Attack resisting method and system for target bounding box positioning in target detection model

Abstract

The invention discloses an anti-attack method for positioning a target bounding box in a target detection model, and relates to the technical field of deep learning, and the method comprises the steps: training a target detection model through employing original image data, and obtaining a trained target detection model; inputting a target image into the trained target detection model to obtain all prediction results; generating a heat map by using the prediction result, wherein the heat map is used for indicating an important area having positive influence on prediction of each attribute in the target image; generating a mask by using the heat map, wherein the mask is used for limiting a disturbance area; and generating an adversarial sample, generating adversarial disturbance, limiting a disturbance area by using the mask, and generating the adversarial sample. According to the method, a certain boundary of the target bounding box can be attacked independently, and the target category can be kept unchanged, so that the attack concealment is improved.

Description

Technical Field

[0001] The present invention relates to the field of deep learning security technology, and in particular to a method for countering attacks on target bounding box positioning in a target detection model. Background Art

[0002] As the wave of artificial intelligence rapidly sweeps across all walks of life, the security issues of deep learning models have become increasingly prominent. As a branch of deep learning security technology, adversarial attacks have been widely studied in the field of computer vision.

[0003] Adversarial attacks were initially only used for image classification tasks in computer vision, but have since been expanded to tasks such as object detection and semantic segmentation, where the models are more complex and difficult to attack. In classification tasks, the model only needs to correctly classify the most prominent object in the input image. In object detection tasks, however, the model needs to correctly classify and accurately locate multiple objects in the input image. Therefore, attacking object detection models is more challenging than attacking classification models. In addition, adversarial attacks on object detection models are more varied than those on classification models. For example, attacking a classification model can only cause the model to misclassify the input image, while attacking a object detection model can cause the model to mislocate the target, fail to locate the target, or misclassify a target.

[0004] At present, the existing adversarial attack methods for target detection models can only make the target missed, misdetected or mislocated, where misdetection is accompanied by mislocation. However, for some application scenarios where the target category needs to be correct and the target bounding box positioning is wrong, the existing attack methods cannot do it, and research on this issue is still blank. In addition, when target misdetection and bounding box positioning errors occur, the target bounding box will randomly expand and contract in the four boundary directions, and it is impossible to effectively control the expansion and contraction of a single boundary.

[0005] Existing object detection adversarial attack technologies can only attack target categories, which are generally accompanied by random deformation of the target bounding box in four directions, but cannot attack the positioning of the target bounding box alone; and cannot meet some application scenarios that require ensuring that the target category is correct and the target bounding box positioning is incorrect. Summary of the invention

[0006] The purpose of the present invention is to provide a method for countering the positioning of a target bounding box in a target detection model. The method can not only attack a certain boundary of the target bounding box separately, but also keep the target category unchanged, thereby improving the concealment of the attack.

[0007] The technical solution adopted by the present invention is as follows:

[0008] A method for adversarial attack on target bounding box localization in a target detection model, specifically comprising:

[0009] Model training: using the original image data to train the target detection model and obtain the trained target detection model;

[0010] Obtaining prediction results: inputting the target image into the trained target detection model to obtain all prediction results;

[0011] Heat map generation, generating a heat map using the prediction results, wherein the heat map is used to indicate important areas in the target image that have a positive impact on the prediction of each attribute;

[0012] Mask generation, using the heat map to generate a mask, wherein the mask is used to limit the disturbance area;

[0013] Adversarial sample generation, generating adversarial perturbations, and using the mask to limit the perturbation area to generate adversarial samples.

[0014] Furthermore, the prediction result acquisition includes:

[0015] The target image Input into the trained target detection model, the model outputs multiple prediction results p, each prediction result p includes the class score and bounding box

[0016]

[0017] Furthermore, heat map generation specifically includes:

[0018] Using the prediction result p and B (P) Attributes and target detection interpretable algorithm to generate heat map H (P) .

[0019] Furthermore, heat map generation specifically includes:

[0020] Assume that the attacker specifies to attack the lower boundary of a target bounding box, that is, the corresponding prediction result p Attributes, in order to obtain the attributes that can indicate the predicted attributes in the input image Heat map of important areas (P) , the following operations need to be performed:

[0021]

[0022] In the formula, A k The output of the last convolutional layer of the feature extraction network of the target detection model, i.e., the feature map map; is the gradient map after local smoothing operation Φ as an importance weight map; Represents the multiplication of corresponding elements in a matrix or vector; ReLU() is the activation function.

