A backdoor attack method, device and system for thermal infrared target detection

Abstract

The application discloses a backdoor attack method, device and system for thermal infrared target detection, and belongs to the technical field of image attack. The method designs a target trigger and a corresponding second temperature interval according to a target thermal infrared scene and a first temperature interval corresponding to a target attack object of the target thermal infrared scene. The method implants an image of the target trigger into each sample image and modifies a corresponding label to generate a poisoned sample. The method trains a target backdoor model by mixing a clean sample set with a poisoned sample set, so as to realize backdoor attack. The application innovatively proposes a backdoor attack strategy for thermal infrared target detection. The temperature interval of the trigger is designed based on the temperature interval of the target attack object by utilizing the temperature characteristics of thermal infrared. The target trigger set based on temperature difference is used for poisoning, training and attack. The security vulnerability of thermal infrared object detection to backdoor attack is explored, and the hidden backdoor control of the output result of thermal infrared target detection is realized.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of image attack, and more particularly relates to a backdoor attack method, device and system for thermal infrared target detection. BACKGROUND

[0002] Compared with visible light target detection, thermal infrared target detection has many unique advantages. They can detect in low visible light, smoke or dust environment, are less affected by glare and light mutation, have better stability in extreme weather conditions such as heavy rain and snow, and are sensitive to the thermal changes of objects. Therefore, thermal infrared target detection has become increasingly indispensable in various application scenarios where visible light target detection fails, from security monitoring and autonomous driving in darkness to human temperature measurement and other aspects. Obviously, many such application systems have high safety requirements, and as a key technology, it is particularly important to deeply explore the security problems of thermal infrared target detection. The vulnerability of thermal infrared target detection to backdoor attacks has not been revealed, which is a major threat to thermal infrared target detection.

[0003] Backdoor attack implants a backdoor into the model by poisoning a small part of the training samples, and uses the backdoor trigger to manipulate the output results of the model on the test samples. The detector implanted with a backdoor will produce a backdoor effect when encountering test samples with a backdoor trigger during testing, and will remain normal when inputting clean test samples. In real-world scenarios, backdoor attacks pose a serious security threat to deep neural networks due to their concealment. SUMMARY

[0004] In view of the above defects or improvement needs of the prior art, the present application provides a backdoor attack method, device and system for thermal infrared target detection, which aims to design a target trigger and its corresponding second temperature interval according to the target thermal infrared scene and the first temperature interval corresponding to the target attack object, and then generate poisoned samples by implanting the target trigger from each sample image, and then use the target backdoor model trained by the poisoned data set and the clean sample set to implement backdoor attack, thereby solving the technical problem that existing attack means for thermal infrared target detection often have vulnerability.

[0005] To achieve the above-mentioned purpose, according to one aspect of the present application, a backdoor attack method for thermal infrared target detection is provided, comprising:

[0006] S1: determining a target thermal infrared scene and its corresponding target attack object from the acquired thermal infrared image annotation data set;

[0007] S2: design a target trigger and a corresponding second temperature interval according to the target thermal infrared scene and the first temperature interval corresponding to the target attack object; the second temperature interval is different from the first temperature interval but has a repeated interval;

[0008] S3: select part of sample images from the thermal infrared image annotation dataset, implant the image of the target trigger in each sample image and modify the corresponding label to generate a poisoned sample, and then obtain a poisoning dataset;

[0009] S4: mix the poisoning dataset and a clean dataset in the thermal infrared image annotation dataset that is not poisoned to obtain a mixed dataset; and train an initial thermal infrared target detection model using the mixed dataset to obtain a target backdoor model;

[0010] S5: input a current sample image into the target backdoor model; if the target trigger exists in the current sample image, trigger the target backdoor model to implement an attack behavior on the current sample image.

[0011] In one of the embodiments, the S3 includes:

[0012] select part of sample images from the thermal infrared image annotation dataset;

[0013] for a target influence attack, implant the target trigger in a target box of a same type of target of the attack object in the sample image and modify the label of the same type of target to generate a poisoned sample.

