Customizable physical adversarial patch generation method based on diffusion model

Abstract

The invention provides a customizable physical adversarial patch generation method based on a diffusion model, belongs to the field of artificial intelligence safety, and aims to avoid recognition by generating a natural and undetectable adversarial patch on the surface of an object and cheating a target detection system. The invention is specifically used for creating natural and customizable adversarial patches. The reference image is used for replacing traditional random noise to serve as the basis of patch generation, and it is ensured that the patch is highly consistent with a natural image visually. By introducing an incomplete diffusion optimization strategy, the patch generation process is more efficient, and meanwhile, the attack performance is effectively maintained. According to the method, the mask technology is used, so that the generated adversarial patch can be in various shapes and is not limited to a traditional square patch any more. The adversarial patch provided by the invention has an attack success rate equivalent to or even higher than that of an existing non-natural adversarial patch method while keeping a natural appearance.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security, and specifically relates to a method for generating customizable physical adversarial patches based on a diffusion model. Background Art

[0002] With the rapid development of deep learning, object detectors based on deep learning are widely used in real life, including autonomous driving, medical diagnosis and other fields, which are closely related to our own safety. Unfortunately, many recent works have proved that deep neural networks are very easy to be interfered by some maliciously designed adversarial samples, thus making judgments that go against common sense, which poses a huge threat to related applications.

[0003] For the visual field, adversarial attacks can be divided into two different categories: digital adversarial attacks and physical adversarial attacks. Unlike digital attacks that add small perturbations in the digital space, physical adversarial attacks are carried out in the real world, and their goal is to mislead the visual system by changing the appearance or position of physical objects. This attack can be implemented in a variety of ways, such as sticking specific stickers on the surface of objects, changing the lighting of the environment, or adding interference elements. Compared with digital attacks, physical adversarial attacks face more limitations and challenges in actual operations because they must be effective in the real world. For example, attackers may need to consider factors such as lighting conditions, viewing angles, object movement, etc. to ensure the stability and continuity of the attack.

[0004] In most previous studies on physical adversarial patches, such as the AdvYOLO method [1] and T-SEA method [2] , mainly focusing on improving the attack performance of patches, which means that stronger perturbations need to be added to the generated patches, causing the patches to deviate greatly from the distribution of natural images and become very inconsistent. Although almost all patch generation methods introduce TV loss to make patches smoother, this still cannot solve the fundamental problem of patch abruptness, and they are still very easy to be recognized by people. With the development of the field of image generation, some natural patch generation methods based on deep image generators have emerged, such as Naturalistic Adversarial Patch (NAP). [3] As a representative example, since the patches are generated by these well-trained generators, the patches can have a natural appearance, thereby increasing the concealment of the patches. However, these methods have not achieved a good attack performance, and there is a gap with the performance of unnatural patches. In addition, these methods usually optimize the initialized random noise and are difficult to achieve patch generation using a given image, which requires a lot of time for image screening.

[0005] [1] Thys, S.; Van Ranst, W.; and Goedem′e, T. 2019. Fooling au-tomatedsurveillance cameras: adversarial patches to attackperson detection. In CVPRW,0-0.

[0006] [2] Huang, H.; Chen, Z.; Chen, H.; Wang, Y.; and Zhang, K. 2023. T-sea: Transfer-based self-ensemble attack on object detection. In CVPR, 20514-20523.

[0007] [3] Hu, Y.-C.-T.; Kung, B.-H.; Tan, DS; Chen, J.-C.; Hua, K.-L.; and Cheng, W.-H. 2021. Naturalistic physical adversarial patch for object detectors. In CVPR, 7848-7857. Summary of the invention

[0008] The present invention is made to solve the above-mentioned problem, and aims to provide a customizable physical adversarial patch generation method based on a diffusion model.

[0009] The present invention provides a customizable physical adversarial patch generation method based on a diffusion model, which has the following characteristics, including the following steps: S10, generating a text description of a reference image; S20, performing background replacement based on a target mask on a non-subject area of ​​the reference image; S30, performing a perfect mapping based on an empty text reversal on the reference image and the latent vector of the intermediate time step to obtain a starting noise latent vector x T / 2 ; S40, the hidden vector x T / 2 Through DDIM sampling, adversarial patches are obtained under the guidance of text descriptions; S50, the character images of the data set are padded and scaled to the same size, and then the adversarial patches are applied to the surface of the character's clothes in the character image to obtain a training data set; S60, the training data set is detected using the detection model to obtain a prediction result; S70, the loss of the prediction result is detected to update the latent vector x T / 2 ; S80, repeat steps S40 to S70 until the iteration ends and output the final adversarial patch.

