Adaptive meta-attack system and method for target tracker under autonomous driving conditions

Abstract

This invention discloses an adaptive meta-attack system and method for target trackers under autonomous driving conditions. The system includes an initialization module, a meta-training iteration module, a meta-test module, a perturbation generator, and an inference module. The invention can enhance the generalization and attack power of adversarial attack models in visual target tracking tasks. The invention designs a novel dual-confidence balanced optimization loss function and a peripheral attack regression loss function to accurately and effectively destroy the target tracking system. The invention can implement generalized adversarial attacks on multiple trackers, improving the applicability of adversarial attacks on multiple trackers and increasing the threat posed to visual target tracking models.

Description

Technical Field

[0001] The present invention belongs to the field of autonomous driving and machine vision target tracking, and relates to an adaptive meta-attack system and method for a target tracker under autonomous driving conditions. Background Art

[0002] In the digital age, intelligent driving technology faces the challenge of adversarial attacks. These attacks can cause autonomous driving systems to make erroneous decisions, increasing the risk of traffic accidents. Visual object tracking technology is a key component of intelligent driving systems, enabling the identification and tracking of various objects on the road. However, adversarial attack techniques can disrupt these tracking systems, leading to erroneous object tracking or tracking failures, thus compromising the safety and stability of intelligent vehicles. To address this challenge, researchers have proposed adversarial attack algorithms to gain a deeper understanding of and improve the effectiveness and generalization of adversarial examples. Current research focuses on white-box, black-box, and semi-white-box attacks. Semi-white-box attacks are considered effective because they design attack strategies with limited model information, resulting in good adaptability and balance. Object tracking algorithms primarily rely on deep learning techniques. With the advent of large models and the widespread use of Transformer architectures, autonomous driving will inevitably be dominated by Transformer models. Visual object tracking has also evolved from Siamese networks to the Transformer framework, which is now predominantly used. However, the different structures and principles of different algorithms have led to limitations in research on attacks against specific trackers. To address the shortcomings of existing attack methods, researchers have proposed a method to improve the resilience of target tracking systems against adversarial attacks in the autonomous driving field. This method, through in-depth analysis and generation of highly effective and generalizable adversarial examples, aims to enhance the effectiveness and generalizability of adversarial examples in complex autonomous driving scenarios. This research will help strengthen the defense capabilities of target tracking systems against adversarial attacks and advance the development of adversarial defense technology. Summary of the Invention

[0003] The present invention aims to solve the adversarial attack problem faced by the visual tracking system in the autonomous driving system. Specifically, the technical problems include: the emergence of adversarial samples: with the development of autonomous driving technology, the visual tracking system faces the threat of adversarial samples. Adversarial samples are specially designed input data that can deceive the tracking system, causing the system to produce incorrect recognition and tracking results, thereby affecting the performance and safety of the entire autonomous driving system; Insufficient generalization ability: Traditional adversarial attack methods have the problem of insufficient generalization ability, that is, the attack strategy may only be effective for a specific tracker model and it is difficult to adapt to diverse tracker structures and characteristics; Balance between effect and speed: The adversarial attack method needs to minimize the impact on the performance and speed of the tracking system while ensuring the effect of the attack, so as to ensure the real-time and stability of the autonomous driving system.

[0004] The technical solutions of the present invention are as follows:

[0005] An adaptive meta-attack system against target trackers under autonomous driving conditions,

[0006] The system includes an initialization module, a meta-training iteration module, a meta-test module, a perturbation generator, and an inference module;

[0007] The initialization module includes a model initialization module and a parameter initialization module, which are used to initialize the model and parameters of the initialization module;

[0008] The meta-training iteration module includes a video input module, a training and verification model division module, and a meta-training module;

[0009] The meta-test module includes a performance verification and evaluation module and a parameter output module;

[0010] The meta-training iteration module trains the perturbation generator using video dataset data; and uses the meta-testing module to verify and evaluate the performance, performing multiple rounds of iterations to finally obtain the trained perturbation generator;

[0011] The inference module is used to attack the video using a perturbation generator.

