Method and device for generating adversarial sample of multi-modal fusion model

Abstract

The invention provides an adversarial sample generation method and device for a multi-modal fusion model, and the method comprises the steps: obtaining a multi-modal image, inputting the multi-modal image to the multi-modal fusion model to obtain an initial fusion image, and enabling the multi-modal image to comprise a plurality of single-modal images; determining a plurality of initial confrontation samples based on the multi-modal image; injecting each initial confrontation sample into each single-mode image to obtain each single-mode disturbance image, and obtaining a semi-disturbance fusion image corresponding to each single-mode disturbance image through a multi-mode fusion model based on each single-mode disturbance image and each single-mode image, determining an optimal initial confrontation sample corresponding to each single-mode image based on each semi-perturbation fusion image and the initial fusion image; and generating a plurality of sub-confrontation samples based on each optimal initial confrontation sample, and determining an optimal confrontation sample of the multi-modal fusion model from the plurality of sub-confrontation samples. According to the invention, the robustness and security of the multi-modal fusion model in attack resistance can be improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for generating adversarial samples of a multimodal fusion model. Background Art

[0002] Deep neural networks (DNNs) have achieved significant performance improvements on a variety of visual tasks, and therefore, their security has received increasing attention. As one of the most basic tasks in computer vision, object detection is widely used in a large number of scenarios, including video surveillance, autonomous driving, and human-computer interaction. Investigating the potential risks of object detection models has become a critical task. Previous work has revealed that existing detectors based on deep neural networks are easily perturbed by adversarial samples, which is undoubtedly a potential huge security risk for deploying this type of object detector in systems with high security requirements. Adversarial attack methods are an important means to test the robustness and security of models.

[0003] Currently, a common method is to generate adversarial samples by adding slight perturbations that are invisible to the human eye to the entire visible light photo; although this method is very effective, these perturbations are not feasible in the real world because it is impossible to attack every pixel in the photo. In order to enhance the feasibility of adversarial attacks, a patch-based attack method has been proposed, which only attacks a small area where pixels are concentrated; in the patch-based attack method, the generated adversarial patch is injected into the image to achieve the effect of misleading the deep network model. Recent investigations have shown that adversarial patches are highly concealed and can be implemented in the real world. For example, Patch-fool can mislead ViTs (Vision Transformer) in various visual tasks to make wrong judgments by adding a small patch to a visible light image; Invisible-Cloak can print a pre-prepared pattern on clothes to make the detector ignore the wearer of the clothes; NaturalisticAttack can make the person being tested hold a pre-printed photo and be ignored by the detector; the above methods can detect the robustness and security of the model to a certain extent, but the more mature adversarial attack method is single-modal attack, that is, single-modal attack usually uses visible light images as attack targets, and generates adversarial samples by perturbing the pixels of the target image or injecting patches. This attack method requires the attacked object to have relatively obvious texture information and is sensitive to pixel perturbations or patch attacks; As a result, single-modal attack methods can often only be applied in situations with high visibility, and are ineffective in low-visibility environments such as foggy conditions or at night. Therefore, single-modal attacks cannot cope with complex and changeable real-world environments.

[0004] In order to solve the problems existing in single-modal attacks, multimodal fusion detection has attracted attention, and corresponding adversarial attack methods have also emerged, such as Unified-Attack, which attacks visible light and infrared images simultaneously. At present, multimodal attack methods are based on the expansion of single-modal attacks. Although they can attack multiple modalities at the same time, the existing multimodal attack methods treat multiple single modalities independently and attack each modality separately, that is, each modality uses a separate adversarial sample, which does not consider the information interaction between modalities and ignores the interactivity between modalities, resulting in poor performance of the model after adversarial training. Therefore, how to improve the robustness and security of multimodal fusion models in adversarial attacks is a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a method and device for generating adversarial samples of a multimodal fusion model to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of the present invention provides a method for generating adversarial samples of a multimodal fusion model, the method comprising the following steps:

[0007] Acquire a multimodal image, and input the multimodal image into a multimodal fusion model to obtain an initial fused image, wherein the multimodal image includes a plurality of single-modal images;