[0010] The method for generating customizable physical adversarial patches based on a diffusion model provided by the present invention may also have the following feature: in step S10, a text description is generated using a BLIP model.

[0011] The method for generating a customizable physical adversarial patch based on a diffusion model provided by the present invention may also have the following characteristics: wherein, in step S20, the background replacement formula is: In the above formula, is the reference image; m is the target mask; s is the solid color background, which is used to replace the original background; The new image obtained.

[0012] The customizable physical adversarial patch generation method based on the diffusion model provided by the present invention may also have the following feature: wherein, in step S30, the empty text reverse training is unconditionally embedded in each sampling process, thereby correcting the path deviation of the generation process.

[0013] The method for generating customizable physical adversarial patches based on a diffusion model provided by the present invention may also have the following feature: in step S50, the character image is scaled to the same square size after being filled.

[0014] The method for generating a customizable physical adversarial patch based on a diffusion model provided by the present invention may also have the following feature: wherein, in step S60, the prediction result includes the coordinates of the prediction box and the corresponding object probability therein.

[0015] In the customizable physical adversarial patch generation method based on the diffusion model provided by the present invention, it can also have the following characteristics: wherein, in step S70, the latent vector is updated by gradient descent using the IoU detection loss, and the latent vector is derived according to the loss to obtain the gradient of the loss function with respect to the latent vector, and then the latent vector is adjusted by the gradient descent algorithm, and the IoU loss is defined as follows: In the above formula, M is the total number of detection boxes that satisfy the maximum IoU greater than the threshold t; IoU(J j , J′ k ) is the detection box J′ k and the real frame J j The intersection-and-union ratio between them; is an indicator function. When the condition in the brackets is true, the function value is 1, otherwise it is 0; P is the probability P of an object existing in the prediction box output by the detector after processing the image. obj And the classification probability P of various objects cls The product of .

[0016] The method for generating customizable physical adversarial patches based on a diffusion model provided by the present invention may also have the following feature: wherein t=0.5.

[0017] Functions and Effects of the Invention

[0018] The diffusion model-based customizable physical adversarial patch generation method of the present invention realizes the generation of physical patches with customized natural appearance by mapping images and latent space vectors in combination with target masks.

[0019] The present invention uses incomplete diffusion optimization, which effectively solves the problem that it is difficult to compromise between the aggressiveness and concealment of patches during the optimization process when using a diffusion model.

[0020] The present invention proposes a detection loss that is more suitable for anti-patch optimization, called the intersection detection loss. While maintaining the natural appearance of the patch, the loss function can achieve stronger attack performance and faster convergence speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a flowchart of a method for generating a customizable physical adversarial patch based on a diffusion model in an embodiment of the present invention;

[0022] Figure 2 It is a flowchart of a method for generating a customizable physical adversarial patch based on a diffusion model in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the following embodiments and accompanying drawings specifically illustrate a method for generating a customizable physical adversarial patch based on a diffusion model of the present invention.

[0024] <Example>

[0025] Figure 1 is a flowchart of a method for generating a customizable physical adversarial patch based on a diffusion model in an embodiment of the present invention; Figure 2 It is a flowchart of a method for generating a customizable physical adversarial patch based on a diffusion model in an embodiment of the present invention.

[0026] like Figure 1 and 2 As shown, this embodiment provides a method for generating a customizable physical adversarial patch based on a diffusion model, comprising the following steps:

[0027] S10, generating a text description of the reference image using the BLIP model.

[0028] S20, performing background replacement based on the target mask on the non-subject area of ​​the reference image.

[0029] Among them, the formula for background replacement is:

[0030]

[0031] In the above formula, is the reference image; m is the target mask; s is the solid color background, which is used to replace the original background; The new image obtained.

[0032] S30, the reference image and the latent vector of the intermediate time step are perfectly mapped based on the empty text reversal to obtain the starting noise latent vector x T / 2 The empty text reverses the training of the unconditional embedding at each sampling process, thereby correcting the path deviation of the generation process.

[0033] S40, the hidden vector x T / 2 Through DDIM sampling, adversarial patches are obtained under the guidance of text descriptions.

[0034] S50, padding the person images in the data set and scaling them into the same square size, and then applying the adversarial patch to the surface of the person's clothes in the person image to obtain a training data set.

[0035] S60, using the detection model to detect the training data set to obtain a prediction result, where the prediction result includes the coordinates of the prediction box and the corresponding object probability therein.

