Adversarial sample detection method for dangerous driving behavior detection recognition rate

Abstract

The invention discloses an adversarial sample detection method for a dangerous driving behavior detection recognition rate, relates to the field of adversarial sample detection, and is used for solving the problem that an established adversarial model neglects hidden features of a new image, so that classification errors of corresponding adversarial samples are retrieved, and the purity of the model and the accuracy of classification of the new image are reduced. Acquiring continuous characteristic information of a new image and mapping information of the adversarial model, performing normalization processing, substituting the information into a logistic regression model to determine a noise coefficient of the new image, comparing the noise coefficient with a preset noise threshold, performing statistics on a comparison result, performing statistical calculation on the noise coefficients of the new image of different labels, determining a new image result, and outputting the new image result. And substituting the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum value of the similarity difference between the new image and the feature vectors of other continuously shot images into the fuzzy Bayesian neural network to determine the type of the adversarial sample to which the new image belongs, thereby improving the accuracy of image feature extraction and adversarial detection.

Description

Technical Field

[0001] The present invention relates to the field of adversarial sample detection, and more specifically, to an adversarial sample detection method for improving the recognition rate of dangerous driving behavior detection. Background Art

[0002] In intelligent transportation systems, dangerous driving behavior detection is a key technology that uses deep learning models to identify behavior through video surveillance, sensor data, etc. Among them, adversarial samples are generated by adding fine-tuned perturbations to the original data. These perturbations are usually invisible to the naked eye, but are enough to make machine learning models make wrong decisions. Due to the vulnerability of deep learning models in the face of these adversarial samples, it will significantly affect the life and health of drivers.

[0003] The prior art has the following deficiencies:

[0004] At present, after a relatively complete adversarial model has been trained, with the increase of new images taken again at different times in actual applications, the adversarial model retrieves the corresponding adversarial samples based on features such as similarity. However, although this method is relatively fast, it is easy to ignore the hidden features of the new image, resulting in misclassification of the retrieved adversarial samples, reducing the purity of the model and the accuracy of new image classification. Therefore, an adversarial sample detection method for the recognition rate of dangerous driving behavior detection is proposed.

[0005] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not constitute the prior art that is already known to one of ordinary skill in the art. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides an adversarial sample detection method for the recognition rate of dangerous driving behavior detection, which solves the problems raised in the above-mentioned background technology by using different product inspection methods.

[0007] To achieve the above object, the present invention provides the following technical solution: an adversarial sample detection method for the recognition rate of dangerous driving behavior detection, comprising S1: collecting continuous feature information of a new image and adversarial model mapping information, and preprocessing the new image and the adversarial model mapping, and obtaining the similarity of all features of the new image and the average similarity between the adversarial model mapping relationship and the new image features through data processing;

[0008] S2: Obtain the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image, perform normalization, and determine the noise coefficient of the new image by establishing a logistic regression model;

[0009] S3: Obtain the noise coefficient of the new image, and compare it with the preset noise threshold, generate comparison results covering different labels, count the comparison results and perform statistical calculations on the noise coefficients of the new images with different labels, and compare it with the preset sample threshold to determine the new image result;

[0010] S4: According to the new image results, the similarities between the new images are arranged in order, and the feature vectors of the remaining continuously shot images with the largest difference from the feature vector of the new image and the feature vectors of the corresponding adversarial samples are selected to obtain the minimum distance between the new image and the feature vectors of the adversarial samples and the maximum value of the similarity difference between the feature vectors of the new image and other continuously shot images;

[0011] S5: Based on the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the new image and the feature vectors of other continuously shot images, a fuzzy Bayesian neural network is used to determine the type of adversarial sample to which the new image belongs.

[0012] In a preferred embodiment, the feature vector is extracted from each image through the original images taken continuously, and the feature vectors of the new image are calculated for similarity with the feature vectors of other continuously taken images. Then, a feature similarity matrix is ​​constructed, and the average value of the elements in the matrix is ​​taken to obtain the feature similarity of all the new images As. i ; i is the i-th other continuously captured image;

[0013] Extract feature vectors for each adversarial sample, calculate the similarity between the feature vectors of the continuously captured new images and the overall known adversarial sample feature distribution, and obtain the average value to obtain the average similarity Ds between the mapping relationship of the adversarial model and the new image features. i .

