the above object, the first aspect of the present application provides an adversarial sample generation method, comprising the following steps:

[0007] S1, the training sample x in the training data set X i Based on color channel splitting processing, obtaining the first color statistical characteristics i Corresponding to the training sample x i Based on the random noise of the training sample x ori Generate the first adversarial sample P;

[0008] S2, the first adversarial sample P based on color channel splitting processing, obtaining the second color statistical characteristics

[0009] S3, the first color statistical characteristics And the second color statistical characteristics Normalization processing, respectively obtaining the first color distribution characteristics L ad And the second color distribution characteristics L j , and calculating the similarity loss value L j Between the color channels.

[0010] S4, the overall loss value L statis Is obtained by calculating the similarity loss value L statis The updated loss value L orig Is calculated by the overall loss value L new And the original loss value L new ;

[0011] S5, the first adversarial sample P is updated by the updated loss value L i .

[0012] Preferably, in the step S1, the color information of all channel images is counted, wherein the color channel is RGB channel, and the corresponding first color statistical characteristics

[0013] Preferably, in the step S1, a random noise with the same size as the training sample x i In the training data set is randomly initialized, and the random noise is attached to the selected sample to form the first adversarial sample P.

[0014] Preferably, in the step S2, the first adversarial sample P is based on color channel splitting processing, and the color information of all channel images is counted, and the corresponding second color statistical characteristics

[0015] Preferably, in the step S3, the first color statistical characteristics Normalization processing includes:

[0016] based on the first color statistical feature obtaining the training data cumulative statistical feature The calculation expression is:

[0017]

[0018] wherein, represents the training sample x i corresponding to all channel images; represents all channel images of the 256-dimensional training data cumulative statistical feature; W and H respectively represent the width and length of the training sample x i corresponding to all channel images; R represents the number of samples participating in training;

[0019] performing SVD decomposition on the training data cumulative statistical feature to determine the corresponding maximum singular value σ MAX , and obtaining the first color distribution feature L ori The first color distribution feature L ori The calculation expression is:

[0020]

[0021] wherein, σ MAX represents the maximum singular value of the training data cumulative statistical feature , and σ MAX ∈(0, 1].

[0022] Preferably, in the step S3, the second color statistical feature The normalization processing includes:

[0023] based on the second color statistical feature obtaining the adversarial sample statistical feature The calculation expression is:

[0024]

[0025] wherein, represents all channel images corresponding to the first adversarial sample P; represents all channel images of the 256-dimensional adversarial sample statistical feature; W and H respectively represent the width and length of the first adversarial sample P corresponding to all channel images;

[0026] performing SVD decomposition on the adversarial sample statistical feature to determine the corresponding maximum singular value δ MAX , and obtaining the second color distribution feature Lad , the second color distribution feature L ad The calculation expression is:

[0027]

[0028] wherein, δ MAX represents the maximum singular value of the adversarial sample statistical feature , δ MAX ∈(0, 1].

[0029] Preferably, in the step S3, the calculation expression of the similarity loss value L j is:

[0030] L j = D KL (L ori || L ad ), j∈{R, G, B}

[0031] wherein, L j represents the similarity loss value between the first color distribution feature L ori and the second color distribution feature L ad in RGB channels.

[0032] Preferably, in the step S4, the first adversarial sample is taken as input, the confidence is calculated by the target detection algorithm, and is taken as the original loss function L orig The calculation expression of the confidence is:

[0033]

[0034] wherein, B represents the number of reference frames, S represents the output feature grid size, and C represents the number of categories.

[0035] Preferably, in the step S4, the overall loss value L j is calculated by the similarity loss value L statis The calculation expression of the overall loss value L j is:

[0036]

[0037] wherein, α j represents the weight coefficient corresponding to each channel, and α j ∈[0, 1], and ∑ j∈{R,G,B} α j =1.

[0038] Preferably, in the step S4, the update loss value L statis is calculated by the overall loss value L orig and the original loss value L new The calculation expression of the update loss value L statis is:

[0039] L new =L orig +βL statis

[0040] wherein, β represents the overall loss value L statis corresponding weight coefficient.

[0041] Preferably, in the step S5, the loss value L new by back propagation including: gradient fixing of target detection and distribution gap calculation, random noise generated by gradient descent optimization on the random noise, and updating the first adversarial sample P by the optimized random noise.

[0042] The second aspect of the present application provides an adversarial sample generation system, comprising:

[0043] a color feature module, configured to split the training sample x i in the training data set X based on color channels to obtain the first color statistical feature corresponding to the training sample x i . based on the training sample x i , generate a first adversarial sample P; and split the first adversarial sample based on color channels to obtain a second color statistical feature;

[0044] a sample generation module, configured to normalize the first color statistical feature and the second color statistical feature to obtain a first color distribution feature L ori and a second color distribution feature L ad respectively, and calculate the similarity loss value L j between the two color channels; calculate the overall loss value L statis based on the similarity loss value L j ; calculate the updated loss value L statis based on the overall loss value L orig and the original loss value L new ; and update the first adversarial sample P by back propagation based on the updated loss value L new .

