Low-distortion physical space adversarial attack method and system for target detection models

Abstract

The present invention relates to a low-distortion physical space adversarial attack method and system for target detection models, which belongs to the field of artificial intelligence security technology and solves the problems of low robustness and high perceptual distortion of generated adversarial samples in the prior art. The method comprises: inputting an original image, processing the cropped image x, and o , and the intermediate image of the adversarial sample in the initial iteration round; perform affine transformation on the intermediate image x′ of the adversarial sample in the current round, and introduce a random background image to obtain the image x after random physical transformation phy ; Calculate the cross entropy loss to obtain the cross entropy loss term; calculate the L2 square distance loss term; calculate the human eye perception distortion loss term; obtain the total loss function LOSS; use gradient descent to update the intermediate image x′ of the adversarial sample of the current round; judge whether the total loss function LOSS converges. If it converges, the optimization is completed and the intermediate image x′ of the adversarial sample of the current round is output as the final result. Otherwise, return to execute step S2.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security technology, and specifically relates to a low-distortion physical space counterattack method and system for target detection models. Background Art

[0002] Today, object detection models based on deep neural networks are widely used in the real world, playing a vital role in fields such as autonomous driving, security monitoring, and medical image analysis. However, these models are also vulnerable to adversarial attacks. Adversarial inputs from digital or physical space can cause the models to produce erroneous detection results, posing risks to the models' critical safety-related decisions.

[0003] Compared to adversarial attack methods in the digital space, adversarial attack methods in the physical space are more practical for target detection models. Physical space adversarial attack methods attack target detection models by adding perturbations to physical entities in the real world and generating physical space adversarial samples. These attacks can adapt to changes in lighting, viewing angle, and distance in the physical space to a certain extent. At the same time, adversarial attack methods for target detection models should be sufficiently natural and not easily perceived by the human eye. If the adversarial sample image differs significantly from the original image and produces perturbations that are noticeable to the human eye, the adversarial sample's intention to attack the target detection model will be easily discovered.

[0004] Currently, existing physical-space adversarial attack methods for object detection models mostly focus on the physical robustness of generated adversarial examples, while to some extent ignoring the degree of perceptual distortion of adversarial examples. Therefore, there is a need to generate physical-space adversarial examples for object detection models with high physical robustness and low perceptual distortion. Summary of the Invention

[0005] To address the above issues, embodiments of the present invention provide a low-distortion physical-space adversarial attack method and system for target detection models. This method, a physical-space adversarial attack method for target detection models, focuses on generating adversarial samples with physical robustness while also striving to reduce the perceived distortion of these samples. The key technical aspect of this method is to minimize the perceived distortion of the generated adversarial samples while maintaining the physical robustness of the adversarial attack method.

[0006] According to one embodiment of the present invention, a low-distortion physical space adversarial attack method for a target detection model is provided, comprising the following steps:

[0007] S1: Input the original image from the digital space and process the original image to obtain the cropped image xo , and the intermediate image of the adversarial sample in the initial iteration round;

[0008] S2: Perform an affine transformation on the intermediate image x′ of the current round of adversarial samples and introduce a random background image to obtain the random physical transformation image x corresponding to the intermediate image x′ of the current round of adversarial samples. phy ;

[0009] S3: Calculate the cross entropy loss and convert the image x after random physical transformation phy Input into the target detection model expected to be attacked to obtain the detection category Used to calculate the cross entropy loss term;

[0010] S4: Calculate the intermediate image x′ and the cropped image x of the current round of adversarial samples o The L2 square distance is calculated and multiplied by the weight hyperparameter w1 to obtain the L2 square distance loss term:

[0011] S5: Calculate the intermediate image x′ and the cropped image x of the current round of adversarial samples o The difference between the structural similarity index SSIM and 1 is multiplied by the perceptual distortion weight hyperparameter w2 to obtain the human eye perception distortion loss term: w2*(1-SSIM(x′,x o ));

[0012] S6: Add the obtained cross entropy loss term, L2 square distance loss term and human eye perception distortion loss term to obtain the total loss function LOSS;

[0013] S7: Update the intermediate image x′ of the adversarial sample of the current round using gradient descent;

[0014] S8: Determine whether the total loss function LOSS has converged. If so, the optimization is completed and the intermediate image x′ of the adversarial sample of the current round is output as the final result; otherwise, return to step S2 and use the updated intermediate image x′ of the adversarial sample as the intermediate image x′ of the adversarial sample of the next round.

[0015] Optionally, step S1 specifically includes the following steps:

[0016] S1-1: Input a normal original image containing the detection target from the digital space, and crop the input original image to obtain the cropped image x o , there is only a single detection target in the cropped image, and the cropped image x o The size is uniformly set to Psize*Psize;

[0017] S1-2: Identify and provide the correct category y of the detected target in the cropped image, or provide the wrong category y′ that is expected to mislead the target detection model output;

[0018] S1-3: Use the cropped image as the intermediate image x′ of the adversarial sample in the initial iteration round.

[0019] Optionally, step S2 specifically includes the following steps:

[0020] S2-1: Perform a distance transform on the intermediate image x′ of the current round of adversarial samples. This distance transform corresponds to a scaling transformation of the image, and obtains the scaled transformed image corresponding to the intermediate image x′ of the current round of adversarial samples.

[0021] S2-2: Perform an angle transformation on the image after the scaling transformation in S2-1. This angle transformation corresponds to the rotation transformation of the image, and obtain the scaling and rotation transformation images corresponding to the intermediate image x′ of the current round of adversarial sample.

[0022] S2-3: Perform a translation transformation on the image after scaling and rotation transformation in S2-2, and introduce a random background image to simulate the background transformation in the real world. The scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample is overlaid on a random position of the background image to obtain the random physical transformation image x′ corresponding to the intermediate image x′ of the current round of adversarial sample. phy .

