An adversarial sample detection method for dangerous driving behavior detection and recognition rate

Abstract

The present invention discloses an adversarial sample detection method for improving the recognition rate of dangerous driving behavior detection, which relates to the field of adversarial sample detection and is used to solve the problem that an established adversarial model ignores the hidden features of a new image, resulting in retrieval errors in the corresponding adversarial sample classification, reducing the purity of the model and the accuracy of new image classification. The method collects continuous characteristic information of the new image and adversarial model mapping information, performs normalization processing, substitutes the new image noise coefficient into a logistic regression model, and compares it with a preset noise threshold. The comparison results are statistically compared and the noise coefficients of new images with different labels are statistically calculated to determine the new image results. The minimum distance between the new image and each type of adversarial sample feature vector and the maximum similarity difference between the new image and the feature vectors of other continuously shot images are substituted into a fuzzy Bayesian neural network to determine the type of adversarial sample to which the new image belongs, thereby improving the accuracy of image feature extraction and adversarial detection.

Description

Technical Field

[0001] The present invention relates to the field of adversarial sample detection, and more specifically, to an adversarial sample detection method for improving the recognition rate of dangerous driving behavior detection. Background Art

[0002] In intelligent transportation systems, dangerous driving behavior detection is a key technology that uses deep learning models to identify behavior through video surveillance, sensor data, and other means. Adversarial samples are generated by adding finely tuned perturbations to the original data. These perturbations are usually invisible to the naked eye, but are enough to cause machine learning models to make incorrect decisions. Due to the vulnerability of deep learning models in the face of these adversarial samples, they can significantly affect the life and health of drivers.

[0003] The existing technology has the following deficiencies:

[0004] At present, after a relatively complete adversarial model has been trained, as new images taken at different times increase in actual applications, the adversarial model retrieves corresponding adversarial samples based on features such as similarity. However, although this method is relatively fast, it is easy to ignore the hidden features of the new image, resulting in misclassification of the retrieved adversarial samples, reducing the purity of the model and the accuracy of new image classification. Therefore, an adversarial sample detection method for the recognition rate of dangerous driving behavior detection is proposed.

[0005] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0006] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides an adversarial sample detection method for the recognition rate of dangerous driving behavior detection, which solves the problems raised in the above-mentioned background technology by using different product inspection methods.

[0007] To achieve the above objectives, the present invention provides the following technical solution: an adversarial sample detection method for improving the recognition rate of dangerous driving behavior detection, comprising S1: collecting continuous feature information of a new image and adversarial model mapping information, and preprocessing the new image and the adversarial model mapping, and obtaining the similarity of all features of the new image and the average similarity between the adversarial model mapping relationship and the new image features through data processing;

[0008] S2: Obtain the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image, perform normalization, and determine the noise coefficient of the new image by establishing a logistic regression model;

[0009] S3: Obtain the noise coefficient of the new image and compare it with the preset noise threshold to generate comparison results covering different labels, collect statistics on the comparison results and perform statistical calculations on the noise coefficients of the new images with different labels, and compare it with the preset sample threshold to determine the new image results;

[0010] S4: Based on the new image results, the similarities between the new images are sorted in order, and the feature vectors of the remaining consecutive images with the largest difference from the new image feature vector and the feature vectors of the corresponding adversarial samples are selected to obtain the minimum distance between the new image and the feature vectors of the adversarial samples and the maximum similarity difference between the feature vectors of the new image and the other consecutive images;

[0011] S5: Based on the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the new image and the feature vectors of other continuously captured images, a fuzzy Bayesian neural network is used to determine the type of adversarial sample to which the new image belongs.

[0012] In a preferred embodiment, the feature vectors of each image are extracted by continuously shooting the original images, and the feature vectors of the new image are similar to the feature vectors of other continuously shot images. Then, a feature similarity matrix is ​​constructed, and the average value of the elements in the matrix is ​​taken to obtain the feature similarity of all the new images As i ; i is the i-th other continuously captured image;

[0013] Extract feature vectors for each adversarial sample, calculate the similarity between the feature vectors of the continuously captured new images and the overall known adversarial sample feature distribution, and obtain the average value to obtain the average similarity Ds between the mapping relationship of the adversarial model and the new image features. i .