[0023] Furthermore, the mask generation specifically includes:

[0024] Using heat map H (P) Generate mask M (P) , the M (P) The construction process is as follows:

[0025] Idx=Indice(H (P) ) (3)

[0026] M (P) =Mask(0, Idx) (4)

[0027] In the formula, the function of Indice(x) is to find all points in vector x whose values ​​are not 0 and record their indexes as Idx; is a vector whose element values ​​are all 0; Mask(x,index) is an operation to modify the value of the corresponding index index in the vector x to 1; For the mask.

[0028] Further, the generation of adversarial perturbations includes but is not limited to masking, random noise, or fast gradient sign method.

[0029] The second technical solution adopted by the present invention is a counterattack model for positioning a target bounding box in a target detection model, the model comprising:

[0030] The model training module uses the original image data to train the target detection model and obtain the trained target detection model;

[0031] A prediction result acquisition module inputs the target image into the trained target detection model to obtain all prediction results;

[0032] A heat map generation module, which generates a heat map using the prediction results, wherein the heat map is used to indicate important areas in the target image that have a positive impact on the prediction of each attribute;

[0033] A mask generation module, using the heat map to generate a mask, wherein the mask is used to limit the disturbance area;

[0034] The adversarial sample generation module generates adversarial perturbations, and uses the mask to limit the perturbation area to generate adversarial samples.

[0035] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0036] The present invention provides a method for countering the positioning of a target bounding box in a target detection model, which can cause the target detection model to misposition a specific boundary of a selected target bounding box. In addition, the attack method can be applied to some application scenarios where the target category needs to be correct and the positioning of the target bounding box is wrong, so as to achieve the purpose of attacking the target bounding box alone. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A flowchart of a method for countering an attack on target bounding box positioning in a target detection model according to the present invention;

[0038] Figure 2 A comparison diagram of the detection results of adversarial samples generated in an adversarial attack method for positioning a target bounding box in a target detection model of the present invention and the detection results of original samples;

[0039] Figure 3 A comparison between a heat map of an important region of the prediction of the lower boundary of the dog's bounding box in an original sample in an adversarial attack method for positioning the target bounding box in a target detection model of the present invention and a heat map of an important region of the prediction of the lower boundary of the dog's bounding box by the method of the present invention;

[0040] Figure 4 A structural diagram of a counterattack system for positioning a target bounding box in a target detection model according to the present invention;

[0041] Figure 5 This is a structural block diagram of the terminal part mentioned in Example 3 of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be described in detail below in conjunction with the accompanying drawings.

[0043] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0044] Example 1

[0045] An adversarial attack method for localizing the object bounding box in the object detection model, such as Figure 1 As shown, specifically including:

[0046] Step 1: Use the original image data to train the FCOS target detection model to obtain a FCOS target detection model that performs well on a normal data set;

[0047] This embodiment takes the MS COCO dataset, a large-scale detection benchmark dataset, as an example. The FCOS used uses ResNet-50 as the feature extraction backbone network and combines it with the feature pyramid network FPN. The model is trained using the MS COCO training set, and a model with good performance on its test set is obtained;

[0048] Step 2: The target image The input is fed into the trained FCOS target detection model, and the model outputs multiple prediction results p, each of which consists of a class score and bounding box composition;

[0049] In this embodiment, the MS COCO test set image is used as the original image I to input into the trained FCOS target detection model, and the model outputs the prediction result p. The attributes in the prediction result are used to subsequently generate the heat map H corresponding to the target bounding box boundary. (P) ;

[0050] Step 3: Use the prediction result p and B (P) And the target detection interpretable algorithm generates a heat map H (P) , to indicate the important areas that have a positive impact on the prediction of each attribute, specifically:

[0051] Assume that the attacker specifies the lower boundary of the attack target bounding box, which corresponds to the prediction p The attacker's goal is to make the lower boundary of the target bounding box deviate from the original lower boundary as much as possible; first, in order to obtain Heat map of important areas (P) , you need to implement the following operations:

[0052]

[0053] In the formula, A k It is the feature map of a certain layer of the feature pyramid network of the FCOS target detection model; is the gradient map after local smoothing operation Φ As feature map A k Importance weight map of ReLU is the activation function. After the above series of operations, the heat map H is obtained. (P) ;

