Hybrid-mode anti-attack method and system based on laser radar point cloud

Abstract

The invention discloses a mixed mode anti-attack method and system based on a laser radar point cloud. The method comprises the following steps: acquiring an original point cloud; sequentially performing frequency domain transformation, disturbance and inverse transformation processing on the original point cloud to generate a disturbance point cloud; generating an initial antagonistic point cloud based on the disturbance point cloud; optimizing the initial antagonistic point cloud to obtain first antagonistic disturbance, wherein the first antagonistic disturbance comprises the following steps: constructing a target function based on a Hausdorff distance and a chamfering distance between the antagonistic point cloud and the original point cloud; obtaining a first antagonistic disturbance by minimizing the objective function, including: calculating gradient information in the current iteration; the step length is adjusted according to gradient information in the current iteration, the antagonistic disturbance in the next round of iteration is determined, and the first antagonistic disturbance is output after iteration is conducted for the preset number of times; and processing the original point cloud and the first adversarial disturbance based on shape prior guidance to generate an optimal adversarial point cloud so as to carry out adversarial attack. According to the method, the attack resisting effect and robustness are improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and more particularly to a hybrid mode counterattack method and system based on laser radar point cloud. Background Art

[0002] With the continuous development of autonomous driving technology and environmental perception systems, LiDAR has become a major environmental perception sensor used to obtain three-dimensional scene information around the vehicle. However, this has led to higher requirements for the safety and reliability of LiDAR systems. It has been found that LiDAR systems are vulnerable to adversarial attacks. Attackers can deceive autonomous driving systems by modifying LiDAR point cloud data, causing the system to make wrong decisions and even cause traffic accidents. Therefore, researching and developing an effective adversarial attack method is crucial to ensuring the safety and reliability of LiDAR systems. Summary of the invention

[0003] The present invention is proposed based on the above-mentioned requirements of the prior art. The technical problem to be solved by the present invention is a hybrid mode counter-attack method and system based on lidar point cloud to improve the effect and robustness of the counter-attack.

[0004] In order to solve the above problems, the present invention is implemented by adopting the following technical solutions:

[0005] A hybrid mode adversarial attack method based on laser radar point cloud, the method comprising: obtaining an original point cloud; performing frequency domain transformation, perturbation and inverse transformation processing on the original point cloud in sequence to generate a perturbed point cloud; generating an initial adversarial point cloud based on the perturbed point cloud, comprising: calculating a sensitivity score of each point in the perturbed point cloud; selecting key points based on the sensitivity scores; moving the key points to the center of the point cloud to generate an initial adversarial point cloud; optimizing the initial adversarial point cloud to obtain a first adversarial perturbation, comprising: optimizing the Hausdorff distance and chamfer between the adversarial point cloud and the original point cloud; distance, construct an objective function; obtain a first adversarial perturbation by minimizing the objective function, including: calculating the gradient of the adversarial loss function of the sum of the adversarial point cloud and the adversarial perturbation in the current iteration, and obtaining the gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration, determining the adversarial perturbation in the next round of iteration, iterating a preset number of times to output the first adversarial perturbation, wherein the gradient information is directly proportional to the amplitude of the adjusted step size; processing the original point cloud and the first adversarial perturbation based on shape prior guidance, and generating an optimal adversarial point cloud for adversarial attack.

[0006] Optionally, the original point cloud is sequentially subjected to frequency domain transformation, perturbation and inverse transformation processing to generate a perturbed point cloud, including: performing frequency domain transformation on the original point cloud, and performing frequency analysis on the transformed frequency domain to obtain a first frequency component and a second frequency component, wherein the first frequency is less than the second frequency; perturbing the first frequency component, and recombining the disturbed first frequency component with the second frequency component to obtain first frequency domain data; and inverse transforming the first frequency domain data to obtain a perturbed point cloud.

[0007] Optionally, the key point is moved to the center of the point cloud to obtain the moved key point, which is expressed as: m′ i =m i +α·(Cm i ), where m′ i Indicates the coordinates of the key point after moving, m i represents the coordinates of the key point before moving, α represents the parameter controlling the moving step, C represents the center of the point cloud, and i represents the identification number of the point in the point cloud.

