Non-directional attack countermeasure method and system for two-stage target detection model
Through the non-directed adversarial attack method for the two-stage object detection model, the generation of adversarial samples that enable the object detection model to classify the target into the background category, solving the problem that existing targeted attacks are difficult to apply to single-category object detection data sets, and achieving successful attacks and slight perturbations of adversarial samples in single-category data sets.
Patent Information
- Application Number
- CN202411922065.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-25
- Publication Date
- 2025-04-01
AI Technical Summary
The existing adversarial attack technology is mainly targeted attacks, which are difficult to apply to single-category target detection data sets, and it is difficult to successfully attack when the target category is large and the original category is different.
A non-directed adversarial attack method for two-stage object detection model is proposed. Through model training, candidate area acquisition, objective function establishment and adversarial sample acquisition, it generates adversarial samples that enable the object detection model to classify the target into the background category.
This method can successfully attack the target detection model in a single-category target detection data set, so that the target category is misclassified as a background, thereby achieving the purpose of evading detection, and the perturbation amplitude of the countermeasures is small and difficult for human eyes to detect.
Smart Images
Figure CN119741565A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of deep learning security technology, and in particular to a non-directional adversarial attack method for a two-stage target detection model.
[0002] The present invention also relates to a non-directional adversarial attack system for a two-stage target detection model. Background Art
[0003] With the rapid application of deep learning in various fields, the security of deep learning has become a research hotspot; studies have shown that adversarial attacks can use perturbations that are imperceptible to the human eye to arbitrarily manipulate the output of classification networks.
[0004] In classification tasks, the model only needs to correctly classify the most prominent object in the input image. In object detection tasks, the model needs to correctly classify and accurately locate multiple objects in the input image; therefore, attacking the object detection model is more challenging than attacking the classification model.
[0005] Currently, most of the attack methods for target detection models are targeted attacks. Before the attack, the targeted attack selects a target category for each proposal box. Then, using the gradient information, the category of the proposal box is attacked as the target category.
[0006] However, some object detection datasets used for specific scenarios have only one category and are not suitable for targeted attacks. In addition, if the original category is very different from the target category, it is difficult to successfully attack by generating larger perturbations.
[0007] Most existing adversarial attack techniques are targeted attacks, which tend to cause target misclassification and cannot hide the target, making them difficult to apply to single-category target detection datasets. Summary of the invention
[0008] The purpose of the present invention is: to address the above-mentioned problems, the present invention provides a non-directional adversarial attack method for a two-stage target detection model, which not only reduces the disturbance of adversarial samples, but also enables the target detection model to classify the target into the background category, thereby hiding the attack target.
[0009] The technical solution adopted by the present invention is as follows:
[0010] A non-directional adversarial attack method for a two-stage object detection model, comprising:
[0011] Model training: using the original image data to train the two-stage target detection model to obtain a trained two-stage target detection model;
[0012] Acquiring candidate regions, inputting the target image into the trained two-stage target detection model, and acquiring all correctly classified candidate regions of the target image and the categories of the candidate regions;
[0013] The objective function is established by using all candidate regions of the target image that are classified into corresponding categories to construct the objective function.
[0014] Adversarial samples are obtained by solving the objective function to obtain adversarial perturbations, and adversarial samples are obtained through the adversarial perturbations.
[0015] Furthermore, model training specifically includes:
[0016] Construct an original image dataset and divide the dataset into a training set and a test set. Train the two-stage target detection model with the training set, and test the trained two-stage target detection model with the test set to obtain the trained two-stage target detection model.
[0017] Furthermore, obtaining the candidate region includes:
[0018] All the correct regions of the target detection image that are classified into the corresponding regions are obtained from the region extraction network in the two-stage target detection model, and the region category is obtained at the same time. The region extraction network performs preprocessing to obtain more candidate regions.
[0019] Furthermore, the objective function is as follows:
[0020] L(I,l t )=CrossEntropy[f l (I,t n ),l] (1)
[0021] In the formula, f l (I,t n ) is the score corresponding to the nth candidate region under category l, and CrossEntropy() represents the cross entropy function.
[0022] Furthermore, the objective function is solved by using a gradient ascent algorithm to obtain adversarial disturbances.
[0023] Furthermore, the adversarial perturbation is constrained by a two-norm to obtain adversarial samples.
[0024] Furthermore, the adversarial perturbation is constrained and clipped to obtain adversarial samples. The clipping function is specifically as follows:
[0025] Clip(x)=min(255,max(0,x)) (2).
