Natural adversarial patch generation method based on cue word

Abstract

The target detection technology is widely applied to the fields of automatic driving, video monitoring and the like. In recent years, target detectors face increasingly severe anti-attack threats, in particular anti-patch attacks. The adversarial patch is used for misleading a detection result through normal prediction of an interference model for a deep learning model image area. Most traditional adversarial patches are semantic-free random patterns and are difficult to keep concealment in an actual scene, and the application effect of the traditional adversarial patches is affected. In order to solve the problem, the invention provides a natural adversarial patch (PNAP) generation method based on cue words. According to the method, an adversarial patch with semantics and concealment is generated by utilizing cue words by utilizing a potential diffusion model (LDM) text graph technology. And through the designed combined loss function, the latent variable of the LDM is optimized, so that the generated patch has stronger attack performance in the target detection model. The PNAP generation method provided by the invention has remarkable practicability, especially in an important target anti-intelligent protection scene.

Description

Technical Field

[0001] The present invention relates to the field of anti-attack technology, and in particular to a method for generating natural anti-attack patches based on prompt words. Background Art

[0002] In modern military technology, the application of intelligent systems is becoming increasingly popular, including automatic target recognition, intelligent monitoring and decision support systems. However, with the widespread application of these intelligent systems, related adversarial technologies are also constantly developing to address the security issues of intelligent systems. Adversarial technology, especially the generation and application of adversarial samples, has become an important research direction, which is of great significance in military anti-intelligence scenarios. Adversarial samples refer to carefully designed input data designed to make intelligent systems produce wrong predictions or judgments. This technology has been widely used to improve the security and robustness of intelligent systems.

[0003] In the military field, intelligent systems are often deployed in scenarios such as drones, automated weapon systems, and intelligent monitoring equipment. These systems are critical to the automatic recognition and decision-making capabilities of targets. However, attackers can use adversarial techniques to interfere with these systems. By generating adversarial samples, attackers can cause intelligent systems to make recognition errors or other operational errors without being visually noticeable, thereby interfering with or paralyzing the intelligent systems. Application scenarios of this technology include navigation systems for autonomous drones, target recognition systems on the battlefield, and target locking systems for high-precision missiles.

[0004] In the process of generating adversarial samples, researchers have proposed a variety of methods to increase the effectiveness and concealment of adversarial samples. Traditional adversarial sample generation methods are usually based on gradient attack techniques, such as the fast gradient sign method (FGSM) and iterative optimization technique (PGD), which generate adversarial samples with high attack capabilities by calculating the gradient of the loss function. However, these methods have certain limitations in generating adversarial samples with natural visual effects, which often make the samples appear visually abnormal and easy to be detected and identified.

[0005] To overcome these problems, researchers have explored more natural adversarial sample generation methods. These methods not only need to maintain the attack effect of the adversarial sample, but also need to ensure its visual naturalness to avoid being recognized by the defense mechanism or manual review of the target system. In recent years, adversarial sample generation methods based on generative adversarial networks (GANs) and diffusion models have become a research hotspot. These methods can generate adversarial samples with natural visual effects by simulating the generation process of images. The core of these technologies is that through complex generation models and training mechanisms, the generated adversarial samples can not only effectively attack the target system, but also be highly similar to real samples visually, thereby increasing the concealment and practicality of adversarial attacks.

[0006] In military anti-intelligence scenarios, generating natural adversarial samples has important practical significance. First, these adversarial samples can interfere with the normal operation of intelligent systems without arousing suspicion. Second, the method of generating natural adversarial samples can be applied in various environments and conditions, providing stronger adaptability and robustness. For example, in a battlefield environment, intelligent recognition systems may encounter changes in different lighting, weather, and background conditions. Natural adversarial samples can effectively cope with these changes and ensure the continuity and stability of the attack effect.

[0007] In addition, in military applications, the use of adversarial technology to counter intelligent systems is not only to interfere with the opponent's system, but also to improve the robustness and security of one's own system. By researching and developing more natural adversarial sample generation methods, it can help military system developers identify and fix potential security vulnerabilities, thereby improving the system's defense capabilities. This forward-looking research can not only improve the performance of intelligent systems in actual combat, but also provide strong guarantees for the future development of military technology.

[0008] In short, with the widespread application of intelligent technology in the military field, the research and application of adversarial technology has also continued to deepen. The method of generating natural adversarial samples not only improves the effect of adversarial attacks, but also takes into account the visual naturalness and concealment of the samples, providing new ideas and technical support for applications in military anti-intelligence scenarios. Future research will further explore how to generate natural adversarial samples in more complex scenarios and evaluate their effectiveness and application potential in actual military environments. This will be a key step in promoting the security of military intelligent systems and an important direction in the development of intelligent adversarial technology. Summary of the invention

[0009] This paper proposes a method for generating natural adversarial patches (PNAP) based on prompt words. The core of the method is to use deep learning technology to generate adversarial patches that can be effectively applied in practical environments to interfere with the target detection function of modern intelligent monitoring and automatic recognition systems. This technology is particularly suitable for military and security fields that require high concealment and attack effects, and can effectively interfere with the operation of the target system without being detected by it.

