Adversarial sample generation method, system, device and medium for misleading target tracking

Abstract

The present invention relates to a method, system, device and medium for generating adversarial samples for misleading target tracking, and to the technical field of adversarial sample generation, wherein the method comprises: obtaining a video sequence to be tracked; using an evolutionary search strategy to generate an optimal adversarial sample of a frame image in the video sequence, wherein the optimal adversarial sample is used for misleading target tracking, and specifically comprises: the evolutionary search strategy adopts an improved particle swarm optimization algorithm, and the particles in the improved particle swarm optimization algorithm are used as queries for generating adversarial samples, and in the improved particle swarm optimization algorithm, the query in each frame image is initialized in speed, and the query position and the query speed are iteratively updated after the query speed is initialized, and the optimal adversarial sample is continuously iterated to be generated. The present invention constructs an efficient evolutionary search strategy, which can generate adversarial samples that mislead the tracker, so that the tracker cannot correctly track the target.

Description

Technical Field

[0001] The present invention relates to the technical field of adversarial sample generation, and in particular to an adversarial sample generation method, system, device and medium for misleading target tracking. Background Art

[0002] In the field of cybersecurity, adversarial attacks are a technique that exploits the vulnerabilities of machine learning models to mislead model decisions through carefully designed input samples. This attack can be applied to a variety of scenarios, including image recognition, speech recognition, and natural language processing. The attacker may have full knowledge of the model (white-box attack) or infer the model behavior by only observing the model output (black-box attack). Techniques for generating adversarial samples include gradient-based methods, optimization algorithms, and heuristic methods.

[0003] In recent years, tracking technology has been widely used in many fields, and deep models have been increasingly used. At the same time, model security issues have become a top priority. On this basis, adversarial attacks have been widely studied as a powerful attack to evaluate the robustness of models.

[0004] Existing decision attacks cannot be well applied to tracking tasks. Considering the timeliness requirements of tracking tasks and the unclear decision boundaries of tracking, we believe that the serial single-step iterative optimization strategy used by traditional decision attacks is the problem, which makes the attack rely on a large number of queries and easily repeat queries in difficult sequences. At the same time, existing decision attacks also have the problem of unclear tracking decision boundaries. Since the output of tracking is not clear like classification, and the output of clean samples will be affected by the attacks of the previous few frames, resulting in unreasonable reference problems.

[0005] In summary, the existing adversarial attack strategies for tracking task models are not very effective. Summary of the invention

[0006] Therefore, the technical problem to be solved by the present invention is to overcome the problem that the adversarial attack strategy used for tracking task models in the prior art is not effective.

[0007] In order to solve the above technical problems, the present invention provides an adversarial sample generation method for misleading target tracking, comprising:

[0008] Step S1: Obtain a video sequence for target tracking;

[0009] Step S2: using an evolutionary search strategy to generate an optimal adversarial sample of a frame image in the video sequence, wherein the optimal adversarial sample is used to mislead target tracking, specifically comprising:

[0010] The evolutionary search strategy adopts an improved particle swarm optimization algorithm, and uses particles in the improved particle swarm optimization algorithm as queries for generating adversarial samples. In the improved particle swarm optimization algorithm, the speed of the query in each frame of the image is initialized, and the query position and query speed are iteratively updated based on the query speed initialization, and the optimal query position and query speed are selected to generate the optimal adversarial sample;

[0011] When the improved particle swarm optimization algorithm is used, step S2 further includes constructing an evaluation function, which is used to evaluate the effectiveness of the adversarial sample, and the formula is:

[0012] ;

[0013] in, is the evaluation function, and They are Frame and The bounding box of the original image of the frame, is the bounding box output by the adversarial sample, represents the evaluation weight in time, represents a metric that considers the offset and deformation of two bounding boxes, represents the intersection-over-union ratio of two bounding boxes; is the displacement measure, is the deformation measure, As ,Will or As , and They are and The center point of and represents two bounding boxes, refers to the Euclidean distance, is the diagonal of the minimum bounding box, and Indicates the width and height of the target box, and Represents the width and height of the prediction box, and is the width and height of the smallest bounding box that covers the target box and the predicted box.

