A black-box based cross-modal dual-sparse video adversarial sample generation method

Abstract

The application discloses a kind of cross-modal double sparse video adversarial sample generation methods based on black box, belong to computer vision field, including: providing video sample, according to uniform sparse strategy division key frame set and sparse frame set;ImageNet pre-training image model VGG-16 is obtained;Provide herringbone mask;Initialize adversarial disturbance, utilize herringbone mask image restriction, initial disturbance is added to the herringbone area of current key frame to obtain the current key frame after initial disturbance;The current key frame before being disturbed and the current key frame after being disturbed are input into pre-training image model and the intermediate feature map of two is obtained;By reducing the structural similarity loss of the intermediate feature map of two, continuously update adversarial disturbance, finally form current adversarial frame;Key frame set is sequentially processed to form adversarial frame set;According to initial frame order, reorganize adversarial frame and sparse frame to form video adversarial sample.The application can generate video adversarial sample with double sparsity in time and space.

Description

Technical Field

[0001] This invention belongs to the field of computer vision, and in particular relates to a method for generating cross-modal dual-sparse video adversarial examples based on a black box. Background Technology

[0002] Deep neural networks have achieved great success in the field of artificial intelligence, such as natural language processing, image classification, and video recognition. However, existing research has shown that deep neural networks are vulnerable to security threats from adversarial examples. Adversarial examples are generated by adding carefully crafted subtle perturbations to benign samples, which can cause well-trained classifiers to make misclassifications with high confidence. Adversarial examples were first applied to image classification tasks, and research has gradually expanded to the field of video recognition. Video adversarial example generation methods mainly include two categories: white-box attacks and black-box attacks. For white-box attacks, attackers can obtain all the information of the attacked model, including model parameters, datasets, and output information, etc. Wei et al. proposed the first white-box-based video adversarial example generation method in the article "Sparse Adversarial Perturbations for Videos. Proceedings of the AAAI Conference on Artificial Intelligence, 2019, 33(01): 8973-8980". However, white-box-based video adversarial examples often fail to successfully attack black-box models. For black-box attacks, attackers can often only obtain partial information about the model, such as the model's output labels and probabilities. Therefore, compared to white-box attacks, black-box attacks are often closer to reality. Black-box attacks can generally be divided into two types: query-based black-box attacks and transfer-based black-box attacks. Query-based black-box attacks typically utilize the model's output information to estimate gradients, thereby generating video adversarial examples. Jiang et al. proposed the first query-based black-box video adversarial example generation method in their paper "Black-box Adversarial Attacks on Video Recognition Models, Proceedings of the 27th ACM International Conference on Multimedia, 2019, 864-872". However, query-based video adversarial example generation methods usually require a huge number of queries, which is impractical in real-world scenarios. Transfer-based black-box attacks typically require training a local alternative model. Wei et al. proposed using temporal transformation to enhance video data in “Boosting the Transferability of Video Adversarial Examples via TemporalTranslation. Proceedings of the AAAI conference on artificial intelligence, 2022, 36(3):2659-2667”, thereby enhancing the transferability of video adversarial examples.However, both query-based methods, which require significant query overhead, and transfer-based methods, which necessitate training local alternative models, present challenges to implementing video adversarial attacks. Furthermore, both query- and transfer-based video adversarial example generation processes rely on homomorphic video models.

[0003] To address the shortcomings of query-based and transfer-based black-box video adversarial example generation methods, researchers propose a cross-modal black-box video adversarial example generation method. This method leverages image models to generate adversarial frames, which are then combined to generate video adversarial examples. Compared to acquiring homomorphic video models, image models have simpler structures and are easier to obtain. Wei et al., in their paper "Cross-Modal Transferable Adversarial Attacks from Images to Videos. Proceedings of the IEEE / CVF conference on computer vision and pattern recognition, 2022, 15064-15073," proposed the first cross-modal video adversarial attack method, I2V. I2V successfully implemented video adversarial attacks using image models, such as SqueezeNet. In their paper "Global-Local Characteristic Excited Cross-Modal Attacks from Images to Videos. Proceedings of the AAAI Conference on Artificial Intelligence, 2023, 37(2), 2635-2643", Wang et al. proposed enhancing the effectiveness of adversarial examples in videos by generating more effective perturbations and disrupting the local correlations of video samples through the interaction of global frames. Current cross-modal video adversarial example generation methods only focus on dense attacks based on the infinite norm. Such attacks require calculating the global perturbation of video samples, which requires perturbing all video frames in the temporal dimension and the entire spatial region of the video frames in the spatial dimension.

