Method and device for testing robustness of automatic driving model

Abstract

The invention relates to the field of deep learning model application testing, in particular to an automatic driving model robustness testing method and device. Through a module-level noise injection technology, various interference factors in a real environment are simulated, and the performance of the automatic driving model is comprehensively evaluated. According to the method, the disturbance of input data is considered, the intelligent task performance of the model in key stages such as perception and prediction is further deeply analyzed, and targeted anti-noise is designed to maximize the influence on the model performance. And the anti-noise is optimized by adopting a target-based optimization method, so that the robustness of the automatic driving model is accurately evaluated. In addition, the performance of the automatic driving model in a complex environment and under noise interference can be accurately evaluated, and an important guarantee is provided for safety application of the automatic driving technology. Through the implementation of the invention, the robustness and safety of the automatic driving system can be remarkably improved, and a solid foundation is laid for the future development of an intelligent traffic system.

Description

Technical Field

[0001] The present application relates to the field of deep learning model application testing, and in particular to a method and device for testing the robustness of an autonomous driving model. Background Art

[0002] With the tremendous progress in deep learning, autonomous driving technology plays an increasingly important role in today's society.

[0003] The classic solution for implementing autonomous driving is to develop and deploy a series of subtasks separately. This approach is relatively simple, but there will be problems of cumulative errors and difficulty in coordination. End-to-end autonomous driving models have emerged as a cutting-edge technical solution. By integrating modules such as perception, decision-making and control into a unified architecture, the design and deployment process of autonomous driving systems has been greatly simplified. Through a large amount of training data, the model can learn the mapping relationship from raw sensor data to driving actions, and achieve an efficient learning process. However, despite the excellent performance of end-to-end models, the security challenges they face cannot be ignored. On the one hand, the driving environment of vehicles is complex and changeable, and there are many uncertain factors, such as weather changes, traffic conditions, road construction, etc. These factors may interfere with the decision-making of the model, leading to misjudgment or wrong driving behavior. On the other hand, deep learning models themselves are fragile and vulnerable to malicious attacks. Cyber ​​attackers may steal, tamper with or destroy the data of the model through technical means, resulting in the performance degradation or even complete failure of the model. In addition, attackers may also exploit model vulnerabilities to carry out malicious attacks, such as injecting malicious data, tampering with model parameters, etc., which pose a serious threat to the security of autonomous driving systems.

[0004] In order to test the robustness of end-to-end autonomous driving models and make model improvements and optimizations, many studies have proposed adversarial attack methods for subtasks in autonomous driving, especially focusing on the perception layer. However, there is currently no robustness testing method for complex end-to-end autonomous driving models that are combined with multiple subtasks. Despite its excellent performance and revolutionary innovation, the evaluation of its adversarial robustness is still a big gap.

[0005] In view of this, how to provide an end-to-end autonomous driving model robustness testing method to evaluate the robustness of a complex end-to-end autonomous driving model composed of multiple subtasks has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] Embodiments of the present application provide an autonomous driving model robustness testing method, an autonomous driving model robustness testing device, an electronic device, and a computer storage medium, which are used to solve the problem that there is currently no robustness test for a complex end-to-end autonomous driving model composed of multiple subtasks.

[0007] In a first aspect of an embodiment of the present application, a method for testing the robustness of an autonomous driving model is provided, comprising:

[0008] Performing structural analysis on the autonomous driving model to identify model information, wherein the model information carries task stages and model subtasks corresponding to each task stage;

[0009] Designing specific adversarial noise for each model subtask corresponding to each task stage, and injecting the specific adversarial noise into the corresponding model subtask during the forward propagation process of the model, and recording the propagation information of the specific noise between each model subtask, wherein the specific adversarial noise corresponds to the performance of each model subtask;

[0010] Iteratively optimizing the specific adversarial noise by using a target method to obtain an optimized target adversarial noise, and injecting the target adversarial noise into corresponding model subtasks to obtain a target autonomous driving model;

[0011] Based on the performance difference between the target autonomous driving model under normal conditions and under abnormal conditions, the robustness of the autonomous driving model is evaluated.