[0014] In one embodiment of the present invention, the formula for the update query speed is:

[0015] ;

[0016] in, and Indicates speed, respectively represents query In the The iteration and The distance and direction that can be moved in each iteration; represents the inertia weight, is the individual learning factor, is the social learning factor, and are the first and second random values, Yes Query In the The individual best historical position in the iteration, All queries in The global historical optimal position in the iteration, Representation query In the The position of the iteration, variable The role of is to reduce the displacement that will worsen the current query, the variable The role of is to promote the current query to converge to the optimal value.

[0017] In one embodiment of the present invention, the formula for initializing the speed of the query in each frame of image is:

[0018] ;

[0019] in, Yes Query The initial velocity is obtained by the orthogonal combination of tangential perturbation and normal perturbation. Provide initial velocity; the tangential disturbance is random Gaussian noise ; The normal disturbance is , indicating that based on and template adversarial examples Combination composition; represents the normal perturbation function; is the tangential perturbation learning rate; is normal perturbation learning.

[0020] In one embodiment of the present invention, the formula for updating the query position is:

[0021] ;

[0022] in, Indicates speed, represents query In the The distance and direction that can be moved in each iteration; and Respectively represent queries In the The iteration and The position of the iteration.

[0023] In one embodiment of the present invention, the method for selecting the optimal query position and query speed is:

[0024] In the improved particle swarm optimization algorithm In the iteration, the worst query is removed, and a new query is derived from the best query. The speed and position of the new derived query are generated based on the speed and position of the best query. The formula is:

[0025] ;

[0026] ;

[0027] in, represents the newly derived query position at the kth iteration, represents the optimal query position for the kth query, represents the query speed newly derived in the kth iteration, represents the optimal query speed for the kth iteration, is the tangential perturbation learning rate, is random Gaussian noise.

[0028] In one embodiment of the present invention, in the improved particle swarm optimization algorithm, the optimal adversarial sample generation process for the second frame image and each frame image thereafter of the video sequence further includes position initialization of the query: by constructing the total perturbation of the previous frame image and the learned perturbation, and applying the total perturbation of the previous frame image and the learned perturbation to the current frame image, wherein the formula for constructing the total perturbation of the previous frame image and the learned perturbation is:

[0029] ;

[0030] ;

[0031] in, Indicates The total disturbance in the frame image, Indicates Final adversarial example of frame, Indicates The original image of the frame, Indicates The perturbation learned in the frame image, Indicates that from Frame image to The cross-frame perturbation transfer of frame images is formulated as:

[0032] ;

[0033] in, Indicates The total disturbance in the frame image, Indicates The perturbation learned in the frame image, represents the weight of the total disturbance, represents the weight of the learned perturbation.

[0034] In order to solve the above technical problems, the present invention provides an adversarial sample generation system for misleading target tracking, comprising:

[0035] Acquisition module: used to acquire the video sequence to be tracked;

[0036] A generation module is used to generate an optimal adversarial sample of a frame image in the video sequence using an evolutionary search strategy, wherein the optimal adversarial sample is used to mislead target tracking, and specifically includes:

[0037] The evolutionary search strategy adopts an improved particle swarm optimization algorithm, and uses particles in the improved particle swarm optimization algorithm as queries for generating adversarial samples. In the improved particle swarm optimization algorithm, the speed of the query in each frame of the image is initialized, and the query speed and query position are updated based on the query speed initialization, and the optimal query speed and query position are selected to generate the optimal adversarial sample;

[0038] When the generation module adopts the improved particle swarm optimization algorithm, it also includes constructing an evaluation function, which is used to evaluate the effectiveness of the adversarial sample. The formula is:

[0039] ;

[0040] in, is the evaluation function, and They are Frame and The bounding box of the original image of the frame, is the bounding box output by the adversarial sample, represents the evaluation weight in time, represents a metric that considers the offset and deformation of two bounding boxes, represents the intersection-over-union ratio of two bounding boxes; is the displacement measure, is the deformation measure, As ,Will or As , and They are and The center point of and represents two bounding boxes, refers to the Euclidean distance, is the diagonal of the minimum bounding box, and Indicates the width and height of the target box, and Represents the width and height of the prediction box, and is the width and height of the smallest bounding box that covers the target box and the predicted box.

[0041] To solve the above technical problems, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the adversarial sample generation method for misleading target tracking are implemented as described above.

[0042] In order to solve the above technical problems, the present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the adversarial sample generation method for misleading target tracking are implemented as described above.

