Method and apparatus for generating adversarial patches

Abstract

This invention provides a method for generating an adversarial patch set for an image. The method includes segmenting the image into multiple regions; selecting a set of target regions that satisfy attack criteria by discretely searching the multiple regions; and generating an adversarial patch set using the set of target regions.

Description

Technical Field

[0001] This disclosure generally relates to computer vision technology, and more specifically, to techniques for generating adversarial patch-based images for computer vision neural networks. Background Technology

[0002] Currently, computer vision technology is widely used in various scenarios such as surveillance and autonomous driving. Deep learning models, especially those based on convolutional neural networks (CNNs), have been successfully applied in computer vision technology. However, recent research has shown that deep neural networks (DNNs) are vulnerable to adversarial attacks. The vulnerability of DNN-based computer vision technology poses a significant potential security risk to scenarios such as autonomous driving, making research into adversarial attacks on computer vision neural networks essential.

[0003] Perturbation-based attacks and patch-based attacks are two mainstream attack methods. Perturbation-based methods rely on small perturbations and learn additive noise across the entire image, allowing them to influence deep learning model predictions with perturbations virtually imperceptible to humans. Because this method manipulates every pixel of the image, it is infeasible for attacks in the physical world. Patch-based methods use one or more adversarial patches to attack specific parts of the image, producing patch-level changes. Since patch-based attacks only alter one or more regions of the image, they are potentially feasible in the physical world, such as hiding people or stop signs, which is dangerous for autonomous driving.

[0004] Therefore, in order to study the vulnerability of computer vision neural networks to physical attacks and to improve the security of computer vision neural networks accordingly, patch-based adversarial attacks deserve more research. Summary of the Invention

[0005] The following provides a brief overview of one or more aspects of this disclosure in order to offer a basic understanding of these aspects. This overview is not a comprehensive summary of all anticipated aspects and is neither intended to identify key or essential elements of all aspects nor to depict the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to the more detailed description that follows.

[0006] In one aspect of this disclosure, a method for generating an adversarial patch set for an image is provided. The method may include: segmenting the image into multiple regions; selecting a set of target regions that satisfy attack criteria by discretely searching the multiple regions; and generating the adversarial patch set using the set of target regions.

[0007] In another aspect of this disclosure, an apparatus for generating a set of adversarial patches for an image is provided. The apparatus may include a memory and at least one processor coupled to the memory. The at least one processor may be configured to: segment the image into a plurality of regions; select a set of target regions that satisfy attack criteria by discretely searching the plurality of regions; and generate a set of adversarial patches using the set of target regions.

[0008] In another aspect of this disclosure, a computer-readable medium is provided that stores computer code for generating a set of adversarial patches for an image. When executed by a processor, the computer code enables the processor to segment the image into multiple regions; select a set of target regions that satisfy attack criteria by discretely searching the multiple regions; and generate a set of adversarial patches using the set of target regions.

[0009] In another aspect of this disclosure, a computer program product is provided for generating a set of adversarial patches for an image. The computer program product may include processor-executable computer code for: segmenting the image into multiple regions; selecting a set of target regions that satisfy attack criteria by discretely searching the multiple regions; and generating a set of adversarial patches using the set of target regions.

[0010] Other aspects or variations of this disclosure will become apparent from the following detailed description and accompanying drawings. Attached Figure Description

[0011] The following figures depict various embodiments of the present disclosure for illustrative purposes only. Those skilled in the art will readily recognize from the following description that alternative embodiments of the methods and structures disclosed herein can be implemented without departing from the spirit and principles of the present disclosure described herein.

[0012] Figure 1 An example of object detection based on one aspect of a computer vision task is shown.

[0013] Figure 2 An example of an adversarial attack failure on object detection based on one aspect of the prior art is shown.

[0014] Figure 3 An example of a patch for adversarial attacks on object detection according to embodiments of this disclosure is shown.

[0015] Figures 4A-4B An example of a patch for adversarial attacks on object detection according to embodiments of this disclosure is shown.

[0016] Figures 5A-5BAn example of a patch for adversarial attacks on object detection according to embodiments of this disclosure is shown.

[0017] Figure 6 A flowchart illustrating a method for generating an image patch according to an embodiment of the present disclosure is shown.

