Intelligent perception deception method and system
By introducing focus maps and constructing mapping triangle loss functions in the intelligent perception spoofing method, using shallow features in the recognition model, the problem of poor spoofing effect of black box attacks in the existing technology is solved, and a more efficient spoofing effect is achieved.
Patent Information
- Application Number
- CN202411490346.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-24
- Publication Date
- 2025-04-04
AI Technical Summary
The existing intelligent perception spoofing methods have poor deception effects during black box attacks, and fail to fully utilize the shallow feature information between different models, resulting in the inability to effectively deceive other identification models for adversarial samples.
By introducing focus maps and constructing mapping triangle loss functions, the shallow features of the image in the recognition model are used to generate adversarial samples. This method inputs the focus map and the original map respectively to identify the model, obtains the KL divergence and Euro-type distance between the feature map and the edge feature map, and constructs the total loss function to generate the perturbation value.
The convergence speed and deception effect of the algorithm model are improved, and different recognition models can be deceived more effectively.
Smart Images
Figure CN119762902A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of deep learning deception algorithms, and specifically relates to an intelligent perception deception method and system. Background Art
[0002] The intelligent perception deception algorithm aims to study how to generate adversarial samples, that is, to add some subtle interference or perturbations that are imperceptible to the human eye to the original clean image samples. These perturbations will not affect human recognition, but can mislead the machine learning model and make it make wrong judgments or predictions.
[0003] Intelligent perception deception methods for generating adversarial samples can be mainly divided into three categories: gradient-based methods, optimization-based methods, and generative model-based methods. Gradient-based methods use model gradient information to construct perturbations, which are direct and efficient but may be limited by the model structure. Optimization-based methods use an iterative optimization process to find the minimum perturbation, which is more flexible but has a higher computational cost. Generative model-based methods use models such as generative adversarial networks to generate adversarial samples, which can generate diverse samples but have a complex training process. These methods have their own advantages and disadvantages and are suitable for different scenarios and needs.
[0004] The most widely used method is the gradient-based method. The gradient-based method generally designs the loss function based on the semantic information of the highest level of the perception and recognition model, and then generates small noise perturbations through gradient backpropagation. It works well in white-box attacks, which means that the attacker can fully access the internal information of the target model, such as parameters and structure, and then use this information to construct adversarial samples. However, the deception effect is poor in black-box attacks, which means that the attacker cannot directly obtain the internal information of the model and can only rely on the input and output of the model to attack. The main reason is that the shallow feature information with commonality between different models is not fully utilized. For example, when the resnet18 and vgg11 models recognize a photo of an airplane, the shallow features of the model are all the outline of the airplane, but the high-level semantics between the two are different. However, when generating adversarial samples, the loss function is only designed for the high-level semantics of the model, while ignoring or not fully utilizing the shallow semantics with commonality between models. This leads to the adversarial samples obtained under a certain intelligent perception recognition model, which cannot effectively deceive other recognition models. Summary of the invention
[0005] The purpose of the present invention is to overcome the deficiencies in the prior art and provide an intelligent perception deception method and system. The solution of the present invention can solve the problems existing in the above-mentioned prior art.
