A method, system and terminal for countermeasure attack against visual target tracking

Abstract

The present invention belongs to the field of adversarial attack technology, and discloses an adversarial sample attack method, system and terminal for visual target tracking, comprising the following steps: S1, randomly selecting an interference image and adding a patch; S2, perturbing the test image features to generate an adversarial sample; that is, optimizing the test image in the feature space so that it approximates the interference image features with the patch, while keeping the adversarial noise as imperceptible as possible in the pixel space of the test image. This method is called USAE; S3, sample replacement, attacking the target tracking algorithm; using the adversarial test sample for target tracking model testing, and evaluating the tracking result is the attack effect. The present invention does not require a specific interference data set and can process any data set. The size of the patch added to the data set can be adjusted, and the overall adjustability is strong, and relevant settings can be adjusted according to actual needs.

Description

Technical Field

[0001] The present invention belongs to the field of adversarial attack technology, and in particular relates to an adversarial sample attack method, system and terminal for visual target tracking. Background Art

[0002] With the rapid development of deep learning, it has been applied to various problems, including computer vision tasks such as classification, detection, tracking, and generation. However, when processing computer vision tasks, it is vulnerable to adversarial attacks. These attacks are often difficult for the human visual system to detect, causing it to output erroneous results with high confidence. Currently, adversarial attacks mainly target target recognition and classification tasks, while adversarial attack methods for target tracking tasks are still lacking. Target tracking tasks are also widely used in various fields such as autonomous driving, smart transportation, and surveillance, and are closely related to the safety of people's lives and property. After improving tracking accuracy and speed, how to obtain more robust tracking models is one of the topics of subsequent research. However, only by understanding the attack methods can we understand the defense methods.

[0003] Adversarial examples are essentially adversarial attacks, designed to attack target tracking tasks and cause them to lose track. Adversarial attacks have become increasingly important with the advancement of visual object tracking. By studying adversarial attacks, we can identify vulnerabilities and weaknesses in tracking networks, lay a solid foundation for implementing defense strategies in later models, and design more robust tracking models with improved security.

[0004] Currently, adversarial attacks against visual object tracking can be categorized into two types: black-box attacks and white-box attacks. These attacks are categorized based on the degree of access to the parameters of the attacked tracking model. Black-box attacks only capture input and output parameters, while white-box attacks can obtain all algorithms and parameters of the tracking model.

[0005] While research on attack methods for visual object tracking has made some progress in recent years, it remains significantly lacking. Most adversarial attack methods remain confined to image recognition and classification tasks, with relatively little research on adversarial attacks for complex tasks such as object tracking. The vast majority of existing adversarial methods for object tracking target only the tracking models of Siamese networks, lacking a general, universal adversarial attack method. Although recent research has proposed using the intersection-over-union (IoU) score to perform adversarial attacks on visual object tracking, this method still only targets Siamese networks and is quite limited.

[0006] Through the above analysis, the problems and defects of the existing technology are: adversarial attacks based on visual target tracking can often only attack twin networks, and almost no other types of tracking models are involved; and most adversarial sample generation methods require changing the entire data set to attack, which is easy to detect. Summary of the Invention

[0007] In response to the problems existing in the prior art, the present invention provides a method, system and terminal for adversarial sample attacks on visual target tracking.

[0008] The present invention randomly selects an interference image dataset, matches the 50 images closest to the interference image in the original dataset as the objects to be attacked, modifies the original image features to generate adversarial sample images, makes them consistent with the interference image in feature space and consistent with the original image in pixel space, and finally replaces the generated adversarial sample with the test set, executes the tracking algorithm to finally achieve the attack. This is an adversarial sample attack method for visual target tracking, which can be called USAE (Universal and Sparse Adversarial Examples). The adversarial sample attack method for visual target tracking includes:

[0009] S1, random interference image selection and patch addition: randomly select several categories of images from other unrelated datasets as interference images, and add a patch of size 80×80 pixels at a random position of the interference image;

[0010] S2, perturb the test image features to generate adversarial samples: Match the images in the interference image dataset and the tracking test set, select the ones with the closest features as a pair, optimize the original image in the test set to make it close to the paired interference image features, while keeping the original pixel space as unchanged as possible, and use the standard gradient descent method to optimize it to generate adversarial samples;

[0011] S3, sample replacement, attack target tracking algorithm: the generated adversarial samples are replaced with the original test set, and only 50 images are replaced in each video sequence to form an adversarial test set; and it is used to test the target tracking model and evaluate the tracking results, that is, the attack effect.