[0018] Figure 7 A flowchart illustrating a method for generating an image patch according to an embodiment of the present disclosure is shown.

[0019] Figure 8 An example of a hardware implementation of a device according to an embodiment of the present disclosure is shown.

[0020] Figure 9 An example of an attacked image according to an embodiment of this disclosure is shown. Detailed Implementation

[0021] Before explaining any embodiment of this disclosure in detail, it should be understood that the application of this disclosure is not limited to the construction details and feature arrangements set forth in the following description. This disclosure can have other embodiments and can be implemented or performed in various ways.

[0022] Object detection is a type of computer vision task used to identify and locate objects of certain categories in an image. This disclosure will be described using object detection as an example; however, it should be noted that this disclosure can be applied to other computer vision neural networks that can provide various types of predictions based on an input image.

[0023] Deep neural networks have been applied to object detection with great success. Object detectors using deep neural networks (especially convolutional neural networks) can be classified into single-level detectors and two-level detectors.

[0024] For two-stage detectors, predictions include region proposals and subsequent classification. An early detector utilizing deep neural networks was OverFeat, which combined sliding windows and convolutional neural networks (CNNs) for detection. Subsequently, Region Convolutional Neural Networks (R-CNN) were proposed. Two-stage detectors first search for region proposals and then classify each of them. One problem with R-CNN is that it runs too slowly. Therefore, several modern detectors such as Fast R-CNN, Faster R-CNN, and Mask R-CNN have been proposed to speed it up.

[0025] Figure 1An example of object detection as a type of computer vision task is shown. Image 110 is the original clean image. The person in the center of image 110 is the target object. Image 120 shows the prediction result of the Faster R-CNN object detector for image 110. As shown by the bounding box 125 in image 120, the Faster R-CNN object detector is able to successfully detect the target object in the clean image.

[0026] Level 1 detectors, also known as "single-shot detectors," predict bounding boxes, object scores, and class scores using only a single pass through the network. Level 1 detectors utilize only a single CNN to extract features and immediately produce object localization and classification results. This difference makes Level 1 detectors faster but more vulnerable to attack. In contrast, two-level detectors are slower but more accurate and harder to attack.

[0027] To evaluate the security of DNN-based computer vision systems, numerous adversarial attack schemes have been proposed against computer vision systems including two-level object detectors. From a pattern-based perspective, adversarial attacks can be categorized into perturbation-based attacks and patch-based attacks. Since perturbation-based attacks manipulate every pixel of an image and are physically infeasible, while patch-based attacks use one or more adversarial patches to attack an image and may introduce potential security risks in the physical world, this disclosure primarily focuses on patch-based methods for generating adversarial attack images in order to evaluate and improve the security of computer vision neural networks.

[0028] Patch-based attacks typically modify parts of an image with visible changes, such as adversarial patches. The texture in the modified part is not constrained by the original image, meaning the patch can have a perceptible texture. However, existing patch-based attack methods are inflexible in terms of the patch's location and shape, which can limit attack performance when these properties are constrained.

[0029] First, in existing patch-based methods, the patch position is fixed. For example, the DPatch method uses the top-left corner of the image, the AdvPatch method uses the center of a person in the image as the attack region, and the UPC method places its adversarial patch on eight manually selected parts of the person. Second, the shape of the patch in existing patch-based methods is also fixed, typically rectangular. Rectangles are easy to define in digital images but are not related to the shape of the target object. These shape and position settings of existing patch-based methods can lead to poor attack performance in various object detection tasks, such as misclassification, position shifting, and vanishing, indicating that these constrained attack regions are insufficient to effectively evaluate the security of computer vision neural networks.

[0030] Figure 2 An example of an adversarial attack failure on object detection according to one aspect of the prior art is shown. Image 210 shows an adversarial patch generated by the ADVPatch method. The patch in image 210 is fixed at the center of the person. Image 220 shows the failure of an adversarial attack on object detection by overlaying image 210 onto... Figure 1 The image 110 is the clean image being attacked. Bounding box 225 is the prediction of the attacked image by the two-stage object detector of Faster R-CNN. As shown in bounding box 225, the Faster R-CNN detector can detect the target object in the image attacked by AdvPatch and classifies the object as "person" with a confidence of 0.66. In other words, the AdvPatch method fails to attack this image and may not be sufficient to evaluate the security of the Faster R-CNN detector. If the shape and position of the patch can be optimized, there is still room to improve attack performance and reduce the attack area compared to those methods with constrained attack positions and shapes.