[0043] The above technical solution of the present invention has the following advantages compared with the prior art:

[0044] The adversarial sample generation method for misleading target tracking described in the present invention constructs an efficient evolutionary search strategy, which can generate adversarial samples that mislead the tracker. Experiments show that the present invention can make the tracker unable to correctly track the target. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to make the contents of the present invention more clearly understood, the present invention is further described in detail below based on specific embodiments of the present invention in conjunction with the accompanying drawings.

[0046] Figure 1 It is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0047] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0048] Embodiment 1

[0049] Reference Figure 1The present invention relates to a method for generating adversarial samples for misleading target tracking, comprising:

[0050] Step S1: Obtain a video sequence for target tracking;

[0051] Step S2: using an evolutionary search strategy to generate an optimal adversarial sample of a frame image in the video sequence, wherein the optimal adversarial sample is used to mislead target tracking, specifically comprising:

[0052] The evolutionary search strategy adopts an improved particle swarm optimization algorithm, and uses the particles in the improved particle swarm optimization algorithm as queries for generating adversarial samples. In the improved particle swarm optimization algorithm, the speed of the query in each frame image is initialized, and the query position and query speed are iteratively updated based on the query speed initialization, and the optimal query position and query speed are selected to generate the optimal adversarial sample.

[0053] The present embodiment is described in detail below.

[0054] 1. Evolutionary Search Process

[0055] In traditional decision-based black-box attacks, a serial single-step iterative method is usually used to optimize adversarial samples, and the attack effect is improved by increasing the number of queries. However, for visual tracking tasks, the decision boundary is not clear, and the real-time nature of tracking limits the number of queries. Therefore, standard decision-based black-box attack techniques, although effective in classification, are not suitable for tracking. Although feasible methods have been proposed in tracking, the effect is limited and the search process is relatively slow. To solve this problem, a method that combines evolutionary search strategies with parallel processing techniques is proposed to further accelerate the process.

[0056] To emphasize the interaction between queries, the evolutionary search process consists of three parts: query velocity update, query position update, and optimal selection.

[0057] Query speed update: By updating the query speed, the search direction and range of the query can be controlled, thereby exploring the search space more efficiently. The speed update equation is defined as:

[0058] ;

[0059] in, and Indicates speed, respectively represents query In the The iteration and The distance and direction that can be moved in each iteration; is the query number; represents the inertia weight, which is a measure of the query's prior confidence in its motion state; is the individual learning factor, represents the social learning factor; and is a random value in the range of (0,1); Yes Query In the The historical best position in the iteration, Represents all queries in The historical best position in the iteration, Representation query In the The speed update formula corrects the deteriorated query and promotes all queries to converge to the optimal direction. The role of is to mitigate displacements that would worsen the current state, while It is used to promote the current query to converge to the optimal state;

[0060] The speed initialization of the query in each frame can be understood as a speed perturbation to accelerate convergence, which is defined as:

[0061] ;

[0062] in, Yes Query The initial velocity is obtained by the orthogonal combination of tangential perturbation and normal perturbation. Provides initial velocity, By providing a general direction to speed up the search process, aimless random search is avoided; the tangential disturbance is random Gaussian noise ; The normal disturbance is , indicating that based on and template adversarial examples Combination composition, template adversarial sample That is, an image with heavy noise added; represents the normal perturbation function; is the tangential perturbation learning rate; It is normal perturbation learning. It should be noted that when the tangential perturbation and the normal perturbation are combined, they form an orthogonal perturbation vector, which means that they are independent in direction. This orthogonal combination can provide a more comprehensive search space, so that particles have the potential to explore different directions at the time of initialization.

[0063] Query position update: By continuously updating the query position, the optimal adversarial sample can be gradually approached. This process can be performed in parallel to improve search efficiency. Specifically, the position update formula is as follows:

[0064] ;

[0065] in, Indicates speed, represents query In the The distance and direction that can be moved in each iteration; and Respectively represent queries In the The iteration and The position of the iteration.

