Target detection model-oriented low-distortion physical space countermeasure attack method and system

Abstract

The invention relates to a target detection model-oriented low-distortion physical space attack countermeasure method and system, belongs to the technical field of artificial intelligence security, and solves the problems of low robustness and high perceptual distortion of generated countermeasure samples in the prior art. Obtaining an adversarial sample intermediate image of the initial iteration round; performing affine transformation on the adversarial sample intermediate image x'of the current round, and introducing a random background image to obtain an image xphy after random physical transformation; calculating cross entropy loss to obtain a cross entropy loss item; calculating to obtain an L2 square distance loss item; calculating to obtain a human eye perception distortion loss item; obtaining a total loss function LOSS; updating the adversarial sample intermediate image x'of the current round by adopting a gradient descent mode; and S2, judging whether the total loss function LOSS converges or not, if so, completing optimization, and outputting the adversarial sample intermediate image x'of the current round as a final result, otherwise, returning to execute the step S2.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security technology, and specifically relates to a low-distortion physical space counterattack method and system for a target detection model. Background Art

[0002] Today, target detection models based on deep neural networks are widely used in the real world, playing an important role in autonomous driving, security monitoring, medical image analysis and other fields. However, at the same time, target detection models based on deep neural networks are vulnerable to adversarial samples. Adversarial sample inputs from digital or physical space can cause target detection models to produce erroneous detection results, which in turn brings risks to the model in key safety-related decisions.

[0003] Compared with the adversarial attack methods in digital space, the adversarial attack methods in physical space are more realistic for target detection models. The physical space adversarial attack method can attack the target detection model by adding perturbations to physical entities in the real world and generating physical space adversarial samples. This attack can adapt to changes in lighting, viewing angle, and distance in the physical space to a certain extent. At the same time, the adversarial attack methods for target detection models should be natural enough and not easily perceived by the human eye. If the adversarial sample image is very different from the original image and produces perturbations that are obviously perceived by the human eye, it is easy for people to discover the intention of the adversarial sample to attack the target detection model.

[0004] At present, most of the existing physical space adversarial attack methods for target detection models focus on the physical robustness of generating adversarial samples, but ignore the perceptual distortion of adversarial samples to a certain extent. Therefore, there is a demand for generating physical space adversarial samples with high physical robustness and low perceptual distortion for target detection models. Summary of the invention

[0005] In order to solve the above problems, a low-distortion physical space adversarial attack method and system for a target detection model is provided according to an embodiment of the present invention. This method belongs to a physical space adversarial attack method for a target detection model, which focuses on generating physical robustness of adversarial samples while reducing the perceived distortion of adversarial samples. The technical key point of this method is to maintain the physical robustness of the adversarial attack method while reducing the perceived distortion of the generated adversarial samples as much as possible.

[0006] According to an embodiment of the present invention, a low-distortion physical space counterattack method for a target detection model is provided, comprising the following steps:

[0007] S1: Input the original image from the digital space, process the original image to get the cropped image xo , and the intermediate image of the adversarial sample in the initial iteration round;

[0008] S2: Perform an affine transformation on the intermediate image x′ of the current round of adversarial samples and introduce a random background image to obtain the image x after random physical transformation corresponding to the intermediate image x′ of the current round of adversarial samples. phy ;

[0009] S3: Calculate the cross entropy loss and convert the randomly physically transformed image x phy Input into the target detection model expected to be attacked to obtain the detection category Used to calculate the cross entropy loss term;

[0010] S4: Calculate the intermediate image x′ and cropped image x of the current round of adversarial samples o The L2 square distance is calculated and the result is multiplied by the weight hyperparameter w1 to obtain the L2 square distance loss term:

[0011] S5: Calculate the intermediate image x′ and cropped image x of the current round of adversarial samples o The difference between the structural similarity index SSIM and 1 is then multiplied by the perceptual distortion weight hyperparameter w2 to obtain the human eye perceptual distortion loss term: w2*(1-SSIM(x′,x o ));

[0012] S6: Add the obtained cross entropy loss term, L2 square distance loss term and human eye perception distortion loss term to obtain the total loss function LOSS;

[0013] S7: Update the intermediate image x′ of the adversarial sample of the current round using gradient descent;

[0014] S8: Determine whether the total loss function LOSS converges. If so, the optimization is completed and the intermediate image x′ of the adversarial sample of the current round is output as the final result; otherwise, return to step S2 and use the updated intermediate image x′ of the adversarial sample as the intermediate image x′ of the adversarial sample of the next round.

[0015] Optionally, the step S1 specifically includes the following steps:

[0016] S1-1: Input a normal original image containing the detection target from the digital space, and crop the input original image to obtain the cropped image x o , there is only a single detection target in the cropped image, and the cropped image x o The size is uniformly set to Psize*Psize;

[0017] S1-2: Identify and provide the correct category y of the detected target in the cropped image, or provide the wrong category y′ that is expected to mislead the output of the target detection model;

[0018] S1-3: Use the cropped image as the intermediate image x′ of the adversarial sample in the initial iteration round.

[0019] Optionally, the step S2 specifically includes the following steps:

[0020] S2-1: Perform a distance transformation on the intermediate image x′ of the current round of adversarial samples, where the distance transformation corresponds to the scaling transformation of the image, to obtain the scaled transformed image corresponding to the intermediate image x′ of the current round of adversarial samples;

[0021] S2-2: Perform an angle transformation on the image after the scaling transformation in S2-1, and the angle transformation corresponds to the rotation transformation of the image, so as to obtain the scaling transformation and rotation transformation image corresponding to the intermediate image x′ of the adversarial sample in the current round;

[0022] S2-3: Perform a translation transformation on the image after scaling and rotation transformation in S2-2, and introduce a random background image to simulate the background transformation in the real world, and overlay the scaling and rotation transformation image corresponding to the intermediate image x′ of the current round of adversarial sample at a random position of the background image to obtain the random physical transformation image x corresponding to the intermediate image x′ of the current round of adversarial sample. phy .

