Adversarial sample generation method and system based on noise erasure and logit loss optimization

Abstract

The invention discloses an adversarial sample generation method and system based on noise erasure and logit loss optimization. The method comprises the steps of 1, performing data enhancement on an original picture in a given data set; 2, inputting the enhanced picture into a preset target detection model to obtain an erasure gradient value; and 3, updating the original picture in the given data set according to the erasure gradient value and the momentum, and repeating the steps for multiple iterations to obtain a final adversarial sample. According to the method, the higher attack success rate is achieved under the white box condition and the black box condition, and the significant progress is achieved in the aspect of improving the efficiency and robustness of adversarial sample generation.

Description

Technical Field

[0001] The present invention relates to the technical field of computer vision target detection, and in particular to an adversarial sample generation method and system based on noise erasure and logit loss optimization. Background Art

[0002] In recent years, thanks to the emergence of large-scale high-quality data sets and the improvement of computing power brought by computer hardware upgrades, deep learning theory and technology have achieved remarkable development results. This progress has promoted the development and practical application of many visual tasks, among which object detection is a widely used technology. Object detection is the basis of many computer vision tasks, such as instance segmentation, image captioning, object tracking, etc. However, they also inherit the shortcomings of deep neural networks: they are easily attacked by adversarial samples. Adversarial samples constructed by adding small perturbations can easily cause model prediction errors, and the robustness of the model is seriously insufficient. With the widespread application and rapid popularization of deep learning technology, the scope of adversarial samples has expanded from image classification to multiple fields including object detection, visual tracking, and natural language processing. This expansion has brought new challenges and put forward more stringent requirements on the reliability and security of existing deep learning-based object detection technology. Therefore, constructing effective adversarial samples to train the model can greatly improve the prediction accuracy and robustness of the model.

[0003] The research on adversarial attacks on target detection is based on adversarial attacks on image classification. Whether it is target detection or image classification, the method of adversarial sample generation can use similar techniques. Among them, gradient-based methods are universal adversarial attack methods. They use image classification tasks as verification, but because they fail to fully adapt to the characteristics of target detection, the attack effect is relatively poor. In target detection, adversarial samples are usually generated using one or more losses of the target model, such as category loss, confidence loss, and position loss. Similar to the image classification task, the gradient-based attack method uses gradient information to add specific perturbations to the original image, so that the small perturbations of the input will be amplified during the entire forward propagation process of the attacked detector, which is enough to change the prediction results of the model.

[0004] Generally speaking, adversarial attacks can be divided into two types according to whether the attack requires the specification of a specific target category: non-targeted attacks and targeted attacks. In non-targeted attacks, the attacker does not need to explicitly specify a specific category, but aims to guide the model to produce incorrect recognition results; in contrast, targeted attacks are not only intended to make the model recognize incorrectly, but also to mislead the model's output to a specific category, which is usually not the correct label of the sample. In comparison, targeted attacks are a more challenging task because the attacker can control the output of the model at will, which can bring potential greater harm. However, correspondingly, targeted attacks are more difficult to generate and require more precise adjustments. In the target detection task, the difference between these two types of attacks is as follows: Figure 1 As shown in Figure 2, this distinction is very important for understanding the challenges and potential harm of different types of attacks. The models used in practical applications are generally black-box models, and there is a lack of research on black-box attacks against target detection models. Furthermore, previous work mostly focuses on the transferability of non-targeted adversarial attacks, while improving the transferability of targeted adversarial samples is more challenging. Summary of the invention

[0005] In order to at least partially solve the problems of insufficient research on existing black-box attacks on target detection models and insufficient attention to the transferability of targeted adversarial attacks, the present invention provides an adversarial sample generation method and system based on noise erasure and logit loss optimization. The erased gradient value is obtained by constructing a target detection model, and adversarial samples are generated by combining the erased gradient value with momentum, which effectively prevents overfitting of adversarial samples, improves the success rate of black-box attacks, and achieves good attack effects on different target detectors, with good transferability.

