Reverse neural network hidden attack method and system based on automatic driving perception

Abstract

The invention belongs to the technical field of automatic driving perception attack confrontation, and particularly relates to a reverse neural network hidden attack method and system based on automatic driving perception, and the method comprises the steps: selecting an original image; classifying and identifying the original image to obtain an attack type; extracting and learning the features of the image of the attack type to obtain difference information, and updating the guide direction for generating the attack image; processing the original image and the attack image based on wavelet decomposition to obtain respective multi-scale image information; residual features in the multi-scale information are extracted through the first network system; exchanging the target image information and the attack image information based on nonlinear transformation to obtain wavelet information; inversely transforming the wavelet information to form a antagonistic image; classifying and identifying the adversarial image, and generating an adversarial loss function value; and adjusting the exchange process of the attack image information and the target image information according to the loss function value until the obtained adversarial loss function value is within the threshold range, and attacking the original image by the output adversarial image.

Description

Technical Field

[0001] The present invention belongs to the technical field of autonomous driving perception counterattack, and specifically relates to a reverse neural network covert attack method and system based on autonomous driving perception. Background Art

[0002] In autonomous driving systems, camera image perception is a crucial part, which realizes environmental perception and scene understanding by analyzing the visual information around the vehicle. However, it is precisely because of its wide application and high sensitivity to the environment that camera image perception systems have become one of the main targets of digital adversarial attacks. Digital adversarial attacks refer to deliberately designed input data, whose purpose is to deceive machine learning models and cause the models to make incorrect predictions or judgments. For camera image perception systems, digital adversarial attacks may take various forms, such as adding tiny perturbations to images or modifying images to interfere with the normal operation of perception algorithms. These attacks may cause autonomous driving systems to incorrectly identify targets such as traffic signs, pedestrians, and vehicles, which in turn affects their decision-making and behavior planning, posing a serious threat to driving safety.

[0003] Existing digital attack methods have obvious problems when targeting the camera image perception of autonomous driving systems. First, the disturbances or modifications introduced by many attack methods often cause visible noise or distortion in the image, making the attack easy to detect. Second, some attacks may significantly change the size or proportion of the image, attracting people's attention. Finally, some attack methods may introduce unreasonable transformations or deformations, making the image visually unnatural and exposing the existence of the attack. In order to solve these problems and make the attack more covert and effective, it is possible to consider using adversarial generative networks to generate realistic attack samples, adopting physical perception attacks, combining stealth assessment techniques, and using multimodal attack methods.

[0004] Visible noise and distortion: The perturbations or modifications introduced into the image by existing technology solutions often result in noise visible to the naked eye, making the attack easy to detect. These visible changes may affect the visual quality of the image and reduce the realism of the image, thus exposing the existence of the attack.

[0005] Image size change: Existing technical solutions may cause the size of the modified image to be inconsistent with the original image size, that is, the storage size of the image changes. This mutation may arouse suspicion and increase the possibility of the attack being detected, especially when the storage size needs to be kept consistent during image processing, the detectability of the attack will be further enhanced.

[0006] Unnatural transformations and deformations: The transformations or deformations introduced by existing technical solutions may be unreasonable, causing the image to appear visually unnatural. Such unnatural changes may make people suspicious, thus exposing the existence of an attack. For example, some objects in the image may appear in shapes or postures that do not conform to the actual situation, or in unreasonable positions in the image. Summary of the invention

[0007] The present invention is proposed based on the above-mentioned requirements of the prior art. The technical problem to be solved by the present invention is to provide a covert attack method and system for a reverse neural network based on autonomous driving perception.