[0004] Therefore, this invention proposes a black-box-based cross-modal dual-sparse video adversarial sample generation method to address black-box video adversarial attacks. This method generates video adversarial samples with temporal and spatial sparse perturbations, which can examine vulnerabilities in video recognition models and serve as an evaluation metric for the security of video recognition models, thereby promoting the improvement of the robustness of video recognition models. Summary of the Invention

[0005] To address the shortcomings of current cross-modal attacks, which require calculating global perturbations of video samples and thus perturb all video frames across their entire spatial region, resulting in a large number of perturbation frames and a large perturbation area, this invention provides a black-box-based method for generating cross-modal dual-sparse adversarial examples. This method divides the video adversarial examples into two groups: a keyframe set and a sparse frame set. The keyframes and the latest perturbated keyframes are input into the ImageNet pre-trained model VGG-16 to obtain intermediate feature maps. The similarity loss between these intermediate feature maps is continuously reduced to obtain adversarial perturbations. These perturbations are then superimposed onto the cross-shaped regions of the video sample keyframes to generate adversarial frames. Finally, the adversarial frame set and the undisturbed sparse frame set are recombined in the original video frame order to form video adversarial examples with temporal and spatial dual sparsity.

[0006] To achieve the above objectives, the present invention provides the following solution:

[0007] A black-box-based method for generating cross-modal dual-sparse video adversarial examples includes the following steps:

[0008] Step S1: Provide benign video samples and divide the frames of a single benign video sample into a key frame set and a sparse frame set according to a uniform sparsity strategy.

[0009] Step S2: Obtain the ImageNet image pre-trained model VGG-16 provided by PyTorch;

[0010] Step S3: Provide a cross-shaped mask image with the same length, width, number of channels, and video frame count;

[0011] Step S4: Initialize the adversarial perturbation that is confined to the X-shaped region by the masked image, and add the adversarial perturbation to the current keyframe;

[0012] Step S5: For the key frame to be processed, input the key frame before it was perturbed and the key frame after the latest perturbed into VGG-16 respectively, and obtain the intermediate feature map of the two for the l-th layer of VGG-16.

[0013] Step S6: Using the structural similarity measurement loss function, calculate the similarity loss between the intermediate feature maps before and after the current keyframe is perturbed. Based on the calculated similarity loss, backpropagate to calculate the perturbation that is restricted to the X-shaped region by the mask image. Add the perturbation to the X-shaped perturbation region of the current keyframe to obtain the current keyframe after the latest perturbation.

[0014] Step S7: For the keyframe currently being processed, iterate steps S5 and S6 I times to output the final perturbated keyframe, i.e., the adversarial frame.

[0015] Step S8: Repeat steps S4, S5, S6 and S7 for all keyframes in the keyframe set until all keyframes are processed and all perturbed keyframes are obtained, i.e., the adversarial frame set.

[0016] Step S9: Reassemble the adversarial frame set and sparse frame set according to the frame order of the original benign video samples to obtain video adversarial samples with spatial and temporal sparse perturbations.

[0017] Step S10: Output the processed video adversarial sample.

[0018] A further improvement of the technical solution of this invention lies in that the uniform sparsity strategy is a temporal sparsity perturbation strategy. This strategy uniformly divides the total number of video frames (an even number n) into c groups, each group containing b video frames, where n = c × b and n, b, and c are all integers. Within each group, t keyframes and bt sparse frames are arranged in sequence. Once the total number of frames n is determined, c and t can be reasonably set according to the temporal sparsity requirements and actual conditions. The key principle is to maximize the uniform mixing of keyframes and sparse frames to disrupt the inter-frame similarity between adjacent frames, thereby causing the video recognition model to misidentify samples. For ease of demonstration, this application presents a division method where the total number of frames is an even number n, divided into n / 2 groups, each group containing 2 frames, one keyframe and one sparse frame. The division formula is expressed as follows:

[0019] v = (x1, x2, ..., x i ,...,x n )

[0020] K x =(x1,x3,x5,...,x n-1 )

[0021] S x =(x2,x4,x6,...,x n )

[0022] Where v represents a video sample, x i K represents the i-th video frame. x S represents the set of keyframes. x This represents a set of sparse frames.

[0023] A further improvement of the technical solution of the present invention is that the key frame is a video frame that needs to be disturbed.

[0024] A further improvement of the technical solution of the present invention is that the sparse frame is a video frame that does not need to be disturbed.