[0006] In order to achieve the above object, the technical solution of the present invention is:

[0007] The first aspect of the present invention proposes an adversarial sample generation method based on noise erasure and logit loss optimization, comprising:

[0008] Step 1: Perform data augmentation on an original image in a given dataset to facilitate the generation of adversarial samples;

[0009] Step 2: Input the enhanced image into the preset object detection model to obtain the erased gradient value, which makes the adversarial sample more aggressive and helps prevent the adversarial sample from overfitting during gradient descent.

[0010] Step 3: Update the original image in the given data set according to the erased gradient value and momentum to obtain the adversarial sample, and repeat the above steps for multiple iterations to obtain all adversarial samples.

[0011] Furthermore, the step 1 specifically includes:

[0012] Perform multiple random color changes on the original image according to a preset probability; wherein the multiple random color changes include sequentially changing the hue of the original image RandomHue according to a preset probability, changing the saturation of the original image Random Saturation according to a preset probability, changing the brightness of the original image RandomBrightness according to a preset probability, and changing the contrast of the original image RandomContrast according to a preset probability, to prevent overfitting of the adversarial sample;

[0013] The following formula is used to represent the random color transformation of the original image:

[0014]

[0015] Among them, Transform is a set of data enhancement strategies. is the adversarial sample of the tth iteration.

[0016] Furthermore, the preset target detection model includes a gradient value calculation unit and a noise random erasure unit;

[0017] The gradient value calculation unit is used to detect the input enhanced picture, obtain the number of data enhancements performed in this iteration, and obtain the gradient value of the original picture gradient and the image enhancement data, so as to obtain the erased gradient value;

[0018] The noise random erasing unit is used to perform weighted averaging of the original image gradient and the enhanced output gradient to obtain an average gradient, and then randomly erase a portion of the noise in the average gradient to obtain an erased gradient value, so as to facilitate the generation of adversarial samples.

[0019] Furthermore, the gradient value of the image enhancement data is expressed by the following formula:

[0020]

[0021] L target_cls (x adv ,y tar )={max i≠t (Z(x adv ) i )}-Z(x adv ) t

[0022] Among them, n is the sum of the number of data enhancements and the original images in this iteration, is the adversarial sample of the tth iteration, g i is the gradient value of the image enhancement data corresponding to the random transformation of the i-th color, L target_clsis the objective function optimized based on logit loss, t is the target category to be attacked, z(·) is the logit output of the corresponding category, and y tar is the target category, and RandomColor is the color random transformation enhancement.

[0023] Furthermore, the erase gradient value is expressed by the following formula:

[0024]

[0025] g′ t = RandomErase(g t )

[0026] Among them, g i is the gradient value of the image enhancement data corresponding to the random transformation of the i-th color, RandomErase is the random erasure algorithm, g′ t To erase the gradient value.

[0027] Furthermore, updating the original image in the given data set according to the erased gradient value and momentum also includes adding noise to the updated original image, so that the adversarial sample only interferes with the foreground area of ​​the image and focuses on the category of the attacked object.

[0028] Furthermore, updating the original image in the given data set according to the erased gradient value and momentum also includes adding noise to the updated original image, and the process is expressed by the following formula:

[0029]

[0030] g″ t+1 =M⊙g′ t+1

[0031]

[0032] Among them, μ is the attenuation factor of the momentum term. In the initial state, g0=0, ε is the perturbation size, M is the mask matrix, is the label y corresponding to the target loss function at the current iteration round t true Input image The gradient value, g″ t+1 is the perturbation gradient value, ⊙ is the dot product, clip{·} is the clipping function, α is the iteration step size, sign(·) is the sign function, y true is the label corresponding to the target loss function at the current iteration round t, g′ t+1 To erase the gradient value, is the adversarial sample of the t+1th iteration.