[0014] In a preferred embodiment, the similarity of all features of the new image and the average similarity of the mapping relationship of the adversarial model and the new image features are normalized;

[0015] Substitute the similarity of all features of the new image, the mapping relationship of the adversarial model and the average similarity of the new image features into the logistic regression calculation formula as follows:

[0016]

[0017] Where, L i is the result of logistic regression calculation, that is, the new image noise coefficient, e is the natural base, and y is the linear combination term of the logistic regression model. Specifically, y can be set as:

[0018] y=β0+β1·As i +β2·Ds i ;

[0019] Where β0 is the bias term, β1 and β2 are the regression coefficients of the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image, respectively.

[0020] In a preferred embodiment, the new image noise coefficient L is obtained i Finally, the new image noise coefficient is compared and analyzed with the continuously iterated noise threshold;

[0021] If the noise coefficient of the new image is greater than or equal to the noise threshold, the new image currently captured is marked as a similar adversarial sample and a similar signal is generated;

[0022] If the noise coefficient of the new image is less than the noise threshold, the new image currently captured is marked as a correct sample and an end signal is generated.

[0023] In a preferred embodiment, after multiple rounds of calculations, i.e., after the nth round of calculations, multiple comparison results are obtained in which the noise coefficients of the new images are greater than or equal to the noise threshold, and then multiple new images marked as similar adversarial samples are extracted, and are similar to the adversarial samples in the adversarial model;

[0024] Count the new images marked as similar adversarial samples and obtain the corresponding new image noise coefficients for addition calculation, and calculate the ratio with the total number of new images marked as similar adversarial samples to obtain the similarity sample degree of the new images marked as similar adversarial samples, and compare it with the sample threshold. New images marked as similar adversarial samples that are greater than or equal to the sample threshold are marked as adversarial samples.

[0025] In a preferred embodiment, the feature vector of the new image is extracted, and the distance between the feature vector and each vector in the feature vector set of each type of adversarial sample in the adversarial model is calculated. For each type of adversarial sample, the minimum distance value with the feature vector of the new image is selected to obtain the minimum distance between the new image and the feature vector of each type of adversarial sample;

[0026] After calculating the similarity between the new images, for each image, the similarity difference between the feature vector and the feature vectors of other images is calculated, and the largest value is selected as the maximum similarity difference between the feature vectors of the new image and other continuous images.

[0027] In a preferred embodiment, a fuzzy Bayesian neural network is used to determine the type of adversarial sample to which a new image belongs. The minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the feature vectors of the new image and other consecutively captured images are defined as input nodes in the input layer, and the type of adversarial sample to which the new image belongs is defined as the output layer.

[0028] Formulate a fuzzy Bayesian neural network to describe the impact of the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the feature vectors of the new image and other consecutively captured images on the type of adversarial sample to which the new image belongs;

[0029] According to the fuzzy Bayesian neural network, the type of adversarial sample to which the new image belongs is determined by the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the feature vectors of the new image and other continuously captured images.

[0030] Technical effects and advantages of the present invention:

[0031] 1. The present invention collects continuous characteristic information of the new image and the mapping information of the adversarial model, and obtains the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image through data processing, performs normalization processing, substitutes it into the logistic regression model to determine the noise coefficient of the new image, and compares it with the preset noise threshold to generate comparison results covering different labels, statistically compares the comparison results and performs statistical calculation of the noise coefficients of the new images with different labels, and compares them with the preset sample threshold to determine the new image results, thereby improving the accuracy of image feature extraction and adversarial detection, enhancing the sensitivity of noise detection, and improving data processing efficiency.

[0032] 2. The present invention arranges the similarities between new images in order according to the new image results, selects the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the new image and the feature vectors of other continuously shot images, substitutes them into the fuzzy Bayesian neural network, and uses the gradient descent method to train the hidden layer through the input layer and the output layer, and continuously iterates, so that the type of adversarial sample to which the new image belongs is more accurate, the accuracy of new image classification is improved, the high-dimensional complex data in the deep learning model is processed, and the image classification efficiency is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flow chart of a method for detecting adversarial samples to improve the recognition rate of dangerous driving behavior detection in the present invention.

