Road Physical Domain Adversarial Patch Generation Method for Monocular Depth Estimation in Autonomous Driving

Abstract

The present invention provides a method for generating a road physical domain adversarial patch for monocular depth estimation of autonomous driving, forming a scene image data set; generating a mask image of a target vehicle, converting the target vehicle into pixel coordinates in a pixel coordinate system, embedding the target vehicle into a scene image to obtain a target object scene graph; converting a road patch into pixel coordinates in a pixel coordinate system; obtaining multiple scene images through a scene construction module to obtain a multi-party road patch view set; calculating depth loss and feature loss, constructing a target loss function; calculating the average gradient weighted by the size of the corresponding patch area input by the model through the target function, using the average gradient as the gradient of the road patch image, using the MI-FGSM method to update the current patch, and generating a final road adversarial patch when the maximum number of iterations is reached. The method of the present invention makes the monocular depth estimation technology more accurate, reliable, and more robust.

Description

Technical Field

[0001] The present invention belongs to the field of autonomous driving, and in particular relates to a method for generating road physical domain adversarial patches for autonomous driving monocular depth estimation. Background Art

[0002] Monocular depth estimation technology is an important computer vision technology used to infer the three-dimensional structure of a scene from an image captured by a single camera. Compared with stereo vision (using two or more cameras) and laser-based depth perception technology, monocular depth estimation relies on only one camera, so it is cheaper and simpler to install. It is widely used in fields such as three-dimensional reconstruction and autonomous driving. In the field of autonomous driving, monocular depth estimation technology can be used to detect and avoid obstacles, lane keeping, and vehicle behavior prediction. However, deep learning-based monocular depth estimation technology is vulnerable to adversarial perturbation attacks. Current adversarial attacks on monocular depth estimation models can be divided into digital domain attacks and physical domain attacks. In the digital domain, some use deep feature elimination loss to generate perturbations and launch patch attacks; some generate targeted adversarial perturbations on images, and scale the estimated depth and depth flip by globally perturbing the captured images. In physical domain attacks, adversarial patches are attached to the rear of the car, and the perturbations are made more concealed by optimizing the patch area and perturbation size. Some people have proposed 3D adversarial textures that are independent of the target type and improve the robustness under adverse weather conditions, such as rain and fog. However, the above technologies all consider how to perturb the target, but do not perturb the surrounding environment. Summary of the invention

[0003] The purpose of the present invention is to provide a method for generating road physical domain adversarial patches for monocular depth estimation of autonomous driving, aiming to solve the following problems:

[0004] The impact of the vehicle's external environment on depth estimation is not considered. Existing research mainly considers how to add perturbations to the target object. For each target object, the corresponding perturbation needs to be regenerated. It does not consider how to achieve adversarial attacks on the depth distance of different target objects through the perturbations of the surrounding scene.

[0005] The adversarial patches obtained by a single optimization objective are prone to failure in dynamic scenarios. When considering adversarial attacks on road scenarios, the imaging of the road patches is different when the vehicle is moving forward, which will result in the adversarial patches generated by a single optimization objective not being able to interfere with the monocular depth estimation model during the entire driving process.

[0006] The present invention is implemented as follows: a method for generating a road physical domain adversarial patch for monocular depth estimation of autonomous driving, the method comprising the following steps:

[0007] Step S1: merge the open source dataset and the actual scene dataset to form a scene image dataset;

[0008] Step S2: Generate a mask image of the target vehicle, map the target vehicle to the scene image to obtain world coordinates in the world coordinate system, then convert them into pixel coordinates in the pixel coordinate system, and embed the target vehicle into the scene image to obtain a target object scene graph;

[0009] Step S3: Map the road patch on the scene image to obtain world coordinates in the world coordinate system, and then convert them into pixel coordinates in the pixel coordinate system;

[0010] Step S4: Setting a scene construction module to construct road patches at different positions, using the pixel coordinates of the road patches and their masks obtained in step S3, and embedding them into the target object scene graph obtained in step S2, obtaining multiple scene images through the scene construction module, and obtaining a multi-party road patch view set;

[0011] Step S5: Calculate the depth loss and feature loss, and construct the target loss function;

[0012] Step S6: Randomly sample several scene view images from the multi-party road patch view set obtained in step S4 and apply the corresponding weight coefficients for gradient calculation. The average gradient weighted by the size of the corresponding patch area input by the model is calculated through the objective function. The average gradient is used as the gradient of the road patch image. The current patch is updated using the MI-FGSM method. When the maximum number of iterations is reached, the final road adversarial patch is generated.