[0008] In order to solve the above problems, the technical solution provided by the present invention includes:

[0009] A reverse neural network covert attack method based on autonomous driving perception is provided, comprising: S1 selecting an attacked target, wherein the attacked target is an original image; S2 classifying and identifying the original image, taking the type closest to the original image as the target type, taking the type least similar to the original image as the attack type, and selecting an attack image based on the attack type; the classification and identification is completed by a classifier; S3 extracting and learning features of the image of the attack type, combining the output features of the classifier to obtain difference information, and updating the guidance direction of the attack image according to the difference generation information; S4 processing the original image and the attack image based on wavelet decomposition to obtain multi-scale image information of each; S5 extracting the original image through a first network system The residual features in the multi-scale information of the image are used as the first information, and the residual features in the multi-scale information of the attack image are extracted as the second information through the first network; the first network system includes a residual network; S6 exchanges the target image information and the attack image information based on a nonlinear transformation to obtain wavelet information, the target image information includes the first information, and the attack image information includes the second information; S7 inversely transforms the wavelet information to form an adversarial image; S8 classifies and identifies the adversarial image, and generates an adversarial loss function value; S9 adjusts the exchange process of the attack image information and the target image information according to the loss function value, repeats S6-S8, until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

[0010] By utilizing the information preservation characteristics of reversible neural networks, this method can achieve a covert attack on the image perception algorithm of self-driving cars. By adding class-specific information and deleting the semantic information of the original class at the same time, no obvious attack information such as noise visible to the naked eye will appear, making the attack behavior more covert and difficult to detect. By learning the gradient information of the attack image and combining wavelet decomposition with residual network feature extraction, the information interaction and exchange between the attack image and the attacked image is realized. This information interaction is based on the reversible information exchange module to exchange equal pixels, generate more covert attack samples without changing the image size. The adversarial image samples are evaluated and fed back by the classification network with pre-trained weights, and the results guide the reversible information exchange module to conduct a new round of data exchange. This adaptive learning and feedback mechanism makes the attack method more flexible and targeted, and can continuously adjust and optimize the attack samples to improve the success rate and concealment of the attack.

[0011] Preferably, the original image is classified and identified by a classifier, and the type closest to the original image and the type least similar to the original image are obtained, which are expressed as: Among them, I represents the original image, Represents all types in the dataset, It is used to determine the type that maximizes the classification function, f class (I) is a classification function used to identify the type of image I, c likely is the type closest to the original image, i.e. the target type, c unlikely The type that is least similar to the original image; the least similar type is used as the attack type: C target =c unlikely , where c target The attack type.

[0012] Preferably, S3 extracts and learns the features of the attack type image, obtains difference information by combining the output features of the classifier, and updates the guidance direction of the attack image according to the difference generation information, including: adv =g target (f target -f class (I)), where P adv is the generated new attack image, g target is the target guidance function, f target It is the key feature information.

[0013] Preferably, an attention mechanism for the frequency domain is introduced into the residual network to adaptively adjust the weights of features of different frequencies, which is expressed as: Among them, y represents the weighted feature, x is the input feature of the high-frequency wavelet, and through an attention mechanism Features of different frequencies are weighted, and ⊙ represents element-by-element multiplication.

[0014] Preferably, the residual network further includes a residual block, which is expressed as: Among them, y′ is the output of the residual block, is the residual function, x' represents the different features of the image, and W is a learned weight matrix used to perform a linear transformation on the input features.

[0015] Preferably, the residual network includes a multi-scale feature fusion module, which fuses high-frequency wavelet features of different scales, expressed as: Among them, x1 and x2 are high-frequency wavelet features of two different scales, · represents the concatenation operation of features, is a learned function used for feature fusion, and y″ is the feature integrated from two high-frequency wavelet features.

[0016] Preferably, the first network further includes a dynamic residual learning module, which adaptively adjusts the learning strategy and parameters of the residual block according to different frequency characteristics of the input features, expressed as: The input of the dynamic residual module is x″, and the output of the dynamic residual module is y″′. is a learned residual function, and A(x″) is an adaptive parameter used to adjust the learning process of the residual function.

[0017] Preferably, the target image information and the attack image information are exchanged based on nonlinear transformation to obtain wavelet information, which is expressed as: F exchange =ε(F adv , F original ), and obtain the new feature representation F exchange , these two features are exchanged through a nonlinear transformation function ε(·).

[0018] Preferably, S8 classifies and identifies adversarial images and generates adversarial loss function values, including: using a pre-trained classifier f pretrained For the generated adversarial image I adv Perform classification and obtain classification results The degree of deviation between the generated adversarial image and the target type is measured by the adversarial loss function, which is expressed as: L adv (I adv ,y target )=-log P(y target |Iadv )

[0019] Among them, y target is the attack type, P(y target |I adv ) is the adversarial image I given by the classifier adv The probability of belonging to the attack type, L adv is the loss function.