[0008] Determining a plurality of initial adversarial samples based on the multimodal image;

[0009] Injecting each of the initial adversarial samples into each of the unimodal images to obtain each unimodal perturbation image, obtaining a semi-perturbation fusion image corresponding to each of the unimodal perturbation images through a multimodal fusion model based on each of the unimodal perturbation images and each of the unimodal images, and determining an optimal initial adversarial sample corresponding to each of the unimodal images based on each of the semi-perturbation fusion images and the initial fusion image;

[0010] A plurality of sub-adversarial samples are generated based on each of the optimal initial adversarial samples, and an optimal adversarial sample of the multimodal fusion model is determined from the plurality of sub-adversarial samples.

[0011] In some embodiments of the present invention, obtaining a semi-perturbed fusion image corresponding to each single-modal perturbation image based on each single-modal perturbation image and each single-modal image through a multimodal fusion model includes:

[0012] The first unimodal perturbation image and other second unimodal images in the multimodal image except the first unimodal image corresponding to the first unimodal perturbation image are input into the multimodal fusion model to obtain a semi-perturbation fusion image corresponding to the first unimodal perturbation image.

[0013] In some embodiments of the present invention, determining the optimal initial adversarial sample corresponding to each of the single-modal images based on each of the semi-perturbed fused images and the initial fused image includes:

[0014] Calculating the confidence difference between each of the semi-perturbed fused images and the initial fused image;

[0015] Determine the initial adversarial sample size corresponding to each of the semi-perturbed fusion images and the degree of deviation of the perturbed region contour before and after the attack;

[0016] Based on the confidence differences, the initial adversarial sample size, and the degree of displacement of the perturbed region contour, an optimal initial adversarial sample corresponding to each of the single-modal images is determined.

[0017] In some embodiments of the present invention, the calculation formula of the optimal initial adversarial sample is:

[0018]

[0019] Among them, M * represents the optimal initial adversarial sample, M represents the initial adversarial sample, x vis represents the first single modality image, x inf represents the second single modality image, L s Represents the confidence difference, L d Indicates the degree of displacement of the disturbance area contour, L a represents the initial adversarial sample size, λ1 and λ2 represent coefficients.

[0020] In some embodiments of the present invention, determining a plurality of initial adversarial samples based on the multimodal image includes:

[0021] Determine a plurality of sample center point coordinates and anchor point position coordinates corresponding to each of the sample center point coordinates based on the size of the multimodal image;

[0022] Based on the anchor point position coordinates corresponding to the center point coordinates of each sample, a sample contour curve corresponding to each sample center point coordinate is obtained by using a Bessel function;

[0023] Each initial adversarial sample is determined based on each of the sample contour curves.

[0024] In some embodiments of the present invention, the slopes of two curves passing through the same anchor point in each of the sample contour curves are the same.

[0025] In some embodiments of the present invention, generating a plurality of sub-adversarial samples based on each of the optimal initial adversarial samples, and determining the optimal adversarial sample of the multimodal fusion model from the plurality of sub-adversarial samples includes:

[0026] Based on each of the optimal initial adversarial samples, selection, mutation and crossover are performed to obtain a plurality of sub-adversarial samples;

[0027] Injecting each sub-adversarial sample into the multimodal image to obtain a multimodal perturbation image corresponding to each sub-adversarial sample;

[0028] Inputting the multimodal perturbation image into the multimodal fusion model to obtain a fully perturbation fusion image;

[0029] An optimal adversarial sample of the multimodal fusion model is determined based on each of the fully perturbation fusion images and the initial fusion image.

[0030] In some embodiments of the present invention, the Bezier curve is:

[0031] B i (t) = f B (P i , D, E, P i+1 )=(1-t) 3 P i +3t(1-t) 2 E+3t 2 (1-t)D+t 3 P i+1 t∈[0,1];

[0032] Among them, P i represents the i-th anchor point, P i+1 represents the i+1th anchor point, and D and E represent two control points.