[0012] In a second aspect of an embodiment of the present application, an autonomous driving model robustness testing device is provided, comprising:

[0013] An analysis module is configured to perform structural analysis on the autonomous driving model and identify model information, wherein the model information carries task stages and model subtasks corresponding to each task stage;

[0014] A design module is configured to design specific adversarial noise for each model subtask corresponding to each task stage, and inject the specific adversarial noise into the corresponding model subtask during the forward propagation process of the model, and record the propagation information of the specific noise between each model subtask, wherein the specific adversarial noise corresponds to the performance of each model subtask;

[0015] An optimization module is configured to iteratively optimize the specific adversarial noise using a target method to obtain an optimized target adversarial noise, and inject the target adversarial noise into corresponding model subtasks to obtain a target autonomous driving model;

[0016] The evaluation module is configured to perform a robustness evaluation on the autonomous driving model based on the performance difference of the target autonomous driving model under normal conditions and under abnormal conditions.

[0017] According to a third aspect of an embodiment of the present application, a computing device is provided, including:

[0018] Memory and processor;

[0019] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned autonomous driving model robustness testing method are implemented.

[0020] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, which stores computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned autonomous driving model robustness testing method.

[0021] The present application provides a method for testing the robustness of an autonomous driving model, comprising: first, performing a structural analysis on the autonomous driving model and identifying model information, wherein the model information carries task stages and model subtasks corresponding to each task stage; then, designing specific adversarial noise for each model subtask corresponding to each task stage, and injecting the specific adversarial noise into the corresponding model subtask during the forward propagation of the model, and recording the propagation information of the specific noise between the model subtasks, wherein the specific adversarial noise corresponds to the performance of each model subtask; secondly, iteratively optimizing the specific adversarial noise using a target method to obtain an optimized target adversarial noise, and injecting the target adversarial noise into the corresponding model subtasks, respectively, to obtain a target autonomous driving model; finally, based on the performance difference of the target autonomous driving model under normal conditions and under abnormal conditions, performing a robustness evaluation on the autonomous driving model.

[0022] The autonomous driving model robustness test method provided in the embodiment of the present application is applied, and the module-level noise injection technology is used to simulate various interference factors in the real environment to comprehensively evaluate the performance of the autonomous driving model. This method not only considers the disturbance of the input data, but also deeply analyzes the intelligent task performance of the model in key stages such as perception and prediction, and designs targeted adversarial noise to maximize the impact on the model performance. A gradient-based method is used to optimize the adversarial noise to achieve an accurate evaluation of the robustness of the autonomous driving model. This method can accurately evaluate the performance of the autonomous driving model in complex environments and noise interference, and provide important guarantees for the safe application of autonomous driving technology. Through the implementation of the present invention, the robustness and safety of the autonomous driving system will be significantly improved, laying a solid foundation for the future development of intelligent transportation systems.

[0023] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, which can be implemented in accordance with the contents of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0025] Figure 1 A flowchart of a method for testing the robustness of an autonomous driving model provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of the hardware level of online mapping of an autonomous driving model robustness testing method provided in an embodiment of the present application;

[0027] Figure 3 A schematic diagram of the structure of an autonomous driving model robustness testing device provided in an embodiment of the present application;

[0028] Figure 4 A structural block diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0030] Existing deep learning robustness evaluation methods are more suitable for single-task models. However, as autonomous driving is an intelligent task that requires multiple tasks to collaborate to complete safe planning, its robustness evaluation cannot only focus on the perturbation of image data, but should comprehensively consider various key vulnerabilities in the entire autonomous driving task chain.

[0031] Compared with general deep learning model robustness assessment technology, the present invention implements robustness assessment more specifically on end-to-end autonomous driving models. Traditional methods only apply disturbances at the input data level. Although a very rich implementation method has emerged for the generation of disturbances, this robustness assessment method cannot comprehensively evaluate tasks at different stages of autonomous driving. If the intermediate module has a strong error recovery capability, it is impossible to fully test the downstream modules. The present invention cleverly combines the characteristics of the collaborative promotion of different tasks in the autonomous driving model, and specifically designs anti-noise to achieve sufficient robustness evaluation of each module.

[0032] See also Figure 1 , Figure 1A flowchart of a method for testing the robustness of an autonomous driving model provided in an embodiment of the present application is shown below. Figure 1 As shown, the specific steps include the following steps.

[0033] Step S102: Perform structural analysis on the autonomous driving model and identify model information, wherein the model information carries task stages and model subtasks corresponding to each task stage.