[0034] Figure 2 This is a schematic diagram of the steps of an adversarial sample detection method for improving the recognition rate of dangerous driving behavior detection in the present invention. DETAILED DESCRIPTION

[0035] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0036] Example 1

[0037] See also Figure 1 , a method for detecting adversarial samples to improve the recognition rate of dangerous driving behavior detection. The specific operation process is as follows:

[0038] S1: Collect the continuous feature information of the new image and the adversarial model mapping information, and pre-process the new image and the adversarial model mapping. Through data processing, obtain the similarity of all features of the new image and the average similarity between the adversarial model mapping relationship and the new image features;

[0039] Among them, the adversarial model mapping information refers to the mapping relationship of the adversarial model. The mapping relationship of the adversarial model is obtained by the model trained in advance by the experimenters. Specifically, the correct samples are transformed by color attributes, noise is added, ambient lighting is added, and disturbances (such as blur occlusion) based on model gradients and simulation of actual driving environments are performed. Then, the generated adversarial samples are sent to the deep learning model, and the deep learning model is trained to distinguish between adversarial samples and correct samples, avoiding mistaking adversarial samples for correct samples and vice versa. Finally, based on the training results, an adversarial model is established so that the deep learning model can distinguish adversarial samples, thereby achieving adaptive judgment for images with different types of defects in practical applications.

[0040] Specifically, color attribute transformation is to adjust the color space of the image and use changes such as saturation, brightness, contrast, etc. to change the visual effect, and mark it as f(x1);

[0041] Adding noise is to add tiny noise (such as Gaussian noise, salt and pepper noise) to the image, causing the deep learning model to make a misjudgment and mark it as f(x2);

[0042] Adding ambient lighting is to simulate the lighting changes in the actual driving environment, such as strong light, shadows, day and night changes, etc., usually achieved by adjusting the brightness or changing the position of the light source, which is marked as f(x3);

[0043] Based on the model gradient, the perturbation is generated by the gradient back propagation technology, so that the image disturbs the prediction result of the model without changing the original content, which is marked as f(x4);

[0044] The disturbances in the simulated actual driving environment are interference factors such as camera lens dirt, rain, and haze, and the actual scene f(x5) is simulated through image blur, occlusion or perspective transformation;

[0045] Each image has its own unique features, and the process of generating adversarial examples can be viewed as a mapping relationship between the input image and the output perturbation. Specifically, the correct image is used as the independent variable, and the adversarial example is used as the dependent variable. Through training and optimization, the mapping relationship of the generated adversarial example is the functional relationship between the image features and the perturbation.

[0046] The output of the model is not only the classification result of the image, but also the generation of adversarial perturbations, so that each image has its corresponding adversarial example;

[0047] It should be noted that there are more than the five methods for generating and detecting adversarial samples mentioned above. Our researchers can also generate corresponding adversarial samples based on highly targeted scenario attacks. Since adversarial sample detection methods are existing technologies, we will not elaborate on them here.

[0048] The new image continuous characteristic information refers to the original image currently captured or newly acquired, that is, the image captured in actual application. Specifically, in order to verify the verifiability of the new image, several original images are captured quickly and continuously at the same time;

[0049] In actual application, the images captured are taken by a miniature camera installed in front of the vehicle's driver's seat, capturing the head position of the person sitting in the driver's seat. There is no specific limit on the shooting duration, nor is there a limit on the number of original images captured. This is set by the experimenters based on the number of head movements of the driver or the perception frequency of the optical elements set in the image, and will not be elaborated here.