[0014] In one of the embodiments, the S5 includes:

[0015] input the current sample image into the target backdoor model;

[0016] if the target trigger exists in the current sample image, the target backdoor model modifies the label category of the target attack object to the label category of the target trigger, and outputs the original position of the attack object and the modified label category.

[0017] In one of the embodiments, the S3 includes:

[0018] select part of sample images from the thermal infrared image annotation dataset;

[0019] for a range influence attack, implant the target trigger in a fixed position in the scene corresponding to the target thermal infrared scene in the sample image, and modify the label of a same type of target within a certain range to generate a poisoned sample.

[0020] In one of the embodiments, the S5 includes:

[0021] Input the current sample image into the target backdoor model;

[0022] If the target trigger exists in the current sample image, the target backdoor model modifies the label category of each target within the attack range to the label category of the target trigger, and outputs the location information of each target within the attack range and the modified label category.

[0023] In one embodiment, S2 includes:

[0024] The highest and lowest temperatures of all targets in the target infrared scene are obtained to obtain a first temperature range; the pixel values ​​corresponding to each temperature point in the first temperature range are obtained to obtain the mapping relationship between temperature and pixel values.

[0025] The design parameters of the target trigger and the second temperature range are determined based on the mapping relationship; the design parameters include: size parameters, implantation location and material.

[0026] In one embodiment, the backdoor attack method for thermal infrared target detection further includes:

[0027] The range and intensity of the attack can be controlled by changing the second temperature range corresponding to the target trigger.

[0028] According to another aspect of the present invention, a backdoor attack device for thermal infrared target detection is provided, comprising:

[0029] The preprocessing module is used to determine the target thermal infrared scene and its corresponding target attack object from the acquired thermal infrared image annotation dataset;

[0030] The design module is used to design a target trigger and its corresponding second temperature range based on the target thermal infrared scene and the first temperature range corresponding to the target attack object; the second temperature range is different from the first temperature range but has overlapping intervals.

[0031] The poisoning module is used to select a portion of sample images from the thermal infrared image annotation dataset, implant the image of the target trigger into each sample image and modify the corresponding label to generate a poisoning sample, thereby obtaining a poisoning dataset;

[0032] The training module is used to mix the poisoned dataset and the clean dataset that was not poisoned in the thermal infrared image annotation dataset to obtain a mixed dataset; and to train an initial thermal infrared target detection model using the mixed dataset to obtain a target backdoor model.

[0033] An attack module is configured to input a current sample image into the target backdoor model; if the target trigger exists in the current sample image, triggering the target backdoor model to implement attack behavior on the current sample image.

[0034] According to another aspect of the present application, a backdoor attack system for thermal infrared target detection is provided, comprising a memory and a processor, the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0035] According to another aspect of the present application, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the steps of the above method.

[0036] Overall, compared with the prior art, the above technical solutions conceived by the present application can achieve the following beneficial effects:

[0037] (1) The present application provides a backdoor attack method for thermal infrared target detection, a target trigger and its corresponding second temperature interval are designed according to the target thermal infrared scene and the first temperature interval corresponding to the target attack object, the image of the target trigger is implanted in each sample image and the corresponding label is modified to generate a poisoned sample, and a target backdoor model is obtained by mixing and training the poisoned sample set and the clean sample set, thereby realizing backdoor attack. The present application innovatively proposes a backdoor attack strategy for thermal infrared target detection, uses the temperature characteristics of thermal infrared to design the temperature interval of the trigger based on the temperature interval of the target attack object, uses the target trigger set based on temperature difference to poison, train and attack, explores the security vulnerabilities of thermal infrared object detection to backdoor attack, and realizes hidden backdoor control of the output results of thermal infrared target detection.

[0038] (2) The present application describes the poisoning process of the target influence attack, implants the target trigger in the same target frame of the target attack object in the sample image and modifies the label of the same target to generate a poisoned sample, which can accurately implement the poisoning of the target influence attack and lay a foundation for the subsequent backdoor model to trigger the target influence attack.

[0039] (3) The present application describes the attack behavior of the target influence attack, the target backdoor model modifies the label category of the target attack object to the label category of the target trigger, and outputs the original position and the modified label category of the attack object. The recognition result of the selected object can be deceived, and the backdoor control of the single target detection of the model is realized.

