A global perturbation attack method based on infrared image target detection
By performing Gaussian edge blur preprocessing and gradient backpropagation optimization on infrared images, and combining momentum iteration to generate global perturbations, the vulnerability of infrared image target detectors to attacks is solved, enhancing their robustness and defense capabilities.
Patent Information
- Application Number
- CN202310882380.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-07-18
- Publication Date
- 2025-11-18
- Estimated Expiration
- 2043-07-18
AI Technical Summary
Deep learning model target detectors are vulnerable to attacks in infrared images, and existing research lacks in-depth defenses against infrared images, resulting in insufficient security in applications such as visual surveillance and autonomous driving.
The design employs Gaussian edge blurring preprocessing of infrared images, gradient backpropagation to optimize the target detection box and confidence-related loss function, and momentum iteration to generate global perturbations. The design is simple and easy to operate.
This improves the vulnerability of infrared images to attacks, enhances the robustness of target detectors, and improves the model's defensive capabilities.
Smart Images
Figure CN117036675B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security technology, specifically relating to a global perturbation attack method based on infrared image target detection. Background Technology
[0002] Deep learning models have been widely applied to various vision tasks and have achieved good results. However, robustness has always been a major obstacle for deep learning models. Research shows that models based on deep neural networks are vulnerable to adversarial attacks, meaning that adversarial instances exist that slightly modify the original image but cause the classifier to predict incorrect results. Some work has been dedicated to improving the robustness of these models. Object detection, as one of the most common problems in computer vision, has many efficient and mature methods dedicated to solving this task. However, recent research has found that object detectors can be vulnerable to maliciously crafted input attacks. Since object detection plays a crucial role in applications such as visual surveillance and autonomous driving, researching object detectors resistant to adversarial attacks is extremely important.
[0003] Infrared imaging possesses certain penetrating properties; even if a person is obscured by clothing, thermal radiation can still be detected by the receiver through the clothing, thus allowing imaging through obstruction. However, infrared images only have a single channel, and feature extraction is difficult, making it challenging to obtain the target texture and spatial location information needed by attack algorithms. While infrared target detection systems are widely used in my country due to their unique advantages, in-depth research on their security is still lacking. Summary of the Invention
[0004] To overcome the shortcomings of existing technologies, this invention provides a global perturbation attack method based on infrared image target detection. The method comprises four steps: Step 1, obtaining infrared input data for the target detection attack model; Step 2, performing Gaussian edge blur preprocessing on the infrared input data; Step 3, optimizing the target detection bounding box and the target confidence-related loss function using gradient backpropagation; and Step 4, generating global perturbations in the infrared image using momentum iteration. This invention uses infrared images with fewer feature textures as input to the target detection attack model, leveraging the robustness of infrared images to Gaussian noise to preprocess the input data, making the infrared image more vulnerable to attack. A loss function is designed for the target detection bounding box to optimize the gradient in a more attack-friendly direction. Momentum iteration is used to generate global adversarial perturbations in the direction of the fastest descent of the objective function. This invention has a simple structure and is convenient to implement and use.
[0005] The technical solution adopted by this invention to solve its technical problem includes the following steps:
[0006] Step 1: Obtain the infrared input data of the target detection attack model;
[0007] Step 1-1: Convert the FLIR infrared dataset format to the VOC dataset format;
[0008] Step 1-2: Create a text file containing image names during the attack process. Randomly shuffle the image names from the infrared input data and store them in the text file. Use the PIL library to iterate through the images.
[0009] Step 2: Perform Gaussian edge blur preprocessing on the infrared input data;
[0010] Step 2-1: Use the Canny operator to determine the edges of the infrared image through denoising, calculating the magnitude and direction of the gradient, and non-maximum suppression operation;
[0011] Step 2-2: Set the size of the coarse-grained convolution kernel and the size of the fine-grained convolution kernel to obtain structuring elements of a specified shape and size;
[0012] Steps 2-3: Locate the coarse grains on the edges of the original image and apply Gaussian blur to the coarse grains on the edges; locate the fine grains on the edges of the original image, without applying Gaussian blur to the fine grains, thus preserving parts of the original image.
[0013] Step 3: Backpropagation of gradients optimizes the target detection bounding box and the loss function related to target confidence.
[0014] Step 3-1: A sample is labeled as x, and the corresponding adversarial sample is... , antagonistic perturbation The perturbation is constrained using the p-norm, and an adversarial loss function is formulated.
[0015] Step 3-2: Develop the target loss function for confidence level. Select the item with the highest category probability. Confidence score of target Subtract 1 after multiplying;
[0016] Step 3-3: Define the target loss function for the detection box. Select the length and width of each detection box and minimize the size of the detection box;
[0017] Step 4: Momentum iteration generates global perturbation for infrared images;
[0018] Step 4-1: Obtain the gradient information of the image;
[0019] Step 4-2: Add a momentum term to the gradient of the iterative attack.