[0050] Therefore, from the above, it can be seen that the total number of original images captured quickly and continuously at the same time is set to n;

[0051] The similarity of all new image features refers to the calculation of the similarity between the features of multiple new images taken continuously (a group of dangerous driving behavior images taken quickly at the same time). That is, the similarity between the feature distribution of the new image and the feature distribution of the consecutive images is calculated. The acquisition logic is to extract the feature vector of each image from the original images taken continuously. After calculating the pairwise similarity between the feature vectors of the new image and the feature vectors of other consecutive images, a feature similarity matrix is ​​constructed. The average value of the elements in the matrix is ​​taken to obtain the similarity of all new image features.

[0052] Specifically, deep learning models, such as convolutional neural networks (CNNs), are often used to extract features from new images. In the process of extracting new image features using deep learning models, features primarily refer to high-dimensional data representations extracted from images using deep learning algorithms. These features capture key information such as the image's structure, texture, and color distribution.

[0053] Furthermore, by inputting these original images, the shallow convolutional layers extract basic visual information of the image, such as edges, textures, and colors. The intermediate convolutional layers then capture more complex shape contours and local structures based on the features extracted by the shallow convolutional layers. Finally, the deep convolutional layers extract a high-dimensional abstraction of the image's global information, reflecting the image's object semantics, scene features (such as highways, nighttime environments, etc.), and key point features (such as the driver's eye position and head orientation).

[0054] At the end of the convolutional neural network, a fully connected layer converts the high-dimensional feature map into a fixed-length feature vector. This feature vector includes the driver's head posture (such as looking up, looking down, turning), facial state (such as eyes closed, mouth open), lighting conditions (such as strong light or shadow), and scene background information (such as whether the driver is in motion).

[0055] It should be noted that the selection of feature vectors and the number of feature vectors are set by the experimenters based on the output results of the convolutional neural network, and will not be described in detail here;

[0056] Specifically, the similarity between the feature vector of the new image and the feature vectors of other continuously captured images is determined by Euclidean distance. The specific formula is as follows:

[0057]

[0058] Where F1 is the new image vector, F i is the other continuously shot image vector, i is the i-th other continuously shot image;

[0059] Construct a feature similarity matrix S, where the matrix elements S(F1,F i ), represents the similarity between the new image and the i-th image. By taking the average value of the elements of the matrix S, the similarity of all features of the new image is calculated. The specific formula is expressed as follows:

[0060]

[0061] Where, As i is the similarity of all features of the new image;

[0062] The average similarity between the adversarial model mapping relationship and the new image features refers to the average similarity between the feature vector of the new image and the feature vectors of all mapping relationships stored in the adversarial model. Its acquisition logic is to extract the feature vector of each adversarial sample, calculate the similarity between the feature vectors of the continuously captured new images and the overall distribution of known adversarial sample features, and obtain the average similarity between the adversarial model mapping relationship and the new image features.

[0063] Specifically, the similarity between the feature vector of the new image and the feature vector of the adversarial model is calculated. The specific similarity calculation can be based on a similarity formula such as cosine similarity or Euclidean distance. Specifically, the total number of adversarial samples is set to m, and k is the kth adversarial model feature vector;

[0064] For each new image, calculate the average similarity with all adversarial model features. Since the total number of new image features taken continuously is n, take the average value of all images and calculate to obtain the average similarity Bs between the adversarial model mapping relationship and the new image features. i ;

[0065] S2: Obtain the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image, perform normalization, and determine the noise coefficient of the new image by establishing a logistic regression model;

[0066] Normalize the similarity of all features of the new image and the mapping relationship of the adversarial model with the average similarity of the new image features. All input variables will be converted to the same range to ensure that the contribution of each input to the model is balanced. Specifically, the normalization method is to normalize the [0,1] interval. The specific formula is expressed as:

[0067]

[0068] Where, As i is the similarity of all features of the new image, As norm is the normalized similarity of all features of the new image, As min is the minimum value of the similarity of all features of the new image, As max is the maximum value of the similarity of all features of the new image;

[0069] Among them, the mapping relationship between the adversarial model and the average similarity of the new image features are also normalized using the above formula, which will not be repeated here;

[0070] After normalization, the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the new image features are all within the range of [0, 1]. The system can make comparisons and decisions on a unified scale, thereby improving the accuracy and efficiency of the logistic regression model.

