A hybrid mode adversarial attack method and system based on lidar point cloud

Abstract

The application discloses a kind of hybrid mode counterattack method and system based on laser radar point cloud, the method includes: obtaining original point cloud;Original point cloud is sequentially subjected to frequency domain transformation, disturbance and inverse transformation processing, and generates disturbance point cloud;Based on disturbance point cloud generates initial counteractive point cloud;Optimization is carried out to initial counteractive point cloud to obtain first counteractive disturbance, including: based on the Hausdorff distance and chamfer distance between counteractive point cloud and original point cloud to construct objective function;By minimizing objective function, first counteractive disturbance is obtained, including: gradient information in current iteration is calculated;According to gradient information in current iteration, step is adjusted, determines the counteractive disturbance in next round iteration, and first counteractive disturbance is output after iteration for a predetermined number of times;Based on shape priori guide to original point cloud and first counteractive disturbance processing generates optimal counteractive point cloud to carry out counterattack.The application improves the effect and robustness of counterattack.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing. Specifically, it relates to a hybrid mode adversarial attack method and system based on laser radar point cloud. BACKGROUND

[0002] With the continuous development of autonomous driving technology and environmental perception systems, laser radar has become a major environmental perception sensor for obtaining three-dimensional scene information around the vehicle. However, it has also brought higher requirements for the safety and reliability of laser radar systems. It has been found that laser radar systems are vulnerable to adversarial attacks, and attackers can deceive autonomous driving systems by modifying laser radar point cloud data, causing the system to make wrong decisions, and even causing traffic accidents. Therefore, it is crucial to research and develop an effective adversarial attack method to ensure the safety and reliability of laser radar systems. SUMMARY

[0003] The present application is based on the above-mentioned needs of the prior art, and the technical problem to be solved by the present application is a hybrid mode adversarial attack method and system based on laser radar point cloud to improve the effectiveness and robustness of adversarial attacks.

[0004] To solve the above problems, the present application is realized by adopting the following technical solutions:

[0005] A hybrid mode adversarial attack method based on laser radar point cloud, the method comprising: obtaining an original point cloud; sequentially performing frequency domain transformation, perturbation and inverse transformation processing on the original point cloud to generate a perturbed point cloud; generating an initial adversarial point cloud based on the perturbed point cloud, including: calculating the sensitivity score of each point in the perturbed point cloud; selecting key points based on the sensitivity score; moving the key points to the center of the point cloud to generate an initial adversarial point cloud; optimizing the initial adversarial point cloud to obtain a first adversarial perturbation, including: constructing an objective function based on the Hausdorff distance and the chamfer distance between the adversarial point cloud and the original point cloud; minimizing the objective function to obtain the first adversarial perturbation, including: calculating the gradient of the adversarial loss function on the sum of the adversarial point cloud and the adversarial perturbation in the current iteration to obtain gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration to determine the adversarial perturbation in the next iteration, and outputting the first adversarial perturbation after a predetermined number of iterations, wherein the gradient information is proportional to the magnitude of the adjusted step size; processing the original point cloud and the first adversarial perturbation based on shape priors to generate an optimal adversarial point cloud for adversarial attack.

[0006] Optionally, the original point cloud is sequentially subjected to frequency domain transformation, perturbation and inverse transformation processing to generate a perturbed point cloud, including: performing frequency domain transformation on the original point cloud, and performing frequency analysis on the transformed frequency domain to obtain a first frequency component and a second frequency component, the first frequency being less than the second frequency; perturbing the first frequency component, and recombining the perturbed first frequency component with the second frequency component to obtain first frequency domain data; and performing inverse transformation on the first frequency domain data to obtain the perturbed point cloud.

[0007] Optionally, the key point is moved to the center of the point cloud to obtain a moved key point, and the expression is: m' i = m i + a·(C-m i ), wherein m' i represents the coordinates of the moved key point, m i represents the coordinates of the key point before moving, a represents a parameter for controlling the moving step, C represents the center of the point cloud, and i represents the identification number of the point in the point cloud.

