Method and system for generating physical world confrontation samples based on robust features

Abstract

The invention discloses a robust feature-based physical world adversarial sample generation method, which comprises the following steps of: acquiring a pre-trained auto-encoder, three pre-trained image classification task models and a data set for an image classification task, setting attack parameters, and generating a robust feature-based physical world adversarial sample; an auto-encoder and three image classification task models are used to carry out iterative optimization processing on each image of which the category label number is t in the data set used for the image classification task, so as to obtain a robust feature code Ftar of the image of which the category label number is t; randomly selecting an image xc of which the category label number is c from a data set for an image classification task, initializing weight matrixes m and alpha, and respectively optimizing the weight matrixes m and alpha by utilizing robust feature codes Ftar of the selected image of which the category label number is v and the selected image of which the category label number is t; respectively obtaining optimized weight matrixes m'and alpha ', and obtaining a final adversarial sample according to the optimized weight matrixes m' and alpha '.

Description

Technical Field

[0001] The present invention belongs to the field of computer vision, and more specifically, to a method and system for generating a physical-world adversarial example (PAE) based on robust features. Background Art

[0002] Adversarial examples refer to samples that cause deep learning models to make incorrect predictions by applying small and carefully designed perturbations to the input data. With the widespread application of deep neural networks in the real (physical) world such as autonomous driving systems, face recognition systems, and medical imaging systems, studying adversarial examples that can be applied to the physical world is of great significance for improving the security of artificial intelligence systems and applications. Existing physical world adversarial examples can be divided into the following three categories according to their manifestations:

[0003] 1. Adversarial samples based on pixel perturbations: The attacker generates perturbed image samples by adding carefully designed noise perturbations to the pixels of the original image and prints them into the physical world. Such samples mislead deep learning models by modifying the image at the pixel level.

[0004] 2. Adversarial samples based on adversarial patches: The attacker designs a fine small pattern (i.e., a patch) and prints it into the physical world, attaching it to the surface of the target object by pasting or other means; when the model makes predictions about the object, the adversarial patch causes the model to output incorrect results.

[0005] 3. Adversarial samples based on optical methods: The attacker uses optical conditions in the physical world, such as lasers, light beams, and shadows, to exert disturbance effects, thereby interfering with the model's image perception process and causing the model to make incorrect judgments.

[0006] However, the above-mentioned existing physical-world adversarial samples still have some defects that cannot be ignored: First, the above-mentioned three adversarial samples have poor transferability, that is, adversarial samples generated for specific models and tasks are difficult to produce effective attack effects in other models and tasks, and have poor transferability; Second, the above-mentioned adversarial samples based on optical methods have poor robustness, and their attack effects are easily affected by the physical world environmental conditions and sampling conditions, such as sampling distance and angle, ambient lighting, reflection and refraction, etc., resulting in a significant decrease in attack performance; Third, it is difficult to balance the attack performance and concealment of the above-mentioned adversarial samples based on pixel perturbation and adversarial patches. Improving the attack performance of adversarial samples often sacrifices their concealment, making them easier to be perceived or detected by the human eye. Summary of the invention

[0007] In view of the above defects or improvement needs of the prior art, the present invention provides a method and system for generating physical world adversarial samples based on robust features, which aims to solve the technical problems that the three existing adversarial samples have poor transferability and poor transferability, as well as the technical problems that the existing adversarial samples based on optical methods have poor robustness and their attack effects are easily affected by the physical world environmental conditions and sampling conditions, resulting in a significant decrease in attack performance, and the technical problems that the existing adversarial samples based on pixel perturbations and adversarial patches have difficulty balancing the attack performance and concealment, and improving the attack performance of adversarial samples often sacrifices their concealment, making them more easily perceived or detected by the human eye.