[0034] In the embodiment of the present application, the structural analysis of the autonomous driving model and the identification of model information include:

[0035] Performing an overall structural analysis on the autonomous driving model to determine the task stages corresponding to the autonomous driving model and the model subtasks corresponding to each task stage, wherein the task stages include: a perception stage, a prediction stage, and a decision stage;

[0036] Based on the model subtasks corresponding to each task stage, feature information corresponding to each model subtask is determined, and based on the feature information, key information corresponding to each model subtask is determined, wherein the feature information includes: input information, output information and intermediate feature information.

[0037] It should be noted that the structural analysis here includes analysis of the model structure as well as non-robust analysis of the model (also known as vulnerability analysis).

[0038] In practical applications, the structural analysis of the end-to-end autonomous driving model is carried out, including: a detailed analysis of the overall architecture of the end-to-end autonomous driving model, dividing the model into three stages of perception, prediction and decision-making, and the intelligent tasks corresponding to each stage; focusing on the intelligent tasks of each stage, analyzing the role of the original input image or intermediate features from the module, and determining the potential robust key modules in the model reasoning stage.

[0039] On the one hand, the model structure is analyzed. The full-stack end-to-end autonomous driving model includes five intelligent tasks and builds a complete model structure that integrates full-stack tasks such as perception, prediction, and planning into a network. The design goal of the model is planning-oriented, rather than simply stacking independent tasks or adopting a multi-task learning scheme. To achieve this goal, the model uses learnable queries as interfaces to connect all modules, achieving flexible representation and knowledge interaction between tasks. In addition, the model also includes five key driving tasks such as tracking, map building, motion prediction, occupancy prediction, and planning, providing a complete autonomous driving solution.

[0040] Specifically, the perception module encodes agent-level and scene-level features to provide input for the subsequent prediction module; the motion prediction module considers the interactions between agents and predicts the future trajectories of all agents; the occupancy prediction module fuses agent-level and scene-level representations to predict the occupancy of future scenes; finally, the planning module uses the outputs of the aforementioned modules to generate a safe and collision-avoiding autonomous driving vehicle trajectory.

[0041] On the other hand, the model is not robustly analyzed. Perception, prediction, and planning work closely together in building an end-to-end autonomous driving model, which also represents a potential vulnerability to noise injection. Specifically, attackers can develop noise countermeasures and exploit the information exchange process between modules to attack the autonomous driving system. Therefore, during the robustness evaluation of the present invention, noise is projected and injected into the input image and output features of each intermediate module.

[0042] After completing the identification of the model information, this application also designs noise resistance at various key interfaces of the autonomous driving model to comprehensively evaluate the robustness of the model.

[0043] Step S104: Design specific adversarial noise for each model subtask corresponding to each task stage, and inject the specific adversarial noise into the corresponding model subtask during the forward propagation process of the model, and record the propagation information of the specific noise between the model subtasks, wherein the specific adversarial noise corresponds to the performance of each model subtask.

[0044] In the embodiment of the present application, for each model subtask corresponding to each task stage, a specific anti-noise is designed, including:

[0045] Designing a first anti-noise according to first input information in the perception stage, wherein the first input information includes original image information;

[0046] Designing a second anti-noise according to second input information of the prediction stage, wherein the second input information is output information of the perception stage;

[0047] A third anti-noise is designed according to third input information of the decision stage, wherein the third input information includes scene information and output information of the prediction stage.

[0048] In practical applications, the structure of the end-to-end autonomous driving model is analyzed for robustness (also known as vulnerability analysis), and specialized adversarial noise is designed based on the subtasks of the model's perception, prediction, and decision-making stages. These noises can be used to simulate interference factors in the real world and the errors in the model's intermediate representation caused by them, such as environmental noise, malicious interference, etc.

[0049] In the embodiment of the present application, when designing the anti-noise, it specifically includes the design of the perception stage, the prediction stage and the decision stage.