[0071] Substitute the similarity of all features of the new image, the mapping relationship of the adversarial model and the average similarity of the new image features into the logistic regression calculation formula as follows:

[0072]

[0073] Where, L i is the result of logistic regression calculation, that is, the new image noise coefficient, e is the natural base, and y is the linear combination term of the logistic regression model. Specifically, y can be set as:

[0074] y=β0+β1·As i +β2·Ds i ;

[0075] Where β0 is the bias term, β1 and β2 are the regression coefficients of the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image;

[0076] S3: Obtain the noise coefficient of the new image and compare it with the preset noise threshold to generate comparison results covering different labels, collect statistics on the comparison results and perform statistical calculations on the noise coefficients of the new images with different labels, and compare it with the preset sample threshold to determine the new image results;

[0077] The logic for obtaining the noise threshold is to collect historical adversarial samples and correct sample sets, then divide the dataset into training and test sets, set evaluation indicators and clustering algorithms, and in each round of cross-validation, train the model on the training set and evaluate the model performance on the test set. The noise threshold is then adjusted based on the performance of the validation set. Therefore, the noise threshold is continuously updated.

[0078] In this paper, clustering algorithms are a type of unsupervised learning algorithm used to divide adversarial examples in a dataset into groups or clusters with similarities. A common example is K-means clustering, which divides adversarial examples in a dataset into K clusters, minimizing the distance between each adversarial example and the center point (centroid) of its cluster. Finally, the similarity between the adversarial example and the new image is measured using the Euclidean distance, thereby setting the noise threshold.

[0079] Get the new image noise coefficient L i Finally, the new image noise coefficient is compared and analyzed with the continuously iterated noise threshold;

[0080] If the noise coefficient of the new image is greater than or equal to the noise threshold, the new image currently captured is marked as a similar adversarial sample and a similar signal is generated;

[0081] If the noise coefficient of the new image is less than the noise threshold, the new image currently captured is marked as a correct sample and an end signal is generated;

[0082] After multiple rounds of calculations, that is, after the nth calculation, multiple comparison results are obtained in which the noise coefficients of the new images are greater than or equal to the noise threshold, and multiple new images marked as similar adversarial samples are extracted, and are similar to the adversarial samples in the adversarial model;

[0083] It should be noted that after filtering out the currently captured new images whose noise coefficients are less than the noise threshold, multiple new images marked as similar adversarial samples are obtained;

[0084] Count the new images marked as similar adversarial samples and obtain the corresponding new image noise coefficients for addition calculation, and calculate the ratio with the total number of new images marked as similar adversarial samples to obtain the similarity sample degree of the new images marked as similar adversarial samples, and compare it with the sample threshold. New images marked as similar adversarial samples that are greater than or equal to the sample threshold are marked as adversarial samples;

[0085] Specifically, the new image marked as similar adversarial sample is labeled as an adversarial sample, which means that the new image with the adversarial sample can be determined as a certain type of adversarial sample in the adversarial model through the above comparison;

[0086] The logic for obtaining the sample threshold is obtained through the measurement of the noise coefficient of the new image and the continuous iteration of the historical image classification dataset, which will not be elaborated here;

[0087] The present invention collects continuous characteristic information of the new image and the mapping information of the adversarial model, obtains the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image through data processing, performs normalization processing, substitutes the new image noise coefficient into the logistic regression model, and compares it with the preset noise threshold to generate comparison results covering different labels, statistically compares the comparison results and performs statistical calculation of the noise coefficients of new images with different labels, and compares them with the preset sample threshold to determine the new image results, thereby improving the accuracy of image feature extraction and adversarial detection, enhancing the sensitivity of noise detection, and improving data processing efficiency.