[0008] To achieve the above object, according to one aspect of the present invention, a method for generating physical world adversarial samples based on robust features is provided, comprising the following steps:

[0009] (1) obtaining a pre-trained autoencoder, three pre-trained image classification task models, and a dataset for an image classification task, wherein the autoencoder includes an encoder E and a decoder D;

[0010] (2) Set the attack parameters and use the autoencoder obtained in step (1) and the three image classification task models to iteratively optimize each image with category label number t in the dataset for the image classification task to obtain the robust feature encoding F of the image with category label number t. tar , where t∈[1, the total number of image categories in the dataset used for image classification tasks];

[0011] (3) Randomly select an image x with a category label number c from the dataset for the image classification task obtained in step (1) c (c is freely chosen by the attacker, and its value range is 0 to 999, and it is different from t set in step (2)), initialize the weight matrix m and α, and use the robust feature code F of the image with the selected category label number c and the image with the category label number t obtained in step (2) tar The weight matrices m and α are optimized respectively to obtain the optimized weight matrices m′ and α′ respectively, where m is the dimension of the selected x c The same matrix, the value of each element in the weight matrix m is randomly initialized in the interval [0,1], and the weight matrix α is the robust feature code F of the image with the category label number t obtained in step (2) tar The same matrix, the value of each element in the weight matrix α is randomly initialized in the interval [0,1];

[0012] (4) Obtain the final adversarial sample x according to the optimized weight matrix m′ and α′ obtained in step (3)adv .

[0013] Preferably, the autoencoder selected in step (1) is the backbone network of the VGG-16 model;

[0014] The three pre-trained image task classification models obtained are ResNet-50, VGG-16, and DenseNet-121, and the number of pre-training rounds for all four is 100 rounds;

[0015] The dataset used for the image classification task is the ImageNet ILSVRC 2012 dataset, which includes 1000 types of images.

[0016] Preferably, step (2) comprises the following sub-steps:

[0017] (2-1) Initialize the attack parameters and load the autoencoder and three image classification task models obtained in step (1);

[0018] (2-2) using the three image classification task models loaded in step (1) to predict each image with a category label number t in the data set for the image classification task obtained in step (1), respectively, to obtain the prediction confidence of the image corresponding to each image task classification model, and obtain all images whose prediction confidences corresponding to all three image task classification models are greater than θ from all images with a category label number t in the data set, and randomly obtain N images therefrom to form an image set S;

[0019] (2-3) Use the encoder E in the autoencoder obtained in step (1) to encode all the images in the set S obtained in step (2-2) in sequence, and take the average of all the encoding results to obtain the robust feature encoding F of the target category 0 ;

[0020] (2-4) Set counter cnt = 0 and initialize the optimization variable f to be equal to the robust feature code F of the target category obtained in step (2-3) 0 ;

[0021] (2-5) Using the decoder D in the autoencoder obtained in step (1) to decode the optimized variable f to obtain a decoding result D(f);

[0022] (2-6) Generate a random matrix δ with the same dimension as the decoding result D(f) obtained in step (2-5), where each element in the random matrix δ is derived from a standard normal distribution. obtained by independent sampling;

[0023] (2-7) Adding the random matrix obtained in step (2-6) as a random noise disturbance to the decoding result D(f) obtained in step (2-5) to obtain a disturbed result D(f)+mδ, and inputting the disturbed results into the three pre-trained classification models obtained in step (1) for prediction, and calculating the loss function L according to the prediction results, wherein m represents the added noise intensity coefficient, and its value range is 0.5 to 4, preferably 2;

[0024] (2-8) Obtain the gradient g of the optimization variable f according to the loss function L obtained in step (2-7);

[0025] (2-9) Update the optimization variable f according to the gradient g obtained in step (2-8);

[0026] (2-10) Update counter cnt 1 =cnt 1 +1, and judge n 1 Is it greater than the number of optimization iterations n in the attack parameter obtained in step (2-1)? If so, the current optimization variable f is used as the robust feature encoding F of the image with category label number t tar , the process ends, otherwise returns to step (2-5).

[0027] Preferably, the attack parameters in step (2-1) include the number of optimization iterations n, the number N of target category images selected for extracting robust features, and the prediction confidence threshold θ of the target category images for extracting robust features;

[0028] The number N of target category images selected for extracting robust features in step (2-1) ranges from 10 to 20, preferably 15;

[0029] The prediction confidence threshold θ of the target category image used to extract robust features in step (2-1) ranges from 0.5 to 1, preferably 0.7;

[0030] The number of optimization iterations n in step (2-1) ranges from 1000 to 3000, preferably 2500.