[0045] Preferably, the color information of all channel images is counted, wherein the color channel is an RGB channel, and the first color statistical feature

[0046] Preferably, a random noise with the same size as the training sample x i in the training data set is randomly initialized, and the random noise is attached to the selected sample to form the first adversarial sample P.

[0047] Preferably, the first adversarial sample P is split based on color channels, color information of all channel images is counted, and a corresponding second color statistical feature is generated

[0048] Preferably, the first color statistical feature The normalization processing includes:

[0049] Based on the first color statistical feature The training data cumulative statistical feature is obtained by calculation The expression is calculated as:

[0050]

[0051] wherein, x represents the training sample i corresponding to all channel images; represents all channel images of the 256-dimensional training data cumulative statistical feature; and H represents the training sample x i corresponding to all channel images; R represents the number of samples that have participated in training;

[0052] The training data cumulative statistical feature is subjected to SVD decomposition to determine the corresponding maximum singular value σ MAX , and the first color distribution feature L ori is obtained by calculation ori The expression is calculated as:

[0053]

[0054] wherein, σ MAX represents the maximum singular value of the training data cumulative statistical feature , and σ MAX ∈(0, 1].

[0055] Preferably, the second color statistical feature The normalization processing includes:

[0056] Based on the second color statistical feature The adversarial sample statistical feature is obtained by calculation The expression is calculated as:

[0057]

[0058] wherein, represents all channel images corresponding to the first adversarial sample P; represents all channel images 256-dimensional adversarial sample statistical features; W and H represent the width and length of the first adversarial sample P corresponding to all channel images, respectively;

[0059] Adversarial sample statistical features SVD decomposition is performed to determine the corresponding maximum singular value δ MAX The second color distribution feature L is calculated and obtained ad The second color distribution feature L ad The expression is calculated as:

[0060]

[0061] wherein δ MAX represents the maximum singular value of the adversarial sample statistical features , and δ MAX ∈(0,1].

[0062] Preferably, the calculation expression of the similarity loss value L j is:

[0063] L j = D KL (L ori ||L ad ),j∈{R,G,B}

[0064] wherein L j represents the similarity loss value between the first color distribution feature L ori and the second color distribution feature L ad .

[0065] Preferably, the adversarial sample generation system, characterized in that the first adversarial sample is taken as input, the confidence is calculated by a target detection algorithm, and is taken as the original loss function L orig The calculation expression of the confidence is:

[0066]

[0067] wherein B represents the number of reference frames, S represents the output feature grid size, and C represents the number of categories.

[0068] Preferably, in the step S4, the overall loss value L j is calculated by the similarity loss value L statis The calculation expression of the overall loss value L statis is:

[0069]

[0070] wherein α j represents the weight coefficient corresponding to each channel, and α j ∈[0,1], and ∑j∈{R,G,B} α j = 1.

[0071] Preferably, the total loss value L statis and the original loss value L orig The calculation expression of the update loss value L new is as follows:

[0072] L new = L orig + βL statis

[0073] Wherein, β represents the weight coefficient corresponding to the total loss value L statis .

[0074] Preferably, the update loss value L new is obtained by back propagation including: gradient fixing of target detection and distribution gap calculation, random noise generated by gradient descent optimization on the random noise, and updating the first adversarial sample P by the optimized random noise.

[0075] The third aspect of the present application provides a storage medium having a computer program stored thereon, the program being executed by a processor to implement the steps of the adversarial sample generation method.

[0076] The fourth aspect of the present application provides an electronic device comprising a processor and a storage medium.

[0077] The storage medium is used to store instructions; and

[0078] The processor is used to operate according to the instructions to perform the steps of the adversarial sample generation method.

[0079] Advantages of the present application:

[0080] (1) The present application normalizes the color features, limits the change in a small range on the basis of limiting the degree of change of the function, and makes the change continuous in a small range, so that the calculation model is more stable:

[0081] (2) The present application uses the update loss value to make the updated first adversarial sample meet the requirements of reducing the confidence of the target detection algorithm to a low enough level and the gap between the two distributions small enough through back propagation;

[0082] (3) The present application has the characteristics of strong concealment of the adversarial sample obtained by iterative training, which can force the corresponding target detection algorithm to better improve its own detection robustness. BRIEF DESCRIPTION OF DRAWINGS

[0083] Figure 1 The flowchart of the present application is shown in the figure;

[0084] Figure 2 Figure A is an algorithmic flowchart of the present application;

[0085] Figure 3 Figure B is an algorithmic flowchart of the present application;

[0086] Figure 4 Figure C is a structural block diagram of the present application. DETAILED DESCRIPTION

[0087] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It is to be understood, however, that the description is merely exemplary of the present disclosure, and is not intended to limit the scope of the present disclosure. In the following detailed description of the embodiments of the present disclosure, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it would be apparent to one skilled in the art that the present disclosure can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present disclosure.

[0088] The terms used herein are merely used to describe specific embodiments, and are not intended to limit the present disclosure. The terms "include" and "have" and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

[0089] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present description, and should not be interpreted in an idealized or overly formal manner.