[0012] The present invention further provides an adaptive meta-attack method for a target tracker under autonomous driving conditions. Utilizing the above-mentioned system, the method comprises the following steps:

[0013] (1) First, the initialization module uses the tracker model initialization module and the parameter initialization module to initialize the tracker model pool and parameters: First, the tracker model initialization module constructs a tracker model pool M = {M1, M2..., Mn} with diverse network structures. This model pool is used to construct the meta-training model pool and meta-test model, thereby supporting the rapid adaptation of the perturbation generator on different trackers. The parameters of the perturbation generator are θ output by the previous training process, where random parameters are used in the first training;

[0014] (2) The meta-training iteration module executes the video input module, extracts videos from the video dataset for sampling, and extracts one frame of images every 10 frames to form the training images of this round;

[0015] (3) The meta-training iteration module performs the partitioning module for training and validating the model;

[0016] (4) The meta-training iteration module executes the meta-training module, randomly samples from the tracker model pool N to construct a tracker model group S, extracts the search area image from the training image in this round, extracts the part containing the tracking target and inputs it into the perturbation generator to generate adversarial samples, and calculates the dual confidence balance optimization loss function L generated by each tracker c And the surrounding attack regression loss function L r , ,weighted ensemble loss function and apply back propagation for perturbation generator model optimization;

[0017] (5) Repeat step (4) φ times and output parameter θ1;

[0018] (6) The meta-test module perturbation generator loads the parameter θ1, and the performance verification and evaluation module performs performance testing. The tracker used by the performance verification and evaluation module is tracker E;

[0019] (7) Use the parameter output module of the meta-test module to output the parameters of the current round of disturbance generator θ2;

[0020] (8) Execute step (2) for a total of τ cycles, and take the perturbation generator parameters trained last time as the final parameter output;

[0021] (9) When conducting an attack, the inference module is executed, the final generator parameters are loaded, perturbations are generated and superimposed on the original search image to generate adversarial samples and deceive the tracker.

[0022] Preferably, the specific algorithm for dividing the training and validation models in step (3) above is as follows:

[0023] In each meta-training iteration, a tracker model E is randomly selected from the tracker model pool M, and the remaining models are used as the meta-training model pool N. Through this division, the meta-training and meta-testing mechanisms are used to evaluate and improve the generalization ability of the model and enhance the model's adaptability to new scenarios.

[0024] Preferably, the specific algorithm for performing the meta-training in step (4) above is as follows:

[0025] (2-1) Random Sampling Combination: Randomly sample the meta-training model pool N to construct a tracker model group S to enhance the diversity and complexity of the training model;

[0026] (2-2) Perturbation Generation: Perform multi-task training on the selected tracker model group S, pass the original search area image frame by frame to the perturbation generator to generate adversarial samples;

[0027] (2-3) Feature map acquisition: The adversarial sample and the original sample input S obtain the feature map (1) of each tracker, which is used to analyze the difference between the two and deceive the tracker.

[0028]

[0029] In formula (1), t represents the t frame of the video stream, Represents the adversarial sample, R represents the classification loss of the tracking process, and C represents the regression loss of the tracking process. Represent the regression feature maps of adversarial samples and original samples respectively, Represents the classification feature map of the adversarial sample and the original sample, The probability feature map of the softmax transformation of the classification feature map indicates the relative confidence of the target at that position;

[0030] (2-4) Calculating and weighting the integrated loss function and applying backpropagation for model optimization: Adversarial examples With the original sample They are respectively used as the input images of the trackers in the model group S to obtain the regression feature maps generated by each tracker Classification feature map and softmax conversion probability feature map Calculate the dual confidence balance optimization loss function L generated by each tracker c And the surrounding attack regression loss function L r , and obtain the comprehensive loss value by weighted summation, and backpropagate to update the model parameters.

