A covert attack method and system for inverse neural networks based on autonomous driving perception

Abstract

The present invention belongs to the technical field of autonomous driving perception counterattack, and specifically relates to a covert attack method and system of an inverse neural network based on autonomous driving perception, including: selecting an original image; classifying and identifying the original image to derive the attack type; extracting and learning the features of the image of the attack type to obtain difference information, and updating the guidance direction of the generated attack image; processing the original image and the attack image based on wavelet decomposition to obtain multi-scale image information of each; extracting residual features in the multi-scale information through a first network system; exchanging target image information and attack image information based on nonlinear transformation to obtain wavelet information; inversely transforming the wavelet information to form an adversarial image; classifying and identifying the adversarial image and generating an adversarial loss function value; adjusting the exchange process of the attack image information and the target image information according to the loss function value until the adversarial loss function value is within a threshold range, and the output adversarial image attacks the original image.

Description

Technical Field

[0001] The present invention belongs to the technical field of autonomous driving perception counterattack, and specifically relates to a covert attack method and system for an inverse neural network based on autonomous driving perception. Background Art

[0002] Camera image perception is a crucial component of autonomous driving systems, enabling environmental awareness and scene understanding by analyzing visual information around the vehicle. However, precisely due to its widespread use and high sensitivity to the environment, camera image perception systems have become a prime target for digital adversarial attacks. Digital adversarial attacks involve intentionally crafting input data to deceive machine learning models, causing them to make incorrect predictions or judgments. For camera image perception systems, digital adversarial attacks can take various forms, such as adding subtle perturbations to images or modifying them to disrupt the proper functioning of perception algorithms. These attacks can cause autonomous driving systems to misidentify objects such as traffic signs, pedestrians, and vehicles, potentially affecting their decision-making and behavioral planning, posing a serious threat to driving safety.

[0003] Existing digital attack methods have significant problems when targeting the camera image perception of autonomous driving systems. First, the perturbations or modifications introduced by many attack methods often cause visible noise or distortion in the image, making the attack easy to detect. Second, some attacks may significantly change the size or scale of the image, attracting attention. Finally, some attack methods may introduce unreasonable transformations or deformations, making the image appear visually unnatural and exposing the existence of the attack. To address these problems and make the attack more covert and effective, it is possible to consider using adversarial generative networks to generate realistic attack samples, adopting physical perception attacks, combining stealth assessment techniques, and using multimodal attack methods.

[0004] Visible noise and distortion: Existing solutions often introduce perturbations or modifications to images, often resulting in visible noise that can be easily detected by the naked eye. These visible changes can affect the visual quality of the image, reducing its fidelity and revealing the presence of an attack.

[0005] Image size changes: Existing solutions may cause the modified image size to be inconsistent with the original image size, meaning that the image storage size changes. This sudden change can arouse suspicion and increase the likelihood of attack detection, especially when the image storage size must be maintained consistent during processing, further enhancing the detectability of the attack.

[0006] Unnatural transformations and deformations: Existing solutions may introduce unreasonable transformations or deformations, causing the image to appear visually unnatural. These unnatural changes can raise suspicion and expose the existence of an attack. For example, certain objects in the image may appear in shapes or poses that are not realistic, or in unreasonable positions within the image. Summary of the Invention

[0007] The present invention is proposed based on the above-mentioned requirements of the prior art. The technical problem to be solved by the present invention is to provide a covert attack method and system for reverse neural networks based on autonomous driving perception.

[0008] In order to solve the above problems, the technical solutions provided by the present invention include:

[0009] A covert attack method based on an inverse neural network for autonomous driving perception is provided, comprising: S1 selecting an attacked target, wherein the attacked target is an original image; S2 classifying and identifying the original image, taking the type closest to the original image as the target type, taking the type least similar to the original image as the attack type, and selecting an attack image based on the attack type; the classification and identification is completed by a classifier; S3 extracting and learning features of the image of the attack type, combining the output features of the classifier to obtain difference information, and updating the guidance direction of the attack image based on the difference generation information; S4 processing the original image and the attack image based on wavelet decomposition to obtain multi-scale image information of each; S5 extracting the original image through a first network system The residual features in the multi-scale information of the image are used as the first information, and the residual features in the multi-scale information of the attack image are extracted as the second information through the first network; the first network system includes a residual network; S6 exchanges the target image information and the attack image information based on a nonlinear transformation to obtain wavelet information, the target image information includes the first information, and the attack image information includes the second information; S7 inversely transforms the wavelet information to form an adversarial image; S8 classifies and identifies the adversarial image, and generates an adversarial loss function value; S9 adjusts the exchange process of the attack image information and the target image information according to the loss function value, repeats S6-S8 until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