[0040] (4) This scheme describes the poisoning process for target range attack, implants the target trigger in the fixed position in the scene corresponding to the target thermal infrared scene in the sample image, and modifies the label of the same type of target in a certain range to generate a poisoned sample, which lays the foundation for the subsequent backdoor model to trigger the target range attack.

[0041] (5) This scheme describes the attack behavior for target range attack, the target backdoor model modifies the label category of each target in the attack range to the label category of the target trigger, and outputs the position information and the modified label category of each target in the attack range. The recognition result of the selected range object can be deceived, and the backdoor control of the model multi-target detection is realized.

[0042] (6) The design method of the target trigger is described in this scheme, first, the mapping relationship between the temperature corresponding to the target infrared scene and the pixel value is obtained; then, the design parameters of the target trigger and the second temperature interval are determined based on the mapping relationship; the consistency of the attack deployment scene and the infrared imaging can be guaranteed, and the design of the temperature difference trigger in the backdoor control is realized.

[0043] (7) This scheme describes that this scheme can include controlling the range and intensity of the attack behavior by changing the second temperature interval corresponding to the target trigger, allowing the target to activate or deactivate the backdoor effect in different temperature ranges by adjusting its temperature, allowing the range to affect the attack to realize different backdoor attack ranges in different temperature ranges, thereby realizing the control of the backdoor attack effect. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 A flowchart of a backdoor attack method for thermal infrared target detection is provided for an embodiment of the present application.

[0045] Figure 2 A schematic diagram of digital world and physical world trigger design is provided for an embodiment of the present application.

[0046] Figure 3 A real world trigger schematic diagram is provided for an embodiment of the present application.

[0047] Figure 4 A target influence attack algorithm flowchart is provided for an embodiment of the present application.

[0048] Figure 5 A range influence attack algorithm flowchart is provided for an embodiment of the present application.

[0049] Figure 6 A real scene deployment schematic diagram is provided for an embodiment of the present application.

[0050] Figure 7 A block diagram of a backdoor attack device for thermal infrared target detection is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the objectives, technical solutions and advantages of the present application clearer, further detailed description will be made to the present application in combination with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. In addition, the technical features involved in the various embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0052] Embodiment 1

[0053] As Figure 1 shown, in order to achieve the above-mentioned purpose, according to an aspect of the present embodiment, a backdoor attack method for thermal infrared target detection is provided, comprising:

[0054] S1: determining a target thermal infrared scene and a corresponding target attack object from an acquired thermal infrared image labeled data set.

[0055] Specifically, collecting the thermal infrared image labeled data set includes screening existing classic data sets and shooting real scene data. Taking the autonomous driving scene as an example, the existing classic data set can use the FLIRv2 data set published by FLIR company and the multi-spectral object detection data set (Multi-spectral Object Detection Dataset) published by Tokyo University as the benchmark data set of digital world setting. FLIRv2 is the latest updated thermal data set of FLIR company, which contains 13,460 thermal infrared images and 12,982 RGB images sampled from videos. By screening the thermal infrared images and corresponding annotations in FLIRv2, and using them for digital world parameter research experiments. The multi-spectral object detection data set contains four sub-data sets of RGB, NIR, MIR and FIR, as well as the ground truth labels provided by the autonomous driving research team of Tokyo University. By screening the FIR sub-data set containing 7521 thermal infrared images and labels, the universality experiment of the backdoor attack method is carried out. Since the published data sets are mostly targets on the road, through screening comparison and scene analysis, it can be found that vehicles and pedestrians are the most common target classes in the data set, and they are the most important target classes in the field of autonomous driving, etc. Therefore, these two types of targets are selected as target attack objects, and the attack purpose is set to misidentify vehicles as pedestrians or fail to identify vehicle categories. Real scene data shooting can use a thermal infrared camera with pixel meeting the preset requirements to shoot target thermal infrared scenes, such as using HTI-301 thermal infrared camera (FPA384x288, NETD<$60mK) for physical shooting.