[0031] Preferably, the robust feature encoding of the target category is calculated in step (2-3) using the following formula:

[0032]

[0033] where x i is the i-th image in the image set S, E(x i ) represents the encoding result of the i-th image in the image set S, and i∈[1,N], N represents the total number of images in the image set S;

[0034] The calculation formula of the loss function L in step (2-7) is:

[0035]

[0036] Among them, M j is the jth image classification task model among the three pre-trained image classification task models obtained in step (1), and j∈[1,3], L CE is the cross entropy function.

[0037] The calculation formula in step (2-8) is

[0038] The formula in step (2-9) is f = f - lr g;

[0039] Wherein lr represents the update rate of the optimization variable f, and its value range is 0.001 to 0.01, preferably 0.005.

[0040] Preferably, step (3) comprises the following sub-steps:

[0041] (3-1) Randomly select an image x with a category label number c from the data set obtained in step (1) c , initialize the weight matrices m and α;

[0042] (3-2) Initialize the parameters used to optimize the fusion and set the counter cnt 2 =0;

[0043] (3-3) Based on the current weight matrix m and α, and the image x with the category label number c selected in step (3-1) c , get the intermediate result x′;

[0044] (3-4) Obtain the adversarial loss L based on the intermediate result x′ obtained in step (3-3) adv With the perceptual loss L cog ;

[0045] (3-5) According to the adversarial loss and perceptual loss obtained in step (3-4), the gradient g of the weight matrix m is obtained respectively 1 , and the gradient g of the weight matrix α 2 ;

[0046] (3-6) According to the gradient g of the weight matrix m obtained in step (3-5) 1 and the gradient g of the weight matrix α 2 , and the parameters used to optimize the fusion after initialization in step (3-1), and update the weight matrices m and α;

[0047] (3-7) Update counter cnt2 =cnt 2 +1, and judge cnt 2 Is it greater than the number of iterations n in the parameters used to optimize the fusion after initialization in step (3-1)? 2 ; If so, the weight matrix m obtained in step (3-6) is used as the optimized weight matrix m′, and the weight matrix α obtained in step (3-6) is used as the optimized weight matrix α′, and the process ends, otherwise return to step (3-3).

[0048] Preferably, the parameters used to optimize the fusion in step (3-2) specifically include the number of optimization iterations n 2 , the update rate s of the weight matrix m 1 , and the update rate s of the weight matrix α 2 ;;

[0049] Optimization iteration number n 2 The value range of is 100 to 1000, preferably 500;

[0050] The update rate s of the weight matrix m 1 The value range of is 0.001 to 0.01, preferably 0.002;

[0051] The update rate s of the weight matrix α 2 The value range is 0.001 to 0.05, preferably 0.01.

[0052] Preferably, the calculation formula of step (3-3) is:

[0053]

[0054] in Represents element-wise multiplication of matrices;

[0055] The calculation formula for the adversarial loss in step (3-4) is:

[0056]

[0057] The calculation formula for the perceptual loss in step (3-4) is:

[0058] L cog =||m|| 1 +TV(m)+SSIM(x′,x c )

[0059] Where ||·|| is the L1 norm, TV(·) is the total variation function, and SSIM(·) is the structural similarity index;

[0060] The calculation formula for step (3-5) is:

[0061]

[0062] The update formula for steps (3-6) is:

[0063] m=m―s 1 *g 1

[0064] α=α―s 2 *g 2 .

[0066] Preferably, the formula for calculating the adversarial sample in step (4) is:

[0067]

[0068] According to another aspect of the present invention, a system for generating physical world adversarial samples based on robust features is provided, comprising:

[0069] The first module is used to obtain a pre-trained autoencoder, three pre-trained image classification task models, and a dataset for an image classification task, wherein the autoencoder includes an encoder E and a decoder D;

[0070] The second module is used to set the attack parameters and use the autoencoder obtained in the first module and the three image classification task models to iteratively optimize each image with a category label number t in the dataset for the image classification task to obtain the robust feature encoding F of the image with a category label number t. tar , where t∈[1, the total number of image categories in the dataset used for image classification tasks];

[0071] The third module is used to randomly select an image x with a category label number c from the data set for image classification tasks obtained in the second module. c (c is freely chosen by the attacker, ranging from 0 to 999, and is different from t set by the second module), initialize the weight matrices m and α, and use the image with the selected category label number c and the robust feature code F of the image with the category label number t obtained by the second module tar The weight matrices m and α are optimized respectively to obtain the optimized weight matrices m′ and α′ respectively, where m is the dimension of the selected x c The same matrix, the value of each element in the weight matrix m is randomly initialized in the interval [0,1], and the weight matrix α is the robust feature code F of the image with the category label number t obtained in the second module. tar The same matrix, the value of each element in the weight matrix α is randomly initialized in the interval [0,1];

[0072] The fourth module is used to obtain the final adversarial sample x according to the optimized weight matrix m′ and α′ obtained in the third module. adv .