[0010] Leveraging the information preservation properties of reversible neural networks, this method enables covert attacks against the image perception algorithms of autonomous vehicles. By simultaneously adding class-specific information and removing semantic information from the original class, the attack is concealed and difficult to detect, eliminating visible noise and other obvious attack information. By learning the gradient information of the attack image and combining wavelet decomposition with residual network feature extraction, information exchange between the attacking and attacked images is achieved. This information exchange, based on a reversible information exchange module, swaps equal pixels, generating more subtle attack samples without changing the image size. The adversarial image samples are evaluated and fed back by a classification network with pretrained weights. The results guide the reversible information exchange module in a new round of data exchange. This adaptive learning and feedback mechanism makes the attack method more flexible and targeted, enabling continuous adjustment and optimization of attack samples, improving the success rate and stealth of the attack.

[0011] Preferably, the original image is classified and identified by a classifier, and the type closest to the original image and the type least similar to the original image are obtained, which can be expressed as: Where I represents the original image, Represents all types in the dataset, Used to determine the type that maximizes the classification function, f class (I) is a classification function used to identify the type of image I, c likely is the type closest to the original image, that is, the target type, c unlikely The type that is least similar to the original image; the least similar type is used as the attack type: C target =c unlikely , where c target The attack type.

[0012] Preferably, S3 extracts and learns the features of the attack type image, combines the output features of the classifier to obtain difference information, and updates the guidance direction of the attack image based on the difference generation information, including: P adv =g target (f target -f class (I)), where P adv is the generated new attack image, g target is the target guidance function, f target It is the key feature information.

[0013] Preferably, an attention mechanism for the frequency domain is introduced into the residual network to adaptively adjust the weights of features of different frequencies, which is expressed as: Among them, y represents the weighted feature, x is the input feature of the high-frequency wavelet, and through an attention mechanism Features of different frequencies are weighted, and ⊙ represents element-by-element multiplication.

[0014] Preferably, the residual network further includes a residual block, which is expressed as: Among them, y′ is the output of the residual block, is the residual function, x' represents the different features of the image, and W is a learned weight matrix used to perform a linear transformation on the input features.

[0015] Preferably, the residual network includes a multi-scale feature fusion module to fuse high-frequency wavelet features of different scales, which can be expressed as: Among them, x1 and x2 are high-frequency wavelet features of two different scales, · represents the splicing operation of features, It is a learned function used for feature fusion, and y″ is the feature integrated from two high-frequency wavelet features.

[0016] Preferably, the first network further includes a dynamic residual learning module, which adaptively adjusts the learning strategy and parameters of the residual block according to the different frequency characteristics of the input features, expressed as: The input of the dynamic residual module is x″, and the output of the dynamic residual module is y″′, where is a learned residual function, and A(x″) is an adaptive parameter used to adjust the learning process of the residual function.

[0017] Preferably, the target image information and the attack image information are exchanged based on nonlinear transformation to obtain wavelet information, which is expressed as: F exchange =ε(F adv , F original ), and get the new feature representation F exchange , these two features are exchanged through the nonlinear transformation function ε(·).

[0018] Preferably, S8 classifies and identifies adversarial images and generates adversarial loss function values, including: using a pre-trained classifier f pretrained For the generated adversarial image I adv Perform classification and obtain classification results The degree of deviation between the generated adversarial image and the target type is measured by the adversarial loss function, which is expressed as: L adv (I adv ,y target )=-log P(y target |I adv )

[0019] Among them, y target is the attack type, P(y target |Iadv ) is the adversarial image I given by the classifier adv The probability of belonging to the attack type, L adv is the loss function.