[0031] Figure 3 An example of a patch for adversarial attacks on object detection according to embodiments of this disclosure is shown. Figure 3 As shown, patch P i The parameters can include position p i Shapes i and texture t i This disclosure not only optimizes the texture of the patch but also optimizes at least one of the patch's position and shape, thereby enhancing the attack performance and efficiency against the image. The patch can be located anywhere in the image. In one aspect, the position can be constrained to a foreground object in the image to simulate a physical scene. This is primarily because in a physical scene, attackers typically attach their patches to the surface of a target object. The shape of each patch can be derived from a variety of pre-designed shapes, such as squares, ovals, rhombuses, triangles, trapezoids, and other regular / irregular shapes. In another aspect, the set of shapes can be constrained to convex shapes. In a physical scene, convex patches are easier to cut from printed paper and are stronger in maintaining their shape when attached to an object surface.

[0032] In an embodiment that optimizes all parameters of the position, shape, and texture of each patch, the i-th patch can be represented as P. i =(s i p i , t i ) tuples, where s i p i , t i These represent the shape, position, and texture of the patch, respectively, such as Figure 3 As shown. Therefore, the optimization of the patch parameters can be based on the following objective function:

[0033]

[0034] Where f is the object detection model (e.g., Faster R-CNN, Mask R-CNN, etc.), x is the original image before the attack (e.g., image 110), and y is the ground truth label of the image (e.g., bounding box 125 in image 120). This indicates an overlay patch on the image. Indicates based on each For an image with modified texture at a region, L(·) is the prediction of the object detection model for the attacked image. The loss function is the difference between the label and the true label y. It is a function that calculates the area of ​​the region for each patch, and λ is a balancing parameter. A specific loss function can depend on the specific attack task.

[0035] In one embodiment, the patch can be used and Constraints, among which It is the set of all convex shapes on a 2D plane, and It is the background of the image. In other words, the patch is constrained to be convex and exists only in the foreground. By maximizing The difference between the predicted output and the true label is maximized, which leads to a decrease in the detector's performance across different attack tasks. Meanwhile, The penalty is applied to the area of ​​the region weighted by the balancing parameter λ. This encourages optimization to obtain patches with smaller areas while achieving satisfactory performance.

[0036] However, since the position and shape parameters are defined in a discrete space at the pixel level, the loss function in Equation (1) becomes non-differentiable for optimization. Therefore, using only the traditional gradient descent method, the position and shape of the patch cannot reach their optimal point.

[0037] According to one aspect of this disclosure, instead of directly optimizing the position and shape parameters, the image can be over-segmented into multiple small regions, and some of these small regions can then be selected as attack regions. In this way, the original optimization problem in Equation (1) can be reformulated as a discrete search problem.

[0038] Figures 4A-4B An example of a patch for adversarial attacks on object detection according to embodiments of this disclosure is shown. Figure 4AAs shown, an image is segmented into multiple regions using multiple parallel vertical lines and multiple parallel horizontal lines. The distances between the parallel lines can be equal or different. Segmentation can be based on a predetermined number of regions. For example, if the predetermined number of regions is 625, it can be segmented using 24 vertical lines and 24 horizontal lines. The predetermined number can be a balance between attack performance and computational complexity. In other embodiments, segmentation can be based on one or more predetermined shapes, allowing the image to be segmented into different patterns. Although in some embodiments the shape of each region can be fixed and not optimized, multiple connected regions can form patches with different shapes. In other words, the generated patch can consist of several adjacent regions, so the shape of the patch can be optimized to some extent by optimizing the selection of each region.

[0039] In this way, the optimization of position and shape parameters can be transformed into a discrete search problem of whether to select a region as the target region, such as... Figure 4A Region R in i (This means the i-th region). In other words, the set of target regions satisfying the attack criteria can be selected as the attack region by discretely searching multiple regions. The selected regions can be constrained to foreground objects in the image, and correspondingly, only foreground objects in the image can be segmented. In an embodiment used to solve this discrete search problem, 0-1 values ​​can be used to represent the selection of each region and can be treated as discrete random variables. In one embodiment, it can be assumed that each random variable follows a Bernoulli distribution separately and independently. The Bernoulli distribution is a basic discrete probability distribution defined in {0, 1}. The parameters of these Bernoulli distributions can be estimated using a Natural Evolutionary Strategy (NES), which is widely used to estimate parameter distributions and is suitable for our discrete search problem. Using NES, the distribution parameters can be gradually obtained, and regions with high probabilities can be selected.