[0026] The present invention also provides a second technical solution, a non-directional adversarial attack system for a two-stage target detection model, the system comprising:
[0027] A model training module is used to train the two-stage target detection model using original image data to obtain a trained two-stage target detection model;
[0028] A candidate region extraction module is used to input the target image into the trained two-stage target detection model to obtain all correctly classified candidate regions of the target image and the categories of the candidate regions;
[0029] A classification loss construction module is used to construct an objective function using all candidate regions of the target image that are classified into corresponding categories;
[0030] The optimization module is used to optimize and solve the objective function to obtain adversarial perturbations, thereby obtaining adversarial samples.
[0031] Furthermore, the system also includes a constraint module, which is used to constrain the adversarial perturbation and trim the adversarial perturbation to obtain adversarial samples.
[0032] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:
[0033] The non-directional adversarial attack method proposed in the present invention for the two-stage target detection model can cause the target detection model to misclassify, and the attack method can be applied to a single-category target detection data set. In a single-category target detection scenario, it is easier to classify the target category as background, thereby achieving the purpose of escaping detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] Figure 1 It is a flow chart of a non-directional adversarial attack method for a two-stage target detection model of the present invention;
[0035] Figure 2 It is a comparison diagram of surviving adversarial samples and original samples in a non-directional adversarial attack method for a two-stage target detection model of the present invention;
[0036] Figure 3 It is a comparison diagram of the detection results of the target detection model before and after the attack in a non-directional adversarial attack method for a two-stage target detection model of the present invention;
[0037] Figure 4 It is a structural schematic diagram of a non-directional adversarial attack system for a two-stage target detection model of the present invention;
[0038] Figure 5 This is a block diagram of the terminal structure in Embodiment 3 of the present invention. DETAILED DESCRIPTION
[0039] The present invention will be described in detail below in conjunction with the accompanying drawings.
[0040] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.
[0041] Example 1
[0042] A non-directional adversarial attack method for two-stage object detection models, such as Figure 1 As shown, the specific implementation steps are as follows:
[0043] Step 1: Use the original image data to train the two-stage object detection model so that the two-stage object detection model performs well on the normal data set;
[0044] This embodiment takes the self-constructed insulator dataset as an example; the insulator rupture dataset constructed in this embodiment contains 305 insulator images, which are divided into a training set and a test set at a ratio of 9:1; the training set contains 274 images and the test set contains 31 images, which are used for subsequent model training and evaluation.
[0045] The two-stage object detection model FasterR-CNN used in this embodiment uses VGG16 as the feature extraction network. The model is first trained using the PASCAL VOC 2007 dataset, and then migrated to the self-constructed insulator dataset to fine-tune the FasterR-CNN model to obtain the model with the highest mAP value on the test set;
[0046] Step 2: Input the target image I into the trained two-stage target detection model, and obtain all the regions of the target image I classified as foreground and the categories of the regions from the region extraction network of the two-stage target detection model, such as RPN (Region Proposal Network);
[0047] In this embodiment, the self-constructed insulator test set image is input as the original image I into the trained FasterR-CNN network model, and the IoU (Intersection over Union) threshold of the NMS (Non-Maximum Suppression) of the RPN layer of the model is increased to generate more candidate regions, and all the correctly classified candidate regions {t1, t2, …, t n};
[0048] Step 3: Use the target image I to classify allt The candidate regions in the category construct the classification loss function L(I,L t );
[0049] Specifically, the constructed classification loss function is:
[0050] L(I,l t )=CrossEntropy[f l (I,t n ),l] (1)
[0051] In the formula, is the original image, {t1,t2,…,t n} are all correctly classified candidate regions in I, f l (I,t n ) is the score corresponding to the nth candidate region under the true category l, that is, the output of the network model before the Softmax layer; the attacker’s attack goal is to make as many targets with the true category l as possible be misclassified;
[0052] Step 4: Use the gradient ascent algorithm to solve the optimization objective function, i.e., the loss function, to obtain the adversarial disturbance;
[0053] Step 5, using the adversarial sample perturbation size generated by the two-norm constraint to obtain the adversarial sample;
[0054] Specifically, the modulus of the adversarial perturbation obtained in step 4 is calculated, and the adversarial perturbation is divided by its modulus to obtain the normalized gradient, thereby limiting the amplitude of the adversarial perturbation. The adversarial sample is obtained by adding the original sample to the adversarial perturbation, and then the adversarial sample is cropped to the pixel space using the cropping function. Specifically, the cropping function is:
[0055] Clip(x)=min(255,max(0,x)) (2)
[0056] In practical applications, the average precision AP (average precision) is usually used to evaluate the performance of the target detection model, and the extent of the AP value decrease is used to measure the intensity of the adversarial attack.