[0025] A further improvement to the technical solution of this invention lies in the following: the value of the star-shaped region of the star-shaped mask image is 1, and the values ​​of other positions are 0. The star-shaped region is composed of four line segments intersecting at the midpoint, with the angle between adjacent line segments being 45 degrees. The four lines are sufficiently thin and long, extending as far as possible to the edge of the image. This mask image is used to restrict the addition of perturbation to the star-shaped region of the video frame, thereby achieving spatial sparsity of video adversarial sample perturbation. The input image of the VGG-16 model has a length and width of 224, therefore the length and width of the mask image are also 224. Assuming that the origin of the mask image (0,0) is located at the upper left corner of the image, with the positive direction of the horizontal axis to the right and the positive direction of the vertical axis downwards, the formula for this mask image is expressed as follows:

[0026]

[0027] Where, m e,k This represents the pixel values ​​of all channels in the mask image at coordinates (e, k), where e is the x-coordinate, k is the y-coordinate, and C represents the number of channels, {1} C This indicates that all channels of the mask image are 1 at a certain coordinate position, {0} C This indicates that all channels of the mask image are 0 at a certain coordinate position.

[0028] A further improvement to the technical solution of this invention is that the adversarial perturbation of the initial masked image, confined to the X-shaped region, is shown in the following formula:

[0029]

[0030] in, Let m represent the initial perturbation of the i-th keyframe, m represent the cross-shaped mask image, and ||m||0 represent the 0-norm constraint on m.

[0031] A further improvement to the technical solution of the present invention is that the adversarial perturbation is added to the current keyframe using the following formula:

[0032]

[0033] in, This represents the i-th keyframe after adding the initial adversarial perturbation to the star-shaped region, where 1 ∈ {1} H×W×C , m represents the star-shaped mask image, x i This represents the i-th keyframe, and ⊙ represents pixel multiplication. This represents the initial perturbation of the i-th keyframe.

[0034] A further improvement of the technical solution of the present invention is that: the first layer of VGG-16 is the 9th ReLU layer of VGG-16, that is, the 20th layer feature map obtained by inputting the video frame into VGG-16.

[0035] A further improvement to the technical solution of the present invention is that the structural similarity measurement loss function is formulated as follows:

[0036]

[0037] Where SSLF(·) represents the structural similarity loss function, p and q represent two aligned input images, and μ p and μ q Let p and q represent the average values, respectively. and Let σ represent the variances of p and q, respectively. pq Let C1 represent the covariance of p and q, where C1 = (K1L). 2 C2 = (K2L) 2 L represents the dynamic range of pixel values, K1 = 0.01, K2 = 0.03.

[0038] A further improvement to the technical solution of this invention lies in: the perturbation confined to the X-shaped region by the masked image is calculated by backpropagation based on the calculated similarity loss, and the formula is as follows:

[0039]

[0040] Where i represents the current processing frame as the i-th keyframe, and j represents the j-th iteration of the processing of the current keyframe. and These represent the adversarial perturbations of the i-th keyframe in rounds j and (j-1), respectively; ω represents the step size; ADAM(·) indicates that the optimizer used is the Adam optimizer; SSLF(·) represents the structural similarity loss function; f(·) represents the image pre-trained model VGG-16; and map l (·) represents the intermediate feature map of the l-th layer. x represents the version of the keyframe i after the perturbation is added in the (j-1)th iteration. i This represents the i-th keyframe that has not been disturbed.

[0041] A further improvement to the technical solution of this invention is that: the formula for accumulating the perturbation into the star-shaped perturbation region of the current keyframe to obtain the latest perturbed keyframe is as follows:

[0042]

[0043] Where i represents the current processing frame as the i-th keyframe, and j represents the j-th iteration of the processing of the current keyframe. Let i be the i-th keyframe processed in the j-th round, 1∈{1} H×W×C , m represents the star-shaped mask image, xi This represents the i-th unperturbed keyframe, and ⊙ represents pixel multiplication. This represents the perturbation obtained in the h-th round of the i-th frame image.

[0044] A further improvement to the technical solution of the present invention is that the final perturbated current keyframe, i.e., the adversarial frame, has the following formula:

[0045]

[0046] Where i represents the i-th keyframe being processed. Let i be the adversarial frame, 1 ∈ {1} H×W×C , m represents the star-shaped mask image, x i This represents the i-th keyframe, ⊙ represents pixel multiplication, and I = 50 represents the total number of loop iterations. This represents the perturbation obtained in the h-th round of the i-th frame image.

[0047] A further improvement to the technical solution of this invention lies in: obtaining all perturbated keyframes, i.e., the set of adversarial frames, is achieved by the following formula:

[0048]

[0049] in, Represents the set of adversarial frames. This indicates the first frame of the adversarial process, and n is the total number of frames in the video.

[0050] A further improvement to the technical solution of this invention lies in the following: the adversarial frame set and sparse frame set are reorganized according to the frame order of the original benign video samples to obtain video adversarial samples with spatial and temporal sparse perturbations, as shown in the following formula:

[0051]

[0052] Among them, v adv This represents adversarial examples in videos. This represents the (i-1)th adversarial frame, x i denoted as the i-th sparse frame, and n is the total number of video sample frames.