[0050] Perception layer anti-noise design. The perception layer plays a fundamental and important role in all subsequent tasks in the entire process line of autonomous driving. For the target tracking module, TrackFormer, the present invention designs an anti-noise N 1 To simulate the challenging and complex scenes in the real driving environment. For the design of anti-noise, the present invention designs pixel-by-pixel disturbances on the original input image. This noise can simulate various interference factors that are very common in actual scenes. For example, adding virtual occluders to the target objects around the autonomous driving vehicle may be caused by natural conditions such as foggy days or lighting. At the same time, the random changes in pixel values ​​can characterize various common noises caused by sensors, such as motion blur caused by the relatively high-speed movement of the target object, sensor image distortion, etc. This can specifically test the stability and continuity of the tracking module, and check whether there will be detection errors such as lost targets or incorrect tracking of false targets under normal adverse conditions. As for online mapping, namely MapFormer, its role in the entire task is parallel to that of TrackFormer, see Figure 2 , Figure 2 A schematic diagram of the hardware level of online mapping for an autonomous driving model robustness testing method provided in an embodiment of the present application. Considering the hardware level of mapping, the data captured by the lidar or IMU may be corrupted due to sensor quality noise. The mapping module also uses RGB images as the top-level input, but it directly receives the BEV feature map obtained from the multi-view image, which is different from the tracking module. However, small errors at the pixel level can also characterize unconventional changes in the scene area, such as small changes in the driving area due to emergencies. This design of anti-noise can effectively evaluate the accuracy of map construction at the layer level and measure the map reconstruction error under different noise conditions.

[0051] Design of anti-noise for prediction layer. As a bridge between perception and decision-making, the prediction layer plays an important role in enhancing perception and guiding decision-making. On the one hand, the decision-making layer must have the ability to repair the accumulated errors of upstream tasks, and on the other hand, it must have the ability to predict the future state of the environment and the behavior of the intelligent agent based on the perception layer's understanding of the environment. In view of these two important aspects, the present invention designs anti-noise to be injected into the prediction layer. TrackFormer provides important spatiotemporal features of objects to the prediction layer, which contains historical information and plays an important indicative role in the reasoning of the motion prediction module, namely MotionFormer. The present invention specifically adapts anti-noise to the interactive information between the two. Specifically, the basic prototype of the noise is the characteristic perturbation N of a single object.A Since the number of target objects in each frame scene changes dynamically, when applying noise to the prediction module, each target must be traversed for noise injection. This can directly interfere with MotionFormer to complete robustness evaluation, including the accuracy of predicted trajectory. Of course, the module-by-module noise design of the present invention will perform cumulative non-robust interference on subsequent modules to achieve a more comprehensive evaluation. MapFormer and TrackFormer are in a parallel position, so the present invention also performs noise-resistant adaptation on the output features of MapFormer, that is, N M , and directly injected into MotionFormer. This design can simulate the damage and incompleteness of high-definition maps used for autonomous driving, and further evaluate the robustness of the motion prediction module. For occupancy prediction at the same prediction layer, namely OccFormer, it does not directly accept the role of the perception layer, but is based on the task of motion prediction to further strengthen the role of the prediction process. The motion prediction module provides the occupancy prediction with the most expected future motion trajectory of the moving targets around the autonomous driving vehicle. Therefore, the present invention designs the disturbance noise N at the trajectory level. T , in order to achieve the inclusiveness of the evaluation model to future trajectory changes, which can characterize some unpredictable behaviors in autonomous driving scenarios, such as sudden acceleration, sharp turns, etc.

[0052] Decision-making layer anti-noise design. The decision-making stage integrates the processing of all upstream tasks to make the final planning result, that is, the next driving route of the autonomous driving vehicle in the previous frame. In general, the planning module will be affected by all previous tasks, so the module-by-module noise design of the present invention will affect the planning module. In order to achieve stronger robustness testing, the present invention also directly performs noise design on the input features of the planning module of MotionFormer, expressed as N E ,This design can simulate adding virtual obstacles or dynamic interference on the ,planned path to test the planning module’s ability to handle emergencies, and the real-time ,and stability of path planning under different interference conditions.

[0053] In the embodiment of the present application, during the forward propagation process of the model, the specific adversarial noise is injected into the corresponding model subtask, and the propagation information of the specific noise between each model subtask is recorded, including:

[0054] In the forward propagation process of the model, the specific adversarial noise is injected into the corresponding model subtask based on the preset adversarial noise injection order and adversarial noise injection position;

[0055] Monitor and record in real time the propagation information of the adversarial noise between each model subtask, and perform real-time analysis on the propagation information, wherein the propagation information includes transmission information and accumulation information.