[0023] Optionally, the step S3 specifically includes the following steps:

[0024] The image x obtained in S2 phy Input into the target detection model expected to be attacked to obtain the detection category

[0025] From S1-2, we get the correct category y of the detected target in the cropped image or the wrong category u′ that we expect to mislead the target detection model to output. The correct category u is the same as the detected category The negative value of the cross entropy loss, or the difference between the wrong category u′ and the detected category The cross entropy loss of , as the cross entropy loss term.

[0026] Optionally, step S2 specifically includes the following steps:

[0027] S2-1: Perform distance transformation on the intermediate image x′ of the current round of adversarial samples. The distance transformation corresponds to the scaling transformation of the image, and obtain the scaled transformed image corresponding to the intermediate image x′ of the current round of adversarial samples. The scaling transformation is performed as follows:

[0028]

[0029] Among them, the two-dimensional vector is the pixel coordinate of the intermediate image x′ of the adversarial sample in the current round, is the image pixel coordinate after scaling x′, s p and q are the scaling ratios of the image in the horizontal and vertical directions respectively;

[0030] S2-2: Perform an angle transformation on the image after the scaling transformation in S2-1. The angle transformation corresponds to the rotation transformation of the image, and obtain the scaling transformation and rotation transformation image corresponding to the intermediate image x′ of the current round of adversarial sample. The rotation transformation is performed as follows:

[0031]

[0032] Among them, the two-dimensional vector is the image pixel coordinate after scaling transformation obtained by S2-1, To rotate the pixel coordinates of the image after the rotation transformation, θ is the radian value of the image rotation, and the counterclockwise direction is the positive direction;

[0033] S2-3: Perform a translation transformation on the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial samples, and introduce a random background image with a uniform pixel size of Bsize*Bsize. Overlay the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial samples on the background image, and perform a translation transformation to obtain the image x after random physical transformation corresponding to the intermediate image x′ of the current round of adversarial samples. phy , the translation transformation is performed as follows:

[0034]

[0035] Among them, the two-dimensional vector is the image pixel coordinate after rotation transformation obtained by S2-2, On this basis, the pixel coordinates of the image are transformed after translation, t p and t q are the horizontal and vertical translations of the image, respectively, and are determined by the image pixel points The image formed is the image x after random physical transformation corresponding to the intermediate image x′ of the adversarial sample in the current round phy .

[0036] Optionally, the step S3 specifically includes the following steps:

[0037] The image x obtained by performing affine transformation on the adversarial sample image and adding random background phy , input to the attacked target detection model, obtain the target detection bounding box set rpn(), and then calculate the negative value of the cross entropy loss between the detection category and the correct category, or the cross entropy loss between the detection category and the wrong category in each bounding box;

[0038] The cross entropy loss of each bounding box under each transformation is averaged, and then the expected value of the mean cross entropy loss under all transformations is calculated. The expected value is used as the cross entropy loss term. The optimization objective function of the cross entropy loss term is as follows:

[0039]

[0040] or:

[0041]

[0042] Among them, M t () represents the physical condition transformation imposed on the adversarial sample image, F() is the attacked target detection model, and the input image obtains the corresponding detection category; L() is the cross entropy loss between different categories; rpn() is the target detection bounding box set, m is the number of bounding box elements in the set, and r i represents a specific target detection bounding box, i represents the bounding box number, t represents a specific affine transformation, T represents a set of affine transformations, Indicates calculation of different M t () is the expected value of the cross entropy loss.

[0043] Optionally, step S5 further includes: optimizing the human eye perception distortion loss term, and the optimization objective function of the human eye perception distortion loss term is as follows: argmin(1-SSIM(x′,x o )).

[0044] Optionally, step S6 further includes:

[0045] The total loss function LOSS is optimized. The optimization objective function of the total loss function LOSS is as follows

[0046]

[0047] or:

[0048]

[0049] Optionally, it is characterized in that:

[0050] In S1, the cropped image size Psize is set to 600px±100px;

[0051] The value of the hyperparameter w1 in S4 is set to 0.005±0.001;

[0052] The value of the hyperparameter w2 in S5 is set to 2500 to 3000.

[0053] According to another embodiment of the present invention, a system for executing the low-distortion physical space adversarial attack method for a target detection model includes: a basic method module, which selects a target detection model as an attacked model, maximizes the cross entropy loss between a detection category and a correct category, or minimizes the cross entropy loss between a detection category and an incorrect category, and iterates and updates adversarial images by gradient descent as optimization targets; a physical constraint module, which models the physical constraint part using an expected transformation method, and designs relevant loss functions to convert it into optimization targets, wherein the expected transformation method includes performing an affine transformation on the adversarial sample image of the current round in each round of iterative optimization of the adversarial sample image to simulate changes in physical conditions in the real world; a human eye perception distortion constraint module, which selects a structural similarity index closely related to human eye perception to model the perceptual distortion constraint, and designs relevant loss function terms, converts the human eye perception distortion constraint part into an optimization target by modeling it using the structural similarity index, and combines it with the optimization targets given in the above-mentioned basic method module and physical constraint module for joint optimization.

[0054] According to an embodiment of the present invention, a low-distortion physical space adversarial attack method for a target detection model is provided. First, starting from the basic method of adversarial attack on the target detection model, the adversarial sample image is iteratively optimized by gradient descent by accessing the internal parameters of the attacked model; then, the physical constraints are modeled and represented by the expectation over transformation (EOT) method, and relevant loss function terms are designed and added to the above-mentioned basic adversarial attack method; finally, the structural similarity index (Structural Similarity, SSIM) is selected as an indicator to measure the degree of distortion perceived by the human eye, and corresponding loss function terms and weight coefficients are designed for it.