[0006] The technical solution of the present invention:
[0007] According to a first aspect, there is provided an intelligent perception deception method, comprising the following steps:
[0008] Select the focus map and the intelligent recognition model that has been trained for a certain image recognition data set, and use the intelligent recognition model as the recognition model S for subsequent perturbation generation. Its parameters are denoted as θ, and the shallow mapping function of the recognition model is denoted as g su ;
[0009] Select an original image and record its true category label;
[0010] The focus map and the original image are input into the recognition model S respectively to obtain their respective feature maps, and the edge feature map of the original image is obtained using the edge detection algorithm canny;
[0011] Obtain the KL divergence between the feature map of the focus map and the feature map of the original image as loss sub-function one, obtain the KL divergence between the feature map of the focus map and the edge feature map of the original image as loss sub-function two, and obtain the Euclidean distance between the feature map of the original image and the edge feature map of the original image as loss sub-function three;
[0012] According to the obtained loss sub-function 1, loss sub-function 2 and loss sub-function 3, a mapping triangular loss function is constructed, and its value is: the sum of loss sub-function 1, loss sub-function 2 and loss sub-function 3;
[0013] According to the feature map of the original image and the true category label of the original image, the classic cross entropy loss function is calculated;
[0014] The total loss function is obtained by weighted summing the mapped triangular loss function and the classic cross entropy loss function;
[0015] Based on the total loss function, multiple rounds of gradient back propagation are performed to obtain the perturbation value, and the perturbation value is superimposed on the original image to obtain the adversarial sample;
[0016] Use the obtained adversarial samples to deceive.
[0017] Furthermore, the intelligent perception deception method also includes inputting the obtained adversarial sample into the recognition model S or other recognition models for recognition to verify its deception effect. If the set deception effect is not met, the gradient back propagation iteration rounds are increased until the deception is successful.
[0018] Furthermore, the loss subfunction sp The formula for (x|θ) is:
[0019]
[0020] Among them, m, c, r represent the channel number involved in the current calculation, the column number of the current channel, and the row number of the current channel, n m ,n cand n r Indicates the number of channels, columns, and rows of the feature map, g su (x) (m,c,r) It means that the original image is input into the recognition model S to obtain the eigenvalue corresponding to the rth row and cth column of the mth channel of the feature image; g su (a) (m,c,r) It represents the eigenvalue corresponding to the rth row and cth column of the mth channel of the feature map obtained by the focus map input recognition model S, and x represents the original image.
[0021] According to a second aspect, there is provided the above-mentioned intelligent perception deception system, comprising a focus mapping unit, an original image acquisition unit, a feature map calculation unit, an edge feature map calculation unit, a mapping triangle loss function calculation unit, a cross entropy loss function calculation unit, a total loss function calculation unit and an adversarial sample acquisition unit;
[0022] The focus map unit presets a focus map and sends the focus map to the feature map calculation unit;
[0023] The original image acquisition unit acquires the original image, records the true category label of the original image, sends the original image to the feature image calculation unit, the edge feature image calculation unit and the adversarial sample acquisition unit, and sends the true category label to the cross entropy loss function calculation unit;
[0024] The feature map calculation unit presets an intelligent recognition model for a certain image recognition data set, inputs the focus map and the original image into the intelligent recognition model respectively, obtains a focus map feature map and an original image feature map, sends the focus map feature map and the original image feature map to the mapping triangle loss function calculation unit, and sends the original image feature map to the cross entropy loss function calculation unit;
[0025] The edge feature map calculation unit is pre-set with an edge detection algorithm canny, and the original image is obtained by using the edge detection algorithm canny to obtain an edge feature map of the original image, and the edge feature map is sent to the mapping triangular loss function calculation unit;
[0026] The mapping triangular loss function calculation unit obtains the KL divergence between the feature map of the focus mapping image and the feature map of the original image as loss sub-function one, obtains the KL divergence between the feature map of the focus mapping image and the edge feature map of the original image as loss sub-function two, obtains the Euclidean distance between the feature map of the original image and the edge feature map of the original image as loss sub-function three, the sum of loss sub-function one, loss sub-function two and loss sub-function three is the mapping triangular loss function, and sends the mapping triangular loss function to the total loss function calculation unit;
[0027] The cross entropy loss function calculation unit calculates the classic cross entropy loss function according to the obtained feature map of the original image and the true label of the category of the original image, and sends the cross entropy loss function to the total loss function calculation unit;
[0028] The total loss function calculation unit performs weighted addition of the obtained mapping triangle loss function and the classic cross entropy loss function to obtain a total loss function, and sends the total loss function to the adversarial sample acquisition unit;
[0029] The adversarial sample acquisition unit performs multiple rounds of gradient back propagation according to the obtained total loss function to obtain a perturbation value, superimposes the perturbation value with the original image to obtain an adversarial sample, and uses the adversarial sample to deceive.