[0056] In practical applications, the injection and storage propagation of adversarial noise are completed based on the designed noise. In the process of forward propagation of the end-to-end model, the designed noise is injected into the corresponding subtasks module by module. At the same time, the storage of noise at each stage must be completed in the whole process, including its transmission and accumulation between different modules until the final planning is completed.

[0057] The method of injecting specific noise into the corresponding model subtask includes: when each set of data is inferred for the first time, the noise is initialized according to the design of anti-noise at different stages; in each iteration, the anti-noise is added to the corresponding input features according to the execution order of each module, and the noise at each level is stored until the planning is completed, and is updated as the injected noise for the next iteration.

[0058] Adversarial noise injection and storage propagation. This process not only involves injecting the carefully designed adversarial noise main module into the corresponding subtask, but also involves the storage, propagation and accumulation of noise during the entire forward propagation process.

[0059] First, noise needs to be injected into each key subtask of the full-stack end-to-end autonomous driving model based on the designed specific adversarial noise. The injection process needs to ensure that it can accurately act on the corresponding model layer or module to simulate interference factors in the real world.

[0060] For intelligent tasks in the perception stage, such as target detection and tracking, and online mapping, the present invention directly superimposes pixel-level adversarial noise onto the original input image. These noises may simulate factors such as illumination changes, sensor noise, or human interference, thereby testing the robustness of the model under dangerous conditions.

[0061] In the prediction phase, the model receives the output from the perception phase as input. Therefore, the present invention injects adversarial noise into these features, which targets specific elements in the scene, such as vehicles, pedestrians and other traffic participants, or static scene facilities, to simulate their possible incorrect modeling in the perception layer, or sudden traffic conditions, etc.

[0062] In the decision-making stage, the present invention designs adversarial noise according to the output characteristics of the prediction stage. These noises attempt to disrupt the model's understanding of the environmental state, for example, by changing the future motion state (speed direction, etc.) of the surrounding intelligent agents, simulating real possible unexpected traffic behaviors, so as to test the model's decision-making ability when faced with misleading information in emergency and dangerous situations.

[0063] In order to further optimize the noise and fully perform robustness evaluation, it is necessary to save the noise at each stage during the injection process until each task on the entire autonomous driving task line is completed. Therefore, after injecting noise at each stage, the present invention stores the state of the noise at that stage (such as size, distribution, etc.) in the global public cache area. This storage state uses the training time of a batch of data as the storage period. This information will be used for subsequent analysis of the impact of noise on model performance, and then make noise updates.

[0064] Step S106: Iteratively optimize the specific adversarial noise using a target method to obtain an optimized target adversarial noise, and inject the target adversarial noise into corresponding model subtasks to obtain a target autonomous driving model.

[0065] In the embodiment of the present application, the specific anti-noise is iteratively optimized by adopting a target method to obtain an optimized target anti-noise, including:

[0066] Using the loss function of each model subtask as an optimization target, iteratively updating the specific adversarial noise to obtain a first model subtask;

[0067] The first model subtask is optimized using a target optimization method to obtain an optimized target anti-noise.

[0068] It should be noted that the target method is a gradient-based method, that is, a gradient-based method optimizes and updates the adversarial noise.

[0069] In practical applications, after the final planning is completed, the loss of each module of the model is used to update the adversarial noise at each stage to maximize the impact of noise on model performance. The above process is performed iteratively to more finely adjust the direction of noise update. That is, in the inference stage of the end-to-end model, each model completes the prediction in sequence, and the loss calculation of each subtask is completed in the same way as during model training; after the planning is completed, all adversarial noises are updated with the goal of maximizing the loss of each subtask.

[0070] The present invention implements the attack by iteratively optimizing the noise of each module. Specifically, in the inference stage of the autonomous driving model, for each batch of data, the present invention first initializes the corresponding adversarial noise within the corresponding disturbance constraints in the forward propagation process of the model. In each iteration, after the noise of each level is injected into the corresponding module, it will be saved until the end of the final planning, and all noises will be synchronously updated through the adversarial loss as the initial noise of the next iteration.