[0055] According to an embodiment of the present invention, a low-distortion physical space adversarial attack system for a target detection model is provided, which reduces the perceived distortion of the generated adversarial samples as much as possible while maintaining the physical robustness of the adversarial attack, and includes: a basic method module, a physical constraint module, and a human eye perception distortion constraint module.

[0056] The basic method module updates the adversarial image iteratively by gradient descent. Specifically, a target detection model is selected as the attacked model, and the cross entropy loss between the detection category and the correct category is maximized, or the cross entropy loss between the detection category and the wrong category is minimized.

[0057] The physical constraint module selects the expected transformation method to model the physical constraints and designs related loss function terms to be added to the above-mentioned basic method for countering attacks. Specifically, the physical constraint part is modeled using the expected transformation method and converted into an optimization target, which is then combined with the optimization target given in the above-mentioned basic method module for joint optimization.

[0058] The human eye perception distortion constraint module selects a structural similarity index that is closely related to human eye perception to model the perception distortion constraint, and designs a related loss function term to be added to the above-mentioned adversarial attack method that introduces the physical constraint module. Specifically, the human eye perception distortion constraint part is modeled using the structural similarity index and converted into an optimization target, which is combined with the optimization targets given in the above-mentioned basic method module and physical constraint module for joint optimization.

[0059] Furthermore, the attacked target detection model selected in the basic method module can be a "two-stage" target detection model such as Faster R-CNN or a "one-stage" target detection model such as YOLO. For the "two-stage" target detection model, the cross entropy loss between the detection category and the correct / wrong category in the classification stage is calculated.

[0060] Furthermore, the expected transformation method selected in the physical constraint module applies a certain affine transformation to the adversarial sample image of the current round in each round of iterative optimization of the adversarial sample image, simulating the changes in physical conditions (such as distance, angle, lighting, etc.) in the real world, so as to continuously improve the success rate of adversarial sample image attacks while strengthening the physical robustness of the adversarial sample image.

[0061] Furthermore, the structural similarity index selected by the human eye perception distortion constraint module comprehensively considers information such as brightness, contrast and structure, and is closer to the human eye's perception mode. It simulates the human eye's perception process of an image, and therefore performs well in evaluating the human eye's perception distortion.

[0062] Furthermore, in the process of combining the physical constraint module with the human eye perception distortion constraint module, in order to balance the constraint relationship between physical robustness and the degree of perceptual distortion, a perceptual distortion weight hyperparameter is set for the perceptual distortion optimization item. The selection of this hyperparameter value directly determines the physical robustness and perceptual distortion degree of the generated adversarial sample.

[0063] Furthermore, the selected value of the hyperparameter w2 in the above-mentioned total optimization objective function is crucial. As shown in the above-mentioned total optimization objective function, the first optimization item requires that the cross entropy between the detection category and the correct category after the adversarial sample image is input into the attacked target detection model is as large as possible, or the cross entropy with the wrong category is as small as possible. At the same time, the introduced expected transformation method requires that the adversarial sample image has a certain physical robustness. These requirements force the adversarial sample image to be iteratively optimized in the direction of increasing the perturbation range and intensity. The perceptual distortion optimization item requires that the perceptual distortion degree between the adversarial sample image and the original image is as small as possible, which in turn limits the perturbation range and intensity of the adversarial sample image to a certain extent. Therefore, the optimization of the physical robustness of the adversarial sample image and the optimization of the perceptual distortion degree have a certain degree of "antagonistic" relationship, and the value selected by the perceptual distortion weight hyperparameter w2 will directly determine whether the physical robustness and perceptual distortion degree of the adversarial sample image can be balanced during the optimization process.

[0064] Compared with the prior art, the low-distortion physical space counterattack method and system for target detection model provided according to the embodiments of the present invention have at least the following beneficial effects:

[0065] 1. The low-distortion physical space adversarial attack method for the target detection model provided by the embodiment of the present invention realizes the construction of an adversarial attack model for generating physical space adversarial sample images.

[0066] 2. The low-distortion physical space adversarial attack method for target detection models provided in the embodiments of the present invention improves physical robustness by introducing the expected transformation method to simulate the transformation of various physical conditions in the iterative optimization process of the adversarial sample image; and reduces the degree of perceptual distortion by setting the adversarial attack method to design the corresponding optimization objective function item according to the structural similarity index.

[0067] 3. The low-distortion physical space counterattack method for the target detection model provided by the embodiment of the present invention can effectively discover the potential security vulnerabilities in the current target detection model, thereby improving the security of the target detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. By referring to the drawings, the features and advantages of the present invention will be more clearly understood. The drawings are schematic and should not be understood as limiting the present invention in any way. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0069] Figure 1It is a flow chart of the low-distortion physical space counterattack method for target detection model proposed in the present invention.

[0070] Figure 2 It is the algorithm pseudo code of the low-distortion physical space counterattack method for the target detection model proposed in the present invention.

[0071] Figure 3 This is an example diagram of a random background image selected in an embodiment of a low-distortion physical space counterattack method for a target detection model provided by an embodiment of the present invention.

[0072] Figure 4 It is an embodiment of a low-distortion physical space adversarial attack method for a target detection model provided by an embodiment of the present invention, which generates an adversarial sample image and then collects a schematic diagram of points in the physical space. DETAILED DESCRIPTION

[0073] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0074] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0075] The following is a detailed description of a low-distortion physical space counterattack method for a target detection model provided according to an embodiment of the present invention.

[0076] like Figure 1-2 As shown, according to the first embodiment of the present invention, a low-distortion physical space adversarial attack method for a target detection model is provided, which performs a joint iterative optimization of physical constraints and perceptual distortion constraints on the input original image, including the following steps.