[0090] In the case where expressions such as "at least one of A, B, and C, etc." are used, it generally should be interpreted to include any of one, two, or all of the items enumerated after the conjunction, unless otherwise specifically indicated (e.g., "a system having at least one of A, B, and C" should be interpreted to include a system having A alone, a system having B alone, a system having C alone, a system having both A and B together, a system having both A and C together, a system having both B and C together, and / or a system having all of A, B, and C together, etc.). In the case where an expression such as "at least one of A, B, or C, etc." is used, it generally should be interpreted to include any of one, two, or all of the items enumerated after the conjunction, unless otherwise specifically indicated (e.g., "a system having at least one of A, B, or C" should be interpreted to include a system having A alone, a system having B alone, a system having C alone, a system having both A and B together, a system having both A and C together, a system having both B and C together, and / or a system having all of A, B, and C together, etc.).

[0091] The accompanying drawings illustrate several block diagrams and / or flowcharts. It should be understood that some blocks, or combinations thereof, in the block diagrams and / or flowcharts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that, when executed by the processor, these instructions can create means for implementing the functions / operations described in these block diagrams and / or flowcharts. The technology of this disclosure can be implemented in hardware and / or software (including firmware, microcode, etc.). Alternatively, the technology of this disclosure can take the form of a computer program product stored on a computer-readable storage medium, which is available for use by or in conjunction with an instruction execution system.

[0092] In autonomous driving scenarios, since the intelligent decision-making process relies on the perception of external road conditions, highly concealed adversarial examples pose a significant threat to autonomous driving perception systems. This invention can generate adversarial examples that more closely resemble the autonomous driving environment, making defensive algorithms in the autonomous driving field more difficult to detect and preventing serious safety incidents.

[0093] like Figure 1 As shown, the first aspect of the present invention provides an adversarial example generation method, comprising the following steps:

[0094] S1. Take the training samples x from the training dataset X. i The color channel is used for splitting to obtain the result compared to the training sample x. i Corresponding first color statistical features Based on training samples x i The first adversarial sample P is generated from random noise;

[0095] S2. The first adversarial sample P is split based on color channels to obtain the second color statistical features.

[0096] S3, Statistical features of the first color and second color statistical characteristics After normalization, the first color distribution feature L is obtained respectively. ori and the second color distribution feature L ad And calculate the similarity loss value L between the two in each color channel. j ;

[0097] S4, using similarity loss value L j Calculate the total loss value L statis Through the total loss value L statis Compared with the original loss value L orig The update loss value L is calculated. new ;

[0098] S5. Update the loss value L new Backpropagation updates the first adversarial sample P.

[0099] Existing technologies generate adversarial examples based on optimization strategies or generative networks. After generating the adversarial examples, both strategies require re-detecting the adversarial data after pasting the adversarial examples and calculating the corresponding original loss value L using the corresponding loss function. orig The original loss value L orig This will guide subsequent adversarial example updates or network updates. However, this invention obtains the original loss value L. orig Instead of using it directly for subsequent optimization, it calculates training data on adversarial examples to generate a new updated loss value, which is used to generate highly similar adversarial examples. Highly similar adversarial examples have strong concealment characteristics, which can force the corresponding target detection algorithm to better improve its own detection robustness.

[0100] It should be noted that commonly used color modes include RGB, CMYK, HSB / HSV, HSL, YUV, YCbCr, CIELAB, etc. When implementing this invention, a color mode that meets the requirements can be selected. Each color mode has a corresponding color channel. In this invention, the RGB mode is used, and correspondingly, all color channels are RGB channels. In this invention, j∈{R,G,B}, and the value of j is directly related to the selected color channel type. For example, when selecting the CMYK channel, j∈{C,M,Y,K}. Therefore, the protection of this invention is not limited to application scenarios under the RGB channel. Any scheme that conforms to the principle and concept of this invention and related non-RGB channel application methods are within the protection scope of this invention.

[0101] like Figures 2-3 As shown, adversarial examples are obtained by adding randomly generated Gaussian noise to the original data. Then, the process is divided into two steps. First, the adversarial examples are processed by an object detection network to obtain the predicted confidence of the target object, which is used as the original loss. Then, the color distribution of the adversarial examples and the original image is statistically analyzed by color channel. The mean and variance are then normalized to unify them. Finally, the difference between the two distributions is calculated and used as the supplementary loss. Finally, the original loss and the supplementary loss are combined and the noise added to the original image is updated by backpropagation.

[0102] Preferably, in step S1, the color information of all channel images is statistically analyzed, wherein the color channels are RGB channels, and corresponding first color statistical features are generated.

[0103] In one embodiment, each training sample x is segmented using a splitting algorithm. iThe image is split into three parts (R, G, B) based on the RGB channels. Further segmentation based on the RGB channels yields three single-channel images: and All channel images are represented as j∈{R,G,B}.

[0104] Preferably, in step S1, a training sample x from the training dataset is randomly initialized. i Random noise of the same magnitude is added to the selected samples to form the first adversarial sample P.

[0105] In one embodiment, the adversarial example P is split into three parts, R, G, and B, according to the RGB channels using a segmentation algorithm. The segmentation is then performed based on the RGB channels to obtain... Statistics of all channel images The color information also forms a 256-dimensional color statistical feature vector corresponding to the adversarial example. Each dimension corresponds to a channel image The number of pixels at this pixel value.