[0056] S2: Design a target trigger and its corresponding second temperature interval according to the target thermal infrared scene and the first temperature interval corresponding to its target attack object. The second temperature interval is different from the first temperature interval but has a repeated interval. For example, for an automatic driving scene, the target attack object is a driving vehicle and / or a pedestrian, the first temperature interval can be [32℃, 37℃], and the second temperature interval can be [40℃, 45℃]. For human body temperature detection, the target attack object is a human body, the first temperature interval is [36℃, 37℃], and the second temperature interval is [25℃, 28℃]. It should be noted that the above scenarios are only used as examples, and the target thermal infrared scene of the present embodiment is not limited thereto.

[0057] S3: Select part of sample images from the thermal infrared image annotation dataset, implant the image of the target trigger for each sample image, and modify the corresponding label to generate a poisoned sample, and then obtain a poisoned dataset. Different temperature target triggers and corresponding attack effects can be set when implanting the target trigger in the data poisoning stage, so that the trained target backdoor model can achieve different attack effects for different temperature triggers.

[0058] S4: Mix the poisoned dataset and the clean dataset in the thermal infrared image annotation dataset to obtain a mixed dataset. Train the initial thermal infrared target detection model using the mixed dataset to obtain a target backdoor model.

[0059] Specifically, the poisoned dataset and the clean dataset are mixed, and the number of samples in the mixed dataset and the number of samples in the original dataset can be the same or similar. The target backdoor model is trained using the mixed dataset, and the hyperparameters are adjusted so that the recognition accuracy of the target backdoor model and the benchmark model for clean samples is similar. For example, the initial thermal infrared target detection model can be Faster RCNN, Yolo v3 or Yolo v5, and two datasets-FLIR v2 and Multi-spectral Object Detection Dataset are used to implement thermal infrared target detection backdoor attack; the universality of the attack method is verified by using different target detection technologies and scenes; clean sample pictures and poisoned sample pictures are collected in different real scenes, the pictures are manually labeled, and the position information and category information of the attack target are modified to obtain a mixed dataset, and a target backdoor model is trained and deployed in a real scene to implement a backdoor attack. The present embodiment verifies the effectiveness in a digital world environment using three popular thermal infrared target detection models and two popular benchmark datasets, and achieves a very high attack success rate. Moreover, the arrangement cost is low, and the selected target trigger is easy to obtain in reality.

[0060] For example, the initial thermal infrared target detection model is YOLO v5, which includes the following three loss components: classification loss L cls , target box regression loss L B , and confidence loss L conf . The classification loss of the detected target box is only calculated when there is an object in the target box. The total loss function is composed of all three individual loss components: L = αL cls + βL conf + γL B ; where α, β, and γ are balance hyperparameters. According to different attack purposes, the backdoor attack can be expressed by the following two optimization problems. When the attack purpose is target misclassification, the optimization function is: where L represents the classification loss of the model with target backdoor model parameters on the mixed training set . Since only the class label of the target is modified, the mixed training set has no direct relationship with the confidence loss and the target box regression loss.

[0061] When the attack purpose is target disappearance, the optimization function is:

[0062]

[0063] where L represents the confidence loss of the model with target backdoor model parameters on the mixed training set . Since the classification loss and the target box regression loss of the target are only involved when the confidence loss indicates that the target in the target box has a high confidence, by deleting the class information and the position information of the object label, the normal function of the confidence loss component can be destroyed in the presence of the target trigger, causing the detector to incorrectly identify the object as non-existent in detection.

[0064] S5: inputting the current sample image into the target backdoor model. If the target trigger exists in the current sample image, triggering the target backdoor model to implement attack behavior on the current sample image, and modifying the position and label of the target attack object to the position and class of the target trigger.

[0065] Embodiment 2

[0066] In this embodiment, S2 includes obtaining the highest temperature and the lowest temperature of all targets in the target infrared scene to obtain a first temperature interval. The pixel value corresponding to each temperature point of the first temperature interval is obtained, so as to obtain a mapping relationship between temperature and pixel value. The design parameters of the target trigger and a second temperature interval are determined based on the mapping relationship. The design parameters include size parameters, implantation positions, and materials.