[0033] According to another aspect of the present invention, a system for generating adversarial samples for a multimodal fusion model is also disclosed, including a processor, a memory, and a computer program stored in the memory, wherein the processor is used to execute the computer program, and when the computer program is executed, the system implements the steps of the method described in any of the above embodiments.

[0034] According to yet another aspect of the present invention, a computer-readable storage medium is disclosed, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in any of the above embodiments are implemented.

[0035] The adversarial sample generation method and device of the multimodal fusion model of the present invention adopt a modal alternation selection algorithm, make full use of the image information of the single modality, select the initial adversarial samples with outstanding attack effects in each single modality, and generate new sub-adversarial samples based on the selected outstanding initial adversarial samples under each single modality, and then use the new sub-adversarial samples to attack the multimodal fusion image, and determine the optimal adversarial sample of the multimodal fusion model based on the attack effect. This method makes good use of the interactive information between multimodalities and has stronger adaptability to complex environments, thereby improving the robustness and security of the multimodal fusion model in adversarial attacks.

[0036] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0037] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention. The components in the drawings are not drawn to scale, but are only for illustrating the principles of the present invention. In order to facilitate the illustration and description of some parts of the present invention, the corresponding parts in the drawings may be enlarged, that is, they may become larger relative to other components in the exemplary device actually manufactured according to the present invention. In the drawings:

[0039] Figure 1 Schematic diagram of the process of generating adversarial samples of a multimodal fusion model in one embodiment of the present invention.

[0040] Figure 2 A schematic diagram of the effect of generating adversarial samples of a multimodal fusion model according to an embodiment of the present invention.

[0041] Figure 3 A schematic flowchart of a method for generating adversarial samples for a multimodal fusion model according to another embodiment of the present invention.

[0042] Figure 4 The figure is a schematic diagram of contour generation based on Bessel function according to an embodiment of the present invention.

[0043] Figure 5 Schematic diagram of adversarial sample boundary constraints according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0045] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0046] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0047] The current single-mode adversarial attack method has a relatively single attack mode, most of which are attacks on visible light images, which cannot adapt to complex application scenarios; while multi-mode adversarial attacks do not utilize multi-modal fusion information, but attack on their own modes, without considering the information interaction between different modes, resulting in poor performance of the multi-modal fusion model after adversarial training. Therefore, in view of the few application scenarios of current single-mode attacks and the problem of information interaction ignored by multi-modal attacks, this application proposes a method and device for generating adversarial samples of a multi-modal fusion model. The method and device start from the shape, which is an attribute that has obvious effects on each mode, and use Bessel functions to design an adversarial patch with the same shape in all modes, which is continuously optimized during the iterative process, and finally injected into images of different modes at the same time, thereby obtaining the optimal adversarial sample of the multi-modal fusion model. The adversarial sample takes into account the information of multi-modal images and pays attention to information interaction, and has the potential to work in complex environments, so that the multi-modal fusion model trained based on the adversarial sample has good robustness and security.

[0048] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0049] Figure 1 FIG. 1 is a flow chart of a method for generating adversarial samples of a multimodal fusion model in an embodiment of the present invention. Figure 1 As shown, the adversarial sample generation method includes at least steps S10 to S40.

[0050] Step S10: acquiring a multimodal image, and inputting the multimodal image into a multimodal fusion model to obtain an initial fused image, wherein the multimodal image includes a plurality of single-modal images.

[0051] In this step, the multimodal image is a pair of multiple single-modal images, that is, the paired multiple single-modal images are input into the multimodal fusion model to obtain the initial fusion image. In addition, in order to obtain a high-quality initial fusion image, the initial fusion image generated by the multimodal fusion model further determines whether the confidence of the object in the image is lower than a preset threshold based on the target detector. If it is lower than the preset threshold, it proves that the initial fusion image obtained based on the multimodal fusion model is of too poor quality and has no value in resisting attacks, so the initial fusion image with poor quality is ignored.

[0052] Step S20: determining a plurality of initial adversarial samples based on the multimodal image.