[0106] Statistics of all channel images The color information on the sample forms a match with the training sample x. i The corresponding 256-dimensional first statistical eigenvector Where j∈{R,G,B}. First statistical eigenvector. Each dimension corresponds to a channel image The number of pixels at this pixel value.

[0107] Preferably, in step S2, the first adversarial sample P is split based on color channels, and the color information of all channel images is statistically analyzed to generate corresponding second color statistical features.

[0108] Preferably, in step S3, the first color statistical feature Normalization includes:

[0109] Based on the first color statistical features Calculate the cumulative statistical features of the training data The calculation expression is:

[0110]

[0111] in, Indicates training sample x i All corresponding channel images; Represents all channel images The 256-dimensional cumulative statistical features of the training data; W and H represent the training samples x, respectively.i The width and length of the corresponding images for all channels; R represents the number of samples used in training;

[0112] Cumulative statistical features of training data Perform SVD decomposition to determine its corresponding maximum singular value σ. MAX And calculate to obtain the first color distribution feature L ori First color distribution feature L ori The calculation expression is:

[0113]

[0114] Where, σ MAX Represents the cumulative statistical features of training data The maximum singular value, σ MAX ∈(0,1).

[0115] Preferably, in step S3, the second color statistical feature Normalization includes:

[0116] Based on the statistical features of the second color Calculate and obtain the statistical features of adversarial examples The calculation expression is:

[0117]

[0118] in, This represents all channel images corresponding to the first adversarial sample P; Represents all channel images The 256-dimensional statistical features of adversarial examples; W and H represent the width and length of the first adversarial example P corresponding to all channels of the image, respectively;

[0119] Statistical characteristics of adversarial examples Perform SVD decomposition to determine its corresponding maximum singular value δ MAX And calculate to obtain the second color distribution feature L ad Second color distribution feature L ad The calculation expression is:

[0120]

[0121] Where, δ MAX Indicating the statistical characteristics of adversarial examples The maximum singular value, δ MAX ∈(0,1).

[0122] In the training process, each batch is only a small part of the sample distribution, if not normalized, will cause each batch to learn the distribution of the dramatic changes, so that the model fluctuation, therefore, the main role of the normalization is to limit the function of the degree of change, so that the model is stable.

[0123] The normalization in the application includes two steps, step one is to count the number of pixel points of the first color statistical feature and the second color statistical feature According to the size of all channel images, the number of pixel points is normalized to obtain the training data cumulative statistical feature and the adversarial sample statistical feature In order to make the model more stable, step two is spectral normalization, which limits the degree of change of the function, limits the change in a small range, and makes the change in a small range and continuous, specifically, the SVD decomposition of the training data cumulative statistical feature and the adversarial sample statistical feature is performed to determine the maximum singular value, and the first color distribution feature L ori and the second color distribution feature L ad are obtained by corresponding maximum singular value calculation.

[0124] Preferably, in step S3, the calculation expression of the similarity loss value L j is:

[0125] L j =D KL (L ori ||L ad ),j∈{R,G,B}

[0126] Wherein, L j represents the similarity loss value between the first color distribution feature L ori and the second color distribution feature L ad in RGB channels.

[0127] The application calculates the similarity loss value L j of the first color distribution feature L ori and the second color distribution feature L ad corresponding to the adversarial sample P in each channel through the relative entropy loss function (also known as KL divergence). The relative entropy loss function is used to measure the difference between the first color distribution feature L ori and the second color distribution feature L ad under the same distribution, the smaller the similarity loss value L j , the smaller the difference between the two, and the closer the distribution rule.

[0128] Preferably, in the step S4, the first adversarial sample is input, the confidence is calculated by the target detection algorithm, and the confidence is taken as the original loss function L orig The calculation expression of the confidence is as follows:

[0129]

[0130] Wherein, B represents the number of reference frames, S represents the output feature grid size, and C represents the number of categories.

[0131] Preferably, in the step S4, the first adversarial sample is input, the confidence is calculated by the target detection algorithm, and the confidence is taken as the original loss function L orig The calculation expression of the confidence is as follows:

[0132]

[0133] Wherein, B represents the number of reference frames, S represents the output feature grid size, and C represents the number of categories.

[0134] In the application, the first adversarial sample P is calculated by the target detection algorithm to obtain the confidence f of whether the target object exists in the first adversarial sample P, in order to improve the attack success rate of the adversarial sample P on the target object, the confidence of the target detection algorithm on the target object should be low enough. Therefore, the confidence is taken as the original loss value L orig .

[0135] Preferably, in the step S4, the total loss value L j is calculated by the similar loss value L statis The calculation expression of the total loss value L

[0136]

[0137] Wherein, alpha j represents a weight coefficient corresponding to each channel, alpha j ∈[0,1], and sum j∈{R,G,B} alpha j =1.

[0138] In an embodiment, the weight coefficient alpha j can control which channel is mainly kept uniform in features between the adversarial sample P and the training data set X. For example, alpha R =1.0, alpha G =0.0, and alpha B =0.0, which means that the adversarial sample P is only kept uniform in the R channel with the training data. In the initial setting of the application That is, the same feature uniformity needs to be kept in the R, G and B channels, and the weights are equal. Alpha jThe determination of the value can be set according to different application scenarios or different task objectives.