[0071] The calculation goal of the adversarial loss used to update the noise is to make the predictions made by each module of the autonomous driving model deviate from the original correct results as much as possible. Specifically, in the robustness evaluation process, each module sequentially obtains the corresponding task results and features for downstream tasks. After the module reasoning is completed, the present invention uses the method of calculating the loss during training to calculate the corresponding loss. After the planning is completed, the present invention adds up the losses of each module as the final attack loss, which can be expressed as:

[0072] L adv =L track +L map +L motion +L occ +L plan ;

[0073] Among them, L adv Indicates the final attack loss; L track Indicates the loss of the module;

[0074] The present invention adopts a PGD-like approach to optimize noise, performing gradient ascent on the anti-noise, namely:

[0075]

[0076] Among them, N represents the adversarial noise used for robustness testing, i represents the stage number of noise injection in autonomous driving, k represents the number of iterative updates, t represents the current number of iterations, ε is a hyperparameter for constraining the disturbance amplitude, and sign() represents the sign function.

[0077] Step S108: Based on the performance differences of the target autonomous driving model under normal conditions and under abnormal conditions, the robustness of the autonomous driving model is evaluated.

[0078] In the embodiment of the present application, the robustness evaluation of the autonomous driving model based on the performance difference of the target autonomous driving model under normal circumstances and under abnormal circumstances also includes:

[0079] Test the model's performance under normal conditions at least once to get the first performance difference;

[0080] Test the model’s performance under abnormal conditions at least once to obtain a second performance difference;

[0081] Based on the first performance difference and the second performance difference, the robustness of the autonomous driving model is evaluated.

[0082] In practical applications, the noise obtained by the final optimization is sequentially injected into each subtask of each stage of the model. The performance indicators of each task of the model under normal conditions and against noise attacks are compared to quantitatively evaluate the robustness level of the model.

[0083] In an embodiment of the present application, the method further includes:

[0084] Based on the evaluation result of the robustness evaluation of the autonomous driving model, the autonomous driving model is improved and optimized to generate an optimized autonomous driving model.

[0085] The model is evaluated for adversarial robustness. For the full-stack end-to-end autonomous driving model, the five tasks have corresponding evaluation indicators after completion, such as the average multi-target tracking accuracy (AMOTA) for target tracking, the intersection over union (IOU) of the predicted and real areas for online mapping and occupancy prediction, the minimum average deviation error (minADE) for motion prediction, and the L2 error for planning. The evaluation indicator of module i is denoted as M i , then the evaluation index of module i after implementing the attack of the present invention is The average degradation rate of all task performance is used to measure the robustness of the autonomous driving model:

[0086]

[0087] The smaller R is, the more resistant the autonomous driving model is to interference or dangerous conditions, that is, the more robust the model is.

[0088] Applying the method provided in this application, through module-level noise injection technology, simulate various interference factors in the real environment to comprehensively evaluate the performance of the autonomous driving model. This application not only considers the disturbance of the input data, but also deeply analyzes the intelligent task performance of the model in key stages such as perception and prediction, and designs targeted adversarial noise to maximize the impact on model performance. Adopt a target-based optimization method to optimize adversarial noise and achieve accurate evaluation of the robustness of the autonomous driving model. In addition, this application can accurately evaluate the performance of the autonomous driving model in complex environments and noise interference, providing important guarantees for the safe application of autonomous driving technology. Through the implementation of this application, the robustness and safety of the autonomous driving system will be significantly improved, laying a solid foundation for the future development of intelligent transportation systems.

[0089] Corresponding to the above method embodiment, this specification also provides an embodiment of an autonomous driving model robustness testing device, Figure 3 This is a schematic diagram of the structure of an automatic driving model robustness test device provided in an embodiment of the present application. Figure 3 As shown, the device comprises:

[0090] An analysis module 302 is configured to perform a structural analysis on the autonomous driving model and identify model information, wherein the model information carries a task stage and a model subtask corresponding to each task stage;

[0091] The design module 304 is configured to design specific adversarial noise for each model subtask corresponding to each of the task stages, and inject the specific adversarial noise into the corresponding model subtask during the forward propagation process of the model, and record the propagation information of the specific noise between the model subtasks, wherein the specific adversarial noise corresponds to the performance of each model subtask;

[0092] The optimization module 306 is configured to iteratively optimize the specific adversarial noise using a target method to obtain an optimized target adversarial noise, and inject the target adversarial noise into corresponding model subtasks to obtain a target autonomous driving model;

[0093] The evaluation module 308 is configured to perform a robustness evaluation on the autonomous driving model based on the performance difference between the target autonomous driving model under normal conditions and under abnormal conditions.

