Intelligent camouflage detection method for remote sensing image target
By combining the particle swarm algorithm and projection gradient descent method in the intelligent detection algorithm to perturb the image to form a fraud sample, the problem of the vulnerability of the intelligent detection algorithm in the prior art detection in complex environments is solved, and the success rate and robustness of the fraud are achieved.
Patent Information
- Application Number
- CN202411781450.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-05
- Publication Date
- 2025-04-18
AI Technical Summary
Existing intelligent detection algorithms are vulnerable to intelligent detection of multiple types and multi-scale targets in complex environments, and it is difficult to accurately detect perturbed targets in terms of physical characteristics, apparent differences, geometric changes and topological deformation.
The combination of noise addition based on particle swarm algorithm and random patches based on projection gradient descent is used to perturb the original image and form a fooling sample, thereby improving the fooling success rate of the intelligent detection algorithm.
It improves the success rate of the intelligent detection algorithm, is highly aggressive and robust, and can detect targets more accurately in complex environments.
Smart Images
Figure CN119851057A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of image counterattack, and in particular relates to a remote sensing image target intelligent detection deception method. Background Art
[0002] Image adversarial attacks refer to samples obtained by adding some subtle noise (perturbation) to the samples in an originally clean image dataset in some way or following some rules. The target of these samples is the detection system. When they are used as input to the detection system, they can cause it to obtain incorrect recognition results.
[0003] With the rapid development of remote sensing imaging technology, the amount of image data has increased dramatically, and the model that relies on manual image analysis has become insufficient in terms of efficiency and capabilities. Many foreign commercial satellite companies have provided data analysis services, which use intelligent recognition network models to detect and classify various use case objects from raw images, minimizing the need for manual image analysis and the time spent on analysis.
[0004] Machine learning represented by deep neural networks has continuously made new breakthroughs in various complex tasks, and has reached or exceeded the level of manual analysis in many applications. Intelligent multimodal (visible light / infrared) remote sensing image detection systems based on deep learning models have gradually been widely used in aerospace technology applications, human-computer interaction systems, automatic image recognition of unmanned platforms, and other scenarios.
[0005] Existing intelligent detection algorithms are mainly based on the powerful expressive ability of deep networks. By learning from large amounts of data, they can provide a comprehensive and high-precision description of targets from multiple angles, dimensions, and granularities, and have high target recognition accuracy. However, the algorithms are vulnerable to intelligent detection of multiple types and multi-scale targets in complex environments, and it is difficult to accurately detect targets that have been perturbed in terms of physical properties, appearance differences, geometric changes, and topological deformations. Summary of the invention
[0006] The technical problem solved by the present invention is: to overcome the deficiencies of the prior art and provide a remote sensing image target intelligent detection deception method, which has a higher success rate of deceiving the intelligent detection algorithm and has strong aggressiveness and robustness.
[0007] The object of the present invention is achieved through the following technical solutions: a remote sensing image target intelligent detection deception method, comprising: adding a perturbation based on a particle swarm algorithm to the original image to form a first sample to be fused; adding a random patch based on projected gradient descent to the original image to form a second sample to be fused; fusing the first sample to be fused and the second sample to be fused to form a deception sample.
[0008] The above remote sensing image target intelligent detection deception method also includes: using deception samples to deception the detector to obtain a deception result.
[0009] In the above remote sensing image target intelligent detection deception method, adding disturbances based on the particle swarm algorithm to the original image includes the following steps: Step S11: adding preset disturbances to the original image to generate candidate deception samples; Step S12: initializing the individual optimal position and the global optimal position of each particle; Step S13: judging whether the particle meets the end condition, if not, continue to execute step S14, if it does, execute step S15; Step S14: updating the speed and position of the particle, and returning to step S13 to evaluate whether the particle meets the end condition; Step S15: outputting the candidate deception sample.