[0008] Optionally, based on the Hausdorff distance and the chamfer distance between the adversarial point cloud and the original point cloud, a target function is constructed, and the expression is: L(X adv ,X) = λ1·Chamfer(X adv ,X) + λ2·Hausdorff(X adv ,X), wherein L(X adv ,X) represents the target function, X adv represents the adversarial point cloud, X represents the original point cloud, λ1 represents the weight parameter of the chamfer distance, Chamfer() represents the chamfer distance, λ2 represents the weight parameter of the Hausdorff distance, and Hausdorff() represents the Hausdorff distance.

[0009] Optionally, the step size is adjusted according to the gradient information in the current iteration to determine the adversarial perturbation in the next iteration, and the expression is: wherein ΔX (t+1) represents the adversarial perturbation in the t+1th iteration, ΔX (t) represents the adversarial perturbation in the tth iteration, η (t) represents the step size in the tth iteration, represents the gradient information in the current iteration, represents the adversarial loss function, represents the adversarial point cloud in the tth iteration.

[0010] Optionally, the sensitivity score of each point in the perturbed point cloud is calculated, including: dimensionally reducing each point in the perturbed point cloud; obtaining the best attack direction of each point after dimension reduction based on a white box model attack test; and obtaining the sensitivity score of the point based on the best attack direction.

[0011] Optionally, the original point cloud and the first adversarial perturbation are processed based on a shape prior to generate an optimal adversarial point cloud, and an expression of the optimal adversarial point cloud is as follows: where ΔX'optimal adversarial point cloud, X represents the original point cloud, represents the minimum value of the adversarial loss function, corresponding to the adversarial perturbation ΔX, wherein an initial value of ΔX is the first adversarial perturbation, represents the adversarial loss function, and λ represents a regularization parameter, represents a shape prior regularization term.

[0012] Optionally, the shape prior regularization term is determined based on a smoothness constraint or a local connectivity constraint, and an expression of the smoothness constraint is as follows: where i represents an identification number of a point in the point cloud, N represents a total number of points in the point cloud, δx i represents an adversarial perturbation of the point numbered i, represents a gradient; and an expression of the local connectivity constraint is as follows: δx j || 2 , wherein, represents a local field of the point x i , j represents data in the local field, and δx j represents an adversarial perturbation of the point numbered j.

[0013] Optionally, an expression of the adversarial loss function is as follows: where, represents the adversarial loss function, I adv represents input data of the adversarial loss function, y target represents a target category, P(y target |I adv ) represents a probability that the adversarial point cloud generated by the classifier belongs to the target category.

[0014] The application discloses a hybrid mode adversarial attack system based on a laser radar point cloud, and the system comprises an acquisition module, which acquires an original point cloud; a first processing module, which sequentially performs frequency domain transformation, disturbance and inverse transformation processing on the original point cloud to generate a disturbed point cloud; a second processing module, which generates an initial adversarial point cloud based on the disturbed point cloud, and the second processing module comprises the following steps: calculating a sensitivity score of each point in the disturbed point cloud; selecting key points based on the sensitivity score; moving the key points to the center of the point cloud to generate an initial adversarial point cloud; an optimization module, which optimizes the initial adversarial point cloud to obtain a first adversarial disturbance, and the optimization module comprises the following steps: constructing a target function based on the Hausdorff distance and the chamfer distance between the adversarial point cloud and the original point cloud; obtaining the first adversarial disturbance by minimizing the target function, and the obtaining comprises the following steps: calculating the gradient of the adversarial loss function on the sum of the adversarial point cloud and the adversarial disturbance in the current iteration to obtain gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration to determine the adversarial disturbance in the next iteration, and outputting the first adversarial disturbance after iterating for a preset number of times, wherein the gradient information is in direct proportion to the amplitude of the adjusted step size; and a shape guiding module, which guides the processing of the original point cloud and the first adversarial disturbance based on shape prior to generate an optimal adversarial point cloud for adversarial attack.

[0015] Compared with the prior art, the application provides a hybrid mode adversarial attack method and system based on a laser radar point cloud, which not only considers the geometric features and shape information of the point cloud, but also fully utilizes the frequency domain features of the point cloud, thereby enhancing the universality and generalization ability of the attack method, making the attack method have good applicability to different types of point cloud data and different attack scenes, while maintaining the imperceptibility and semantic information of the adversarial samples. By utilizing the characteristics and prior knowledge of the point cloud data, more realistic and imperceptible adversarial samples are generated, the attack effect and success rate on the point cloud data are improved, the robustness and imperceptibility of the adversarial attack are enhanced, and the attack on the deep model is more covert and effective; the optimization algorithm of the application ensures that the adversarial samples can not only deceive the deep model, but also maintain the original features and semantic information of the point cloud, thereby improving the usability and acceptability of the attack; by comprehensively considering various attack methods and adversarial strategies and dynamically adjusting according to different attack scenes and complex environments, various attack scenes and complex environments are coped with. The application expands the research scope of the attack field and helps to strengthen the security protection of the point cloud data. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, brief descriptions will be given to the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art according to these drawings.