[0077] S1: Input an original image from a digital space, process the original image to obtain a cropped image, and an intermediate image of an adversarial sample in an initial iteration round. This step S1 specifically includes the following steps.

[0078] S1-1: Input a normal original image containing the detection target from the digital space, and crop the input original image to obtain the cropped image x o , ensuring that there is only a single detected target in the cropped image. o The size is uniformly set to Psize*Psize.

[0079] S1-2: Identify and provide the correct category y of the detected object in the cropped image, or provide the wrong category y′ that is expected to mislead the output of the target detection model.

[0080] S1-3: The cropped image is used as the intermediate image x′ of the adversarial sample in the initial iteration round. The subsequent steps S2-S7 will iteratively optimize the intermediate image x′.

[0081] S2: Perform an affine transformation on the intermediate image x′ of the current round of adversarial samples and introduce a random background image (such as Figure 3 As shown in Figure 2, the distance, angle, background and other physical conditions in the real world are simulated to obtain the image x after random physical transformation corresponding to the intermediate image x′ of the current round of adversarial samples. phy The introduced random background image may be related to a specific target included in the original image, and may be obtained by on-site photography, Internet search, etc. Step S2 specifically includes the following steps.

[0082] S2-1: Perform a distance transformation on the intermediate image x′ of the adversarial sample of the current round. The distance transformation actually corresponds to the scaling transformation of the image, and obtains the scaled transformed image corresponding to the intermediate image x′ of the adversarial sample of the current round.

[0083] S2-2: Perform an angle transformation on the image after scaling transformation in S2-1. The angle transformation actually corresponds to the rotation transformation of the image, and obtain the image after scaling transformation and rotation transformation corresponding to the intermediate image x′ of the adversarial sample in the current round.

[0084] S2-3: Perform translation transformation on the image after scaling and rotation transformation in S2-2, and introduce a random background image to simulate the background transformation in the real world. The background image can be selected from a background image that is close to the content of the adversarial sample image, and the pixel size is unified to Bsize*Bsize. The image after scaling and angle transformation corresponding to the intermediate image x′ of the current round of adversarial samples is overlaid at a random position of the background image. Note that the edge of the image after scaling and rotation transformation cannot exceed the introduced random background image, and the image x after random physical transformation corresponding to the intermediate image x′ of the current round of adversarial samples is obtained. phy This step involves a translation transformation operation on the adversarial sample image on the background image.

[0085] S3: Calculate the cross entropy loss and transform the image x obtained in S2 after random physical transformation phy Input into the target detection model expected to be attacked to obtain the detection category Then calculate the correct category y given in S1-2 and the detected category The negative value of the cross entropy loss, or the difference between the wrong category y′ and the detected category The calculated loss is called the cross entropy loss term, which will be used to add other loss terms for joint optimization. Among them, for the cross entropy loss term, if you only need the generated adversarial image to mislead the target detection model and fail to output the correct category, you can choose the correct category y and the detection category The negative value of the cross entropy loss; if you need to not only fail to output the correct category, but also let the target detection model output the specified error category, the optional error category y′ and the detection category The cross entropy loss.

[0086] S4: Calculate the L2 square distance loss. Calculate the current round of adversarial sample intermediate image x′ and cropped image x o The L2 square distance is multiplied by the weight hyperparameter w1 to obtain the L2 square distance loss, that is, The selection of the value of the hyperparameter w1 needs to be manually adjusted according to the effect of the final generated adversarial sample image. The larger the w1 value, the larger the added micro-perturbation, and the higher the attack success rate of the generated adversarial sample image, but the corresponding degree of perceptual distortion of the adversarial sample image will be greater. This loss term is called the L2 squared distance loss term, which will be used to add with other loss terms for joint optimization.

[0087] S5: Calculate the distortion loss perceived by the human eye. Calculate the intermediate image x′ and the cropped image x of the current round of adversarial samples o The structural similarity index SSIM is calculated, and the difference between it and 1 is multiplied by the perceptual distortion weight hyperparameter w2, that is, w2*(1-SSIM(x′,x o )). The selection of the hyperparameter w2 value needs to be manually adjusted according to the effect of the final generated adversarial sample image. The larger the w1 value, the stronger the perceptual distortion constraint, and the lower the perceptual distortion of the generated adversarial sample image, but the attack success rate of the adversarial sample image will decrease accordingly. This loss term is called the human eye perceptual distortion loss term, which will be used to add with other loss terms for joint optimization.

[0088] S6: Calculate the total loss function. The total loss function LOSS is the sum of the cross entropy loss term obtained in S3, the L2 square distance loss term obtained in S4, and the human eye perception distortion loss term obtained in S5.

[0089] S7: Update the intermediate image x′ of the adversarial sample of the current round using gradient descent. Specifically, the total loss function LOSS obtained in S6 calculates the gradient of x′ and multiplies it by the learning rate lr to perform the update

[0090] S8: Determine whether the total loss function LOSS has converged. If it has converged, the optimization is completed and the intermediate image x′ of the adversarial sample of the current round is output as the final result; otherwise, return to step S2 and use the updated intermediate image x′ of the adversarial sample as the intermediate image x′ of the next round. The loss function converges, which is specifically reflected in the stability of the loss function value and no longer obvious changes. Then the optimization is completed and the adversarial sample image x′ obtained in step S7 of this round of iteration is fixed. This image is the desired adversarial sample image finally obtained by this method.

[0091] The following is a detailed description of the low-distortion physical space counterattack method for the target detection model provided according to the second embodiment of the present invention.

[0092] Still reference Figure 1 and Figure 2 According to the second embodiment of the present invention, a low-distortion physical space adversarial attack method for a target detection model is provided, which includes the following steps.

[0093] S1: Input an original image from a digital space, process the original image to obtain a cropped image, and an intermediate image of an adversarial sample in an initial iteration round. This step S1 specifically includes the following steps.