[0053] Due to the adoption of the above technical solution, the technical effects achieved by the present invention are as follows:

[0054] This invention proposes a black-box-based method for generating cross-modal dual-sparse video adversarial samples, utilizing the principle of cross-modal video adversarial sample generation. This method can generate video adversarial samples that simultaneously exhibit temporal and spatial sparsity perturbations.

[0055] This invention proposes a temporal sparse perturbation strategy. Unlike traditional methods that perturb all video frames, this method selects a set of keyframes for perturbation, leaving the sparse frame set undisturbed. The perturbed keyframe set and the undisturbed sparse frame set are then uniformly mixed to disrupt the local correlation of video samples, thereby mitigating the negative impact of reduced perturbation frames. This achieves temporal sparse perturbation while stabilizing the attack success rate.

[0056] This invention proposes a spatial sparse perturbation strategy, which applies a star-shaped block perturbation to the spatial region of a video frame. Compared with the square or rectangular block perturbation in local areas, the star-shaped block perturbation can have a global impact on the video frame, thus enhancing its attack performance.

[0057] This invention proposes to design a similarity loss using structural similarity to enhance the aggressiveness of adversarial examples. Attached Figure Description

[0058] Figure 1 This is a flowchart illustrating a black-box-based cross-modal dual-sparse video adversarial sample generation method proposed in this invention.

[0059] Figure 2 It is the rice-shaped mask image proposed in this invention;

[0060] Figure 3 This is a schematic diagram illustrating a specific embodiment of the present invention. Detailed Implementation

[0061] To make the technical solution of the present invention clearer and more understandable, the technical solution of the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0062] Example 1

[0063] This invention provides a black-box-based method for generating cross-modal dual-sparse video adversarial examples, comprising the following steps: Figure 1 As shown,

[0064] (1) Provide benign video samples and divide the frames of a single benign video sample into a key frame set and a sparse frame set according to a uniform sparse strategy;

[0065] (2) Obtain the ImageNet image pre-trained model VGG-16 provided by PyTorch;

[0066] (3) Provide a cross-shaped mask image with the same length, width, number of channels, and video frame count;

[0067] (4) Initialize the adversarial perturbation that is confined to the star-shaped region by the masked image, and add the adversarial perturbation to the current keyframe;

[0068] (5) For the key frame to be processed, input the key frame before it was disturbed and the key frame after the latest disturbance into VGG-16 respectively, and obtain the intermediate feature map of the two for the l-th layer of VGG-16.

[0069] (6) Using the structural similarity measurement loss function, calculate the similarity loss between the intermediate feature maps before the current keyframe is disturbed and after the latest disturbance. Based on the calculated similarity loss, backpropagate to calculate the disturbance that is restricted to the cross-shaped region by the mask image. Add the disturbance to the cross-shaped disturbance region of the current keyframe to obtain the current keyframe after the latest disturbance.

[0070] (7) For the current key frame being processed, iterate steps (5) and (6) I times to output the current key frame after being disturbed, i.e., the adversarial frame.

[0071] (8) Repeat steps (4), (5), (6) and (7) for all keyframes in the keyframe set until all keyframes are processed and all perturbed keyframes are obtained, i.e., the adversarial frame set.

[0072] (9) Reorganize the adversarial frame set and sparse frame set according to the frame order of the original benign video samples to obtain video adversarial samples with spatial and temporal sparse perturbations.

[0073] The uniform sparsity strategy described in this embodiment of the invention is a temporal sparsity perturbation strategy. This strategy uniformly divides the total number of video frames (an even number n) into c groups, each group containing b video frames, where n = c × b and n, b, and c are all integers. Within each group, t keyframes and bt sparse frames are arranged in sequence. Once the total number of frames n is determined, c and t can be reasonably set according to the temporal sparsity requirements and actual conditions. The key principle is to maximize the uniform mixing of keyframes and sparse frames to disrupt the inter-frame similarity between adjacent frames, thereby causing the video recognition model to misidentify samples. For ease of demonstration, one division method is shown here, where the total number of frames is an even number n, divided into n / 2 groups, each group containing 2 frames: one keyframe and one sparse frame. The division formula is expressed as follows:

[0074] v = (x1, x2, ..., x i ,...,x n )

[0075] K x =(x1,x3,x5,...,x n-1 )

[0076] S x =(x2,x4,x6,...,x n )

[0077] Where v represents a video sample, x iK represents the i-th video frame. x S represents the set of keyframes. x This represents a set of sparse frames.

[0078] In this embodiment of the invention, the keyframe is a video frame that needs to be disturbed.

[0079] In this embodiment of the invention, the sparse frame is a video frame that does not need to be disturbed.