[0033] The second aspect of the present invention proposes an adversarial sample generation system based on noise erasure and logit loss optimization, comprising:

[0034] The data augmentation module is used to augment an original image in a given dataset to facilitate the generation of adversarial samples;

[0035] The target detection model is used to input the enhanced image into the preset target detection model to obtain the erased gradient value, which makes the adversarial sample more aggressive and helps prevent the adversarial sample from overfitting during gradient descent;

[0036] The adversarial sample generation module is used to update the original image in the given data set according to the erased gradient value and momentum to obtain the adversarial sample, and repeat the above steps for multiple iterations to obtain all adversarial samples.

[0037] The third aspect of the present invention proposes an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the adversarial sample generation method based on noise erasure and logit loss optimization as described in the first aspect above is implemented.

[0038] The fourth aspect of the present invention proposes a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the adversarial sample generation method based on noise erasure and logit loss optimization as described in the first aspect above.

[0039] Beneficial effects of the present invention:

[0040] (1) The present invention improves the attack success rate in both white-box and black-box application scenarios. From the perspective of data enhancement, the proposed diversified data enhancement methods can enrich the gradient flow information returned by the target detection model to increase the diversity of the model and effectively prevent the adversarial samples from overfitting the white-box model. In addition, the present invention does not regard targeted attacks as a simple extension of non-target attacks, but designs an objective function based on logit loss optimization to obtain gradient values. On the one hand, it alleviates the noise solidification problem caused by cross entropy, and on the other hand, it increases the distance between the target class and the non-target class, namely the logit margin. This enables the present invention to improve the performance and mobility of targeted attacks. Finally, the present invention does not add perturbation noise to the entire image, but calculates the perturbation mask through the Hadamard product and adds the perturbation to the frame of the specified object. On the one hand, this reduces the perturbation range to improve the attack concealment; on the other hand, by introducing noise in the foreground area with a greater impact on the target class, adversarial samples can be generated more efficiently.

[0041] (2) In terms of robustness: The present invention can more comprehensively evaluate the robustness of the target detection model in more complex targeted attack scenarios. Existing attack algorithms are difficult to deceive black box models and have a low success rate, resulting in inaccurate evaluation of the robustness of the target detection model. By generating targeted adversarial samples, the present invention can evaluate the performance of the target detection model in the face of targeted attacks and improve the robustness of the model.

[0042] (3) In terms of attack success rate: Compared with the traditional adversarial sample generation method, the method of the present invention achieves a higher attack success rate under the white-box setting. The present invention uses YOLOv8 and Faster-RCNN to evaluate the attack performance of the proposed method on the MS COCO dataset. The experimental results show that compared with I-FGSM, TIM, and SIM, the attack success rate of the present invention is higher.

[0043] (5) In terms of transferability: The method of the present invention has achieved good attack effects on different target detectors and has good transferability. Compared with the adversarial attack method represented by I-FGSM, the present invention has better performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram showing a comparison between a targeted attack and a non-targeted attack provided in an embodiment of the present invention.

[0045] Figure 2 A flowchart of an adversarial sample generation method based on noise erasure and logit loss optimization provided in an embodiment of the present invention.

[0046] Figure 3 A specific flowchart of the adversarial sample generation method based on noise erasure and logit loss optimization provided in an embodiment of the present invention.

[0047] Figure 4 A schematic diagram of a logit optimization objective function provided by an embodiment of the present invention.

[0048] Figure 5 A schematic diagram of the effect of random noise erasure provided by an embodiment of the present invention.

[0049] Figure 6 A schematic diagram of the effect of targeted counterattack provided by an embodiment of the present invention.

[0050] Figure 7 An architecture diagram of an adversarial sample generation system based on noise erasure and logit loss optimization provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] Example 1

[0053] like Figure 2 As shown in the figure, the adversarial sample generation method based on noise erasure and logit loss optimization includes:

[0054] S101: Perform data augmentation on an original image in a given dataset.

[0055] S102: Input the enhanced image into a preset target detection model to obtain an erased gradient value.

[0056] S103: Update the original image in the given data set according to the erased gradient value and momentum to obtain an adversarial sample, and repeat the above steps for multiple iterations to obtain all adversarial samples.