[0023] Optionally, step S3 specifically includes the following steps:

[0024] The image x obtained in S2 phy Input into the target detection model expected to be attacked to obtain the detection category

[0025] From S1-2, we get the correct category y of the detected target in the cropped image or the wrong category u′ that we expect to mislead the target detection model to output. The correct category u is the same as the detected category. The negative value of the cross entropy loss, or the difference between the wrong category u′ and the detection category The cross entropy loss of , as the cross entropy loss term.

[0026] Optionally, step S2 specifically includes the following steps:

[0027] S2-1: Perform distance transformation on the intermediate image x′ of the current round of adversarial samples. This distance transformation corresponds to the scaling transformation of the image, and obtains the scaled transformed image corresponding to the intermediate image x′ of the current round of adversarial samples. The scaling transformation is performed as follows:

[0028]

[0029] Among them, the two-dimensional vector is the pixel coordinate of the intermediate image x′ of the adversarial sample in the current round, is the image pixel coordinate after scaling x′, s p and s q are the scaling ratios of the image in the horizontal and vertical directions respectively;

[0030] S2-2: Perform an angle transformation on the image after the scaling transformation in S2-1. This angle transformation corresponds to the rotation transformation of the image, and obtain the scaling and rotation transformation images corresponding to the intermediate image x′ of the current round of adversarial sample. The rotation transformation is performed as follows:

[0031]

[0032] Among them, the two-dimensional vector is the coordinate of the image pixel after scaling transformation obtained by S2-1, To perform rotation transformation on this basis, the pixel coordinates of the image are obtained. θ is the radian value of the image rotation, and the counterclockwise direction is the positive direction.

[0033] S2-3: Perform a translation transformation on the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample, and introduce a random background image with a uniform pixel size of Bsize*Bsize. Overlay the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample on the background image, and perform a translation transformation to obtain the random physical transformation image x corresponding to the intermediate image x′ of the current round of adversarial sample. phy , the translation transformation is performed as follows:

[0034]

[0035] Among them, the two-dimensional vector is the coordinate of the image pixel after the rotation transformation obtained by S2-2, On this basis, the pixel coordinates of the image are transformed and the t p and t q are the horizontal and vertical translations of the image, respectively, and are determined by the image pixel points The image formed is the image x after random physical transformation corresponding to the intermediate image x′ of the adversarial sample in the current round. phy .

[0036] Optionally, step S3 specifically includes the following steps:

[0037] The random physical transformed image x obtained after affine transformation and random background addition to the adversarial sample image phy , input to the attacked target detection model, obtain the target detection bounding box set rpn(), and then calculate the negative value of the cross entropy loss between the detection category and the correct category, or the cross entropy loss between the detection category and the wrong category in each bounding box;

[0038] The cross entropy loss of each bounding box under each transformation is averaged, and the expected value of the mean cross entropy loss under all transformations is obtained. The expected value is used as the cross entropy loss term. The optimization objective function of the cross entropy loss term is as follows:

[0039]

[0040] or:

[0041]

[0042] Among them, M t () represents the physical condition transformation imposed on the adversarial sample image, F() is the attacked target detection model, and the input image obtains the corresponding detection category; L() is the cross entropy loss between different categories; rpn() is the target detection bounding box set, m is the number of bounding box elements in the set, r i Represents a specific target detection bounding box, i represents the bounding box number, t represents a specific affine transformation, T represents the set of affine transformations, Indicates calculation of different M t () The expected value of the cross entropy loss.

[0043] Optionally, the step S5 further includes: optimizing the human eye perception distortion loss term, and the optimization objective function of the human eye perception distortion loss term is as follows: argmin(1-SSIM(x′,x o )).

[0044] Optionally, step S6 further includes:

[0045] Optimize the total loss function LOSS. The optimization objective function of the total loss function LOSS is as follows

[0046]

[0047] or:

[0048]

[0049] Optionally, it is characterized in that:

[0050] In S1, the cropped image size Psize is set to 600px±100px;

[0051] The value of the hyperparameter w1 in S4 is set to 0.005±0.001;

[0052] The value of the hyperparameter w2 in S5 is set to 2500 to 3000.

[0053] According to another embodiment of the present invention, a system for executing the low-distortion physical space adversarial attack method for target detection models includes: a basic method module, which selects the target detection model as the attacked model, maximizes the cross-entropy loss between the detection category and the correct category, or minimizes the cross-entropy loss between the detection category and the wrong category, and updates the iterative adversarial image by gradient descent as the optimization target; a physical constraint module, which models the physical constraint part using the expected transformation method, and designs a related loss function to convert it into an optimization target, wherein the expected transformation method includes performing an affine transformation on the adversarial sample image of the current round in each round of iterative optimization of the adversarial sample image to simulate the changes in physical conditions in the real world; a human eye perception distortion constraint module, which selects a structural similarity index closely related to human eye perception to model the perceptual distortion constraint, and designs a related loss function term, converts the human eye perception distortion constraint part using the structural similarity index to be modeled into the optimization target, and combines it with the optimization targets given in the above-mentioned basic method module and physical constraint module for joint optimization.

[0054] According to one embodiment of the present invention, a low-distortion physical space adversarial attack method for a target detection model is provided. First, starting from the basic method of adversarial attack on the target detection model, the internal parameters of the attacked model are accessed and the adversarial sample image is iteratively optimized using gradient descent. Then, the expectation over transformation (EOT) method is used to model the physical constraints, and relevant loss function terms are designed and added to the above-mentioned basic adversarial attack method. Finally, the structural similarity index (SSIM) is selected as an indicator to measure the degree of distortion perceived by the human eye, and corresponding loss function terms and weight coefficients are designed for it.