[0030] The beneficial effects of the present invention compared with the prior art are as follows:
[0031] (1) The present invention accelerates the convergence of the algorithm model and improves the calculation speed by introducing the focus map;
[0032] (2) The present invention constructs a mapping triangular loss function to fully utilize the shallow features of the image in the recognition model from multiple angles to improve the deception effect. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] The included drawings are used to provide a further understanding of the embodiments of the present invention, which constitute a part of the specification, are used to illustrate the embodiments of the present invention, and together with the text description, explain the principles of the present invention. Obviously, the drawings in the following description are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0034] Figure 1 A schematic diagram of the steps of an intelligent perception deception method provided according to an embodiment of the present invention is shown;
[0035] Figure 2 (1)-2(6) show a schematic diagram of a focus mapping diagram provided according to an embodiment of the present invention. DETAILED DESCRIPTION
[0036] It should be noted that, in the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other. The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present invention and its application or use. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0037] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.
[0038] Unless otherwise specifically stated, the relative arrangement of the parts and steps described in these embodiments, numerical expressions and numerical values do not limit the scope of the present invention. At the same time, it should be understood that, for ease of description, the sizes of the various parts shown in the accompanying drawings are not drawn according to the actual proportional relationship. The technology, method and equipment known to ordinary technicians in the relevant field may not be discussed in detail, but in appropriate cases, the technology, method and equipment should be regarded as a part of the authorization specification. In all examples shown and discussed here, any specific value should be interpreted as being merely exemplary, rather than as a limitation. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once a certain item is defined in an accompanying drawing, it does not need to be further discussed in subsequent drawings.
[0039] Focus map is an image with strong visual features, covering a variety of elements such as texture, corners, contours, shapes, etc. Figure 2 (1)-2(6) as shown.
[0040] like Figure 1 As shown, according to an embodiment of the present invention, an intelligent perception deception method is provided, comprising the following steps:
[0041] Step 1: Select the focus map and the intelligent recognition model that has been trained for a certain image recognition data set, and use the intelligent recognition model as the recognition model S for subsequent perturbation generation. Its weight is denoted by θ. The intelligent recognition model is a neural network model. The neural network model includes several layers of neuron nodes. Each neuron node includes two parameters: weight and offset. The parameters of all neuron nodes in the intelligent recognition model are uniformly represented by θ. The shallow mapping function of the recognition model is denoted by g su ;
[0042] Step 2: Select an original image and record its true category label;
[0043] Step 3: Input the focus map and the original image into the recognition model S respectively, and obtain their respective feature maps after passing through the shallow mapping function. Use the edge detection algorithm canny to obtain the edge feature map of the original image.
[0044] Step 4, obtaining the KL divergence between the feature map of the focus map and the feature map of the original image as the first loss sub-function, obtaining the KL divergence between the feature map of the focus map and the edge feature map of the original image as the second loss sub-function, obtaining the Euclidean distance between the feature map of the original image and the edge feature map of the original image as the third loss sub-function;
[0045] Step 5: construct a mapping triangular loss function based on the obtained loss sub-function 1, loss sub-function 2 and loss sub-function 3, and its value is: the sum of loss sub-function 1, loss sub-function 2 and loss sub-function 3;
[0046] Step 6: Calculate the classic cross entropy loss function based on the feature map of the original image and the true category label of the original image;
[0047] Step 7: The total loss function is obtained by weighted summing the mapped triangle loss function and the classic cross entropy loss function;
[0048] Step 8: Based on the total loss function, multiple rounds of gradient back propagation are performed to obtain the perturbation value, and the perturbation value is superimposed on the original image to obtain the adversarial sample;
[0049] Step nine: Use the obtained adversarial sample to deceive.