[0057] The present invention inputs the enhanced image into a preset target detection model to erase the noise of the image, thereby obtaining an erased gradient value, so as to reduce the risk of overfitting of the adversarial sample, and combines the erased gradient value with momentum to update the original image to obtain the adversarial sample. The attack success rate and mobility of the obtained adversarial sample are improved.

[0058] Example 2

[0059] Based on the above embodiments, Figure 3 As shown, the present invention proposes a specific construction structure of adversarial samples, which specifically includes:

[0060] The original image is subjected to multiple random color changes according to a preset probability (such as a 50% probability). The multiple random color changes include sequentially changing the hue of the original image RandomHue according to a preset probability, changing the saturation of the original image Random Saturation according to a preset probability, changing the brightness of the original image RandomBrightness according to a preset probability, and changing the contrast of the original image RandomContrast according to a preset probability.

[0061] The following formula is used to represent the random color transformation of the original image:

[0062]

[0063] Among them, Transform is a set of data enhancement strategies. is the adversarial sample of the tth iteration.

[0064] The preset target detection model includes a gradient value calculation unit and a noise random erasure unit.

[0065] The gradient value calculation unit is used to detect the input enhanced image, obtain the number of data enhancements in this iteration, and obtain the gradient value of the original image gradient and the image enhancement data. The above process is expressed by the following formula:

[0066]

[0067] L target_cls (x adv ,y tar )={max i≠t (Z(x adv ) i )}-Z(x adv ) t

[0068] Among them, n is the sum of the number of data enhancements and the original images in this iteration, is the adversarial sample of the tth iteration, g i is the gradient value of the image enhancement data corresponding to the random transformation of the i-th color, L target_cls For the objective function optimized based on logit loss (such as Figure 4 ), t is the target category to be attacked, z(·) is the logit output of the corresponding category, y tar is the target category, and RandomColor is the color random transformation enhancement.

[0069] The noise random erasing unit is used to perform weighted averaging of the original image gradient and the enhanced output gradient to obtain an average gradient, and then randomly erase a portion of the noise in the average gradient to obtain an erased gradient value, which helps to learn more robust features because it does not rely too much on specific pixels in the original image. Compared with existing methods, the adversarial samples generated by the method of the present invention have better attack success rate and transferability, such as Figure 5 The specific process is expressed by the following formula:

[0070]

[0071] g′ t = RandomErase(g t )

[0072] Among them, RandomErase is a random erasure algorithm used to randomly erase some small rectangles, g′ tTo erase the gradient value.

[0073] The classic gradient-based iterative adversarial attack method (such as I-FGSM) greedily updates the adversarial perturbation in a small step size along the direction of the fastest current gradient descent at each iteration, which can easily fall into the local optimum.

[0074] The present invention proposes to combine the gradient value after data enhancement with momentum (abbreviated as MI-FGSM) to iteratively update the original image. Adding momentum is to introduce the gradient accumulated by momentum in the gradient iteration process to stabilize the optimization, avoid poor local maximum values, and alleviate the problem that I-FGSM is prone to fall into poor local maximum values ​​and the migration performance is too low. The above process is expressed by the following formula:

[0075]

[0076] Among them, μ is the attenuation factor of the momentum term. In the initial state, g0=0, is the label y corresponding to the target loss function at the current iteration round t true Input image The gradient value, y true is the label corresponding to the target loss function at the current iteration round t, g′ t+1 To erase the gradient value.

[0077] After adding momentum, not only the excellent white-box attack capability is maintained, but also the transferability of adversarial samples under black-box conditions is effectively improved.