[0139] During the network training process of this invention, there is a chance that different training datasets will be encountered. In the case of non-convergence, the Wasserstein distance can be used instead of the relative entropy loss function (KL divergence) as a measure of the distance between the two distributions.

[0140] During training, if the color distribution of the training dataset differs significantly from that of the adversarial examples, there will be no non-negligible overlap between the two distributions. Therefore, regardless of the distance between the two distributions, the KL divergence will always be log2, resulting in... The gradient is (approximately) zero, causing gradient vanishing. In such cases, the W distance can be used to calculate... By combining spectral normalization, the problem of gradients being zero is solved, thus enabling network training to converge.

[0141] Preferably, in step S4, the total loss value L is used. statis Compared with the original loss value L orig Calculate and obtain the update loss value L new The calculation expression is:

[0142] L new =L orig +βL statis

[0143] Where β represents the total loss value L statis The corresponding weighting coefficients.

[0144] After generating an adversarial example P, the corresponding original loss value L can be calculated by directly detecting the adversarial data after pasting the adversarial example P and using the corresponding loss function. orig .

[0145] In this invention, the initial value is β = 1e -4 The weight is relatively small because controlling the statistical features' constraints on the adversarial example P does not affect the original aggressiveness of the adversarial example P. Finally, L will be used. new Complete subsequent optimizations and updates to the adversarial examples or the generator network, and continuously iterate to generate highly similar adversarial examples.

[0146] Preferably, in step S5, the loss value L is updated. newBackpropagation includes: fixing the gradient for target detection and distribution gap calculation; optimizing the random noise by performing gradient descent on the random noise; and updating the first adversarial sample P with the optimized random noise. This ensures that the updated first adversarial sample P satisfies both reducing the confidence of the target detection algorithm to a sufficiently low level and minimizing the gap between the two distributions.

[0147] like Figure 4 As shown, a second aspect of the present invention provides an adversarial example generation system, comprising:

[0148] The color feature module is used to select training samples x from the training dataset X. i The color channel is used for splitting to obtain the result compared to the training sample x. i Corresponding first color statistical features Based on training samples x i The first adversarial sample P is generated from random noise; the first adversarial sample is split based on color channels to obtain the second color statistical features;

[0149] The sample generation module will use the first color statistical features and second color statistical characteristics After normalization, the first color distribution feature L is obtained respectively. ori and the second color distribution feature L ad And calculate the similarity loss value L between the two in each color channel. j ; through similarity loss value L j Calculate the total loss value L statis Through the total loss value L statis Compared with the original loss value L orig The update loss value L is calculated. new By updating the loss value L new Backpropagation updates the first adversarial sample P.

[0150] Existing technologies generate adversarial examples based on optimization strategies or generative networks. After generating the adversarial examples, both strategies require re-detecting the adversarial data after pasting the adversarial examples and calculating the corresponding original loss value L using the corresponding loss function. orig The original loss value L orig This will guide subsequent adversarial example updates or network updates. However, this invention obtains the original loss value L. orig Instead of using it directly for subsequent optimization, it calculates the adversarial sample and training data to generate a new updated loss value, which is used to generate highly similar adversarial samples. Highly similar adversarial samples have strong concealment characteristics, which can force the corresponding target detection algorithm to better improve its own detection robustness.

[0151] It should be noted that the commonly used color modes include: RGB, CMYK, HSB / HSV, HSL, YUV, YCbCr, CIELAB, etc., and in the implementation of the present application, the color mode meeting the requirements can be selected, each color mode has a corresponding color channel, in the present application, the RGB mode is adopted, and the corresponding color channel is also RGB channel, in the present application, j∈{R,G,B}, the j value is directly related to the selected color channel type, for example, when the CMYK channel is selected, j∈{C,M,Y,K}, therefore, the present application is not limited to the application scene under the RGB channel, but any scheme meeting the principle and concept of the present application and the related non-RGB channel application method also belongs to the protection scope of the present application.

[0152] The system of the present application can perform different degree of constraint processing on the color statistical characteristics of the adversarial sample on the R, G and B three channels under the premise of ensuring the original attack effect of the adversarial sample, the high similarity adversarial sample generated by the present application has higher consistency in color distribution characteristics with the original training data, thereby reducing the sense of discomfort of the adversarial sample when being pasted to the test data. Meanwhile, the scheme of the present application can be directly applied to the two main current adversarial sample generation strategy frameworks, without additional adaptation processing.

[0153] The adversarial sample is obtained by adding random generated Gaussian noise to the original data, and then two steps are taken, first, the adversarial sample is subjected to the target detection network to obtain the predicted target object confidence as the original loss, then the color distribution of the adversarial sample and the original image is respectively counted according to the color channel, and then the mean and variance are unified through normalization, and finally the difference between the two distributions is calculated, which is used as a supplementary loss, and finally the original loss and the supplementary loss are combined, and the noise added to the original image is updated through the back propagation mode.

[0154] Preferably, the color information of all channel images is counted, wherein the color channel is an RGB channel, and a corresponding first color statistical feature is generated

[0155] Preferably, a training sample x i A random noise with the same size is added to the selected sample to form a first adversarial sample P.