[0012] Furthermore, S1 selects several categories from the ImageNet dataset as interference image datasets. The ImageNet dataset contains a total of 14,197,122 images with 1,000 categories. Only a small number of categories need to be selected to obtain sufficient interference images.

[0013] Furthermore, the USAE adversarial sample generation process in S2 includes:

[0014] Let the original image be c, the interference image be a, and the patch be p. Paste the patch p onto a to get the interference image with the patch: Generate adversarial samples y by the following formula:

[0015]

[0016] st.‖yc‖ ∞ <∈;

[0017] Here, f(·) is the intermediate feature of the deep model, which is the fc7 fully connected layer of AlexNet. The value of ∈ is very small, set to 16, to ensure that the poisoned data y and the target image are very close in the feature space.

[0018] Furthermore, in S2, the standard gradient descent method is used to perform gradient optimization on the model. After several iterations, the optimized generation equation can be obtained:

[0019]

[0020]

[0021] where y x is the xth iteration of the adversarial sample obtained, m(x) is a one-to-one matching function, That is the interference image after adding the corresponding patch.

[0022] Furthermore, S3 can generate corresponding adversarial samples for any dataset and has universal offensiveness against any tracker.

[0023] Another object of the present invention is to provide an adversarial sample attack system for visual target tracking using the adversarial sample attack method for visual target tracking. The adversarial sample attack system for visual target tracking includes:

[0024] The image selection module is used to randomly select interference images and add patches: from other unrelated datasets, several categories of images are randomly selected as interference images, and a patch of size 80×80 pixels is added to the random position of the interference image;

[0025] The sample generation module is used to perturb the test image features and generate adversarial samples. The module matches the images in the interference image dataset with the images in the tracking test set, selects the images with the closest features as a pair, optimizes the original image in the test set to make it close to the paired interference image features, and keeps the original pixel space as unchanged as possible. The module then uses the standard gradient descent method to optimize the original image to generate adversarial samples.

[0026] The sample replacement module is used to perform sample replacement and attack the target tracking algorithm: the generated adversarial samples are replaced with the original test set, and only 50 images are replaced in each video sequence to form an adversarial test set; and it is used to test the target tracking model and evaluate the tracking results, that is, the attack effect.

[0027] Another object of the present invention is to provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the adversarial sample attack method for visual target tracking.

[0028] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the adversarial sample attack method for visual target tracking.

[0029] Another object of the present invention is to provide an information data processing terminal, which is used to implement the adversarial sample attack system for visual target tracking.

[0030] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0031] First, the research on existing adversarial attack algorithms, especially adversarial attack methods for generating adversarial samples, is just emerging. Most of the research is still only focused on image recognition and classification tasks, and a small number of research works are focused on visual target detection. The research on visual target attack tasks is very limited. Simple image recognition and classification tasks only require misjudging the final output label of the target, but attacks on tracking tasks require that the final prediction box does not track the target, which is more complex and difficult. The research direction of the present invention is the research on adversarial attacks on target tracking tasks, which can fill the gap in this direction. In addition, existing methods generally only target tracking algorithms based on twin networks, especially SiamRPN++ algorithms. There is no universal attack method that is effective for all tracking algorithms. In response to the problems existing in the prior art, the present invention proposes a universal adversarial sample generation method that can attack any dataset or tracker, and expands the adversarial attack from being limited to a specific dataset or only targeting the twin network tracking model to various different tracking models. The adversarial sample generation method USAE based on this method has achieved good attack results. For example, it can reduce the tracker success rate to 1.8% in the GOT-10k dataset. This paper attacks three representative trackers: twin networks, discriminant correlation filters, and Transformer models, achieving good results. Most current adversarial attack methods attack every frame in a sequence. This sparse attack method, which targets only 50 images in each sequence, achieves similar or even better results.

[0032] Second, the present invention does not require a specific interference dataset and can process any dataset. The size of the patch added to the dataset can be adjusted, and the overall adjustability is strong, and relevant settings can be adjusted according to actual needs.

