A method for generating infrared small target migration disturbance based on multi-dimensional feature distortion

Abstract

The present invention belongs to the field of artificial intelligence security technology, and relates to a method for generating infrared small target migration disturbance based on multi-dimensional feature distortion. Firstly, with the goal of maximizing the degree of feature distortion, the difference between adversarial samples and real samples is offset on source networks of multiple different dimensions; then, according to the visual difference and attack efficiency of samples in different dimensions, an updated loss function is designed; finally, according to the characteristic that the pixel proportion of infrared small targets is small, the feature proximity of local areas is introduced on the deep features, the target area features are simulated, and high-quality adversarial samples are generated; the present invention can provide more accurate security assessment and interference strategies for the field of infrared small target recognition.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security technology, and in particular to a method for generating infrared small target migration disturbance based on multi-dimensional feature distortion. Background Art

[0002] In recent years, significant progress in hardware technology has greatly promoted the development of computer science and injected new vitality into the widespread application of deep learning and image recognition technology. These advanced technologies have not only significantly improved efficiency and convenience in many fields, but also aroused widespread concern about security issues. Against this background, adversarial attack technology has emerged. It can effectively affect the function and performance of image recognition systems by interfering with input data, injecting noise, implementing deception and destruction. Especially in the application of infrared small target detection, due to the widespread use of deep learning technology, the vulnerability of such recognition systems is particularly sensitive to adversarial sample attacks. Adversarial attack technology can not only be used to detect security vulnerabilities in the system and evaluate its protection capabilities, but also reveal and repair potential security vulnerabilities, prompting researchers to improve algorithms and enhance the robustness and reliability of the system.

[0003] Although there are many methods for generating adversarial samples, research specifically targeting infrared small targets is still limited. Existing attack strategies often focus on specific attack algorithms and lack sufficient transferability. In addition, due to the significant differences in feature processing requirements of different networks, traditional adversarial attack methods often use a relatively crude method to indiscriminately distort the features of the source model to generate adversarial samples. This method can easily fall into the local optimal solution of a specific model, thereby weakening the transferability of the attack samples.

[0004] To solve this problem, we propose a new countermeasure, a method for generating infrared small target migration perturbations based on multi-dimensional feature distortion. This method not only significantly enhances the migration of adversarial samples by simulating feature distortions of different depths on the source network, but also improves the flexibility and effectiveness of adversarial attacks. By fine-tuning and simulating feature distortions at various levels in the source network, this strategy can generate adversarial samples that are more migration-oriented and difficult to detect, thereby providing more accurate and efficient security assessment and attack strategies in the field of infrared small target recognition. Summary of the invention

[0005] The purpose of the present invention is to overcome the deficiencies in the prior art and provide a method for generating infrared small target migration disturbance based on multi-dimensional feature distortion.

[0006] In order to achieve the purpose of the present invention, the present invention will be implemented by adopting the technical solution described below.

[0007] A method for generating infrared small target migration disturbance based on multi-dimensional feature distortion comprises the following steps:

[0008] S1. Input the clean sample and the initial adversarial sample into the source network ResNet18 respectively to start perturbation iteration, wherein the initial adversarial sample is obtained by applying random perturbations to the clean sample;

[0009] S2. Each perturbation iteration is completed in sequence through the first stage, the second stage, the third stage and the fourth stage, where:

[0010] When the perturbation iteration enters the first stage, the clean sample and the adversarial sample pass the perceptual_criteria(n) function, n=1, and the MSE values ​​of the two are obtained. , which is the degree of feature distortion corresponding to the first stage, multiplied by the corresponding weight α and added to the loss function. At this time, the loss is ;

[0011] When the perturbation iteration enters the second stage, the clean sample and the adversarial sample pass the perceptual_criteria(n) function, n=2, and the MSE values ​​of the two are obtained. , which is the degree of feature distortion corresponding to the second stage, multiplied by the corresponding weight β and added to the loss function, the loss is ;