[0008] Optionally, based on the Hausdorff distance and chamfer distance between the adversarial point cloud and the original point cloud, an objective function is constructed, which is expressed as: L(X adv ,X)=λ 1 Chamfer (X adv ,X)+λ 2 ·Hausdorff(X adv ,X), where L(X adv ,X) represents the objective function, X adv represents the adversarial point cloud, X represents the original point cloud, and λ 1 Represents the weight parameter of the chamfer distance, Chamfer() represents the chamfer distance, λ 2 Represents the weight parameter of Hausdorff distance, and Hausdorff() represents Hausdorff distance.

[0009] Optionally, the step size is adjusted according to the gradient information in the current iteration to determine the adversarial perturbation in the next iteration, which is expressed as: Where ΔX (t+1) represents the adversarial perturbation in the t+1th iteration, ΔX (t) represents the adversarial perturbation in the tth iteration, η (t) represents the step size in the tth iteration, Represents the gradient information in the current iteration, represents the adversarial loss function, Represents the adversarial point cloud in the tth iteration.

[0010] Optionally, calculating the sensitivity score of each point in the perturbed point cloud includes: reducing the dimension of each point in the perturbed point cloud; obtaining the best attack direction of each point after the dimension reduction based on a white box model attack test; and obtaining the sensitivity score of the point based on the best attack direction.

[0011] Optionally, the original point cloud and the first adversarial perturbation are processed based on the shape prior guidance to generate an optimal adversarial point cloud, which is expressed as: Among them, ΔX′ is the optimal adversarial point cloud, X represents the original point cloud, Indicates The adversarial perturbation ΔX corresponding to the minimum value is obtained, where the initial value of ΔX is the first adversarial perturbation, represents the adversarial loss function, λ represents the regularization parameter, represents the shape prior regularization term.

[0012] Optionally, the shape prior regularization term is determined based on a smoothness constraint or a local connectivity constraint, including: the expression of the smoothness constraint is: Among them, i represents the identification number of the point in the point cloud, N represents the total number of points in the point cloud, and δx i represents the adversarial perturbation numbered i, represents the gradient; the expression of the local connectivity constraint is: δx j || 2 ,in, Represents point x i The local area, j represents The data in δx j represents the adversarial perturbation of point numbered j.

[0013] Optionally, the adversarial loss function is expressed as: in, represents the adversarial loss function, I adv Represents the input data of the adversarial loss function, y target represents the target category, P(y target |I adv ) represents the probability that the adversarial point cloud generated by the classifier belongs to the target category.

[0014] A hybrid mode adversarial attack system based on laser radar point cloud, the system comprises: an acquisition module, which acquires an original point cloud; a first processing module, which sequentially performs frequency domain transformation, perturbation and inverse transformation processing on the original point cloud to generate a perturbed point cloud; a second processing module, which generates an initial adversarial point cloud based on the perturbed point cloud, including: calculating a sensitivity score of each point in the perturbed point cloud; selecting a key point based on the sensitivity score; moving the key point to the center of the point cloud to generate an initial adversarial point cloud; an optimization module, which optimizes the initial adversarial point cloud to obtain a first adversarial perturbation, including: optimizing the first adversarial point cloud based on the relationship between the adversarial point cloud and the original point cloud; Hausdorff distance and chamfer distance are used to construct an objective function; a first adversarial perturbation is obtained by minimizing the objective function, including: calculating the gradient of the adversarial loss function of the sum of the adversarial point cloud and the adversarial perturbation in the current iteration, and obtaining the gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration, determining the adversarial perturbation in the next round of iteration, and outputting the first adversarial perturbation after a preset number of iterations, wherein the gradient information is directly proportional to the amplitude of the adjusted step size; a shape guidance module processes the original point cloud and the first adversarial perturbation based on shape prior guidance to generate an optimal adversarial point cloud for adversarial attack.