[0013] A further technical solution of the present invention is: the step S1 comprises the following steps:

[0014] Step S11: The open source dataset is obtained by using a known and publicly available computer vision algorithm evaluation dataset in an autonomous driving scenario, and extracting road image data and corresponding camera parameters therein;

[0015] Step S12: The actual scene data set collects driving data of autonomous vehicles on urban roads and highways, including depth distance information and the camera internal parameters used. The data collection needs to cover all time periods throughout the day.

[0016] Step S13: Merge the data obtained in step S11 and step S12 to obtain the entire scene image data set S.

[0017] A further technical solution of the present invention is: the computer vision algorithm evaluation data set used in step S11 adopts KITTI or NuScene.

[0018] A further technical solution of the present invention is: the step S2 comprises the following steps:

[0019] Step S21: Obtain a certain type of target car rear image , the mask of the vehicle body is obtained through the image semantic segmentation model , The pixel value of the middle car body is 1, and the value of the rest is 0;

[0020] Step S22: Using the public world coordinate system and camera internal parameters, the scene image mapping relationship of the target vehicle is as follows:

[0021] ,

[0022] in and is the pixel coordinate of the target vehicle image, w and h are the length and width of the target vehicle image, W and H are the length and width of the actual target in the real scene, is the offset angle of the target vehicle image, p is the lateral offset of the target vehicle image relative to the optical center of the acquired image, d is the actual distance of the target vehicle from the acquisition vehicle in the real scene, and h is the height of the acquisition vehicle camera module;

[0023] Step S23: After obtaining the world coordinates of the vehicle image, the vehicle image is mapped to the pixel coordinate system, and the mapping matrix is ​​as follows:

[0024] ,

[0025] Where K is the internal and external parameters of the camera, and 1 / z is the pixel coordinate obtained by normalization;

[0026] Step S24: embedding the target car into the scene image Get the target object scene graph , the embedding formula is as follows:

[0027] .

[0028] A further technical solution of the present invention is: the step S3 comprises the following steps:

[0029] Step S31: assuming that the road patch is an M*N image and is initialized with random noise;

[0030] Step S32: Use the public world coordinate system and camera intrinsic parameters. The specific mapping relationship is as follows:

[0031] ,

[0032] in and is the pixel coordinate of the road adversarial patch, w and h are the length and width of the adversarial patch, W and H are the length and width of the adversarial patch in the real scene, is the offset angle of the adversarial patch, k is the lateral offset of the adversarial patch relative to the optical center of the acquired image, d is the actual distance of the adversarial patch from the acquisition vehicle in the real scene, and h is the height of the camera module of the acquisition vehicle;

[0033] Step S33: After obtaining the world coordinates of the road patch, the image is mapped to the pixel coordinate system. The mapping matrix is ​​as follows:

[0034] ,

[0035] Where K is the internal and external parameters of the camera, and 1 / z is normalized to obtain the pixel coordinates.

[0036] A further technical solution of the present invention is that the intrinsic and extrinsic parameters K of the camera are calculated by the following formula:

[0037]

[0038] ,

[0039] in and is the pixel focal length, in pixels, that is, the number of pixels per unit length, and is the offset from the optical center to the CMOS zero point, that is, the coordinate of the camera optical center in the pixel coordinate system, It is The offset distance from the camera to the 0th camera, R is a built-in 3×3 matrix, which is the correction matrix of the camera. It is the camera external parameter matrix with a dimension of 3×4, which is used to transform the point coordinates in the world coordinate system into the pixel coordinate system.

[0040] A further technical solution of the present invention is: the step S4 comprises the following steps:

[0041] Step S41: Since there is color distortion in the actual physical adversarial patch production process, the EoT algorithm is used to optimize and enhance the adversarial patch during the generation process;

[0042] Step S42: Setting a scene construction module to construct road patches at different locations. The scene construction module randomly generates different depth distances dx, lateral offsets dy, and perspective offset angles φ of the road patches. The pixel coordinates of the road patches and their masks obtained in step S33 are then embedded into the scene image. :

[0043] ,

[0044] refers to the road patch image, It refers to the mask map of the road patch image;

[0045] Step S43: Given an initial patch image , multiple scene images are obtained through the scene construction module , get the multi-party road patch view set X;

[0046] Step S44: In actual scenes, different weather conditions may affect the attack effect of the road patch and the scene image. Physical enhancement is performed to obtain an enhanced multi-party road patch view set X.

