Black box confrontation sample generation method based on deceptive texture

Abstract

The invention discloses a deceptive texture-based black box adversarial sample generation method, which comprises the following steps of: acquiring a plurality of initial optimization variables, the initial optimization variables being an array of 2 + m * m dimensions, the first two-dimensional numerical values being used for representing coordinates of an adversarial patch center in an image, the last m * m-dimensional numerical values being used for representing a pixel value of an adversarial patch, and the pixel value being 1 or 0; decoding the last m * m-dimensional numerical value of the initial optimization variable to obtain a corresponding adversarial patch, and pasting the adversarial patch in the image according to the first two-dimensional numerical value of the initial optimization variable to obtain an adversarial sample; and inputting the adversarial samples corresponding to the plurality of initial optimization variables into the deep neural network model to obtain a detection result output by the model, and performing optimization variable iterative updating based on the plurality of initial optimization variables and the detection result to obtain a final optimization variable and a corresponding adversarial sample thereof. The method can improve the cheating of the anti-patch, improves the attack effect of the anti-sample, improves the optimization efficiency, and reduces the optimization cost.

Description

Technical Field

[0001] The present invention relates to the field of computer vision technology, and in particular to a method for generating black box adversarial samples based on deceptive textures. Background Art

[0002] In recent years, with the continuous progress and development of machine learning theory and technology, especially the breakthroughs in computer vision and multimedia, machine learning has been widely used in technical fields such as autonomous driving, target detection, medical image processing, biological image recognition, and face recognition. However, the rapid development of machine learning has also brought many security issues. Studies have shown that the output of deep neural networks is highly sensitive to small changes in the input. For example, for image classification tasks, by adding some imperceptible perturbations to the original image, the deep neural network can make incorrect output results. The image with added perturbations is called an adversarial sample. From the perspective of the human eye, there is no difference between the adversarial sample and the corresponding original image.

[0003] The process of generating adversarial samples that cause deep neural networks to predict incorrect results is defined as an adversarial attack. Adversarial attacks can be divided into white-box attacks and black-box attacks. White-box attacks refer to known information such as the structure and parameters of the target model, and adversarial samples can be constructed by analyzing the structure of the target model to conduct adversarial attacks. Black-box attacks refer to the inability to obtain the internal structure and parameters of the target model, but the target model can be accessed and queried.

[0004] At present, there are two main black-box attack methods: invisible interference-based attack and patch-based attack. Invisible interference-based attack is to add invisible tiny interference to all or part of the pixels of the image to generate adversarial samples. However, this attack method cannot be implemented in the physical world. Patch-based attack is to paste adversarial patches in specific areas of the image to generate adversarial samples. This attack method is easy to implement in the digital space and the physical world, so it has become a more commonly used attack method in practice. However, the current patch-based attack method mainly focuses on obtaining the optimal position, shape and pixel value of the adversarial patch, which makes the generated patch too conspicuous and easy to attract attention in practical applications. Summary of the invention

[0005] In order to solve some or all of the technical problems existing in the above-mentioned prior art, the present invention provides a black-box adversarial sample generation method based on deceptive texture.

[0006] The technical solution of the present invention is as follows:

[0007] A black-box adversarial sample generation method based on deceptive textures is provided, comprising:

[0008] Acquire multiple initial optimization variables, where the initial optimization variables are 2+m×m-dimensional arrays, where the first 2-dimensional values ​​of the initial optimization variables are used to represent the coordinates of the center of the adversarial patch in the image, and the last m×m-dimensional values ​​are used to represent the pixel values ​​of the adversarial patch, where the pixel values ​​are 1 or 0. When the pixel value is 1, the pixel color is white, and when the pixel value is 0, the pixel color is black;

[0009] Decoding the latter m×m dimensional values ​​of the initial optimization variable to obtain an adversarial patch corresponding to the initial optimization variable, and pasting the adversarial patch corresponding to the initial optimization variable into a pre-acquired image according to the former 2 dimensional values ​​of the initial optimization variable to obtain an adversarial sample;

[0010] The adversarial samples corresponding to the multiple initial optimization variables are respectively input into a pre-trained deep neural network model to obtain the detection results output by the deep neural network model, and the optimization variables are iteratively updated based on the multiple initial optimization variables and the detection results output by the deep neural network model to obtain the final optimization variables and their corresponding adversarial samples.