[0054] Step 4: Use heat map H (P) Generate mask M (P) , used to limit the area where disturbances are added later. Specifically, M (P) The construction process is as follows:

[0055] Idx=Indice(H (P) ) (3)

[0056] M (P) =Mask(0, Idx) (4)

[0057] In the formula, the function of Indice(x) is to find all points in vector x whose values ​​are not 0 and record their indexes as Idx; is a vector whose element values ​​are all 0; Mask(x,index) is the operation of changing the value of the corresponding index index in vector x to 1; the final mask is

[0058] Step 5: Generate adversarial perturbations using techniques such as masking, random noise, or fast gradient sign method, and use mask M (P) Limit the perturbation area and finally get the adversarial sample

[0059] In this embodiment, the masking method refers to directly using the index recorded in step 4 to modify the value of the corresponding pixel in the input image I to 0;

[0060] The random noise method refers to randomly generating Gaussian noise of the same size as the input image. The generated adversarial samples are as follows:

[0061]

[0062] Clip(x)=min(255,max(0,x))(6)

[0063] In the formula, is the adversarial sample corresponding to the original image I; Clip(x) is the clipping function to ensure that the final generated adversarial sample is a legal image;

[0064] The fast gradient sign method constructs adversarial samples by using the sign of the gradient of the loss function. The loss function is constructed as follows:

[0065]

[0066] In the formula, MSE is the mean square error, which is solved by the gradient descent method, with the intention of making The value of is as large as possible; then, the fast gradient sign method and the loss function are used to generate the perturbation η for the gradient of the input image, and Clip(η+I) is used to clip the adversarial sample to ensure that the final generated adversarial sample is a legal image.

[0067] The adversarial samples generated in this embodiment are used to attack the FCOS target detection model. The specific attack results are as follows: Figure 2As shown, the red target bounding box in all images represents the prediction result of the target detection model for the target in the normal sample, and the blue target bounding box represents the prediction result of the target detection model for the target in the adversarial sample; it can be observed that the adversarial sample generated by this embodiment can successfully deviate the lower boundary of the selected target, that is, the dog's bounding box, while ensuring that the boundaries in the other three directions and the bounding boxes of other targets remain unchanged. The specific degree of deviation is shown in Table 1 below. It can be seen that the masking method causes the lower boundary of the dog's bounding box to deviate by 20 pixels, which is 7.12% compared with the original lower bounding box; the random noise method causes the lower boundary of the dog's bounding box to deviate by 22 pixels, which is 7.83% compared with the original lower bounding box; the fast gradient sign method causes the lower boundary of the dog's bounding box to deviate by 9 pixels, which is 3.2% compared with the original lower bounding box.

[0068] Table 1. Comparison of deviations from the lower boundary of the dog’s bounding box in adversarial examples

[0069] Attack Methods Cover-up Random Noise Method Fast Gradient Sign Method Deviation Pixels 20 22 9 The deviation from the original bounding box 7.12％ 7.83％ 3.2％

[0070] Depend on Figure 3 It can be seen from the heat map of the important area of ​​the lower boundary prediction of the dog's bounding box in the input image that the adversarial perturbation generated by the present invention makes the lower boundary attribute of the dog's bounding box in the input image The predicted important area has shifted, which directly explains the change in the lower boundary of the target bounding box.

[0071] The above experiments and related result analysis verify the effectiveness of the attack method proposed in this invention.

[0072] Example 2

[0073] This embodiment provides an adversarial attack system for positioning a target bounding box in a target detection model, which is used to implement the adversarial sample generation method in the above embodiment; the system includes:

[0074] A model training module 401 is used to train the FCOS target detection model using the MS COCO dataset;

[0075] The prediction result acquisition module 402 is used to input the original image data into the trained FCOS target detection model to obtain all its prediction results p;

[0076] The heat map generation module 403 uses the attributes in the prediction result p obtained by the prediction result acquisition module 402 and object detection interpretable algorithms, generating algorithms that can indicate the attributes of objects in the input image. Heat map of the regions predicted to play an important role H (P) ;