[0047] A further technical solution of the present invention is: step S5 comprises the following steps:

[0048] Step S51: Depth loss, using the MSE loss of the target area to estimate the depth, as follows:

[0049] ;

[0050] Step S52: Feature loss. The depth estimation network includes an encoding network E and a decoding network D. The encoding network extracts the depth features of the original image to obtain five depth features of different dimensions. The four dimensional information of each feature is respectively represented by: batch size, number of channels, length and width. After obtaining the depth features of the original image and the adversarial image, a negative logarithmic loss is taken, as follows:

[0051] ,

[0052] It refers to the deep features of the original image obtained through the encoding network. It refers to the deep features obtained by the adversarial image through the encoding network;

[0053] Step S53: The target loss function calculation formula is:

[0054] ,

[0055] in is the depth loss, is the feature loss, is the smoothing loss, μ, γ, β are the weights of different losses.

[0056] A further technical solution of the present invention is: step S6 comprises the following steps:

[0057] Step S61: Randomly sample M scene view images from the multi-view set obtained in step S42, apply corresponding weight coefficients to the gradient calculation of the road adversarial patches in the M scene view images, that is, normalize the patch area, and calculate the average gradient weighted by the size of the corresponding patch area input by the model through the objective function:

[0058] ,

[0059] in is the weight coefficient corresponding to the patch area in the i-th scene view, is the i-th scene view picture;

[0060] Step S62: Use the average gradient as the gradient of the road patch image and use the MI-FGSM method to update the current patch. The MI-FGSM update method is as follows:

[0061] ,

[0062] ,

[0063] Among them, ρ is the momentum factor, g is the average gradient, is the cutoff function, ε is the disturbance threshold, σ is the iteration step size, is a sign function that generates the final road adversarial patch when the maximum number of iterations is reached.

[0064] The beneficial effects of the present invention are as follows: the method of the present invention takes into account the impact of the vehicle's external environment on depth estimation, and uses multi-scenario iterative optimization to update and optimize the physical domain road adversarial patches of the monocular depth estimation module in the autonomous driving scenario, making the monocular depth estimation technology more accurate, reliable and more robust. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is the main flow chart of the method of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0067] The present invention provides a method for generating a road physical domain adversarial patch for autonomous driving monocular depth estimation, the method comprising the following steps:

[0068] Step S1: merge the open source dataset and the actual scene dataset to form a scene image dataset;

[0069] Open source datasets. Use publicly known computer vision algorithm evaluation datasets in autonomous driving scenarios, such as KITTI and NuScene, and extract road image data and corresponding camera parameters.

[0070] Actual scene data set. Collect driving data of autonomous vehicles on urban roads and highways, mainly including depth distance information and the camera internal parameters used. Data collection needs to cover all time periods throughout the day to ensure data diversity and comprehensiveness.

[0071] The open source dataset is merged with the actual scene dataset to obtain the entire scene image dataset S.

[0072] Step S2: Generate a mask image of the target vehicle. Map the target vehicle to the scene image to obtain world coordinates in the world coordinate system, then convert them into pixel coordinates in the pixel coordinate system. Embed the target vehicle in the scene image to obtain a target object scene graph.

[0073] Generate a mask image of the target vehicle. Get a certain type of target car rear image , the mask of the vehicle body is obtained through the image semantic segmentation model , The pixel value of the vehicle body is 1, and the value of the rest is 0.

[0074] Scene image mapping of the target vehicle. In order to simulate the distance between the target vehicle and the attacking vehicle in a real scene, it is necessary to construct the position of the vehicle image in the scene image based on the camera intrinsic parameters that capture the real-time scene image. This case takes the KITTI dataset as an example, using its public world coordinate system and camera intrinsic parameters, the scene image mapping relationship of the target vehicle is as follows:

[0075] ,

[0076] in and is the pixel coordinate of the target vehicle image, w and h are the length and width of the target vehicle image, and W and H are the length and width of the actual target in the real scene. is the offset angle of the target vehicle image, p is the lateral offset of the target vehicle image relative to the optical center of the acquired image, d is the actual distance of the target vehicle from the acquisition vehicle in the real scene, and h is the height of the acquisition vehicle camera module.