[0017] Figure 1 is a flowchart of a hybrid mode adversarial attack method based on laser radar point cloud provided by the embodiment. DETAILED DESCRIPTION

[0018] To make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0019] To facilitate the understanding of the embodiments of the present application, further explanation and description will be made with specific embodiments in combination with the drawings, and the embodiments do not constitute a limitation on the protection scope of the present application.

[0020] Embodiment 1

[0021] The gradient information attack in the prior art usually utilizes the gradient information of the model to generate adversarial samples, but this method may excessively rely on the gradient calculation of the model and ignore the characteristics of the input data itself. Therefore, when the attacker cannot obtain the gradient information of the model, this attack method may fail. Since the point cloud data has characteristics such as unstructured, high dimension and sparsity, directly applying the gradient information attack may encounter difficulties, because the gradient calculation of the point cloud data is relatively complex, and the attacker is difficult to effectively utilize the gradient information to generate adversarial samples. The optimization problem attack usually generates the minimum perturbation by solving the optimization problem, but the high dimension and complexity of the point cloud data increase the difficulty of solving the optimization problem, so that the attacker needs more computing resources and time to find effective adversarial samples. The existing optimization problem attack method may not adequately consider the characteristics of the point cloud data, such as geometric structure, shape information and frequency domain features, etc., resulting in that the generated adversarial samples may not be effective or not unnoticeable enough. The attack method based on point cloud characteristics may be limited in scope of application by the characteristics of the point cloud data, such as noise, deformation and occlusion, etc., which may affect the effect of the attack method. The attack method based on point cloud characteristics may be designed for specific point cloud data characteristics, lacking of universality and generalization ability, and being difficult to cope with different types of point cloud data and different attack scenes.

[0022] To solve the problems in the prior art, the embodiment provides a hybrid mode adversarial attack method based on laser radar point cloud, and a flowchart thereof is shown as Figure 1 , which comprises the following steps.

[0023] S1, acquiring an original point cloud.

[0024] The original point cloud of the target is acquired by the laser radar.

[0025] S2 performs frequency domain transformation, perturbation and inverse transformation on the original point cloud in sequence to generate a perturbed point cloud.

[0026] By analyzing and perturbing the frequency domain representation of the original point cloud, the overall shape and semantic information of the point cloud are maintained, while the adversarial perturbation is introduced.

[0027] S200 performs frequency domain transformation on the original point cloud, and performs frequency analysis on the transformed frequency domain to obtain a first frequency component and a second frequency component.

[0028] The original point cloud is converted into a frequency domain representation using graph Fourier transform. Assuming that the original point cloud is X, its frequency domain representation is X freq =GFT(X), where X freq is represented in the frequency domain, and GFT represents the graph Fourier transform algorithm.

[0029] The frequency domain representation X freq is decomposed into a first frequency component X low and a second frequency component X high , where the first frequency is smaller than the second frequency. Threshold or other methods can be used to determine the boundary between low frequency and high frequency.

[0030] S210 perturbs the first frequency component and recombines the perturbed first frequency component with the second frequency component to obtain first frequency domain data.

[0031] The first frequency component X low is perturbed to maintain the overall shape and semantic information of the point cloud unchanged. Assuming that the perturbation is P low , the perturbed first frequency component is X low_perturbed =X low +P low .

[0032] The perturbed first frequency component X low_perturbed is recombined with the second frequency component X high to obtain the first frequency domain data X freq_perturbed .

[0033] S220 inversely transforms the first frequency domain data to obtain a perturbed point cloud.

[0034] The first frequency domain data X freq_perturbed is inversely Fourier transformed to obtain a perturbed point cloud X perturbed .