[0055] According to an embodiment of the present invention, a low-distortion physical space adversarial attack system for target detection models is provided, which reduces the perceived distortion of the generated adversarial samples as much as possible while maintaining the physical robustness of the adversarial attack, and includes: a basic method module, a physical constraint module, and a human eye perception distortion constraint module.

[0056] The basic method module updates the adversarial image iteratively via gradient descent. Specifically, it selects a target detection model as the attacked model and maximizes the cross-entropy loss between the detected category and the correct category, or minimizes the cross-entropy loss between the detected category and the incorrect category.

[0057] The physical constraint module uses the expected transformation method to model physical constraints and designs related loss functions to incorporate into the aforementioned basic adversarial attack method. Specifically, the physical constraints modeled using the expected transformation method are transformed into optimization objectives, which are then combined with the optimization objectives given in the basic method module for joint optimization.

[0058] The human perception distortion constraint module uses a structural similarity index, which is closely related to human perception, to model the perceptual distortion constraint. It also designs a related loss function term to be incorporated into the adversarial attack method introduced in the physical constraint module. Specifically, the human perception distortion constraint is modeled using the structural similarity index and converted into an optimization objective. This is then combined with the optimization objectives given in the basic method module and the physical constraint module for joint optimization.

[0059] Furthermore, the target detection model selected in the basic method module can be a "two-stage" target detection model such as Faster R-CNN or a "one-stage" target detection model such as YOLO. For "two-stage" target detection models, the cross entropy loss between the detected class and the correct / incorrect class in the classification stage is calculated.

[0060] Furthermore, the expected transformation method selected in the physical constraint module applies a certain affine transformation to the adversarial sample image of the current round in each round of iterative optimization of the adversarial sample image, simulating the changes in physical conditions (such as distance, angle, lighting, etc.) in the real world, so as to continuously improve the success rate of adversarial sample image attacks while strengthening the physical robustness of the adversarial sample image.

[0061] Furthermore, the structural similarity index selected by the human perception distortion constraint module comprehensively considers information such as brightness, contrast, and structure, and is closer to human perception. It simulates the human eye's perception of images and therefore performs well in assessing human perception distortion.

[0062] Furthermore, when combining the physical constraint module with the perceptual distortion constraint module, a perceptual distortion weight hyperparameter is set for the perceptual distortion optimization term to balance the constraints between physical robustness and perceptual distortion. The choice of this hyperparameter directly determines the physical robustness and perceptual distortion of the generated adversarial examples.

[0063] Furthermore, the selection of the hyperparameter w2 in the overall optimization objective function is crucial. As shown in the overall optimization objective function, the first optimization term requires that the cross-entropy between the detected category and the correct category, or the cross-entropy with the incorrect category, after the adversarial image is input into the attacked target detection model, be as large as possible, or as small as possible. Furthermore, the introduced expected transformation method requires that the adversarial image possess a certain degree of physical robustness. These requirements force the adversarial image to be iteratively optimized toward increasing the perturbation range and intensity. The perceptual distortion optimization term, on the other hand, requires that the perceptual distortion between the adversarial image and the original image be as small as possible, which in turn limits the perturbation range and intensity of the adversarial image. Therefore, the optimization of the physical robustness of the adversarial image and the optimization of the perceptual distortion have a certain degree of "antagonism." The value of the perceptual distortion weight hyperparameter w2 directly determines whether the optimization process can strike a balance between the physical robustness and the perceptual distortion of the adversarial image.

[0064] Compared with the prior art, the low-distortion physical space counterattack method and system for target detection models provided according to the embodiments of the present invention have at least the following beneficial effects:

[0065] 1. The low-distortion physical space adversarial attack method for target detection models provided by the embodiments of the present invention realizes the construction of an adversarial attack model for generating physical space adversarial sample images.

[0066] 2. The low-distortion physical space adversarial attack method for target detection models provided by the embodiments of the present invention improves physical robustness by introducing the expected transformation method to simulate the transformation of various physical conditions in the iterative optimization process of the adversarial sample image; by setting the adversarial attack method to design the corresponding optimization objective function item according to the structural similarity index, the degree of perceptual distortion is reduced.

[0067] 3. The low-distortion physical space counterattack method for target detection models provided by the embodiments of the present invention can effectively discover potential security vulnerabilities in the current target detection model, thereby improving the security of the target detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. By referring to the drawings, the features and advantages of the present invention will be more clearly understood. The drawings are schematic and should not be understood as limiting the present invention in any way. Those skilled in the art can derive other drawings based on these drawings without inventive effort. Among them:

[0069] Figure 1It is a flowchart of the low-distortion physical space counterattack method for target detection models proposed in the present invention.

[0070] Figure 2 This is the algorithm pseudocode of the low-distortion physical space counterattack method for target detection models proposed in this invention.

[0071] Figure 3 This is an example of a random background image selected in an embodiment of a low-distortion physical space counterattack method for a target detection model provided by an embodiment of the present invention.

[0072] Figure 4 This is an example of a low-distortion physical space adversarial attack method for a target detection model provided by an embodiment of the present invention, which generates an adversarial sample image and then collects a point diagram in the physical space. DETAILED DESCRIPTION

[0073] In order to more clearly understand the above-mentioned objects, features and advantages of the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present invention and the features therein can be combined with each other without conflict.

[0074] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the scope of protection of the present invention is not limited to the specific embodiments disclosed below.

[0075] The following describes in detail a low-distortion physical space counterattack method for a target detection model provided according to an embodiment of the present invention.

[0076] like Figure 1-2 As shown, the low-distortion physical space adversarial attack method for target detection models provided by the first embodiment of the present invention performs a joint iterative optimization of physical constraints and perceptual distortion constraints on the input original image, including the following steps.