[0033] The present invention does not require attacking every original image; instead, only 50 images per sequence are needed to achieve the attack. These 50 images are the 50 images with the closest features to those after adding the interference patch. The attack is sparse, and not every sequence in the test set is attacked, making it more concealed.

[0034] The present invention randomly selects two types of data from ImageNet as interference datasets and adds a small patch to the interference dataset; matches the patched interference image with the original image to find the image pair with the most similar features, and uses the original image in the image pair as the target; uses the standard gradient descent method to optimize and generate adversarial samples. The adversarial samples adjust the features of the original image while keeping the original pixels unchanged as much as possible. To the model, the image has changed, but to the naked eye, the image has not changed, making the naked eye unable to detect that the attack has occurred; the attack effect of the present invention on multiple video tracking datasets is better than other advanced adversarial attack methods for visual target tracking.

[0035] This invention is not targeted at any specific tracking algorithm and can attack any tracking algorithm. Current mainstream tracker types, such as the twin network-based tracking algorithm, the discriminant correlation filter tracking algorithm, and the Transformer-based tracking algorithm, all have excellent attack effects.

[0036] Third, the technical solution of the present invention fills the technical gaps in the industry at home and abroad: the adversarial attack methods in the field of computer vision mainly focus on image classification, target detection and other fields, and involve a lot of visual target tracking tasks. In this small amount of research on target tracking, most of the attack methods are only aimed at twin network trackers, especially SiamRPN++ trackers, and there are almost no attack methods for other types of trackers. The attack method adopted by the present invention is applicable to trackers of any backbone, including but not limited to twin network-based, correlation filtering-based, Transfomer-based and other backbones. The attack method of the present invention is universal.

[0037] Does the technical solution of this invention overcome technical bias? Existing attack methods based on adversarial examples generally modify the entire original image, assuming that only by modifying every frame can an adversarial attack be achieved. This invention is a sparse adversarial example generation method that only requires modifying 50 images per sequence, without modifying the entire dataset. However, it ultimately achieves more effective and stealthy attack results.

[0038] Fourth, the significant technological advancements brought about by the technical solutions of the present invention include:

[0039] 1. Versatility: The USAE method is a universal adversarial sample generation method, which means it can attack a variety of visual object tracking algorithms and is not limited to specific models or application scenarios.

[0040] 2. Efficient Interference: By randomly selecting interfering images and generating adversarial examples, USAE can effectively perturb the decisions of target tracking algorithms. This enables it to affect a range of tracking tasks, including but not limited to drone tracking and smart camera surveillance.

[0041] 3. Fine-grained attack: This scheme allows maintaining the characteristics of the original image at the pixel level, which means that visually, the adversarial sample is very close to the original image, making the attack more difficult to detect.

[0042] 4. Saving computing resources: By replacing only 50 images, this scheme provides a cost-effective method for adversarial attacks in large datasets. This means that effective attacks can be achieved even with limited computing resources.

[0043] 5. Enhanced the depth of adversarial research: USAE provides a new way to think about and execute adversarial attacks, which may inspire other researchers to further explore and develop adversarial techniques, promoting the depth and breadth of research in this field.

[0044] In summary, USAE not only brings new ideas and methods to adversarial research, but also successfully demonstrates its efficient and imperceptible attack effects in practical applications, thus achieving significant technological progress. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0046] Figure 1 Schematic diagram of the steps of the adversarial sample attack method for visual target tracking provided by an embodiment of the present invention;

[0047] Figure 2 Flowchart of the adversarial sample attack method for visual target tracking provided by an embodiment of the present invention; wherein, (a) adversarial image generation process, (b) tracking process;

[0048] Figure 3This is an example image of an interference image with patches added at random positions provided by an embodiment of the present invention;

[0049] Figure 4 This is a comparison between the original image provided by an embodiment of the present invention and the adversarial sample generated by USAE, as well as a comparison of their feature maps. MAE and PNSR are schematic diagrams of image difference indicators.

[0050] Figure 5 : This is a comparison diagram of the original image tracking results and the tracking results after the attack provided by the embodiment of the present invention; among them, (a) original tracking result, (b) original heat map, (c) adversarial tracking result, (d) adversarial heat map;

[0051] Figure 6 This is a comparison chart of performance indicators before and after USAE attacks on different backbone network SiamRPN++ models and SiamMask models provided by an embodiment of the present invention;

[0052] Figure 7 Schematic diagram of the performance of five different types of tracking models for USAE attacks provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0054] In response to the problems existing in the prior art, the present invention provides a method, system and terminal for countermeasure sample attacks against visual target tracking. The present invention is described in detail below with reference to the accompanying drawings.