[0053] This step is to initialize the adversarial samples. The number of initial adversarial samples is set based on needs. The initial adversarial samples are used to attack each unimodal image.

[0054] Exemplarily, multiple initial adversarial samples are determined based on the multimodal image, specifically including the following steps: determining multiple sample center point coordinates and anchor point position coordinates corresponding to each of the sample center point coordinates based on the size of the multimodal image; obtaining a sample contour curve corresponding to each of the sample center point coordinates through a Bessel function based on the anchor point position coordinates corresponding to each of the sample center point coordinates; and determining each initial adversarial sample based on each of the sample contour curves.

[0055] The size of the multimodal image can also be understood as the size of the image received by the multimodal fusion model. That is, this step determines the positions of multiple groups of center point coordinates and anchor points according to the image size input by the multimodal fusion model, and then smoothly connects all anchor points in each group through the Bessel function to obtain a smooth sample contour, thereby determining an initial adversarial sample.

[0056] Step S30: Injecting each of the initial adversarial samples into each of the unimodal images to obtain each unimodal perturbation image, obtaining a semi-perturbation fusion image corresponding to each unimodal perturbation image based on each of the unimodal perturbation images and each of the unimodal images through a multimodal fusion model, and determining the optimal initial adversarial sample corresponding to each of the unimodal images based on each of the semi-perturbation fusion images and the initial fusion image.

[0057] In this step, each initial adversarial sample is injected into a single modality image, and the perturbed unimodal image and the unperturbed unimodal image are fused through the multimodal fusion model to measure the attack effect of the initial adversarial sample in the semi-perturbed fusion image. This step realizes the alternating optimization of each modality, that is, finally determining the optimal initial adversarial sample under each single modality.

[0058] Exemplarily, based on each of the unimodal perturbation images and each of the unimodal images, a semi-perturbed fusion image corresponding to each unimodal perturbation image is obtained through a multimodal fusion model, including: inputting the first unimodal perturbation image and the second unimodal images other than the first unimodal image corresponding to the first unimodal perturbation image in the multimodal image into the multimodal fusion model to obtain a semi-perturbed fusion image corresponding to the first unimodal perturbation image. In this embodiment, the semi-perturbed fusion image is obtained by fusing the perturbed first unimodal image and the unperturbed other unimodal images; for example, when the number of unimodal images is two and the number of initial adversarial samples is two, four unimodal perturbation images are obtained based on the two initial adversarial samples, the two unimodal images are defined as unimodal image A and unimodal image B, and the four unimodal perturbation images are defined as the first unimodal perturbation image A, the second unimodal perturbation image A, the first unimodal perturbation image B and the second unimodal perturbation image B; During the first iteration, the multimodal fusion model fuses the first unimodal perturbation image A and the unimodal image B; during the second iteration, the multimodal fusion model fuses the second unimodal perturbation image A and the second unimodal image B; during the third iteration, the multimodal fusion model fuses the unimodal image A and the first unimodal perturbation image B; during the fourth iteration, the multimodal fusion model fuses the unimodal image A and the second unimodal perturbation image B; thereby finding the optimal initial adversarial samples corresponding to the unimodal image A and the unimodal image B respectively.

[0059] When determining the initial adversarial samples with excellent performance in each single modality, it can be specifically calculated based on the adaptation function, that is, the attack results of each initial adversarial sample on each single modality image are quantified through the adaptation function. In one embodiment, the optimal initial adversarial sample corresponding to each single modality image is determined based on each of the semi-perturbed fusion images and the initial fusion image, including: calculating the confidence difference between each of the semi-perturbed fusion images and the initial fusion image; determining the initial adversarial sample size corresponding to each of the semi-perturbed fusion images and the degree of deviation of the perturbation area contour before and after the attack; determining the optimal initial adversarial sample corresponding to each of the single modality images based on each of the confidence differences, the initial adversarial sample size, and the degree of deviation of the perturbation area contour. In this embodiment, the adaptation function is related to the confidence difference, the initial adversarial sample size, and the degree of deviation of the perturbation area contour.