[0073] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects compared with the prior art:

[0074] 1. Since the present invention adopts steps (2-1) to (2-10), it adopts an algorithm for extracting robust features of target category images. The extracted robust features are robust to physical world environmental disturbances and can effectively improve the robustness of adversarial samples.

[0075] 2. Since the present invention adopts steps (3-1) to (3-5), it adopts a robust feature fusion method to inject the extracted robust features of the target category image into the clean image, so that the injected robust features can be recognized and perceived by models of various different architectures, thereby effectively improving the transferability of adversarial samples.

[0076] 3. Since the present invention adopts steps (3-3) to (3-5), it adopts the minimized cognitive pattern algorithm to erase unnecessary disturbances in the image, which can maximize the concealment of the adversarial sample while ensuring the attack performance of the adversarial sample. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 is a flow chart of a method for generating physical world adversarial samples based on robust features of the present invention;

[0078] Figure 2 is a detailed flow chart of step (2) in the method of the present invention;

[0079] Figure 3 It is a flowchart of the present invention that fuses the target robust features into the clean image and generates adversarial samples. DETAILED DESCRIPTION

[0080] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0081] The basic method of the present invention is to use two main measures to improve the transferability, robustness and concealment of physical world adversarial samples. On the one hand, a process is designed to extract robust features of the target category and then fuse them into clean images to comprehensively improve the transferability and robustness of adversarial samples. On the other hand, an algorithm that minimizes cognitive patterns is used to erase unnecessary disturbances and enhance its concealment without affecting the attack performance of adversarial samples.

[0082] The purpose of the present invention is to design physical world adversarial samples with good attack performance, so as to construct a physical world adversarial sample test data set, and lay a foundation for evaluating and improving the robustness and security of deep learning models. The advantages of the present invention are that the designed adversarial samples can adapt to a variety of complex physical world environments, and can achieve attack effects on models of various architectures, and have good concealment and are not easily perceived and detected by the human eye.

[0083] In order to make the purpose, technical methods and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings.

[0084] like Figure 1 As shown, the present invention provides a method for generating physical world adversarial samples based on robust features, comprising the following steps:

[0085] (1) obtaining a pre-trained autoencoder, three pre-trained image classification task models, and a dataset for an image classification task, wherein the autoencoder includes an encoder E and a decoder D;

[0086] Specifically, the autoencoder selected in this step is the backbone network of the VGG-16 model, and the three pre-trained image task classification models obtained are ResNet-50, VGG-16, and DenseNet-121, and the number of pre-training rounds for the four is 100. The dataset obtained for the image classification task is the ImageNet ILSVRC 2012 dataset;

[0087] It should be noted that each type of image in the dataset used for the image classification task is assigned a category label number; in the dataset selected by the present invention, there are a total of 1,000 types of images, so the category label numbers are between 0 and 999.

[0088] (2) Set the attack parameters and use the autoencoder obtained in step (1) and the three image classification task models to iteratively optimize each image with a category label number t (selected by the attacker, ranging from 0 to 999) in the dataset used for the image classification task to obtain the robust feature encoding F of the image with category label number t. tar ;

[0089] like Figure 2 As shown, this step includes the following sub-steps:

[0090] (2-1) Initialize the attack parameters and load the autoencoder and three image classification task models obtained in step (1);

[0091] Specifically, the attack parameters in this step include the number of optimization iterations n, the number of target category images N selected for extracting robust features, and the prediction confidence threshold θ of the target category images for extracting robust features;

[0092] More specifically, the attack parameters initialized in this step need to be flexibly selected according to actual conditions and needs;

[0093] In this step, the number N of target category images selected for extracting robust features ranges from 10 to 20, preferably 15;