[0031] Preferably, the detailed training algorithm of the perturbation generator in the above step (4) in the meta-training module is as follows:

[0032] (3-1) Randomly select a model from the model pool M as the meta-test model E{M e}, and the rest are used as the meta-training model pool N = {M1, M2, ..., M j ,…,M n}(e≠j);

[0033] (3-2), random sampling of models in the training model pool N = {(M a , M b |M a , M b ∈F, a≠b};

[0034] (3-3) The perturbation generator G generates a perturbation image P:

[0035] (3-4) Generate adversarial samples in the search area

[0036] (3-5) The adversarial sample and the original sample are passed to different trackers in S to generate their own regression feature maps Classification feature map And its corresponding probability feature map According to formula (1);

[0037] (3-6) Calculate the loss function L s =αL1+βL c +γL r ,

[0038] (3-7) Weighted summation of the loss functions of each part

[0039] (3-8), update the generator parameters θ1.

[0040] Preferably, the dual confidence balance optimization loss function L in step (4) above is c The definition is as follows

[0041]

[0042]

[0043]

[0044] (4-1) Dual confidence balance optimization loss function L c In the above example, three thresholds are set, δ represents the high confidence threshold, ζ represents the medium confidence threshold, Represents the low confidence threshold, m represents a tracker, h represents the original sample, a represents the adversarial sample, P represents the generated probability feature map, C represents the generated classification feature map, BCE represents the binary cross entropy formula, and H represents The confidence region index, λ1, λ2, λ3, λ4, λ5, λ6 represent the weights of each part. It represents the probability feature map generated by the original sample transfer tracker m. and It represents the probability feature map and classification feature map generated by the adversarial sample transfer tracker m. The loss function represents the area with higher confidence; Represents areas with lower confidence. To guide the adversarial attack, it targets both high-confidence and low-confidence areas, effectively increasing the attack strength.

[0045] (4-2) Specifically, we design two functions: First, we define the loss function for the area with higher confidence. The goal is to reduce the confidence scores in these areas; correspondingly, for areas with lower confidence, the loss function is defined In order to improve its confidence score, a dual strategy is used to optimize the effect of adversarial attacks. The loss function uses binary cross entropy (BCE) to evaluate the loss above δ. The difference between the confidence score of region H and zero makes the value of the high confidence region shift towards 0, and the constraint term is added to eliminate the difference between the foreground and background scores of the high confidence region. The value of L in the low confidence region is made close to 1, while also reducing the difference between the foreground and background scores. The definition of the low confidence interval is not simply to use all values ​​less than ζ, because the edge area is easily affected by the Hamming window and is not conducive to attack. Therefore, the range is limited to a more detailed interval. Inside,

[0046] And sort them, select the part that is greater than 1.5 times H. By balancing the number of high-confidence and low-confidence prediction boxes in this way, the focus is shifted to the easy-to-attack area, thereby enhancing the algorithm's attack capability. At the same time, inspired by the idea of ​​focal loss, the difficulty of the sample is adjusted, and finally multiplied by The adaptive optimization of the confidence of each channel makes the larger or smaller confidence have a greater weight, and pays more attention to the closest area and the area farthest from the true target.

[0047] Preferably, the peripheral attack regression loss function L in the above step (4) is R The definition is as follows

[0048]

[0049] L R In the loss function representing the surrounding attack regression loss, R represents the generated prediction box boundary. and Represents the predicted box boundaries generated by the adversarial sample and the original sample passing tracker m; m represents a tracker, h represents the original sample; δ represents the high confidence threshold; H represents The confidence region index; λ7 represents the coefficient; It represents the probability feature map generated by the original sample transfer tracker m; represents the regression feature map generated by the tracker after the adversarial attack within the confidence range [δ, 1], reflecting the position of the prediction box, It refers to the regression feature map corresponding to the highest confidence determined by the tracker in the unattacked search area.