[0078] Since the present invention aims to carry out targeted attacks, it focuses on the category of the attacking object, and the foreground area has a greater impact on the classification of the object. Therefore, the present invention adopts a local perturbation method to superimpose the adversarial noise into the target frame, only interfering with the foreground area of ​​the image, so that the perturbation is mainly concentrated in the area that has an important impact on the classification decision. Specifically, the present invention designs a mask matrix of the same size as the original image, in which the value of the position with the target, that is, the foreground area, is set to 1, and the values ​​of other areas are set to 0. This mask is multiplied by the corresponding pixels of the updated noise through the Hadamard product operation to ensure that the perturbation is only superimposed on the foreground area to be attacked. On the one hand, this strategy can improve the concealment of the attack by limiting the perturbation to the foreground area, because the perturbation is mainly concentrated on the target object, and will not attract unnecessary attention to the background or other irrelevant areas of the image; on the other hand, by introducing noise in the foreground area where the target category has a greater impact, adversarial samples can be generated more effectively. Finally, the image with added noise is processed to obtain the adversarial sample. The above process is expressed by the following formula:

[0079] g″ t+1 =M⊙g′ t+1

[0080]

[0081] Among them, ε is the perturbation size, M is the mask matrix, and g″ t+1 is the perturbed gradient value, ⊙ is the dot product, clip{·} is the clipping function, α is the iteration step size, sign(·) is the sign function, is the adversarial sample of the t+1th iteration.

[0082] The obtained output is used to update the original images in the dataset, and then all the original images in the dataset are repeatedly updated to obtain all adversarial samples.

[0083] In summary, the pseudo code for constructing adversarial samples is shown in Table 1.

[0084] Table 1 Pseudocode for constructing adversarial samples

[0085]

[0086]

[0087] Example 3

[0088] Based on the above embodiments, the embodiments of the present invention provide a process for verifying the effectiveness of the adversarial sample constructed by the present invention, including:

[0089] (1) Dataset and Experimental Settings

[0090] Model: The experiments in this paper are based on one-stage and two-stage object detection models, including representative algorithms YOLOv3, YOLOv8, RetinaNet and Faster R-CNN. These models are trained on the MS COCO dataset.

[0091] Baseline method: This paper compares the mainstream gradient iteration-based attack methods in adversarial attacks, including I-FGSM, TIM and SIM.

[0092] The MS COCO dataset is a large collection of rich object detection data, mainly collected from complex daily scenes, and contains 80 target categories to be detected. In the experiments of this invention, the target category is agreed to be "person", that is, t tar = 0. The present invention randomly selected 2000 images from the COCO test set, all of which can be correctly recognized by the model. When calculating mAP, in order to ensure that the hyperparameters do not affect the results, the present invention uses the same parameter settings as the baseline method, and the specific parameters are shown in Table 2.

[0093] Table 2 Algorithm hyperparameter settings

[0094]

[0095] (2) Evaluation indicators

[0096] The attack success rate (ASR) is defined to evaluate the attack effect, which indicates the change of mAP before and after the attack. The attack performance is measured by calculating the degree of mAP decline. Among them, mAP (mean Average Precision) is the result obtained by averaging the AP (average precision) of each category, which is widely used in target detection. AP is the area under the precision-recall curve of a fixed category at a certain threshold. The formulas for precision and recall are as follows:

[0097]

[0098]

[0099] Among them, TP is True Positives, which indicates the number of correctly detected targets, FP is False Positives, which indicates the number of incorrectly detected targets, FN is False Negatives, which indicates the number of real targets that cannot be detected, Precision is the accuracy, and Recall is the recall rate.

[0100] The more errors there are in the output of the target detector, the larger the ASR value is, indicating that the attack effect is better. The definition of ASR is shown in the formula:

[0101]

[0102] Among them, mAP adv Represents the mAP value of the adversarial sample on the dataset, mAP clean Represents the mAP value of the clean sample on the dataset.

[0103] (3) Experimental results

[0104] The current mainstream method for generating adversarial samples for target detection tasks is to maximize the loss function in a gradient iterative manner. This paper increases the diversity of gradients through data augmentation. According to the characteristics of targeted attacks, an objective function based on logit loss optimization is designed. Compared with the baseline method, the performance is improved under both white-box and black-box conditions. Figure 6The generated adversarial samples are displayed. It can be seen from the figure that the difference between the original image and the corresponding generated adversarial sample is very small, that is, the adversarial perturbation is almost invisible to the human eye. It can be seen from the figure that the adversarial sample makes the object detector unable to work properly and can change the output category according to the attacker's intention.