[0156] In one embodiment, each training sample x i Split into R, G, B three parts according to the RGB channel, and the splitting processing is performed according to the RGB channel, so as to obtain three single channel images respectively as: and All channel images are represented as j e {R, G, B}.

[0157] Preferably, the first adversarial sample P is split based on color channels, color information of all channel images is counted, and a corresponding second color statistical feature is generated

[0158] In an embodiment, the adversarial sample P is split into R, G, and B parts by a splitting algorithm, and is split based on RGB channels to obtain Color information of all channel images is counted to form a 256-dimensional color statistical feature vector corresponding to the adversarial sample P Each dimension corresponds to a channel image The number of pixel points at the pixel value.

[0159] Preferably, color information of all channel images is counted, wherein the color channels are RGB channels, and a corresponding first color statistical feature is generated

[0160] Color information of all channel images is counted to form a 256-dimensional first statistical feature vector corresponding to the training sample x i wherein j e {R, G, B}. The first statistical feature vector Each dimension corresponds to a channel image The number of pixel points at the pixel value.

[0161] Preferably, the first color statistical feature Normalization processing includes:

[0162] Based on the first color statistical feature A training data cumulative statistical feature is obtained by calculation The calculation expression is:

[0163]

[0164] wherein, all channel images corresponding to the training sample x i ; and A 256-dimensional training data cumulative statistical feature of all channel images ; W and H represent the width and length of all channel images corresponding to the training sample x i ; and R represents the number of samples that have participated in training.

[0165] The training data cumulative statistical feature is subjected to SVD decomposition to determine the corresponding maximum singular value σ​MAX And calculate to obtain the first color distribution feature L ori First color distribution feature L ori The calculation expression is:

[0166]

[0167] Where, σ MAX Represents the cumulative statistical features of training data The maximum singular value, σ MAX ∈(0,1).

[0168] Preferred, second color statistical features Normalization includes:

[0169] Based on the statistical features of the second color Calculate and obtain the statistical features of adversarial examples The calculation expression is:

[0170]

[0171] in, This represents all channel images corresponding to the first adversarial sample P; Represents all channels of the image The 256-dimensional statistical features of adversarial examples; W and H represent the width and length of the first adversarial example P corresponding to all channels of the image, respectively;

[0172] Statistical characteristics of adversarial examples Perform SVD decomposition to determine its corresponding maximum singular value δ MaX And calculate to obtain the second color distribution feature L ad Second color distribution feature L ad The calculation expression is:

[0173]

[0174] Where, δ MAX Indicating the statistical characteristics of adversarial examples The maximum singular value, δ MAX ∈(0,1).

[0175] During training, each batch represents only a small portion of the distribution. Without normalization, the distribution that each batch learns will change drastically, causing the model to fluctuate. Therefore, the main purpose of normalization is to limit the drastic changes in the function, thereby stabilizing the model.

[0176] The normalization in this invention includes two steps. The first step is to perform statistical analysis on the first color feature. and second color statistical characteristics The pixel point statistical quantity is obtained by number normalization according to the image size of all channels to obtain training data cumulative statistical characteristics and the adversarial sample statistical characteristics In order to make the model more stable, step two is spectral normalization, which limits the change in the degree of function change, limits the change in a small range, and makes the change in a small range and continuous, and the specific is to perform training data cumulative statistical characteristics and the adversarial sample statistical characteristics SVD decomposition, determine the maximum singular value, and calculate the first color distribution feature L ori and the second color distribution feature L ad .

[0177] Preferably, the calculation expression of the similarity loss value L j is:

[0178] L j = D KL (L ori ||L ad ), j e {R, G, B}

[0179] Wherein, L j represents the similarity loss value between the first color distribution feature L ori and the second color distribution feature L ad in each channel of RGB.

[0180] The present application calculates the similarity loss value L j between the first color distribution feature L ori and the second color distribution feature L ad of the adversarial sample P in each channel through the relative entropy loss function (also called KL divergence). The relative entropy loss function is used to measure the difference between the first color distribution feature L ori and the second color distribution feature L ad under the same distribution, and the smaller the similarity loss value L j , the smaller the difference between the two, and the closer the distribution rule is to the same distribution.

[0181] Preferably, the adversarial sample generation system, characterized by taking the first adversarial sample as input, calculating the confidence through the target detection algorithm, and taking the confidence as the original loss function L orig , and the calculation expression of the confidence is:

[0182]

[0183] Wherein, B represents the number of reference frames, S represents the output feature grid size, and C represents the number of categories.

[0184] In the present application, the first adversarial sample P is passed through the target detection algorithm to calculate the confidence f of whether the target object exists in the first adversarial sample P. In order to improve the attack success rate of the adversarial sample P on the target object, the confidence of the target detection algorithm on the target object should be low enough. Therefore, the confidence is taken as the original loss value L orig .

[0185] Preferably, the similarity loss value L j is calculated to obtain the overall loss value L statis The calculation expression of the overall loss value L

[0186]

[0187] Wherein, α j represents the weight coefficient corresponding to each channel, and α j ∈[0, 1], ∑ j∈{R,G,B} α j =1.