[0094] In an optional embodiment, the analysis module 302 is further configured to:

[0095] Performing an overall structural analysis on the autonomous driving model to determine the task stages corresponding to the autonomous driving model and the model subtasks corresponding to each task stage, wherein the task stages include: a perception stage, a prediction stage, and a decision stage;

[0096] Based on the model subtasks corresponding to each task stage, feature information corresponding to each model subtask is determined, and based on the feature information, key information corresponding to each model subtask is determined, wherein the feature information includes: input information, output information and intermediate feature information.

[0097] In an optional embodiment, the design module 304 is further configured to:

[0098] Designing a first anti-noise according to first input information in the perception stage, wherein the first input information includes original image information;

[0099] Designing a second anti-noise according to second input information of the prediction stage, wherein the second input information is output information of the perception stage;

[0100] A third anti-noise is designed according to third input information of the decision stage, wherein the third input information includes scene information and output information of the prediction stage.

[0101] In an optional embodiment, the design module 304 is further configured to:

[0102] In the forward propagation process of the model, the specific adversarial noise is injected into the corresponding model subtask based on the preset adversarial noise injection order and adversarial noise injection position;

[0103] Monitor and record in real time the propagation information of the adversarial noise between each model subtask, and perform real-time analysis on the propagation information, wherein the propagation information includes transmission information and accumulation information.

[0104] In an optional embodiment, the optimization module 306 is further configured to:

[0105] Using the loss function of each model subtask as an optimization target, iteratively updating the specific adversarial noise to obtain a first model subtask;

[0106] The first model subtask is optimized using a target optimization method to obtain an optimized target anti-noise.

[0107] In an optional embodiment, the evaluation module 308 is further configured to:

[0108] Test the model's performance under normal conditions at least once to get the first performance difference;

[0109] Test the model’s performance under abnormal conditions at least once to obtain a second performance difference;

[0110] Based on the first performance difference and the second performance difference, the robustness of the autonomous driving model is evaluated.

[0111] In an optional embodiment, the device further includes:

[0112] The improvement module is configured to improve and optimize the autonomous driving model based on the evaluation result of the robustness evaluation of the autonomous driving model, and generate an optimized autonomous driving model.

[0113] By using the device provided by this application, various interference factors in the real environment are simulated through module-level noise injection technology to comprehensively evaluate the performance of the autonomous driving model. This application not only considers the disturbance of the input data, but also deeply analyzes the intelligent task performance of the model in key stages such as perception and prediction, and designs targeted adversarial noise to maximize the impact on model performance. The adversarial noise is optimized based on the target optimization method to achieve accurate evaluation of the robustness of the autonomous driving model. In addition, this application can accurately evaluate the performance of the autonomous driving model in complex environments and noise interference, providing important guarantees for the safe application of autonomous driving technology. Through the implementation of this application, the robustness and safety of the autonomous driving system will be significantly improved, laying a solid foundation for the future development of intelligent transportation systems.

[0114] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the autonomous driving model robustness test device, since it is basically similar to the autonomous driving model robustness test method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the autonomous driving model robustness test method embodiment.

[0115] Figure 4 This is a block diagram of a computing device provided in an embodiment of the present application. The components of the computing device 400 include but are not limited to a memory 410 and a processor 420. The processor 420 is connected to the memory 410 via a bus 430, and the database 450 is used to store data.

[0116] The computing device 400 also includes an access device 440 that enables the computing device 400 to communicate via one or more networks 460. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 440 may include one or more of any type of network interface (e.g., a network interface card (NIC)) that is wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0117] In one embodiment of the present specification, the above components of the computing device 400 and Figure 4 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 4 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0118] The computing device 400 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 400 may also be a mobile or stationary server.

[0119] Among them, the processor 420 is used to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the above-mentioned autonomous driving model robustness testing method.

[0120] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computing device embodiment, since it is basically similar to the autonomous driving model robustness test method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the autonomous driving model robustness test method embodiment.

[0121] An embodiment of the present specification also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned autonomous driving model robustness testing method.

[0122] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer-readable storage medium embodiment, since it is basically similar to the autonomous driving model robustness test method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the autonomous driving model robustness test method embodiment.

[0123] An embodiment of the present specification also provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned autonomous driving model robustness testing method.

[0124] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer program embodiment, since it is basically similar to the autonomous driving model robustness test method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the autonomous driving model robustness test method embodiment.