[0077] S1: Input an original image from the digital space, process the original image to obtain a cropped image, and an intermediate image of the adversarial sample in the initial iteration round. This step S1 specifically includes the following steps.

[0078] S1-1: Input a normal original image containing the detection target from the digital space, and crop the input original image to obtain the cropped image x o , ensuring that there is only a single detection target in the cropped image. o The size is uniformly set to Psize*Psize.

[0079] S1-2: Identify and provide the correct category y of the detected target in the cropped image, or provide the wrong category y′ that is expected to mislead the output of the target detection model.

[0080] S1-3: The cropped image is used as the intermediate image x′ of the adversarial sample in the initial iteration. Subsequent steps S2-S7 will iteratively optimize the intermediate image x′.

[0081] S2: Perform affine transformation on the intermediate image x′ of the current round of adversarial samples and introduce a random background image (such as Figure 3 As shown in the figure), the transformation of physical conditions such as distance, angle, and background in the real world is simulated to obtain the random physical transformation image x corresponding to the intermediate image x′ of the current round of adversarial sample. phy The random background image introduced may be related to a specific target contained in the original image and may be obtained by on-site photography, Internet search, etc. Step S2 specifically includes the following steps.

[0082] S2-1: Perform a distance transformation on the intermediate image x′ of the adversarial sample in the current round. This distance transformation actually corresponds to the scaling transformation of the image, and obtains the scaled transformed image corresponding to the intermediate image x′ of the adversarial sample in the current round.

[0083] S2-2: Perform an angular transformation on the image after the scaling transformation in S2-1. This angular transformation actually corresponds to the rotation transformation of the image, and obtains the scaling and rotation transformation images corresponding to the intermediate image x′ of the adversarial sample in the current round.

[0084] S2-3: Perform a translation transformation on the image after scaling and rotation transformation in S2-2, and introduce a random background image to simulate the background transformation in the real world. The background image can be selected from a background image that is close to the content of the adversarial sample image, and the pixel size is unified to Bsize*Bsize. The scaling and angle transformation corresponding to the intermediate image x′ of the current round of adversarial sample is overlaid on a random position of the background image. Note that the edge of the image after scaling and rotation transformation cannot exceed the introduced random background image, and the random physical transformation image x′ corresponding to the intermediate image x′ of the current round of adversarial sample is obtained. phy This step involves a translation operation on the adversarial sample image on the background image.

[0085] S3: Calculate the cross entropy loss and transform the image x obtained in S2 into a random physical transformation. phy Input into the target detection model expected to be attacked to obtain the detection category Then calculate the correct category y given in S1-2 and the detection category The negative value of the cross entropy loss, or the difference between the wrong category y′ and the detection category The calculated loss is called the cross entropy loss term, which will be used to add other loss terms for joint optimization. Among them, for the cross entropy loss term, if the generated adversarial image is only needed to mislead the target detection model and fail to output the correct category, the correct category y and the detection category y can be selected. The negative value of the cross entropy loss; If you need not only to be unable to output the correct category, but also let the target detection model output the specified error category, the optional error category y′ and the detection category The cross entropy loss.

[0086] S4: Calculate the L2 square distance loss. Calculate the current round of adversarial sample intermediate image x′ and cropped image x o The L2 square distance is multiplied by the weight hyperparameter w1 to obtain the L2 square distance loss, that is, The value of the hyperparameter w1 needs to be manually adjusted based on the final quality of the generated adversarial images. A larger w1 value means larger perturbations, resulting in a higher success rate for the generated adversarial images. However, this also results in greater perceptual distortion of the adversarial images. This loss term, called the L2 squared distance loss, is combined with other loss terms for joint optimization.

[0087] S5: Calculate the distortion loss of human eye perception. Calculate the current round of adversarial sample intermediate image x′ and cropped image x o The structural similarity index SSIM of , the difference between it and 1 is obtained and multiplied by the perceptual distortion weight hyperparameter w2, that is, w2*(1-SSIM(x′,x o The hyperparameter w2 needs to be manually adjusted based on the final quality of the generated adversarial images. A larger w1 value indicates a stronger perceptual distortion constraint, resulting in less perceptual distortion in the generated adversarial images. However, this also reduces the success rate of adversarial attacks. This loss term, called the perceptual distortion loss, is combined with other loss terms for joint optimization.

[0088] S6: Calculate the total loss function. The total loss function LOSS is the sum of the cross entropy loss term obtained in S3, the L2 squared distance loss term obtained in S4, and the human eye perception distortion loss term obtained in S5.

[0089] S7: Update the intermediate image x′ of the adversarial sample in the current round using gradient descent. Specifically, the total loss function LOSS obtained in S6 is calculated with respect to x′ and multiplied by the learning rate lr to perform the update.

[0090] S8: Determine whether the total loss function LOSS has converged. If so, optimization is complete, and the adversarial sample intermediate image x′ for the current round is output as the final result. Otherwise, the process returns to step S2 and uses the updated adversarial sample intermediate image x′ as the adversarial sample intermediate image x′ for the next round. Convergence of the loss function is indicated by the loss function value becoming stable and no longer experiencing significant changes. Optimization is complete, and the adversarial sample image x′ obtained in step S7 for this iteration is fixed. This image is the desired adversarial sample image ultimately generated by this method.

[0091] The following describes in detail a low-distortion physical space counterattack method for a target detection model provided according to a second embodiment of the present invention.

[0092] Still refer to Figure 1 and Figure 2 According to the second embodiment of the present invention, a low-distortion physical space adversarial attack method for a target detection model is provided, which includes the following steps.

[0093] S1: Input an original image from the digital space, process the original image to obtain a cropped image, and an intermediate image of the adversarial sample in the initial iteration round. This step S1 specifically includes the following steps.