[0020] A reverse neural network covert attack method based on autonomous driving perception is also provided, including: a selection module, which selects an attacked target, wherein the attacked target is an original image; a classification and recognition module, which classifies and recognizes the original image, takes the type closest to the original image as the target type, takes the type least similar to the original image as the attack type, and selects an attack image based on the attack type; a direction guidance module, which extracts and learns the features of the image of the attack type, obtains difference information in combination with the output features of the classifier, and updates the guidance direction of the attack image based on the difference generation information; a wavelet decomposition module, which processes the original image and the attack image based on wavelet decomposition to obtain their respective multi-scale image information; and a residual network module, which extracts the residual features in the multi-scale information of the original image as the first information through the first network system. The residual features in the multi-scale information of the attack image are extracted as the second information through the first network; the first network system includes a residual network; an information exchange module, which exchanges the target image information and the attack image information based on a nonlinear transformation to obtain wavelet information, wherein the target image information includes the first information and the attack image information includes the second information; an inverse transformation module, which inversely transforms the wavelet information to form an adversarial image; an adversarial image evaluation module, which classifies and identifies adversarial images and generates an adversarial loss function value; an adversarial image output module, which adjusts the exchange process of the attack image information and the target image information according to the loss function value, feeds back to the information exchange module, and passes through the inverse transformation module and the adversarial image evaluation module in sequence until the adversarial loss function value is within a threshold range, and outputs the corresponding adversarial image to attack the original image.

[0021] Compared with the prior art, the present invention utilizes the information preservation characteristics of reversible neural networks, and the method can realize a covert attack on the image perception algorithm of an autonomous vehicle. By adding class-specific information and deleting the semantic information of the original class at the same time, no obvious attack information such as noise visible to the naked eye will appear, and the attack behavior will be more concealed and difficult to detect. The proposed target image learning module realizes the information interaction and exchange between the attack image and the attacked image by learning the gradient information of the attack image and combining wavelet decomposition with residual network feature extraction. This information interaction is based on the reversible information exchange module to exchange equal pixel points, generate more concealed attack samples without changing the image size. The adversarial image samples are evaluated and fed back by the classification network with pre-trained weights, and the results guide the reversible information exchange module to perform a new round of data exchange. This adaptive learning and feedback mechanism makes the attack method more flexible and targeted, and can continuously adjust and optimize the attack samples to improve the success rate and concealment of the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this specification. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0023] Figure 1 It is a flowchart of the steps of the inverse neural network covert attack method based on autonomous driving perception in the embodiment;

[0024] Figure 2 Schematic diagram of data transmission of the inverse neural network covert attack method based on autonomous driving perception in an embodiment. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] In the description of the embodiments of the present invention, it should be noted that, unless otherwise clearly specified and limited, the term "connected" should be understood in a broad sense, for example, it can be a fixed connection, or a detachable connection, or an integral connection, which can be a mechanical connection, or an electrical connection, which can be a direct connection, or can be indirectly connected through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0027] The terms "top", "bottom", "above", "lower", and "on" used throughout the description are relative to the relative positions of components of a device, such as the relative positions of the top and bottom substrates within a device. It is understood that devices are multifunctional regardless of their orientation in space.

[0028] To facilitate understanding of the embodiments of the present application, further explanation will be given below with reference to specific embodiments in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present application.

[0029] Example 1

[0030] This embodiment provides a reverse neural network covert attack method based on autonomous driving perception, such as Figure 1 and Figure 2 shown.

[0031] The inverse neural network covert attack method based on autonomous driving perception includes:

[0032] S1 selects an attacked target, where the attacked target is an original image.

[0033] Select an attacked image I (i.e., original image) from the dataset as the starting point of the attack.

[0034] S2 classifies and identifies the original image, takes the type closest to the original image as the target type, takes the type least similar to the original image as the attack type, and selects the attack image based on the attack type; the classification and identification is completed by a classifier.

[0035] The image is classified using a common classification model (i.e., classifier). This classification model is usually a pre-trained deep learning model, such as ResNet, VGG, etc., or other models that have been verified to be effective in related fields to ensure the credibility and effectiveness of the attack.