[0036] S70, using the IoU detection loss to update the latent vector by gradient descent, the latent vector is differentiated according to the loss to obtain the gradient of the loss function with respect to the latent vector, and then the latent vector is adjusted by the gradient descent algorithm. The IoU loss is defined as follows:

[0037]

[0038] In the above formula, M is the total number of detection boxes that satisfy the maximum IoU greater than the threshold t (generally 0.5); is the detection box J' k and the real frame J j The intersection-and-union ratio between them; is an indicator function. When the condition in the brackets is true, the function value is 1, otherwise it is 0; P is the probability P of an object existing in the prediction box output by the detector after processing the image. obj And the classification probability P of various objects cls The IoU detection loss considers multiple objects with patches pasted in a single image and addresses the impact of unpasted objects on training.

[0039] S80, repeat steps S40 to S70 for K times until the iteration ends, and output the final adversarial patch. The whole process is an iterative process. By continuously optimizing the latent vector, the generated adversarial patch can maximize the impact on the detector's detection ability without significantly changing the image content, so as to train and test the robustness of the deep learning model.

[0040] Functions and Effects of the Embodiments

[0041] This embodiment uses optimization to generate adversarial patches in the form of latent vectors after adding noise. However, if the initial vector is directly added with noise using the diffusion process and then the image is generated through the inverse process, it will lead to imperfect image reconstruction, that is, the generated image will lose part of the semantics of the original image and will be inconsistent with the original image. Therefore, this embodiment uses empty text injection to train unconditional embedding, and uses the dual guidance of conditional and unconditional embedding to achieve near-perfect reconstruction.

[0042] This embodiment uses incomplete diffusion optimization to optimize the latent space vector and uses intersection-and-union detection loss to accelerate convergence, thereby ensuring the natural appearance and attack performance of the patch and avoiding semantic loss during the optimization process.

[0043] In order to generate a non-square patch image, this embodiment uses a mask to replace the background and gradient cover the non-main part, thereby reducing information interference caused by other areas during the optimization process.

[0044] Those skilled in the art should understand that the present invention is not limited to the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, and these changes and improvements fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A method for generating customizable physical adversarial patches based on a diffusion model, characterized in that: The following steps are involved: S10, generating a text description of the reference image; S20, performing background replacement based on the target mask on the non-subject area of ​​the reference image; S30, performing a perfect mapping based on the empty text reversal on the reference image and the latent vector of the intermediate time step to obtain the initial noise latent vector x T / 2 ; S40, the latent vector x T / 2 Through DDIM sampling, an adversarial patch is obtained under the guidance of the text description; S50, padding the person images in the data set and scaling them to the same size, and then applying the adversarial patch to the surface of the person's clothes in the person image to obtain a training data set; S60, using the detection model to detect the training data set to obtain a prediction result; S70, detecting the loss of the prediction result, thereby updating the latent vector x T / 2 ; S80, repeat steps S40 to S70 until the iteration ends, and output the final adversarial patch.

2. The method for generating customizable physical adversarial patches based on a diffusion model according to claim 1, characterized in that: in, In step S10, the text description is generated using the BLIP model.

3. The method for generating customizable physical adversarial patches based on a diffusion model according to claim 1, characterized in that: in, In step S20, the background replacement formula is: In the above formula, is the reference image; m is the target mask; s is the solid color background, which is used to replace the original background; The new image obtained.

4. The method for generating customizable physical adversarial patches based on a diffusion model according to claim 1, characterized in that: in, In step S30, the empty text reverses the unconditional embedding in each sampling process to correct the path deviation of the generation process.

5. The method for generating customizable physical adversarial patches based on a diffusion model according to claim 1, characterized in that: in, In step S50, the character images are filled and scaled to the same square size.

6. The method for generating customizable physical adversarial patches based on a diffusion model according to claim 1, characterized in that: in, In step S60, the prediction result includes the coordinates of the prediction box and the corresponding object probability therein.

7. The method for generating customizable physical adversarial patches based on a diffusion model according to claim 1, Features: in, In step S70, the latent vector is updated by gradient descent using the IoU detection loss, the latent vector is differentiated according to the loss to obtain the gradient of the loss function with respect to the latent vector, and then the latent vector is adjusted by the gradient descent algorithm. The IoU loss is defined as follows: In the above formula, M is the total number of detection boxes that satisfy the maximum IoU greater than the threshold t; Is the detection frame and the real frame J j The intersection-and-union ratio between them; It is an indicator function. When the condition in the brackets is true, the function value is 1, otherwise it is 0; P is the probability that an object exists in the prediction box output by the detector after processing the image. obj And the classification probability P of various objects cls The product of .

8. The method for generating customizable physical adversarial patches based on a diffusion model according to claim 7, characterized in that: in, t＝0.5。

Images