[0012] When the perturbation iteration enters the third stage, the clean sample and the adversarial sample are passed through the perceptual_criteria(n) function, n=3 to obtain the MSE values ​​of the two. , which is the degree of feature distortion corresponding to the third stage, multiplied by the corresponding weight α and added to the loss function. At this time, the loss is ;

[0013] When the perturbation iteration enters the fourth stage, the clean sample and the adversarial sample are passed through the perceptual_criteria(n) function, n=4, to obtain the feature maps of the two, and the extract_region function is used to select the area where the features need to be close. Finally, the MSE value is calculated to obtain the feature closeness value of the two. , which is the degree of feature proximity corresponding to the fourth stage, multiplied by the corresponding weight γ and added to the loss function, which is the final loss ;

[0014] S3, continuously updating its pixel value according to the gradient information of the loss function, and framing it in the pixel value range of the clean sample plus the perturbation budget until the preset number of iterations is reached to generate an adversarial sample image;

[0015] in:

[0016] The source network ResNet18 parses command line parameters through the argparse library to set the image dataset path, target model, batch size, perturbation budget, step size, and number of iterations;

[0017] The source network ResNet18 uses a custom data loader MFDP_Load to set the input image size, specify the image format, and load the infrared image dataset;

[0018] The formula for the perceptual_criteria(n) function is

[0019] ;

[0020] Among them, Feature_Model represents the ResNet18 feature model intercepted at each stage, X adv represents adversarial samples, X real represents a clean sample, m represents the number of pixels in the image, and n represents the nth stage;

[0021] The Extract_region function is used to identify and extract the key areas above the threshold in the feature map. Specifically, the clean sample feature map and the adversarial sample feature map are input into the Extract_region function respectively, and the key areas in the clean sample are extracted by calculating the contrast information of the clean sample feature map. The remaining areas are replaced by the corresponding areas of the adversarial sample to form a new feature map;

[0022] The weights α, β and γ are all obtained by taking part of the training set of the infrared small target data set and performing adversarial sample generation training on ResNet18.

[0023] As a preferred solution of the present invention, the source network ResNet18 includes an initial convolutional layer and a residual component, wherein:

[0024] The initial convolution layer is an input layer for receiving an image, and is composed of a convolution layer and a maximum pooling layer following the convolution layer, wherein the convolution kernel size of the convolution layer is 7x7, the step size is 2, and the output dimension is 64; the convolution kernel size of the maximum pooling layer is 3x3, the step size is 2, and is used to reduce the spatial size of the feature map;

[0025] The residual component is composed of the first stage, the second stage, the third stage and the fourth stage which are set in succession. Each stage contains 2 residual blocks. Each residual block is composed of 2 convolutional layers with 3x3 convolution kernels. Each convolutional layer is followed by batch normalization and activation function. The connection of the residual blocks is realized by adding the input directly to the output by skipping the intermediate convolution operation.

[0026] As a preferred solution of the present invention, the number of output channels of the two residual blocks in the first stage is 64;

[0027] The number of output channels of the two residual blocks in the second stage is 128, and the first residual block uses a convolution with a stride of 2;

[0028] The number of output channels of the two residual blocks in the third stage is 256, and the first residual block uses a convolution with a step size of 2;

[0029] The number of output channels of the two residual blocks in the fourth stage is 512, and the first residual block uses a convolution with a step size of 2.

[0030] As a preferred solution of the present invention, the process of the Extract_region function identifying and extracting the key area above the threshold in the feature map is as follows:

[0031] S41. Define a sliding window of size 6×6, divide it into 9 regions, each of which is 2×2 in size, C represents the central region, B represents the i (i = 1, 2, 3…, 8) is the background area; the sliding window traverses the clean sample feature map from left to right and from top to bottom;

[0032] S42. When the sliding window stays at a certain position, the difference between the central area of ​​the position and the background area can be defined as:

[0033] ;

[0034] In the formula represents the mean value of pixels in the central area, and Represents the pixel mean of the background area; these eight values ​​describe the difference between the center area of ​​the current position and the background area; in the feature map, the intensity of the extracted target feature is different from that of the background feature, and the following formula is used to describe this property, namely similarity:

[0035] ;

[0036] S43, in order to extract the contrast information to the greatest extent, the minimum similarity value is taken to replace the pixel value of the central area C, and finally a contrast information map is obtained, namely:

[0037] ;

[0038] Among them, a and b are the length and width of the feature map respectively, and N is the area divided by the sliding window.