[0105] ① White box attack experiment results

[0106] First, in the white-box setting, MI-FGSM, TIM, SIM and the present invention are used to attack the two-stage detector Faster-RCNN and the one-stage detector YOLOV8 respectively, and the attack success rates are shown in Tables 3 and 4.

[0107] Under the same parameter settings, compared with the two traditional baseline methods, the attack success rate of the improved method RE-MI-FGSM is improved by an average of 6%. For example, in Table 3, the present invention uses the Faster R-CNN model to generate adversarial samples. The three attack methods in the table are all under the white-box setting. The average attack success rates of MI-FGSM and TIM are 74.6% and 79.7%, respectively, while the attack success rate of the present invention is the highest, 85.6%, and mAP50 drops from 0.610 to 0.088. The experimental results fully verify the effectiveness of the present invention and significantly improve the white-box attack success rate of existing methods, which shows that the present invention can be used as a powerful method to improve the attack capability of adversarial samples.

[0108] Table 3 Comparison of different attack methods in white box

[0109]

[0110] Table 4 Comparison of different attack methods in white box

[0111]

[0112] ② Migration attack experiment results

[0113] In order to verify the migration attack capability of the present invention, adversarial samples were generated on Faster-RCNN and YOLOV8 respectively using MI-FGSM, TIM, SIM and the present invention under white-box conditions, and then an unknown model RetinaNet was attacked. As shown in Tables 5 and 6, the attack success rate of the present invention is higher than that of the baseline attack method under the black-box setting. For example, when the adversarial samples generated on Faster R-CNN attack retinaNet, the average attack success rates of MI-FGSM and TIM are 29.5% and 68.71% respectively, while the attack success rate of the adversarial samples generated by RE-MI-FGSM of the present invention can reach 80.58%, which greatly improves the success rate of the black-box attack; and in Table 5, when the adversarial samples generated on YOLOV5 attack RetinaNet, the migration is slightly improved. This fully proves the effectiveness of the present invention in improving the migration capability of adversarial samples.

[0114] Table 5 Comparison of different attack methods in black box

[0115]

[0116] Table 6 Comparison of different attack methods in black box

[0117]

[0118] ③Ablation experiment

[0119] In order to study the impact of the data augmentation framework and logit loss optimization on the attack capability, ablation experiments were conducted to compare the results under the same parameter settings. Taking YOLOv8 as an example, when the MI-FGSM method was used to iteratively attack a single image, the mAP dropped to 0.168. However, after the introduction of the data augmentation framework, the diversity of gradients increased, and the specific experimental results in Tables 7 and 8 showed that the attack success rate and transferability were improved. This shows that the introduction of the data augmentation framework improves the attack success rate and transferability. When the data augmentation framework and logarithmic loss optimization were introduced at the same time, the mAP further dropped to 0.057. In addition, the strategy of introducing partial perturbations in the present invention also caused the mAP to further drop to 0.108. These ablation experimental results can deeply understand the role of data augmentation and logarithmic loss optimization in adversarial attacks on object detection. Further analysis can explore the impact under different parameter settings and how to optimize these methods in practical applications to enhance the robustness of the model.

[0120] Table 7 Comparison of different attack methods in white box

[0121]

[0122] Table 8 Comparison of different attack methods in white box

[0123]