[0066] Optimal selection (selecting the optimal query position and query speed): This selection process can be based on some evaluation indicators, such as the tracking error of the tracker or the perturbation size of the adversarial sample. The optimal selection can ensure that the search process is always carried out in the direction of improving the attack effect. In the iteration, the worst query is removed, and a new query is derived from the best query. The speed and position of the new derived query are generated based on the speed and position of the best query. The calculation method of the best choice is as follows:

[0067] ;

[0068] ;

[0069] in, represents the newly derived query position at the kth iteration, represents the optimal query position for the kth query, represents the query speed newly derived in the kth iteration, represents the optimal query speed for the kth iteration, is the tangential perturbation learning rate, is random Gaussian noise. The concept of optimal selection follows the principle of evolutionary algorithms, where the worst performing queries are removed and the best performing queries are derived. The distinction between queries is determined by an evaluation function. It should be noted that the position of this new query inherits the position of the global optimal query ( ), while the speed is based on the speed of the global optimal query with a certain disturbance ( ), this perturbation can be regarded as a slight adjustment to the optimal query, the purpose of which is to explore new possible solution spaces while maintaining the characteristics of the optimal solution, so as to find a better solution.

[0070] In the improved particle swarm optimization algorithm, the optimal adversarial sample generation process for the second frame image and each frame image thereafter of the video sequence also includes initializing the query position: by constructing the total perturbation of the previous frame image and the learned perturbation, and applying the total perturbation of the previous frame image and the learned perturbation to the current frame image, wherein the total perturbation of the previous frame image and the learned perturbation can be understood as initializing the query position for accelerating convergence, which is specifically defined as:

[0071] ;

[0072] ;

[0073] in, Indicates The total disturbance in the frame image, Indicates Final adversarial example of frame, Indicates The original image of the frame, Indicates The perturbation learned in the frame image, Indicates that from Frame image to The cross-frame perturbation transfer of frame images is formulated as:

[0074] ;

[0075] in, Indicates The total disturbance in the frame image, Indicates The perturbation learned in the frame image, represents the weight of the total disturbance, represents the weight of the learned perturbation, and It is used to adjust the influence of the previous frame perturbation on the current frame. It should be noted that for the first frame image, the position is generally not initialized. At the same time, if the current frame is considered unsuitable for attack, the search process will be skipped for this frame. is used as an adversarial example for the attack. The above adversarial sample initialization process also speeds up the search process, which is a key factor for attacks in tracking, because tracking sequences exhibit a certain degree of correlation and the interaction between global and adjacent frame perturbations can produce better results.

[0076] The evolutionary search process of this embodiment includes two exit conditions: reaching the maximum number of iterations of the particle swarm optimization algorithm or all queries exceed norm constraint. If the norm is not corrected, they will be frozen. This embodiment not only performs well in global search capability, but also has stability in attack speed, and there will not be a large number of queries in difficult-to-attack sequences.

[0077] 2. Evaluation Function

[0078] To support efficient search, an evaluation function is designed to quantify the difference between the tracker output on adversarial examples and clean images as a metric to evaluate the effectiveness of the attack. However, this embodiment cannot provide the attacker with the desired supervision in terms of bounding box attention.

[0079] Considering the powerful performance of existing trackers, in most scenarios, the bounding boxes output basically overlap with the real position. Therefore, this embodiment uses multi-threading technology to obtain all the output bounding boxes of the clean sequence as a reference for the target position. Generally speaking, an attack in a certain frame will always pass its negative impact to the subsequent frames. Obtaining the output of the clean sequence can also avoid using the output of the clean image of the current frame as a reference when it has been affected, resulting in an inability to accurately evaluate the effectiveness of the attack.

[0080] On this basis, since the reference is not affected by the attack, there will be many cases where the output of the adversarial samples does not overlap with the reference at all. At the same time, the attack impact of the current frame will be transmitted to the subsequent frames, so it is hoped that the attack impact of the current frame is as large as possible. In the case of complete non-overlap, IoU cannot measure the impact of the attack. Therefore, this embodiment considers offset and deformation to measure the effectiveness of the attack, so that the impact of the attack can be measured in various situations.

[0081] The evaluation function of this embodiment is defined as:

[0082] ;

[0083] in, is the evaluation function, and They are obtained through multiple threads. Frame and The bounding box of the original image of the frame, is the bounding box output by the adversarial sample, represents the evaluation weight in time, It represents the metric that considers the offset and deformation of the two bounding boxes. It should be noted that Equivalent to , Equivalent to ; represents the intersection-over-union ratio of two bounding boxes; is the displacement measure, is the deformation measure, As ,Will or As , and They are and The center point of and represents two bounding boxes, refers to the Euclidean distance, is the diagonal of the minimum bounding box, and Indicates the width and height of the target box, and Represents the width and height of the prediction box, and is the width and height of the smallest bounding box that covers the target box and the predicted box.