[0015] Compared with the prior art, the present invention provides a hybrid mode adversarial attack method and system based on LiDAR point cloud, which not only considers the geometric features and shape information of point cloud, but also makes full use of the frequency domain features of point cloud, thereby enhancing the versatility and generalization ability of the attack method, making the attack method have good applicability to different types of point cloud data and different attack scenarios, while maintaining the imperceptibility and semantic information of adversarial samples. By utilizing the characteristics and prior knowledge of point cloud data, more realistic and imperceptible adversarial samples are generated, which improves the attack effect and success rate of point cloud data. The robustness and imperceptibility of adversarial attacks are enhanced, making the attack on deep models more concealed and effective; the optimization algorithm of the present invention ensures that adversarial samples can deceive deep models and maintain the original features and semantic information of point clouds, thereby improving the availability and acceptability of attacks; by comprehensively considering a variety of attack methods and adversarial strategies, and dynamically adjusting according to different attack scenarios and complex environments, to cope with a variety of attack scenarios and complex environments. The present invention expands the research scope of the attack field and helps to strengthen the security protection of point cloud data. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this specification. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0017] Figure 1 This is a flowchart of a hybrid mode counterattack method based on lidar point cloud provided in this embodiment. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] To facilitate understanding of the embodiments of the present invention, further explanation will be given below with reference to specific embodiments in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the protection scope of the present invention.

[0020] Example 1

[0021] In the prior art, gradient information attacks usually use the gradient information of the model to generate adversarial samples, but this method may over-rely on the gradient calculation of the model and ignore the characteristics of the input data itself. Therefore, when the attacker cannot obtain the gradient information of the model, this attack method may fail. Due to the characteristics of point cloud data such as unstructured, high dimensionality and sparsity, it may be difficult to directly apply gradient information attacks, because the gradient calculation of point cloud data is relatively complex, and it is difficult for attackers to effectively use gradient information to generate adversarial samples. Optimization problem attacks usually generate minimum perturbations by solving optimization problems, but the high dimensionality and complexity of point cloud data increase the difficulty of solving optimization problems, so that attackers need more computing resources and time to find effective adversarial samples. Existing optimization problem attack methods may not fully consider the characteristics of point cloud data, such as geometric structure, shape information and frequency domain characteristics, resulting in the generated adversarial samples may not be effective or imperceptible enough. The scope of application of attack methods based on point cloud characteristics may be limited by the characteristics of point cloud data. For example, factors such as noise, deformation and occlusion may affect the effectiveness of attack methods. Attack methods based on point cloud characteristics may be designed for specific point cloud data features, lack universality and generalization capabilities, and are difficult to cope with different types of point cloud data and different attack scenarios.

[0022] To solve the problems of the prior art, this embodiment provides a hybrid mode counterattack method based on lidar point cloud, the process of which is as follows: Figure 1 As shown, including:

[0023] S1 obtains the original point cloud.

[0024] The original point cloud of the target is obtained through LiDAR.

[0025] S2 performs frequency domain transformation, perturbation and inverse transformation on the original point cloud in sequence to generate a perturbed point cloud.

[0026] By analyzing and perturbing the frequency domain representation of the original point cloud, the overall shape and semantic information of the point cloud are maintained, while adversarial perturbations are introduced.

[0027] S200 performs frequency domain transformation on the original point cloud, and performs frequency analysis on the transformed frequency domain to obtain a first frequency component and a second frequency component.

[0028] The original point cloud is converted into frequency domain representation using graph Fourier transform. Assuming the original point cloud is X, its frequency domain representation is X freq =GFT(X), where X freq It is represented in the frequency domain, and GFT stands for Graph Fourier Transform algorithm.

[0029] Representing X in the frequency domain freq Decomposed into the first frequency component X low and the second frequency component X high , wherein the first frequency is less than the second frequency. A threshold or other method may be used to determine the boundary between low frequency and high frequency.

[0030] S210 perturbs the first frequency component, and recombines the perturbed first frequency component with the second frequency component to obtain first frequency domain data.

[0031] For the first frequency component X low Apply perturbations to keep the overall shape and semantic information of the point cloud unchanged. Assume that the perturbation is P low , then the first frequency component after disturbance is X low_perturbed =X low +P low .

[0032] The first frequency component X after disturbance low_perturbed With the second frequency component X high Recombination, get the first frequency domain data X freq_perturbed .

[0033] S220 performs an inverse transformation on the first frequency domain data to obtain a disturbance point cloud.

[0034] The first frequency domain data X freq_perturbed Perform inverse Fourier transform to obtain the perturbed point cloud X perturbed .

[0035] By performing frequency domain transformation on point cloud data, the point cloud is represented as frequency domain features, thereby reducing the reliance on model gradient information. Frequency domain representation can better capture the global features of point cloud data, so that attackers no longer need to directly access the gradient information of the model.

[0036] S3 generates an initial adversarial point cloud based on the perturbed point cloud.