[0124] In summary, for target detection tasks, the gradient-based targeted adversarial sample generation methods currently mainly use technologies such as I-FGSM and PGD to simply expand the non-targeted attack method into a targeted attack. However, these methods have limited migration capabilities when dealing with targeted attacks, and there is still potential for further improvement in white-box attacks. The research of the present invention aims to overcome these problems. First, by analyzing the differences between image classification tasks and target detection tasks, the present invention makes full use of the similarities between neural network training and adversarial sample generation, and proposes a target detection model. The model incorporates the techniques of data erasure and color random transformation to increase the diversity of gradients, thereby avoiding overfitting to the attacked white-box model. Secondly, the present invention designs an objective function based on logit loss optimization to alleviate the problem of excessive consistency of continuous noise introduced by cross entropy when accumulating momentum, which helps to more effectively optimize the adversarial sample generation process and produce more mobile and stable adversarial samples. Finally, the present invention introduces a mask matrix for superimposing perturbation noise on the foreground area, thereby reducing the range of perturbation. Experimental results show that compared with traditional adversarial sample generation methods, the method proposed in the present invention achieves a higher attack success rate under both white-box and black-box conditions. This shows that the present invention has made significant progress in improving the efficiency and robustness of adversarial sample generation.

[0125] Example 4

[0126] Based on the above embodiments, Figure 7 As shown in the figure, the adversarial sample generation system based on noise erasure and logit loss optimization includes:

[0127] The data augmentation module is used to perform data augmentation on an original image in a given dataset.

[0128] The target detection model is used to input the enhanced image into a preset target detection model to obtain an erased gradient value.

[0129] The adversarial sample generation module is used to update the original image in the given data set according to the erased gradient value and momentum to obtain the adversarial sample, and repeat the above steps for multiple iterations to obtain all adversarial samples.

[0130] It should be noted that the adversarial sample generation system based on noise erasure and logit loss optimization provided in the embodiment of the present invention is to implement the adversarial sample generation method based on noise erasure and logit loss optimization in the above-mentioned embodiment. Its specific functions can be referred to the above-mentioned method embodiments, which will not be repeated here.

[0131] Example 5

[0132] Corresponding to the above method, an embodiment of the present invention provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the adversarial sample generation method based on noise erasure and logit loss optimization as in the above embodiment.

[0133] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the adversarial sample generation method based on noise erasure and logit loss optimization as described in the above embodiment.

[0134] In summary, the present invention improves the attack success rate in both white-box and black-box application scenarios. From the perspective of data enhancement, the proposed diversified data enhancement methods can enrich the gradient flow information returned by the target detection model to increase the diversity of the model and effectively prevent the adversarial samples from overfitting the white-box model. In addition, the present invention does not regard targeted attacks as a simple extension of non-target attacks, but designs an objective function based on logit loss optimization to obtain gradient values, which on the one hand alleviates the noise solidification problem caused by cross entropy, and on the other hand increases the distance between the target class and the non-target class, namely the logit margin. This enables the present invention to improve the performance and mobility of targeted attacks. Finally, the present invention does not add perturbation noise to the entire image, but calculates the perturbation mask through the Hadamard product, and adds the perturbation to the frame of the specified object, which on the one hand reduces the perturbation range to improve the attack concealment; on the other hand, by introducing noise in the foreground area with a greater impact on the target category, adversarial samples can be generated more efficiently. In terms of robustness: the present invention can more comprehensively evaluate the robustness of the target detection model in more complex targeted attack scenarios. Existing attack algorithms are difficult to deceive black box models and have a low success rate, resulting in inaccurate evaluation of the robustness of the target detection model. By generating targeted adversarial samples, the present invention can evaluate the performance of the target detection model in the face of targeted attacks and improve the robustness of the model. In terms of attack success rate: compared with traditional adversarial sample generation methods, the method of the present invention achieves a higher attack success rate under a white box setting. The present invention uses YOLOv8 and Faster-RCNN to evaluate the attack performance of the proposed method on the MS COCO dataset. The experimental results show that compared with I-FGSM, TIM, and SIM, the attack success rate of the present invention is higher. In terms of migration: the method of the present invention has achieved good attack effects on different target detectors and has good migration. Compared with adversarial attack methods represented by I-FGSM, the present invention has better performance.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. The adversarial sample generation method based on noise erasure and logit loss optimization is characterized by: include: Step 1: Perform data augmentation on an original image in a given dataset; Step 2: Input the enhanced image into the preset target detection model to obtain the erased gradient value; Step 3: Update the original image in the given data set according to the erased gradient value and momentum to obtain the adversarial sample, and repeat the above steps for multiple iterations to obtain all adversarial samples.