[0036] The classifier is used to infer the type of the original image and identify the type that the original image is most likely to belong to, that is, the type c that is closest to the original image. likely , and at the same time get the type that is least likely to belong to, that is, the type c that is least similar to the original image unlikely . Specifically expressed as:

[0037]

[0038] Among them, I represents the original image, Represents all types in the dataset, It is used to determine the type that maximizes the classification function, f class (I) is a classification function used to identify image type I.

[0039] The closest type is used as the target type, and the least close type is used as the attack type.

[0040] C target =c unlikely

[0041] Among them, c target The attack type.

[0042] Through the above steps, the attack image guidance module selects a picture that is least similar to the attacked image (original image), and this picture is used as the attack image to exchange data with the original image, thereby realizing the attack.

[0043] S3 extracts and learns the features of the attack type image, combines the output features of the classifier to obtain the difference information, and updates the guidance direction of the generated attack image according to the difference generation information.

[0044] By learning the attack type image, we can obtain the key feature information f of the attack type. target .

[0045] Combining the output features of the classifier, the difference information is expressed as: f target -f class (I).

[0046] The guidance direction of generating attack images is updated according to the difference generation information. The process is expressed as:

[0047] P adv =g target (f target -f class (I))

[0048] Among them, P adv is the generated new attack image, g target is the target guidance function.

[0049] The above settings can generate new attack images more accurately and specifically, making it easier for the classifier to mistake them for target types, thereby improving the success rate and effect of the attack.

[0050] S4 processes the original image and the attack image based on wavelet decomposition to obtain their respective multi-scale image information.

[0051] Wavelet decomposition is not only the decomposition of the image, but also has the reversible property of wavelet transform. Wavelet transform is a linear transform that can represent the signal in the time-frequency domain and has good time-frequency locality. This feature makes wavelet transform widely used in image processing, because it can represent the image into multi-scale and multi-directional details while retaining important information of the image. Moreover, due to the reversibility of wavelet transform, the decomposed image can be reconstructed back to the original image through inverse wavelet transform.

[0052] In this embodiment, the wavelet coefficients obtained by wavelet decomposition can be used to exchange and process image information of different scales. The image is decomposed into approximate coefficients and detail coefficients of multiple scales, including four levels of wavelet decomposition: LL (low frequency low frequency), LH (low frequency high frequency), HL (high frequency low frequency) and HH (high frequency high frequency).

[0053] The LL layer contains the overall outline and general structural information of the image.

[0054] The LH layer and the HL layer contain the detailed information of the image in the horizontal and vertical directions, that is, the edge features in the horizontal and vertical directions.

[0055] The HH layer contains the detailed information of the image, including the texture features of the image.

[0056] Among these wavelet coefficients, the high-frequency LL, LH, and HL layers contain the image contour and edge feature information in different directions, and the LL layer includes the texture feature details of the image, which is crucial for data exchange and operation during the attack process. Because the high-frequency wavelet (LL layer) contains detailed features such as image texture, in the reversible information exchange process, exchanging and adjusting the LL layer information can more directly affect the appearance and recognizability of the image, thereby enhancing the pertinence and misleading nature of the attack image.

[0057] S5 extracts residual features from the multi-scale information of the original image as first information through the first network, and extracts residual features from the multi-scale information of the attack image as second information through the first network; the first network includes a residual network.

[0058] In the residual network, an attention mechanism for the frequency domain is introduced to adaptively adjust the weights of features of different frequencies. Assuming x is the input feature of the high-frequency wavelet, through an attention mechanism Weight the features of different frequencies to obtain the weighted feature representation where ⊙ represents element-wise multiplication.

[0059] The residual network includes residual blocks, which are connected through dense connections and residual connections. Assume that the input of the residual block is x, and the output of the residual block is in is the residual function, x' represents the different features of the image, and W is a learned weight matrix used to perform a linear transformation on the input features.

[0060] The residual network includes a multi-scale feature fusion module that can fuse high-frequency wavelet features of different scales. Assume that there are two high-frequency wavelet features x1 and x2 of different scales, and they are fused into an integrated feature representation through a fusion operation. Where. represents the concatenation operation of features, It is a learned function used for feature fusion.