[0057] The FasterR-CNN target detection model is tested using the adversarial samples generated in this embodiment, and the results are shown in Table 1. As can be seen from Table 1, the adversarial samples generated in this embodiment are very aggressive to FasterR-CNN, reducing its mAP value from 0.551 to 0.309. Moreover, this embodiment is more aggressive to the jyz_pl category, reducing its AP value from 0.315 to 0.102, and also reducing the AP value of the jyz category from 0.342 to 0.226.
[0058] Depend on Figure 2 It can be seen that the amplitude of the countermeasure disturbance generated by this embodiment is very small and difficult to be detected by the human eye.
[0059] Table 1 AP comparison of target detection models before and after the attack
[0060] Attack Methods mAP jyz jyz_pl Original Image 0.551 0.342 0.315 The present invention 0.309 0.226 0.102
[0061] The specific attack results of this embodiment on the Faster-RCNN model are as follows: Figure 3 As shown. Figure 3 It can be seen that the method of this embodiment causes the target detection model to generate a lot of errors, including missed detection of insulators, incorrect positioning of insulators, and generation of redundant bounding boxes.
[0062] The above experiments and related result analysis verify the effectiveness of the attack method proposed in this invention.
[0063] Example 2
[0064] This embodiment provides a non-directional adversarial attack system for a two-stage target detection model. Figure 4 As shown, specifically including:
[0065] A model training module 401 is used to train the FasterR-CNN model using the original image data;
[0066] The candidate region acquisition module 402 is used to input the original image data into the trained Faster R-CNN model to obtain all correctly classified candidate regions;
[0067] A classification loss construction module 403 is used to construct a classification loss using the candidate regions obtained by the module 402;
[0068] Specifically, the classification loss construction module includes obtaining the classification loss through the following formula:
[0069] L(I,l t )=CrossEntropy[f l (I,t n ),l] (1)
[0070] In the formula, is the original image, {t1,t2,…,t n} are all correctly classified candidate regions in I, f l (I,t n ) is the score corresponding to the nth candidate region under the true category l, that is, the output of the network model before the Softmax layer; the attacker’s attack goal is to make as many targets with the true category l as possible be misclassified;
[0071] An optimization module 404 is used to optimize and solve the optimization objective function constructed by the module 403 to obtain a countermeasure disturbance;
[0072] A constraint module 405 constrains the adversarial perturbation constructed in 404 and trims the adversarial perturbation to obtain an adversarial sample;
[0073] Specifically, the clipping function is:
[0074] Clip(x)=min(255,max(0,x)) (2)
[0075] Example 3
[0076] This embodiment also provides a terminal, such as Figure 5 As shown, for the sake of convenience of explanation, only the parts related to the embodiments of the present invention are shown; the terminal may include any terminal device such as a mobile phone, a tablet, a computer, a POS machine, etc., taking a terminal computer as an example.
[0077] like Figure 5 As shown, the computer includes: a memory, an input device, a display device, an audio circuit, a wireless fidelity (WIFI) module, a processor, a power supply and other components; those skilled in the art can understand that Figure 5 The computer structure shown in the figure does not constitute a limitation of the computer, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.
[0078] Combine the following Figure 5 A detailed introduction to the various components of the computer:
[0079] The memory can be used to store software programs and modules. The processor executes various functional applications and data processing of the computer by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and an application required for at least one function, such as a sound playback function, an image playback function, etc.; the data storage area can store data created according to the use of the computer, such as audio data, a phone book, etc. In this embodiment, the data storage area can store the original image of the adversarial sample to be generated. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.
[0080] The input device can be used to receive input digital or character information and generate key signal input related to user settings and function control of the computer. The input device in this embodiment can be used to receive original image data to be generated as adversarial samples.
[0081] The output device can be used to output and display information input by the user or information provided to the user and various menus of the computer. The output device may include a display panel, and optionally, the output display panel may be configured in the form of a liquid crystal display (Liquid Crystal Display), an organic light-emitting diode (Organic Light-Emitting Diode, OLED), etc.
[0082] The audio module can convert the received audio data into an electrical signal and transmit it to the speaker, which converts it into a sound signal for output.