[0035] By performing frequency domain transformation on point cloud data, the point cloud is represented as frequency domain features, thereby reducing the dependence on model gradient information. The frequency domain representation can better capture the global features of the point cloud data, so that the attacker no longer needs to directly access the gradient information of the model.

[0036] S3 generates an initial adversarial point cloud based on the perturbed point cloud.

[0037] S300 calculates the sensitivity score of each point in the perturbed point cloud.

[0038] In this step, it includes:

[0039] Dimensionality reduction is performed on each point in the perturbed point cloud.

[0040] Based on the white-box model attack test, the optimal attack direction of each point after dimensionality reduction is obtained.

[0041] Based on the optimal attack direction, the sensitivity score of the point is obtained.

[0042] By calculating the sensitivity score of each point, the contribution of the point to the classification result of the deep model is reflected.

[0043] S310 selects key points based on the sensitivity score.

[0044] Assuming that the sensitivity score of each point x i in the point cloud X i is S i , the key points that are most important to the model decision are selected according to the sensitivity score S

[0045] S320 moves the key points to the center of the point cloud to generate an initial adversarial point cloud.

[0046] The selected key points are moved to the center of the point cloud to minimize the impact on the shape of the point cloud. Assuming that the center of the point cloud is C, the expression of the moved key point m′ i is:

[0047] m′ i =m i +α·(C-m i )

[0048] Where m′ i represents the coordinates of the moved key point, m i represents the coordinates of the moved key point, α represents a parameter for controlling the moving step length, used to balance the degree of keeping the original point cloud shape and the influence of moving the key points, C represents the center of the point cloud, and i represents the identification number of the point in the point cloud.

[0049] The key points are deleted from the original point cloud, and the moved key points are retained to generate an initial adversarial point cloud.

[0050] X keypoints =MoveKeyPoints(X perturbed ,S)

[0051] where X keypoints represents the initial adversarial point cloud, MoveKeyPoints represents the algorithm for moving key points, and S represents the sensitivity score. The sensitivity evaluation method is used to find the key points that are most important to the decision of the depth model, and these key points are moved towards the center of the point cloud, and finally these key points are deleted from the original point cloud to generate the initial adversarial point cloud.

[0052] This step identifies and selects key points based on the generated preliminary adversarial samples. Delete or move these key points to introduce further adversarial perturbations. When introducing perturbations, design perturbations based on frequency domain representation features to ensure the effectiveness and imperceptibility of adversarial samples in the frequency domain. In this way, even if the gradient information of the model cannot be obtained, the attacker can still generate adversarial samples through frequency domain features to increase the imperceptibility and success rate of the attack. In addition, this step not only increases the diversity of perturbations, but also reduces the solution space of the optimization problem, making the optimization process more efficient.

[0053] S4 optimizes the initial adversarial point cloud to obtain the first adversarial point cloud.

[0054] S400 constructs an objective function based on the Hausdorff distance and chamfer distance between the adversarial point cloud and the original point cloud.

[0055] Use optimization algorithms such as gradient descent or evolutionary algorithms, and combine chamfer distance and Hausdorff distance as loss function to optimize the perturbation of point cloud. The goal of optimization is to minimize the distance between adversarial point cloud and original point cloud while maintaining the deceptive nature to the depth model.

[0056] Assuming the original point cloud is X, the initial adversarial point cloud X keypoints is considered as X adv , where X adv and X i contain N points, and the coordinates of each point in X adv are represented as x i , i = 1, 2, …, N, i represents the identification number of the points in the point cloud, and N represents the total number of points in the point cloud. The loss function is composed of chamfer distance and Hausdorff distance, represented as L(X adv ,X), which is represented as:

[0057] L(X adv ,X) = λ1·Chamfer(X adv ,X) + λ2·Hausdorff(X adv ,X)

[0058] where L(X advX) represents the objective function, X adv represents the adversarial point cloud, X represents the original point cloud, λ1 represents the weight parameter of the chamfer distance, Chamfer() represents the chamfer distance, λ2 represents the weight parameter of the Hausdorff distance, Hausdorff() represents the Hausdorff distance.

[0059] S410 obtains the first adversarial perturbation by minimizing the objective function.

[0060] The gradient of the adversarial loss function on the sum of the adversarial point cloud and the adversarial perturbation in the current iteration is calculated to obtain the gradient information in the current iteration; the step size is adjusted according to the gradient information in the current iteration to determine the adversarial perturbation in the next iteration, and the first adversarial perturbation is output after a preset number of iterations, wherein the gradient information is in direct proportion to the amplitude of the adjusted step size.