[0061] The first network also includes a dynamic residual learning module, which adaptively adjusts the learning strategy and parameters of the residual block according to the different frequency characteristics of the input features. Assume that the input of the dynamic residual module is x″, and the output of the dynamic residual module is in is a learned residual function, and A(x″) is an adaptive parameter used to adjust the learning process of the residual function.

[0062] S6 exchanges the target image information and the attack image information based on nonlinear transformation to obtain wavelet information, wherein the target image information includes first information and the attack image information includes second information.

[0063] The task of the information exchange module is to exchange information between the attack image and the original image through nonlinear transformation. This exchange maintains the authenticity of the image while introducing adversarial perturbations to increase the effectiveness of the attack. In addition, the amount of exchanged data is small and equal, which can produce extremely high concealment characteristics, making the attack difficult to detect.

[0064] Attack Image I adv and the original image I original Extract features to represent the target image information F adv and attack image information F original .

[0065] The two feature representations are exchanged through the nonlinear transformation function ε(·) to obtain a new feature representation F exchange . This process can be expressed as:

[0066] F exchange =ε(F adv , F original )

[0067] Exchange high-frequency wavelet coefficients, for example:

[0068]

[0069] Finally, by reconstructing the exchanged feature representation, the high-frequency wavelet layer LL of the final adversarial example is obtained. exchange , the information of the original image and the attack image is utilized, and while maintaining the authenticity of the image, adversarial perturbations are introduced to improve the effectiveness of the attack.

[0070] S7 inversely transforms the wavelet information to form an adversarial image.

[0071] The wavelet representation after information exchange is reversely converted into the spatial domain to generate an adversarial image. The exchanged wavelet coefficients are inversely transformed and merged to reconstruct the attack image into an adversarial example image I adv The mathematical representation of the inverse wavelet transform is I adv =IWT(LL exchanged ), where IWT represents the inverse wavelet transform operation. This ensures that the generated adversarial image has the same spatial domain characteristics as the original image, while also containing targeted attack noise, which improves the effectiveness of the attack.

[0072] S8 classifies and identifies adversarial images and generates adversarial loss function values.

[0073] The generated adversarial images are classified using a pre-trained classifier, and the adversarial loss function value is generated as an important indicator of the optimization process.

[0074] Use the pre-trained classifier f pretrained For the generated adversarial image I adv Perform classification and obtain classification results

[0075] Next, define the adversarial loss function L adv , which measures the degree of deviation between the generated adversarial examples and the target type. This loss function can be expressed using the cross entropy loss function:

[0076] L adv (I adv ,y target )=-log P(y target |I adv )

[0077] Among them, y target is the attack type, P(y target |I adv ) is the adversarial image I given by the classifier adv The probability of belonging to the attack type.

[0078] Finally, by calculating the adversarial loss function value Ladv To evaluate the quality of the generated adversarial images and guide the optimization process.

[0079] In this way, the quality assessment module uses the pre-trained classifier to classify the generated adversarial images and generates the adversarial loss function value based on the classification result, which reflects the degree of deviation between the adversarial example and the target type, providing important guidance and evaluation basis for the optimization process.

[0080] S9 adjusts the exchange process of the attack image information and the target image information according to the loss function value, repeats S6-S8 until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

[0081] The loss function value is fed back into the exchange architecture of the attack image information and the target image information. The loss function value reflects the degree of deviation between the currently generated adversarial image and the target type.

[0082] Adaptive optimization is performed according to the adversarial loss function value. The information exchange process adjusts parameters and learning strategies to make the generated adversarial images more targeted and misleading. This process is an iterative optimization process. If the adversarial loss function value is within the range, that is, after classification by the pre-trained classifier with a set threshold, the adversarial image can no longer be correctly classified, then the adaptive optimization can be stopped and the adversarial image can be output; if it fails, further cycles are performed to output the loss function for the image, and continuous learning from the adversarial loss is performed to improve the performance and stability of the attack.

[0083] By interacting with the classifier, that is, reclassifying and identifying the output adversarial images, we can better understand the discrimination criteria of the classifier and adjust the strategy of generating adversarial images accordingly to improve the effectiveness of the attack.