[0067] Referring to Figure 2 Unlike RGB images with three channels, thermal infrared images have only one gray channel and contain less texture information. When objects are mapped into the thermal infrared domain, they appear as gray images, and the gray distribution within the same object is relatively uniform, so the target trigger that wants to correspond to the physical world can only be designed as a gray pixel block. The first thing to do to deploy a thermal infrared target backdoor attack in the physical world is to clarify the relationship between temperature and thermal infrared imaging. A thermal infrared camera can be used to observe an electric heating plate at different temperatures to understand its shape and pixel value when mapped into the thermal infrared domain, and the mapping relationship between temperature and gray pixels can be obtained by interpolation: p = g(t) = Λ ΔT t-Φ ΔT ; where p ∈ [0, 255] is the pixel value, t is the target temperature, and p increases with t. Λ ΔT and Φ ΔT are adjustment parameters obtained by the thermal infrared camera according to the relative temperature difference ΔT. When ΔT is 14.73℃, Λ ΔT and Φ ΔT are 17.33 and 406.07, respectively. On the basis of this relationship, a target trigger carrier with good temperature sensitivity and controllability is selected.

[0068] For example, for temperature control attacks, selecting an electric heating plate as a target trigger can achieve the effect of temperature change without changing other parameter conditions of the target trigger; for general backdoor attacks, selecting a transparent plastic plate as a target trigger can achieve an effective attack that is hidden in the real world. As shown in Figure 3 , the image of the transparent plastic plate in the thermal infrared camera and the way to implant the target trigger into the target. In a real scene, according to the best parameter setting, the target trigger of the target influence attack is placed in front of the target to ensure that the relative position of the target trigger and the target in the thermal infrared camera is similar to the best parameter; the target trigger of the range influence attack is placed in the preset fixed position. It can be ensured that the target trigger effectively triggers the backdoor effect.

[0069] Embodiment 3

[0070] In this embodiment, S3 includes: selecting part of the sample images from the thermal infrared image annotation dataset. For target influence attacks, implant a target trigger in the target frame of the same target of the target attack object in the sample image and modify the label of the same target to generate a poisoned sample.

[0071] For the targeted impact attack, a ground parking lot was chosen as the physical experimental scenario. Thermal infrared video was captured between 6 PM and 8 PM, with an ambient temperature of 90 degrees Fahrenheit (32 degrees Celsius). By mounting thermal infrared cameras on moving vehicles, videos were recorded along the same driving route, showing both the presence and absence of target triggers, where the target triggers were randomly placed next to some cars. After splitting the video into frames, 788 clean images and 472 poisoned images were collected, and each image was manually annotated with three categories (people, bicycles, and cars).

[0072] like Figure 4 As shown, in the target influence attack, the attack target - vehicle - is first selected from the poisoned sample. Since the target trigger needs to be added inside the target object, the distance between the vehicle and the thermal infrared camera placed at a distance is different, and the size of the same target trigger is also different in the camera's view. In this embodiment, the size of the target trigger is adaptively adjusted according to the target bounding box of the target attack object to simulate the visual effect of the target trigger in the physical world. Given object 0 and its target bounding box size s, the target after the target trigger is implanted is: o′=o+y(p,λs); where the target trigger y(p,λs) is a pixel block with a pixel value of p and a size of λs, and λ is the scaling ratio. Then, the target trigger is attached to all objects in the target class (e.g., all vehicles in the image), which can be represented as: x′=x+∑ class＝car y(p, λs); x′ is the poisoned sample after all target triggers have been added to a clean image x. For each target to which a target trigger has been added, a label modification is performed. Poisoning Labels Modify the original tag according to the attack objective (i.e., to make the vehicle misidentified as a person or to make the vehicle unidentifiable). i , means as follows: l oc This represents the category label set by the attacker; here, the selected category is "human." "None" indicates that both the category and location information for this label have been deleted. After the target trigger is implanted and the label is modified, the poisoning dataset is obtained.

[0073] Example 4

[0074] In this embodiment, S5 includes: inputting the current sample image into the target backdoor model. If a target trigger exists in the current sample image, the target backdoor model modifies the label category of the target attack object to the label category of the target trigger, and outputs the original position and modified label category of the target attack object. See also... Figure 6 Two backdoor attack methods implemented using transparent plastic panels.