[0061] The step size is dynamically adjusted according to the gradient information in the optimization process to avoid falling into a local optimal solution and to find the adversarial perturbation more quickly. Specifically, in the optimization process of each step, the gradient of the adversarial loss function on the sum of the adversarial point cloud and the adversarial perturbation in the current iteration is calculated to obtain the gradient information in the current iteration wherein represents the adversarial loss function. Then, the step size η is dynamically adjusted according to the size of the current gradient to ensure that the adversarial perturbation is updated more significantly in the case of a larger gradient, and a smaller step size is taken in the case of a smaller gradient to prevent excessive shock or skip the optimal solution. In the optimization process, the step size is dynamically adjusted according to the gradient information to find the adversarial perturbation more quickly, and the expression of the process is as follows:

[0062]

[0063] wherein ΔX (t+1) represents the adversarial perturbation in the t+1th iteration, ΔX (t) represents the adversarial perturbation in the tth iteration, η (t) represents the step size in the tth iteration, represents the gradient information in the current iteration, represents the adversarial loss function, represents the adversarial point cloud in the tth iteration.

[0064] This step minimizes the impact of perturbation by adjusting the position or attributes of the point cloud data, and ensures that the adversarial sample can both deceive the deep model and maintain the original features and semantic information of the point cloud. A variable step attack strategy is adopted, which dynamically adjusts the size and direction of the perturbation according to the changes of the optimization target, and comprehensively considers the success rate of the attack and the impact of the perturbation, so that the gradient changes in the optimization process can be more flexibly responded to, so that the adversarial perturbation can be more effectively found, and better optimization results can be achieved in different situations.

[0065] S5 generates an optimal adversarial point cloud based on shape prior guidance to process the original point cloud and the first adversarial perturbation for adversarial attack.

[0066] Shape prior guidance refers to using shape prior or prior knowledge of object structure to guide the generation of perturbation, so as to ensure that the generated adversarial point cloud looks reasonable in geometry and can deceive the target deep model.

[0067] Suppose the original point cloud is X = {x1, x2, …, x i ,…,x N}, the adversarial perturbation is ΔX = {δx1, δx2, …, δx i ,…,δx N}, where δx i represents the adversarial perturbation of x i , then the shape prior guidance can be applied in the following way:

[0068]

[0069] where ΔX' is the optimal adversarial point cloud, X represents the original point cloud, represents the adversarial loss function, takes the minimum value, where the initial value of ΔX is the first adversarial perturbation, λ represents a regularization parameter for balancing the adversarial loss and the shape prior regularization term, represents the shape prior regularization term.

[0070] The shape prior regularization term can be designed according to prior knowledge, for example, it can be defined based on the geometric structure or shape features of the object. Specifically, the following shape prior can be considered:

[0071] Smoothness constraint: maintain the smoothness of the adversarial perturbation to prevent the generated adversarial point cloud from having unnatural jagged edges. This can be achieved by smoothing the perturbation, for example, using total variation regularization or Gaussian smoothing.

[0072]

[0073] where δx ian adversarial perturbation representing the point numbered i, representing the gradient.

[0074] Local connectivity constraint: Ensure that the adversarial perturbation maintains connectivity on a local region, avoiding the generation of isolated or scattered points in the adversarial point cloud. This can be achieved by constraining the local connectivity of the perturbation, such as smoothing or connecting the local neighborhood of the perturbation.

[0075]

[0076] wherein, representing the local field of point x i , j represents data in j , δx j represents the adversarial perturbation numbered j.

[0077] By combining the adversarial loss function and the shape prior regularization term, the shape prior guidance can effectively guide the generation of adversarial perturbations, ensuring that the perturbations are more consistent with the true distribution of the point cloud, and the generated adversarial point cloud looks reasonable in geometry and can deceive the target deep model, enhancing the effectiveness and imperceptibility of the attack.