[0080] In this embodiment of the invention, the cross-shaped mask image has a value of 1 for the cross-shaped region and 0 for other positions. The cross-shaped region is composed of four line segments intersecting at the midpoint, with adjacent line segments forming an angle of 45 degrees. The four lines are sufficiently thin and long, extending as far as possible to the edge of the image. This mask image is used to restrict the addition of perturbation to the cross-shaped region of the video frame, thereby achieving spatial sparsity of video adversarial sample perturbation. The input image of the VGG-16 model has a length and width of 224, therefore the length and width of the mask image are also 224. Assuming that the origin (0,0) of the mask image is located at the upper left corner of the image, with the positive horizontal axis pointing to the right and the positive vertical axis pointing downwards, the formula for this mask image is expressed as follows:

[0081]

[0082] Where, m e,k This represents the pixel values ​​of all channels in the mask image at coordinates (e, k), where e is the x-coordinate, k is the y-coordinate, and C represents the number of channels, {1} C This indicates that all channels of the mask image are 1 at a certain coordinate position, {0} C This indicates that all channels of the mask image are 0 at a certain coordinate position.

[0083] The adversarial perturbation for initializing the masked image within a star-shaped region, as described in this embodiment of the invention, is shown in the following formula:

[0084]

[0085] in, Let m represent the initial perturbation of the i-th keyframe, m represent the cross-shaped mask image, and ||m||0 represent the 0-norm constraint on m.

[0086] In this embodiment of the invention, the adversarial perturbation is added to the current keyframe using the following formula:

[0087]

[0088] in, This represents the i-th keyframe after adding the initial adversarial perturbation to the star-shaped region, where 1 ∈ {1} H×W×C , m represents the star-shaped mask image, x iThis represents the i-th keyframe, and ⊙ represents pixel multiplication. This represents the initial perturbation of the i-th keyframe.

[0089] In this embodiment of the invention, the 1st layer of VGG-16 is the 9th ReLU layer of VGG-16, which is the 20th layer feature map obtained by inputting video frames into VGG-16.

[0090] The structural similarity measurement loss function described in this embodiment of the invention is shown in the following formula:

[0091]

[0092] Where SSLF(·) represents the structural similarity loss function, p and q represent two aligned input images, and μ p and μ q Let p and q represent the average values, respectively. and Let σ represent the variances of p and q, respectively. pq Let C1 represent the covariance of p and q, where C1 = (K1L). 2 C2 = (K2L) 2 L represents the dynamic range of pixel values, K1 = 0.01, K2 = 0.03.

[0093] In this embodiment of the invention, the perturbation confined to the X-shaped region by the masked image is calculated by backpropagation based on the calculated similarity loss, and the formula is as follows:

[0094]

[0095] Where i represents the current processing frame as the i-th keyframe, and j represents the j-th iteration of the processing of the current keyframe. and These represent the adversarial perturbations of the i-th keyframe in rounds j and (j-1), respectively; ω represents the step size; ADAM(·) indicates that the optimizer used is the Adam optimizer; SSLF(·) represents the structural similarity loss function; f(·) represents the image pre-trained model VGG-16; and map l (·) represents the intermediate feature map of the l-th layer. x represents the version of the keyframe i after the perturbation is added in the (j-1)th iteration. i This represents the i-th keyframe that has not been disturbed.

[0096] In this embodiment of the invention, the perturbation is accumulated into the star-shaped perturbation region of the current keyframe to obtain the latest perturbated keyframe. The formula is as follows:

[0097]

[0098] Where i represents the current processing frame as the i-th keyframe, and j represents the j-th iteration of the processing of the current keyframe. Let i be the i-th keyframe processed in the j-th round, 1∈{1} H×W×C , m represents the star-shaped mask image, x i This represents the i-th unperturbed keyframe, and ⊙ represents pixel multiplication. This represents the perturbation obtained in the h-th round of the i-th frame image.

[0099] The final perturbated keyframe, i.e., the adversarial frame, described in this embodiment of the invention has the following formula:

[0100]

[0101] Where i represents the i-th keyframe being processed. Let i be the adversarial frame, 1 ∈ {1} H×W×C , m represents the star-shaped mask image, x i This represents the i-th keyframe, ⊙ represents pixel multiplication, and I = 50 represents the total number of loop iterations. This represents the perturbation obtained in the h-th round of the i-th frame image.

[0102] The formula for obtaining all perturbated keyframes, i.e., the set of adversarial frames, in this embodiment of the invention is as follows:

[0103]

[0104] in, Represents the set of adversarial frames. This indicates the first frame of the adversarial process, and n is the total number of frames in the video.

[0105] In this embodiment of the invention, the adversarial frame set and sparse frame set are reassembled according to the frame order of the original benign video samples to obtain video adversarial samples with spatial and temporal sparse perturbations. The formula is as follows:

[0106]

[0107] Among them, v adv This represents adversarial examples in videos. This represents the (i-1)th adversarial frame, x i denoted as the i-th sparse frame, and n is the total number of video sample frames.