[0010] Existing adversarial sample generation techniques mostly focus on deceiving neural networks by modifying the entire image. Although this method is effective in laboratory tests, it is often easily identified in practical applications and is not sufficiently concealed. In contrast, the present invention solves this problem by generating visually natural adversarial patches. The adversarial patches of the present invention are not only difficult to be identified by the naked eye, but also can maintain efficient interference capabilities in various complex practical environments.

[0011] The present invention adopts a new framework that integrates the most advanced latent diffusion model (LDM) technology and deep learning text-to-image generation technology. By inputting a specific prompt word, the PNAP system can generate adversarial patches that are semantically associated with the prompt word and have a high degree of natural concealment. The key to this method is that it allows users to directly control the content of the generated patch through simple text descriptions, greatly increasing the flexibility of the operation and the practicality of the patch.

[0012] In terms of technical implementation, the PNAP system first processes the input prompt word through the CLIP text encoder and converts it into text embedding; then, these embeddings guide the conditioned U-Net to generate relevant potential noise, which forms specific image patches through the sampling process. During the generation process, the system fine-tunes the patch by optimizing a designed loss function to make it more visually natural and effectively interfere with the target detection system.

[0013] The embedding process of adversarial patches also takes into account the needs of practical applications. Through a specially designed patch transformation function, the patch undergoes a series of transformations before being embedded into the original image, including rotation, scaling, brightness adjustment, etc., to ensure that the patch can maintain its interference effect in various environments. Finally, these processed patches are synthesized with the original image through a mask matrix to generate the final adversarial sample.

[0014] The design of the loss function is another innovative point of the present invention. This loss function not only considers the attack effect of the patch, but also takes into account its printing and display robustness in the real world. Specifically, the function includes target loss, non-printing space loss and total change loss, which jointly optimize the generated patch to ensure its effectiveness and concealment in the actual environment.

[0015] Through the above technical solutions, the present invention can significantly improve the naturalness and concealment of the adversarial patch while ensuring the anti-attack effect, making it more suitable for use in security-sensitive and intensively monitored environments. This innovation not only promotes the practical development of adversarial sample technology, but also provides new ideas and tools for the field of security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments;

[0017] Figure 1 It is the overall training flow chart of PNAP adversarial patch of the present invention; DETAILED DESCRIPTION

[0018] This paper proposes a natural adversarial patch generation method (PNAP) based on prompt words, which aims to effectively interfere with intelligent monitoring systems without being discovered by target detection systems through deep learning technology. This method is particularly suitable for use in military and security fields that require high concealment and effective interference capabilities.

[0019] First, the latent variable z is randomly initialized from the normal distribution, and then the pre-trained LDM is used to perform patch sampling (PS) to generate an adversarial patch P with a specified prompt word description k. Secondly, the patch P that passes the patch transformation function (PT) is embedded into the clean sample X to obtain the adversarial sample X'. Then the adversarial sample X' is used to attack the target detector D to calculate the loss function By minimizing the loss function To optimize the latent variable z. Repeat the above steps to get the best adversarial patch P * .

[0020]

[0021] (1) Patch Sampling: Patch Sampling (PS) uses the pre-trained LDM to generate adversarial patches P with a specified cue word description k. PS is defined as follows:

[0022] P=PS(z,k,N)

[0023] Where z is a random value sampled from a normal distribution, and N is the number of LDM samples. The higher N is, the higher the quality of the generated image will be, but the speed of generating patches will be slower. The pre-trained LDM usually consists of the following parts: Clip Text Encoderε for prompt word encoding, Conditional U-Net∈ θ Noise, Sampler for predicting latent variables Used for denoising latent variables, VAE Decoder Used to decode latent variables into images. The process of PS is shown in Algorithm 2.

[0024]

[0025] (2) Patch embedding: The transformed adversarial patch P is embedded into the original sample X in the dataset to obtain the adversarial sample X' which can be defined as follows:

[0026] X′=(1-M P )⊙X+M P ⊙PT(P)

[0027] Among them, ⊙ and M P Denote the Hadamard product and the mask matrix respectively, the mask matrix M PIt is used to constrain the size, shape and position of the adversarial patch. Its value is 1 in the area where the patch is located, otherwise it is 0. PT(·) is a set of patch transformation functions. In order to simulate the geometric space transformation and color space transformation of the patch P in the real world, various transformation functions are applied to the patch during training to enhance its robustness in the real world. PT(·) contains the following transformations:

[0028] ●Apply random rotation to patch P with a rotation angle range of ±20°.