[0078] Compared with the prior art, the embodiment provides a hybrid mode adversarial attack method based on lidar point cloud, which not only considers the geometric features and shape information of the point cloud, but also fully utilizes the frequency domain features of the point cloud, thereby enhancing the universality and generalization ability of the attack method, making the attack method have good applicability to different types of point cloud data and different attack scenes, while maintaining the imperceptibility and semantic information of the adversarial samples. By utilizing the characteristics and prior knowledge of point cloud data, more realistic and imperceptible adversarial samples are generated, improving the attack effect and success rate of point cloud data, enhancing the robustness and imperceptibility of adversarial attacks, making the attack on the deep model more covert and effective; the optimization algorithm of the embodiment ensures that the adversarial samples can deceive the deep model while maintaining the original features and semantic information of the point cloud, thereby improving the usability and acceptability of the attack; by comprehensively considering multiple attack methods and adversarial strategies, and dynamically adjusting according to different attack scenes and complex environments, various attack scenes and complex environments are coped with. The embodiment expands the research scope of the attack field, which helps to strengthen the security protection of point cloud data.

[0079] Embodiment 2

[0080] The embodiment provides a hybrid mode adversarial attack system based on lidar point cloud, which realizes the hybrid mode adversarial attack method based on lidar point cloud in embodiment 1, comprising:

[0081] An acquisition module acquires an original point cloud.

[0082] The first processing module sequentially performs frequency domain transformation, perturbation and inverse transformation processing on the original point cloud to generate a perturbed point cloud.

[0083] The second processing module generates an initial adversarial point cloud based on the perturbed point cloud, including: calculating a sensitivity score of each point in the perturbed point cloud; selecting key points based on the sensitivity score; moving the key points to the center of the point cloud to generate an initial adversarial point cloud.

[0084] The optimization module optimizes the initial adversarial point cloud to obtain a first adversarial perturbation, including: constructing an objective function based on the Hausdorff distance and the chamfer distance between the adversarial point cloud and the original point cloud; obtaining the first adversarial perturbation by minimizing the objective function, including: calculating the gradient of the adversarial loss function on the sum of the adversarial point cloud and the adversarial perturbation in the current iteration to obtain gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration to determine the adversarial perturbation in the next iteration, and outputting the first adversarial perturbation after a preset number of iterations, wherein the gradient information is in direct proportion to the amplitude of the adjusted step size.

[0085] The shape guiding module processes the original point cloud and the first adversarial perturbation based on shape priors to generate an optimal adversarial point cloud for adversarial attack.

[0086] The above specific embodiments further illustrate the purpose, technical solutions and advantages of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A hybrid mode adversarial attack method based on laser radar point cloud, characterized in that, The method comprises the following steps: obtaining an original point cloud; performing frequency domain transformation, perturbation and inverse transformation on the original point cloud in sequence to generate a perturbed point cloud; generating an initial adversarial point cloud based on the perturbed point cloud, comprising: calculating the sensitivity score of each point in the perturbed point cloud, comprising: dimension reduction on each point in the perturbed point cloud; obtaining the optimal attack direction of each point after dimension reduction based on white box model attack test; obtaining the sensitivity score of the point based on the optimal attack direction; selecting a key point based on the sensitivity score; moving the key point to the center of the point cloud to generate an initial adversarial point cloud; optimizing the initial adversarial point cloud to obtain a first adversarial perturbation, comprising: constructing an objective function based on the Hausdorff distance and the chamfer distance between the adversarial point cloud and the original point cloud; obtaining the first adversarial perturbation by minimizing the objective function, comprising: calculating the gradient of the adversarial loss function on the sum of the adversarial point cloud and the adversarial perturbation in the current iteration to obtain the gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration to determine the adversarial perturbation in the next iteration, and outputting the first adversarial perturbation after iterating for a preset number of times, wherein the gradient information is in direct proportion to the amplitude of the adjusted step size; processing the original point cloud and the first adversarial perturbation based on shape prior to generate an optimal adversarial point cloud, whose expression is: wherein, optimal adversarial point cloud, denotes the original point cloud, denotes the adversarial perturbation, corresponding to the adversarial perturbation wherein, the initial value of is the first adversarial perturbation, denotes the adversarial loss function, denotes the regularization parameter, denotes a shape prior regularization term for adversarial attack.