[0011] In some optional implementations, decoding the rear m×m dimensional values ​​of the initial optimization variables to obtain the adversarial patch corresponding to the initial optimization variables includes:

[0012] Converting the latter m×m dimensional values ​​of the initial optimization variables into an m×m matrix;

[0013] The m×m matrix is ​​upsampled to an n×n matrix using a nearest neighbor interpolation method to obtain an adversarial patch corresponding to the initial optimized variable.

[0014] In some optional embodiments, m=10, n=30.

[0015] In some optional embodiments, the deep neural network model adopts one of the VGG-16 neural network model, the Resnet-50 neural network model, and the Googlenet neural network model.

[0016] In some optional embodiments, the deep neural network model is trained in the following manner:

[0017] Obtain a training sample set, wherein the training sample includes a sample image and an object detection frame and an object category label corresponding to the sample image;

[0018] The deep neural network model is trained by taking the sample images of the training samples in the training sample set as input, and taking the target detection boxes and target category labels corresponding to the sample images as output.

[0019] In some optional embodiments, based on the detection results of the multiple initial optimization variables and the deep neural network model output, a genetic evolutionary algorithm is used to iteratively update the optimization variables to obtain final optimization variables and their corresponding adversarial samples.

[0020] In some optional implementations, based on the multiple initial optimization variables and the detection results output by the deep neural network model, a genetic evolutionary algorithm is used to iteratively update the optimization variables to obtain the final optimization variables and their corresponding adversarial samples, including:

[0021] Step 311, using the plurality of initial optimization variables as an initial population;

[0022] Step 312, calculating the fitness function value corresponding to each optimized variable in the current population according to the detection result output by the deep neural network model;

[0023] Step 313, determine whether the preset termination condition is met, if so, proceed to step 318, if not, proceed to step 314;

[0024] Step 314, based on the current population and the fitness function value corresponding to each optimization variable in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple intermediate optimization variables;

[0025] Step 31 5, selecting multiple optimization variables from the current population and the intermediate population as a new generation population;

[0026] Step 316, respectively decode the rear m×m dimensional values ​​of each optimization variable in the new generation population to obtain an adversarial patch corresponding to the optimization variable, and paste the adversarial patch corresponding to the optimization variable into the pre-acquired image according to the front 2 dimensional values ​​of the optimization variable to obtain an adversarial sample corresponding to each optimization variable;

[0027] Step 317, respectively inputting the adversarial samples corresponding to each optimized variable in the new generation population into the deep neural network model, obtaining the detection result output by the deep neural network model, and returning to step 312;

[0028] Step 318, select the optimization variable with the smallest corresponding fitness function value in the current population as the final optimization variable, decode the latter m×m dimensional values ​​of the final optimization variable, obtain the adversarial patch corresponding to the final optimization variable, and paste the adversarial patch corresponding to the final optimization variable into the pre-acquired image according to the first 2 dimensional values ​​of the final optimization variable to obtain the adversarial sample corresponding to the final optimization variable.

[0029] In some optional embodiments, the detection results output by the deep neural network model include: target detection box, category information and confidence level.

[0030] In some optional implementations, the fitness function is set to:

[0031] S(X) = P(X) - S0;

[0032] Among them, S(X) represents the fitness function value corresponding to the optimization variable X, P(X) represents the confidence of the target detection box output by the deep neural network model corresponding to the adversarial sample corresponding to the optimization variable X, and S0 represents the confidence threshold.

[0033] In some optional implementations, the termination condition is set to that there is a fitness function value corresponding to at least one optimization variable that is less than 0.