[0050] (5-1) Peripheral attack regression loss function L R In the example, R represents the generated prediction box boundary. and It represents the boundary of the prediction box generated by the adversarial sample and the original sample transfer tracker m. During the tracking process, if the intersection over union (IoU) between the prediction box and the real box shows a low value, it usually indicates that the prediction box at that position is not suitable as the final tracking result. Compared with IoU, generalized IoU (GIoU) ​​provides a more obvious improvement. Even when the prediction box is completely out of the target, GIoU can still effectively measure the offset difference between the prediction box and the real target. As the relative distance between the two increases, the GIoU value also increases accordingly. This feature helps to guide the tracker prediction result away from the real target position. In this article, H represents the time The confidence region index; λ7 represents the coefficient; δ represents the high confidence threshold, represents the regression feature map generated by the tracker after the adversarial attack within the confidence range [δ, 1], reflecting the position of the prediction box. This refers to the regression feature map corresponding to the highest confidence score determined by the tracker in the unattacked search area. This approach may cause the prediction box to shift significantly or even shrink, so that in the next frame, the search area may no longer contain the true target location. This purposefully generates adversarial examples, effectively disrupting the tracker's performance and increasing its vulnerability to adversarial perturbations.

[0051] Preferably, the specific algorithm for performance verification and evaluation in step (6) above is as follows:

[0052] (6-1) Performance Verification and Evaluation: The same training strategy will be applied to the performance verification and evaluation module to counter the sample. With the original sample As the input of the tracker E, the feature map (4) is obtained to test its generalization ability to different models, evaluate and guide the optimization direction of the perturbation generator.

[0053]

[0054] In formula (4), t represents the t frame of the video stream, Represents the adversarial sample, R represents the classification loss of the tracking process, and C represents the regression loss of the tracking process. Represent the regression feature maps of adversarial samples and original samples respectively, Represents the classification feature map of the adversarial sample and the original sample, The probability feature map of the softmax transformation of the classification feature map indicates the relative confidence of the target at that position;

[0055] Preferably, the detailed training algorithm of the perturbation generator in the above step (4) in the meta-test module is as follows:

[0056] (7-1) Generator G generates a perturbed image P:

[0057] (7-2) Generate adversarial samples in the search area

[0058] (7-3), the adversarial sample is passed to the tracker in E to generate the classification feature map and its corresponding probability feature map according to formula (4);

[0059] (7-4) Calculate the loss function L e =αL1+βL C +γL R ,

[0060] (7-5), update the generator parameter θ2;

[0061] The beneficial effects of the present invention are:

[0062] The present invention can enhance the generalization and attack strength of the adversarial attack model in the visual target tracking task; the present invention designs a novel dual-confidence balanced optimization loss function and a peripheral attack regression loss function to accurately and effectively destroy the target tracking system; the present invention can realize generalized adversarial attacks on multiple trackers, improve the applicability of adversarial attacks on multiple trackers, and enhance the threat to the visual target tracking model. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is the algorithm flow chart of the present invention. DETAILED DESCRIPTION

[0064] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.

[0065] An adaptive meta-attack system against target trackers under autonomous driving conditions,

[0066] The system includes an initialization module, a meta-training iteration module, a meta-test module, a perturbation generator, and an inference module;

[0067] The initialization module includes a model initialization module and a parameter initialization module, which are used to initialize the model and parameters of the initialization module;

[0068] The meta-training iteration module includes a video input module, a training and verification model division module, and a meta-training module;

[0069] The meta-test module includes a performance verification and evaluation module and a parameter output module;

[0070] The meta-training iteration module trains the perturbation generator using video dataset data; and uses the meta-testing module to verify and evaluate the performance, performing multiple rounds of iterations to finally obtain the trained perturbation generator;

[0071] The inference module is used to attack the video using a perturbation generator.