[0014] In a preferred embodiment, the similarities of all features of the new image and the average similarities of the mapping relationship of the adversarial model and the features of the new image are normalized;

[0015] Substitute the similarity of all features of the new image and the mapping relationship of the adversarial model with the average similarity of the new image features into the logistic regression calculation. The specific formula is expressed as follows:

[0016]

[0017] Where, L i is the result of logistic regression calculation, that is, the new image noise coefficient, e is the natural base, and y is the linear combination term of the logistic regression model. Specifically, y can be set as:

[0018] y=β0+β1·As i +β2·Ds i ;

[0019] Where β0 is the bias term, β1 and β2 are the regression coefficients of the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image.

[0020] In a preferred embodiment, the new image noise coefficient L is obtained i Finally, the new image noise coefficient is compared and analyzed with the continuously iterated noise threshold;

[0021] If the noise coefficient of the new image is greater than or equal to the noise threshold, the new image currently captured is marked as a similar adversarial sample and a similar signal is generated;

[0022] If the noise coefficient of the new image is less than the noise threshold, the new image currently captured is marked as a correct sample and an end signal is generated.

[0023] In a preferred embodiment, after multiple rounds of calculations, that is, after the nth calculation is completed, a plurality of comparison results are obtained in which the noise coefficients of the new images are greater than or equal to the noise threshold, and then a plurality of new images marked as similar adversarial samples are extracted, and are similar to the adversarial samples in the adversarial model;

[0024] Count the new images marked as similar adversarial samples and obtain the corresponding new image noise coefficients for addition calculation, and calculate the ratio with the total number of new images marked as similar adversarial samples to obtain the similarity sample degree of the new images marked as similar adversarial samples, and compare them with the sample threshold, and mark the new images marked as similar adversarial samples that are greater than or equal to the sample threshold as adversarial samples.

[0025] In a preferred embodiment, by extracting the feature vector of the new image, calculating the distance between the feature vector and each vector in the feature vector set of each type of adversarial sample in the adversarial model, for each type of adversarial sample, selecting the minimum distance value with the feature vector of the new image, and obtaining the minimum distance between the new image and the feature vector of each type of adversarial sample;

[0026] After calculating the similarity between the new images, for each image, the similarity difference between the feature vector and the feature vectors of other images is calculated, and the largest value is selected as the maximum similarity difference between the feature vectors of the new image and other continuous images.

[0027] In a preferred embodiment, a fuzzy Bayesian neural network is used to determine the type of adversarial sample to which a new image belongs, the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum value of the similarity difference between the new image and the feature vectors of other continuously shot images are defined as input nodes in the input layer, and the type of adversarial sample to which the new image belongs is defined as the output layer;

[0028] Formulate a fuzzy Bayesian neural network to describe the impact of the minimum distance between a new image and the feature vectors of various adversarial samples and the maximum similarity difference between the feature vectors of the new image and other consecutively captured images on the type of adversarial sample to which the new image belongs;

[0029] According to the fuzzy Bayesian neural network, the type of adversarial sample to which the new image belongs is determined by the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the new image and the feature vectors of other continuously shot images.

[0030] Technical effects and advantages of the present invention:

[0031] 1. The present invention collects continuous characteristic information of the new image and the mapping information of the adversarial model, obtains the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image through data processing, performs normalization processing, substitutes it into the logistic regression model to determine the noise coefficient of the new image, and compares it with the preset noise threshold to generate comparison results covering different labels, statistically compares the comparison results and performs statistical calculation of the noise coefficients of the new images with different labels, and compares them with the preset sample threshold to determine the new image results, thereby improving the accuracy of image feature extraction and adversarial detection, enhancing the sensitivity of noise detection, and improving data processing efficiency.