[0034] The main advantages of the technical solution of the present invention are as follows:

[0035] The deceptive texture-based black-box adversarial sample generation method of the present invention uses white and black as the constituent colors of the adversarial patch, so that the adversarial patch is visually similar to a "QR code" pattern, which can improve the deceptiveness of the adversarial patch; by modeling the generation problem of adversarial patches and adversarial samples as a discrete optimization problem for optimization solution, the attack effects of the obtained adversarial patches and adversarial samples can be significantly improved. At the same time, in the optimization solution process, multidimensional arrays are used as optimization variables, and the adversarial patches and adversarial samples are obtained by decoding the optimization variables, which can reduce the variable dimension in the optimization solution process, avoid the influence of excessive dimension on the optimization solution process, significantly improve the optimization solution efficiency, and reduce the optimization cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings described herein are used to provide a further understanding of the embodiments of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0037] Figure 1 A flowchart of a method for generating black-box adversarial samples based on deceptive textures provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0039] The technical solution provided by the embodiments of the present invention is described in detail below with reference to the accompanying drawings.

[0040] refer to Figure 1 The embodiment of the present invention provides a method for generating a black box adversarial sample based on deceptive texture, and the method includes the following steps 1 to 3:

[0041] Step 1, obtaining multiple initial optimization variables;

[0042] In the embodiment of the present invention, the initial optimization variable is a 2+m×m dimensional array, the first 2 dimensional values ​​of the initial optimization variable are used to represent the coordinates of the center of the adversarial patch in the image, and the last m×m dimensional values ​​are used to represent the pixel value of the adversarial patch, and the pixel value is 1 or 0; wherein, when the pixel value is 1, the pixel color is white, and when the pixel value is 0, the pixel color is black;

[0043] Step 2: decode the latter m×m dimensional values ​​of the initial optimization variable to obtain the adversarial patch corresponding to the initial optimization variable, and paste the adversarial patch corresponding to the initial optimization variable into the pre-acquired image according to the first 2 dimensional values ​​of the initial optimization variable to obtain the adversarial sample;

[0044] In an embodiment of the present invention, the image used to paste the adversarial patch is determined and obtained according to the function and role of the actual target model to be attacked. For example, when the actual target model to be attacked is used for classification detection of a certain type of object, the image used to paste the adversarial patch is an image containing the object of that type.

[0045] It should be noted that, for the same batch of optimization variables, the images used to paste the adversarial patches corresponding to the optimization variables are the same images, so as to avoid the influence of external factors on the optimization solution of the optimization variables and the adversarial samples.

[0046] Step 3: Input the adversarial samples corresponding to the multiple initial optimization variables into the pre-trained deep neural network model respectively to obtain the detection results output by the deep neural network model, and iteratively update the optimization variables based on the multiple initial optimization variables and the detection results output by the deep neural network model to obtain the final optimization variables and their corresponding adversarial samples.

[0047] The black-box adversarial sample generation method based on deceptive texture provided by an embodiment of the present invention uses white and black as the constituent colors of the adversarial patch, so that the adversarial patch is visually similar to a "QR code" pattern, thereby improving the deceptiveness of the adversarial patch; by modeling the generation problem of adversarial patches and adversarial samples as a discrete optimization problem for optimization solution, the attack effects of the obtained adversarial patches and adversarial samples can be significantly improved. At the same time, in the optimization solution process, multidimensional arrays are used as optimization variables, and the adversarial patches and adversarial samples are obtained by decoding the optimization variables, which can reduce the variable dimension in the optimization solution process, avoid the influence of excessive dimensionality on the optimization solution process, significantly improve the optimization solution efficiency, and reduce the optimization cost.

[0048] Further, in an optional implementation of the embodiment of the present invention, in step 2, decoding the rear m×m dimensional values ​​of the initial optimization variables to obtain the adversarial patches corresponding to the initial optimization variables includes the following steps:

[0049] Step 201, converting the latter m×m dimensional values ​​of the initial optimization variables into an m×m matrix;

[0050] Step 202 , using the nearest neighbor interpolation method to upsample the m×m matrix to an n×n matrix, and obtain an adversarial patch corresponding to the initial optimized variable.

[0051] It should be noted that when generating adversarial patches, one matrix element corresponds to one pixel.