[0039] S44, judging whether the corresponding area is to be retained according to the contrast information:

[0040] ;

[0041] Among them, k is the contrast threshold, Input1 is the clean sample feature map, and Input2 is the adversarial sample feature map.

[0042] As a preferred solution of the present invention, the update formula of the adversarial sample is:

[0043] ;

[0044] In the formula, t represents the round of each update, w i is the weight of each layer’s gradient information, Indicates that each time the adversarial sample of the previous round is updated, It indicates that the adversarial samples of the current round are updated each time, lr indicates the update step size, sign indicates the sign function, n indicates that there are n stages in total, and grid indicates the gradient.

[0045] As a preferred solution of the present invention, the ResNet18 feature model is intercepted using nn.Sequential.

[0046] As a preferred solution of the present invention, the adversarial sample image is normalized by a normalize function, wherein the formula of the normalize function is:

[0047] ;

[0048] Among them, mean means the pixel mean of the input image, std means the pixel variance of the input image, the Input here is the adversarial sample, and the Output is the standardized adversarial sample.

[0049] As a preferred solution of the present invention, the standardization process includes adjusting brightness and contrast.

[0050] As a preferred solution of the present invention, the input image size is 256*256, and the image format is RGB format.

[0051] As a preferred solution of the present invention, the infrared image dataset is organized into iterable data batches through DataLoader. Beneficial Effects

[0052] Compared with the prior art, the present invention adopts the above technical solution and has the following technical effects:

[0053] Based on the common characteristics of the current mainstream adversarial attack methods, the present invention uses feature distortion to achieve high-quality migration perturbation generation; and, in response to the problem of indiscriminate feature distortion in traditional adversarial attack methods, we choose to consider features in multiple dimensions to ensure that adversarial samples have migration capabilities while maintaining a certain attack strength. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 is a flow chart of the method of the present invention;

[0055] Figure 2 The calculation process of the loss function of the present invention;

[0056] Figure 3 (a) is a clean sample, and (b) is an adversarial sample. DETAILED DESCRIPTION

[0057] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings:

[0058] As an embodiment of the present invention, Figures 1 to 3 As shown, a method for generating infrared small target migration disturbance based on multi-dimensional feature distortion includes the following steps:

[0059] Step 1: The preprocessing phase includes the following steps:

[0060] Step 1.1: Parse the command line parameters through the argparse library and set basic parameters such as image dataset path, target model (such as ResNet), batch size, perturbation budget, step size, number of iterations, etc.

[0061] Step 1.2: Customize the data loader MFDP_Load, set the image size to 256*256, specify the RGB format, and load the infrared image dataset. Use DataLoader to organize it into iterable data batches to provide input for subsequent model training and perturbation generation.

[0062] Step 1.3: Prepare a clean sample dataset and a randomly perturbed adversarial sample dataset.

[0063] Step 2: Build the ResNet18 network.

[0064] Initial convolutional layer:

[0065] The input layer receives a 256x256x3 image. The first convolutional layer uses a 7x7 kernel with a stride of 2 and an output dimension of 64. This is followed by a 3x3 max pooling layer with a stride of 2 to reduce the spatial size of the feature map.

[0066] The residual block consists of:

[0067] ResNet18 consists of 4 stages, each of which contains 2 basic residual blocks. Each residual block consists of two 3x3 convolutional layers, each of which is followed by BatchNormalization and ReLU activation functions. Residual connections are implemented by adding the input directly to the output, bypassing the intermediate convolution operation. If the dimensions do not match, 1x1 convolution is used for adjustment.