[0032] 2. The present invention arranges the similarities between new images in order according to the new image results, selects the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the new image and the feature vectors of other continuously shot images, substitutes them into the fuzzy Bayesian neural network, and trains the hidden layer using the gradient descent method through the input layer and the output layer, and continuously iterates, so that the type of adversarial sample to which the new image belongs is more accurate, the classification accuracy of the new image is improved, the high-dimensional complex data in the deep learning model is processed, and the image classification efficiency is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a method flow chart of an adversarial sample detection method for improving the recognition rate of dangerous driving behavior detection in the present invention.

[0034] Figure 2 A schematic diagram of the steps of an adversarial sample detection method for improving the recognition rate of dangerous driving behavior detection in the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] Example 1

[0037] See also Figure 1 , an adversarial sample detection method for dangerous driving behavior detection recognition rate, the specific operation process is as follows:

[0038] S1: Collect the continuous feature information of the new image and the adversarial model mapping information, and pre-process the new image and the adversarial model mapping. Through data processing, obtain the similarity of all features of the new image and the average similarity between the adversarial model mapping relationship and the new image features;

[0039] Among them, the adversarial model mapping information refers to the mapping relationship of the adversarial model. The mapping relationship of the adversarial model is obtained by the model trained in advance by the experimenters. Specifically, the correct samples are determined by color attribute transformation, noise addition, ambient lighting addition, model gradient-based and perturbation simulating the actual driving environment (such as blur occlusion). Then, the generated adversarial samples are sent to the deep learning model, and the deep learning model is trained so that it can distinguish between adversarial samples and correct samples, and avoid mistaking adversarial samples for correct samples and correct samples for adversarial samples. Finally, based on the training results, an adversarial model is established so that the deep learning model can distinguish adversarial samples, thereby achieving adaptive judgment for images with different types of defects in practical applications.

[0040] Specifically, color attribute transformation is to adjust the color space of the image, using changes such as saturation, brightness, contrast, etc. to change the visual effect, and mark it as f(x1);

[0041] Adding noise means adding tiny noise (such as Gaussian noise, salt and pepper noise) to the image, causing the deep learning model to misjudge and mark it as f(x2);

[0042] Adding ambient lighting is to simulate the lighting changes in the actual driving environment, such as strong light, shadow, day and night changes, etc., which is usually achieved by adjusting the brightness or changing the position of the light source, and is marked as f(x3);

[0043] Based on the model gradient, the perturbation is generated by gradient back propagation technology, so that the image disturbs the prediction result of the model without changing the original content, which is marked as f(x4);

[0044] The disturbances simulating the actual driving environment are interference factors such as dirty camera lenses, rain, and haze, and the actual scene f(x5) is simulated by image blur, occlusion, or perspective transformation;

[0045] Each image has its own unique features, and the process of generating adversarial samples can be regarded as the mapping relationship between the input image and the output perturbation. Specifically, the correct image is used as the independent variable, and the adversarial sample is used as the dependent variable. Through training and optimization, the mapping relationship of the generated adversarial sample is the functional relationship between the image features and the perturbation.

[0046] The output of the model is not only the classification result of the image, but also the generation of adversarial perturbations, so that each image has its corresponding adversarial sample;

[0047] It should be noted that there are more than the above five methods for generating and detecting specific adversarial samples. The experimenters can also generate corresponding adversarial samples based on highly targeted scenario attacks. Since the adversarial sample detection method is an existing technology, it will not be described here.

[0048] The new image continuous characteristic information refers to the original image currently captured or newly acquired, that is, the image captured in actual application. Specifically, for the verifiability of the new image, several original images are captured quickly and continuously at the same time;

[0049] Among them, the image captured in actual application is a micro camera installed in front of the vehicle driving seat to capture the head state of the person sitting in the driving seat. The specific shooting time is not limited, and the number of original images captured is not limited either. Instead, it is set by the experimenter according to the number of driver's head movements or the perception frequency of the optical element set in the image, which will not be elaborated here;

[0050] Therefore, from the above, it can be seen that the total number of original images captured quickly and continuously at the same time is set to n;

[0051] The similarity of all features of new images refers to the calculation of the similarity between the features of multiple new images taken continuously (a group of dangerous driving behavior images taken quickly at the same time), that is, the similarity between the feature distribution of the new image and the feature distribution of the continuous images. The acquisition logic is to extract feature vectors from the original images taken continuously, calculate the similarity between the feature vectors of the new image and the feature vectors of other continuously taken images, construct a feature similarity matrix, and take the average value of the elements in the matrix to obtain the similarity of all features of the new image;

[0052] Specifically, deep learning models, such as convolutional neural networks and CNNs, are usually used to extract features of new images. In the process of extracting features of new images using deep learning models, features mainly refer to high-dimensional data representations extracted from images by deep learning algorithms. These features capture key information such as the structure, texture, and color distribution of the image.