[0077] Specifically, assume that the attacker specifies to attack the lower boundary of a target bounding box, that is, the corresponding prediction p The attacker's goal is to make the lower boundary of the target bounding box deviate from the original lower boundary as much as possible; first, in order to obtain Heat map of important areas (P) , it is necessary to implement equations (1) and (2):

[0078]

[0079] In the formula, A k The output of the last convolutional layer of the feature extraction network of the target detection model, i.e., the feature map map; is the gradient map after local smoothing operation Φ as an importance weight map; Represents the multiplication of corresponding elements in a matrix or vector; ReLU() is the activation function;

[0080] The mask generation module 404 uses the heat map H constructed by the heat map generation module 403. (P) , generate mask M (P) , used to limit the area where disturbances are added later;

[0081] Specifically, M. (P) The construction process of is as follows:

[0082] Idx=Indice(H (P) )(3)

[0083] M (P) =Mask(0,Idx)(4)

[0084] In the formula, the function of Indice(x) is to find all points in vector x whose values ​​are not 0 and record their indexes as Idx; is a vector whose element values ​​are all 0; Mask(x,index) is an operation to modify the value of the corresponding index index in the vector x to 1; For mask;

[0085] The adversarial sample generation module 405 generates adversarial perturbations using techniques such as masking, random noise, or fast gradient sign method, and uses the mask M generated by the mask generation module 404 (P) Limit the perturbation area and finally get the adversarial sample

[0086] Specifically, the masking method refers to directly using the index recorded in the mask generation module 404 to modify the value of the corresponding pixel in the input image to 0; the random noise method refers to randomly generating Gaussian noise of the same size as the input image. Then use equations (5) and (6) to construct adversarial samples:

[0087]

[0088] Clip(x)=min(255,max(0,x))(6)

[0089] In the formula, is the adversarial sample corresponding to the original image I; Clip(x) is the clipping function to ensure that the final generated adversarial sample is a legal image;

[0090] The fast gradient sign method constructs adversarial samples by using the sign of the gradient of the loss function. The loss function is constructed as follows:

[0091]

[0092] In the formula, MSE is the mean square error, which is solved by the gradient descent method, with the intention of making The value of is as large as possible; then, the fast gradient sign method and the loss function are used to generate the perturbation η for the gradient of the input image, and Clip(η+I) is used to clip the adversarial sample to ensure that the final generated adversarial sample is a legal image.

[0093] Example 3

[0094] This embodiment also provides a terminal, such as Figure 5 As shown, for the sake of convenience, only the parts related to this embodiment are shown. The terminal may include any terminal device such as a mobile phone, a tablet, a computer, a POS machine, etc., taking a terminal computer as an example.

[0095] like Figure 5 The block diagram shown is a partial structure of a computer related to the terminal provided in this embodiment. The computer includes: a memory, an input device, a display device, an audio circuit, a wireless fidelity (WIFI) module, a processor, a power supply and other components. Those skilled in the art can understand that Figure 5 The computer structure shown in the figure does not constitute a limitation of the computer, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0096] Combine the following Figure 5 A detailed introduction to the various components of the computer:

[0097] The memory can be used to store software programs and modules. The processor executes various functional applications and data processing of the computer by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the computer (such as audio data, a phone book, etc.), etc. In this embodiment, the data storage area can store the original image of the adversarial sample to be generated. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0098] The input device can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the computer; the input device in this embodiment can be used to receive original image data for generating adversarial samples.

[0099] The output device can be used to output and display information input by the user or information provided to the user and various menus of the computer; the output device may include a display panel, and optionally, the output display panel may be configured in the form of a liquid crystal display (Liquid Crystal Display), an organic light-emitting diode (Organic Light-Emitting Diode, OLED), etc.

[0100] The audio module can convert the received audio data into an electrical signal and transmit it to the speaker, which converts it into a sound signal for output.

[0101] WiFi is a short-range wireless transmission technology. Computers can help users send and receive emails, browse web pages, and access streaming media through WiFi modules. It provides users with wireless broadband Internet access.

[0102] The processor is the control center of the computer, which uses various interfaces and lines to connect various parts of the entire computer, and executes various functions of the computer and processes data by running or executing software programs and / or modules stored in the memory, and calling data stored in the memory, so as to monitor the computer as a whole; optionally, the processor may include one or more processing units; preferably, the processor may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor.

[0103] A power source (such as a battery), preferably, the power source can be logically connected to the processor through a power management system, so that the power management system can manage charging, discharging, power consumption and other functions.