[0108] The following is in conjunction with Example 2 and Figure 3 The present invention will be further explained below.

[0109] Example 2

[0110] A black-box-based method for generating cross-modal dual-sparse video adversarial examples:

[0111] Step 1: Input the video sample that needs to be processed.

[0112] Step 2: Process the current video sample according to the proposed black-box-based cross-modal dual-sparse video adversarial sample generation method.

[0113] 2.1) Divide the frames of the video samples into a set of keyframes and a set of sparse frames according to a uniform sparsity strategy.

[0114] A detailed description of the uniform sparsity strategy is shown below:

[0115] Assume the total number of video frames is an even number n, and n is evenly divided into c groups, each group containing b video frames, where n = b × c and n, b, and c are all integers. Within each group, there are t keyframes and bt sparse frames in sequence. Once the total number of frames n is determined, c and t can be reasonably set according to the time sparsity requirements and actual conditions. The principle behind this approach is to maximize the even mixing of keyframes and sparse frames to disrupt the inter-frame similarity between adjacent frames, thereby achieving time sparsity perturbation of the video adversarial sample while maintaining its attack performance. For ease of demonstration, we select one case with good results: setting the total number of frames to an even number n, with n / 2 groups, each group containing 2 frames, one keyframe and one sparse frame. The division formula is expressed as follows:

[0116] v = (x1, x2, ..., x i ,...,x n )

[0117] K x =(x1,x3,x5,...,x n-1 )

[0118] S x =(x2,x4,x6,...,x n )

[0119] Where v represents a video sample, x i K represents the i-th video frame. x S represents the set of keyframes. x This represents a set of sparse frames.

[0120] 2.2) Obtain the ImageNet image pre-trained model VGG-16 provided by PyTorch.

[0121] 2.3) Provide a cross-shaped mask image with the same length, width, number of channels, and video frame count as the video frame. The cross-shaped mask image is as follows: Figure 2As shown, the cross-shaped region of the mask image has a value of 1, while other locations have values ​​of 0. The cross-shaped region consists of four line segments intersecting at the midpoint, with adjacent line segments forming an angle of 45 degrees. The four lines are sufficiently thin and long, extending to the edge of the image. This mask image is used to restrict the addition of perturbations to the cross-shaped region of the video frame, thereby achieving spatial sparsity of video adversarial sample perturbations. The mask image and the input image of the VGG-16 model have the same length and width, both being 224. Assuming that the origin (0,0) of the mask image is located at the top left corner of the image, with the positive horizontal axis pointing to the right and the positive vertical axis pointing downwards, the pixel values ​​of all channels with coordinates (i,j) in this mask image are shown below:

[0122]

[0123] Where, m e,k This represents the pixel values ​​of all channels in the mask image at coordinates (e, k), where e is the x-coordinate, k is the y-coordinate, and C represents the number of channels, {1} C This indicates that all channels of the mask image are 1 at a certain coordinate position, {0} C This indicates that all channels of the mask image are 0 at a certain coordinate position.

[0124] 2.4) Initialize the adversarial perturbation, where the initial perturbation outside the star-shaped region is 0, and the adversarial perturbation value within the star-shaped region is 0.01 / 255. This adversarial perturbation is then added to the current keyframe. This process can be represented as follows:

[0125]

[0126] in, Let represent the initial perturbation of the i-th keyframe, m represent the cross-shaped mask image, and ||m||0 represent the 0-norm constraint on m. This represents the i-th keyframe after adding the initial adversarial perturbation to the star-shaped region, where 1 ∈ {1} H×W×C x i ⊙ represents the i-th keyframe, and ⊙ represents pixel multiplication.

[0127] 2.5) Input the current keyframe that is not disturbed into the image pre-training model VGG-16 to obtain its l-th intermediate feature map. Then input the latest disturbed current keyframe into the image pre-training model VGG-16 to obtain its l-th intermediate feature map. l is the 9th ReLU layer of VGG-16, that is, the 20th intermediate feature map of the image input VGG-16.

[0128] 2.6) Using the structural similarity measurement loss function, calculate the similarity loss between the intermediate feature maps before and after the current keyframe is perturbed. Based on the calculated similarity loss, backpropagate to calculate the perturbation of the masked image in the X-shaped region. Add the perturbation to the X-shaped perturbation region of the current keyframe to obtain the current keyframe after the latest perturbation.

[0129] The structural similarity measurement loss function is shown in the following formula:

[0130]

[0131] Where SSLF(·) represents the structural similarity loss function, p and q represent two aligned input images, and μ p and μ q Let p and q represent the average values, respectively. and Let σ represent the variances of p and q, respectively. pq Let C1 represent the covariance of p and q, where C1 = (K1L). 2 C2 = (K2L) 2 L represents the dynamic range of pixel values, K1 = 0.01, K2 = 0.03.