[0094] S1-1: Input a normal original image containing the detection target from the digital space, and crop the input original image to obtain the cropped image x o , ensuring that there is only a single detected target in the cropped image. o The size is uniformly set to Psize*Psize.

[0095] S1-2: Identify and provide the correct category y of the detected object in the cropped image, or provide the wrong category y′ that is expected to mislead the output of the target detection model.

[0096] S1-3: The cropped image is used as the intermediate image x′ of the adversarial sample in the initial iteration round. The subsequent steps S2-S7 will iteratively optimize the intermediate image x′.

[0097] S2: Perform an affine transformation on the intermediate image x′ of the current round of adversarial samples and introduce a random background image (such as Figure 3 As shown in Figure 2, the image x corresponding to the intermediate image x′ of the adversarial sample in the current round is obtained by simulating the transformation of physical conditions such as distance, angle, and background in the real world. phyThe introduced random background image may be related to a specific target contained in the original image, and may be obtained by field photography, Internet search, etc. In this embodiment, the image may be subjected to affine transformation types such as scaling, rotation, and translation in step S2. Step S2 specifically includes the following steps.

[0098] S2-1: Perform distance transformation on the intermediate image x′ of the current round of adversarial samples. The distance transformation actually corresponds to the scaling transformation of the image, and obtain the scaled transformed image corresponding to the intermediate image x′ of the current round of adversarial samples. The scaling transformation is implemented as follows:

[0099]

[0100] Among them, the two-dimensional vector is the pixel coordinate of the intermediate image x′ of the adversarial sample in the current round, is the image pixel coordinate after scaling x′, s p and q are the scaling ratios of the image in the horizontal and vertical directions respectively;

[0101] S2-2: Perform angle transformation on the image after scaling transformation. The angle transformation actually corresponds to the rotation transformation of the image, and obtain the image after scaling transformation and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample. The rotation transformation is implemented as follows:

[0102]

[0103] Among them, the two-dimensional vector is the image pixel coordinate after scaling transformation obtained by S2-1, To rotate the pixel coordinates of the image after the rotation transformation, θ is the radian value of the image rotation, and the counterclockwise direction is the positive direction.

[0104] S2-3: Perform a translation transformation on the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial samples, and introduce a random background image with a uniform pixel size of Bsize*Bsize. Overlay the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial samples on the background image, and perform a translation transformation to obtain the image x after random physical transformation corresponding to the intermediate image x′ of the current round of adversarial samples. phy The translation transformation of the image after the scaling transformation and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample is implemented as follows:

[0105]

[0106] Among them, the two-dimensional vector is the image pixel coordinate after rotation transformation obtained by S2-2, is the pixel coordinate of the image after translation transformation on this basis, t p and t q are the horizontal and vertical translations of the image, respectively, and are determined by the image pixel points The image formed is x phy .

[0107] In this step, a random background image is introduced to simulate the background transformation in the real world. The background image can be selected from a background image that is closely related to the content of the adversarial sample image. In the process of covering and translating the image after the scaling and rotation transformation corresponding to the intermediate image x′ of the adversarial sample in the current round, it is noted that the edge of the image after the scaling and rotation transformation cannot exceed the introduced random background image.

[0108] S3: Calculate the cross entropy loss and obtain the cross entropy loss term. phy Input into the target detection model expected to be attacked to obtain the detection category Then calculate the correct category y given in S1-2 and the detected category The negative value of the cross entropy loss, or the difference between the wrong category y′ and the detected category The calculated loss is used as the cross entropy loss term and will be added to other loss terms for joint optimization.

[0109] In this embodiment, step S3 specifically includes performing affine transformation on the intermediate image of the adversarial sample and adding a random background to obtain an image x phy , input to the attacked target detection model, and obtain the target detection bounding box set rpn(); calculate the average of the cross entropy loss of each bounding box under each transformation, and then calculate the expected value of the mean of the cross entropy loss under all transformations, and use the expected value as the cross entropy loss term. The optimization objective function of the cross entropy loss term is as follows:

[0110]

[0111] or:

[0112]

[0113] Among them, M t() represents the physical condition transformation applied to the adversarial sample image, including affine transformations such as distance and angle and background image addition, to simulate the transformation of physical conditions in the real world; F() is the attacked target detection model, and the input image obtains the corresponding detection category; L() is the cross entropy loss between different categories; rpn() is the target detection bounding box set, m is the number of bounding box elements in the set, and r i represents a specific target detection bounding box, i represents the bounding box number, t represents a specific affine transformation, T represents a set of affine transformations (including scaling, rotation, translation, etc.), and E represents the calculation of different M t () is the expected value of the cross entropy loss. argmin means to minimize the function. The optimized cross entropy loss term is used in subsequent steps.

[0114] S4: Calculate the L2 square distance loss and obtain the L2 square distance loss term. Calculate the current round of adversarial sample intermediate image x′ and cropped image x o The L2 square distance is multiplied by the weight hyperparameter w1 to obtain the L2 square distance loss, that is, The value of the hyperparameter w1 needs to be manually adjusted according to the effect of the final generated adversarial sample image. The larger the w1 value, the larger the added micro-perturbation, and the higher the attack success rate of the generated adversarial sample image, but the perceived distortion of the adversarial sample image will be correspondingly greater. The loss term obtained in this step is called the L2 square distance loss term, which will be added with other loss terms for joint optimization.

[0115] In this embodiment, in S4, the role of the L2 square distance loss term is to make the generated adversarial sample image maintain a certain similarity with the original image at the pixel level. However, this similarity does not take into account the particularity of human visual perception, so the following step S5 is designed to restrict and optimize the human eye perception distortion loss term accordingly.