[0094] In this step, the prediction confidence threshold θ of the target category image used to extract robust features ranges from 0.5 to 1, preferably 0.7;

[0095] The value range of the optimization iteration number n in this step is 1000 to 3000, preferably 2500;

[0096] (2-2) using the three image classification task models loaded in step (1) to predict each image with a category label number t in the data set for the image classification task obtained in step (1), respectively, to obtain the prediction confidence of the image corresponding to each image task classification model, and obtain all images whose prediction confidences corresponding to all three image task classification models are greater than θ from all images with a category label number t in the data set, and randomly obtain N images therefrom to form an image set S;

[0097] (2-3) Use the encoder E in the autoencoder obtained in step (1) to encode all the images in the set S obtained in step (2-2) in sequence, and take the average of all the encoding results to obtain the robust feature encoding F of the target category 0 ;

[0098] Specifically, this step calculates the robust feature encoding of the target category using the following formula:

[0099]

[0100] where x i is the i-th image in the image set S, E(x i ) represents the encoding result of the i-th image in the image set S, and i∈[1,N], N represents the total number of images in the image set S;

[0101] (2-4) Set counter cnt = 0 and initialize the optimization variable f to be equal to the robust feature code F of the target category obtained in step (2-3) 0 ;

[0102] (2-5) Using the decoder D in the autoencoder obtained in step (1) to decode the optimized variable f to obtain a decoding result D(f);

[0103] (2-6) Generate a random matrix δ with the same dimension as the decoding result D(f) obtained in step (2-5), where each element in the random matrix δ is independently sampled from a standard normal distribution N(0,1);

[0104] (2-7) Adding the random matrix obtained in step (2-6) as a random noise disturbance to the decoding result D(f) obtained in step (2-5) to obtain a disturbed result D(f)+mδ, and inputting the disturbed results into the three pre-trained classification models obtained in step (1) for prediction, and calculating the loss function L according to the prediction results, wherein m represents the added noise intensity coefficient, and its value range is 0.5 to 4, preferably 2;

[0105] Specifically, the calculation formula of the loss function L in this step is:

[0106]

[0107] Among them, M j is the jth image classification task model among the three pre-trained image classification task models obtained in step (1), and j∈[1,3], L CE is the cross entropy function;

[0108] The advantage of this sub-step (2-7) is that, when extracting the robust feature coding of the image with category label number t, a variety of noise perturbations are introduced, so that the extracted feature coding can be robust to the physical world environment, which helps to improve the robustness of the adversarial samples generated in subsequent steps.

[0109] (2-8) Obtain the gradient g of the optimization variable f according to the loss function L obtained in step (2-7); specifically, the calculation formula in this step is:

[0110] (2-9) Update the optimization variable f according to the gradient g obtained in step (2-8);

[0111] Specifically, the formula in this step is f = f - lr g;

[0112] Where lr represents the update rate of the optimization variable f, and its value range is 0.001 to 0.01, preferably 0.005;

[0113] (2-10) Update counter cnt 1 =cnt 1 +1, and judge cnt 1 Is it greater than the number of optimization iterations n in the attack parameter obtained in step (2-1)? If so, the current optimization variable f is used as the robust feature encoding F of the image with category label number t tar , the process ends, otherwise return to step (2-5);

[0114] The advantage of the above sub-steps (2-7) to (2-10) is that multiple image classification task models are used in the optimization process, so that the robust feature encoding F of the image with the extracted category label number t is tar Being able to be recognized by models of various different architectures helps to improve the transferability of adversarial samples generated in subsequent steps.

[0115] (3) Randomly select an image x with a category label number c from the dataset for the image classification task obtained in step (1) c (c is freely chosen by the attacker, and its value range is 0 to 999, and it is different from t set in step (2)), initialize the weight matrix m and α, and use the robust feature code F of the image with the selected category label number c and the image with the category label number t obtained in step (2) tar The weight matrices m and α are optimized respectively to obtain the optimized weight matrices m′ and α′ respectively, where m is the dimension of the selected x c The same matrix, the value of each element in the weight matrix m is randomly initialized in the interval [0,1], and the weight matrix α is the robust feature code F of the image with the category label number t obtained in step (2) tar For the same matrix, the value of each element in the weight matrix α is randomly initialized in the interval [0,1]. The overall process of this step is as follows Figure 3 As shown;

[0116] The advantage of this step (3) is that by optimizing the two weight matrices m and α instead of directly taking the image as the optimization variable, the space for optimization variables is larger, which is conducive to improving the attack performance of adversarial samples.