[0010] In the above-mentioned remote sensing image target intelligent detection deception method, adding random patches based on projected gradient descent to the original image includes the following steps: Step S21: Adding random small perturbations to the original image within a limited range to form an adversarial sample, and limiting the perturbation range, and setting the number of iterations T; Step S22: Calculating the gradient of the current adversarial sample; Step S23: Applying perturbations along the sign direction of the gradient; Step S24: Ensure that the generated adversarial sample is always within the perturbation range through projection operations; Step S25: Repeat steps S22 to S24 until the set number of iterations T is reached.
[0011] In the above remote sensing image target intelligent detection deception method, the deception result includes missed detection rate, false detection rate and confidence level.
[0012] A remote sensing image target intelligent detection deception system includes: a first module, used to add a perturbation based on a particle swarm algorithm to an original image to form a first sample to be fused; a second module, used to add a random patch based on projected gradient descent to the original image to form a second sample to be fused; a third module, used to fuse the first sample to be fused and the second sample to be fused to form a deception sample.
[0013] The above remote sensing image target intelligent detection deception system also includes: a fourth module, which is used to use the deception sample to deceive the detector to obtain a deception result.
[0014] In the above-mentioned remote sensing image target intelligent detection deception system, adding disturbances based on the particle swarm algorithm to the original image includes the following steps: Step S11: adding preset disturbances to the original image to generate candidate deception samples; Step S12: initializing the individual optimal position and the global optimal position of each particle; Step S13: judging whether the particle meets the end condition, if not, continue to execute step S14, if it does, execute step S15; Step S14: updating the speed and position of the particle, and returning to step S13 to evaluate whether the particle meets the end condition; Step S15: outputting the candidate deception sample.
[0015] In the above-mentioned remote sensing image target intelligent detection deception system, adding random patches based on projected gradient descent to the original image includes the following steps: Step S21: adding random small perturbations to the original image within a limited range to form an adversarial sample, and limiting the perturbation range, and setting the number of iterations T; Step S22: calculating the gradient of the current adversarial sample; Step S23: applying perturbations along the sign direction of the gradient; Step S24: ensuring that the generated adversarial sample is always within the perturbation range through projection operations; Step S25: repeating steps S22 to S24 until the set number of iterations T is reached.
[0016] In the above remote sensing image target intelligent detection deception system, the deception result includes missed detection rate, false detection rate and confidence level.
[0017] Compared with the prior art, the present invention has the following beneficial effects:
[0018] (1) The present invention combines noise addition with random patches of different sizes, which can also cause deception to models that have certain defense mechanisms against adversarial attacks;
[0019] (2) The present invention has a higher success rate in deceiving intelligent detection algorithms and is highly aggressive and robust. BRIEF DESCRIPTION OF THE DRAWINGS
[0020] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:
[0021] Figure 1 is a flow chart of a noise adding method based on a particle swarm algorithm provided in an embodiment of the present invention;
[0022] Figure 2 is a flow chart of a random patch method based on projected gradient descent provided by an embodiment of the present invention;
[0023] Figure 3 It is a flow chart of a remote sensing image target intelligent detection deception method provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0024] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to be able to fully convey the scope of the present disclosure to those skilled in the art. It should be noted that, in the absence of conflict, the embodiments of the present invention and the features described in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0025] Existing intelligent detection algorithms have made significant progress in the field of remote sensing images by learning from a large amount of data, and have been applied to tasks such as high-resolution target detection in remote sensing images, multi-scale target detection, detection in complex scenes, and real-time detection. In addition, many models have certain defense mechanisms against common adversarial attacks, especially through adversarial training to enhance the robustness of the model to noise or local patches. However, the attack method that combines the two will make the defense mechanism more difficult to deal with, because the defense of the model at different levels often focuses on a single type of perturbation. This embodiment, for a single-stage target detector and a two-stage target detector, uses an attack method that combines a noise addition method based on a particle swarm algorithm and a random patch method based on projected gradient descent to interfere with the generation and classification of candidate frames by the detection algorithm. This embodiment proposes an effective remote sensing image target intelligent detection deception strategy for remote sensing image intelligent detection of deep learning network models.
[0026] Figure 3 FIG. 1 is a flow chart of a remote sensing image target intelligent detection method for deception provided by an embodiment of the present invention. Figure 3 As shown, the method includes:
[0027] Add the perturbation based on the particle swarm algorithm to the original image to form the first sample to be fused;
[0028] Add random patches based on projected gradient descent to the original image to form the second sample to be fused;
[0029] The first sample to be fused and the second sample to be fused are fused to form a deception sample.