2. The hybrid mode adversarial attack method based on lidar point cloud according to claim 1, characterized in that, performing frequency domain transformation, perturbation and inverse transformation on the original point cloud in sequence to generate a perturbed point cloud, comprising: performing frequency domain transformation on the original point cloud, and performing frequency analysis on the transformed frequency domain to obtain a first frequency component and a second frequency component, wherein the first frequency is smaller than the second frequency; perturbing the first frequency component, and recombining the perturbed first frequency component with the second frequency component to obtain first frequency domain data; performing inverse transformation on the first frequency domain data to obtain the perturbed point cloud.

3. The hybrid mode adversarial attack method based on lidar point cloud according to claim 1, characterized in that, moving the key point to the center of the point cloud, whose expression is: wherein, denotes the coordinates of the key points after the movement, denotes the key point coordinates before the movement, denotes a parameter controlling the movement step size, denotes the center of the point cloud, denotes the identification number of the point in the point cloud.

4. The hybrid mode adversarial attack method based on lidar point cloud according to claim 1, characterized in that, constructing an objective function based on the Hausdorff distance and the chamfer distance between the adversarial point cloud and the original point cloud, whose expression is: wherein, is the objective function, denotes the adversarial point cloud, denotes the original point cloud, denotes the weight parameter for the chamfer distance, denotes the chamfer distance, denotes the weight parameter for the Hausdorff distance, denotes the Hausdorff distance.

5. The hybrid mode adversarial attack method based on lidar point cloud according to claim 1, characterized in that, adjusting the step size according to the gradient information in the current iteration to determine the adversarial perturbation in the next iteration, whose expression is: where, denotes the adversarial perturbation in the denotes the adversarial perturbation in the denotes the step size in the denotes the gradient information in the current iteration, denotes the adversarial loss function, denotes the adversarial point cloud in the 6. The hybrid mode adversarial attack method based on lidar point cloud according to claim 1, characterized in that, determining the shape prior regularization term based on smoothness constraint or local connectivity constraint, comprising: The expression of the smoothness constraint is: wherein, denotes the identification number of a point in the point cloud, denotes the total number of points in the point cloud, denotes the adversarial perturbation of the point numbered denotes the gradient;​ the expression of the local connectivity constraint is: wherein, representing a point of a local region, representing data in, representing an adversarial perturbation of a point numbered .

7. The hybrid mode adversarial attack method based on lidar point cloud according to claim 1, characterized in that, the expression of the adversarial loss function is: wherein, represents an adversarial loss function, represents input data of the adversarial loss function, represents a target class, represents a probability that an adversarial point cloud generated by the classifier belongs to the target class.

8. A hybrid mode adversarial attack system based on lidar point cloud, characterized in that, The method comprises the following steps: an acquisition module for acquiring an original point cloud; a first processing module for performing frequency domain transformation, perturbation and inverse transformation on the original point cloud in sequence to generate a perturbed point cloud; a second processing module for generating an initial adversarial point cloud based on the perturbed point cloud, comprising: calculating the sensitivity score of each point in the perturbed point cloud, comprising: dimension reduction on each point in the perturbed point cloud; obtaining the optimal attack direction of each point after dimension reduction based on white box model attack test; obtaining the sensitivity score of the point based on the optimal attack direction; selecting a key point based on the sensitivity score; moving the key point to the center of the point cloud to generate an initial adversarial point cloud; The optimization module optimizes the initial adversarial point cloud to obtain a first adversarial disturbance, comprising: constructing a target function based on the Hausdorff distance and the chamfer distance between the adversarial point cloud and the original point cloud; obtaining the first adversarial disturbance by minimizing the target function, comprising: calculating the gradient of the adversarial loss function on the sum of the adversarial point cloud and the adversarial disturbance in the current iteration to obtain the gradient information in the current iteration; adjusting the step size according to the gradient information in the current iteration to determine the adversarial disturbance in the next iteration, and outputting the first adversarial disturbance after iterating for a preset number of times, wherein the gradient information is in direct proportion to the amplitude of the adjusted step size; The shape guiding module guides the processing of the original point cloud and the first adversarial disturbance based on the shape prior to generate an optimal adversarial point cloud, and the expression is: wherein, optimal adversarial point cloud, denotes the original point cloud, denotes the adversarial perturbation that makes corresponding to the adversarial perturbation that makes wherein, the initial value of is the first adversarial perturbation, denotes the adversarial loss function, denotes the regularization parameter, denotes the shape prior regularization term to conduct adversarial attack.

Images