[0117] Specifically, this step includes the following sub-steps:

[0118] (3-1) Randomly select an image x with a category label number c from the data set obtained in step (1) c , initialize the weight matrices m and α;

[0119] (3-2) Initialize the parameters used to optimize the fusion and set the counter cnt 2 =0;

[0120] The parameters used to optimize the fusion specifically include the number of optimization iterations n 2 , the update rate s of the weight matrix m 1 , and the update rate s of the weight matrix α 2 ;;

[0121] In this step, set the number of optimization iterations n 2 The value range of is 100 to 1000, preferably 500;

[0122] In this step, set the update rate s of the weight matrix m 1 The value range of is 0.001 to 0.01, preferably 0.002;

[0123] In this step, the update rate s of the weight matrix α is set 2 The value range is 0.001 to 0.05, preferably 0.01.

[0124] (3-3) Based on the current weight matrix m and α, and the image x with the category label number c selected in step (3-1) c , get the intermediate result x′;

[0125] Specifically, the calculation formula for this step is:

[0126]

[0127] in Represents element-wise multiplication of matrices;

[0128] (3-4) Obtain the adversarial loss L based on the intermediate result x′ obtained in step (3-3) adv With the perceptual loss L cog ;

[0129] Specifically, the calculation formula for adversarial loss in this step is:

[0130]

[0131] The calculation formula of the perceptual loss in this step is:

[0132] L cog =||m|| 1 +TV(m)+SSIM(x′,x c )

[0133] Where ||·|| is the L1 norm, TV(·) is the total variation function, and SSIM(·) is the structural similarity index;

[0134] The advantage of this sub-step (3-4) is that the designed loss function not only includes the optimization of the attack target, but also takes into account the enhancement of the concealment of the adversarial sample, making it less likely to be detected and detected, which helps to achieve a balance between the attack performance and concealment of the adversarial sample.

[0135] (3-5) According to the adversarial loss and perceptual loss obtained in step (3-4), the gradient g of the weight matrix m is obtained respectively 1 , and the gradient g of the weight matrix α 2 ;

[0136] Specifically, the calculation formula for this step is:

[0137]

[0138] (3-6) According to the gradient g of the weight matrix m obtained in step (3-5) 1 and the gradient g of the weight matrix α 2 , and the parameters used to optimize the fusion after initialization in step (3-1), and update the weight matrices m and α;

[0139] Specifically, the update formula in this step is:

[0140] m=m―s 1 *g 1

[0141] α=α―s 2 *g 2 ;

[0142] (3-7) Update counter cnt 2 =cnt 2 +1, and judge cnt 2 Is it greater than the number of iterations n in the parameters used to optimize the fusion after initialization in step (3-1)? 2 ; If yes, the weight matrix m obtained in step (3-6) is used as the optimized weight matrix m′, and the weight matrix α obtained in step (3-6) is used as the optimized weight matrix α′, and the process ends, otherwise return to step (3-3);

[0143] (4) Obtain the final adversarial sample x according to the optimized weight matrix m′ and α′ obtained in step (3) adv ;

[0144] Specifically, the formula for calculating adversarial samples in this step is:

[0145]

[0146] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for generating physical world adversarial samples based on robust features, characterized in that: The following steps are involved: (1) obtaining a pre-trained autoencoder, three pre-trained image classification task models, and a dataset for an image classification task, wherein the autoencoder includes an encoder E and a decoder D; (2) Set the attack parameters and use the autoencoder obtained in step (1) and the three image classification task models to iteratively optimize each image with category label number t in the dataset for the image classification task to obtain the robust feature encoding F of the image with category label number t. tar , where t∈[1, the total number of image categories in the dataset used for image classification tasks]; (3) Randomly select an image x with a category label number c from the dataset for the image classification task obtained in step (1) c (c is freely chosen by the attacker, and its value range is 0 to 999, and it is different from t set in step (2)), initialize the weight matrix m and α, and use the robust feature code F of the image with the selected category label number c and the image with the category label number t obtained in step (2) tar The weight matrices m and α are optimized respectively to obtain the optimized weight matrices m′ and α′ respectively, where m is the dimension of the selected x c The same matrix, the value of each element in the weight matrix m is randomly initialized in the interval [0,1], and the weight matrix α is the robust feature code F of the image with the category label number t obtained in step (2) tar The same matrix, the value of each element in the weight matrix α is randomly initialized in the interval [0,1]; (4) Obtain the final adversarial sample x according to the optimized weight matrix m′ and α′ obtained in step (3) adv .