[0052] In the embodiment of the present invention, by upsampling the optimization variables to obtain the adversarial patch, the variable dimension in the adversarial patch and adversarial sample optimization solution process can be reduced, the optimization efficiency can be improved, the optimization cost can be reduced, and the dimensionality disaster can be avoided.

[0053] It should be noted that the nearest neighbor interpolation method is a commonly used upsampling method in the art and will not be described in detail here.

[0054] In the embodiment of the present invention, the initial optimization variables are obtained by randomly initializing the values ​​of different dimensions in the variables.

[0055] Furthermore, the specific values ​​of m and n are set according to actual needs. In the embodiment of the present invention, m is set to 10, and the optimization variable is a 102-dimensional array; n is set to 30, and the 10×10 matrix is ​​upsampled to a 30×30 matrix.

[0056] Furthermore, the deep neural network model is set according to the function and role of the actual target model to be attacked.

[0057] In an embodiment of the present invention, when the actual target model to be attacked is used for target classification detection, the deep neural network model can adopt one of the VGG-16 neural network model, the Resnet-50 neural network model, and the Googlenet neural network model.

[0058] Further, in an optional implementation of the embodiment of the present invention, in step 3, the deep neural network model is trained in the following manner:

[0059] Step 301, obtaining a training sample set, where the training sample includes a sample image and a target detection frame and a target category label corresponding to the sample image;

[0060] Step 302: Take the sample image of the training sample in the training sample set as input, take the target detection box and target category label corresponding to the sample image as output, and train the deep neural network model.

[0061] The sample images are directly obtained from the existing image dataset according to the actual target model to be attacked and the actually set deep neural network model.

[0062] In an embodiment of the present invention, when the actual target model to be attacked is used for target classification detection, and the deep neural network model adopts one of the VGG-16 neural network model, the Resnet-50 neural network model, and the Googlenet neural network model, the sample image is selected from the ImageNet dataset.

[0063] Furthermore, the number of training samples in the training sample set is set according to actual needs. In the embodiment of the present invention, the number of training samples is set to 1,000.

[0064] Furthermore, in an embodiment of the present invention, a sample image of a training sample in a training sample set is used as input, and a target detection box and a target category label corresponding to the sample image are used as output to train a deep neural network model, further including the following steps 3021-3023:

[0065] Step 3021, inputting the sample images in all training samples into the deep neural network model in batches, and obtaining the target detection box, category information and confidence corresponding to the sample images output by the deep neural network model;

[0066] In one embodiment of the present invention, a sample image is input from the input end of a deep neural network model, processed in sequence by each layer in the deep neural network model, and output from the output end of the deep neural network model. The information output by the deep neural network model is the target detection box, category information, and confidence corresponding to the sample image.

[0067] In one embodiment of the present invention, the deep neural network model is the model to be trained, and the model parameters are initialization parameters. During the training process of the model, the model parameters are continuously updated and learned.

[0068] Step 3022, calculating a preset loss function according to the target detection box and target category label corresponding to the sample image in the training sample, and the target detection box and category information corresponding to the sample image output by the deep neural network model;

[0069] In an embodiment of the present invention, a preset loss function is calculated based on the target detection box and target category label corresponding to the sample image in each training sample input to the deep neural network model, and the target detection box and category information corresponding to each sample image output by the deep neural network model.

[0070] The specific type of the loss function is set according to actual needs. In the embodiment of the present invention, the loss function adopts the cross entropy loss function.

[0071] Step 3023, determine whether the preset training stop condition is reached. If so, use the current deep neural network model as the deep neural network model to complete the training. If not, use the preset loss function to update the parameters of the deep neural network model and return to step 3021.

[0072] The training stop condition is set according to the actual situation. In the embodiment of the present invention, the training stop condition is set as the number of training iterations reaches a set number of iterations or the optimization index reaches a set threshold. Among them, the loss function is used as the optimization index.

[0073] Furthermore, in one embodiment of the present invention, the stochastic gradient descent method is used to train and update the parameters of the deep neural network model.

[0074] Specifically, the following formula is used to update the parameters of the deep neural network model:

[0075]

[0076] Among them, θ represents the parameter set of the deep neural network model, Δ[·] represents the optimizer, η represents the learning rate, and Loss represents the loss function. The optimizer is set according to the actual situation, for example, Adam, and the learning rate is pre-set to control the speed of updating the parameters of the deep neural network model.