[0040] Then, for the selected regions, their textures can be modified by iterative gradient backpropagation and minimizing the confidence scores of the predicted bounding boxes on the attacked image covered by the textures in the corresponding selected regions. The texture of each selected region can also be preserved as a texture predetermined or computed during the region selection phase. Figure 4B An example of a patch generated based on a selected region and a modified texture is shown. In an embodiment that optimizes only the location of the adversarial patch, the texture of the selected region can be determined based on a default configuration. For example, the texture can be fixed as a texture of pseudo-random noise, such as... Figure 4A The top of the candidate textures is shown.

[0041] Figures 5A-5BAnother example of a patch for adversarial attacks on object detection according to embodiments of this disclosure is shown. Figures 5A-5B The patch in the example and Figures 4A-4B The main difference between the patches in the examples is that image segmentation can be based on superpixels. Superpixels segment an image into small regions of uniform color or texture. A key property of superpixels is preserving object boundaries; that is, all pixels in a superpixel can belong to the same object. Since superpixels can be used as an important clue to measure the predictive performance of an object detector by utilizing the extent to which superpixels span bounding boxes, adversarial attacks on superpixels can affect the object detector's predictions.

[0042] Therefore, as Figure 5A As shown, the image is segmented into multiple regions, each of which is a superpixel, such as sP. i Segmentation can be based on Simple Linear Iterative Clustering (SLIC), a widely used method for segmenting images into superpixels. To obtain small superpixels that may lead to fine-grained attacks, the merging process can be removed during superpixel generation. Figure 5A In the example, superpixel segmentation is constrained to the foreground object (i.e., a person) in the image. In embodiments with convex shape constraints, since superpixels can depend on the pattern of the image and can have various shapes, they can be segmented as follows: Figure 5A shown The function is used to perform the operation of obtaining the convex envelope of the superpixel.

[0043] Then, a set of regions can be selected as the attack area, and the texture of each selected region can be determined, similar to the reference above. Figure 4A and 4B As stated above. Figure 5B An example of a patch generated based on a selected region and a defined texture is shown. It can be seen that, due to the nature of superpixels, the shape of the patch is not fixed.

[0044] Figure 6 A flowchart illustrating a method 600 for generating an image patch according to an embodiment of the present disclosure is shown. Reference may be made to... Figure 4A and 5A To implement method 600, and Figure 4B and 5B The results of performing method 600 are shown, and method 600 is not limited to the reference. Figures 4A-4B The embodiments described in 5A-5B.

[0045] At box 610, method 600 may include segmenting an image into multiple regions. The image may be an original image with real labels for training and / or testing a computer vision neural network. The computer vision neural network can be used for object detection, instance segmentation, etc. Segmentation may be based on a predetermined shape or a predetermined number of regions. The predetermined shape may be a regular polygonal shape, such as a triangle, square, rhombus, trapezoid, pentagon, hexagon, etc. The predetermined shape may also be an irregular polygonal shape. Segmentation may be based on different patterns, which may depend on the characteristics of the input image. Segmentation may be constrained to foreground objects in the image.

[0046] In one embodiment, segmentation at box 610 may include dividing the image into multiple regions based on pixels having values ​​within a threshold range. For example, each of the multiple regions of the image may have a uniform color or texture value and may be referred to as a superpixel. Based on the pattern of the image, the shape of each superpixel may be different at different locations in the image. In this embodiment, segmentation at box 610 may also include transforming the multiple regions into a convex shape by obtaining a convex envelope of each region in the multiple regions.