[0060] Exemplarily, the calculation formula of the optimal initial adversarial sample (fitting function) is:

[0061]

[0062] Among them, M * represents the optimal initial adversarial sample, M represents the initial adversarial sample, x vis represents the first single modality image, x infrepresents the second single modality image, L s Represents the confidence difference, L d Indicates the degree of displacement of the disturbance area contour, L a represents the initial adversarial sample size, λ1 and λ2 represent coefficients.

[0063] In the above steps, the modality alternation selection algorithm based on information fusion realizes the determination of the optimal initial adversarial sample for each modality. The modality alternation selection algorithm takes the initial adversarial sample as input, transforms it to obtain the image mask, injects the image mask into one of the single modality images, obtains the perturbed image corresponding to the modality, and ensures that the images of other modalities remain unchanged. The injection method of the initial adversarial sample is shown in the following formula: in, represents a single-mode perturbation image, x vis represents the unimodal image before perturbation, C vis represents the control matrix corresponding to the unimodal image, ⌒ represents the Hadamard product of the matrix, and M is the mask matrix that characterizes the adversarial sample.

[0064] After a single-modal image is attacked by a single modality, all paired modal images (one of the modalities is a single-modal perturbation image) are used as input, and a semi-perturbation fusion image is generated through a multimodal fusion model. The adaptation function is used to test the attack effect of the initial adversarial sample on the corresponding modality. In the same way, the remaining modalities are attacked in turn, and their adaptation function values ​​are counted. By calculating the attack effects of all initial adversarial samples on all single-modal images, the initial adversarial sample with the best attack effect is selected as the master, which can accelerate the convergence speed.

[0065] Step S40: generating a plurality of sub-adversarial samples based on each of the optimal initial adversarial samples, and determining an optimal adversarial sample of the multimodal fusion model from the plurality of sub-adversarial samples.

[0066] In this step, based on the optimal initial adversarial sample that performs well on each single modal image determined in step S30 as the parent, multiple sub-adversarial samples are derived. The derived sub-adversarial samples attack images of all modalities at the same time, and the optimal adversarial sample is determined by measuring the attack effect of each sub-adversarial sample.

[0067] Specifically, this step derives multiple sub-adversarial samples through a genetic algorithm, that is, generates multiple sub-adversarial samples based on each of the optimal initial adversarial samples, and determines the optimal adversarial sample of the multimodal fusion model from the multiple sub-adversarial samples, which may specifically include: selecting, mutating and crossing based on each of the optimal initial adversarial samples to obtain multiple sub-adversarial samples; injecting each sub-adversarial sample into the multimodal image to obtain a multimodal perturbation image corresponding to each sub-adversarial sample; inputting the multimodal perturbation image into the multimodal fusion model to obtain a fully perturbed fusion image; and determining the optimal adversarial sample of the multimodal fusion model based on each of the fully perturbed fusion images and the initial fusion image. In this embodiment, the sub-adversarial samples are injected into multiple single-modal images at the same time, and multiple single-modal images perturbed by the sub-adversarial samples are used as input images of the multimodal fusion model, so that the multimodal fusion model outputs a fully perturbed fusion image corresponding to the sub-adversarial sample. Further, the attack effect of the sub-adversarial sample on the fused image can be measured based on a preset adaptation function; thus, the optimal sub-adversarial sample is found as the optimal adversarial sample of the multimodal fusion model based on the attack effects of multiple sub-adversarial samples. It can be understood that the calculation formula of the optimal adversarial sample in this step is similar to the calculation formula of the optimal initial adversarial sample (adaptation function) in step S30, except that the confidence difference in this step is the difference between the confidence of the fully perturbed fused image and the initial fused image.