[0037] S300 calculates a sensitivity score for each point in the perturbed point cloud.

[0038] This step includes:

[0039] Perform dimensionality reduction on each point in the perturbed point cloud.

[0040] Based on the white-box model attack test, the optimal attack direction of each point after dimensionality reduction is obtained.

[0041] Based on the optimal attack direction, a sensitivity score of the point is obtained.

[0042] The sensitivity score of each point is calculated to reflect the contribution of the point to the classification results of the deep model.

[0043] S310 selects key points based on the sensitivity scores.

[0044] Assume that every point x in the point cloud X i The sensitivity score is S i , according to the sensitivity score S i , select the key points that are most important to the model decision. These key points may be the points with the highest scores, or they can be filtered by setting a threshold.

[0045] S320 moves the key point toward the center of the point cloud to generate an initial adversarial point cloud.

[0046] Move the selected key point to the center of the point cloud to minimize the impact on the shape of the point cloud. Assuming the center of the point cloud is C, the key point m′ after the move i The expression is:

[0047] m′ i =m i +α·(Cm i )

[0048] Among them, m′ i Indicates the coordinates of the key point after moving, m i represents the coordinates of the key point before moving, α represents the parameter controlling the moving step length, which is used to balance the influence of maintaining the original point cloud shape and moving the key point, C represents the center of the point cloud, and i represents the identification number of the point in the point cloud.

[0049] Delete key points from the original point cloud, keep the moved key points, and generate the initial adversarial point cloud.

[0050] X keypoints =MoveKeyPoints(X perturbed ,S)

[0051] Among them, X keypoints represents the initial adversarial point cloud, MoveKeyPoints represents the algorithm for removing key points, and S represents the sensitivity score. The sensitivity evaluation method is used to find the key points that are most important for the deep model decision, and these key points are moved to the center of the point cloud. Finally, these key points are deleted from the original point cloud to generate the initial adversarial point cloud.

[0052] This step identifies and selects key points based on the generated preliminary adversarial samples. These key points are deleted or moved to introduce further adversarial perturbations. When introducing perturbations, the perturbations are designed based on the features represented in the frequency domain to ensure the effectiveness and imperceptibility of the adversarial samples in the frequency domain. In this way, even if the gradient information of the model cannot be obtained, the attacker can still generate adversarial samples through frequency domain features to increase the imperceptibility and success rate of the attack. In addition, this step can not only increase the diversity of perturbations, but also reduce the solution space of the optimization problem, making the optimization process more efficient.

[0053] S4 optimizes the initial adversarial point cloud to obtain the first adversarial point cloud.

[0054] S400 constructs the objective function based on the Hausdorff distance and chamfer distance between the adversarial point cloud and the original point cloud.

[0055] Using an optimization algorithm, such as gradient descent or evolutionary algorithm, and combining chamfer distance and Hausdorff distance as loss functions, the point cloud is perturbed and optimized. The goal of the optimization is to minimize the distance between the adversarial point cloud and the original point cloud while maintaining deception to the deep model.

[0056] Assume that the original point cloud is X, and the initial adversarial point cloud X keypoints Treat as X adv , where X and X adv Contains N points, the coordinates of each point in X are represented by x i , X adv The coordinates of each point in is denoted as x′ i , i = 1, 2, ..., N, i represents the identification number of the point in the point cloud, and N represents the total number of points in the point cloud. The loss function consists of the chamfer distance and the Hausdorff distance, expressed as L(X adv ,X), which is expressed as:

[0057] L(X adv ,X)=λ 1 Chamfer (X adv ,X)+λ 2 ·Hausdorff(X adv ,X)

[0058] Among them, L(X adv ,X) represents the objective function, X adv represents the adversarial point cloud, X represents the original point cloud, and λ 1 Represents the weight parameter of the chamfer distance, Chamfer() represents the chamfer distance, λ 2 Represents the weight parameter of Hausdorff distance, and Hausdorff() represents Hausdorff distance.

[0059] S410 obtains a first adversarial perturbation by minimizing the objective function.

[0060] Calculate the gradient of the adversarial loss function of the sum of the adversarial point cloud and the adversarial perturbation in the current iteration to obtain the gradient information in the current iteration; adjust the step size according to the gradient information in the current iteration, determine the adversarial perturbation in the next round of iteration, and output the first adversarial perturbation after a preset number of iterations, wherein the gradient information is directly proportional to the amplitude of the adjusted step size.