[0053] Furthermore, by inputting these original images, the shallow convolutional layer extracts the basic visual information of the image, such as edge, texture, color, etc., and then the intermediate convolutional layer extracts more complex shape contours and local structures based on the features extracted by the shallow convolutional layer. Finally, the deep convolutional layer extracts the high-dimensional abstraction of the global information of the image, reflecting the object semantics, scene features (such as highways, night environments, etc.) and key point features (such as the driver's eye position, head orientation, etc.) of the image.

[0054] At the end of the convolutional neural network, the high-dimensional feature map is converted into a fixed-length feature vector through a fully connected layer. These feature vectors include the driver's head posture (such as looking up, looking down, turning the head), facial state (such as closing eyes, opening mouth), lighting conditions (such as strong light or shadow), and scene background information (such as whether the driver is in motion);

[0055] It should be noted that the selection of feature vectors and the number of feature vectors are set by the experimenters according to the output results of the convolutional neural network, and will not be elaborated here;

[0056] Specifically, the similarity between the feature vector of the new image and the feature vectors of other continuously shot images is calculated by using the Euclidean distance. The specific formula is as follows:

[0057]

[0058] Where F1 is the new image vector, F i is the other continuously shot image vector, i is the i-th other continuously shot image;

[0059] Construct a feature similarity matrix S, where the matrix elements S(F1,F i ), represents the similarity between the new image and the i-th image. By taking the average value of the elements of the matrix S, the similarity of all features of the new image is calculated. The specific formula is expressed as follows:

[0060]

[0061] In the formula, As i is the similarity of all features of the new image;

[0062] The average similarity between the mapping relationship of the adversarial model and the new image features refers to the average of the similarities between the feature vector of the new image and the feature vectors of all mapping relationships stored in the adversarial model. The acquisition logic is to extract the feature vector of each adversarial sample, calculate the similarity between the feature vectors of the continuously shot new images and the overall distribution of the known adversarial sample features, and obtain the average value to obtain the average similarity between the mapping relationship of the adversarial model and the new image features;

[0063] Specifically, the feature vector of the new image is similar to the feature vector of the adversarial model. The specific similarity calculation can be based on a similarity formula such as cosine similarity or Euclidean distance. Specifically, the total number of adversarial samples is set to m, and k is the kth adversarial model feature vector;

[0064] For each new image, the average similarity with all adversarial model features is calculated. Since the total number of new image features taken continuously is n, the average value of all images is taken and calculated to obtain the average similarity Bs between the adversarial model mapping relationship and the new image features. i ;

[0065] S2: Obtain the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image, perform normalization, and determine the noise coefficient of the new image by establishing a logistic regression model;

[0066] Normalize the similarity of all features of the new image and the mapping relationship of the adversarial model with the average similarity of the new image features. All input variables will be converted to the same range to ensure that the contribution of each input to the model is balanced. Specifically, the normalization method is to normalize the interval [0,1]. The specific formula is:

[0067]

[0068] In the formula, As i is the similarity of all features of the new image, As norm is the normalized similarity of all features of the new image, As min is the minimum value of all feature similarities of the new image, As max is the maximum value of all feature similarities of the new image;

[0069] Among them, the mapping relationship between the adversarial model and the average similarity of the new image features are also normalized using the above formula, which will not be elaborated here;

[0070] After normalization, the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image are all within the range of [0,1]. The system can make comparisons and decisions on a unified scale, thereby improving the accuracy and efficiency of the logistic regression model.