[0094] S1-1: Input a normal original image containing the detection target from the digital space, and crop the input original image to obtain the cropped image x o , ensuring that there is only a single detection target in the cropped image. o The size is uniformly set to Psize*Psize.

[0095] S1-2: Identify and provide the correct category y of the detected target in the cropped image, or provide the wrong category y′ that is expected to mislead the output of the target detection model.

[0096] S1-3: The cropped image is used as the intermediate image x′ of the adversarial sample in the initial iteration. Subsequent steps S2-S7 will iteratively optimize the intermediate image x′.

[0097] S2: Perform affine transformation on the intermediate image x′ of the current round of adversarial samples and introduce a random background image (such as Figure 3 As shown in the figure), the transformation of physical conditions such as distance, angle, and background in the real world is simulated to obtain the random physical transformation image x corresponding to the intermediate image x′ of the current round of adversarial sample. phyThe random background image introduced may be related to a specific target contained in the original image and may be obtained by on-site photography, online search, etc. In this embodiment, in step S2, an affine transformation type such as scaling, rotation, and translation may be performed on the image. Step S2 specifically includes the following steps.

[0098] S2-1: Perform distance transformation on the intermediate image x′ of the current round of adversarial samples. This distance transformation actually corresponds to the scaling transformation of the image, and obtains the scaled image corresponding to the intermediate image x′ of the current round of adversarial samples. The scaling transformation is implemented as follows:

[0099]

[0100] Among them, the two-dimensional vector is the pixel coordinate of the intermediate image x′ of the adversarial sample in the current round, is the image pixel coordinate after scaling x′, s p and s q are the scaling ratios of the image in the horizontal and vertical directions respectively;

[0101] S2-2: Perform an angle transformation on the scaled image. This angle transformation actually corresponds to the rotation transformation of the image. The scaled and rotation transformed images corresponding to the intermediate image x′ of the current round of adversarial sample are obtained. The rotation transformation is implemented as follows:

[0102]

[0103] Among them, the two-dimensional vector is the coordinate of the image pixel after scaling transformation obtained by S2-1, To perform rotation transformation on this basis, the pixel coordinates of the image are obtained. θ is the radian value of the image rotation, and the counterclockwise direction is the positive direction.

[0104] S2-3: Perform a translation transformation on the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample, and introduce a random background image with a uniform pixel size of Bsize*Bsize. Overlay the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample on the background image, and perform a translation transformation to obtain the random physical transformation image x corresponding to the intermediate image x′ of the current round of adversarial sample. phy The translation transformation of the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample is implemented as follows:

[0105]

[0106] Among them, the two-dimensional vector is the coordinate of the image pixel after the rotation transformation obtained by S2-2, The pixel coordinates of the image after translation transformation are performed on this basis, t p and t q are the horizontal and vertical translations of the image, respectively, and are determined by the image pixel points The image formed is x phy .

[0107] In this step, a random background image is introduced to simulate the background transformation in the real world. The background image can be selected from a background image that is closely related to the content of the adversarial sample image. In the process of covering and translating the image after the scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample, it is noted that the edge of the image after the scaling and rotation transformation cannot exceed the introduced random background image.

[0108] S3: Calculate the cross entropy loss and get the cross entropy loss term. phy Input into the target detection model expected to be attacked to obtain the detection category Then calculate the correct category y given in S1-2 and the detection category The negative value of the cross entropy loss, or the difference between the wrong category y′ and the detection category The calculated loss is used as the cross entropy loss term and will be added to other loss terms for joint optimization.

[0109] In this embodiment, step S3 specifically includes performing affine transformation on the intermediate image of the adversarial sample and adding a random background to obtain the image x phy , input to the attacked target detection model to obtain the target detection bounding box set rpn(); calculate the average cross entropy loss of each bounding box under each transformation, and then calculate the expected value of the mean cross entropy loss under all transformations, and use the expected value as the cross entropy loss term. The optimization objective function of this cross entropy loss term is as follows:

[0110]

[0111] or:

[0112]

[0113] Among them, M t() represents the physical condition transformation applied to the adversarial sample image, including affine transformations such as distance and angle and background image addition, to simulate the transformation of physical conditions in the real world; F() is the attacked target detection model, and the input image obtains the corresponding detection category; L() is the cross entropy loss between different categories; rpn() is the target detection bounding box set, m is the number of bounding box elements in the set, and r i Represents a specific target detection bounding box, i represents the bounding box number, t represents a specific affine transformation, T represents a set of affine transformations (including scaling, rotation, translation, etc.), and E represents the calculation of different M t () is the expected value of the cross entropy loss. argmin means minimizing the function. This optimized cross entropy loss term is used in subsequent steps.

[0114] S4: Calculate the L2 square distance loss and get the L2 square distance loss term. Calculate the current round of adversarial sample intermediate image x′ and cropped image x o The L2 square distance is multiplied by the weight hyperparameter w1 to obtain the L2 square distance loss, that is, The value of the hyperparameter w1 needs to be manually adjusted based on the final quality of the generated adversarial image. A larger w1 value indicates a larger perturbation, resulting in a higher success rate for the generated adversarial image, but this also results in a greater degree of perceptual distortion. The loss term obtained in this step is called the L2 squared distance loss and is added to other loss terms for joint optimization.

[0115] In this implementation, the L2 squared distance loss term in S4 is used to ensure that the generated adversarial image maintains a certain degree of similarity with the original image at the pixel level. However, this similarity does not take into account the peculiarities of human visual perception. Therefore, the following step S5 is designed to appropriately limit and optimize the distortion loss term for human visual perception.