[0055] like Figure 1 As shown, an embodiment of the present invention provides an adversarial sample attack method for visual target tracking, comprising the following steps:

[0056] S1, randomly interfere with the image selection and add patches;

[0057] In other unrelated datasets, such as the ImageNet dataset, several categories of images are randomly selected as interference images, and a patch of size 80×80 pixels is added to the random position of the interference image;

[0058] Several categories in the ImageNet dataset are selected as interference image datasets. The ImageNet dataset contains a total of 14,197,122 images in 1,000 categories. The image resources are rich, and only a small number of categories need to be selected to obtain sufficient interference images.

[0059] S2, perturbs the test image features to generate adversarial samples;

[0060] Match the interference image dataset and the tracking test set images, select the ones with the closest features as a pair, optimize the original image in the test set to make it close to the paired interference image features, keep the original pixel space as unchanged as possible, and use the standard gradient descent method to optimize it to generate adversarial samples, forming the complete USAE method;

[0061] Let the original image be c, the interference image be a, and the patch be p. Paste the patch p onto a to get the interference image with the patch: Generate adversarial samples y by the following formula:

[0062]

[0063] st.‖yc‖ ∞ <∈

[0064] Here, f(·) is the intermediate feature of the deep model, which is the fc7 fully connected layer of AlexNet. The value of ∈ is very small, set to 16, to ensure that the adversarial sample y and the target image are very close in the feature space.

[0065] The standard gradient descent method is used to perform gradient optimization on the model. After several iterations, the optimized generation equation can be obtained:

[0066]

[0067]

[0068] where y x is the xth iteration of the adversarial sample obtained, m(x) is a one-to-one matching function, That is the interference image after adding the corresponding patch.

[0069] S3, sample replacement, attack target tracking model;

[0070] The generated adversarial samples are replaced with the original test set, with only 50 images replaced in each video sequence, to form an adversarial test set. This set is then used to test the target tracking model and evaluate the tracking results, i.e., the attack effect.

[0071] Corresponding adversarial samples can be generated for any dataset, and step three is universally aggressive against any tracker.

[0072] Figure 2 This is a flow chart of an adversarial sample attack method for visual target tracking provided by an embodiment of the present invention; wherein, (a) adversarial image generation process, (b) tracking process.

[0073] In order to prove the creativity and technical value of the technical solution of the present invention, this section provides application examples of the claimed technical solution on specific products or related technologies.

[0074] An application embodiment of the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor executes the steps of an adversarial sample attack method for visual target tracking.

[0075] An application embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of an adversarial sample attack method for visual target tracking.

[0076] An application embodiment of the present invention provides an information data processing terminal, which is used to implement an adversarial sample attack system for visual target tracking.

[0077] The application embodiment of the present invention provides an optional interference data set, and the huge interference data set can be randomly selected in the adversarial sample attack system of visual target tracking.

[0078] The application embodiment of the present invention provides corresponding different patch images, and each patch can achieve similar attack effects, helping to realize an adversarial sample attack system for visual target tracking.

[0079] An application embodiment of the present invention provides a patch adding system that can add patches at random positions of an interference image and can set the patch size, thereby implementing the part of adding patches on the interference image for an adversarial sample attack system for visual target tracking.

[0080] An application embodiment of the present invention provides an image feature optimization system, which can achieve that the generated adversarial sample is similar to the interference image after the patch is added in the feature space, and remains similar to the original image in the similarity space, thereby realizing the adversarial sample generation for the adversarial sample attack system for visual target tracking.

[0081] The embodiments of the present invention have achieved some positive results during the development or use process, and indeed have great advantages over the existing technology. The following content describes them in conjunction with data, charts, etc. from the experimental process.

[0082] Figure 3 This is an example image of an interference image with patches added at random positions provided by an embodiment of the present invention;

[0083] Figure 4This is a comparison between the original image provided by an embodiment of the present invention and the adversarial sample generated by USAE, as well as a comparison of their feature maps. MAE and PNSR are schematic diagrams of image difference indicators.