[0020] Preferably, step 1-1 specifically comprises:
[0021] The .json label files in the FLIR infrared dataset are converted into corresponding category and detection box information in txt text label files according to the "annotation", "file_name" and "height, width" information in the .json file, and then converted from the text file to .xml file format.
[0022] Preferably, the coarse-grained convolution kernel is set to 3*3, the fine-grained convolution kernel is set to 9*9, and the Gaussian kernel size for Gaussian blurring is set to 7*7.
[0023] Preferably, the Gaussian blurring in steps 2-3 uses Gaussian filtering, and its two-dimensional normal distribution is calculated using the following formula: Where x and y are the coordinate values in the x-axis and y-axis directions, respectively. Let Variance be the variance.
[0024] Preferably, the target loss function in step 3-2 regarding confidence level The calculation formula is:
[0025]
[0026] in, For categorical variables, It is a set of categories.
[0027] Preferably, the target loss function in step 3-3 is related to the confidence level. The calculation formula is:
[0028]
[0029] in, For categorical variables, For a set of categories, , These are the width and height of the detection frame, respectively. These represent the width and height of the infrared image, respectively.
[0030] Preferably, the formula for calculating the momentum term added to the gradient of the iterative attack in step 4-2 is as follows:
[0031]
[0032] in, for The attenuation coefficient, For the first t The gradient value of the next iteration. For loss function, 、y These are the detection results for adversarial samples and original samples, respectively.
[0033] The beneficial effects of this invention are as follows:
[0034] This invention uses infrared images with few texture features as input to the target detector model. It preprocesses the infrared images with coarse and fine Gaussian blurring at the edges, making the images more vulnerable to attack. Two target loss functions are proposed to optimize the gradient in the direction more susceptible to attack. Momentum iteration is used to generate global adversarial perturbations by moving towards the direction of fastest descent of the target function. The method of this invention has a simple structure and is convenient to implement and use. Attached Figure Description
[0035] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation
[0036] The present invention will be further described below with reference to the accompanying drawings and embodiments.
[0037] The problem this invention aims to solve is that, in the context of deep neural networks, target detection models are vulnerable to attacks, which is detrimental to network model protection. It provides a global perturbation attack method based on infrared image target detection. This method has a simple structure and reasonable design. It utilizes coarse and fine particles to perform Gaussian blurring preprocessing on the infrared image edges, thereby increasing the image's vulnerability to attack. A target loss function based on confidence and bounding box is designed to optimize the gradient in a more attack-friendly direction. Momentum iteration is used to generate global adversarial perturbations in the direction of the fastest descent of the target function, improving the speed of global perturbation generation.
[0038] like Figure 1 As shown, the present invention provides a global perturbation attack method based on infrared image target detection, comprising the following steps:
[0039] Step 1: Obtain the infrared input data for the target detection attack model:
[0040] Step 101: Convert the FLIR infrared dataset format to the VOC dataset format. Convert the .json label files in the FLIR infrared dataset into corresponding category and bounding box information in a txt text label file, based on the "annotation," "file_name," and "height, width" information within the .json file. Then convert the text file to .xml file format.
[0041] Step 102: Create a text file containing image names during the attack process. Randomly shuffle the image names from the infrared input data and store them in the text file. Use the PIL library to iterate through the images.
[0042] Step 2: Perform Gaussian edge blur preprocessing on the infrared input data:
[0043] Step 201: Use the Canny operator to determine the edges of the infrared image through denoising, calculating the magnitude and direction of the gradient, and non-maximum suppression operation;
[0044] Step 202: Set the size of the coarse-grained convolution kernel and the size of the fine-grained convolution kernel to obtain structuring elements of specified shapes and sizes. Set the coarse-grained kernel to 3*3 and the fine-grained kernel to 9*9.
[0045] Step 203: Locate the coarse grains on the edges of the original image and apply Gaussian blur to the coarse grains on the edges, setting the Gaussian kernel size to 7*7. Locate the fine grains on the edges of the original image, without applying Gaussian blur to the fine grains, preserving parts of the original image.
[0046] Step 3: Optimize the target detection box and target confidence-related loss function using gradient backpropagation.
[0047] Step 301: Define the backpropagation optimization problem of gradient attack. A sample is labeled x, and the corresponding adversarial sample is... The adversarial perturbation is The p-norm is used to constrain perturbations, and an adversarial loss function is formulated.
[0048] Step 302: Develop the target loss function for confidence level. Select the item with the highest category probability. With target score Subtracting 1 after multiplication aims to make the confidence of the adversarial example detection box closer to 1, so that it will not be filtered out by the non-maximum suppression module (NMS).