[0075] Example 5

[0076] In this embodiment, S3 includes: selecting part of sample images from the thermal infrared image annotation dataset. For range influence attack, a target trigger is implanted in a fixed position in the scene corresponding to the target thermal infrared scene in the sample image, and the labels of the same type of targets within a certain range are modified to generate poisoned samples.

[0077] For range influence attack, a crossroads is selected as the physical experiment scene. The thermal infrared video is taken during 6 pm to 8 pm, and the ambient temperature is 95 degrees Fahrenheit (35 degrees Celsius). By fixing the thermal infrared camera on the roadside and recording the video with the presence and absence of target triggers in a fixed position and perspective. After dividing the video into frames, 800 clean images and 488 poisoned images were collected, and each image was manually annotated with four categories (people, bicycles, cars, trucks). The target attack object selection and attack purpose setting are consistent with the digital experiment.

[0078] As shown in Figure 5 , in the range influence attack, for q*N poisoned samples, a target trigger is inserted in each sample image, so the position of the target trigger can be more flexible. Given a pixel strip y(p,wh) of length h, width w, and pixel value p∈[0,255] as the target trigger, the attacker arbitrarily selects a point (a,b) in the clean image x as the center point of the target trigger, implants the target trigger into the clean image, and the obtained poisoned image can be represented as follows: x'=x+y(p,wh); Unlike target influence attack, range influence attack only needs to modify the labels of all target attack objects within a certain range from the target trigger. Given the attack radius ar, when the object's coordinates (a0,b0) satisfy the following conditions, , the object's label is modified, and the modification method is the same as in the target influence attack. According to the attack purpose (target misclassification or target disappearance), the modification is made. Finally, the poisoned dataset for range influence attack can be obtained.

[0079] Embodiment 6

[0080] In this embodiment, S5 includes: inputting the current sample image into the target backdoor model. If there is a target trigger in the current sample image, the target backdoor model modifies the label category of each target within the attack range to the label category of the target trigger, and outputs the position information and the modified label category of each target within the attack range. Referring to Figure 6 , the two backdoor attack methods implemented by transparent plastic plates.

[0081] Embodiment 7

[0082] In this embodiment, the backdoor attack method for thermal infrared target detection further includes: by changing the second temperature interval corresponding to the target trigger, the range and intensity of the attack behavior can be controlled.

[0083] Specifically, after changing the temperature of the target trigger, the opening and closing of the attack can be controlled for the target impact attack; the range size of the attack can be controlled for the range impact attack. In addition, to achieve the above effects, different temperature target triggers and corresponding attack effects need to be set when implanting the target trigger in the data poisoning stage, so that the target backdoor model has the effect of temperature control attack.

[0084] Embodiment 8

[0085] As Figure 7 shown, according to another aspect of the present embodiment, a backdoor attack device for thermal infrared target detection is provided, comprising:

[0086] A preprocessing module is configured to determine a target thermal infrared scene and a corresponding target attack object from an acquired thermal infrared image annotation dataset.

[0087] A design module is configured to design a target trigger and a corresponding second temperature interval according to a first temperature interval corresponding to the target thermal infrared scene and the target attack object. The second temperature interval is different from the first temperature interval but has a repeated interval.

[0088] A poisoning module is configured to select part of sample images from the thermal infrared image annotation dataset, implant an image of the target trigger for each sample image, modify the corresponding label to generate a poisoned sample, and then obtain a poisoned dataset.

[0089] A training module is configured to mix the poisoned dataset and a clean dataset in the thermal infrared image annotation dataset that is not poisoned to obtain a mixed dataset. The initial thermal infrared target detection model is trained using the mixed dataset to obtain a target backdoor model.

[0090] An attack module is configured to input a current sample image into the target backdoor model. If the target trigger exists in the current sample image, the target backdoor model is triggered to implement an attack behavior on the current sample image.

[0091] Embodiment 9

[0092] The present embodiment provides a backdoor attack system for thermal infrared target detection, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the steps of the above method when executing the computer program.