2. The adversarial sample generation method based on noise erasure and logit loss optimization according to claim 1, characterized in that: The step 1 specifically includes: Performing multiple random color changes on the original image according to a preset probability; wherein the multiple random color changes include sequentially changing the hue of the original image RandomHue according to a preset probability, changing the saturation of the original image Random Saturation according to a preset probability, changing the brightness of the original image RandomBrightness according to a preset probability, and changing the contrast of the original image RandomContrast according to a preset probability; The following formula is used to represent the random color transformation of the original image: Among them, Transform is a set of data enhancement strategies. is the adversarial sample of the tth iteration.

3. The adversarial sample generation method based on noise erasure and logit loss optimization according to claim 1, characterized in that: The preset target detection model includes a gradient value calculation unit and a noise random erasure unit; The gradient value calculation unit is used to detect the input enhanced picture, obtain the number of data enhancements performed in this iteration, and obtain the gradient value of the original picture gradient and the image enhancement data; The noise random erasing unit is used to perform weighted averaging on the original image gradient and the enhanced output gradient to obtain an average gradient, and then randomly erase a portion of the noise in the average gradient to obtain an erased gradient value.

4. The adversarial sample generation method based on noise erasure and logit loss optimization according to claim 3, characterized in that: The gradient value of the image enhancement data is expressed by the following formula: L target_cls (x adv ,y tar )={max i≠t (Z(x adv ) i )}-Z(x adv ) t Among them, n is the sum of the number of data enhancements and the original images in this iteration, is the adversarial sample of the tth iteration, g i is the gradient value of the image enhancement data corresponding to the random transformation of the i-th color, L target_cls is the objective function optimized based on logit loss, t is the target category to be attacked, z(·) is the logit output of the corresponding category, and y tar is the target category, and RandomColor is the color random transformation enhancement.

5. The adversarial sample generation method based on noise erasure and logit loss optimization according to claim 4, characterized in that: The erase gradient value is expressed by the following formula: gt′=RandomErase(gt) Among them, g i is the gradient value of the image enhancement data corresponding to the random transformation of the i-th color, RandomErase is the random erasure algorithm, and gt′ is the erased gradient value.

6. The adversarial sample generation method based on noise erasure and logit loss optimization according to claim 1, characterized in that: The updating of the original image in the given data set according to the erased gradient value and momentum also includes adding noise to the updated original image.

7. The adversarial sample generation method based on noise erasure and logit loss optimization according to claim 6, characterized in that: The updating of the original image in the given data set according to the erased gradient value and momentum also includes adding noise to the updated original image, and the process is expressed by the following formula: g t ″ +1 =M⊙g t ′ +1 Among them, μ is the attenuation factor of the momentum term. In the initial state, g0=0, ε is the perturbation size, M is the mask matrix, is the label y corresponding to the target loss function at the current iteration round t true Input image The gradient value, g t ″ +1 is the perturbation gradient value, ⊙ is the dot product, clip{·} is the clipping function, α is the iteration step size, sign(·) is the sign function, y true is the label corresponding to the target loss function at the current iteration round t, g t ' +1 To erase the gradient value, is the adversarial sample of the t+1th iteration.

8. Adversarial sample generation system based on noise erasure and logit loss optimization, characterized by: include: The data augmentation module is used to perform data augmentation on an original image in a given dataset; The target detection model is used to input the enhanced image into a preset target detection model to obtain an erased gradient value; The adversarial sample generation module is used to update the original image in the given data set according to the erased gradient value and momentum to obtain the adversarial sample, and repeat the above steps for multiple iterations to obtain all adversarial samples.

9. An electronic device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the adversarial sample generation method based on noise erasure and logit loss optimization as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the adversarial sample generation method based on noise erasure and logit loss optimization as described in any one of claims 1 to 7.

Images