[0029] ●Apply random brightness adjustment to patch P, with a brightness adjustment range of ±0.1.

[0030] ●Apply random contrast adjustment to patch P with a contrast adjustment range of ±0.2.

[0031] ●Add random noise to patch P, and the value of each pixel changes within the range of ±0.1.

[0032] • Apply scaling to patch P, with a scaling size of 20% of the target area.

[0033] ●Apply an offset to patch P, the offset is ±20% of the target width and height.

[0034] (3) Patch offset: For objects of different sizes, embedding adversarial patches of appropriate sizes and performing appropriate offsets can improve patch robustness. For any object detection box d, assuming its width and height are (w d ,h d ), the detection box coordinates are (x1, y1, x2, y2), and the patch P embedded in the target d The center coordinates of It can be expressed as

[0035]

[0036] The offset (x offset ,y offset ) is expressed as follows:

[0037] (x offset ,y offset )=U(-0.2,0.2)·(w d ,h d )

[0038] Where U represents uniform distribution. Considering objects of different sizes, the size of the patch P The size of the detection box d (w d ,h d ) Maintain a suitable ratio r d :

[0039]

[0040] The scaled patch size can be expressed as:

[0041]

[0042] (4) Loss calculation:

[0043] By minimizing the loss function To optimize the latent variable z, thus guiding LDM to generate high-quality adversarial patches, The loss function is defined as follows:

[0044]

[0045] It consists of three parts, among which the target loss Used to optimize attack effects, non-printing space loss Used to ensure the robustness of the patch after printing, the total differential loss Used to enhance the smoothness of the patch. λ1 and λ2 represent and The weight of the loss function is as follows:

[0046] (1) Target loss The prediction results after NMS can be expressed as a set R = {(b i ,o i ,c i )|i=1,2,…,N}, where b is the coordinate of the detection box, o is the target confidence, c represents the confidence of each category, and N is the number of detected targets. It is defined as the average of the target confidence o of all N detection results, which is defined as follows:

[0047]

[0048] Our goal is to make the detector undetectable for objects with adversarial patches, so Only the target confidence is considered, without considering whether the detection box is classified correctly.

[0049] (2) Non-printing space loss Since when printing adversarial patches, mapping digital colors to physical colors often leads to distortion, thus reducing the effect of patch attacks, the introduction of this loss can enhance the robustness of adversarial patches in the real world. This loss function is used to calculate the distance between colors in the digital world and the physical world, and is defined as follows:

[0050]

[0051] where p i,jRepresents the pixel value of the corresponding position of the adversarial patch, c is a color in the printable color set C, and by optimizing this loss, the color of the generated adversarial patch can be made more printable.

[0052] (3) Total differential loss Since the differences between neighboring pixels are difficult to be recaptured by image acquisition devices, adversarial patches that perform well in the digital world may not be equally effective in the real world. By introducing this loss function, the pixels between the generated adversarial patches can be made smoother, which is defined as follows:

[0053]

[0054] Optimizing this loss function can reduce the differences between adjacent pixels of the patch, making the image smoother.

[0055] Specific implementation method of the present invention: First, select the detector to be attacked, and select the category to be attacked from the detection categories it supports. Collect a data set containing targets of this category, and divide the data set according to the ratio of training set: verification set: test set = 7:1:2. Use the detector to detect the data set to obtain the detection result, and obtain the embedded position information of the patch according to the detection result. Then input the text prompt, such as "vegetation camouflage", and convert these prompts into text embeddings through the CLIP text encoder. These embeddings subsequently guide the conditional U-Net to generate relevant potential noise, which is converted into a specific image patch through the VAE decoder after multiple iterations of fine adjustment. After embedding the image patch transformed by the result into the original image according to the original detection result to obtain the adversarial sample, the adversarial sample is sent to the detector again for detection to obtain the detection result. Calculate the loss function based on the detection box information related to the attack category in the detection result and back-propagate to optimize the potential noise of the LDM. Repeat the iteration to obtain a suitable adversarial patch.

[0056] The generated adversarial patches can be printed for deployment in real-world environments, such as on the roof of a car. When a smart drone with a detector takes a bird's-eye view and detects the vehicle, the vehicle with the adversarial patch on the roof can go undetected. This is of great significance for military missions.

[0057] In summary, the present invention is not only technically innovative, but also demonstrates extremely high value in practical applications. By precisely controlling each step in the generation process, efficient generation and efficient interference of adversarial patches are ensured, providing a new technical means for the confrontation of intelligent monitoring systems. This not only helps to improve the level of security defense, but also provides possibilities for wider application areas in the future, such as autonomous driving, public safety and military fields. Through these measures, the present invention achieves the goal of effectively interfering with intelligent systems in complex practical environments, and provides valuable research results and practical technologies for related technical fields.