[0071] Substitute the similarity of all features of the new image and the mapping relationship of the adversarial model with the average similarity of the new image features into the logistic regression calculation. The specific formula is expressed as follows:

[0072]

[0073] Where, L i is the result of logistic regression calculation, that is, the new image noise coefficient, e is the natural base, and y is the linear combination term of the logistic regression model. Specifically, y can be set as:

[0074] y=β0+β1·As i +β2·Ds i ;

[0075] Where β0 is the bias term, β1 and β2 are the regression coefficients of the similarity of all features of the new image and the average similarity of the mapping relationship of the adversarial model and the new image features;

[0076] S3: Obtain the noise coefficient of the new image, and compare it with the preset noise threshold, generate comparison results covering different labels, count the comparison results and perform statistical calculations on the noise coefficients of the new images with different labels, and compare it with the preset sample threshold to determine the new image result;

[0077] The logic of obtaining the noise threshold is to collect historical adversarial samples and correct sample sets, divide the data set into training set and test set, set the evaluation index and clustering algorithm, train the model on the training set and evaluate the model performance on the test set in each round of cross-validation, and then adjust the noise threshold according to the performance of the validation set. Therefore, the noise threshold is constantly updated;

[0078] In the present invention, clustering algorithm is a kind of unsupervised learning algorithm, which is used to divide the adversarial samples in the data set into groups or clusters with similarities; a common one is K-means clustering, which divides the adversarial samples in the data set into K clusters, so that the distance between each adversarial sample and the center point (center of mass) of the cluster to which it belongs is minimized, and finally the similarity between the adversarial sample and the new image is measured by the Euclidean distance, so as to set the noise threshold;

[0079] Get the new image noise coefficient L i Finally, the new image noise coefficient is compared and analyzed with the continuously iterated noise threshold;

[0080] If the noise coefficient of the new image is greater than or equal to the noise threshold, the new image currently captured is marked as a similar adversarial sample and a similar signal is generated;

[0081] If the noise coefficient of the new image is less than the noise threshold, the new image currently captured is marked as a correct sample and an end signal is generated;

[0082] After multiple rounds of calculations, that is, after the nth calculation is completed, multiple comparison results of new images with noise coefficients greater than or equal to the noise threshold are obtained, and multiple new images marked as similar adversarial samples are extracted, and are similar to the adversarial samples in the adversarial model;

[0083] It should be noted that after filtering out the currently captured new images whose noise coefficients are less than the noise threshold, multiple new images marked as similar adversarial samples are obtained;

[0084] Count the new images marked as similar adversarial samples and obtain the corresponding new image noise coefficients for addition calculation, and calculate the ratio with the total number of new images marked as similar adversarial samples to obtain the similar sample degree of the new images marked as similar adversarial samples, and compare it with the sample threshold, and mark the new images marked as similar adversarial samples that are greater than or equal to the sample threshold as adversarial samples;

[0085] Specifically, the new image marked as a similar adversarial sample is marked as an adversarial sample, which means that the new image with the adversarial sample can be determined as a certain type of adversarial sample in the adversarial model through the above comparison;

[0086] The logic of obtaining the sample threshold is obtained through the measurement of the noise coefficient of the new image and the continuous iteration of the historical image classification data set, which will not be elaborated here;

[0087] The present invention collects continuous characteristic information of the new image and adversarial model mapping information, obtains the similarity of all features of the new image and the average similarity between the adversarial model mapping relationship and the new image features through data processing, performs normalization processing, substitutes the new image noise coefficient into the logistic regression model, compares it with a preset noise threshold, generates comparison results covering different labels, statistically compares the comparison results and performs statistical calculations of the new image noise coefficients with different labels, and compares them with a preset sample threshold to determine the new image results, thereby improving the accuracy of image feature extraction and adversarial detection, enhancing the sensitivity of noise detection, and improving data processing efficiency.