[0049] Step 303: Determine the target loss function for the detection box. Select the length and width of each detection box to minimize its size. The aim is to suppress the Intersection over Union (IOU) between different detection boxes, preventing them from being overlooked by the Non-Maximum Suppression (NMS) module.
[0050] Step 4: Momentum iteration generates global perturbation for infrared images:
[0051] Step 401: Obtain the gradient information of the image;
[0052] Step 402: Add a momentum term to the gradient of the basic iterative attack. This avoids poor local maxima and makes the gradient update direction smoother.
[0053] The aforementioned global perturbation attack method based on infrared image target detection, in step 203, employs Gaussian filtering for Gaussian blurring, and its two-dimensional normal distribution is calculated using the following formula: , where x and y are the values in the x-axis direction and the y-axis direction, respectively.
[0054] In the aforementioned global perturbation attack method based on infrared image target detection, step 302 involves a target loss function related to confidence. The calculation formula is ,in, For categorical variables, For a set of categories, , These represent the category probability and the confidence score of the identified category, respectively.
[0055] In the aforementioned global perturbation attack method based on infrared image target detection, step 303 involves a target loss function related to confidence. The calculation formula is ,in, For categorical variables, For a set of categories, , These are the width and height of the detection frame, respectively.
[0056] The gradient calculation formula for momentum iteration in step 402 of the aforementioned global perturbation attack method based on infrared image target detection is as follows: ,in, for The attenuation coefficient, For loss function, y and y represent the detection results of the adversarial sample and the original sample, respectively.
[0057] It should be noted that this plan will be used under legal circumstances.
Claims
1. A global perturbation attack method based on infrared image target detection, characterized in that, Includes the following steps: Step 1: Obtain the infrared input data of the target detection attack model; Step 1-1: Convert the FLIR infrared dataset format to the VOC dataset format; Step 1-2: Create a text file containing image names during the attack process. Randomly shuffle the image names from the infrared input data and store them in the text file. Use the PIL library to iterate through the images. Step 2: Perform Gaussian edge blur preprocessing on the infrared input data; Step 2-1: Use the Canny operator to determine the edges of the infrared image through denoising, calculating the magnitude and direction of the gradient, and non-maximum suppression operation; Step 2-2: Set the size of the coarse-grained convolution kernel and the size of the fine-grained convolution kernel to obtain structuring elements of a specified shape and size; Steps 2-3: Locate the coarse grains on the edges of the original image and apply Gaussian blur to the coarse grains on the edges; locate the fine grains on the edges of the original image, without applying Gaussian blur to the fine grains, thus preserving parts of the original image. Step 3: Backpropagation of gradients optimizes the target detection bounding box and the loss function related to target confidence. Step 3-1: A sample is labeled as x, and the corresponding adversarial sample is... , antagonistic perturbation The perturbation is constrained using the p-norm, and an adversarial loss function is formulated. Step 3-2: Develop the target loss function for confidence level. Select the item with the highest category probability. Confidence score of target Subtract 1 after multiplying; Step 3-3: Define the target loss function for the detection box. ; Select the length and width of each detection box, and minimize the size of the detection box; Step 4: Momentum iteration generates global perturbation for infrared images; Step 4-1: Obtain the gradient information of the image; Step 4-2: Add a momentum term to the gradient of the iterative attack; The target loss function regarding confidence level in step 3-2 The calculation formula is: in, For categorical variables, A collection of categories; In step 3-3, the target loss function for the target detection box The calculation formula is: in, For categorical variables, For a set of categories, , These are the width and height of the detection frame, respectively. These are the width and height of the infrared image, respectively; The formula for calculating the momentum term added to the gradient of the iterative attack in step 4-2 is as follows: in, for The attenuation coefficient, For the first t The gradient value of the next iteration. For loss function, 、y These are the detection results for adversarial samples and original samples, respectively.
2. The global perturbation attack method based on infrared image target detection according to claim 1, characterized in that, Step 1-1 specifically involves: The .json label files in the FLIR infrared dataset are converted into corresponding category and detection box information in txt text label files according to the "annotation", "file_name" and "height, width" information in the .json file, and then converted from the text file to .xml file format.
3. The global perturbation attack method based on infrared image target detection according to claim 1, characterized in that, The coarse-grained convolution kernel is set to 3*3, the fine-grained convolution kernel is set to 9*9, and the Gaussian kernel size for Gaussian blurring is set to 7*7.
4. The global perturbation attack method based on infrared image target detection according to claim 1, characterized in that, In steps 2-3, the Gaussian blurring employs Gaussian filtering, and its two-dimensional normal distribution is calculated using the following formula: Where x and y are the coordinate values in the x-axis and y-axis directions, respectively. Let Variance be the variance.