[0030] The method further includes: using the deception sample to deceive the detector to obtain a deceiving result, wherein the deceiving result includes a missed detection rate, a false detection rate and a confidence level.
[0031] like Figure 1 As shown in Figure 2, adding perturbations based on the particle swarm algorithm to the original image includes the following steps:
[0032] Step S11: adding a preset disturbance to the original image to generate a candidate deception sample;
[0033] Step S12: Initialize the individual optimal position and the global optimal position of each particle;
[0034] Step S13: Determine whether the particle meets the end condition, if not, proceed to step S14, if it does, proceed to step S15;
[0035] Step S14: Update the speed and position of the particle, and return to step S13 to evaluate whether the particle meets the end condition;
[0036] Step S15: Output candidate deception samples.
[0037] In step S12, each particle in the particle swarm algorithm has two attributes: position and speed. The position represents the specific value of the disturbance (the disturbance to the image pixels), and the speed represents the direction and amplitude of the movement of the particle in the search space. During initialization, each particle will randomly generate an initial position (the initial value of the disturbance to the image pixels), and then set an initial speed for each particle. The individual optimal position refers to the best position found by the particle during its search process, and the global optimal position is the optimal disturbance position found among all particles (that is, the best disturbance sample generated).
[0038] This embodiment aims at single-stage and two-stage detector deception recognition, and interferes with the detection algorithm in a noise adding manner. The goal is to find a disturbance that maximizes the misclassification rate of the target detection algorithm while maintaining the original appearance of the image as much as possible.
[0039] This embodiment uses a particle swarm algorithm to find the disturbance that optimizes the objective function (anti-attack effect) by simulating the search behavior of a particle swarm in space. The steps are as follows:
[0040] 1) Initialize a group of particles, the position x of each particle i Corresponding to a disturbance value on the image; the initial position of the particle is randomly generated in the range of [-ε,ε], the speed is set to 0, and the individual optimal position p of each particle is initialized i and the global optimal position g;
[0041] 2) Define the objective function as shown in formula (1):
[0042] f(ΔI)=α·MisRate(I+ΔI)-β·||ΔI|| (1)
[0043] Where I represents the original image, ΔI represents the optimal adversarial perturbation, MisRate(I+ΔI) is the misclassification rate of the perturbed image, ||ΔI|| represents the magnitude of the perturbation, measured by the L2 norm, and α and β are weight parameters;
[0044] 3) Use the standard formula of the particle swarm algorithm to update the particle velocity according to formula (2) and the particle position according to formula (3):
[0045] v i (t+1)=w·v i (t)+c1·r1·(p i -x i )+c2·r2·(gx i ) (2)
[0046] v i is the velocity of particle i, w is the inertia weight, which is used to control the movement of the particle, c1 and c2 are learning factors, which control the particle to move toward the individual optimal p i and the global optimal g direction acceleration, r1 and r2 are random factors;
[0047] x i (t+1)=x i (t)+v i (t+1) (3)
[0048] 4) Repeat the iteration step 3) until the misclassification rate reaches the expected value or the maximum number of iterations is reached.
[0049] like Figure 1 As shown in Figure 1, adding random patches based on projected gradient descent to the original image includes the following steps:
[0050] Step S21: Adding a random small perturbation to the original image within a limited range to form an adversarial sample, and limiting the perturbation range and setting the number of iterations T;
[0051] Step S22: Calculate the gradient of the current adversarial sample;
[0052] Step S23: applying disturbance along the sign direction of the gradient;
[0053] Step S24: Ensure that the generated adversarial sample is always within the perturbation range through projection operation;
[0054] Step S25: Repeat steps S22 to S24 until a set number of iterations T is reached.
[0055] This embodiment targets a single-stage target detector and a two-stage target detector, and uses an attack method combining noise addition and random patching to interfere with the generation and classification of candidate boxes by the detection algorithm.