[0088] Example 2

[0089] In Example 1 of the present invention, an example is given to collect continuous characteristic information of a new image and mapping information of an adversarial model, and through data processing, the similarity of all features of the new image and the average similarity of the mapping relationship of the adversarial model and the features of the new image are obtained, normalization is performed, and the noise coefficient of the new image is determined by substituting it into a logistic regression model, and compared with a preset noise threshold, to generate comparison results covering different labels, statistically compare the comparison results and perform statistical calculations on the noise coefficients of new images with different labels, and compare with a preset sample threshold to determine the operation strategy of the new image results; however, in Example 1, only whether the new image is an adversarial sample is evaluated, and no further analysis is made on how to classify the adversarial sample types corresponding to the types in the adversarial model. Obviously, arbitrarily measuring the division of the new image based on the similarity will further pollute the adversarial model in practical applications, resulting in errors in the detection of adversarial samples and reducing the accuracy of detection; in view of the above problems, Example 2 of the present invention is further refined;

[0090] S4: According to the new image results, the similarities between the new images are arranged in order, and the feature vectors of the remaining continuously shot images with the largest difference from the feature vector of the new image and the feature vectors of the corresponding adversarial samples are selected to obtain the minimum distance between the new image and the feature vectors of the adversarial samples and the maximum value of the similarity difference between the feature vectors of the new image and other continuously shot images;

[0091] The logic for obtaining the minimum distance between the new image and the feature vectors of various adversarial samples is to extract the feature vector of the new image, calculate the distance between the feature vector and each vector in the feature vector set of various adversarial samples in the adversarial model, and for each type of adversarial sample, select the minimum distance value with the feature vector of the new image to obtain the minimum distance between the new image and the feature vectors of various adversarial samples;

[0092] Specifically, the formula for calculating the minimum distance is expressed as follows:

[0093]

[0094] Where, d min,k is the minimum distance between the new image and the kth type of adversarial sample set, that is, the minimum distance between the new image and the feature vectors of various adversarial samples, A k is the feature vector set of the kth adversarial sample in the adversarial model, F k is any feature vector in the k-th adversarial sample set, ||F new -F k || is the distance metric function between the new image and any feature vector in the k-th adversarial sample set;

[0095] The distance measurement function may be Euclidean distance or cosine distance, etc., which are not limited here;

[0096] The logic for obtaining the maximum value of the similarity difference between the feature vectors of the new image and other continuously shot images is to calculate the similarity between the new images, and then, for each image, calculate the similarity difference between the feature vector and the feature vectors of other images, and then select the largest value as the maximum value of the similarity difference between the feature vectors of the new image and other continuously shot images;

[0097] Specifically, the calculation of the similarity between the new images has been described in Example 1 and will not be repeated here;

[0098] S5: According to the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the feature vectors of the new image and other continuously shot images, a fuzzy Bayesian neural network is used to determine the type of adversarial sample to which the new image belongs;

[0099] Fuzzy Bayesian neural network is a neural network model that combines fuzzy logic and Bayesian reasoning. Its network structure mainly includes input layer, hidden layer and output layer.

[0100] The input layer contains the minimum distance between the input data new image and the feature vectors of various adversarial samples, as well as the feature vector of the maximum similarity difference between the new image and other continuously shot image feature vectors. Each feature vector corresponds to an input node of the network.

[0101] From the above, we can see that the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the feature vectors of the new image and other continuously shot images are both single features for evaluating the type of adversarial samples to which the new image belongs. The input layer contains two input nodes.

[0102] The output layer generates the final output of the network, and each output node corresponds to the adversarial sample type T to which the new image evaluated by the network belongs;

[0103] Below, the training method of the hidden layer is described in detail:

[0104] (1) By collecting historical data, continuously inputting the minimum distance between the new image and the feature vectors of various adversarial samples, the maximum similarity difference between the feature vectors of the new image and other continuously captured images, and outputting the type of adversarial sample to which the new image belongs, the hidden layer is trained;

[0105] (2) Through the gradient descent method, the parameters of the model are initialized first, and the weight coefficients β1 and β2 are set to bring in the minimum distance between the input new image and the feature vectors of various adversarial samples and the maximum similarity difference between the feature vectors of the new image and other continuously shot images to obtain: β1*Wi, β2*Hi. For each subsequent iteration, the gradient of the loss function with respect to the parameters needs to be calculated. The gradient shows the rate of change of the loss function at the current parameter value and the direction in which the parameters should be adjusted to reduce the loss. Usually, the mean square error loss function is used as the loss function, and its mathematical expression is:

[0106]

[0107] Where J(θ) is the mean square error loss function, θ represents the parameters of the model, N is the number of samples, and y i is the true value of the i-th sample, is the value of the i-th sample predicted by the model; the sample refers to the type of adversarial sample to which the new image belongs, so as to calculate the loss; the gradient of the loss function with respect to the model parameters is calculated by the back-propagation algorithm, which calculates the gradient layer by layer through the chain rule and propagates the gradient from the output layer to the input layer; now the output is known to be T and the loss function is J(θ), then the gradient of the loss function with respect to the model parameter θ can be expressed as:

[0108]

[0109] (3) Update the parameters of the neural network based on the calculated gradient. The formula for updating the parameters is usually:

[0110] θ new =θ old - learning rate-gradient;

[0111] Among them, θ old is the current parameter value, the learning rate is a pre-set hyperparameter, and the gradient is calculated using the back-propagation algorithm described above;

[0112] The process of presetting the learning rate is usually based on historical data experience or trying different values. Generally speaking, the choice of learning rate depends on many factors, including the characteristics of the data set, the complexity of the model, the choice of optimization algorithm, and the convergence speed during training. Usually, the learning rate of the gradient descent method ranges from 0.1, 0.01, 0.001, etc.

[0113] It should be noted that a larger learning rate may cause the parameter update to be too large, making the optimization process unstable or even unable to converge; while a smaller learning rate may cause the optimization process to converge too slowly; during the training process, the learning rate usually needs to be adjusted to improve the performance and convergence speed of the model. A common strategy is to use the learning rate decay technique, that is, gradually reduce the learning rate as the training progresses, so as to search the parameter space more carefully when approaching the optimal solution;

[0114] The sizes of the training set and the validation set are divided. Generally speaking, the training set contains enough samples to ensure that the model has enough data to learn the patterns and features of the task, while the validation set is used to evaluate the generalization ability of the model and adjust the learning rate. Usually, the division is carried out in chronological order, that is, the earlier data is used as the training set and the newer data is used as the validation set. This can better simulate the generalization ability of the model for future data in actual applications. Of course, this embodiment only illustrates the detailed analysis of a certain method, and does not represent the uniqueness of this method, which will not be repeated here.

[0115] (4) Repeat the above steps (1) to (3) for iteration. By setting a tolerance parameter, the training is stopped when the training performance does not improve in several consecutive iterations, which can avoid overfitting and save resources.

[0116] The present invention arranges the similarities between new images in sequence according to the new image results, selects the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the new image and the feature vectors of other continuously shot images, substitutes them into the fuzzy Bayesian neural network, trains the hidden layer using the gradient descent method through the input layer and the output layer, and iterates continuously, so that the type of adversarial sample to which the new image belongs is more accurate, the accuracy of new image classification is improved, the high-dimensional complex data in the deep learning model is processed, and the image classification efficiency is improved.

[0117] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0118] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0119] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0120] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0121] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0122] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0123] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0124] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0125] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0126] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for detecting adversarial samples to improve the recognition rate of dangerous driving behavior detection, characterized by: include: S1: Collect the continuous feature information of the new image and the adversarial model mapping information, and pre-process the new image and the adversarial model mapping. Through data processing, obtain the similarity of all features of the new image and the average similarity between the adversarial model mapping relationship and the new image features; S2: Obtain the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image, perform normalization, and determine the noise coefficient of the new image by establishing a logistic regression model; S3: Obtain the noise coefficient of the new image, and compare it with the preset noise threshold, generate comparison results covering different labels, count the comparison results and perform statistical calculations on the noise coefficients of the new images with different labels, and compare it with the preset sample threshold to determine the new image result; S4: According to the new image results, the similarities between the new images are arranged in order, and the feature vectors of the remaining continuously shot images with the largest difference from the feature vector of the new image and the feature vectors of the corresponding adversarial samples are selected to obtain the minimum distance between the new image and the feature vectors of the adversarial samples and the maximum value of the similarity difference between the feature vectors of the new image and other continuously shot images; S5: Based on the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the new image and the feature vectors of other continuously shot images, a fuzzy Bayesian neural network is used to determine the type of adversarial sample to which the new image belongs.