[0072] The present invention further provides an adaptive meta-attack method for a target tracker under autonomous driving conditions, using the above system, such as Figure 1 As shown, the following steps are included:

[0073] (1) First, the initialization module uses the tracker model initialization module and the parameter initialization module to initialize the tracker model pool and parameters: First, the tracker model initialization module constructs a tracker model pool M = {M1, M2..., Mn} with diverse network structures. This model pool is used to construct the meta-training model pool and meta-test model, thereby supporting the rapid adaptation of the perturbation generator on different trackers. The parameters of the perturbation generator are θ output by the previous training process, where random parameters are used in the first training;

[0074] (2) The meta-training iteration module executes the video input module, extracts videos from the video dataset for sampling, and extracts one frame of images every 10 frames to form the training images of this round;

[0075] (3) The meta-training iteration module performs the partitioning module for training and validating the model;

[0076] (4) The meta-training iteration module executes the meta-training module, randomly samples from the tracker model pool N to construct a tracker model group S, extracts the search area image from the current round of training images, extracts the part containing the tracking target and inputs it into the perturbation generator to generate adversarial samples as the input image data of the tracker model group S, calculates and weights the integrated loss function and applies back propagation to optimize the perturbation generator model;

[0077] (5) Repeat step (4) φ times and output parameter θ1;

[0078] (6) The meta-test module perturbation generator loads the parameter θ1, and the performance verification and evaluation module performs performance testing. The tracker used by the performance verification and evaluation module is tracker E;

[0079] (7) Use the parameter output module of the meta-test module to output the parameters of the current round of disturbance generator θ2;

[0080] (8) Execute step (2) for a total of τ cycles, and take the perturbation generator parameters trained last time as the final parameter output;

[0081] (9) When conducting an attack, the inference module is executed, the final generator parameters are loaded, perturbations are generated and superimposed on the original search image to generate adversarial samples and deceive the tracker.

[0082] Preferably, the specific algorithm for dividing the training and validation models in step (3) above is as follows:

[0083] In each meta-training iteration, a tracker model E is randomly selected from the tracker model pool M, and the remaining models are used as the meta-training model pool N. Through this division, the meta-training and meta-testing mechanisms are used to evaluate and improve the generalization ability of the model and enhance the model's adaptability to new scenarios.

[0084] Preferably, the specific algorithm for performing the meta-training in step (4) above is as follows:

[0085] (2-1) Random Sampling Combination: Randomly sample the meta-training model pool N to construct a tracker model group S to enhance the diversity and complexity of the training model;

[0086] (2-2) Perturbation Generation: Perform multi-task training on the selected tracker model group S, pass the original search area image frame by frame to the perturbation generator to generate adversarial samples;

[0087] (2-3) Feature map acquisition: The adversarial sample and the original sample input S obtain the feature map (1) of each tracker, which is used to analyze the difference between the two and deceive the tracker.

[0088]

[0089] In formula (1), t represents the t frame of the video stream, Represents the adversarial sample, R represents the classification loss of the tracking process, and C represents the regression loss of the tracking process. Represent the regression feature maps of adversarial samples and original samples respectively, Represents the classification feature map of the adversarial sample and the original sample, The probability feature map of the softmax transformation of the classification feature map indicates the relative confidence of the target at that position;

[0090] (2-4) Calculating and weighting the integrated loss function and applying backpropagation for model optimization: Adversarial examples With the original sample They are respectively used as the input images of the trackers in the model group S to obtain the regression feature maps generated by each tracker Classification feature map and softmax conversion probability feature map Calculate the dual confidence balance optimization loss function L generated by each tracker c And the surrounding attack regression loss function L r , and obtain the comprehensive loss value by weighted summation, and backpropagate to update the model parameters.