[0020] A covert attack method of an inverse neural network based on autonomous driving perception is also provided, including: a selection module, which selects an attacked target, wherein the attacked target is an original image; a classification and recognition module, which classifies and recognizes the original image, takes the type closest to the original image as the target type, takes the type least similar to the original image as the attack type, and selects an attack image based on the attack type; a direction guidance module, which extracts and learns the features of the image of the attack type, combines the output features of the classifier to obtain difference information, and updates the guidance direction of the attack image based on the difference generation information; a wavelet decomposition module, which processes the original image and the attack image based on wavelet decomposition to obtain multi-scale image information of each; and a residual network module, which extracts residual features from the multi-scale information of the original image as the first information through the first network system. The residual features in the multi-scale information of the attack image are extracted as the second information through the first network; the first network system includes a residual network; an information exchange module, which exchanges the target image information and the attack image information based on nonlinear transformation to obtain wavelet information, wherein the target image information includes the first information and the attack image information includes the second information; an inverse transformation module, which inversely transforms the wavelet information to form an adversarial image; an adversarial image evaluation module, which classifies and identifies the adversarial image and generates an adversarial loss function value; an adversarial image output module, which adjusts the exchange process of the attack image information and the target image information according to the loss function value, feeds back to the information exchange module, and passes through the inverse transformation module and the adversarial image evaluation module in sequence until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

[0021] Compared to existing technologies, this method leverages the information preservation properties of reversible neural networks to enable covert attacks against the image perception algorithms of autonomous vehicles. By simultaneously adding class-specific information and removing semantic information from the original class, the attack is prevented from appearing as obvious attack information, such as visible noise, making the attack more subtle and difficult to detect. The proposed target image learning module learns the gradient information of the attack image and, combined with wavelet decomposition and residual network feature extraction, enables information exchange between the attacking and attacked images. This information exchange, based on the reversible information exchange module, exchanges equal pixels, generating more subtle attack samples without changing the image size. The adversarial image samples are evaluated and fed back by a classification network with pretrained weights. The results guide the reversible information exchange module in a new round of data exchange. This adaptive learning and feedback mechanism makes the attack method more flexible and targeted, enabling continuous adjustment and optimization of attack samples, improving the success rate and stealth of the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this specification. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0023] Figure 1 This is a flowchart of the steps of the inverse neural network covert attack method based on autonomous driving perception in an embodiment;

[0024] Figure 2 Schematic diagram of data transmission of the inverse neural network covert attack method based on autonomous driving perception in an embodiment. DETAILED DESCRIPTION

[0025] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0026] In the description of the embodiments of the present invention, it should be noted that, unless otherwise specified or limited, the term "connected" should be understood in a broad sense. For example, it can mean a fixed connection, a detachable connection, or an integral connection. It can be a mechanical connection, an electrical connection, a direct connection, or an indirect connection through an intermediate medium. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0027] The terms "top," "bottom," "above," "below," and "on" used throughout the description refer to relative positions of components of a device, such as the relative positions of top and bottom substrates within a device. It will be understood that devices are multifunctional regardless of their orientation in space.

[0028] To facilitate understanding of the embodiments of the present application, further explanation will be given below with reference to specific embodiments in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present application.

[0029] Example 1

[0030] This embodiment provides a method for covert attack of reverse neural network based on autonomous driving perception, such as Figure 1 and Figure 2shown.

[0031] The inverse neural network covert attack method based on autonomous driving perception includes:

[0032] S1 selects an attacked target, where the attacked target is an original image.

[0033] Select an attacked image I (i.e., original image) from the dataset as the starting point of the attack.

[0034] S2 classifies and identifies the original image, uses the type closest to the original image as the target type, uses the type least similar to the original image as the attack type, and selects the attack image based on the attack type; the classification and identification is completed by a classifier.

[0035] The image is classified using a common classification model (i.e., classifier). This classification model is usually a pre-trained deep learning model such as ResNet or VGG, or other models that have been proven effective in related fields to ensure the credibility and effectiveness of the attack.

[0036] The classifier is used to infer the type of the original image and identify the type that the original image is most likely to belong to, that is, the type c that is closest to the original image. likely , and at the same time get the type that is least likely to belong to, that is, the type c that is least similar to the original image unlikely Specific expression is:

[0037]

[0038] Where I represents the original image, Represents all types in the dataset, Used to determine the type that maximizes the classification function, f class (I) is a classification function used to identify image type I.