[0056] This embodiment uses a random patch attack detection algorithm and a projected gradient descent algorithm to generate patches of different sizes.
[0057] This embodiment uses a combination of noise addition and random patching to interfere with the detection algorithm. The steps are as follows:
[0058] 1) Reasonably quantify the currently commonly used image transformations, such as Gaussian noise, contrast, brightness, filter, image rotation, etc., and combine with claim 2 to reasonably quantify the deception capability, usage restrictions, etc.;
[0059] 2) Generate a deception sample with a patch using claim 2;
[0060] 3) In combination with the image scene data that the target detector can obtain in the actual application scenario, the deception samples of 1) and 2) are fused to complete the generation of deception samples;
[0061] 4) Iteratively train single-stage and two-stage target detectors with different structures and versions to reduce the recognition rate of single-stage and two-stage target detectors until a certain deception accuracy is achieved.
[0062] This embodiment targets a single-stage target detector and a two-stage target detector, and mainly generates adversarial samples by combining random perturbations and patches of different sizes added to the input image, so that the single-stage target detector and the two-stage target detector may misdetect or miss targets. The random perturbation method based on the particle swarm algorithm is as follows.
[0063] like Figure 1 As shown, the implementation process is:
[0064] 1) First, add appropriate perturbations to the original image to generate candidate deception samples and define the iteration stop condition;
[0065] 2) Initialize the individual optimal position and global optimal position of each particle;
[0066] 3) Determine whether the particle meets the end condition. If not, continue to step 4). If it does, execute 5);
[0067] 4) Update the particle's velocity and position, and return to step 3) to evaluate whether the particle meets the end condition;
[0068] 5) Output candidate deception samples and end.
[0069] The random patch attack based on projected gradient descent can disrupt the detector's positioning of the target and ultimately achieve the effect of deceiving the detector.
[0070] like Figure 2 As shown, the implementation process is:
[0071] 1) Add a random small perturbation to the original sample within a limited range to form an adversarial sample, limit the perturbation range, and set the number of iterations T;
[0072] 2) Calculate the gradient of the current adversarial sample;
[0073] 3) Apply perturbations along the sign direction of the gradient;
[0074] 4) Ensure that the generated adversarial examples are always included through projection operations;
[0075] 5) Repeat steps 2) to 4) until the set number of iterations T is reached.
[0076] For single-stage and two-stage detectors, the present invention mainly generates adversarial samples by combining random perturbations and patches of different sizes in the input image, thereby interfering with the generation and classification of candidate boxes by the detection algorithm.
[0077] like Figure 3 As shown, the implementation process is:
[0078] 1) Original image by Figure 1 The implementation process adds disturbance based on particle swarm algorithm to form sample 1 to be fused;
[0079] 2) Original image by Figure 2 The implementation process adds random patches based on projected gradient descent to form sample 2 to be fused;
[0080] 3) Deception strategy generation: fusing sample 1 to be fused and sample 2 to be fused to form a deception sample;
[0081] 4) Use the original image samples to train the detector, use the deception samples in the inference stage and evaluate the deception results based on the missed detection rate, false detection rate and confidence level;
[0082] 5) Based on the evaluation results, the deception strategy can be optimized to further improve the performance of the agent.
[0083] Reasonably quantify the commonly used image transformations, such as Gaussian noise, contrast, brightness, filter, image rotation, etc., to reasonably quantify the deception ability, usage restrictions, etc.; use the generated deception samples with patches; combine the image scene data that can be obtained by the target detector in the actual application scenario, perform deception sample fusion, and complete the generation of deception samples; use single-stage and two-stage target detectors with different structures and versions for iterative training to reduce the recognition rate of single-stage and two-stage target detectors until a certain deception accuracy is achieved.
[0084] This embodiment also provides a remote sensing image target intelligent detection deception system, which includes: a first module, used to add a perturbation based on a particle swarm algorithm to the original image to form a first sample to be fused; a second module, used to add a random patch based on projected gradient descent to the original image to form a second sample to be fused; a third module, used to fuse the first sample to be fused and the second sample to be fused to form a deception sample. A fourth module, used to use the deception sample to deceive the detector to obtain a deception result.