[0077] Mapping from world coordinates to image coordinates. After obtaining the world coordinates of the vehicle image, the vehicle image needs to be mapped to the pixel coordinate system to facilitate input into the neural network for subsequent road patch optimization. The mapping matrix is ​​as follows:

[0078] ,

[0079] Where K is the internal and external parameters of the camera, 1 / z is the pixel coordinate obtained by normalization.

[0080] ,

[0081] ,

[0082] in and is the pixel focal length, in pixels, that is, the number of pixels per unit length. and It is the offset from the optical center to the CMOS zero point, that is, the coordinate of the camera optical center in the pixel coordinate system. It is The offset distance from the first camera to the 0th camera, R is a built-in (3×3) matrix, which is the correction matrix of the camera. is the camera extrinsic matrix with a dimension of (3×4), which is used to transform the point coordinates in the world coordinate system into the pixel coordinate system.

[0083] Embedding the target car into the scene image Get the target object scene graph , the embedding formula is as follows:

[0084] .

[0085] Step S3: Map the road patch on the scene image to obtain world coordinates in the world coordinate system, and then convert them into pixel coordinates in the pixel coordinate system.

[0086] Let the patch be an M*N image, initialized with random noise;

[0087] Road patch mapping. In order to generate road adversarial patches, it is necessary to first calculate the coordinates of the road adversarial patches in the world coordinate system. Since the mapping relationship involves the definition of the camera intrinsic parameters and the world coordinate system used for data collection, the mapping relationship of different coordinate systems is slightly different. This case takes the KITTI dataset as an example, using its public world coordinate system and camera intrinsic parameters. The specific mapping relationship is as follows:

[0088] ,

[0089] in and are the pixel coordinates of the road adversarial patch, w and h are the length and width of the adversarial patch, and W and H are the length and width of the adversarial patch in the real scene. is the offset angle of the adversarial patch, k is the lateral offset of the adversarial patch relative to the optical center of the acquired image, d is the actual distance of the adversarial patch from the acquisition vehicle in the real scene, and h is the height of the camera module of the acquisition vehicle.

[0090] Mapping from world coordinates to image coordinates. After obtaining the camera coordinates of the road patch, the image needs to be mapped to the pixel coordinate system to facilitate input into the neural network for patch optimization. The mapping matrix is ​​as follows:

[0091] ,

[0092] Wherein K is the intrinsic and extrinsic parameters of the camera, which is consistent with the calculation process of the intrinsic and extrinsic parameters of the camera in step S2.

[0093] Step S4: Set a scene construction module to construct road patches at different locations. Use the pixel coordinates of the road patches and their masks obtained in step S3 and embed them into the target object scene graph obtained in step S2. Obtain multiple scene images through the scene construction module to obtain a multi-party road patch view set.

[0094] Set up a scene construction module. Since there is color distortion in the actual physical adversarial patch production process (such as printing), it is necessary to use the EoT algorithm to optimize and enhance the adversarial patch during the generation process (such as: color conversion of the adversarial patch, including changing brightness, contrast, saturation, etc.). Since the change of the position of the patch in the world coordinate system will cause the pixels of the imaged image to change, a road patch at a single position will fail at different perspectives. Therefore, it is necessary to construct road patches at different positions so that the optimized road patches can successfully destroy the monocular depth estimation model at different perspectives. This module randomly generates different depth distances dx, lateral offsets dy, and perspective offset angles φ of the road patch, and embeds them into the scene image through the pixel coordinates of the road patch and its mask obtained in step S33. :

[0095] ,

[0096] refers to the road patch image, It refers to the mask map of the road patch image;

[0097] Given an initial patch image , multiple scene images are obtained through the scene construction module . Get the multi-party road patch view set X.

[0098] In actual scenarios, different weather conditions can affect the attack effect of road patches. Therefore, we Physical enhancement is performed (eg, adding different weather images such as cloud, fog, snow, rain, etc. to the image) to obtain an enhanced multi-party road patch view set X.

[0099] Step S5: Calculate the depth loss and feature loss, and construct the target loss function.

[0100] Depth loss. The MSE loss of the target area is used to estimate the depth, as follows:

[0101] .