[0039] The closest type is used as the target type, and the least close type is used as the attack type.

[0040] C target =c unlikely

[0041] Among them, c target The attack type.

[0042] Through the above steps, the attack image guidance module selects an image that is least similar to the attacked image (original image). This image is used as the attack image to exchange data with the original image, thereby achieving the attack.

[0043] S3 extracts and learns the features of attack-type images, combines them with the output features of the classifier to obtain difference information, and updates the guidance direction of attack images based on the difference generation information.

[0044] Obtain the key feature information f of the attack type by learning the attack type image target .

[0045] Combining the output features of the classifier, the difference information is expressed as: f target -f class (I).

[0046] The guidance direction of generating attack images is updated based on the difference generation information. The process is expressed as:

[0047] P adv =g target (f target -f class (I))

[0048] Among them, P adv is the generated new attack image, g target is the target guidance function.

[0049] The above settings can generate new attack images more accurately and specifically, making it easier for the classifier to mistake them for the target type, thereby improving the success rate and effectiveness of the attack.

[0050] S4 processes the original image and the attack image based on wavelet decomposition to obtain their respective multi-scale image information.

[0051] Wavelet decomposition not only decomposes an image but also possesses the reversible property of the wavelet transform. The wavelet transform is a linear transform that can represent signals in the time-frequency domain and exhibits excellent time-frequency locality. This property makes the wavelet transform widely used in image processing, as it can represent images in multi-scale and multi-directional detail while preserving important image information. Furthermore, due to the reversibility of the wavelet transform, the decomposed image can be reconstructed back to the original image through an inverse wavelet transform.

[0052] In this embodiment, the wavelet coefficients obtained by wavelet decomposition can be used to exchange and process image information of different scales. The image is decomposed into approximate coefficients and detail coefficients at multiple scales, including four levels of wavelet decomposition: LL (low frequency low frequency), LH (low frequency high frequency), HL (high frequency low frequency), and HH (high frequency high frequency).

[0053] The LL layer contains the overall outline and general structural information of the image.

[0054] The LH layer and HL layer contain the detailed information of the image in the horizontal and vertical directions, that is, the edge features in the horizontal and vertical directions.

[0055] The HH layer contains the detailed information of the image, including the texture features of the image.

[0056] Among these wavelet coefficients, the high-frequency LL, LH, and HL layers contain information about image contours and edge features in different directions. The LL layer includes detailed image texture features, and the LL layer is crucial for data exchange and manipulation during the attack process. Because the high-frequency wavelet (LL layer) contains detailed features such as image texture, exchanging and adjusting the LL layer information during the reversible information exchange process can more directly affect the image's appearance and recognizability, thereby enhancing the targeted and misleading nature of the attack image.

[0057] S5 extracts residual features from the multi-scale information of the original image as first information through the first network, and extracts residual features from the multi-scale information of the attack image as second information through the first network; the first network includes a residual network.

[0058] The attention mechanism for the frequency domain is introduced into the residual network to adaptively adjust the weights of features of different frequencies. Assuming x is the input feature of the high-frequency wavelet, through an attention mechanism Weight the features of different frequencies to obtain the weighted feature representation where ⊙ represents element-wise multiplication.

[0059] The residual network consists of residual blocks, which are connected through dense connections and residual connections. Assume that the input of the residual block is x, and the output of the residual block is in is the residual function, x' represents the different features of the image, and W is a learned weight matrix used to perform a linear transformation on the input features.

[0060] The residual network includes a multi-scale feature fusion module that can fuse high-frequency wavelet features of different scales. Assume that there are two high-frequency wavelet features x1 and x2 of different scales, and they are fused into an integrated feature representation through a fusion operation. Among them, . represents the splicing operation of features, It is a learned function used for feature fusion.

[0061] The first network also includes a dynamic residual learning module, which adaptively adjusts the learning strategy and parameters of the residual block according to the different frequency characteristics of the input features. Assume that the input of the dynamic residual module is x″, and the output of the dynamic residual module is in is a learned residual function, and A(x″) is an adaptive parameter used to adjust the learning process of the residual function.