[0050] Through this setting, the focus map is introduced to accelerate the convergence of the algorithm model and improve the calculation speed; and by constructing a mapping triangular loss function, the shallow features of the image in the recognition model are fully utilized from multiple angles to improve the deception effect.
[0051] Furthermore, in one embodiment, an intelligent perception deception method also includes inputting the obtained adversarial samples into a recognition model S and other recognition models for category recognition to verify the deception effect. If the set deception effect is not met, the gradient backpropagation iteration rounds are increased until the deception is successful.
[0052] Further in one embodiment, the loss sub-function is sp The formula for (x|θ) is:
[0053]
[0054] Among them, m, c, r represent the channel number involved in the current calculation, the column number of the current channel, and the row number of the current channel, n m ,n c and n r Indicates the number of channels, columns, and rows of the feature map, g su (x) (m,c,r) It means that the original image is input into the recognition model S to obtain the eigenvalue corresponding to the rth row and cth column of the mth channel of the feature image; g su (a) (m,c,r) represents the eigenvalue corresponding to the rth row and cth column of the mth channel of the feature map obtained by the focus map input recognition model S, and x represents the original image;
[0055] Further in one embodiment, the loss sub-function is dis The formula for (x|θ) is:
[0056]
[0057] Among them, edges(x) (m,c,r) It is the eigenvalue corresponding to the rth row and cth column of the mth channel of the edge feature map of the original image.
[0058] Further in one embodiment, the loss sub-function is sim The formula for (x|θ) is:
[0059]
[0060] Wherein, Eucl_dist(·,·) represents the Euclidean distance.
[0061] By setting loss sub-function one, loss sub-function two and loss sub-function three, a mapping triangular loss function is obtained, which fully utilizes the shallow features of the image in the recognition model from multiple angles to improve the deception effect.
[0062] Further in one embodiment, the classic cross entropy loss function l cr The calculation formula for (x,y|θ) is:
[0063]
[0064] where n cate represents the total number of categories, p sur (·) represents the prediction mapping function of the surrogate model S, and q represents the category ordinal number in the classification task.
[0065] Further in one embodiment, the calculation formula of the total loss function L is:
[0066] L = l mt (x|θ)+ws×l cr (x,y|θ)
[0067] =(l sp (x|θ)+l dis (x|θ)+l sim (x|θ))+ws×l cr (x,y|θ)
[0068] Where ws is the weight coefficient and y is the true label of the category.
[0069] Further in one embodiment, the update formula of the adversarial sample is:
[0070]
[0071] in is the adversarial sample generated in round t, α is the step size, Indicates partial derivative of x, clip(·) indicates truncation function, that is, values greater than 1 are reset to 1, values less than 0 are reset to 0, and the rest remain unchanged. Use the original clean image x to initialize After several rounds of iterations, the final adversarial sample x is obtained. adv .