[0088] Example 2

[0089] In Example 1 of the present invention, an example is given of collecting continuous feature information of a new image and mapping information of an adversarial model, and obtaining the similarity of all features of the new image and the average similarity of the mapping relationship of the adversarial model and the features of the new image through data processing, performing normalization processing, substituting the new image noise coefficient into a logistic regression model to determine the noise coefficient, and comparing it with a preset noise threshold to generate comparison results covering different labels, statistically analyzing the comparison results and performing statistical calculations on the noise coefficients of new images with different labels, and comparing them with a preset sample threshold to determine the operation strategy of the new image results; however, in Example 1, only whether the new image is an adversarial sample is evaluated, and no further analysis is made on how to classify the adversarial sample types into the corresponding types in the adversarial model. Obviously, arbitrarily measuring the division of the new image based on the similarity will further pollute the adversarial model in practical applications, resulting in errors in the detection of adversarial samples and reducing the accuracy of detection; in response to the above problems, Example 2 of the present invention is further refined;

[0090] S4: Based on the new image results, the similarities between the new images are sorted in order, and the feature vectors of the remaining consecutive images with the largest difference from the new image feature vector and the feature vectors of the corresponding adversarial samples are selected to obtain the minimum distance between the new image and the feature vectors of the adversarial samples and the maximum similarity difference between the feature vectors of the new image and the other consecutive images;

[0091] The logic for obtaining the minimum distance between the new image and the feature vectors of each type of adversarial sample is to extract the feature vector of the new image, calculate the distance between this feature vector and each vector in the set of feature vectors of each type of adversarial sample in the adversarial model, and for each type of adversarial sample, select the minimum distance value with the feature vector of the new image to obtain the minimum distance between the new image and the feature vectors of each type of adversarial sample;

[0092] Specifically, the formula for calculating the minimum distance is expressed as follows:

[0093]

[0094] Where, d min,k is the minimum distance between the new image and the k-th adversarial sample set, that is, the minimum distance between the new image and the feature vectors of each type of adversarial sample, A k is the feature vector set of the k-th adversarial sample in the adversarial model, F k is any feature vector in the k-th adversarial sample set, ||F new -F k || is the distance metric function between the new image and any feature vector in the k-th adversarial sample set;

[0095] The distance metric function may be Euclidean distance or cosine distance, etc., which are not limited here;

[0096] The logic for obtaining the maximum value of the similarity difference between the feature vectors of the new image and other consecutive images is to calculate the similarity between the new images, and then, for each image, calculate the similarity difference between the feature vector and the feature vectors of other images, and then select the largest value as the maximum value of the similarity difference between the feature vectors of the new image and other consecutive images;

[0097] Specifically, the calculation of the similarity between the new images has been described in Example 1 and will not be repeated here;

[0098] S5: Based on the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the feature vectors of the new image and other consecutively captured images, a fuzzy Bayesian neural network is used to determine the type of adversarial sample to which the new image belongs.

[0099] Fuzzy Bayesian neural network is a neural network model that combines fuzzy logic and Bayesian reasoning. Its network structure mainly includes input layer, hidden layer and output layer.

[0100] The input layer contains the minimum distance between the input data new image and the feature vectors of various adversarial samples, as well as the feature vector with the maximum similarity difference between the new image and the feature vectors of other consecutively captured images. Each feature vector corresponds to an input node of the network.

[0101] As can be seen from the above, the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the feature vectors of the new image and other consecutively captured images are both single features for evaluating the type of adversarial sample to which the new image belongs. Therefore, the input layer contains two input nodes;

[0102] The output layer generates the final output of the network, where each output node corresponds to the adversarial sample type T to which the new image evaluated by the network belongs.

[0103] Below, the training method of the hidden layer is described in detail:

[0104] (1) By collecting historical data, continuously inputting the minimum distance between the new image and the feature vectors of various adversarial samples, the maximum similarity difference between the feature vectors of the new image and other continuously captured images, and outputting the type of adversarial sample to which the new image belongs, the hidden layer is trained;

[0105] (2) Using the gradient descent method, the model parameters are initialized first, and the weight coefficients β1 and β2 are set to take into account the minimum distance between the input new image and the feature vectors of various adversarial samples and the maximum similarity difference between the new image and the feature vectors of other continuously captured images to obtain: β1*Wi, β2*Hi. For each subsequent iteration, the gradient of the loss function with respect to the parameters needs to be calculated. The gradient shows the rate of change of the loss function at the current parameter value and the direction in which the parameters should be adjusted to reduce the loss. Usually, the mean square error loss function is used as the loss function, and its mathematical expression is:

[0106]

[0107] Where J(θ) is the mean square error loss function, θ represents the parameters of the model, N is the number of samples, and y i is the true value of the i-th sample, is the value of the i-th sample predicted by the model; the sample refers to the type of adversarial sample to which the new image belongs, so as to calculate the loss; the gradient of the loss function with respect to the model parameters is calculated by the backpropagation algorithm, which calculates the gradient layer by layer through the chain rule, propagating the gradient from the output layer to the input layer; now it is known that the output is T and the loss function is J(θ), then the gradient of the loss function with respect to the model parameter θ can be expressed as:

[0108]

[0109] (3) Update the parameters of the neural network based on the calculated gradient. The formula for updating the parameters is usually:

[0110] θ new =θ old - learning rate-gradient;

[0111] Among them, θ old is the current parameter value, the learning rate is a pre-set hyperparameter, and the gradient is calculated using the backpropagation algorithm described above;

[0112] The process of presetting the learning rate is usually based on historical data experience or by trying different values. Generally speaking, the choice of learning rate depends on many factors, including the characteristics of the dataset, the complexity of the model, the choice of optimization algorithm, and the convergence rate during training. Usually, the learning rate range of the gradient descent method is 0.1, 0.01, 0.001, etc.

[0113] It should be noted that a larger learning rate may cause the parameter update to be too large, making the optimization process unstable or even unable to converge; while a smaller learning rate may cause the optimization process to converge too slowly. During the training process, it is usually necessary to adjust the learning rate to improve the performance and convergence speed of the model. A common strategy is to use the learning rate decay technique, that is, gradually reducing the learning rate as the training progresses, so as to more carefully search the parameter space when approaching the optimal solution.

[0114] The sizes of the training set and validation set are divided. Generally speaking, the training set contains enough samples to ensure that the model has enough data to learn the patterns and features of the task, while the validation set is used to evaluate the generalization ability of the model and adjust the learning rate. The method of dividing the data in chronological order is usually adopted, that is, the older data is used as the training set and the newer data is used as the validation set. This can better simulate the generalization ability of the model to future data in actual applications. Of course, this embodiment only illustrates the detailed analysis of a certain method and does not represent the uniqueness of this method. It will not be repeated here.

[0115] (4) Repeat the above steps (1) to (3) for iteration. By setting a tolerance parameter, the training is stopped when the training performance does not improve in several consecutive iterations, which can avoid overfitting and save resources.

[0116] The present invention arranges the similarities between new images in sequence according to the new image results, selects the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the new image and the feature vectors of other continuously shot images, substitutes them into the fuzzy Bayesian neural network, uses the gradient descent method to train the hidden layer through the input layer and the output layer, and continuously iterates, so that the type of adversarial sample to which the new image belongs is more accurate, the accuracy of new image classification is improved, and the high-dimensional complex data in the deep learning model is processed, thereby improving the efficiency of image classification.