[0084] Figure 5 : This is a comparison diagram of the original image tracking results and the tracking results after the attack provided by the embodiment of the present invention; among them, (a) original tracking result, (b) original heat map, (c) adversarial tracking result, (d) adversarial heat map;

[0085] Figure 6 This is a comparison chart of performance indicators before and after USAE attacks on different backbone network SiamRPN++ models and SiamMask models provided by an embodiment of the present invention;

[0086] Figure 7 Schematic diagram of the performance of five different types of tracking models for USAE attacks provided by an embodiment of the present invention.

[0087] To better demonstrate the effectiveness of the attack presented in this paper, we compared the performance of several other adversarial attack methods for visual target tracking. As shown in Table 1, the present invention demonstrated significant attack effectiveness against the SiamRPN++ tracking model across various backbone networks, resulting in over 1,100 packet losses. However, its accuracy improved slightly in the VOT2018 dataset. This is primarily due to the accuracy calculation method excluding frames that are reinitialized after a loss of tracking. USAE generates a large number of such frames, and while achieving the goal of tracking losses, they are not included in the accuracy calculation. Comparative experiments were also conducted on a number of different trackers, as shown in Table 2. These experiments fully demonstrate the generalization of the present invention in attacking tracking models. The attack achieved good results against several of the most popular trackers, with the success rate of ToM decreasing by 69.6% and that of SiamRPN++ decreasing to 1.8%, completely rendering the tracker incapable of tracking. The performance of different methods on various datasets was also compared. On the OTB2013 dataset, the proposed method achieved a maximum reduction in success rate of 35% and precision of 45.7%. On the OTB2015 dataset, the success rate was reduced by 27.7% and precision by 36.7%, achieving significant attack results. On the GOT-10K dataset, the SiamRPN++ tracker was completely ineffective, with the average overlap rate and success rate reduced to 1.7% and 1.8%, respectively. The results on various datasets fully demonstrate the strong offensive capabilities of the proposed method in attacking trackers. Furthermore, the proposed method was compared with several currently top-performing adversarial attack methods for target tracking. Since other methods primarily target Siam network trackers, only the tracking performance of the SiamRPN++ tracker is compared. As shown in Table 3, the proposed method achieves the best attack results on VOT2018, OTB2013, and GOT-10K, and the adversarial samples generated are sparse, while other methods require frame-by-frame attacks. The results show that the present invention still has good attack performance on multiple data sets, indicating that the proposed adversarial sample attack method has good generalization and practicality.

[0088] Table 1 Attack effects of the attack method of the present invention on different backbone twin networks

[0089]

[0090] Table 2 Attack effects of the attack method of the present invention on different trackers and different data sets

[0091]

[0092]

[0093] Table 3 Attack effects of the proposed attack method and various attack methods on SiamRPN++

[0094]

[0095] Based on the USAE (Universal and Sparse Adversarial Examples) adversarial attack method, the following are two specific examples:

[0096] Example 1: Drone tracking of human body

[0097] Background: In a city park, a drone automatically tracks and records people running using a visual object tracking algorithm.

[0098] Implementation process:

[0099] 1. Randomly perturb image selection and add patches: Randomly select images from unrelated datasets such as urban buildings, billboards, street scenes, and then add 80×80 pixel patches at random locations on these images.

[0100] 2. Perturb the test image features to generate adversarial samples: Match the perturbed image with the park’s tracking test set, and select the image with the closest features for optimization so that its features are close to those of the perturbed image.

[0101] 3. Sample replacement, attacking the target tracking algorithm: In the drone's test video sequence, 50 images are randomly replaced with generated adversarial samples. When the drone is tracking a person, the tracking algorithm may be disturbed or fail due to the influence of these adversarial samples.

[0102] Result: The drone may lose tracking of the target person or mistakenly follow other objects.

[0103] Example 2: Smart Camera Monitoring Vehicle

[0104] Background: In a parking lot, smart cameras automatically monitor vehicle entry and exit using visual object tracking algorithms.

[0105] Implementation process:

[0106] 1. Randomly perturb image selection and add patches: Randomly select images from unrelated datasets such as natural scenery, flora and fauna, or sky clouds, and add 80×80 pixel patches at random locations on these images.