2. The method for generating physical world adversarial samples based on robust features according to claim 1, characterized in that: The autoencoder selected in step (1) is the backbone network of the VGG-16 model; The three pre-trained image task classification models obtained are ResNet-50, VGG-16, and DenseNet-121, and the number of pre-training rounds for all four is 100 rounds; The dataset used for the image classification task is the ImageNetILSVRC 2012 dataset, which includes 1000 types of images.

3. The method for generating physical world adversarial samples based on robust features according to claim 1 or 2, characterized in that: Step (2) includes the following sub-steps: (2-1) Initialize the attack parameters and load the autoencoder and three image classification task models obtained in step (1); (2-2) using the three image classification task models loaded in step (1) to predict each image with a category label number t in the data set for the image classification task obtained in step (1), respectively, to obtain the prediction confidence of the image corresponding to each image task classification model, and obtain all images whose prediction confidences corresponding to all three image task classification models are greater than θ from all images with a category label number t in the data set, and randomly obtain N images therefrom to form an image set S; (2-3) using the encoder E in the autoencoder obtained in step (1) to sequentially encode all images in the set S obtained in step (2-2), and taking the average of all the encoding results obtained to obtain the robust feature code F0 of the target category; (2-4) Set counter cnt = 0, and initialize the optimization variable f to be equal to the robust feature code F0 of the target category obtained in step (2-3); (2-5) Using the decoder D in the autoencoder obtained in step (1) to decode the optimized variable f to obtain a decoding result D(f); (2-6) Generate a random matrix δ with the same dimension as the decoding result D(f) obtained in step (2-5), where each element in the random matrix δ is derived from a standard normal distribution. obtained by independent sampling; (2-7) Adding the random matrix obtained in step (2-6) as a random noise disturbance to the decoding result D(f) obtained in step (2-5) to obtain a disturbed result D(f)+mδ, and inputting the disturbed results into the three pre-trained classification models obtained in step (1) for prediction, and calculating the loss function L according to the prediction results, wherein m represents the added noise intensity coefficient, and its value range is 0.5 to 4, preferably 2; (2-8) Obtain the gradient g of the optimization variable f according to the loss function L obtained in step (2-7); (2-9) Update the optimization variable f according to the gradient g obtained in step (2-8); (2-10) Update the counter cnt1=cnt1+1, and determine whether cnt1 is greater than the optimization iteration number n in the attack parameter obtained in step (2-1); if so, use the current optimization variable f as the robust feature code F of the image with the category label number t tar , the process ends, otherwise returns to step (2-5).

4. The method for generating physical world adversarial samples based on robust features according to any one of claims 1 to 3, characterized in that: The attack parameters in step (2-1) include the number of optimization iterations n, the number N of target category images selected for extracting robust features, and the prediction confidence threshold θ of the target category images for extracting robust features; The number N of target category images selected for extracting robust features in step (2-1) ranges from 10 to 20, preferably 15; The prediction confidence threshold θ of the target category image used to extract robust features in step (2-1) ranges from 0.5 to 1, preferably 0.7; The number of optimization iterations n in step (2-1) ranges from 1000 to 3000, preferably 2500.

5. The method for generating physical world adversarial samples based on robust features according to claim 4, characterized in that: Step (2-3) calculates the robust feature encoding of the target category using the following formula: where x i is the i-th image in the image set S, E(x i ) represents the encoding result of the i-th image in the image set S, and i∈[1,N], N represents the total number of images in the image set S; The calculation formula of the loss function L in step (2-7) is: Among them, M j is the jth image classification task model among the three pre-trained image classification task models obtained in step (1), and j∈[1,3], L CE is the cross entropy function. The calculation formula in step (2-8) is The formula in step (2-9) is f = f - lr g; Wherein lr represents the update rate of the optimization variable f, and its value range is 0.001 to 0.01, preferably 0.