[0093] Embodiment 10

[0094] The embodiment provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize steps of the method.

[0095] Those skilled in the art can understand that the above description is only the preferred embodiment of the present application, and is not used to limit the present application, and any modification, equivalent replacement and improvement made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A backdoor attack method for thermal infrared target detection, characterized in that, The method comprises the following steps: S1: determining a target thermal infrared scene and a corresponding target attack object from an acquired thermal infrared image annotation dataset; S2: designing a target trigger and a corresponding second temperature interval according to a first temperature interval corresponding to the target thermal infrared scene and the target attack object; the second temperature interval is different from the first temperature interval but has a repeated interval; S3: selecting part of sample images from the thermal infrared image annotation dataset, implanting an image of the target trigger for each sample image, and modifying the corresponding label to generate a poisoned sample, and then obtaining a poisoned dataset; S4: mixing the poisoned dataset and a clean dataset not poisoned in the thermal infrared image annotation dataset to obtain a mixed dataset; training an initial thermal infrared target detection model using the mixed dataset to obtain a target backdoor model; S5: inputting a current sample image into the target backdoor model; if the target trigger exists in the current sample image, triggering the target backdoor model to implement an attack behavior on the current sample image; The S2 comprises: obtaining a first temperature interval by obtaining the highest temperature and the lowest temperature of all targets in the target thermal infrared scene; obtaining a mapping relationship between temperature and pixel value by obtaining the pixel value corresponding to each temperature point of the first temperature interval; determining the design parameters of the target trigger and the second temperature interval based on the mapping relationship; the design parameters include: size parameters, implantation position and material; By changing the second temperature interval corresponding to the target trigger, the range and intensity of the attack behavior can be controlled.

2. The backdoor attack method against thermal infrared target detection of claim 1, wherein, The S3 comprises: selecting part of sample images from the thermal infrared image annotation dataset; for a target influence attack, implanting the target trigger in the same target box of the target attack object in the sample image and modifying the label of the same target to generate a poisoned sample.

3. The backdoor attack method against thermal infrared target detection of claim 2, wherein, The S5 comprises: inputting the current sample image into the target backdoor model; if the target trigger exists in the current sample image, the target backdoor model modifies the label category of the target attack object to the label category of the target trigger, and outputs the original position and the modified label category of the attack object.

4. The backdoor attack method against thermal infrared target detection of claim 1, wherein, The S3 comprises: selecting part of sample images from the thermal infrared image annotation dataset; for a range influence attack, implanting the target trigger in a fixed position in the scene corresponding to the target thermal infrared scene in the sample image, and modifying the label of the same target within a certain range to generate a poisoned sample.

5. The backdoor attack method against thermal infrared target detection of claim 4, wherein, The S5 comprises: inputting the current sample image into the target backdoor model; if the target trigger exists in the current sample image, the target backdoor model modifies the label category of each target within the attack range to the label category of the target trigger, and outputs the position information and the modified label category of each target within the attack range.

6. A backdoor attack device for thermal infrared target detection, characterized in that, A backdoor attack method for thermal infrared target detection according to any one of claims 1-5, comprising: A preprocessing module is configured to determine a target thermal infrared scene and a corresponding target attack object from an acquired thermal infrared image annotation dataset; A design module is configured to design a target trigger and a corresponding second temperature interval according to a first temperature interval corresponding to the target thermal infrared scene and the target attack object; the second temperature interval is different from the first temperature interval but has a repeated interval; A poisoning module is configured to select part of sample images from the thermal infrared image annotation dataset, implant an image of the target trigger for each sample image, modify a corresponding label to generate a poisoned sample, and further obtain a poisoned dataset; A training module is configured to mix the poisoned dataset and a clean dataset in the thermal infrared image annotation dataset that is not poisoned to obtain a mixed dataset, train an initial thermal infrared target detection model using the mixed dataset to obtain a target backdoor model; An attack module is configured to input a current sample image into the target backdoor model, and if the target trigger exists in the current sample image, trigger the target backdoor model to implement an attack behavior on the current sample image.

7. A backdoor attack system for thermal infrared target detection, comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

Images