[0102] Feature loss. The depth estimation network includes an encoding network E and a decoding network D. The encoding network extracts the depth features of the original image and obtains five depth features of different dimensions. Taking the monodepth2 model as an example, its depth features are [1, 64, 160, 512], [1, 64, 80, 256], [1, 128, 40, 128], [1, 256, 20, 64], [1,512, 10, 32]. The four dimensions of each feature are represented by: batch size, number of channels, length, and width. After obtaining the depth features of the original image and the adversarial image, the negative logarithmic loss is taken, as follows:

[0103] ,

[0104] It refers to the deep features of the original image obtained through the encoding network. It refers to the deep features obtained by the adversarial image through the encoding network; the target loss function is:

[0105] ,

[0106] in is the depth loss, is the feature loss, is a smoothing loss used to soften the contrast between pixels. μ, γ, β are the weights of different losses, the purpose is to balance the size of different losses.

[0107] Step S6: Randomly sample several scene view images from the multi-party road patch view set obtained in step S4 and apply the corresponding weight coefficients for gradient calculation. The average gradient weighted by the size of the corresponding patch area input by the model is calculated through the objective function. The average gradient is used as the gradient of the road patch image. The current patch is updated using the MI-FGSM method. When the maximum number of iterations is reached, the final road adversarial patch is generated.

[0108] M scene view images are randomly sampled from the multi-view set obtained in step S43. Since the size of the road patch blocks in each image is different, in order to prevent the larger road patches from having a greater impact on the average gradient of the entire m images, this case applies a corresponding weight coefficient to the gradient calculation of the road adversarial patches in the M scene view images, that is, the patch area is normalized. The average gradient weighted by the size of the corresponding patch area input by the model is calculated through the objective function.

[0109] ,

[0110] in is the weight coefficient corresponding to the patch area in the i-th scene view, is the i-th scene view picture.

[0111] Use the average gradient as the gradient of the road patch image and use the MI-FGSM method to update the current patch. The MI-FGSM update method is as follows:

[0112] ,

[0113] ,

[0114] Among them, ρ is the momentum factor, g is the average gradient, is the cutoff function, ε is the disturbance threshold, σ is the iteration step size, is a sign function that generates the final road adversarial patch when the maximum number of iterations is reached.

[0115] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for generating road physical domain adversarial patches for monocular depth estimation in autonomous driving, characterized in that: The method comprises the following steps: Step S1: merge the open source dataset and the actual scene dataset to form a scene image dataset; Step S2: Generate a mask image of the target vehicle, map the target vehicle to the scene image to obtain world coordinates in the world coordinate system, then convert them into pixel coordinates in the pixel coordinate system, and embed the target vehicle into the scene image to obtain a target object scene graph; Step S3: Map the road patch on the scene image to obtain world coordinates in the world coordinate system, and then convert them into pixel coordinates in the pixel coordinate system; Step S4: Setting a scene construction module to construct road patches at different positions, using the pixel coordinates of the road patches and their masks obtained in step S3, and embedding them into the target object scene graph obtained in step S2, obtaining multiple scene images through the scene construction module, and obtaining a multi-party road patch view set; Step S5: Calculate the depth loss and feature loss, and construct the target loss function; Step S6: Randomly sample several scene view images from the multi-party road patch view set obtained in step S4 and apply the corresponding weight coefficients for gradient calculation. The average gradient weighted by the size of the corresponding patch area input by the model is calculated through the objective function. The average gradient is used as the gradient of the road patch image. The current patch is updated using the MI-FGSM method. When the maximum number of iterations is reached, the final road adversarial patch is generated.

2. The method for generating road physical domain adversarial patches for monocular depth estimation of autonomous driving according to claim 1, characterized in that: The step S1 comprises the following steps: Step S11: The open source dataset is obtained by using a known and publicly available computer vision algorithm evaluation dataset in an autonomous driving scenario, and extracting road image data and corresponding camera parameters therein; Step S12: The actual scene data set collects driving data of autonomous vehicles on urban roads and highways, including depth distance information and the camera internal parameters used. The data collection needs to cover all time periods throughout the day. Step S13: Merge the data obtained in step S11 and step S12 to obtain the entire scene image data set S.

3. The method for generating road physical domain adversarial patches for autonomous driving monocular depth estimation according to claim 2, characterized in that: The computer vision algorithm evaluation dataset used in step S11 adopts KITTI or NuScene.