[0047] At box 620, method 600 may include selecting a set of target regions that satisfy attack criteria by discretely searching a plurality of regions. In one embodiment, a selection vector of the plurality of regions may be used to indicate whether each of the plurality of regions is selected into the set of target regions. The dimension of the selection vector depends on the number of the plurality of regions. Each element of the selection vector has a value of 1 or 0 indicating whether the corresponding region is to be selected, and is assumed to follow a Bernoulli distribution separately and independently. Therefore, selecting the set of target regions at box 620 may include optimizing the probability distribution of the selection vector by computing a search gradient; and selecting the set of target regions based on the selection vector, which is sampled based on the optimized probability distribution.

[0048] In other words, depending on the implementation, the selection of the target region set at box 620 can be based on different objective functions derived from a computer vision neural network for the image to which the patch set has been applied, the true label of the original image, and the total area of ​​the generated patch set. Figure 4A In the example, the optimization objective function defined in formula (1) can be reformulated as:

[0049]

[0050] Where f is the object detection model, x is the original image before the attack (e.g., image 110), y is the ground truth label of the image, and m = (m1, m2, ..., m...). M )∈{0,1} M It indicates whether to select the corresponding region R.i The choice of vector, M, depends on the number of regions to be segmented, R. i Let R represent the i-th segmented region. After segmentation, the shape and position of the region can be determined using the corresponding elements in the selection vector. Only R is considered. i The texture, This indicates that patches (based on region and texture) are applied to the image. L(·) is the prediction of the object detection model on the attacked image. The loss function is the difference between the label and the true label y. It is a function that calculates the sum of the areas of all attack regions, and λ is the balance parameter. The constraints in Equation (1) can be removed by a well-designed partitioning method.

[0051] exist Figure 5A In the example, the optimization objective function defined in formula (1) can be reformulated as:

[0052]

[0053] Where f is the object detection model, x is the original image before the attack (e.g., image 110), y is the ground truth label of the image, and m = (m1, m2, ..., m...). M )∈{0,1} M It is a vector selection, where M depends on the number of superpixels in the segmentation. Let Ω(·) represent the i-th superpixel, and Ω(·) be a function used to obtain the convex envelope of the superpixel. Since, after oversegmentation, the shape of the region depends on the superpixel, and the position can be represented by the corresponding element in the selection vector, only considering... Texture, This indicates that patches (based on region and texture) are applied to the image. L(·) is the prediction of the object detection model on the attacked image. The loss function is the difference between the label and the true label y. It is a function that calculates the sum of the areas of all attack regions, and λ is a balance parameter.

[0054] Based on formulas (2) and (3), the optimization of shape, position, and texture in formula (1) is transformed into selecting vector (m) and texture ({R) i}or Optimization of ). In one embodiment, the selection vector can be optimized by using a natural evolutionary strategy (NES), and the texture can be optimized by using iterative gradient ascent. For example, according to the reformulated objective function in Equation (3), in order to optimize m using NES, the fitness function can be defined as:

[0055]

[0056] in

[0057]

[0058] This means It is a superpixel with its optimal texture determined by given m and y. here, The optimal texture for each superpixel in the matrix can be represented together as t * . t * It is calculated using gradient ascent. The expected fitness under the search distribution can be defined as:

[0059]

[0060] Where π is the search distribution of m. For m∈{0,1} M Assume it follows a Bernoulli distribution Bern(g(θ) m )), where θ m ∈R M It is a distribution parameter. This is a function whose probability values ​​are constrained to [0, 1]. Then, the search gradient can be calculated as follows:

[0061]

[0062]

[0063] In one embodiment, the search gradient can be estimated as follows based on sample m. 1 ,m 2 ,…m K get:

[0064]

[0065] Where K is the group size, which can be an integer between 20 and 50.

[0066] The loss functions in formulas (1)-(3) can depend on the specific attack task, such as misclassification, location shifting, and vanishing. Misclassification tasks involve two distinct tasks: targeted attacks and non-targeted attacks. In targeted attacks, the adversarial attack should cause the detector to predict the target object as the target class. In non-targeted attacks, the adversarial attack should prevent the detector from predicting the correct class. In location shifting tasks, the adversarial attack should move the predicted bounding box of the sacrificed object as far as possible. In vanishing tasks, the adversarial attack should make the given object invisible to the detector.

[0067] For example, for non-target misclassification tasks, the loss function in formula (3) can be set as:

[0068]

[0069] Where b is the predicted bounding box, B * C is the bounding box that can be detected as being at the same location as the ground truth bounding box, and C is the classifier of the detector. The classification score is predicted by the classifier on the bounding box b, and ζ(·) outputs the classification score of the true class predicted by the model.