[0061] The step size is dynamically adjusted according to the gradient information in the optimization process to avoid falling into the local optimal solution and find the adversarial perturbation faster. Specifically, in each step of the optimization process, the gradient of the adversarial loss function in the current iteration is calculated as the sum of the adversarial point cloud and the adversarial perturbation to obtain the gradient information in the current iteration. in Represents the adversarial loss function. Then, the step size η is dynamically adjusted according to the current gradient to ensure that the adversarial perturbation is updated more significantly when the gradient is large, and a smaller step size is taken when the gradient is small to prevent excessive oscillation or skipping the optimal solution. During the optimization process, the step size is dynamically adjusted according to the gradient information to find the adversarial perturbation faster. The expression of the process is as follows:

[0062]

[0063] Where ΔX (t+1) represents the adversarial perturbation in the t+1th iteration, ΔX (t) represents the adversarial perturbation in the tth iteration, η (t) represents the step size in the tth iteration, Represents the gradient information in the current iteration, represents the adversarial loss function, Represents the adversarial point cloud in the tth iteration.

[0064] This step minimizes the impact of the disturbance by adjusting the position or attributes of the point cloud data, and ensures that the adversarial sample can deceive the deep model while maintaining the original features and semantic information of the point cloud. Using a variable step-size attack strategy, dynamically adjusting the size and direction of the disturbance according to the change of the optimization goal, and comprehensively considering the success rate of the attack and the impact of the disturbance, it can more flexibly respond to gradient changes in the optimization process, thereby more effectively finding adversarial disturbances and achieving better optimization results in different situations.

[0065] S5 processes the original point cloud and the first adversarial perturbation based on shape prior guidance to generate the optimal adversarial point cloud for adversarial attack.

[0066] Shape prior guidance refers to the use of shape prior or prior knowledge of object structure to guide the generation of perturbations to ensure that the generated adversarial point cloud looks geometrically reasonable and can deceive the target deep model.

[0067] Assume that the original point cloud is X = {x 1 ,x 2 ,…,x i ,…,x N}, the adversarial perturbation is ΔX={δx 1 ,δx 2 ,…,δx i ,…,δx N}, where δx i Represents x i If we consider the adversarial perturbation of , the shape prior guidance can be applied in the following way:

[0068]

[0069] Among them, ΔX′ is the optimal adversarial point cloud, X represents the original point cloud, Indicates The adversarial perturbation ΔX corresponding to the minimum value is obtained, where the initial value of ΔX is the first adversarial perturbation, and λ represents the regularization parameter, which is used to balance the adversarial loss and the shape prior regularization term. represents the shape prior regularization term.

[0070] The shape prior regularization term can be designed based on prior knowledge, for example, it can be defined based on the geometric structure or shape characteristics of the object. Specifically, the following shape priors can be considered:

[0071] Smoothness constraint: Maintain the smoothness of the adversarial perturbation to prevent the generated adversarial point cloud from having unnatural jagged edges. This can be achieved by regularizing the perturbation with smoothness, for example, using total variation regularization or Gaussian smoothing.

[0072]

[0073] Among them, δx i represents the adversarial perturbation of point numbered i, Represents the gradient.

[0074] Local connectivity constraints: Ensure that the adversarial perturbations maintain connectivity in local areas to avoid isolated or scattered points in the generated adversarial point cloud. This can be achieved by constraining the local connectivity of the perturbations, for example, by smoothing or connecting the local neighborhood of the perturbations.

[0075]

[0076] in, Represents point x i The local area, j represents The data in δx j represents the adversarial perturbation numbered j.

[0077] By combining the adversarial loss function and the shape prior regularization term, the shape prior guidance can effectively guide the generation of adversarial perturbations, ensuring that the perturbations are more consistent with the true distribution of the point cloud. The generated adversarial point cloud looks geometrically reasonable and can deceive the target deep model, enhancing the effectiveness and imperceptibility of the attack.