[0068] Step 3: Divide ResNet18 into 4 stages of different depths and construct the corresponding loss function.

[0069] Step 3.1: Implement a perceptual_criteria module based on different depth levels. The module inputs the parameter n to specify the feature layer position (n corresponds to the four stages respectively), and uses nn.Sequential to intercept the output of the specific layer of ResNet18.

[0070] Step 3.2: Phase division:

[0071] The first stage (n=1): The number of output channels of the two residual blocks included is 64.

[0072] Second stage (n=2): The number of output channels of the next two residual blocks is 128, and the first residual block uses a convolution with a stride of 2 to halve the height and width of the feature map.

[0073] The third stage (n=3): The next two residual blocks have an output channel number of 256. Similarly, the first residual block uses a convolution with a stride of 2.

[0074] Fourth stage (n=4): The number of output channels of the last two residual blocks is 512, and the first residual block uses convolution with a stride of 2 again.

[0075] Step 3.3: Define the extract_region function to identify and extract the key areas above the threshold in the feature map. This step aims to focus on the salient features of the image as a basis for subsequent local feature deviation reduction.

[0076] Step 3.4: Construct a loss function with weights given after training on the infrared small target dataset. Input the original image sample and the adversarial sample into ResNet18 respectively. In the first three stages, the visual difference between the two is evaluated by MSE loss. In the fourth stage, MSE loss is used to calculate the feature difference between local areas. The loss function formula is as follows:

[0077] ;

[0078] ;

[0079] d represents the feature difference, that is, MSE loss; α, β, and γ are all loss function weights, which add up to 1.

[0080] Since the attack effect of the second layer is the most significant and the visual difference is relatively small, a larger weight is assigned to it; the fourth layer is used to reduce the feature differences in local areas. This is because the attack effect of the fourth layer is poor and the visual difference is small, so reducing its feature differences can improve the quality of our adversarial samples.

[0081] Step 4: Multi-dimensional feature distortion perturbation generation.

[0082] Step 4.1: Input the prepared clean samples and adversarial samples into ResNet18 to start iteration.

[0083] Step 4.2: Entering the first stage, the clean sample and the adversarial sample are subjected to the perceptual_criteria (1) function to obtain the MSE values ​​of the two. , which is the degree of feature distortion corresponding to the first stage, multiplied by the corresponding weight α and added to the loss function. At this time, the loss is .

[0084] Step 4.3: Entering the second stage, the clean sample and the adversarial sample are subjected to the perceptual_criteria (2) function to obtain the MSE values ​​of the two. , which is the degree of feature distortion corresponding to the second stage, multiplied by the corresponding weight β and added to the loss function, the loss is .

[0085] Step 4.4: Entering the third stage, the clean sample and the adversarial sample are subjected to the perceptual_criteria (3) function to obtain the MSE values ​​of the two. , which is the degree of feature distortion corresponding to the third stage, multiplied by the corresponding weight α and added to the loss function. At this time, the loss is .

[0086] Step 4.5: Entering the fourth stage, the clean sample and the adversarial sample are subjected to the perceptual_criteria (4) function to first obtain the feature maps of the two, then extract_region is used to select the area where the features need to be close, and finally the MSE is calculated to obtain the feature closeness value of the two. , which is the degree of feature proximity corresponding to stage 4, multiplied by the corresponding weight γ and added to the loss function, which is the final loss .

[0087] Step 4.6: Use the gradient ascent method to obtain the gradient information based on the above loss function, gradually adjust the perturbation to minimize the loss, and generate adversarial samples. By controlling the perturbation range and intensity, ensure that the generated adversarial sample is visually similar enough to the original image, while ensuring that it can effectively trigger the misjudgment of the target model. For each iteratively updated perturbation, consider the perturbation budget and pixel value range limit at the same time to ensure that the modification of the adversarial sample is within a controllable range, that is, limited to between 0 and 1. The adversarial sample update formula is as follows:

[0088] ;

[0089] Where: t represents the round of each update, w i is the weight of each layer’s gradient information, Indicates that each time the adversarial sample of the previous round is updated, It indicates that the adversarial samples of the current round are updated each time, lr indicates the update step size, sign indicates the sign function, n indicates that there are n stages in total, and grid indicates the gradient.