[0068] In addition, in order to ensure the rationality and quality of the generated initial adversarial sample, the position and size of the initial adversarial sample need to be specified; at the same time, in order to ensure the smoothness of the connection between different curve segments, the anchor points of the generated patch need to appear in the specified area. These requirements together form the boundary constraints of the adversarial sample. The smooth contour generation algorithm based on the Bessel function can flexibly characterize the contour of the adversarial patch and conveniently change the shape of the adversarial patch during the iteration process; in one embodiment, a third-order Bessel function is used, such as Figure 4 As shown in Figure a, given four control points, the third-order Bessel function can form a smooth curve in the area containing the four control points. The curve passes through the first and fourth control points but not the second and third control points. The specific formula is: i (t) = f B (P i , D, E, P i+1 )=(1-t) 3 P i +3t(1-t) 2 +3t 2 (1-t)D+t 3 P i+1 t∈[0,1]; where P i represents the i-th anchor point, P i+1represents the i+1th anchor point, and D and E represent two control points.

[0069] exist Figure 4 In figure a, the Bezier curve is at the first control point P i The tangent direction is determined by the first control point P i Point to the second control point E, the curve is at the fourth control point P i+1 The tangent direction of the third control point D points to the fourth control point P i+1 Therefore, the second control point and the third control point control the change direction and shape of the curve. In this embodiment, given an input unimodal image, the anchor points of the initial adversarial sample are calculated in the adversarial sample initialization stage, and two adjacent anchor points are used as the starting point and end point of a Bezier curve. Two control points are defined between the two anchor points to control the change of the curve, and the four control points required to draw the Bezier curve are obtained. A Bezier curve is obtained using the Bezier function; it can be understood that a set of Bezier curves can form the contour boundary line of the initial adversarial sample. Figure 4 As shown in Figure b, a Bezier curve is drawn between every two adjacent anchor points. A closed curve contour can be obtained by connecting all Bezier curve segments. In addition, in order to ensure the smooth connection of the curve, when calculating the control points matching the anchor points, keep B′ i-1 (P i )=B′ i (P i ), that is, the slopes of the two curves passing through the same anchor point are equal at the anchor point. Based on this condition, the smoothness of the contour curve at the connection point is ensured, thereby obtaining a smooth curve contour.

[0070] In addition, in order to ensure the effectiveness of the initial adversarial sample, the positions of the anchor points and control points are further constrained. The specific aspects involved are: the distance between the anchor point and the center point, the smoothness of the curve segment connection points, and avoiding contour self-intersection.

[0071] For example, in terms of the distance between the anchor point and the center point, Figure 5 As shown in Figure a, based on the radius r * The inner circle of the circle and the large circle with radius r constrain the feasible domain of the anchor point, that is, the possible range of the anchor point is inside the ring formed by the two circles; specifically, the distance function can be used Determine anchor point P i The position when r * ≤d i ≤r, then the anchor point P i The position is reasonable, otherwise it is necessary to re-select the point. In the distance function, (x o ,y o ) represents the position coordinates of the center point, (x i ,yi ) represents the anchor point P i The location coordinates of .

[0072] In addition, this application uses segmented Bezier curves to form a closed adversarial sample contour to avoid the following Figure 5 In the case of the non-smooth connection shown in Figure b, the position of the control points also needs to be constrained. In terms of the smoothness of the curve segment connection points, the formula B i (t) = f B (P i , D, E, P i+1 )=(1-t) 3 P i +3t(1-t) 2 E+3t 2 (1-t)D+t 3 P i+1 Take the derivative on both sides of t∈[0,1] to get the tangent representation of the Bessel function at the two endpoints; then when calculating the control point, ensure that B′ i (1) = B′ i+1 (0), which ensures that the slopes of the two Bezier curves at the connection point are equal, thereby ensuring the smoothness of the adversarial sample contour.

[0073] Since the present application first calculates the anchor points required to connect the contours, and then calculates two control points between two adjacent anchor points to control the shape of the Bezier curve, it is feasible to avoid self-intersection of the contours by limiting the control points. Figure 5 As shown in Figure c, when the control point moves from B to B', the Bezier curve will self-intersect. In order to solve this problem, the present application uses the angle to determine the position of the control point; for example, when the control point is between two anchor points, the first line connecting the control point and the center point and the second line connecting the anchor point and the center point are first determined, and the angle formed by the first line and the second line is limited to be smaller than the angle formed by the lines connecting the two anchor points and the center point; if it is not satisfied, it means that the control point will cause the Bezier curve to self-intersect, and the position of the control point should be recalculated.