[0083] WiFi is a short-range wireless transmission technology. Computers can help users send and receive emails, browse web pages, and access streaming media through WiFi modules. It provides users with wireless broadband Internet access.
[0084] The processor is the control center of the computer. It uses various interfaces and lines to connect the various parts of the entire computer. It executes various functions of the computer and processes data by running or executing software programs and / or modules stored in the memory, and calling data stored in the memory, so as to monitor the computer as a whole. Optionally, the processor may include one or more processing units; preferably, the processor may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor.
[0085] Power supply: The power supply can be connected to the processor logic through the power management system, so as to manage charging, discharging, power consumption and other functions through the power management system.
[0086] The computer may also include a camera, a Bluetooth module, etc., which will not be described in detail here.
[0087] Specifically in this embodiment, the processor in the terminal will load the executable files corresponding to the processes of one or more applications into the memory according to the following instructions, and the processor will run the applications stored in the memory to implement various functions:
[0088] Use the stored raw image data to train the Faster R-CNN model;
[0089] Input the original image data into the trained Faster R-CNN model to obtain all correctly classified candidate regions;
[0090] Construct classification loss through the obtained candidate regions;
[0091] Using the annotation information of the original image data, the pixels at the specified target category position are replaced with random noise to construct feature loss;
[0092] Combine the classification loss and feature loss, add the infinite norm to constrain the perturbation size, and obtain the optimized objective function;
[0093] The final optimization objective function is optimized and solved to obtain adversarial samples.
[0094] The principles and implementation methods of the present invention are described in this article using specific embodiments. The description of the above embodiments is only used to help understand the method and core ideas of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made to the present invention without departing from the principles of the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.
Claims
1. A non-directional adversarial attack method for a two-stage target detection model, characterized in that: include: Model training: using the original image data to train the two-stage target detection model to obtain a trained two-stage target detection model; Acquiring candidate regions, inputting the target image into the trained two-stage target detection model, and acquiring all correctly classified candidate regions of the target image and the categories of the candidate regions; The objective function is established by using all candidate regions of the target image that are classified into corresponding categories to construct the objective function; Adversarial samples are obtained by solving the objective function to obtain adversarial perturbations, and adversarial samples are obtained through the adversarial perturbations.
2. The non-directional adversarial attack method for a two-stage target detection model according to claim 1, characterized in that: The model training specifically includes: Construct an original image dataset and divide the dataset into a training set and a test set. Train the two-stage target detection model with the training set, and test the trained two-stage target detection model with the test set to obtain the trained two-stage target detection model.
3. The non-directional adversarial attack method for a two-stage target detection model according to claim 1, characterized in that: The candidate region acquisition includes: All the correct regions of the target detection image that are classified into the corresponding regions are obtained from the region extraction network in the two-stage target detection model, and the region category is obtained at the same time. The region extraction network performs preprocessing to obtain more candidate regions.
4. The non-directional adversarial attack method for a two-stage target detection model according to claim 1, characterized in that: The objective function is specifically as follows: L(I,l t )=CrossEntropy[f l (I,t n ),l] (1) where f l (I,t n ) is the score corresponding to the nth candidate region under category l, and CrossEntropy() represents the cross entropy function.
5. The non-directional adversarial attack method for a two-stage target detection model according to claim 1, characterized in that: The objective function is solved by using a gradient ascent algorithm to obtain the counter-perturbation.
6. The non-directional adversarial attack method for a two-stage target detection model according to claim 1, characterized in that: The adversarial perturbation is constrained by a two-norm to obtain an adversarial sample.
7. The non-directional adversarial attack method for a two-stage target detection model according to claim 6, characterized in that: The adversarial perturbation is constrained and clipped to obtain adversarial samples. The clipping function is as follows: Clip(x)=min(255,max(0,x)) (2).
8. A non-directional adversarial attack system for a two-stage target detection model, characterized in that: The system comprises: A model training module is used to train the two-stage target detection model using original image data to obtain a trained two-stage target detection model; A candidate region extraction module is used to input the target image into the trained two-stage target detection model to obtain all correctly classified candidate regions of the target image and the categories of the candidate regions; A classification loss construction module is used to construct an objective function using all candidate regions of the target image that are classified into corresponding categories; The optimization module is used to optimize and solve the objective function to obtain adversarial perturbations, thereby obtaining adversarial samples.
9. The non-directional adversarial attack system for a two-stage target detection model according to claim 8, characterized in that: The system also includes a constraint module, which is used to constrain the adversarial perturbation and trim the adversarial perturbation to obtain adversarial samples.