[0116] S5: Calculate the human eye perception distortion loss and obtain the human eye perception distortion loss term. Calculate the current round of adversarial sample intermediate image x′ and cropped image x o The structural similarity index SSIM of , the difference between it and 1 is obtained and multiplied by the perceptual distortion weight hyperparameter w2, that is, w2*(1-SSIM(x′,x o The hyperparameter w2 needs to be manually adjusted based on the final quality of the generated adversarial image. A larger w2 value indicates stronger perceptual distortion constraints, resulting in lower perceptual distortion in the generated adversarial image. However, this also reduces the success rate of the adversarial attack. The loss term obtained in this step is called the perceptual distortion loss and is added to other loss terms for joint optimization.

[0117] In this embodiment, in S5, the closer the structural similarity index SSIM is to 1, the closer the two images x′ and x o The smaller the degree of human eye perception distortion, in order to adapt to the minimization form in the aforementioned optimization objective function, the loss function term is designed as (1-SSIM(x′,x o )). Furthermore, the optimization objective function for optimizing the distortion loss perceived by the human eye is as follows:

[0118] argmin(1-SSIM(x′,x o )).

[0119] The optimized human-eye-perceived distortion loss term is used in subsequent steps.

[0120] S6: Calculate the total loss function. The total loss function LOSS is the sum of the cross entropy loss term obtained in S3, the L2 square distance loss term obtained in S4, and the human eye perception distortion loss term obtained in S5.

[0121] In this embodiment, in S6, in order to combine the optimization objective functions corresponding to each loss function item, all optimization objective functions are jointly optimized by setting hyperparameters w1 and w2. The selection of hyperparameters w1 and w2 needs to be manually adjusted according to the effect of the final generated adversarial sample image. If the attack success rate of the final generated adversarial sample image is low, w1 needs to be appropriately increased and w2 needs to be decreased; if the perceived distortion of the final generated adversarial sample image is high, w1 needs to be appropriately decreased and w2 needs to be increased. Therefore, the overall optimization objective function is as follows:

[0122]

[0123] or:

[0124]

[0125] The meaning of each symbol is consistent with the above content. The optimized total loss function LOSS is used in the subsequent steps.

[0126] In this embodiment, the selected value of the hyperparameter w2 in the above-mentioned overall optimization objective function is crucial. The selection of the hyperparameter w2 value needs to be manually adjusted based on the effect of the final generated adversarial sample image. The larger the w2 value, the stronger the perceptual distortion constraint, and the lower the perceptual distortion of the generated adversarial sample image will be, but the attack success rate of the adversarial sample image will correspondingly decrease. As shown in the above-mentioned overall optimization objective function, the first optimization term requires that the cross entropy between the detected category and the correct category after the adversarial sample image is input into the attacked target detection model is as large as possible, or the cross entropy with the incorrect category is as small as possible. At the same time, the introduced expected transformation method requires that the adversarial sample image has a certain degree of physical robustness. These requirements force the adversarial sample image to be iteratively optimized in the direction of increasing the perturbation range and intensity. The perceptual distortion optimization term requires that the perceptual distortion of the adversarial sample image and the original image is as small as possible, which in turn limits the perturbation range and intensity of the adversarial sample image to a certain extent. Therefore, optimizing the physical robustness of adversarial images and optimizing the degree of perceptual distortion are somewhat antagonistic. The value of the perceptual distortion weight hyperparameter w2 directly determines whether the optimization process can achieve a good balance between the physical robustness and perceptual distortion of adversarial images. Therefore, if the resulting adversarial image has a low attack success rate, w2 should be appropriately reduced; if the resulting adversarial image has a high degree of perceptual distortion, w2 should be appropriately increased.

[0127] S7: Update the intermediate image x′ of the adversarial sample in the current round using gradient descent. Specifically, the total loss function LOSS obtained in S6 is calculated with respect to x′ and multiplied by the learning rate lr to perform the update.

[0128] S8: Determine whether the total loss function LOSS has converged. If so, the optimization is complete, and the adversarial sample intermediate image x′ for the current round is output as the final result. Otherwise, the process returns to step S2 and uses the updated adversarial sample intermediate image x′ as the adversarial sample intermediate image x′ for the next round. Convergence of the loss function is reflected in the loss function value becoming stable and no longer undergoing significant changes. The optimization is complete, and the adversarial sample image x′ obtained in step S7 for this iteration is fixed. This image is the final desired adversarial sample image. Based on the final adversarial attack image, an adversarial attack can be performed on the target detection model to discover security vulnerabilities in the target detection model.

[0129] Preferably, in step S1, the cropped image size Psize is set to 600px±100px;

[0130] Preferably, the value of the hyperparameter w1 in step S4 is set to 0.005±0.001;

[0131] Preferably, the value of the hyperparameter w2 in step S5 is set to 2500 to 3000;

[0132] Preferably, the value of the learning rate lr in step S7 is set to 1±0.1;

[0133] Preferably, the number of iteration rounds in step S8 is set to 250±50 times.

[0134] like Figure 1 As shown, a low-distortion physical space adversarial attack system for target detection models provided according to another embodiment of the present invention reduces the perceived distortion of generated adversarial samples as much as possible while maintaining the physical robustness of the adversarial attack, including: a basic method module, a physical constraint module, and a human eye perception distortion constraint module. Among them, the basic method module updates the iterative adversarial image by gradient descent. Specifically, as an example, the target detection model Faster R-CNN can be selected as the attacked model to maximize the cross-entropy loss between the detection category and the correct category, or minimize the cross-entropy loss between the detection category and the wrong category.

[0135] The physical constraint module uses the expected transformation method to model physical constraints and designs related loss functions to incorporate into the aforementioned basic adversarial attack method. Specifically, the physical constraints modeled using the expected transformation method are transformed into optimization objectives, which are then combined with the optimization objectives given in the basic method module for joint optimization.