[0074] Through the above embodiments, it can be found that the adversarial sample generation method of the multimodal fusion model disclosed in the present application generates an initial adversarial sample for the multimodal fusion model by a modal alternation selection algorithm through a Bessel function combined with the interactive information of the multimodal image, and iterates and evolves under the guidance of the genetic algorithm to generate a sample with a better attack effect as the final optimal adversarial sample. The effect schematic diagram of the optimal adversarial sample generated by the adversarial sample generation method of the multimodal fusion model of the present application is as follows: Figure 2 shown.

[0075] Figure 3FIG. 4 is a flow chart of a method for generating adversarial samples of a multimodal fusion model according to another embodiment of the present invention. Figure 3 As shown, the adversarial sample generation method specifically includes the following steps: step S01, image quality judgment: judge whether the initial fused image after fusion needs to be attacked; step S02, adversarial sample initialization: determine the center point of each initial adversarial sample according to the size of the model input image; step S03, modal alternation optimization: inject the obtained initial adversarial sample into the single modal image to measure its attack effect on the single modal image; step S04, sample interaction and mutation: perform information interaction and mutation in the selected matrix to obtain sub-adversarial samples; step S05, boundary constraint: ensure the effectiveness and smoothness of the adversarial sample; step S06, redundant post-processing: select the optimal adversarial sample with the best attack effect from a large number of sub-adversarial samples.

[0076] In the above embodiment, the smooth contour generation algorithm based on the Bessel function forms a flexible and controllable contour representation based on the anchor point with the help of the Bessel function, and the shape of the adversarial sample contour can be easily modified by modifying the anchor point coordinates; in addition, when determining the adversarial sample contour, a constraint algorithm related to the position condition is adopted, and the distance between the anchor point and the center point, the smoothness of the connection point, and the smoothness of the overall contour are considered to comprehensively form a reasonable adversarial sample contour. This method first attacks on a single-modal image, verifies the attack effect on the fused image, and finally selects samples with excellent performance on a single modality as the parent, derives the child adversarial sample from the parent, and then obtains the final adversarial sample. This method speeds up the learning speed.

[0077] Through the above embodiments, it can be found that the adversarial sample generation method of the multimodal fusion model disclosed in the present application utilizes texture information and adopts pixel perturbation or patch perturbation to perform adversarial attacks, and performs well under high visibility conditions. When obtaining adversarial samples, the adversarial sample generation method attacks the multimodal fusion model, that is, it attacks the information of multiple modal images at the same time, and adopts Bessel functions to form a controllable and variable contour shape, and the representation method is simple and flexible. Compared with the prior art, the present application can make full use of multimodal information, realize end-to-end training, and can work in more complex environments, greatly broadening its application environment.

[0078] In addition, the adversarial sample generation method of the present application selects adversarial samples with excellent performance under the condition of attacking single-modal images, uses gene interaction and mutation in the selected adversarial samples, and adopts new sub-adversarial samples to attack multimodal fusion images, making good use of the interactive information between multimodal images, so that the multimodal fusion model after adversarial training based on the adversarial samples has better robustness and security.

[0079] Corresponding to the above method, the present invention also provides an adversarial sample generation system for a multimodal fusion model, the system comprising a computer device, the computer device comprising a processor and a memory, the memory storing computer instructions, the processor being used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0080] The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned edge computing server deployment method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0081] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0082] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0083] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or replace features of other embodiments.

[0084] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for generating adversarial samples for a multimodal fusion model, characterized in that: The method comprises the following steps: Acquire a multimodal image, and input the multimodal image into a multimodal fusion model to obtain an initial fused image, wherein the multimodal image includes a plurality of single-modal images; Determining a plurality of initial adversarial samples based on the multimodal image; Injecting each of the initial adversarial samples into each of the unimodal images to obtain each unimodal perturbation image, obtaining a semi-perturbation fusion image corresponding to each of the unimodal perturbation images through a multimodal fusion model based on each of the unimodal perturbation images and each of the unimodal images, and determining an optimal initial adversarial sample corresponding to each of the unimodal images based on each of the semi-perturbation fusion images and the initial fusion image; A plurality of sub-adversarial samples are generated based on each of the optimal initial adversarial samples, and an optimal adversarial sample of the multimodal fusion model is determined from the plurality of sub-adversarial samples.