[0084] Through the above process, the feedback information of the adversarial loss function value can be effectively utilized to continuously optimize the generated adversarial image, thereby improving the performance and stability of the attack. This adaptive learning mechanism enables the attack method to adapt to different situations and challenges, with stronger adaptability and generalization capabilities.

[0085] In summary, the present invention selects the least likely type as the attack type and guides the attack according to its characteristics. Next, the characteristics of the attack type are learned, and the attack image is guided to generate a more targeted and misleading adversarial example. Subsequently, the wavelet decomposition module decomposes the image into multi-scale wavelet coefficients and uses their information to attack. Feature extraction uses an innovative method to improve the ability to capture image details. Information is exchanged between the original image and the attack image through nonlinear transformation. The exchanged wavelet coefficients are reversely converted into an image to generate an adversarial image. The quality of the generated adversarial image is evaluated to guide the optimization process. Finally, the adversarial loss function is used to feedback information, continuously optimize the attack method, and improve the attack performance and stability. These modules cooperate with each other to form an effective attack algorithm with strong adaptability and generalization capabilities.

[0086] Example 2

[0087] This embodiment provides a reverse neural network covert attack system based on autonomous driving perception.

[0088] The system includes:

[0089] A selection module selects an attacked target, wherein the attacked target is an original image;

[0090] A classification and recognition module classifies and recognizes the original image, takes the type closest to the original image as the target type, takes the type least similar to the original image as the attack type, and selects the attack image based on the attack type;

[0091] The direction guidance module extracts and learns the features of the attack type image, combines the output features of the classifier to obtain the difference information, and updates the guidance direction of the attack image based on the difference generation information;

[0092] Wavelet decomposition module, which processes the original image and the attack image based on wavelet decomposition to obtain their respective multi-scale image information;

[0093] A residual network module, extracting residual features from the multi-scale information of the original image as first information through a first network system, and extracting residual features from the multi-scale information of the attack image through the first network as second information; the first network system includes a residual network;

[0094] An information exchange module, exchanging target image information and attack image information based on nonlinear transformation to obtain wavelet information, wherein the target image information includes first information and the attack image information includes second information;

[0095] Inverse transformation module, inversely transforms the wavelet information to form an adversarial image;

[0096] Adversarial image evaluation module, which classifies and identifies adversarial images and generates adversarial loss function values;

[0097] The adversarial image output module adjusts the exchange process of attack image information and target image information according to the loss function value, feeds back to the information exchange module, and passes through the inverse transformation module and the adversarial image evaluation module in sequence until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

[0098] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only the specific implementation method of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A covert attack method of reverse neural network based on autonomous driving perception, characterized in that: include: S1 selects an attacked target, where the attacked target is an original image; S2 classifies and identifies the original image, takes the type closest to the original image as the target type, takes the type least similar to the original image as the attack type, and selects the attack image based on the attack type; the classification and identification is completed by a classifier; S3 extracts and learns the features of the attack type image, combines the output features of the classifier to obtain the difference information, and updates the guidance direction of the generated attack image based on the difference generation information; S4 processes the original image and the attack image based on wavelet decomposition to obtain their respective multi-scale image information; S5 extracts residual features from the multi-scale information of the original image as first information through the first network system, and extracts residual features from the multi-scale information of the attack image as second information through the first network; the first network system includes a residual network; S6 exchanges the target image information and the attack image information based on nonlinear transformation to obtain wavelet information, wherein the target image information includes first information and the attack image information includes second information; S7 inversely transforms the wavelet information to form an adversarial image; S8 classifies and identifies adversarial images and generates adversarial loss function values; S9 adjusts the exchange process of the attack image information and the target image information according to the loss function value, repeats S6-S8 until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

2. The inverse neural network covert attack method based on autonomous driving perception according to claim 1 is characterized in that: The original image is classified and identified by the classifier, and the type closest to the original image and the type least similar to the original image are obtained, which can be expressed as: Among them, I represents the original image, Represents all types in the dataset, It is used to determine the type that maximizes the classification function, f class (I) is a classification function used to identify the type of image I, c likely is the type closest to the original image, i.e. the target type, c unlikely is the type least similar to the original image; Use the least similar type as the attack type: c target =c unlikely Among them, c target The attack type.