[0125] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0126] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0127] It should be noted that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of the present specification.

[0128] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0129] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A method for testing the robustness of an autonomous driving model, characterized in that: include: Performing structural analysis on the autonomous driving model to identify model information, wherein the model information carries task stages and model subtasks corresponding to each task stage; Designing specific adversarial noise for each model subtask corresponding to each task stage, and injecting the specific adversarial noise into the corresponding model subtask during the forward propagation process of the model, and recording the propagation information of the specific noise between each model subtask, wherein the specific adversarial noise corresponds to the performance of each model subtask; Iteratively optimizing the specific adversarial noise by using a target method to obtain an optimized target adversarial noise, and injecting the target adversarial noise into corresponding model subtasks to obtain a target autonomous driving model; Based on the performance difference between the target autonomous driving model under normal conditions and under abnormal conditions, the robustness of the autonomous driving model is evaluated.

2. The method according to claim 1, characterized in that The structural analysis of the autonomous driving model and identification of model information include: Performing an overall structural analysis on the autonomous driving model to determine the task stages corresponding to the autonomous driving model and the model subtasks corresponding to each task stage, wherein the task stages include: a perception stage, a prediction stage, and a decision stage; Based on the model subtasks corresponding to each task stage, feature information corresponding to each model subtask is determined, and based on the feature information, key information corresponding to each model subtask is determined, wherein the feature information includes: input information, output information and intermediate feature information.

3. The method according to claim 1, characterized in that Designing specific anti-noise for each model subtask corresponding to each task stage includes: Designing a first anti-noise according to first input information in the perception stage, wherein the first input information includes original image information; Designing a second anti-noise according to second input information of the prediction stage, wherein the second input information is output information of the perception stage; A third anti-noise is designed according to third input information of the decision stage, wherein the third input information includes scene information and output information of the prediction stage.

4. The method according to claim 1, characterized in that: In the forward propagation process of the model, the specific adversarial noise is injected into the corresponding model subtask, and the propagation information of the specific noise between each model subtask is recorded, including: In the forward propagation process of the model, the specific adversarial noise is injected into the corresponding model subtask based on the preset adversarial noise injection order and adversarial noise injection position; Monitor and record in real time the propagation information of the adversarial noise between each model subtask, and perform real-time analysis on the propagation information, wherein the propagation information includes transmission information and accumulation information.

5. The method according to claim 1, characterized in that The adopting a target method to iteratively optimize the specific anti-noise to obtain an optimized target anti-noise includes: Using the loss function of each model subtask as an optimization target, iteratively updating the specific adversarial noise to obtain a first model subtask; The first model subtask is optimized using a target optimization method to obtain an optimized target anti-noise.

6. The method according to claim 1, characterized in that The performing robustness evaluation on the autonomous driving model based on the performance difference of the target autonomous driving model under normal conditions and under abnormal conditions further includes: Test the model's performance under normal conditions at least once to get the first performance difference; Test the model's performance under abnormal conditions at least once to obtain a second performance difference; Based on the first performance difference and the second performance difference, the robustness of the autonomous driving model is evaluated.

7. The method according to claim 1, characterized in that The method further comprises: Based on the evaluation result of the robustness evaluation of the autonomous driving model, the autonomous driving model is improved and optimized to generate an optimized autonomous driving model.

8. An automatic driving model robustness testing device, characterized in that: include: An analysis module is configured to perform structural analysis on the autonomous driving model and identify model information, wherein the model information carries task stages and model subtasks corresponding to each task stage; A design module is configured to design specific adversarial noise for each model subtask corresponding to each task stage, and inject the specific adversarial noise into the corresponding model subtask during the forward propagation process of the model, and record the propagation information of the specific noise between each model subtask, wherein the specific adversarial noise corresponds to the performance of each model subtask; An optimization module is configured to iteratively optimize the specific adversarial noise using a target method to obtain an optimized target adversarial noise, and inject the target adversarial noise into corresponding model subtasks to obtain a target autonomous driving model; The evaluation module is configured to perform a robustness evaluation on the autonomous driving model based on the performance difference of the target autonomous driving model under normal conditions and under abnormal conditions.

9. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the autonomous driving model robustness testing method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an implementation program for information transmission, and when the program is executed by the processor, the steps of the autonomous driving model robustness testing method as described in any one of claims 1 to 7 are implemented.

Images