[0132] The perturbation of the masked image confined to the star-shaped region by backpropagation, based on the calculated similarity loss, is shown in the following formula:

[0133]

[0134] Where i represents the current processing frame as the i-th keyframe, and j represents the j-th iteration of the processing of the current keyframe. and These represent the adversarial perturbations of the i-th keyframe in rounds j and (j-1), respectively; ω represents the step size; ADAM(·) indicates that the optimizer used is the Adam optimizer; SSLF(·) represents the structural similarity loss function; f(·) represents the image pre-trained model VGG-16; and map l (·) represents the intermediate feature map of the l-th layer. x represents the version of the keyframe i after the perturbation is added in the (j-1)th iteration. i This indicates the current keyframe that has not been disturbed.

[0135] The perturbation is accumulated into the star-shaped perturbation region of the current keyframe, and the latest perturbated keyframe is obtained as shown in the following formula:

[0136]

[0137] Where i represents the current processing frame as the i-th keyframe, and j represents the j-th iteration of the processing of the current keyframe. Let i be the i-th keyframe processed in the j-th round, 1∈{1} H×W×C , m represents the star-shaped mask image, x i This represents the i-th keyframe, and ⊙ represents pixel multiplication. This represents the perturbation obtained in the h-th round of the i-th frame image.

[0138] 2.7) For the current keyframe being processed, iterate through 2.5) and 2.6) I times, and output the final result of the current keyframe after being perturbed, i.e., the adversarial frame.

[0139] The calculation result of the adversarial frame is shown in the formula below:

[0140]

[0141] Where i represents the i-th keyframe being processed. Let i be the adversarial frame, 1 ∈ {1} H×W×C , m represents the star-shaped mask image, x i This represents the i-th keyframe, ⊙ represents pixel multiplication, and I = 50 represents the total number of loop iterations. This represents the perturbation obtained in the h-th round of the i-th frame image.

[0142] 2.8) Process all keyframes in the keyframe set according to steps 2.4), 2.5), 2.6) and 2.7) until all keyframes are processed and all perturbed keyframes are obtained, i.e., the adversarial frame set.

[0143] The set of adversarial frames is shown in the formula below:

[0144]

[0145] in, Represents the set of adversarial frames. This indicates the first frame of the adversarial process, and n is the total number of frames in the video.

[0146] 2.9) Reassemble all video frames of the adversarial frame set and the sparse frame set according to the frame order of the original video samples to finally obtain video adversarial samples with spatial and temporal sparsity perturbations.

[0147] Video adversarial examples with spatially and temporally sparse perturbations are shown in the following formula:

[0148]

[0149] Among them, v adv This represents adversarial examples in videos. This represents the (i-1)th adversarial frame, x i denoted as the i-th sparse frame, and n is the total number of video sample frames.

[0150] Step 3: Output the processed video adversarial examples.

[0151] Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. Furthermore, those skilled in the art will recognize that, based on the ideas of this invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A black-box-based method for generating cross-modal dual-sparse video adversarial examples, characterized in that... Includes the following steps: Step S1: Provide benign video samples and divide the frames of a single benign video sample into a key frame set and a sparse frame set according to a uniform sparsity strategy. Step S2: Obtain the ImageNet image pre-trained model VGG-16 provided by PyTorch; Step S3: Provide a cross-shaped mask image with the same length, width, number of channels, and video frame count; Step S4: Initialize the adversarial perturbation that is confined to the X-shaped region by the masked image, and add the adversarial perturbation to the current keyframe; Step S5: For the key frame to be processed, input the key frame before it was perturbed and the key frame after the latest perturbed into VGG-16 respectively, and obtain the intermediate feature map of the two for the l-th layer of VGG-16. Step S6: Using the structural similarity measurement loss function, calculate the similarity loss between the intermediate feature maps before and after the current keyframe is perturbed. Based on the calculated similarity loss, backpropagate to calculate the perturbation that is restricted to the X-shaped region by the mask image. Add the perturbation to the X-shaped perturbation region of the current keyframe to obtain the current keyframe after the latest perturbation. Step S7: For the keyframe currently being processed, iterate steps S5 and S6 I times to output the final perturbated keyframe, i.e., the adversarial frame. Step S8: Repeat steps S4, S5, S6 and S7 for all keyframes in the keyframe set until all keyframes are processed and all perturbed keyframes are obtained, i.e., the adversarial frame set. Step S9: Reassemble the adversarial frame set and sparse frame set according to the frame order of the original benign video samples to obtain video adversarial samples with spatial and temporal sparsity. Step S10: Output the processed video adversarial sample.