[0116] S5: Calculate the human eye perception distortion loss to obtain the human eye perception distortion loss term. Calculate the current round of adversarial sample intermediate image x′ and cropped image x o The structural similarity index SSIM is calculated, and the difference between it and 1 is multiplied by the perceptual distortion weight hyperparameter w2, that is, w2*(1-SSIM(x′,x o )). The selection of the hyperparameter w2 value needs to be manually adjusted according to the effect of the final generated adversarial sample image. The larger the w2 value, the stronger the perceptual distortion constraint, and the lower the perceptual distortion of the generated adversarial sample image, but the attack success rate of the adversarial sample image will decrease accordingly. The loss term obtained in this step is called the human eye perceptual distortion loss term, which will be added to other loss terms for joint optimization.

[0117] In this embodiment, in S5, the closer the structural similarity index SSIM is to 1, the closer the two images x′ and x are to each other. o The smaller the degree of human eye perception distortion, in order to adapt to the minimization form in the aforementioned optimization objective function, the loss function term is designed as (1-SSIM(x′,x o )). Furthermore, the optimization objective function for optimizing the distortion loss perceived by the human eye is as follows:

[0118] argmin(1-SSIM(x′,x o )).

[0119] The optimized human-eye-perceived distortion loss term is used in subsequent steps.

[0120] S6: Calculate the total loss function. The total loss function LOSS is the sum of the cross entropy loss term obtained in S3, the L2 square distance loss term obtained in S4, and the human eye perception distortion loss term obtained in S5.

[0121] In this implementation, in S6, in order to combine the optimization objective functions corresponding to each loss function item, all optimization objective functions are jointly optimized by setting hyperparameters w1 and w2. The selection of hyperparameters w1 and w2 needs to be manually adjusted according to the effect of the final generated adversarial sample image. If the attack success rate of the final generated adversarial sample image is low, w1 needs to be appropriately increased and w2 needs to be reduced; if the perceived distortion of the final generated adversarial sample image is high, w1 needs to be appropriately reduced and w2 needs to be increased. Therefore, the overall optimization objective function is as follows:

[0122]

[0123] or:

[0124]

[0125] The meaning of each symbol is consistent with the above content. The optimized total loss function LOSS is used in subsequent steps.

[0126] In this embodiment, the selected value of the hyperparameter w2 in the above-mentioned total optimization objective function is crucial. The selection of the hyperparameter w2 value needs to be manually adjusted according to the effect of the final generation of the adversarial sample image. The larger the w2 value, the stronger the perceptual distortion constraint, and the perceptual distortion degree of the generated adversarial sample image will be lower, but the attack success rate of the adversarial sample image will decrease accordingly. As shown in the above-mentioned total optimization objective function, the first optimization item requires that the cross entropy between the detection category and the correct category after the adversarial sample image is input into the attacked target detection model is as large as possible, or the cross entropy with the wrong category is as small as possible. At the same time, the introduced expected transformation method requires that the adversarial sample image has a certain physical robustness. These requirements force the adversarial sample image to be iteratively optimized in the direction of increasing the perturbation range and intensity. The perceptual distortion optimization item requires that the perceptual distortion degree of the adversarial sample image and the original image is as small as possible, which in turn limits the perturbation range and intensity of the adversarial sample image to a certain extent. Therefore, the optimization of the physical robustness of adversarial sample images and the optimization of the degree of perceptual distortion have a certain degree of "adversarial" relationship, and the value of the perceptual distortion weight hyperparameter w2 will directly determine whether the physical robustness and perceptual distortion of adversarial sample images can be balanced during the optimization process. Therefore, if the attack success rate of the adversarial sample images generated in the end is low, w2 needs to be appropriately reduced; if the perceptual distortion of the adversarial sample images generated in the end is high, w2 needs to be appropriately increased.

[0127] S7: Update the intermediate image x′ of the adversarial sample of the current round using gradient descent. Specifically, the total loss function LOSS obtained in S6 calculates the gradient of x′ and multiplies it by the learning rate lr to perform the update

[0128] S8: Determine whether the total loss function LOSS converges. If it converges, the optimization is completed and the intermediate image x′ of the adversarial sample of the current round is output as the final result; otherwise, return to step S2 and use the updated intermediate image x′ of the adversarial sample as the intermediate image x′ of the next round. The loss function converges, which is specifically reflected in the stability of the loss function value and no longer obvious changes. Then the optimization is completed and the adversarial sample image x′ obtained in step S7 of this round of iteration is fixed. This image is the final desired adversarial sample image. Based on the adversarial attack image obtained as the final result, an adversarial attack can be carried out on the target detection model to discover security vulnerabilities of the target detection model.

[0129] Preferably, in step S1, the cropped image size Psize is set to 600px±100px;

[0130] Preferably, the value of the hyperparameter w1 in step S4 is set to 0.005±0.001;

[0131] Preferably, the value of the hyperparameter w2 in step S5 is set to 2500 to 3000;

[0132] Preferably, the value of the learning rate lr in step S7 is set to 1±0.1;

[0133] Preferably, the iteration rounds in step S8 are set to 250±50 times.

[0134] like Figure 1 As shown, a low-distortion physical space adversarial attack system for a target detection model provided according to another embodiment of the present invention reduces the perceived distortion of the generated adversarial samples as much as possible while maintaining the physical robustness of the adversarial attack, including: a basic method module, a physical constraint module, and a human eye perception distortion constraint module. Among them, the basic method module updates the iterative adversarial image by gradient descent. Specifically, as an example, the target detection model Faster R-CNN can be selected as the attacked model to maximize the cross entropy loss between the detection category and the correct category, or minimize the cross entropy loss between the detection category and the wrong category.

[0135] The physical constraint module selects the expected transformation method to model the physical constraints, and designs relevant loss function items to be added to the above-mentioned basic method for countering attacks. Specifically, the physical constraint part is modeled using the expected transformation method and converted into an optimization target, which is combined with the optimization target given in the above-mentioned basic method module for joint optimization.