[0136] The human perception distortion constraint module selects a structural similarity index closely related to human perception to model the perceptual distortion constraint and designs a related loss function term to be incorporated into the adversarial attack method introduced in the physical constraint module. Specifically, the human perception distortion constraint, modeled using the structural similarity index, is converted into an optimization objective and then combined with the optimization objectives given in the basic method module and the physical constraint module for joint optimization.

[0137] Preferably, the "two-stage" target detection model Faster R-CNN is selected as the attacked model in the basic method module, and the cross entropy loss between the detection category and the correct / incorrect category in the classification stage is calculated.

[0138] Preferably, the desired transformation method selected in the physical constraint module applies a certain affine transformation to the adversarial sample image of the current round in each round of iterative optimization of the adversarial sample image, simulating the changes in physical conditions (such as distance, angle, lighting, etc.) in the real world, so as to continuously improve the success rate of the adversarial sample image attack while strengthening the physical robustness of the adversarial sample image.

[0139] Preferably, the structural similarity index selected by the human perception distortion constraint module comprehensively considers information such as brightness, contrast, and structure, and is closer to human perception. It simulates the human eye's perception of images and therefore performs well in assessing human perception distortion.

[0140] Preferably, when combining the physical constraint module with the human perception distortion constraint module, a perceptual distortion weight hyperparameter is set for the perceptual distortion optimization term to balance the constraints between physical robustness and perceptual distortion. The selection of this hyperparameter directly determines the physical robustness and perceptual distortion of the generated adversarial examples.

[0141] The following references Figure 4 An example of applying a low-distortion physical space adversarial attack method for a target detection model provided according to an embodiment of the present invention is described.

[0142] In order to verify the effectiveness and practicality of the present invention, Faster R-CNN is used as the attacked target detection model, the "Stop" symbol (Stop Sign) in the traffic sign is used as the attack category, and "Person" (Person) is used as the expected error category. In order to obtain the physical space adversarial sample image, the digital space adversarial sample image generated by iterative optimization after the input original image is uniformly subjected to the following processing: the digital space adversarial sample image is printed in color on A3 printing paper using a xerox ApeosPort-VC7785 model printer, and then photographed from different angles and distances using a Canon EOS M200 camera to obtain the physical space adversarial sample image. Furthermore, in an indoor environment, the printed adversarial sample image is photographed at 15 shooting points from 5 angles (-30°, -15°, 0°, 15°, 30°) and 3 distances (1m, 2m, 3m) to obtain the physical space adversarial sample image (such as Figure 4 shown).

[0143] Under the above example settings, the generated adversarial image attack success rate was 80%, with an SSIM index as high as 0.8471. Compared to other similar methods, the proposed adversarial attack method achieved a similar attack success rate but with an SSIM index improved by approximately 40%. This demonstrates that the proposed adversarial attack method significantly reduces the perceived distortion of adversarial imagery while maintaining a high level of physical robustness, demonstrating the effectiveness and feasibility of the proposed low-distortion physical space adversarial attack method for target detection models.

[0144] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

[0145] All of the above optional technical solutions can be combined in any way to form optional embodiments of the present application, and will not be described in detail here.

[0146] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0147] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed by the present invention should be covered by the scope of protection of the present invention.

Claims

1. A low-distortion physical space adversarial attack method for target detection models, characterized by: The following steps are involved: S1: Input the original image from the digital space and process the original image to obtain the cropped image x o , and the intermediate image of the adversarial sample in the initial iteration round; S2: Perform an affine transformation on the intermediate image x′ of the current round of adversarial samples and introduce a random background image to obtain the random physical transformation image x corresponding to the intermediate image x′ of the current round of adversarial samples. phy ; S3: Calculate the cross entropy loss and convert the image x after random physical transformation phy Input into the target detection model expected to be attacked to obtain the detection category Used to calculate the cross entropy loss term; S4: Calculate the intermediate image x′ and the cropped image x of the current round of adversarial samples o The L2 square distance is calculated and multiplied by the weight hyperparameter w1 to obtain the L2 square distance loss term: S5: Calculate the intermediate image x′ and the cropped image x of the current round of adversarial samples o The difference between the structural similarity index SSIM and 1 is multiplied by the perceptual distortion weight hyperparameter w2 to obtain the human eye perception distortion loss term: w2*(1-SSIM(x′,x o )); S6: Add the obtained cross entropy loss term, L2 square distance loss term and human eye perception distortion loss term to obtain the total loss function LOSS; S7: Update the intermediate image x′ of the adversarial sample of the current round using gradient descent; S8: Determine whether the total loss function LOSS has converged. If so, the optimization is completed and the intermediate image x′ of the adversarial sample of the current round is output as the final result. Otherwise, return to step S2 and use the updated adversarial sample intermediate image x′ as the adversarial sample intermediate image x′ for the next round.

2. The low-distortion physical space counterattack method for target detection models according to claim 1 is characterized in that: The step S1 specifically includes the following steps: S1-1: Input a normal original image containing the detection target from the digital space, and crop the input original image to obtain the cropped image x o , there is only a single detection target in the cropped image, and the cropped image x o The size is uniformly set to Psize*Psize; S1-2: Identify and provide the correct category y of the detected target in the cropped image, or provide the wrong category y′ that is expected to mislead the target detection model output; S1-3: Use the cropped image as the intermediate image x′ of the adversarial sample in the initial iteration round.