4. The method for generating road physical domain adversarial patches for autonomous driving monocular depth estimation according to claim 1, characterized in that: The step S2 comprises the following steps: Step S21: Obtain a certain type of target car rear image , the mask of the vehicle body is obtained through the image semantic segmentation model , The pixel value of the middle car body is 1, and the value of the rest is 0; Step S22: Using the public world coordinate system and camera internal parameters, the scene image mapping relationship of the target vehicle is as follows: ， in and is the pixel coordinate of the target vehicle image, w and h are the length and width of the target vehicle image, W and H are the length and width of the actual target in the real scene, is the offset angle of the target vehicle image, p is the lateral offset of the target vehicle image relative to the optical center of the acquired image, d is the actual distance of the target vehicle from the acquisition vehicle in the real scene, and h is the height of the acquisition vehicle camera module; Step S23: After obtaining the world coordinates of the vehicle image, the vehicle image is mapped to the pixel coordinate system, and the mapping matrix is ​​as follows: ， Where K is the internal and external parameters of the camera, and 1 / z is the pixel coordinate obtained by normalization; Step S24: embedding the target car into the scene image Get the target object scene graph , the embedding formula is as follows: 。 5. The method for generating road physical domain adversarial patches for autonomous driving monocular depth estimation according to claim 1, characterized in that: The step S3 comprises the following steps: Step S31: assuming that the road patch is an M*N image and is initialized with random noise; Step S32: Use the public world coordinate system and camera intrinsic parameters. The specific mapping relationship is as follows: ， in and is the pixel coordinate of the road adversarial patch, w and h are the length and width of the adversarial patch, W and H are the length and width of the adversarial patch in the real scene, is the offset angle of the adversarial patch, k is the lateral offset of the adversarial patch relative to the optical center of the acquired image, d is the actual distance of the adversarial patch from the acquisition vehicle in the real scene, and h is the height of the camera module of the acquisition vehicle; Step S33: After obtaining the world coordinates of the road patch, the image is mapped to the pixel coordinate system. The mapping matrix is ​​as follows: ， Where K is the internal and external parameters of the camera, and 1 / z is normalized to obtain the pixel coordinates.

6. The method for generating road physical domain adversarial patches for autonomous driving monocular depth estimation according to claim 4 or 5, characterized in that: The intrinsic and extrinsic parameters K of the camera are calculated by the following formula: ， in and is the pixel focal length, in pixels, that is, the number of pixels per unit length, and is the offset from the optical center to the CMOS zero point, that is, the coordinate of the camera optical center in the pixel coordinate system, It is The offset distance from the camera to the 0th camera, R is a built-in 3×3 matrix, which is the correction matrix of the camera. It is the camera external parameter matrix with a dimension of 3×4, which is used to transform the point coordinates in the world coordinate system into the pixel coordinate system.

7. The method for generating road physical domain adversarial patches for monocular depth estimation of autonomous driving according to claim 1, characterized in that: The step S4 comprises the following steps: Step S41: Since there is color distortion in the actual physical adversarial patch production process, the EoT algorithm is used to optimize and enhance the adversarial patch during the generation process; Step S42: Setting a scene construction module to construct road patches at different locations. The scene construction module randomly generates different depth distances dx, lateral offsets dy, and perspective offset angles φ of the road patches. The pixel coordinates of the road patches and their masks obtained in step S33 are embedded into the scene image. : ， refers to the road patch image, It refers to the mask map of the road patch image; Step S43: Given an initial patch image , multiple scene images are obtained through the scene construction module , get the multi-party road patch view set X; Step S44: In actual scenes, different weather conditions may affect the attack effect of the road patch and the scene image. Physical enhancement is performed to obtain an enhanced multi-party road patch view set X.

8. The method for generating road physical domain adversarial patches for autonomous driving monocular depth estimation according to claim 7, characterized in that: Step S6 includes the following steps: Step S61: Randomly sample M scene view images from the multi-view set obtained in step S42, apply corresponding weight coefficients to the gradient calculation of the road adversarial patches in the M scene view images, that is, normalize the patch area, and calculate the average gradient weighted by the size of the corresponding patch area input by the model through the objective function: ， in is the weight coefficient corresponding to the patch area in the i-th scene view, is the i-th scene view picture, is the target loss function; Step S62: Use the average gradient as the gradient of the road patch image and use the MI-FGSM method to update the current patch. The MI-FGSM update method is as follows: ， ， Where ρ is the momentum factor, g i is the average gradient, is the cutoff function, ε is the disturbance threshold, σ is the iteration step size, is a sign function that generates the final road adversarial patch when the maximum number of iterations is reached.

Images