2. The adversarial sample detection method for dangerous driving behavior detection recognition rate according to claim 1 is characterized by: Through the original images taken continuously, the feature vector is extracted for each image, and the feature vector of the new image is calculated with the feature vectors of other continuously taken images for pairwise similarity calculation, and then the feature similarity matrix is ​​constructed, and the average value of the elements in the matrix is ​​taken to obtain the similarity of all features of the new image As i ; i is the i-th other continuously captured image; Extract feature vectors for each adversarial sample, calculate the similarity between the feature vectors of the continuously captured new images and the overall known adversarial sample feature distribution, and obtain the average value to obtain the average similarity Ds between the mapping relationship of the adversarial model and the new image features. i .

3. The adversarial sample detection method for dangerous driving behavior detection recognition rate according to claim 2 is characterized by: Normalize the similarity of all features of the new image and the average similarity of the mapping relationship of the adversarial model and the new image features; Substitute the similarity of all features of the new image, the mapping relationship of the adversarial model and the average similarity of the new image features into the logistic regression calculation. The specific formula is expressed as follows: Where, L i is the result of logistic regression calculation, that is, the new image noise coefficient, e is the natural base, and y is the linear combination term of the logistic regression model. Specifically, y can be set as: y=β0+β1·As i +β2·Ds i ; Where β0 is the bias term, β1 and β2 are the regression coefficients of the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image.

4. The adversarial sample detection method for dangerous driving behavior detection recognition rate according to claim 3 is characterized by: Get the new image noise coefficient L i Finally, the new image noise coefficient is compared and analyzed with the continuously iterated noise threshold; If the noise coefficient of the new image is greater than or equal to the noise threshold, the new image currently captured is marked as a similar adversarial sample and a similar signal is generated; If the noise coefficient of the new image is less than the noise threshold, the new image currently captured is marked as a correct sample and an end signal is generated.

5. The adversarial sample detection method for dangerous driving behavior detection recognition rate according to claim 4 is characterized by: After multiple rounds of calculations, that is, after the nth calculation is completed, multiple comparison results of new images with noise coefficients greater than or equal to the noise threshold are obtained, and multiple new images marked as similar adversarial samples are extracted, and are similar to the adversarial samples in the adversarial model; Count the new images marked as similar adversarial samples and obtain the corresponding new image noise coefficients for addition calculation, and calculate the ratio with the total number of new images marked as similar adversarial samples to obtain the similarity sample degree of the new images marked as similar adversarial samples, and compare them with the sample threshold, and mark the new images marked as similar adversarial samples that are greater than or equal to the sample threshold as adversarial samples.

6. The adversarial sample detection method for dangerous driving behavior detection recognition rate according to claim 5 is characterized by: By extracting the feature vector of the new image, the distance between the feature vector and each vector in the feature vector set of each type of adversarial sample in the adversarial model is calculated. For each type of adversarial sample, the minimum distance value with the feature vector of the new image is selected to obtain the minimum distance between the new image and the feature vector of each type of adversarial sample. After calculating the similarity between the new images, for each image, the similarity difference between the feature vector and the feature vectors of other images is calculated, and the largest value is selected as the maximum similarity difference between the feature vectors of the new image and other continuous images.

7. The adversarial sample detection method for dangerous driving behavior detection recognition rate according to claim 6 is characterized by: Use a fuzzy Bayesian neural network to determine the type of adversarial sample to which the new image belongs. Define the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the feature vectors of the new image and other continuously shot images as the input nodes in the input layer, and define the type of adversarial sample to which the new image belongs as the output layer. Formulate a fuzzy Bayesian neural network to describe the impact of the minimum distance between a new image and the feature vectors of various adversarial samples and the maximum similarity difference between the feature vectors of the new image and other consecutively captured images on the type of adversarial sample to which the new image belongs; According to the fuzzy Bayesian neural network, the type of adversarial sample to which the new image belongs is determined by the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the new image and the feature vectors of other continuously shot images.

Images