[0072] According to the second aspect embodiment, there is provided the above-mentioned intelligent perception deception system, including a focus mapping unit, an original image acquisition unit, a feature map calculation unit, an edge feature map calculation unit, a mapping triangle loss function calculation unit, a cross entropy loss function calculation unit, a total loss function calculation unit and an adversarial sample acquisition unit;
[0073] A focus map is preset in the focus map unit, and the focus map is sent to the feature map calculation unit;
[0074] The original image acquisition unit acquires the original image, records the true category label of the original image, sends the original image to the feature image calculation unit, the edge feature image calculation unit and the adversarial sample acquisition unit, and sends the true category label to the cross entropy loss function calculation unit;
[0075] The feature map calculation unit presets an intelligent recognition model for a certain image recognition data set, inputs the focus map and the original image into the intelligent recognition model respectively, obtains a focus map feature map and an original image feature map, sends the focus map feature map and the original image feature map to the mapping triangle loss function calculation unit, and sends the feature map of the original image to the cross entropy loss function calculation unit;
[0076] The edge detection algorithm canny is preset in the edge feature map calculation unit. The edge feature map of the original image is obtained by using the edge detection algorithm canny, and is sent to the mapping triangle loss function calculation unit;
[0077] The mapping triangular loss function calculation unit obtains the KL divergence between the feature map of the focus mapping image and the feature map of the original image as loss sub-function one, obtains the KL divergence between the feature map of the focus mapping image and the edge feature map of the original image as loss sub-function two, obtains the Euclidean distance between the feature map of the original image and the edge feature map of the original image as loss sub-function three, and the sum of loss sub-function one, loss sub-function two and loss sub-function three is the mapping triangular loss function, and sends the mapping triangular loss function to the total loss function calculation unit;
[0078] The cross entropy loss function calculation unit calculates a classic cross entropy loss function according to the obtained feature map of the original image and the true label of the category of the original image, and sends the cross entropy loss function to the total loss function calculation unit;
[0079] The total loss function calculation unit performs weighted addition of the obtained mapping triangle loss function and the classic cross entropy loss function to obtain a total loss function, and sends the total loss function to the adversarial sample acquisition unit;
[0080] The adversarial sample acquisition unit performs multiple rounds of gradient back propagation according to the obtained total loss function to obtain the perturbation value, superimposes the perturbation value with the original image to obtain the adversarial sample, and uses the adversarial sample to deceive.
[0081] Furthermore, in one embodiment, the intelligent perception deception system also includes a verification unit, which has a preset intelligent recognition model or other recognition model of the image, and uses the recognition model to identify adversarial samples to verify the deception effect of the adversarial samples. If the set deception effect is not met, the result is fed back to the adversarial sample acquisition unit, and the gradient back propagation iteration rounds are increased to obtain a new adversarial sample.
[0082] In order to have a further understanding of the intelligent perception deception method provided by the present invention, a detailed description is given below with reference to specific examples and drawings.
[0083] Before the algorithm starts, prepare the following:
[0084] Several intelligent recognition models that have been trained for a certain image recognition dataset, such as resnet18, vgg11, densenet121, etc. Select one of them, such as resnet18, as the proxy model S for subsequent perturbation generation, and its parameters are recorded as θ. The shallow mapping function of the proxy model is recorded as g su ;
[0085] A clean original image, denoted as x, and its true category label, denoted as y;
[0086] from Figure 2 Choose one of the six focus maps shown, such as Figure 2 (6), as the focus map used by this deception algorithm, this map is denoted as a;
[0087] Edge detection algorithms, such as the Canny algorithm, have their mapping functions recorded as edges.
[0088] The following is an introduction to the four steps of implementing this method.
[0089] Step 1: First, we need to prepare three feature maps. Input the focus map a and the original clean image x into the recognition model S respectively to obtain their respective feature maps, which are denoted as g su (a) and g su (x); at the same time, the edge detection algorithm canny is used to obtain the edge feature map of the original clean image x, which is recorded as edges(x).
[0090] Step 2: Then, we define three loss sub-functions, denoted as l sp (x|θ), l dis (x|θ) and l sim (x|θ), where l sp (x|θ) is defined as the feature map g su (a) and g su The KL divergence of (x), l dis (x|θ) is defined as the feature map g su The KL divergence between (a) and edges(x), while l sim (xθ) is defined as the feature map g su The Euclidean distance between (x) and edges(x). Mapping triangular loss l mt (x|θ) is defined as the sum of the above three loss sub-functions, i.e., l mt (x|θ)=l sp (x|θ)+l dis (x|θ)+l sim (x|θ); The three sub-losses contained in the mapping triangle loss are specifically defined as follows:
[0091]
[0092] where n m ,n c and n r represents the number of channels, columns, and rows of the feature map, and Eucl_dist(·,·) represents the Euclidean distance.