[0091] Preferably, the detailed training algorithm of the perturbation generator in the above step (4) in the meta-training module is as follows

[0092] (3-1) Randomly select a model from the model pool M as the meta-test model E{M e}, and the rest are used as the meta-training model pool N = {M1, M2, ..., M j ,…,M n}(e≠j);

[0093] (3-2), random sampling of models in the training model pool N = {(M a , M b |M a , M b ∈F, a≠b};

[0094] (3-3) The perturbation generator G generates a perturbation image P:

[0095] (3-4) Generate adversarial samples in the search area

[0096] (3-5) The adversarial sample and the original sample are passed to different trackers in S to generate their own regression feature maps Classification feature map And its corresponding probability feature map According to formula (1);

[0097] (3-6) Calculate the loss function L s =αL1+βL c +γL r ,

[0098] (3-7) Weighted summation of the loss functions of each part

[0099] (3-8), update the generator parameters θ1.

[0100] Preferably, the dual confidence balance optimization loss function L in step (4) above is c The definition is as follows

[0101]

[0102]

[0103] (4-1) Dual confidence balance optimization loss function L c In the above example, three thresholds are set, δ represents the high confidence threshold, ζ represents the medium confidence threshold, Represents the low confidence threshold, m represents a tracker, h represents the original sample, a represents the adversarial sample, P represents the generated probability feature map, C represents the generated classification feature map, BCE represents the binary cross entropy formula, and H represents The confidence region index, λ1, λ2, λ3, λ4, λ5, λ6 represent the weights of each part. It represents the probability feature map generated by the original sample transfer tracker m. and It represents the probability feature map and classification feature map generated by the adversarial sample transfer tracker m. The loss function represents the area with higher confidence; Represents areas with lower confidence. To guide the adversarial attack, it targets both high-confidence and low-confidence areas, effectively increasing the attack strength.

[0104] (4-2) Specifically, we design two functions: First, we define the loss function for the area with higher confidence. The goal is to reduce the confidence scores in these areas; correspondingly, for areas with lower confidence, the loss function is defined In order to improve its confidence score, a dual strategy is used to optimize the effect of adversarial attacks. The loss function uses binary cross entropy (BCE) to evaluate the loss above δ. The difference between the confidence score of region H and zero makes the value of the high confidence region shift towards 0, and the constraint term is added to eliminate the difference between the foreground and background scores of the high confidence region. The value of L in the low confidence region is made close to 1, while also reducing the difference between the foreground and background scores. The definition of the low confidence interval is not simply to use all values ​​less than ζ, because the edge area is easily affected by the Hamming window and is not conducive to attack. Therefore, the range is limited to a more detailed interval. In this way, the number of high-confidence and low-confidence prediction boxes is balanced, and the focus is shifted to the easily attacked areas, thereby enhancing the attack capability of the algorithm. At the same time, inspired by the idea of ​​focal loss, the difficulty of the sample is adjusted and finally multiplied by The adaptive optimization of the confidence of each channel makes the larger or smaller confidence have a greater weight, and pays more attention to the closest area and the area farthest from the true target.

[0105] Preferably, the peripheral attack regression loss function L in the above step (4) is R The definition is as follows:

[0106]

[0107] L R In the loss function representing the surrounding attack regression loss, R represents the generated prediction box boundary. and Represents the predicted box boundaries generated by the adversarial sample and the original sample passing tracker m; m represents a tracker, h represents the original sample; δ represents the high confidence threshold; H represents The confidence region index; λ7 represents the coefficient; It represents the probability feature map generated by the original sample transfer tracker m; represents the regression feature map generated by the tracker after the adversarial attack within the confidence range [δ, 1], reflecting the position of the prediction box, It refers to the regression feature map corresponding to the highest confidence determined by the tracker in the unattacked search area.