[0062] S6 exchanges the target image information and the attack image information based on nonlinear transformation to obtain wavelet information, wherein the target image information includes first information and the attack image information includes second information.

[0063] The information exchange module is responsible for exchanging information between the attack image and the original image through nonlinear transformations. This exchange maintains the image's authenticity while introducing adversarial perturbations, increasing the attack's effectiveness. Furthermore, the small and equal amount of data exchanged creates a highly concealed attack, making it difficult to detect.

[0064] Attack Image I adv and the original image I original Extract features to represent target image information F adv and attack image information F original .

[0065] The two feature representations are exchanged through the nonlinear transformation function ε(·) to obtain the new feature representation F exchange . This process can be expressed as:

[0066] F exchange =ε(F adv , F original )

[0067] Exchange high-frequency wavelet coefficients, for example:

[0068]

[0069] Finally, by reconstructing the exchanged feature representation, the high-frequency wavelet layer LL of the final adversarial example is obtained exchange , it utilizes the information of the original image and the attack image, and introduces adversarial perturbations while maintaining the authenticity of the image, thereby improving the effectiveness of the attack.

[0070] S7 inversely transforms the wavelet information to form an adversarial image.

[0071] The wavelet representation after information exchange is reversely converted into the spatial domain to generate an adversarial image. The exchanged wavelet coefficients are inversely transformed and merged to reconstruct the attack image into an adversarial example image I adv The mathematical representation of inverse wavelet transform is I adv =IWT(LL exchanged ), where IWT represents the inverse wavelet transform operation. This ensures that the generated adversarial image has the same spatial domain characteristics as the original image, while also containing targeted attack noise, improving the effectiveness of the attack.

[0072] S8 classifies and identifies adversarial images and generates adversarial loss function values.

[0073] The generated adversarial images are classified using a pre-trained classifier, and the adversarial loss function value is generated as an important indicator of the optimization process.

[0074] Use the pre-trained classifier f pretrained For the generated adversarial image I adv Perform classification and obtain classification results

[0075] Next, define the adversarial loss function L adv , which measures the degree of deviation between the generated adversarial examples and the target type. This loss function can be expressed using the cross entropy loss function:

[0076] L adv (I adv ,y target )=-log P(y target |I adv )

[0077] Among them, y target is the attack type, P(y target |I adv ) is the adversarial image I given by the classifier adv The probability of belonging to the attack type.

[0078] Finally, by calculating the adversarial loss function value L adv To evaluate the quality of generated adversarial images and guide the optimization process.

[0079] In this way, the quality assessment module uses the pre-trained classifier to classify the generated adversarial images and generates the adversarial loss function value based on the classification results, which reflects the degree of deviation between the adversarial examples and the target type, providing important guidance and evaluation basis for the optimization process.

[0080] S9 adjusts the exchange process of attack image information and target image information according to the loss function value, repeats S6-S8 until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

[0081] The loss function value is fed back into the exchange architecture of the attack image information and the target image information. The loss function value reflects the degree of deviation between the currently generated adversarial image and the target type.

[0082] Adaptive optimization is performed based on the adversarial loss function. The information exchange process adjusts parameters and learning strategies to make the generated adversarial images more targeted and misleading. This process is an iterative optimization process. If the adversarial loss function value is within a certain range, that is, if the adversarial image cannot be correctly classified after classification by the pre-trained classifier with a set threshold, the adaptive optimization is stopped and the adversarial image is output. If it fails, the cycle continues, the image is output with the loss function, and continuous learning from the adversarial loss is carried out to improve the performance and stability of the attack.

[0083] By interacting with the classifier, that is, reclassifying and identifying the output adversarial images, we can better understand the classifier's discrimination criteria and adjust the strategy for generating adversarial images accordingly to improve the effectiveness of the attack.

[0084] Through the above process, we can effectively utilize the feedback information of the adversarial loss function value to continuously optimize the generated adversarial image, thereby improving the performance and stability of the attack. This adaptive learning mechanism enables the attack method to adapt to different situations and challenges, with greater adaptability and generalization capabilities.