[0093] In addition, the output obtained by inputting image x into model S and its true label can be calculated to obtain the classic cross entropy loss, denoted as l cr (x,y|θ). The cross entropy loss is defined as follows:
[0094]
[0095] where n cate represents the total number of categories, p sur (·) represents the prediction mapping function of the surrogate model S.
[0096] Step 3: Add the three sub-loss functions and the classic cross entropy loss to obtain the total loss function L, which is as follows:
[0097] L = l mt (x|θ)+ws×l cr (x,y|θ)
[0098] =(lsp(x|θ)+ldis(x|θ)+lsim(x|θ))+ws×lcr(x,y|θ)
[0099] Where ws is the weight coefficient, which is set to 0.995 in this algorithm.
[0100] Based on the total loss function L, multiple rounds of gradient back propagation are performed to obtain adversarial samples. The update formula of adversarial samples is as follows:
[0101]
[0102] in The adversarial sample generated for round t, α is the step size. Use the original clean image x to initialize After several rounds of iterations, this algorithm sets the number of iterations to 6, and finally obtains the final adversarial sample x adv .
[0103] Step 4: Take the adversarial sample x obtained in step 3 adv Input recognition model S and related recognition models for category recognition to verify its deception effect.
[0104] In summary, the intelligent perception deception method provided by the present invention has at least the following advantages over the prior art:
[0105] (1) The present invention accelerates the convergence of the algorithm model and improves the calculation speed by introducing the focus map;
[0106] (2) The present invention constructs a mapping triangular loss function to fully utilize the shallow features of the image in the recognition model from multiple angles to improve the deception effect.
[0107] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. An intelligent perception deception method, characterized in that: The following steps are involved: Select the focus map and the intelligent recognition model that has been trained for a certain image recognition data set, and use the intelligent recognition model as the recognition model S for subsequent perturbation generation. Its parameters are denoted as θ, and the shallow mapping function of the recognition model is denoted as g su ; Select an original image and record its true category label; The focus map and the original image are input into the recognition model S respectively to obtain their respective feature maps, and the edge feature map of the original image is obtained using the edge detection algorithm canny; Obtain the KL divergence between the feature map of the focus map and the feature map of the original image as loss sub-function one, obtain the KL divergence between the feature map of the focus map and the edge feature map of the original image as loss sub-function two, and obtain the Euclidean distance between the feature map of the original image and the edge feature map of the original image as loss sub-function three; According to the obtained loss sub-function 1, loss sub-function 2 and loss sub-function 3, a mapping triangular loss function is constructed, and its value is: the sum of loss sub-function 1, loss sub-function 2 and loss sub-function 3; According to the feature map of the original image and the true category label of the original image, the classic cross entropy loss function is calculated; The total loss function is obtained by weighted summing the mapped triangular loss function and the classic cross entropy loss function; Based on the total loss function, multiple rounds of gradient back propagation are performed to obtain the perturbation value, and the perturbation value is superimposed on the original image to obtain the adversarial sample; Use the obtained adversarial samples to deceive.
2. The intelligent perception deception method according to claim 1, characterized in that: It also includes inputting the obtained adversarial sample into the recognition model S or other recognition models for recognition to verify its deception effect. If the set deception effect is not met, the gradient backpropagation iteration rounds are increased until the deception is successful.
3. The intelligent perception deception method according to claim 2, characterized in that: The loss sub-function The calculation formula is: Among them, m, c, r represent the channel number involved in the current calculation, the column number of the current channel, and the row number of the current channel, n m ,n c and n r Indicates the number of channels, columns, and rows of the feature map, g su (x) (m,c,r) It means that the original image is input into the recognition model S to obtain the eigenvalue corresponding to the rth row and cth column of the mth channel of the feature image; g su (a) (m,c,r) It represents the eigenvalue corresponding to the rth row and cth column of the mth channel of the feature map obtained by the focus map input recognition model S, and x represents the original image.