[0084] Consistent with EIoU including offset and deformation, the quality of adversarial examples can be evaluated even when the bounding boxes do not overlap at all. At the same time, this embodiment also compares the current frame adversarial sample with the clean output of the current frame and the previous frame at the same time to ensure the consistency of the attack.

[0085] Embodiment 2

[0086] This embodiment provides an adversarial sample generation system for misleading target tracking, including:

[0087] Acquisition module: used to acquire the video sequence to be tracked;

[0088] A generation module is used to generate an optimal adversarial sample of a frame image in the video sequence using an evolutionary search strategy, wherein the optimal adversarial sample is used to mislead target tracking, and specifically includes:

[0089] The evolutionary search strategy adopts an improved particle swarm optimization algorithm, and uses particles in the improved particle swarm optimization algorithm as queries for generating adversarial samples. In the improved particle swarm optimization algorithm, the speed of the query in each frame of the image is initialized, and the query position and query speed are iteratively updated based on the query speed initialization, and the optimal query position and query speed are selected to generate the optimal adversarial sample;

[0090] When the generation module adopts the improved particle swarm optimization algorithm, it also includes constructing an evaluation function, which is used to evaluate the effectiveness of the adversarial sample. The formula is:

[0091] ;

[0092] in, is the evaluation function, and They are Frame and The bounding box of the original image of the frame, is the bounding box output by the adversarial sample, represents the evaluation weight in time, represents a metric that considers the offset and deformation of two bounding boxes, represents the intersection-over-union ratio of two bounding boxes; is the displacement measure, is the deformation measure, As ,Will or As , and They are and The center point of and represents two bounding boxes, refers to the Euclidean distance, is the diagonal of the minimum bounding box, and Indicates the width and height of the target box, and Represents the width and height of the prediction box, and is the width and height of the smallest bounding box that covers the target box and the predicted box.

[0093] Embodiment 3

[0094] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the adversarial sample generation method for misleading target tracking described in Embodiment 1 are implemented.

[0095] Embodiment 4

[0096] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the adversarial sample generation method for misleading target tracking described in Embodiment 1 are implemented.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The schemes in the embodiments of the present application may be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0102] Obviously, the above embodiments are merely examples for clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from these are still within the protection scope of the invention.

Claims

1. A method for generating adversarial samples for misleading target tracking, characterized by: include: Step S1: Obtain a video sequence for target tracking; Step S2: using an evolutionary search strategy to generate an optimal adversarial sample of a frame image in the video sequence, wherein the optimal adversarial sample is used to mislead target tracking, specifically comprising: The evolutionary search strategy adopts an improved particle swarm optimization algorithm, and uses particles in the improved particle swarm optimization algorithm as queries for generating adversarial samples. In the improved particle swarm optimization algorithm, the speed of the query in each frame of the image is initialized, and the query position and query speed are iteratively updated based on the query speed initialization, and the optimal query position and query speed are selected to generate the optimal adversarial sample; When the improved particle swarm optimization algorithm is used, step S2 further includes constructing an evaluation function, which is used to evaluate the effectiveness of the adversarial sample, and the formula is: ； in, is the evaluation function, and They are Frame and The bounding box of the original image of the frame, is the bounding box output by the adversarial sample, represents the evaluation weight in time, represents a metric that considers the offset and deformation of two bounding boxes, represents the intersection-over-union ratio of two bounding boxes; is the displacement measure, is the deformation measure, As ,Will or As , and They are and The center point of and represents two bounding boxes, refers to the Euclidean distance, is the diagonal of the minimum bounding box, and Indicates the width and height of the target box, and Represents the width and height of the prediction box, and is the width and height of the smallest bounding box covering the target box and the predicted box; The formula for the update query speed is: ； in, and Indicates speed, respectively represents query In the The iteration and The distance and direction moved in each iteration; represents the inertia weight, is the individual learning factor, is the social learning factor, and are the first and second random values, Yes Query In the The individual historical optimal position in the iteration, All queries in The global historical optimal position in the iteration, Representation query In the The position of the iteration, variable The role of is to reduce the displacement that will worsen the current query, the variable The role of is to promote the current query to converge to the optimal value.