[0085] In summary, the present invention selects the least likely type as the attack type and guides the attack based on its characteristics. Next, the characteristics of the attack type are learned, and the attack image is guided to generate more targeted and misleading adversarial examples. Subsequently, the wavelet decomposition module decomposes the image into multi-scale wavelet coefficients, and uses their information to attack. Feature extraction uses innovative methods to improve the ability to capture image details. Information is exchanged between the original image and the attack image through nonlinear transformation. The exchanged wavelet coefficients are inversely converted into an image to generate an adversarial image. The quality of the generated adversarial image is evaluated to guide the optimization process. Finally, the adversarial loss function is used to feedback information, continuously optimize the attack method, and improve the attack performance and stability. These modules work together to form an effective attack algorithm with strong adaptability and generalization capabilities.

[0086] Example 2

[0087] This embodiment provides a reverse neural network covert attack system based on autonomous driving perception.

[0088] The system includes:

[0089] A selection module selects an attacked target, where the attacked target is an original image;

[0090] The classification and recognition module classifies and recognizes the original image, takes the type closest to the original image as the target type, takes the type least similar to the original image as the attack type, and selects the attack image based on the attack type;

[0091] The direction guidance module extracts and learns the features of the attack type image, combines the output features of the classifier to obtain difference information, and updates the guidance direction of the generated attack image based on the difference generation information;

[0092] Wavelet decomposition module, which processes the original image and the attack image based on wavelet decomposition to obtain their respective multi-scale image information;

[0093] A residual network module, which extracts residual features from the multi-scale information of the original image as first information through a first network system, and extracts residual features from the multi-scale information of the attack image through the first network as second information; the first network system includes a residual network;

[0094] an information exchange module for exchanging target image information and attack image information based on nonlinear transformation to obtain wavelet information, wherein the target image information includes first information and the attack image information includes second information;

[0095] Inverse transformation module, inversely transforms the wavelet information to form an adversarial image;

[0096] Adversarial image evaluation module, which classifies and identifies adversarial images and generates adversarial loss function values;

[0097] The adversarial image output module adjusts the exchange process of attack image information and target image information according to the loss function value, feeds back to the information exchange module, and passes through the inverse transformation module and the adversarial image evaluation module in sequence until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

[0098] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of this application. It should be understood that the above description is only the specific implementation methods of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application should be included in the scope of protection of this application.

Claims

1. A covert attack method of reverse neural network based on autonomous driving perception, characterized in that: include: S1 selects an attacked target, where the attacked target is the original image; S2 classifies and identifies the original image, uses the type closest to the original image as the target type, uses the type least similar to the original image as the attack type, and selects an attack image based on the attack type; the classification and identification is completed by a classifier; S3 extracts and learns the features of the attack type image, combines the output features of the classifier to obtain difference information, and updates the guidance direction of the generated attack image based on the difference generation information; S4 processes the original image and the attack image based on wavelet decomposition to obtain their respective multi-scale image information; S5 extracts residual features from the multi-scale information of the original image as first information through the first network system, and extracts residual features from the multi-scale information of the attack image through the first network as second information. The first network system includes a residual network, and an attention mechanism for the frequency domain is introduced into the residual network to adaptively adjust the weights of features of different frequencies, which is expressed as: in, represents the weighted features, It is the input feature of high-frequency wavelet, through an attention mechanism Weighting the features of different frequencies, Represents element-wise multiplication; The residual network also includes a residual block, which is expressed as: in, is the output of the residual block, is the residual function, Represents different features of the image, is a learned weight matrix used to linearly transform the input features; The residual network includes a multi-scale feature fusion module, which fuses high-frequency wavelet features of different scales, expressed as: in, and are high-frequency wavelet features of two different scales, Represents the splicing operation of features, Is a learned function used for feature fusion, It is a feature integrated from two high-frequency wavelet features; The first network also includes a dynamic residual learning module, which adaptively adjusts the learning strategy and parameters of the residual block according to the different frequency characteristics of the input features, expressed as: Among them, the input of the dynamic residual module is , the output of the dynamic residual module is ,in is a learned residual function, It is an adaptive parameter used to adjust the learning process of the residual function; S6 exchanges the target image information and the attack image information based on nonlinear transformation to obtain wavelet information, wherein the target image information includes first information and the attack image information includes second information; S7 inversely transforms the wavelet information to form an adversarial image; S8 classifies and identifies adversarial images and generates adversarial loss function values; S9 adjusts the exchange process of attack image information and target image information according to the loss function value, repeats S6-S8 until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