3. The inverse neural network covert attack method based on autonomous driving perception according to claim 2 is characterized in that: S3 extracts and learns the features of the attack type image, combines the output features of the classifier to obtain difference information, and updates the guidance direction of the generated attack image based on the difference generation information, including: P adv =g target (f target -f class (I)) Among them, P adv is the generated new attack image, g target is the target guidance function, f target It is the key feature information.

4. The inverse neural network covert attack method based on autonomous driving perception according to claim 1 is characterized in that: The attention mechanism for the frequency domain is introduced into the residual network to adaptively adjust the weights of features of different frequencies, which is expressed as: Among them, y represents the weighted feature, x is the input feature of the high-frequency wavelet, and through an attention mechanism Features of different frequencies are weighted, and ⊙ represents element-by-element multiplication.

5. The inverse neural network covert attack method based on autonomous driving perception according to claim 4 is characterized in that: The residual network also includes a residual block, which is expressed as: Among them, y′ is the output of the residual block, is the residual function, x' represents the different features of the image, and W is a learned weight matrix used to perform a linear transformation on the input features.

6. The inverse neural network covert attack method based on autonomous driving perception according to claim 5 is characterized in that: The residual network includes a multi-scale feature fusion module, which fuses high-frequency wavelet features of different scales, expressed as: Among them, x1 and x2 are high-frequency wavelet features of two different scales, · represents the concatenation operation of features, is a learned function used for feature fusion, and y″ is the feature integrated from two high-frequency wavelet features.

7. The inverse neural network covert attack method based on autonomous driving perception according to claim 6 is characterized in that: The first network also includes a dynamic residual learning module, which adaptively adjusts the learning strategy and parameters of the residual block according to the different frequency characteristics of the input features, expressed as: The input of the dynamic residual module is x″, and the output of the dynamic residual module is y″′. is a learned residual function, and A(x″) is an adaptive parameter used to adjust the learning process of the residual function.

8. The inverse neural network covert attack method based on autonomous driving perception according to claim 1 is characterized in that: Based on nonlinear transformation, the target image information and the attack image information are exchanged to obtain the wavelet information, which is expressed as: F exchange =ε(F adv ,F original ) Get the new feature representation F exchange , these two features are exchanged through a nonlinear transformation function ε(·).

9. The inverse neural network covert attack method based on autonomous driving perception according to claim 1 is characterized in that: S8 classifies and identifies adversarial images and generates adversarial loss function values, including: Use the pre-trained classifier f pretrained For the generated adversarial image I adv Perform classification and obtain classification results The degree of deviation between the generated adversarial image and the target type is measured by the adversarial loss function, which is expressed as: L adv (I adv ,y target )=-logP(y target |I adv ) Among them, y target is the attack type, P(y target |I adv ) is the adversarial image I given by the classifier adv The probability of belonging to the attack type, L adv is the loss function.

10. A covert attack method of reverse neural network based on autonomous driving perception, characterized in that: include: A selection module selects an attacked target, wherein the attacked target is an original image; A classification and recognition module classifies and recognizes the original image, takes the type closest to the original image as the target type, takes the type least similar to the original image as the attack type, and selects the attack image based on the attack type; The direction guidance module extracts and learns the features of the attack type image, combines the output features of the classifier to obtain the difference information, and updates the guidance direction of the attack image based on the difference generation information; Wavelet decomposition module, which processes the original image and the attack image based on wavelet decomposition to obtain their respective multi-scale image information; A residual network module extracts residual features from the multi-scale information of the original image as first information through a first network system, and extracts residual features from the multi-scale information of the attack image through the first network as second information; the first network system includes a residual network; An information exchange module, exchanging target image information and attack image information based on nonlinear transformation to obtain wavelet information, wherein the target image information includes first information and the attack image information includes second information; Inverse transformation module, inversely transforms the wavelet information to form an adversarial image; Adversarial image evaluation module, which classifies and identifies adversarial images and generates adversarial loss function values; The adversarial image output module adjusts the exchange process of attack image information and target image information according to the loss function value, feeds back to the information exchange module, and passes through the inverse transformation module and the adversarial image evaluation module in sequence until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

Images