[0078] Compared with the prior art, this embodiment provides a hybrid mode adversarial attack method based on LiDAR point cloud, which not only considers the geometric features and shape information of point cloud, but also makes full use of the frequency domain features of point cloud, thereby enhancing the versatility and generalization ability of the attack method, making the attack method more applicable to different types of point cloud data and different attack scenarios, while maintaining the imperceptibility and semantic information of adversarial samples. By utilizing the characteristics and prior knowledge of point cloud data, more realistic and imperceptible adversarial samples are generated, which improves the attack effect and success rate of point cloud data. The robustness and imperceptibility of adversarial attacks are enhanced, making the attack on deep models more concealed and effective; the optimization algorithm of this embodiment ensures that adversarial samples can deceive deep models while maintaining the original features and semantic information of point clouds, thereby improving the availability and acceptability of attacks; by comprehensively considering multiple attack methods and adversarial strategies, and dynamically adjusting according to different attack scenarios and complex environments, to cope with multiple attack scenarios and complex environments. This embodiment expands the research scope of the attack field and helps to strengthen the security protection of point cloud data.

[0079] Example 2

[0080] This embodiment provides a hybrid mode counterattack system based on laser radar point cloud, which implements the hybrid mode counterattack method based on laser radar point cloud described in Embodiment 1, including:

[0081] Get the module to get the original point cloud.

[0082] The first processing module performs frequency domain transformation, perturbation and inverse transformation on the original point cloud in sequence to generate a perturbed point cloud.

[0083] The second processing module generates an initial adversarial point cloud based on the perturbed point cloud, including: calculating a sensitivity score of each point in the perturbed point cloud; selecting key points based on the sensitivity scores; and moving the key points toward the center of the point cloud to generate an initial adversarial point cloud.

[0084] The optimization module optimizes the initial adversarial point cloud to obtain the first adversarial perturbation, including: constructing an objective function based on the Hausdorff distance and chamfer distance between the adversarial point cloud and the original point cloud; obtaining the first adversarial perturbation by minimizing the objective function, including: calculating the gradient of the adversarial loss function of the sum of the adversarial point cloud and the adversarial perturbation in the current iteration, and obtaining the gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration, determining the adversarial perturbation in the next round of iteration, and iterating a preset number of times to output the first adversarial perturbation, wherein the gradient information is directly proportional to the amplitude of the adjusted step size.

[0085] The shape guidance module processes the original point cloud and the first adversarial perturbation based on shape prior guidance to generate the optimal adversarial point cloud for adversarial attack.

[0086] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A hybrid mode counterattack method based on LiDAR point cloud, characterized in that: include: Get the original point cloud; The original point cloud is processed by frequency domain transformation, perturbation and inverse transformation in sequence to generate a perturbed point cloud; Generating an initial adversarial point cloud based on the perturbed point cloud, including: calculating a sensitivity score of each point in the perturbed point cloud; selecting a key point based on the sensitivity score; moving the key point to the center of the point cloud to generate an initial adversarial point cloud; The initial adversarial point cloud is optimized to obtain a first adversarial perturbation, including: constructing an objective function based on the Hausdorff distance and the chamfer distance between the adversarial point cloud and the original point cloud; obtaining the first adversarial perturbation by minimizing the objective function, including: calculating the gradient of the adversarial loss function of the sum of the adversarial point cloud and the adversarial perturbation in the current iteration, and obtaining the gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration, determining the adversarial perturbation in the next round of iteration, and iterating a preset number of times to output the first adversarial perturbation, wherein the gradient information is directly proportional to the amplitude of the adjusted step size; The original point cloud and the first adversarial perturbation are processed based on the shape prior guidance to generate the optimal adversarial point cloud for adversarial attack.

2. The hybrid mode counterattack method based on laser radar point cloud according to claim 1 is characterized in that: The original point cloud is processed by frequency domain transformation, perturbation and inverse transformation in sequence to generate a perturbed point cloud, including: The original point cloud is transformed in the frequency domain, and the transformed frequency domain is subjected to frequency analysis to obtain a first frequency component and a second frequency component, wherein the first frequency is less than the second frequency; the first frequency component is disturbed, and the disturbed first frequency component and the second frequency component are recombined to obtain first frequency domain data; the first frequency domain data is inversely transformed to obtain a disturbed point cloud.

3. The hybrid mode counterattack method based on laser radar point cloud according to claim 1, characterized in that: Move the key point to the center of the point cloud, and its expression is: m′ i =m i +α·(C-m i ) Among them, m′ i Indicates the coordinates of the key point after moving, m i represents the coordinates of the key point before moving, α represents the parameter controlling the moving step, C represents the center of the point cloud, and i represents the identification number of the point in the point cloud.