2. The method for generating cross-modal dual-sparse video adversarial examples based on black-box as described in claim 1, characterized in that: In step S1, the uniform sparsity strategy is a temporal sparsity strategy. The video frames, which have an even number of n, are evenly divided into c groups, with b video frames in each group. n = c × b and n, b, and c are all integers. Within each group, there are t key frames and bt sparse frames in sequence. Once the total number of frames n is determined, c and t can be reasonably set according to sparsity requirements and actual conditions to maximize the uniform mixing of key frames and sparse frames, thereby destroying the inter-frame similarity between adjacent frames and causing the video recognition model to misidentify samples.

3. The method for generating cross-modal dual-sparse video adversarial examples based on black-box as described in claim 2, characterized in that: The uniform sparse partitioning strategy sets the total number of frames to an even number n, dividing them into n / 2 groups, with each group containing 2 frames: one keyframe and one sparse frame. The partitioning formula is expressed as follows: v = (x1, x2,..., x i ,...,x n ) K x =(x1,x3,x5,...,x n-1 ) S x =(x2,x4,x6,...,x n ) Where v represents a video sample, x i K represents the i-th video frame. x S represents the set of keyframes. x This represents a sparse frame set.

4. The method for generating cross-modal dual-sparse video adversarial examples based on black-box as described in claim 1, characterized in that: In step S3, the value of the cross-shaped mask image is 1 for the cross-shaped area and 0 for other positions. The cross-shaped area is composed of four line segments that intersect at the midpoint. The angle between adjacent line segments is 45 degrees. The four lines are thin and long enough to extend as far as possible to the edge of the image.

5. The method for generating cross-modal dual-sparse video adversarial examples based on black-box as described in claim 1, characterized in that: This mask image is used to restrict the perturbation to a star-shaped region within the video frame, achieving spatial sparsity of the video adversarial example. The mask image has a length and width of 224. Assuming the origin (0,0) of the mask image is located at the top left corner of the image, with the positive horizontal axis pointing to the right and the positive vertical axis pointing downwards, the formula for this mask image is expressed as follows: Where, m e,k This represents the pixel values ​​of all channels in the mask image at coordinates (e, k), where e is the x-coordinate, k is the y-coordinate, and C represents the number of channels, {1} C This indicates that all channels of the mask image are 1 at a certain coordinate position, {0} C This indicates that all channels of the mask image are 0 at a certain coordinate position.

6. The method for generating cross-modal dual-sparse video adversarial examples based on black-box as described in claim 1, characterized in that: Step S4 adds the adversarial perturbation to the current keyframe, using the following formula: in, This represents the i-th keyframe after adding the initial adversarial perturbation to the star-shaped region, where 1 ∈ {1} H×W×C , m represents the star-shaped mask image, x i This represents the i-th keyframe, and ⊙ represents pixel multiplication. This represents the initial perturbation of the i-th keyframe.

7. The method for generating cross-modal dual-sparse video adversarial examples based on black-box as described in claim 1, characterized in that: Step S6 adds the perturbation to the cross-shaped perturbation region of the current keyframe to obtain the latest perturbated current keyframe, using the following formula: Where i represents the current processing frame as the i-th keyframe, and j represents the j-th iteration of the processing of the current keyframe. Let i be the i-th keyframe processed in the j-th round, 1∈{1} H×W×C , m represents the star-shaped mask image, x i This represents the i-th unperturbed keyframe, and ⊙ represents pixel multiplication. This represents the perturbation obtained in the h-th round of the i-th frame image.

8. The method for generating cross-modal dual-sparse video adversarial examples based on black-box as described in claim 1, characterized in that: The final perturbated keyframe after step S7, i.e., the adversarial frame, is defined by the following formula: Where i represents the i-th keyframe being processed. Let i be the adversarial frame, 1 ∈ {1} H×W×C , m represents the star-shaped mask image, x i This represents the i-th keyframe, ⊙ represents pixel multiplication, and I = 50 represents the total number of loop iterations. This represents the perturbation obtained in the h-th round of the i-th frame image.

9. A method for generating cross-modal dual-sparse video adversarial examples based on a black box as described in claim 1, characterized in that: Step S8 yields all perturbated keyframes, i.e., the set of adversarial frames, as shown in the following formula: in, Represents the set of adversarial frames. This indicates the first frame of the adversarial process, and n is the total number of frames in the video.

10. A method for generating cross-modal dual-sparse video adversarial examples based on a black box, as described in claim 1, characterized in that: Step S9 reassembles the adversarial frame set and the sparse frame set according to the frame order of the original benign video samples, resulting in video adversarial samples with spatial and temporal sparsity perturbations, as shown in the following formula: Among them, v adv This represents adversarial examples in videos. This represents the (i-1)th adversarial frame, x i denoted as the i-th sparse frame, and n is the total number of video sample frames.

Images