[0077] Furthermore, in an optional implementation of an embodiment of the present invention, in step 3, based on multiple initial optimization variables and the detection results output by the deep neural network model, a genetic evolutionary algorithm is used to iteratively update the optimization variables to obtain the final optimization variables and their corresponding adversarial samples.

[0078] Furthermore, in an embodiment of the present invention, based on multiple initial optimization variables and the detection results output by the deep neural network model, a genetic evolutionary algorithm is used to iteratively update the optimization variables to obtain the final optimization variables and their corresponding adversarial samples, further comprising the following steps:

[0079] Step 311, using multiple initial optimization variables as an initial population;

[0080] Step 312, calculating the fitness function value corresponding to each optimized variable in the current population according to the detection result output by the deep neural network model;

[0081] In an embodiment of the present invention, the detection results output by the deep neural network model include: target detection box, category information and confidence level.

[0082] In this embodiment of the present invention, the fitness function is set to:

[0083] S(X)=P(X)-S0;

[0084] Among them, S(X) represents the fitness function value corresponding to the optimization variable X, P(X) represents the confidence of the target detection box output by the deep neural network model corresponding to the adversarial sample corresponding to the optimization variable X, and S0 represents the confidence threshold.

[0085] Step 313, determine whether the preset termination condition is met, if so, proceed to step 318, if not, proceed to step 314;

[0086] The termination condition is set according to the actual situation. In the embodiment of the present invention, considering that the role of the adversarial patch is to make the confidence value of the target image detected and recognized by the deep neural network model after the adversarial patch is pasted lower than the confidence threshold so that the target detection frame is screened out, for this reason, the termination condition is set to the fitness function value corresponding to at least one optimization variable being less than 0.

[0087] Step 314, based on the current population and the fitness function value corresponding to each optimization variable in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple intermediate optimization variables;

[0088] In an embodiment of the present invention, based on the current population and the fitness function value corresponding to each optimization variable in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple intermediate optimization variables, further comprising the following steps:

[0089] Step 3141, performing a mutation operation based on the current population to obtain multiple mutant individuals;

[0090] Step 3142, performing a crossover operation based on the current population and its corresponding mutant individuals to obtain a descendant population corresponding to the current population;

[0091] Step 3143, based on the current population and its corresponding offspring population, a selection operation is performed with the goal of minimizing the fitness function value corresponding to the individual to obtain an intermediate population.

[0092] It should be noted that the above individuals refer to optimization variables.

[0093] In the embodiment of the present invention, the intermediate population obtained in the above manner is the next generation population of the current population.

[0094] Specifically, set the current population to:

[0095]

[0096] Among them, P t represents the current population, that is, the tth generation population, P t (i) represents the population P t The i-th individual in represents the range of individual variable values, N represents the total number of individuals in the population, and T represents the total number of iterations. The upper and lower bounds of all variables are [0,1].

[0097] The mutation operation is expressed as:

[0098] P M (i) = P t (r1)+F(P t (r2)-P t (r3))r1≠r2≠r3≠i

[0099] Among them, P M (i) represents individual P t (i) The corresponding variant individual, F represents the mutation factor, P t (r1),P t (r2) and P t (r3) respectively represent the population P t The r1th individual, r2th individual and r3th individual in , r1, r2 and r3 represent individual indexes, satisfying the inequality constraint.

[0100] The crossover operation is expressed as:

[0101]

[0102] Among them, P C (i) represents the population P t The corresponding offspring population P C The i-th individual in N individuals PC (i) (i = 1, 2, ..., N) constitutes the offspring population P C , C r represents the mutation probability, and rand represents random sampling from the interval [0,1].

[0103] The selection operation is represented as:

[0104]

[0105] Among them, P t+1 (i) represents the population P of the t+1th generation t+1 The i-th individual in f(P t (i)) represents individual P t (i) The corresponding fitness function value, f(P C (i)) represents individual P C (i) A corresponding fitness function value, which is calculated and determined based on the fitness function set above.