[0104] The computer may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0105] Specifically in this embodiment, the processor in the terminal will load the executable files corresponding to the processes of one or more applications into the memory according to the following instructions, and the processor will run the applications stored in the memory to implement various functions:

[0106] Use the stored MS COCO dataset to train the FCOS object detection model;

[0107] Input the original image data into the trained FCOS target detection model to obtain all its prediction results p;

[0108] The obtained prediction results p are used to construct a heat map H indicating the areas in the input image that play an important role in the attribute prediction in p. (P) :

[0109]

[0110] Using heat map H (P) , generate mask M (P) , which is used to limit the area where disturbances are added later:

[0111] Idx=Indice(H (P) )(3)

[0112] M (P) =Mask(0,Idx)(4)

[0113] Generate adversarial perturbations N using techniques such as masking, random noise, or fast gradient sign method (P) , and use the generated mask M (P) Limit the perturbation area to construct adversarial examples The construction process is as follows:

[0114]

[0115] Clip(x)=min(255,max(0,x))(6).

[0116] The principles and implementation methods of the present invention are described in this article using specific embodiments. The description of the above embodiments is only used to help understand the method and core ideas of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made to the present invention without departing from the principles of the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A method for adversarial attack on target bounding box localization in a target detection model, characterized in that: Specifically include: Model training: using the original image data to train the target detection model and obtain the trained target detection model; Obtaining prediction results: inputting the target image into the trained target detection model to obtain all prediction results; Heat map generation, generating a heat map using the prediction results, wherein the heat map is used to indicate important areas in the target image that have a positive impact on the prediction of each attribute; Mask generation, using the heat map to generate a mask, wherein the mask is used to limit the disturbance area; Adversarial sample generation, generating adversarial perturbations, and using the mask to limit the perturbation area to generate adversarial samples.

2. The method for countering an attack on target bounding box positioning in a target detection model according to claim 1, characterized in that: The prediction result acquisition includes: The target image Input into the trained target detection model, the model outputs multiple prediction results p, each prediction result p includes the class score and bounding box 3. The method for countering an attack on target bounding box positioning in a target detection model according to claim 2, characterized in that: The heat map generation specifically includes: Using the prediction result p and B (P) Attributes and target detection interpretable algorithm to generate heat map H (P) .

4. The method for countering an attack on target bounding box positioning in a target detection model according to claim 3, characterized in that: The heat map generation specifically includes: Assume that the attacker specifies to attack the lower boundary of a target bounding box, that is, the corresponding prediction result p Attributes, in order to obtain the attributes that can indicate the predicted attributes in the input image Heat map of important areas (P) , the following operations need to be performed: In the formula, A k The output of the last convolutional layer of the feature extraction network of the target detection model, i.e., the feature map map; is the gradient map after local smoothing operation Φ as an importance weight map; Represents the multiplication of corresponding elements in a matrix or vector; ReLU() is the activation function.

5. The method for countering an attack on target bounding box positioning in a target detection model according to claim 1, characterized in that: The mask generation specifically includes: Using heat map H (P) Generate mask M (P) , the M (P) The construction process is as follows: Idx=Indice(H (P) ) (3)M (P) =Mask(0,Idx) (4) In the formula, the function of Indice(x) is to find all points in vector x whose values ​​are not 0 and record their indexes as Idx; is a vector whose element values ​​are all 0; Mask(x,index) is an operation to modify the value of the corresponding index index in the vector x to 1; For the mask.

6. The method for countering attack on target bounding box positioning in a target detection model according to claim 1, characterized in that: The generation of the adversarial perturbation includes, but is not limited to, masking, random noise, or fast gradient sign method.

7. A counterattack model for target bounding box localization in a target detection model, characterized in that: The model includes: The model training module uses the original image data to train the target detection model and obtain the trained target detection model; A prediction result acquisition module inputs the target image into the trained target detection model to obtain all prediction results; A heat map generation module, which generates a heat map using the prediction results, wherein the heat map is used to indicate important areas in the target image that have a positive impact on the prediction of each attribute; A mask generation module, using the heat map to generate a mask, wherein the mask is used to limit the disturbance area; The adversarial sample generation module generates adversarial perturbations, and uses the mask to limit the perturbation area to generate adversarial samples.

Images