[0070] For position shifting tasks, the loss function in formula (3) can be set as:

[0071]

[0072] Where b is the predicted bounding box, B' is the set of detected bounding boxes that are closest to the real object, |p c (b)-p c (y)| is the L1 norm of the coordinate difference, p c (·) represents the center coordinates of the predicted or actual bounding box.

[0073] For the vanishing task, the inverse of the sum of the object confidence score and the classification score exceeding a certain threshold can be used as the loss function in formula (3). The object confidence score measures the probability of the presence of any object within the bounding box. The classification score measures the probability of the presence of a particular class within the bounding box.

[0074] At box 630, method 600 may include generating an adversarial patch set by using a set of target regions. Figure 4B and 5B The generated adversarial patch, with a texture optimized for the selected target region, is shown. Specifically, as... Figure 5B As shown, the shape of the adversarial patch is based on the convex envelope of the segmented superpixels. Although the generated adversarial patch set includes multiple patches as shown, it can also include only one adversarial patch. In other words, the number of patches in the adversarial patch set is not predetermined and can depend on the optimization results at box 620.

[0075] In one embodiment, the texture of the adversarial patch set can be maintained as the texture used when selecting the target region set. In another embodiment, at box 630, generating the adversarial patch set also includes modifying the texture of the adversarial patch set. The texture of the adversarial patch set can be based on a default configuration. For example, iterative gradient ascent can be used to modify the texture of the adversarial patch set. Alternatively, the texture of the adversarial patch set can be selected from a texture dictionary.

[0076] Method 600 may further include applying an adversarial patch set to the original image to generate an adversarial attack image. The adversarial patch set can be applied to the original image by overlaying the adversarial patch set onto the corresponding target region of the original image, or by replacing the corresponding target region of the original image with the adversarial patch set. Figure 9 An example of an image being attacked according to an embodiment of this disclosure is shown. Image 910 is obtained by... Figure 5B The anti-patch covers Figure 1 The attacked image is generated from the original image 110. The bounding box 920 is the prediction of the Faster R-CNN for the original image. However, after the image is attacked by an adversarial patch generated according to embodiments of this disclosure, the Faster R-CNN fails to detect people in the attacked image 910. In other words, if attacked in this way, the Faster R-CNN may have a potential security problem of ignoring people in the image.

[0077] Figure 7 A flowchart of a method 700 for generating an image patch according to an embodiment of the present disclosure is shown. (Refer to...) Figure 5A Method 700 is described, and it should be understood that method 700 may also be applied to other equivalent or alternative embodiments without departing from the scope of this disclosure.

[0078] Method 700 can begin at box 710 and includes receiving the input image x, the true label y, and the initial values ​​of the distribution parameters. And the population size K. In one example, the distribution parameters can be the initial parameters of a Bernoulli distribution, and the population size can be configured to 30 or 40. At box 720, method 700 includes initializing superpixels, i.e., oversegmenting the image x into superpixels, each superpixel corresponding to a region of the image and having a different shape. The oversegmentation can be constrained to foreground objects of the image.

[0079] After segmentation, method 700 may include: at box 730, based on the search distribution π(m|θ) m To extract samples m of the selected vector. i Where i = 1 to K; based on y and m i Calculate the optimal t * ; evaluate fitness in formula (4) And the logarithmic derivative in formula (7) At box 740, determine whether i has reached K. If not, increment i by 1, and method 700 can return to box 730. If yes, method 700 can continue to box 750, where the search gradient is calculated according to formula (8). And according to Update the distribution parameters, where η is the learning rate. Then, at box 760, determine if a stopping criterion is met. The stopping criterion could be that the fitness function reaches a predetermined threshold, the distribution parameters reach convergence, or the distribution parameters have been updated a maximum number of times. If the stopping criterion is not met, method 700 can return to boxes 730 and 740, where another K samples for the selection vector are obtained based on the updated search distribution. If yes, method 700 can continue to box 770, where further selection can be achieved by using a high θ... m and its best t * Superpixels are used to generate an adversarial patch for the input image x and then to generate the attacked image x'.