[0106] Step 315, selecting multiple optimization variables from the current population and the intermediate population as a new generation population;

[0107] In the embodiment of the present invention, a preset number of optimization variables with the smallest fitness function values ​​are selected from the current population and the intermediate population as individuals in the population to form a new generation of population.

[0108] It should be noted that the number of individuals in different generations of populations is the same, that is, the number of optimization variables in different generations of populations is the same. For this reason, the preset number here is equal to the initial number of optimization variables in the initial population.

[0109] Step 316, respectively decode the rear m×m dimensional values ​​of each optimization variable in the new generation population to obtain an adversarial patch corresponding to the optimization variable, and paste the adversarial patch corresponding to the optimization variable into the pre-acquired image according to the front 2 dimensional values ​​of the optimization variable to obtain an adversarial sample corresponding to each optimization variable;

[0110] Step 317, respectively input the adversarial samples corresponding to each optimized variable in the new generation population into the deep neural network model, obtain the detection result output by the deep neural network model, and return to step 312;

[0111] In the embodiment of the present invention, since the termination condition of the iterative update is not satisfied, after obtaining the new generation population and its corresponding detection result, the process returns to step 312 to continue the iterative update.

[0112] Step 318, select the optimization variable with the smallest corresponding fitness function value in the current population as the final optimization variable, decode the value of the last m×m dimension of the final optimization variable, obtain the adversarial patch corresponding to the final optimization variable, and paste the adversarial patch corresponding to the final optimization variable into the pre-acquired image according to the value of the first 2 dimensions of the final optimization variable to obtain the adversarial sample corresponding to the final optimization variable.

[0113] In an embodiment of the present invention, when the termination condition is met, the optimization variable with the smallest corresponding fitness function value in the current population is selected as the final optimization variable output, and the posterior m×m dimensional value of the final optimization variable is decoded to obtain the corresponding adversarial patch, and the adversarial sample corresponding to the final optimization variable is obtained by pasting the adversarial patch into the pre-acquired image.

[0114] It should be noted that during the iterative update process, the image used to paste the adversarial patch is the same image to avoid the influence of external factors on the optimization variables and the optimization solution of the adversarial sample.

[0115] The black-box adversarial sample generation method based on deceptive texture provided by an embodiment of the present invention uses white and black as the constituent colors of the adversarial patch, so that the adversarial patch is visually similar to a "QR code" pattern, thereby improving the deceptiveness of the adversarial patch; by modeling the generation problem of adversarial patches and adversarial samples as a discrete optimization problem for optimization solution, the attack effects of the obtained adversarial patches and adversarial samples can be significantly improved. At the same time, in the optimization solution process, multidimensional arrays are used as optimization variables, and the adversarial patches and adversarial samples are obtained by decoding the optimization variables, which can reduce the variable dimension in the optimization solution process, avoid the influence of excessive dimensionality on the optimization solution process, significantly improve the optimization solution efficiency, and reduce the optimization cost.

[0116] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In addition, "front", "back", "left", "right", "upper" and "lower" in this article are all referenced to the placement state shown in the accompanying drawings.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A black-box adversarial sample generation method based on deceptive textures, characterized in that: include: Acquire multiple initial optimization variables, where the initial optimization variables are 2+m×m-dimensional arrays, where the first 2-dimensional values ​​of the initial optimization variables are used to represent the coordinates of the center of the adversarial patch in the image, and the last m×m-dimensional values ​​are used to represent the pixel values ​​of the adversarial patch, where the pixel values ​​are 1 or 0. When the pixel value is 1, the pixel color is white, and when the pixel value is 0, the pixel color is black; Decoding the latter m×m dimensional values ​​of the initial optimization variable to obtain an adversarial patch corresponding to the initial optimization variable, and pasting the adversarial patch corresponding to the initial optimization variable into a pre-acquired image according to the former 2 dimensional values ​​of the initial optimization variable to obtain an adversarial sample; The adversarial samples corresponding to the multiple initial optimization variables are respectively input into a pre-trained deep neural network model to obtain the detection results output by the deep neural network model, and the optimization variables are iteratively updated based on the multiple initial optimization variables and the detection results output by the deep neural network model to obtain the final optimization variables and their corresponding adversarial samples.