[0085] This embodiment combines noise addition with random patches of different sizes, which can also cause interference to models with certain defense mechanisms against adversarial attacks; this embodiment has a higher success rate in confusing intelligent detection algorithms and has strong aggressiveness and robustness.
[0086] Although the present invention has been disclosed as above in the form of a preferred embodiment, it is not intended to limit the present invention. Any person skilled in the art may make possible changes and modifications to the technical solution of the present invention by using the methods and technical contents disclosed above without departing from the spirit and scope of the present invention. Therefore, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope of the technical solution of the present invention.
Claims
1. A remote sensing image target intelligent detection method, characterized in that include: Add the perturbation based on the particle swarm algorithm to the original image to form the first sample to be fused; Add random patches based on projected gradient descent to the original image to form the second sample to be fused; The first sample to be fused and the second sample to be fused are fused to form a deception sample.
2. The remote sensing image target intelligent detection deception method according to claim 1, characterized in that Also includes: The deception sample is used to deceive the detector to obtain the deceiving result.
3. The remote sensing image target intelligent detection deception method according to claim 1, characterized in that: Adding perturbations based on particle swarm algorithm to the original image includes the following steps: Step S11: adding a preset disturbance to the original image to generate a candidate deception sample; Step S12: Initialize the individual optimal position and the global optimal position of each particle; Step S13: Determine whether the particle meets the end condition, if not, proceed to step S14, if it does, proceed to step S15; Step S14: Update the speed and position of the particle, and return to step S13 to evaluate whether the particle meets the end condition; Step S15: Output candidate deception samples.
4. The remote sensing image target intelligent detection deception method according to claim 1, characterized in that: Adding random patches based on projected gradient descent to the original image consists of the following steps: Step S21: Adding a random small perturbation to the original image within a limited range to form an adversarial sample, and limiting the perturbation range and setting the number of iterations T; Step S22: Calculate the gradient of the current adversarial sample; Step S23: applying disturbance along the sign direction of the gradient; Step S24: Ensure that the generated adversarial sample is always within the perturbation range through projection operation; Step S25: Repeat steps S22 to S24 until a set number of iterations T is reached.
5. The remote sensing image target intelligent detection deception method according to claim 2, characterized in that: The deception result includes missed detection rate, false detection rate and confidence level.
6. A remote sensing image target intelligent detection deception system, characterized in that include: The first module is used to add a perturbation based on a particle swarm algorithm to the original image to form a first sample to be fused; The second module is used to add a random patch based on projected gradient descent to the original image to form a second sample to be fused; The third module is used to fuse the first sample to be fused and the second sample to be fused to form a deception sample.
7. The remote sensing image target intelligent detection deception system according to claim 6, characterized in that Also includes: The fourth module is used to use the deception sample to deceive the detector to obtain the deceiving result.
8. The remote sensing image target intelligent detection deception system according to claim 6, characterized in that: Adding perturbations based on particle swarm algorithm to the original image includes the following steps: Step S11: adding a preset disturbance to the original image to generate a candidate deception sample; Step S12: Initialize the individual optimal position and the global optimal position of each particle; Step S13: Determine whether the particle meets the end condition, if not, proceed to step S14, if it does, proceed to step S15; Step S14: Update the speed and position of the particle, and return to step S13 to evaluate whether the particle meets the end condition; Step S15: Output candidate deception samples.
9. The remote sensing image target intelligent detection deception system according to claim 6, characterized in that: Adding random patches based on projected gradient descent to the original image consists of the following steps: Step S21: Adding a random small perturbation to the original image within a limited range to form an adversarial sample, and limiting the perturbation range and setting the number of iterations T; Step S22: Calculate the gradient of the current adversarial sample; Step S23: applying disturbance along the sign direction of the gradient; Step S24: Ensure that the generated adversarial sample is always within the perturbation range through projection operation; Step S25: Repeat steps S22 to S24 until a set number of iterations T is reached.
10. The remote sensing image target intelligent detection deception system according to claim 7, characterized in that: The deception result includes missed detection rate, false detection rate and confidence level.