2. The adversarial sample generation method for misleading target tracking according to claim 1, characterized in that: The formula for initializing the speed of the query in each frame of image is: ； in, Yes Query The initial velocity is obtained by the orthogonal combination of tangential perturbation and normal perturbation. Provide initial velocity; the tangential disturbance is random Gaussian noise ; The normal disturbance is , indicating that based on and template adversarial examples Combination composition; represents the normal perturbation function; is the tangential perturbation learning rate; is normal perturbation learning.

3. The adversarial sample generation method for misleading target tracking according to claim 1, characterized in that: The formula for updating the query position is: ； in, Indicates speed, represents query In the The distance and direction moved in each iteration; and Respectively represent queries In the The iteration and The position of the iteration.

4. The adversarial sample generation method for misleading target tracking according to claim 1, characterized in that: The method for selecting the optimal query position and query speed is: In the improved particle swarm optimization algorithm In the iteration, the worst query is removed, and a new query is derived from the best query. The speed and position of the new derived query are generated based on the speed and position of the best query. The formula is: ； ； in, represents the newly derived query position at the kth iteration, represents the optimal query position for the kth query, represents the query speed newly derived in the kth iteration, represents the optimal query speed for the kth iteration, is the tangential perturbation learning rate, is random Gaussian noise.

5. The adversarial sample generation method for misleading target tracking according to claim 1, characterized in that: In the improved particle swarm optimization algorithm, the optimal adversarial sample generation process for the second frame image and each frame image thereafter of the video sequence also includes position initialization of the query: by constructing the total perturbation of the previous frame image and the learned perturbation, and applying the total perturbation of the previous frame image and the learned perturbation to the current frame image, wherein the formula for constructing the total perturbation of the previous frame image and the learned perturbation is: ； ； in, Indicates The total disturbance in the frame image, Indicates Final adversarial example of frame, Indicates The original image of the frame, Indicates The perturbation learned in the frame image, Indicates that from Frame image to The cross-frame perturbation transfer of frame images is formulated as: ； in, Indicates The total disturbance in the frame image, Indicates The perturbation learned in the frame image, represents the weight of the total disturbance, represents the weight of the learned perturbation.

6. A system for generating adversarial samples for misleading target tracking, characterized by: include: Acquisition module: used to acquire the video sequence to be tracked; A generation module is used to generate an optimal adversarial sample of a frame image in the video sequence using an evolutionary search strategy, wherein the optimal adversarial sample is used to mislead target tracking, and specifically includes: The evolutionary search strategy adopts an improved particle swarm optimization algorithm, and uses particles in the improved particle swarm optimization algorithm as queries for generating adversarial samples. In the improved particle swarm optimization algorithm, the speed of the query in each frame of the image is initialized, and the query position and query speed are iteratively updated based on the query speed initialization, and the optimal query position and query speed are selected to generate the optimal adversarial sample; When the generation module adopts the improved particle swarm optimization algorithm, it also includes constructing an evaluation function, which is used to evaluate the effectiveness of the adversarial sample. The formula is: ； in, is the evaluation function, and They are Frame and The bounding box of the original image of the frame, is the bounding box output by the adversarial sample, represents the evaluation weight in time, represents a metric that considers the offset and deformation of two bounding boxes, represents the intersection-over-union ratio of two bounding boxes; is the displacement measure, is the deformation measure, As ,Will or As , and They are and The center point of and represents two bounding boxes, refers to the Euclidean distance, is the diagonal of the minimum bounding box, and Indicates the width and height of the target box, and Represents the width and height of the prediction box, and is the width and height of the smallest bounding box covering the target box and the predicted box; The formula for the update query speed is: ； in, and Indicates speed, respectively represents query In the The iteration and The distance and direction moved in each iteration; represents the inertia weight, is the individual learning factor, is the social learning factor, and are the first and second random values, Yes Query In the The individual historical optimal position in the iteration, All queries in The global historical optimal position in the iteration, Representation query In the The position of the iteration, variable The role of is to reduce the displacement that will worsen the current query, the variable The role of is to promote the current query to converge to the optimal value.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the adversarial sample generation method for misleading target tracking as described in any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the adversarial sample generation method for misleading target tracking as claimed in any one of claims 1 to 5 are implemented.

Images