[0107] 2. Perturb the test image features to generate adversarial samples: Match the perturbed image with the parking lot tracking test set, select the image with the closest features and optimize it to make its features close to the perturbed image.

[0108] 3. Sample replacement, attacking the target tracking algorithm: In the surveillance video sequence of the smart camera, 50 images are randomly replaced with generated adversarial samples. When the camera monitors vehicles, the influence of these adversarial samples may cause it to misjudge or miss some vehicles.

[0109] Result: Smart cameras may not accurately track and record vehicle entry and exit, or may mistake other unrelated objects for vehicles.

[0110] These two examples demonstrate the actual effects and potential impacts of the USAE technical solution in different application scenarios.

[0111] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0112] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A method for attacking adversarial samples against visual object tracking, characterized in that: This method first selects several classes in the ImageNet dataset as interference image datasets and adds specific patches on them. Then, it optimizes the features of the original image to make it close to these interference images in the feature space while remaining unchanged in the pixel space. Finally, it replaces some images in the test set to execute the tracking algorithm, and the attack effect on the visual target tracking algorithm is tested. Adversarial attack methods for visual object tracking include: S1, random interference image selection and patch addition: In the ImageNet dataset, several categories of images are randomly selected as interference images, and a patch of size 80×80 pixels is added to the random position of the interference image; S2, perturb the test image features to generate adversarial samples: Match the images in the interference image dataset and the tracking test set, select the ones with the closest features as a pair, optimize the original image in the test set to make it close to the paired interference image features, while keeping the original pixel space as unchanged as possible, and use the standard gradient descent method to optimize it to generate adversarial samples; S3, sample replacement, attack target tracking algorithm: the generated adversarial samples are replaced with the original test set, replacing only 50 images in each video sequence to form an adversarial test set; this is used to test the target tracking model and evaluate the tracking results, i.e., the attack effect; In S1, several categories in the ImageNet dataset are selected as interference image datasets. The ImageNet dataset contains a total of 14,197,122 images with 1,000 categories. Only a small number of categories need to be selected to obtain sufficient interference images.

2. The adversarial attack method for visual target tracking according to claim 1, wherein: The USAE adversarial sample generation process in S2 includes: Let the original image be c, the interference image be a, and the patch be p. Paste the patch p onto a to get the interference image with the patch: Generate adversarial samples y by the following formula: st.||y-c|| ∞ <∈; Here, f(·) is the intermediate feature of the deep model, which is the fc7 fully connected layer of AlexNet. The value of ∈ is very small, set to 16, to ensure that the poisoned data y and the target image are very close in the feature space.

3. The adversarial attack method for visual target tracking according to claim 1, wherein: In S2, the standard gradient descent method is used to perform gradient optimization on the model. After several iterations, the optimized generation equation can be obtained: where y x is the xth iteration of the adversarial sample obtained, m(x) is a one-to-one matching function, That is the interference image after adding the corresponding patch.

4. The adversarial attack method for visual target tracking according to claim 1, wherein: S3 can generate corresponding adversarial samples for any dataset and has universal offensive properties for any tracker.

5. An adversarial sample attack system for visual target tracking using the adversarial sample attack method for visual target tracking according to any one of claims 1 to 4, characterized in that: Adversarial attack systems for visual object tracking include: The image selection module is used to randomly select interference images and add patches: several classes in the ImageNet dataset are selected as interference image datasets, and a patch of size 80×80 pixels is added to a random position of the interference image; The sample generation module is used to perturb the test image features and generate adversarial samples. The module matches the images in the interference image dataset with the images in the tracking test set, selects the images with the closest features as a pair, optimizes the original image in the test set to make it close to the paired interference image features, and keeps the original pixel space as unchanged as possible. The module then uses the standard gradient descent method to optimize the original image to generate adversarial samples. The sample replacement module is used to perform sample replacement and attack the target tracking algorithm: the generated adversarial samples are replaced with the original test set, and only 50 images are replaced in each video sequence to form an adversarial test set; and it is used to test the target tracking model and evaluate the tracking results, that is, the attack effect.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the adversarial sample attack method for visual target tracking as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the adversarial sample attack method for visual target tracking as described in any one of claims 1 to 4.

8. An information data processing terminal, the information data processing terminal being used to implement the adversarial sample attack system for visual target tracking as claimed in claim 5.

Images