[0188] In an embodiment, the weight coefficient α j can control which channel the adversarial sample P and the training data set X are mainly kept consistent in feature. For example, α R =1.0, α G =0.0, and α B =0.0, which means that the adversarial sample P is only consistent with the training data in the R channel. In the initial setting of the present application That is, the same feature consistency needs to be kept in the R, G, and B channels, and the weights are equal. The determination of α j can be set according to different application scenarios or different task purposes.

[0189] In the network training process of the present application, for different training data sets, there is a probability that non-convergence will occur. At this time, the W distance (Wasserstein distance) can be used to replace the relative entropy loss function (KL divergence) as the distance measurement function between two distributions.

[0190] In the training process, if the color distribution of the training data set and the color distribution of the adversarial sample are too different, it will lead to no negligible overlap between the two distributions, so no matter how far apart the two distributions are, the KL divergence is log2, causing the gradient (approximation) to be 0, resulting in gradient disappearance. In such a case, the W distance can be used to calculate Combined with spectral normalization, the problem of gradient being 0 is solved, and the network training converges.

[0191] Preferably, the overall loss value L statisThe original loss value L orig The calculation expression of the updated loss value L new is as follows:

[0192] L new = L orig + βL statis

[0193] wherein β represents a weight coefficient corresponding to the overall loss value L statis .

[0194] After the adversarial sample P is generated, the corresponding original loss value L orig can be calculated by directly detecting the adversarial data after the adversarial sample P is pasted and using the corresponding loss function.

[0195] In the present application, the initial value is β = 1e -4 , and the weight is small because controlling the statistical characteristics will not affect the original attack of the adversarial sample P. Finally, L new will be used to complete the subsequent optimization and update of the adversarial sample or the generation network, and high-similarity adversarial samples are continuously generated through iteration.

[0196] Preferably, the updated loss value L new is obtained through back propagation, including gradient fixing of target detection and distribution gap calculation, generating random noise through gradient descent optimization on the random noise, and updating the first adversarial sample P through the optimized random noise.

[0197] The third aspect of the present application provides a storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the steps of the adversarial sample generation method.

[0198] The fourth aspect of the present application provides an electronic device comprising a processor and a storage medium.

[0199] The storage medium is used to store instructions; and

[0200] The processor is used to operate according to the instructions to perform the steps of the adversarial sample generation method.

[0201] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0202] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps in one or more flow or blocks

[0203] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps in one or more flow or blocks

[0204] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps in one or more flow or blocks

[0205] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0206] The memory can include non-persistent memory and / or volatile memory, such as a random access memory (RAM) including a cache area for the temporary storage of data. The memory can also include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), or electrically erasable programmable read only memory (EEPROM), for the storage of software that is read during runtime. The memory is an example of computer readable media.

[0207] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0208] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0209] The above only is an embodiment of the present application, and is not used to limit the present application. For those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A method for generating adversarial examples, characterized in that, Includes the following steps: S1, The training dataset training samples The data is split based on color channels to obtain the results compared to the training samples. Corresponding first color statistical features Randomly initialize a sample that is similar to the training sample. Random noise of the same size is added to the training samples. Above, to generate the first adversarial example. ; S2, the first adversarial sample The second color statistical features are obtained by splitting the color channels. ; S3, Statistical features of the first color and second color statistical characteristics Normalization was performed to obtain the first color distribution features. and the distribution characteristics of the second color And calculate the similarity loss value between the two in each color channel. ; S4. Using similarity loss values Calculate the total loss value Through the total loss value Compared with the original loss value The updated loss value is calculated. ; S5. Update the loss value Backpropagation updates the first adversarial sample .

2. The adversarial example generation method according to claim 1, characterized in that, In step S1, the color information of all channel images is statistically analyzed, wherein the color channels are RGB channels, and corresponding first color statistical features are generated. .

3. The adversarial example generation method according to claim 1, characterized in that, In S2, the first adversarial sample The color channels are split to obtain channel images corresponding to each RGB channel. The color information of all channel images is statistically analyzed to generate corresponding second color statistical features. .

4. The adversarial example generation method according to claim 1, characterized in that, In S3, the first color statistical feature Normalization includes: Based on the first color statistical features Calculate the cumulative statistical features of the training data The calculation expression is: in, Indicates training samples All corresponding channel images; Represents all channels of the image The cumulative statistical features of the 256-dimensional training data; and They represent the training samples respectively. The width and length of the corresponding image channels; Cumulative statistical features of training data Perform SVD decomposition to determine its corresponding maximum singular value. And calculate to obtain the first color distribution features First color distribution characteristics The calculation expression is: in, Represents the cumulative statistical features of training data The maximum singular value, .

5. The adversarial example generation method according to claim 1, characterized in that, In S3, the second color statistical feature Normalization includes: Based on the statistical features of the second color Calculate and obtain the statistical features of adversarial examples The calculation expression is: in, Indicates the first adversarial sample All corresponding channel images; Represents all channels of the image Statistical features of 256-dimensional adversarial examples; and These represent the first adversarial samples. The width and length of the corresponding image channels; Statistical characteristics of adversarial examples Perform SVD decomposition to determine its corresponding maximum singular value. And calculate to obtain the second color distribution characteristics. Second color distribution characteristics The calculation expression is: in, Indicating the statistical characteristics of adversarial examples The maximum singular value, .