[0117] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0118] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0119] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0120] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0121] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0122] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0123] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0124] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0125] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0126] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for detecting adversarial examples to improve the recognition rate of dangerous driving behavior detection, characterized by: include: S1: Collect the continuous feature information of the new image and the adversarial model mapping information, and pre-process the new image and the adversarial model mapping. Through data processing, obtain the similarity of all features of the new image and the average similarity between the adversarial model mapping relationship and the new image features; S2: Obtain the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image, perform normalization, and determine the noise coefficient of the new image by establishing a logistic regression model; S3: Obtain the noise coefficient of the new image and compare it with the preset noise threshold to generate comparison results covering different labels, collect statistics on the comparison results and perform statistical calculations on the noise coefficients of the new images with different labels, and compare it with the preset sample threshold to determine the new image results; S4: Based on the new image results, the similarities between the new images are sorted in order, and the feature vectors of the remaining consecutive images with the largest difference from the new image feature vector and the feature vectors of the corresponding adversarial samples are selected to obtain the minimum distance between the new image and the feature vectors of the adversarial samples and the maximum similarity difference between the feature vectors of the new image and the other consecutive images; S5: Based on the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the feature vectors of the new image and other consecutively captured images, a fuzzy Bayesian neural network is used to determine the type of adversarial sample to which the new image belongs. By continuously shooting the original images, extract the feature vector of each image, calculate the similarity between the feature vector of the new image and the feature vector of other continuously shot images, construct the feature similarity matrix, and take the average value of the elements in the matrix to obtain the similarity of all features of the new image. ; i is the i-th other continuously captured image; Extract feature vectors for each adversarial sample, calculate the similarity between the feature vectors of the continuously captured new images and the overall known adversarial sample feature distribution, and obtain the average value to obtain the average similarity between the mapping relationship of the adversarial model and the new image features. ; Normalize the similarity of all features of the new image and the average similarity of the mapping relationship of the adversarial model with the features of the new image; Substitute the similarity of all features of the new image, the mapping relationship of the adversarial model and the average similarity of the new image features into the logistic regression calculation formula as follows: ； Where, is the result of logistic regression calculation, that is, the new image noise coefficient, e is the natural base, and y is the linear combination term of the logistic regression model. Specifically, y can be set as: ； Where, is the bias term, and are the regression coefficients of the similarity of all features of the new image and the average similarity between the mapping relationship of the adversarial model and the features of the new image.

2. The adversarial sample detection method for dangerous driving behavior detection and recognition rate according to claim 1 is characterized by: Get the new image noise coefficient Finally, the new image noise coefficient is compared and analyzed with the continuously iterated noise threshold; If the noise coefficient of the new image is greater than or equal to the noise threshold, the new image currently captured is marked as a similar adversarial sample and a similar signal is generated; If the noise coefficient of the new image is less than the noise threshold, the new image currently captured is marked as a correct sample and an end signal is generated.

3. The adversarial sample detection method for dangerous driving behavior detection recognition rate according to claim 2 is characterized by: After multiple rounds of calculations, that is, after the nth calculation, multiple comparison results are obtained in which the noise coefficients of the new images are greater than or equal to the noise threshold, and multiple new images marked as similar adversarial samples are extracted, and are similar to the adversarial samples in the adversarial model; Count the new images marked as similar adversarial samples and obtain the corresponding new image noise coefficients for addition calculation, and calculate the ratio with the total number of new images marked as similar adversarial samples to obtain the similarity sample degree of the new images marked as similar adversarial samples, and compare it with the sample threshold. New images marked as similar adversarial samples that are greater than or equal to the sample threshold are marked as adversarial samples.

4. The adversarial sample detection method for dangerous driving behavior detection and recognition rate according to claim 3 is characterized by: By extracting the feature vector of the new image, the distance between the feature vector and each vector in the feature vector set of each type of adversarial sample in the adversarial model is calculated. For each type of adversarial sample, the minimum distance value with the feature vector of the new image is selected to obtain the minimum distance between the new image and the feature vector of each type of adversarial sample; After calculating the similarity between the new images, for each image, the similarity difference between the feature vector and the feature vectors of other images is calculated, and the largest value is selected as the maximum similarity difference between the feature vectors of the new image and other continuous images.

5. The adversarial sample detection method for dangerous driving behavior detection and recognition rate according to claim 4 is characterized by: A fuzzy Bayesian neural network is used to determine the type of adversarial sample to which the new image belongs. The minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the feature vectors of the new image and other consecutively captured images are defined as the input nodes in the input layer. The type of adversarial sample to which the new image belongs is defined as the output layer. Formulate a fuzzy Bayesian neural network to describe the impact of the minimum distance between the new image and the feature vectors of various adversarial samples and the maximum similarity difference between the feature vectors of the new image and other consecutively captured images on the type of adversarial sample to which the new image belongs; According to the fuzzy Bayesian neural network, the type of adversarial sample to which the new image belongs is determined by the minimum distance between the new image and the feature vectors of each type of adversarial sample and the maximum similarity difference between the feature vectors of the new image and other continuously captured images.

Images