[0090] Step 4.7: Standardization and optimization. Use the normalize function to standardize the image data to meet the model preprocessing requirements. Specifically, it includes adjusting the brightness, contrast, etc. to ensure that the distribution of the input data is consistent with that during model training.

[0091] The technical solution of the present invention is described in detail above in conjunction with the embodiments / drawings, but the present invention is not limited to the above technical solution. For ordinary technicians in this technical field, after knowing the contents recorded in the present invention, they can make several equivalent changes and substitutions without departing from the principle of the present invention. These equivalent changes and substitutions should also be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for generating infrared small target migration disturbance based on multi-dimensional feature distortion, characterized in that: The following steps are involved: S1. Input the clean sample and the initial adversarial sample into the source network ResNet18 respectively to start perturbation iteration, wherein the initial adversarial sample is obtained by applying random perturbations to the clean sample; S2. Each perturbation iteration is completed in sequence through the first stage, the second stage, the third stage and the fourth stage, where: When the perturbation iteration enters the first stage, the clean sample and the adversarial sample pass the perceptual_criteria(n) function, n=1, and the MSE values ​​of the two are obtained. , which is the degree of feature distortion corresponding to the first stage, multiplied by the corresponding weight α and added to the loss function. At this time, the loss is ; When the perturbation iteration enters the second stage, the clean sample and the adversarial sample pass the perceptual_criteria(n) function, n=2, and the MSE values ​​of the two are obtained. , which is the degree of feature distortion corresponding to the second stage, multiplied by the corresponding weight β and added to the loss function, the loss is ; When the perturbation iteration enters the third stage, the clean sample and the adversarial sample are passed through the perceptual_criteria(n) function, n=3 to obtain the MSE values ​​of the two. , which is the degree of feature distortion corresponding to the third stage, multiplied by the corresponding weight α and added to the loss function. At this time, the loss is ; When the perturbation iteration enters the fourth stage, the clean sample and the adversarial sample are passed through the perceptual_criteria(n) function, n=4, to obtain the feature maps of the two, and the extract_region function is used to select the area where the features need to be close. Finally, the MSE value is calculated to obtain the feature closeness value of the two. , which is the degree of feature proximity corresponding to the fourth stage, multiplied by the corresponding weight γ and added to the loss function, which is the final loss ; S3, continuously updating its pixel value according to the gradient information of the loss function, and framing it in the pixel value range of the clean sample plus the perturbation budget until the preset number of iterations is reached to generate an adversarial sample image; in: The source network ResNet18 parses command line parameters through the argparse library to set the image dataset path, target model, batch size, perturbation budget, step size, and number of iterations; The source network ResNet18 uses a custom data loader MFDP_Load to set the input image size, specify the image format, and load the infrared image dataset; The formula of the perceptual_criteria(n) function is: ， Among them, Feature_Model represents the ResNet18 feature model intercepted at each stage, X adv represents adversarial samples, X real represents a clean sample, m represents the number of pixels in the image, and n represents the nth stage; The Extract_region function is used to identify and extract the key areas above the threshold in the feature map. Specifically, the clean sample feature map and the adversarial sample feature map are input into the Extract_region function respectively, and the key areas in the clean sample are extracted by calculating the contrast information of the clean sample feature map. The remaining areas are replaced by the corresponding areas of the adversarial sample to form a new feature map; The weights α, β and γ are all obtained by taking part of the training set of the infrared small target data set and performing adversarial sample generation training on ResNet18.