4. The intelligent perception deception method according to claim 3, characterized in that: Loss sub-function 2 The calculation formula is: Where edges(x)( m,c,r ) is the eigenvalue corresponding to the rth row and cth column of the mth channel of the edge feature map of the original image.
5. The intelligent perception deception method according to claim 4, characterized in that: Loss sub-function three The calculation formula is: Wherein, Eucl_dist(·,·) represents the Euclidean distance.
6. The intelligent perception deception method according to claim 5, characterized in that: Classic cross entropy loss function The calculation formula is: Where n cate represents the total number of categories, p sur (·) represents the prediction mapping function of the surrogate model S, and q represents the category ordinal number in the classification task.
7. The intelligent perception deception method according to claim 6, characterized in that: The calculation formula of the total loss function L is: Where ws is the weight coefficient and y is the true label of the category.
8. The intelligent perception deception method according to claim 7, characterized in that: The update formula for adversarial samples is: in is the adversarial sample generated in round t, α is the step size, Indicates partial derivative of x, clip(·) indicates truncation function, that is, values greater than 1 are reset to 1, values less than 0 are reset to 0, and the rest remain unchanged. Use the original clean image x to initialize After several rounds of iterations, the final adversarial sample x is obtained. adv .
9. An intelligent perception deception system for implementing an intelligent perception deception method according to any one of claims 1 to 8, characterized in that: It includes a focus mapping unit, an original image acquisition unit, a feature map calculation unit, an edge feature map calculation unit, a mapping triangle loss function calculation unit, a cross entropy loss function calculation unit, a total loss function calculation unit and an adversarial sample acquisition unit; A focus map is preset in the focus map unit, and the focus map is sent to the feature map calculation unit; The original image acquisition unit acquires the original image, records the true category label of the original image, sends the original image to the feature image calculation unit, the edge feature image calculation unit and the adversarial sample acquisition unit, and sends the true category label to the cross entropy loss function calculation unit; The feature map calculation unit presets an intelligent recognition model for a certain image recognition data set, inputs the focus map and the original image into the intelligent recognition model respectively, obtains a focus map feature map and an original image feature map, sends the focus map feature map and the original image feature map to the mapping triangle loss function calculation unit, and sends the feature map of the original image to the cross entropy loss function calculation unit; The edge detection algorithm canny is preset in the edge feature map calculation unit. The edge feature map of the original image is obtained by using the edge detection algorithm canny, and is sent to the mapping triangle loss function calculation unit; The mapping triangular loss function calculation unit obtains the KL divergence between the feature map of the focus mapping image and the feature map of the original image as loss sub-function one, obtains the KL divergence between the feature map of the focus mapping image and the edge feature map of the original image as loss sub-function two, obtains the Euclidean distance between the feature map of the original image and the edge feature map of the original image as loss sub-function three, and the sum of loss sub-function one, loss sub-function two and loss sub-function three is the mapping triangular loss function, and sends the mapping triangular loss function to the total loss function calculation unit; The cross entropy loss function calculation unit calculates a classic cross entropy loss function according to the obtained feature map of the original image and the true label of the category of the original image, and sends the cross entropy loss function to the total loss function calculation unit; The total loss function calculation unit performs weighted addition of the obtained mapping triangle loss function and the classic cross entropy loss function to obtain a total loss function, and sends the total loss function to the adversarial sample acquisition unit; The adversarial sample acquisition unit performs multiple rounds of gradient back propagation according to the obtained total loss function to obtain the perturbation value, superimposes the perturbation value with the original image to obtain the adversarial sample, and uses the adversarial sample to deceive.
10. An intelligent perception deception system according to claim 9, characterized in that: The method also includes a verification unit, in which an intelligent recognition model or other recognition model of the image is preset. The recognition model is used to identify the adversarial sample to verify the deception effect of the adversarial sample. If the set deception effect is not met, the result is fed back to the adversarial sample acquisition unit, and the gradient back propagation iteration rounds are increased to obtain a new adversarial sample.