005.

6. The method for generating physical world adversarial samples based on robust features according to claim 5, characterized in that: Step (3) includes the following sub-steps: (3-1) Randomly select an image x with a category label number c from the data set obtained in step (1) c , initialize the weight matrices m and α; (3-2) Initialize the parameters for optimizing fusion and set the counter cnt2 = 0; (3-3) Based on the current weight matrix m and α, and the image x with the category label number c selected in step (3-1) c , get the intermediate result x′; (3-4) Obtain the adversarial loss L based on the intermediate result x′ obtained in step (3-3) adv With the perceptual loss L cog ; (3-5) According to the adversarial loss and perceptual loss obtained in step (3-4), the gradient g1 of the weight matrix m and the gradient g2 of the weight matrix α are obtained respectively; (3-6) updating the weight matrices m and α according to the gradient g1 of the weight matrix m and the gradient g2 of the weight matrix α obtained in step (3-5) and the parameters used to optimize the fusion after initialization in step (3-1); (3-7) Update counter cnt2=cnt2+1, and determine whether cnt2 is greater than the number of iterations n2 in the parameters used to optimize the fusion after initialization in step (3-1); if so, use the weight matrix m obtained in step (3-6) as the optimized weight matrix m′, and use the weight matrix α obtained in step (3-6) as the optimized weight matrix α′, and the process ends, otherwise return to step (3-3).

7. The method for generating physical world adversarial samples based on robust features according to claim 6, characterized in that: The parameters used for optimizing the fusion in step (3-2) specifically include the number of optimization iterations n2, the update rate s1 of the weight matrix m, and the update rate s2 of the weight matrix α; The value range of optimization iteration number n2 is 100 to 1000, preferably 500; The update rate s1 of the weight matrix m ranges from 0.001 to 0.01, preferably 0.002; The update rate s2 of the weight matrix α ranges from 0.001 to 0.05, preferably 0.

01.

8. The method for generating physical world adversarial samples based on robust features according to claim 7, characterized in that: The calculation formula of step (3-3) is: in Represents element-wise multiplication of matrices; The calculation formula for the adversarial loss in step (3-4) is: The calculation formula for the perceptual loss in step (3-4) is: L cog =||m||1+TV(m)+SSIM(x′,x c ) Where ∥·∥ is the L1 norm, TV(·) is the total variation function, and SSIM(·) is the structural similarity index; The calculation formula for step (3-5) is: The update formula for steps (3-6) is: m=m―s1*g1 α=α―s2*g2.

9. The method for generating physical world adversarial samples based on robust features according to claim 8, characterized in that: The formula for calculating adversarial samples in step (4) is:

10. A physical world adversarial sample generation system based on robust features, characterized in that: include: The first module is used to obtain a pre-trained autoencoder, three pre-trained image classification task models, and a dataset for an image classification task, wherein the autoencoder includes an encoder E and a decoder D; The second module is used to set the attack parameters and use the autoencoder obtained in the first module and the three image classification task models to iteratively optimize each image with a category label number t in the dataset for the image classification task to obtain the robust feature encoding F of the image with a category label number t. tar , where t∈[1, the total number of image categories in the dataset used for image classification tasks]; The third module is used to randomly select an image x with a category label number c from the data set for image classification tasks obtained in the second module. c (c is freely chosen by the attacker, ranging from 0 to 999, and is different from t set by the second module), initialize the weight matrices m and α, and use the image with the selected category label number c and the robust feature code F of the image with the category label number t obtained by the second module tar The weight matrices m and α are optimized respectively to obtain the optimized weight matrices m′ and α′ respectively, where m is the dimension of the selected x c The same matrix, the value of each element in the weight matrix m is randomly initialized in the interval [0,1], and the weight matrix α is the robust feature code F of the image with the category label number t obtained in the second module. tar The same matrix, the value of each element in the weight matrix α is randomly initialized in the interval [0,1]; The fourth module is used to obtain the final adversarial sample x according to the optimized weight matrix m′ and α′ obtained in the third module. adv .

Images