[0108] (5-1) Peripheral attack regression loss function L R In the example, R represents the generated prediction box boundary. and It represents the boundary of the prediction box generated by the adversarial sample and the original sample transfer tracker m. During the tracking process, if the intersection over union (IoU) between the prediction box and the real box shows a low value, it usually indicates that the prediction box at that position is not suitable as the final tracking result. Compared with IoU, generalized IoU (GIoU) ​​provides a more obvious improvement. Even when the prediction box is completely out of the target, GIoU can still effectively measure the offset difference between the prediction box and the real target. As the relative distance between the two increases, the GIoU value also increases accordingly. This feature helps to guide the tracker prediction result away from the real target position. In this article, H represents the time The confidence region index; λ7 represents the coefficient; δ represents the high confidence threshold, represents the regression feature map generated by the tracker after the adversarial attack within the confidence range [δ, 1], reflecting the position of the prediction box. This refers to the regression feature map corresponding to the highest confidence score determined by the tracker in the unattacked search area. This approach may cause the prediction box to shift significantly or even shrink, so that in the next frame, the search area may no longer contain the true target location. This purposefully generates adversarial examples, effectively disrupting the tracker's performance and increasing its vulnerability to adversarial perturbations.

[0109] Preferably, the specific algorithm for performance verification and evaluation in step (6) above is as follows:

[0110] (6-1) Performance Verification and Evaluation: The same training strategy will be applied to the performance verification and evaluation module to counter the sample. With the original sample As the input of the tracker E, the feature map (4) is obtained to test its generalization ability to different models, evaluate and guide the optimization direction of the perturbation generator.

[0111]

[0112] In formula (4), t represents the t frame of the video stream, Represents the adversarial sample, R represents the classification loss of the tracking process, and C represents the regression loss of the tracking process. Represent the regression feature maps of adversarial samples and original samples respectively, Represents the classification feature map of the adversarial sample and the original sample, The probability feature map of the softmax transformation of the classification feature map indicates the relative confidence of the target at that position;

[0113] Preferably, the detailed training algorithm of the perturbation generator in the above step (4) in the meta-test module is as follows

[0114] (7-1) Generator G generates a perturbed image P:

[0115] (7-2) Generate adversarial samples in the search area

[0116] (7-3), the adversarial sample is passed to the tracker in E to generate the classification feature map and its corresponding probability feature map according to formula (4);

[0117] (7-4) Calculate the loss function L e =αL1+βL C +γL R ,

[0118] (7-5), update the generator parameters θ2.

[0119] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An adaptive meta-attack method for target trackers under autonomous driving conditions, characterized by: The steps include: (1-1) First, the initialization module uses the tracker model initialization module and the parameter initialization module to initialize the tracker model pool and parameters: First, the tracker model initialization module constructs a tracker model pool M = {M1, M2, ..., Mn} with diverse network structures. This model pool is used to construct a meta-training model pool and a meta-testing model, thereby supporting the rapid adaptation of the perturbation generator on different trackers. The parameters of the perturbation generator are θ output by the previous training process, and random parameters are used in the first training. (1-2) The meta-training iteration module executes the video input module, extracts videos from the video dataset for sampling, and extracts one frame of images every 10 frames to form the training images of this round; (1-3), the meta-training iteration module executes the training and validation model partitioning module, randomly selects one tracker E model from the tracker model pool M to build the meta-validation model, and the remaining tracker models are used as the meta-training model pool N; (1-4) The meta-training iteration module executes the meta-training module, randomly samples from the tracker model pool M to construct a tracker model group S, uses the tracker model group S to extract the search area image of this round of training images, extracts the part containing the tracking target and inputs it into the perturbation generator to generate adversarial samples, and calculates the dual confidence balance optimization loss function L generated by each tracker c And the surrounding attack regression loss function L r , weighted ensemble loss function and apply backpropagation to optimize the perturbation generator model; Dual confidence balance optimization loss function L c The definition is as follows: δ represents the high confidence threshold, ζ represents the medium confidence threshold, θ represents the low confidence threshold, m represents a tracker, h represents the original sample, a represents the adversarial sample, P represents the generated probability feature map, C represents the generated classification feature map, BCE represents the binary cross entropy formula, and H represents The confidence region index, λ1, λ2, λ3, λ4, λ5, λ6 represent the weights of each part; It represents the probability feature map generated by the original sample transfer tracker m. and They represent the probability feature map and classification feature map generated by the adversarial sample transfer tracker m respectively; The loss function represents the area with higher confidence; represents areas with lower confidence; Peripheral attack regression loss loss function L R The definition is as follows: L R Represents the surrounding attack regression loss function, R represents the generated prediction box boundary, and represents the predicted box boundaries generated by the adversarial sample and the original sample transfer tracker m; λ7 represents the coefficient; (1-5), repeat steps (1-4)φ times, and output parameter θ1; (1-6) The meta-test module will perform performance testing on the perturbation generator trained by each meta-training module during the training process of the meta-training iteration module using the corresponding performance verification and evaluation module. The tracker used by the performance verification and evaluation module is tracker E. (1-7), use the parameter output module of the meta-test module to output the parameters of the current round of disturbance generator θ2; (1-8) Execute step (1-2) for a total of τ cycles, and take the perturbation generator parameters trained last time as the final parameter output; (1-9) When conducting an attack, the inference module is executed, the final generator parameters are loaded, perturbations are generated and superimposed on the original search image to generate adversarial samples and deceive the tracker.