[0136] The human eye perception distortion constraint module selects a structural similarity index that is closely related to human eye perception to model the perception distortion constraint, and designs relevant loss function terms to be added to the above-mentioned adversarial attack method that introduces the physical constraint module. Specifically, the human eye perception distortion constraint part is modeled using the structural similarity index and converted into an optimization target, which is combined with the optimization targets given in the above-mentioned basic method module and physical constraint module for joint optimization.

[0137] Preferably, the "two-stage" target detection model Faster R-CNN is selected as the attacked model in the basic method module, and the cross entropy loss between the detection category and the correct / wrong category in the classification stage is calculated.

[0138] Preferably, the expected transformation method selected in the physical constraint module applies a certain affine transformation to the adversarial sample image of the current round in each round of iterative optimization of the adversarial sample image, simulating the changes in physical conditions (such as distance, angle, lighting, etc.) in the real world, so as to continuously improve the success rate of adversarial sample image attacks while strengthening the physical robustness of the adversarial sample image.

[0139] Preferably, the structural similarity index selected by the human eye perception distortion constraint module comprehensively considers information such as brightness, contrast and structure, and is closer to the perception mode of the human eye. It simulates the perception process of the human eye to the image, and therefore performs better in evaluating the human eye perception distortion.

[0140] Preferably, in the process of combining the physical constraint module with the human eye perception distortion constraint module, in order to balance the constraint relationship between physical robustness and the degree of perceptual distortion, a perceptual distortion weight hyperparameter is set for the perceptual distortion optimization item. The selection of this hyperparameter value directly determines the physical robustness and perceptual distortion degree of the generated adversarial sample.

[0141] The following references Figure 4 An example of a low-distortion physical space adversarial attack method for a target detection model provided according to an embodiment of the present invention is described.

[0142] In order to verify the effectiveness and practicality of the present invention, Faster R-CNN is used as the attacked target detection model, the "Stop" symbol (Stop Sign) in the traffic sign is used as the attack category, and "Person" (Person) is used as the expected error category. In order to obtain the physical space adversarial sample image, the digital space adversarial sample image generated by iterative optimization after the input original image is uniformly processed as follows: the digital space adversarial sample image is printed in color on A3 printing paper using a Xerox ApeosPort-VC7785 model printer, and then photographed from different angles and distances using a Canon EOS M200 camera to obtain a physical space adversarial sample image. Furthermore, in an indoor environment, the printed adversarial sample image is photographed at 15 shooting points at 5 angles (-30°, -15°, 0°, 15°, 30°) and 3 distances (1m, 2m, 3m) to obtain a physical space adversarial sample image (such as Figure 4 shown).

[0143] Under the above example settings, the attack success rate of the generated adversarial sample image is 80%, and the SSIM index is as high as 0.8471. Compared with other similar methods, the adversarial attack method proposed in the present invention has a similar attack success rate, but the SSIM index is improved by about 40%. This shows that the adversarial attack method proposed in the present invention greatly reduces the degree of human eye perception distortion of the adversarial sample image while maintaining a high level of physical robustness, indicating that the low-distortion physical space adversarial attack method for the target detection model provided by the present invention is effective and feasible.

[0144] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

[0145] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.

[0146] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0147] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A low-distortion physical space adversarial attack method for target detection models, characterized in that: The following steps are involved: S1: Input the original image from the digital space, process the original image to get the cropped image x o , and the intermediate image of the adversarial sample in the initial iteration round; S2: Perform an affine transformation on the intermediate image x′ of the current round of adversarial samples and introduce a random background image to obtain the image x after random physical transformation corresponding to the intermediate image x′ of the current round of adversarial samples. phy ; S3: Calculate the cross entropy loss and convert the randomly physically transformed image x phy Input into the target detection model expected to be attacked to obtain the detection category Used to calculate the cross entropy loss term; S4: Calculate the intermediate image x′ and cropped image x of the current round of adversarial samples o The L2 square distance is calculated and the result is multiplied by the weight hyperparameter w1 to obtain the L2 square distance loss term: S5: Calculate the intermediate image x′ and cropped image x of the current round of adversarial samples o The difference between the structural similarity index SSIM and 1 is then multiplied by the perceptual distortion weight hyperparameter w2 to obtain the human eye perceptual distortion loss term: w2*(1-SSIM(x′,x o )); S6: Add the obtained cross entropy loss term, L2 square distance loss term and human eye perception distortion loss term to obtain the total loss function LOSS; S7: Update the intermediate image x′ of the adversarial sample of the current round using gradient descent; S8: Determine whether the total loss function LOSS converges. If so, the optimization is completed and the intermediate image x′ of the adversarial sample of the current round is output as the final result. Otherwise, return to step S2 and use the updated adversarial sample intermediate image x′ as the adversarial sample intermediate image x′ of the next round.

2. The low-distortion physical space counterattack method for target detection model according to claim 1, characterized in that: The step S1 specifically includes the following steps: S1-1: Input a normal original image containing the detection target from the digital space, and crop the input original image to obtain the cropped image x o , there is only a single detection target in the cropped image, and the cropped image x o The size is uniformly set to Psize*Psize; S1-2: Identify and provide the correct category y of the detected target in the cropped image, or provide the wrong category y′ that is expected to mislead the output of the target detection model; S1-3: Use the cropped image as the intermediate image x′ of the adversarial sample in the initial iteration round.