2. The method for generating black-box adversarial samples based on deceptive textures according to claim 1, characterized in that: The decoding of the rear m×m dimensional values ​​of the initial optimization variables to obtain the adversarial patch corresponding to the initial optimization variables includes: Converting the latter m×m dimensional values ​​of the initial optimization variables into an m×m matrix; The m×m matrix is ​​upsampled to an n×n matrix using a nearest neighbor interpolation method to obtain an adversarial patch corresponding to the initial optimized variable.

3. The method for generating black-box adversarial samples based on deceptive textures according to claim 2, characterized in that: m=10, n=30.

4. The method for generating black-box adversarial samples based on deceptive textures according to claim 1, characterized in that: The deep neural network model adopts one of the VGG-16 neural network model, the Resnet-50 neural network model, and the Googlenet neural network model.

5. The method for generating black-box adversarial samples based on deceptive textures according to claim 1, characterized in that: The deep neural network model is trained in the following way: Obtain a training sample set, wherein the training sample includes a sample image and an object detection frame and an object category label corresponding to the sample image; The deep neural network model is trained by taking the sample images of the training samples in the training sample set as input, and taking the target detection boxes and target category labels corresponding to the sample images as output.

6. The method for generating black-box adversarial samples based on deceptive textures according to claim 1, characterized in that: Based on the detection results of the multiple initial optimization variables and the deep neural network model output, the optimization variables are iteratively updated using a genetic evolutionary algorithm to obtain the final optimization variables and their corresponding adversarial samples.

7. The method for generating black-box adversarial samples based on deceptive textures according to claim 6, characterized in that: Based on the detection results of the multiple initial optimization variables and the output of the deep neural network model, the optimization variables are iteratively updated using a genetic evolutionary algorithm to obtain the final optimization variables and their corresponding adversarial samples, including: Step 311, using the plurality of initial optimization variables as an initial population; Step 312, calculating the fitness function value corresponding to each optimized variable in the current population according to the detection result output by the deep neural network model; Step 313, determine whether the preset termination condition is met, if so, proceed to step 318, if not, proceed to step 314; Step 314, based on the current population and the fitness function value corresponding to each optimization variable in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple intermediate optimization variables; Step 315, selecting multiple optimization variables from the current population and the intermediate population as a new generation population; Step 316, respectively decode the rear m×m dimensional values ​​of each optimization variable in the new generation population to obtain an adversarial patch corresponding to the optimization variable, and paste the adversarial patch corresponding to the optimization variable into the pre-acquired image according to the front 2 dimensional values ​​of the optimization variable to obtain an adversarial sample corresponding to each optimization variable; Step 317, respectively inputting the adversarial samples corresponding to each optimized variable in the new generation population into the deep neural network model, obtaining the detection result output by the deep neural network model, and returning to step 312; Step 318, select the optimization variable with the smallest corresponding fitness function value in the current population as the final optimization variable, decode the latter m×m dimensional values ​​of the final optimization variable, obtain the adversarial patch corresponding to the final optimization variable, and paste the adversarial patch corresponding to the final optimization variable into the pre-acquired image according to the first 2 dimensional values ​​of the final optimization variable to obtain the adversarial sample corresponding to the final optimization variable.

8. The method for generating black-box adversarial samples based on deceptive textures according to claim 1 or 7, characterized in that: The detection results output by the deep neural network model include: target detection box, category information and confidence.

9. The method for generating black-box adversarial samples based on deceptive textures according to claim 8, characterized in that: The fitness function is set as: S(X) = P(X) - S0; Among them, S(X) represents the fitness function value corresponding to the optimization variable X, P(X) represents the confidence of the target detection box output by the deep neural network model corresponding to the adversarial sample corresponding to the optimization variable X, and S0 represents the confidence threshold.

10. The method for generating black-box adversarial samples based on deceptive textures according to claim 9, characterized in that: The termination condition is set to that there is at least one optimization variable corresponding to a fitness function value less than 0.

Images