Claims

1. A framework for generating adversarial patches (PNAP generation framework), characterized by: The goal of this framework is to generate an adversarial patch with effective attack capability, sufficient robustness and visual naturalness, and allow the use of arbitrary prompt words to constrain the content of the adversarial patch to ensure the visual naturalness and scene naturalness of the adversarial patch. During the entire PNAP generation process, the parameters of the latent diffusion model LDM and the target detector D are not updated to ensure the generalization and attack migration of the adversarial patch. The PNAP generation framework includes the following steps: (1) The latent variable z is randomly initialized from a normal distribution and the pre-trained LDM is used for patch sampling (PS) to generate an adversarial patch P with a specified cue word description k. (2) The patch P passed through the patch transformation function (PT) is embedded into the clean sample X to obtain the adversarial sample X'. (3) Use adversarial sample X' to attack the target detector D and calculate the loss function And by minimizing the loss function To optimize the latent variable z. (4) Repeat the above steps to obtain the best adversarial patch P * .

2. The PNAP generation framework according to claim 1, characterized in that: Patch Sampling (PS) utilizes the pre-trained LDM to generate adversarial patches P with a specified cue word description k, where PS is defined as follows: P=PS(z,k,N) Where z is a random value sampled from a normal distribution, and N is the number of LDM samples. The higher N is, the higher the quality of the generated image will be, but the speed of generating patches will be slower. The pre-trained LDM usually consists of the following parts: Clip Text Encoderε for cue word encoding, Con nditional U-Net∈ θ Noise, Sampler for predicting latent variables Used for latent variable denoising, VAE Decoder Used to decode latent variables into images.

3. The PNAP generation framework according to claim 1, characterized in that: The process of embedding the adversarial patch P into the original sample X in the dataset to obtain the adversarial sample X' is defined as follows: X′=(1-M P )⊙X+M P ⊙PT(P) Among them, ⊙ and M P Denote the Hadamard product and the mask matrix respectively, the mask matrix M P It is used to constrain the size, shape and position of the adversarial patch. Its value is 1 in the area where the patch is located, otherwise it is 0. PT(·) is a set of patch transformation functions. In order to simulate the geometric space transformation and color space transformation of the patch P in the real world, various transformation functions are applied to the patch during training to enhance its robustness in the real world. PT(·) contains the following transformations: Apply a random rotation to the patch P with a rotation angle range of ±20°. Apply random brightness adjustment to patch P, with a brightness adjustment range of ±0.

1. Apply random contrast adjustment to patch P with a contrast adjustment range of ±0.

2. Add random noise to the patch P, changing the value of each pixel by ±0.

1. Apply scaling to patch P, with a scaling size of 20% of the target area. Apply an offset to patch P by ±20% of the target width and height.

4. The PNAP generation framework according to claim 1, characterized in that: For objects of different sizes, adversarial patches of appropriate sizes are embedded and offset appropriately to improve the robustness of the patches. For any object detection box d, its width and height are (w d ,h d ), the detection box coordinates are (x1, y1, x2, y2), and the patch P embedded in the target d The center coordinates of It can be expressed as: The offset (x offset ,y offset ) is expressed as: (x offset ,y offset )=U(-0.2,0.2)·(w d ,h d ) Where U represents uniform distribution. Considering objects of different sizes, the size of the patch P The size of the detection box d (w d ,h d ) Maintain the appropriate ratio r d : The scaled patch size can be expressed as:

5. The PNAP generation framework according to claim 1, characterized in that: The loss function is designed to find the best adversarial patch P that has good attack effect and is natural * The optimization problem is defined as: in, is defined as follows: in, It consists of three parts: target loss Used to optimize attack effects, non-printing space loss Used to ensure the robustness of the patch after printing, the total differential loss Used to enhance the smoothness of the patch. λ1 and λ2 represent and The loss function is as follows: (1) Target loss The prediction results after NMS can be expressed as a set R = {(b i ,o i ,c i )|i=1,2,…,N}, where b is the coordinate of the detection box, o is the target confidence, c represents the confidence of each category, and N is the number of detected targets. It is defined as the average of the target confidence o of all N detection results: The goal is to make the detector unable to detect the object with the adversarial patch, so Only the target confidence is considered, without considering the classification correctness of the detection box. (2) Non-printing space loss This loss function is used to calculate the distance between colors in the digital world and the physical world to enhance the robustness of adversarial patches in the real world. It is defined as follows: where p i,j represents the pixel value at the corresponding position of the adversarial patch, and c is a color in the printable color set C. By optimizing the loss function, the color of the generated adversarial patch is more inclined to printable colors. (3) Total differential loss This loss function is used to reduce the difference between adjacent pixels of the patch, making the image smoother. It is defined as follows: By minimizing this loss function, smoother patches can be obtained.

Images