3. The low-distortion physical space counterattack method for target detection model according to claim 2, characterized in that: The step S2 specifically includes the following steps: S2-1: Perform a distance transformation on the intermediate image x′ of the current round of adversarial samples, where the distance transformation corresponds to the scaling transformation of the image, to obtain the scaled transformed image corresponding to the intermediate image x′ of the current round of adversarial samples; S2-2: Perform an angle transformation on the image after the scaling transformation in S2-1, and the angle transformation corresponds to the rotation transformation of the image, so as to obtain the scaling transformation and rotation transformation image corresponding to the intermediate image x′ of the adversarial sample in the current round; S2-3: Perform a translation transformation on the image after scaling and rotation transformation in S2-2, and introduce a random background image to simulate the background transformation in the real world, and overlay the scaling and rotation transformation image corresponding to the intermediate image x′ of the current round of adversarial sample at a random position of the background image to obtain the random physical transformation image x corresponding to the intermediate image x′ of the current round of adversarial sample. phy .

4. The low-distortion physical space counterattack method for target detection model according to claim 2, characterized in that: The step S3 specifically comprises the following steps: The image x after random physical transformation phy Input into the target detection model expected to be attacked to obtain the detection category From S1-2, we get the correct category y of the detected target in the cropped image or the wrong category y′ that we expect to mislead the target detection model output. The correct category y is the same as the detected category The negative value of the cross entropy loss, or the difference between the wrong category y′ and the detected category The cross entropy loss of , as the cross entropy loss term.

5. The low-distortion physical space counterattack method for target detection model according to claim 2, characterized in that: The step S2 specifically includes the following steps: S2-1: Perform distance transformation on the intermediate image x′ of the current round of adversarial samples. The distance transformation corresponds to the scaling transformation of the image, and obtain the scaled transformed image corresponding to the intermediate image x′ of the current round of adversarial samples. The scaling transformation is performed as follows: Among them, the two-dimensional vector is the pixel coordinate of the intermediate image x′ of the adversarial sample in the current round, is the image pixel coordinate after scaling x′, s p and q are the scaling ratios of the image in the horizontal and vertical directions respectively; S2-2: Perform an angle transformation on the image after the scaling transformation in S2-1. The angle transformation corresponds to the rotation transformation of the image, and obtain the scaling transformation and rotation transformation image corresponding to the intermediate image x′ of the current round of adversarial sample. The rotation transformation is performed as follows: Among them, the two-dimensional vector is the image pixel coordinate after scaling transformation obtained by S2-1, To rotate the pixel coordinates of the image after the rotation transformation, θ is the radian value of the image rotation, and the counterclockwise direction is the positive direction; S2-3: Perform a translation transformation on the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial samples, and introduce a random background image with a uniform pixel size of Bsize*Bsize. Overlay the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial samples on the background image, and perform a translation transformation to obtain the image x after random physical transformation corresponding to the intermediate image x′ of the current round of adversarial samples. phy , the translation transformation is performed as follows: Among them, the two-dimensional vector is the image pixel coordinate after rotation transformation obtained by S2-2, is the pixel coordinate of the image after translation transformation on this basis, t p and t q are the horizontal and vertical translations of the image, respectively, and are determined by the image pixel points The image formed is the image x after random physical transformation corresponding to the intermediate image x′ of the adversarial sample in the current round phy .

6. The low-distortion physical space counterattack method for target detection model according to claim 5, characterized in that: The step S3 specifically comprises the following steps: The image x obtained by performing affine transformation on the adversarial sample image and adding random background phy , input to the attacked target detection model, obtain the target detection bounding box set rpn(), and then calculate the negative value of the cross entropy loss between the detection category and the correct category, or the cross entropy loss between the detection category and the wrong category in each bounding box; The cross entropy loss of each bounding box under each transformation is averaged, and then the expected value of the mean cross entropy loss under all transformations is calculated. The expected value is used as the cross entropy loss term. The optimization objective function of the cross entropy loss term is as follows: or: Among them, M t () represents the physical condition transformation imposed on the adversarial sample image, F() is the attacked target detection model, and the input image obtains the corresponding detection category; L() is the cross entropy loss between different categories; rpn() is the target detection bounding box set, m is the number of bounding box elements in the set, and r i represents a specific target detection bounding box, i represents the bounding box number, t represents a specific affine transformation, T represents a set of affine transformations, Indicates calculation of different M t () is the expected value of the cross entropy loss.

7. The low-distortion physical space counterattack method for target detection model according to claim 6, characterized in that: The step S5 further comprises: The human eye perception distortion loss term is optimized, and the optimization objective function of the human eye perception distortion loss term is as follows: arg min(1-SSIM(x′,x o ))。 8. The low-distortion physical space counterattack method for target detection model according to claim 7, characterized in that: The step S6 further comprises: The total loss function LOSS is optimized. The optimization objective function of the total loss function LOSS is as follows or:

9. The low-distortion physical space counterattack method for target detection model according to claim 8, characterized in that: In S1, the cropped image size Psize is set to 600px±100px; The value of the hyperparameter w1 in S4 is set to 0.005±0.001; The value of the hyperparameter w2 in S5 is set to 2500 to 3000.

10. A system for executing the low-distortion physical space counterattack method for target detection model according to any one of claims 1 to 9, characterized in that: include: The basic method module selects the target detection model as the attacked model, maximizes the cross entropy loss between the detection category and the correct category, or minimizes the cross entropy loss between the detection category and the wrong category, and updates the iterative adversarial image by gradient descent as the optimization goal; The physical constraint module uses the expected transformation method to model the physical constraint part and designs the relevant loss function to transform it into the optimization target. The expected transformation method includes performing an affine transformation on the adversarial sample image of the current round in each round of iterative optimization of the adversarial sample image to simulate the changes in physical conditions in the real world. The human eye perception distortion constraint module selects the structural similarity index that is closely related to human eye perception to model the perceptual distortion constraint, and designs relevant loss function terms. The human eye perception distortion constraint part is modeled using the structural similarity index and converted into an optimization target, which is combined with the optimization targets given in the above-mentioned basic method module and physical constraint module for joint optimization.

Images