2. The method for generating adversarial samples of a multimodal fusion model according to claim 1, characterized in that: Based on each of the single-modal perturbation images and each of the single-modal images, a semi-perturbation fusion image corresponding to each of the single-modal perturbation images is obtained through a multimodal fusion model, including: The first unimodal perturbation image and other second unimodal images in the multimodal image except the first unimodal image corresponding to the first unimodal perturbation image are input into the multimodal fusion model to obtain a semi-perturbation fusion image corresponding to the first unimodal perturbation image.

3. The method for generating adversarial samples of a multimodal fusion model according to claim 2, characterized in that: Determining the optimal initial adversarial sample corresponding to each of the single-modal images based on each of the semi-perturbed fused images and the initial fused image includes: Calculating the confidence difference between each of the semi-perturbed fused images and the initial fused image; Determine the initial adversarial sample size corresponding to each of the semi-perturbed fusion images and the degree of deviation of the perturbed region contour before and after the attack; Based on the confidence differences, the initial adversarial sample size, and the degree of displacement of the perturbed region contour, an optimal initial adversarial sample corresponding to each of the single-modal images is determined.

4. The method for generating adversarial samples of a multimodal fusion model according to claim 3, characterized in that: The calculation formula of the optimal initial adversarial sample is: Among them, M * represents the optimal initial adversarial sample, M represents the initial adversarial sample, x vis represents the first single modality image, x inf represents the second single modality image, L s Represents the confidence difference, L d Indicates the degree of displacement of the disturbance area contour, L a represents the initial adversarial sample size, λ1 and λ2 represent coefficients.

5. The method for generating adversarial samples of a multimodal fusion model according to claim 1, characterized in that: Determining a plurality of initial adversarial samples based on the multimodal image includes: Determine a plurality of sample center point coordinates and anchor point position coordinates corresponding to each of the sample center point coordinates based on the size of the multimodal image; Based on the anchor point position coordinates corresponding to the center point coordinates of each sample, a sample contour curve corresponding to each sample center point coordinate is obtained by using a Bessel function; Each initial adversarial sample is determined based on each of the sample contour curves.

6. The method for generating adversarial samples of a multimodal fusion model according to claim 5, characterized in that: The slopes of the two curves passing through the same anchor point in each of the sample contour curves are the same.

7. The method for generating adversarial samples of a multimodal fusion model according to claim 1, characterized in that: Generating a plurality of sub-adversarial samples based on each of the optimal initial adversarial samples, and determining an optimal adversarial sample of the multimodal fusion model from the plurality of sub-adversarial samples, comprising: Based on each of the optimal initial adversarial samples, selection, mutation and crossover are performed to obtain a plurality of sub-adversarial samples; Injecting each sub-adversarial sample into the multimodal image to obtain a multimodal perturbation image corresponding to each sub-adversarial sample; Inputting the multimodal perturbation image into the multimodal fusion model to obtain a fully perturbation fusion image; An optimal adversarial sample of the multimodal fusion model is determined based on each of the fully perturbation fusion images and the initial fusion image.

8. The method for generating adversarial samples of a multimodal fusion model according to claim 6, characterized in that: The Bezier curve is: B i (t)=f B (P i ,D,E,P i+1 )=(1-t) 3 P i +3t(1-t) 2 E+3t 2 (1-t)D+t 3 P i +1t∈[0,1]; Among them, P i represents the i-th anchor point, P i+1 represents the i+1th anchor point, and D and E represent two control points.

9. A system for generating adversarial samples of a multimodal fusion model, comprising a processor, a memory, and a computer program stored in the memory, characterized in that: The processor is used to execute the computer program. When the computer program is executed, the system implements the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images