6. The adversarial example generation method according to claim 1, characterized in that, In S3, the similarity loss value The calculation expression is: in, Indicates the first color distribution characteristics and the distribution characteristics of the second color Similarity loss values ​​between RGB channels; Indicates calculation KL divergence.

7. The adversarial example generation method according to claim 1, characterized in that, In step S4, the first adversarial example is used as input, and the confidence level is calculated using an object detection algorithm, which is then used as the original loss function. The confidence level is calculated using the following expression: in, This represents the number of reference boxes. Indicates the output feature grid size. Indicates the number of categories.

8. The adversarial example generation method according to claim 1, characterized in that, In step S4, the similarity loss value is used. Calculate the total loss value The calculation expression is: in, This represents the weight coefficient corresponding to each channel, and , .

9. The adversarial example generation method according to claim 1, characterized in that, In S4, the total loss value is used. Compared with the original loss value Calculate and obtain the updated loss value The calculation expression is: in, Represents the total loss value The corresponding weighting coefficients.

10. The adversarial example generation method according to claim 1, characterized in that, In step S5, the loss value is updated. Backpropagation includes: fixing the gradient for target detection and distribution gap calculation; generating random noise by performing gradient descent optimization on the random noise; and updating the first adversarial sample with the optimized random noise. .

11. An adversarial example generation system, characterized in that, include: The color feature module is used to process the training dataset. training samples The data is split based on color channels to obtain the results compared to the training samples. Corresponding first color statistical features Randomly initialize a sample that is similar to the training sample. Random noise of the same size is added to the training samples. Above, to generate the first adversarial example. The first adversarial sample is split based on color channels to obtain the second color statistical features; The sample generation module will use the first color statistical features and second color statistical characteristics Normalization was performed to obtain the first color distribution features. and the distribution characteristics of the second color And calculate the similarity loss value between the two in each color channel. ; through similarity loss values Calculate the total loss value Through the total loss value Compared with the original loss value The updated loss value is calculated. By updating the loss value Backpropagation updates the first adversarial sample .

12. The adversarial example generation system according to claim 11, characterized in that, Collect color information from all channels of the image, where the color channels are RGB channels, and generate corresponding first color statistical features. .

13. The adversarial example generation system according to claim 11, characterized in that, The first adversarial sample The color channels are split into segments, and the color information of all channels is statistically analyzed to generate corresponding second color statistical features. .

14. The adversarial example generation system according to claim 11, characterized in that, First color statistical characteristics Normalization includes: Based on the first color statistical features Calculate the cumulative statistical features of the training data The calculation expression is: in, Indicates training samples All corresponding channel images; Represents all channels of the image The cumulative statistical features of the 256-dimensional training data; and They represent the training samples respectively. The width and length of the corresponding image channels; Cumulative statistical features of training data Perform SVD decomposition to determine its corresponding maximum singular value. And calculate to obtain the first color distribution features First color distribution characteristics The calculation expression is: in, Represents the cumulative statistical features of training data The maximum singular value, .

15. The adversarial example generation system according to claim 11, characterized in that, Second color statistical characteristics Normalization includes: Based on the statistical features of the second color Calculate and obtain the statistical features of adversarial examples The calculation expression is: in, Indicates the first adversarial sample All corresponding channel images; Represents all channels of the image Statistical features of 256-dimensional adversarial examples; and These represent the first adversarial samples. The width and length of the corresponding image channels; Statistical characteristics of adversarial examples Perform SVD decomposition to determine its corresponding maximum singular value. And calculate to obtain the second color distribution characteristics. Second color distribution characteristics The calculation expression is: in, Indicating the statistical characteristics of adversarial examples The maximum singular value, .

16. The adversarial example generation system according to claim 11, characterized in that, Similarity loss value The calculation expression is: in, Indicates the first color distribution characteristics and the distribution characteristics of the second color Similarity loss values ​​between RGB channels; Indicates calculation KL divergence.

17. The adversarial example generation system according to claim 11, characterized in that, The first adversarial example is used as input, and the confidence score is calculated using an object detection algorithm, which is then used as the original loss function. The confidence level is calculated using the following expression: in, This represents the number of reference boxes. Indicates the output feature grid size. Indicates the number of categories.

18. The adversarial example generation system according to claim 11, characterized in that, Through similar loss values Calculate the total loss value The calculation expression is: in, This represents the weight coefficient corresponding to each channel, and , .

19. The adversarial example generation system according to claim 11, characterized in that, Through total loss value Compared with the original loss value Calculate and obtain the updated loss value The calculation expression is: in, Represents the total loss value The corresponding weighting coefficients.

20. The adversarial example generation system according to claim 11, characterized in that, Update loss value Backpropagation includes: fixing the gradient for target detection and distribution gap calculation; generating random noise by performing gradient descent optimization on the random noise; and updating the first adversarial sample with the optimized random noise. .

21. A storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the adversarial sample generation method according to any one of claims 1 to 10.

22. An electronic device, characterized in that, Including processor and storage media; The storage medium is used to store instructions; and The processor is configured to operate according to the instructions to perform the steps of the adversarial sample generation method according to any one of claims 1 to 10.

Images