2. The method for generating infrared small target migration disturbance based on multi-dimensional feature distortion according to claim 1 is characterized in that: The source network ResNet18 includes an initial convolutional layer and a residual component, wherein: The initial convolution layer is an input layer for receiving an image, and is composed of a convolution layer and a maximum pooling layer following the convolution layer, wherein the convolution kernel size of the convolution layer is 7x7, the step size is 2, and the output dimension is 64; the convolution kernel size of the maximum pooling layer is 3x3, the step size is 2, and is used to reduce the spatial size of the feature map; The residual component is composed of the first stage, the second stage, the third stage and the fourth stage which are set in succession. Each stage contains 2 residual blocks. Each residual block is composed of 2 convolutional layers with 3x3 convolution kernels. Each convolutional layer is followed by batch normalization and activation function. The connection of the residual blocks is realized by adding the input directly to the output by skipping the intermediate convolution operation.

3. The method for generating infrared small target migration disturbance based on multi-dimensional feature distortion according to claim 2 is characterized in that: The number of output channels of the two residual blocks in the first stage is 64; The number of output channels of the two residual blocks in the second stage is 128, and the first residual block uses a convolution with a stride of 2; The number of output channels of the two residual blocks in the third stage is 256, and the first residual block uses a convolution with a step size of 2; The number of output channels of the two residual blocks in the fourth stage is 512, and the first residual block uses a convolution with a step size of 2.

4. The method for generating infrared small target migration disturbance based on multi-dimensional feature distortion according to claim 1, characterized in that: The process of the Extract_region function identifying and extracting the key areas above the threshold in the feature map is as follows: S41. Define a sliding window of size 6×6, divide it into 9 regions, each of which is 2×2 in size, C represents the central region, B represents the i (i = 1, 2, 3…, 8) is the background area; the sliding window traverses the clean sample feature map from left to right and from top to bottom; S42. When the sliding window stays at a certain position, the difference between the central area of ​​the position and the background area can be defined as: ； In the formula represents the mean value of pixels in the central area, and Represents the pixel mean of the background area; These eight values ​​describe the difference between the center area of ​​the current position and the background area. In the feature map, the intensity of the extracted target features is different from that of the background features. The following formula is used to describe the similarity: ； S43, in order to extract the contrast information to the greatest extent, the minimum similarity value is taken to replace the pixel value of the central area C, and finally a contrast information map is obtained, namely: ； Among them, a and b are the length and width of the feature map respectively, and N is the area divided by the sliding window; S44, judging whether the corresponding area is to be retained according to the contrast information: ； Among them, k is the contrast threshold, Input1 is the clean sample feature map, and Input2 is the adversarial sample feature map.

5. The method for generating infrared small target migration disturbance based on multi-dimensional feature distortion according to claim 1, characterized in that: The update formula of the adversarial sample is: ； In the formula, t represents the round of each update, w i is the weight of each layer’s gradient information, Indicates that each time the adversarial sample of the previous round is updated, It indicates that the adversarial samples of the current round are updated each time, lr indicates the update step size, sign indicates the sign function, n indicates that there are n stages in total, and grid indicates the gradient.

6. The method for generating infrared small target migration disturbance based on multi-dimensional feature distortion according to claim 1, characterized in that: The ResNet18 feature model is intercepted using nn.Sequential.

7. The method for generating infrared small target migration disturbance based on multi-dimensional feature distortion according to claim 1 is characterized in that: The adversarial sample image is normalized by a normalize function, wherein the formula of the normalize function is: ； Among them, mean means the pixel mean of the input image, std means the pixel variance of the input image, the Input here is the adversarial sample, and the Output is the standardized adversarial sample.

8. The method for generating infrared small target migration disturbance based on multi-dimensional feature distortion according to claim 7, characterized in that: The normalization process includes adjusting brightness and contrast.

9. The method for generating infrared small target migration disturbance based on multi-dimensional feature distortion according to claim 1, characterized in that: The input image size is 256*256, and the image format is RGB format.

10. The method for generating infrared small target migration disturbance based on multi-dimensional feature distortion according to claim 1, characterized in that: The infrared image dataset is organized into iterable data batches through DataLoader.

Images