4. The hybrid mode counterattack method based on laser radar point cloud according to claim 1, characterized in that: Based on the Hausdorff distance and chamfer distance between the adversarial point cloud and the original point cloud, the objective function is constructed, and its expression is: L(X adv ,X)=λ1·Chamfer(X adv ,X)+λ2·Hausdorff(X adv ,X) Among them, L(X adv ,X) is the objective function, X adv represents the adversarial point cloud, X represents the original point cloud, λ1 represents the weight parameter of the chamfer distance, Chamfer( ) represents the chamfer distance, λ2 represents the weight parameter of the Hausdorff distance, and Hausdorff( ) represents the Hausdorff distance.

5. The hybrid mode counterattack method based on laser radar point cloud according to claim 1, characterized in that: The step size is adjusted according to the gradient information in the current iteration to determine the adversarial perturbation in the next iteration, which is expressed as: Where ΔX (t+1) represents the adversarial perturbation in the t+1th iteration, ΔX (t) represents the adversarial perturbation in the tth iteration, η (t) represents the step length in the tth iteration, Represents the gradient information in the current iteration, represents the adversarial loss function, Represents the adversarial point cloud in the tth iteration.

6. The hybrid mode counterattack method based on laser radar point cloud according to claim 1, characterized in that: Calculate the sensitivity score for each point in the perturbed point cloud, including: Perform dimensionality reduction on each point in the perturbed point cloud; Based on the white-box model attack test, the best attack direction for each point after dimensionality reduction is obtained; Based on the optimal attack direction, a sensitivity score of the point is obtained.

7. The hybrid mode counterattack method based on laser radar point cloud according to claim 1, characterized in that: Based on the shape prior guidance, the original point cloud and the first adversarial perturbation are processed to generate the optimal adversarial point cloud, which is expressed as: Among them, ΔX′ is the optimal adversarial point cloud, X represents the original point cloud, Indicates The adversarial perturbation ΔX corresponding to the minimum value is obtained, where the initial value of ΔX is the first adversarial perturbation, represents the adversarial loss function, λ represents the regularization parameter, represents the shape prior regularization term.

8. The hybrid mode counterattack method based on laser radar point cloud according to claim 7 is characterized in that: The shape prior regularization term is determined based on a smoothness constraint or a local connectivity constraint, including: The expression of the smoothness constraint is: Among them, i represents the identification number of the point in the point cloud, N represents the total number of points in the point cloud, and δx i represents the adversarial perturbation of point numbered i, represents the gradient; The expression of the local connectivity constraint is: in, Represents point x i The local area, j represents The data in δx j represents the adversarial perturbation of point numbered j.

9. The hybrid mode counterattack method based on laser radar point cloud according to claim 1, characterized in that: The expression of the adversarial loss function is: in, represents the adversarial loss function, O adv Represents the input data of the adversarial loss function, y target represents the target category, P(y target |I adv ) represents the probability that the adversarial point cloud generated by the classifier belongs to the target category.

10. A hybrid mode counterattack system based on laser radar point cloud, characterized in that: include: Acquisition module, obtains the original point cloud; The first processing module performs frequency domain transformation, perturbation and inverse transformation on the original point cloud in sequence to generate a perturbed point cloud; The second processing module generates an initial adversarial point cloud based on the perturbed point cloud, including: calculating a sensitivity score of each point in the perturbed point cloud; selecting a key point based on the sensitivity score; and moving the key point to the center of the point cloud to generate an initial adversarial point cloud. The optimization module optimizes the initial adversarial point cloud to obtain the first adversarial perturbation, including: constructing an objective function based on the Hausdorff distance and the chamfer distance between the adversarial point cloud and the original point cloud; obtaining the first adversarial perturbation by minimizing the objective function, including: calculating the gradient of the adversarial loss function of the sum of the adversarial point cloud and the adversarial perturbation in the current iteration, and obtaining the gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration, determining the adversarial perturbation in the next round of iteration, and iterating a preset number of times to output the first adversarial perturbation, wherein the gradient information is directly proportional to the amplitude of the adjusted step size; The shape guidance module processes the original point cloud and the first adversarial perturbation based on shape prior guidance to generate the optimal adversarial point cloud for adversarial attack.

Images