3. The low-distortion physical space counterattack method for target detection models according to claim 2, characterized in that: The step S2 specifically includes the following steps: S2-1: Perform a distance transform on the intermediate image x′ of the current round of adversarial samples. This distance transform corresponds to a scaling transformation of the image, and obtains the scaled transformed image corresponding to the intermediate image x′ of the current round of adversarial samples. S2-2: Perform an angle transformation on the image after the scaling transformation in S2-1. This angle transformation corresponds to the rotation transformation of the image, and obtain the scaling and rotation transformation images corresponding to the intermediate image x′ of the current round of adversarial sample. S2-3: Perform a translation transformation on the image after scaling and rotation transformation in S2-2, and introduce a random background image to simulate the background transformation in the real world. The scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample is overlaid on a random position of the background image to obtain the random physical transformation image x′ corresponding to the intermediate image x′ of the current round of adversarial sample. phy .

4. The low-distortion physical space counterattack method for target detection models according to claim 2, characterized in that: The step S3 specifically includes the following steps: The image x after random physical transformation phy Input into the target detection model expected to be attacked to obtain the detection category From S1-2, we get the correct category y of the detected target in the cropped image or the wrong category y′ that we expect to mislead the target detection model to output. The correct category y is the same as the detected category The negative value of the cross entropy loss, or the difference between the wrong category y′ and the detection category The cross entropy loss of , as the cross entropy loss term.

5. The low-distortion physical space counterattack method for target detection models according to claim 2, characterized in that: The step S2 specifically includes the following steps: S2-1: Perform distance transformation on the intermediate image x′ of the current round of adversarial samples. This distance transformation corresponds to the scaling transformation of the image, and obtains the scaled transformed image corresponding to the intermediate image x′ of the current round of adversarial samples. The scaling transformation is performed as follows: Among them, the two-dimensional vector is the pixel coordinate of the intermediate image x′ of the adversarial sample in the current round, is the image pixel coordinate after scaling x′, s p and s q are the scaling ratios of the image in the horizontal and vertical directions respectively; S2-2: Perform an angle transformation on the image after the scaling transformation in S2-1. This angle transformation corresponds to the rotation transformation of the image, and obtain the scaling and rotation transformation images corresponding to the intermediate image x′ of the current round of adversarial sample. The rotation transformation is performed as follows: Among them, the two-dimensional vector is the coordinate of the image pixel after scaling transformation obtained by S2-1, To perform rotation transformation on this basis, the pixel coordinates of the image are obtained. θ is the radian value of the image rotation, and the counterclockwise direction is the positive direction. S2-3: Perform a translation transformation on the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample, and introduce a random background image with a uniform pixel size of Bsize*Bsize. Overlay the image after scaling and rotation transformation corresponding to the intermediate image x′ of the current round of adversarial sample on the background image, and perform a translation transformation to obtain the random physical transformation image x corresponding to the intermediate image x′ of the current round of adversarial sample. phy , the translation transformation is performed as follows: Among them, the two-dimensional vector is the coordinate of the image pixel after the rotation transformation obtained by S2-2, The pixel coordinates of the image after translation transformation are performed on this basis, t p and t q are the horizontal and vertical translations of the image, respectively, and are determined by the image pixel points The image formed is the image x after random physical transformation corresponding to the intermediate image x′ of the adversarial sample in the current round. phy .

6. The low-distortion physical space counterattack method for target detection models according to claim 5, characterized in that: The step S3 specifically includes the following steps: The random physical transformed image x obtained after affine transformation and random background addition to the adversarial sample image phy , input to the attacked target detection model, obtain the target detection bounding box set rpn(), and then calculate the negative value of the cross entropy loss between the detection category and the correct category, or the cross entropy loss between the detection category and the wrong category in each bounding box; The cross entropy loss of each bounding box under each transformation is averaged, and the expected value of the mean cross entropy loss under all transformations is obtained. The expected value is used as the cross entropy loss term. The optimization objective function of the cross entropy loss term is as follows: or: Among them, M t () represents the physical condition transformation imposed on the adversarial sample image, F() is the attacked target detection model, and the input image obtains the corresponding detection category; L() is the cross entropy loss between different categories; rpn() is the target detection bounding box set, m is the number of bounding box elements in the set, r i Represents a specific target detection bounding box, i represents the bounding box number, t represents a specific affine transformation, T represents the set of affine transformations, Indicates calculation of different M t () The expected value of the cross entropy loss.

7. The low-distortion physical space counterattack method for target detection models according to claim 6, characterized in that: The step S5 further includes: The human eye perception distortion loss term is optimized, and the optimization objective function of the human eye perception distortion loss term is as follows: arg min(1-SSIM(x′,x o ))。 8. The low-distortion physical space counterattack method for target detection models according to claim 7, characterized in that: The step S6 further includes: Optimize the total loss function LOSS. The optimization objective function of the total loss function LOSS is as follows or:

9. The low-distortion physical space counterattack method for target detection models according to claim 8, characterized in that: In S1, the cropped image size Psize is set to 600px±100px; The value of the hyperparameter w1 in S4 is set to 0.005±0.001; The value of the hyperparameter w2 in S5 is set to 2500 to 3000.

10. A system for executing the low-distortion physical space counterattack method for target detection models according to any one of claims 1 to 9, characterized in that: include: The basic method module selects the target detection model as the attacked model, maximizes the cross entropy loss between the detected category and the correct category, or minimizes the cross entropy loss between the detected category and the wrong category, and iterates the adversarial image by gradient descent as the optimization goal; The physical constraint module uses the expected transformation method to model the physical constraints and designs the relevant loss function to convert it into an optimization objective. The expected transformation method involves performing an affine transformation on the adversarial sample image in each round of iterative optimization to simulate the changes in physical conditions in the real world. The human eye perception distortion constraint module selects a structural similarity index that is closely related to human eye perception to model the perceptual distortion constraint, and designs related loss function terms. The human eye perception distortion constraint part is modeled using the structural similarity index and converted into an optimization target, which is combined with the optimization targets given in the above-mentioned basic method module and physical constraint module for joint optimization.

Images