2. The adaptive meta-attack method for target trackers under autonomous driving conditions according to claim 1 is characterized in that The specific algorithm for the meta-training in steps (1-4) is as follows: (2-1) Random sampling combination: Randomly sample the meta-training model pool N to construct a tracker model group S to enhance the diversity and complexity of the training model; (2-2) Perturbation generation: Perform multi-task training on the selected tracker model group S, pass the original search area image frame by frame to the perturbation generator to generate adversarial samples; (2-3) Feature map acquisition: The adversarial sample and the original sample input S are used to obtain the feature maps of each tracker, which are used to analyze the gap between the two and deceive the tracker; (2-4) Calculate and weight the integrated loss function and apply back propagation to optimize the model: the adversarial sample and the original sample are used as the input images of the tracker in the model group respectively, and the regression feature map generated by each tracker is obtained; the classification feature map and the probability feature map of the softmax transformation are calculated, and the dual confidence balance optimization loss function and the surrounding attack regression loss loss function generated by each tracker are calculated, and the comprehensive loss value is obtained by weighted summation, and the model parameters are updated by back propagation.

3. The adaptive meta-attack method for target trackers under autonomous driving conditions according to claim 1 is characterized in that The detailed training algorithm of the perturbation generator in steps (1-4) in the meta-training module is as follows: (3-1) Randomly select a model from the model pool M as the meta-test model E, and the rest as the meta-training model pool N. Randomly sample S from the models in the training model pool N; (3-2) Next, the perturbation generator G generates a perturbation image P, and then generates an adversarial sample in the search area. The adversarial sample and the original sample use different trackers to generate their own regression feature maps, classification feature maps, and their corresponding probability feature maps, and calculate the loss function and the weighted sum of the loss functions of each part. (3-3) Finally, update the generator parameters.

4. The adaptive meta-attack method for target trackers under autonomous driving conditions according to claim 1 is characterized in that The specific algorithms for performance verification and evaluation in steps (1-6) are as follows: The same training strategy is applied to the performance verification and evaluation module. The adversarial samples and original samples are used as the input of the tracker E to obtain feature maps, test its generalization ability for different models, and evaluate and guide the optimization direction of the perturbation generator.

5. The adaptive meta-attack method for target trackers under autonomous driving conditions according to claim 1 is characterized in that The algorithm of the perturbation generator in steps (1-4) in the meta-test module is as follows: The generator G generates a perturbed image, generates adversarial samples in the search area, passes the adversarial samples to the tracker in E to generate classification feature maps and their corresponding probability feature maps, calculates the loss function, and updates the generator parameters.

Images