2. The inverse neural network covert attack method based on autonomous driving perception according to claim 1 is characterized in that: The classifier is used to classify and identify the original image, and the type that is closest to the original image and the type that is least similar to the original image are obtained, which can be expressed as: in, represents the original image, Represents all types in the dataset, Used to determine the type that maximizes the classification function. Is a classification function used to identify images type, is the type closest to the original image, that is, the target type, is the type least similar to the original image; Use the least similar type as the attack type: in, The attack type.

3. The inverse neural network covert attack method based on autonomous driving perception according to claim 2 is characterized in that: S3 extracts and learns the features of attack-type images, combines them with the output features of the classifier to obtain difference information, and updates the guidance direction of attack images based on the difference generation information, including: in, is the new attack image generated, is the target guidance function, It is the key feature information.

4. The inverse neural network covert attack method based on autonomous driving perception according to claim 1 is characterized in that: Based on the nonlinear transformation, the target image information and the attack image information are exchanged to obtain the wavelet information, which can be expressed as: Get new feature representation , through the nonlinear transformation function Swap these two features.

5. The inverse neural network covert attack method based on autonomous driving perception according to claim 1 is characterized in that: S8 classifies and identifies adversarial images and generates adversarial loss function values, including: Using a pre-trained classifier Generated adversarial images Perform classification and obtain classification results ; The degree of deviation between the generated adversarial image and the target type is measured by the adversarial loss function, which is expressed as: in, Is the attack type, is the adversarial image given by the classifier The probability of belonging to the attack type, is the loss function.

6. A reverse neural network covert attack system based on autonomous driving perception, characterized by: include: A selection module selects an attacked target, where the attacked target is an original image; a classification and recognition module that classifies and recognizes the original image, uses the type closest to the original image as the target type, uses the type least similar to the original image as the attack type, and selects an attack image based on the attack type; the classification and recognition is performed by a classifier; The direction guidance module extracts and learns the features of the attack type image, combines the output features of the classifier to obtain difference information, and updates the guidance direction of the generated attack image based on the difference generation information; Wavelet decomposition module, which processes the original image and the attack image based on wavelet decomposition to obtain their respective multi-scale image information; The residual network module extracts residual features from the multi-scale information of the original image as the first information through the first network system, and extracts residual features from the multi-scale information of the attack image through the first network as the second information; the first network system includes a residual network; an attention mechanism for the frequency domain is introduced into the residual network to adaptively adjust the weights of features of different frequencies, which is expressed as: in, represents the weighted features, It is the input feature of high-frequency wavelet, through an attention mechanism Weighting the features of different frequencies, Represents element-wise multiplication; The residual network also includes a residual block, which is expressed as: in, is the output of the residual block, is the residual function, Represents different features of the image, is a learned weight matrix used to linearly transform the input features; The residual network includes a multi-scale feature fusion module, which fuses high-frequency wavelet features of different scales, expressed as: in, and are high-frequency wavelet features of two different scales, Represents the splicing operation of features, Is a learned function used for feature fusion, It is a feature integrated from two high-frequency wavelet features; The first network also includes a dynamic residual learning module, which adaptively adjusts the learning strategy and parameters of the residual block according to the different frequency characteristics of the input features, expressed as: Among them, the input of the dynamic residual module is , the output of the dynamic residual module is ,in is a learned residual function, is an adaptive parameter used to adjust the learning process of the residual function; an information exchange module, which exchanges target image information and attack image information based on nonlinear transformation to obtain wavelet information, wherein the target image information includes the first information and the attack image information includes the second information; Inverse transformation module, inversely transforms the wavelet information to form an adversarial image; Adversarial image evaluation module, which classifies and identifies adversarial images and generates adversarial loss function values; The adversarial image output module adjusts the exchange process of attack image information and target image information according to the loss function value, feeds back to the information exchange module, and passes through the inverse transformation module and the adversarial image evaluation module in sequence until the adversarial loss function value is within the threshold range, and outputs the corresponding adversarial image to attack the original image.

Images