[0080] Figure 8 An example of a hardware implementation of an apparatus 800 according to an embodiment of the present disclosure is shown. The apparatus 800 for generating adversarial patches may include a memory 810 and at least one processor 820. The processor 820 may be coupled to the memory 810 and configured to perform the above-described... Figure 6 and 7 Methods 600 and 700 are described. Processor 820 may be a general-purpose processor, or it may be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. Memory 810 may store input data, output data, data generated by processor 820, and / or instructions executed by processor 820.

[0081] The various operations, models, and networks described in conjunction with the disclosure herein can be implemented using hardware, software executed by a processor, firmware, or any combination thereof. According to embodiments of this disclosure, a computer program product for generating adversarial patches may include components for executing the above-described references. Figure 6 and Figure 7 The described methods 600 and 700 are processor-executable computer code. According to another embodiment of this disclosure, a computer-readable medium can store computer code for generating adversarial patches, which, when executed by a processor, enables the processor to perform the functions described above. Figure 6 and Figure 7 Methods 600 and 700 are described. Computer-readable media include both non-transient computer storage media and communication media, with communication media including any medium that facilitates the transfer of a computer program from one location to another. Any connection can be suitably referred to as a computer-readable medium. Other embodiments and implementations are within the scope of this disclosure.

[0082] By selecting oversegmented regions or superpixels and optimizing their textures, this disclosure can generate multi-distributed patches with more flexible shapes. By optimizing the position, shape, and texture of the adversarial patches instead of using fixed shapes and positions, this disclosure can achieve better attack performance at the same area cost, while also saving attack area while achieving the same attack objective. The generated adversarial patches or attacked images can be used to evaluate the security of computer vision neural networks, and corresponding defensive techniques can be applied to these networks, thereby improving their security.

[0083] The foregoing description of the disclosed embodiments is intended to enable any person skilled in the art to make or use various embodiments. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be applied to other embodiments without departing from the scope of the various embodiments. Therefore, the claims are not intended to limit them to the embodiments shown herein, but are to be accorded the widest scope consistent with the appended claims and the principles and novel features disclosed herein.

Claims

1. A method for generating an adversarial patch set for an image, comprising: The image is divided into multiple regions; The set of target regions that meet the attack criteria is selected by discretely searching the multiple regions. as well as An adversarial patch set is generated by using the target region set, wherein the shape of the adversarial patches in the adversarial patch set is optimized by optimizing the selection of the target regions.

2. The method according to claim 1, wherein, The segmentation includes: The image is divided into the multiple regions based on a predetermined number of polygonal shapes or regions.

3. The method according to claim 1, wherein, The segmentation includes: The image is segmented into the multiple regions based on pixels with values ​​within a threshold range.

4. The method according to claim 3, wherein, The segmentation also includes: By obtaining the convex envelope of each of the plurality of regions, the plurality of regions are transformed into a convex shape.

5. The method according to claim 1, wherein, The segmentation is constrained to the foreground object of the image.

6. The method according to claim 1, wherein, The selection includes: The probability distribution of the selection vectors of the plurality of regions is optimized by calculating the search gradient, wherein the selection vectors indicate whether each region among the plurality of regions should be selected into the target region set; and The target region set is selected based on a sampled selection vector, which is sampled based on an optimized probability distribution.

7. The method according to claim 1, wherein, The generated adversarial patch set includes: Modify the texture of the adversarial patch set, wherein the modification includes: optimizing the texture using iterative gradient ascent, or selecting the texture from a texture dictionary.

8. The method according to claim 1, wherein, The selection is based on a function derived from a computer vision neural network for the image to which the adversarial patch set has been applied, the true label of the image, and the total area of ​​the adversarial patch set.

9. The method according to claim 8, wherein, The computer vision neural network is used for object detection, and the function is based on tasks related to misclassification, position shifting, or disappearance during the object detection process.

10. An apparatus for generating an adversarial patch set for an image, comprising: Memory; as well as At least one processor coupled to the memory and configured to perform the method according to any one of claims 1 to 9.

11. A computer-readable medium storing computer code for generating a set of adversarial patches for an image, the computer code causing the processor, when executed by a processor, to perform the method according to any one of claims 1-9.

12. A computer program product for generating a set of adversarial patches for images, comprising: A processor for performing the method according to any one of claims 1-9 may execute computer code.

Images