Triggered optical countermeasure attack method and system, electronic equipment and storage medium

Abstract

The invention discloses a trigger type optical countermeasure attack method and system, electronic equipment and a storage medium, and the method comprises the steps: optimizing a countermeasure patch based on a loss function, designing a trigger, irradiating a designated region of the countermeasure patch through a light beam, activating the countermeasure of the countermeasure patch, and achieving the attack of an automatic driving target detection model, the loss functions comprise a first loss function of the anti-patch when the light beam is lacked in the appointed area and a second loss function when the light beam is superposed to the appointed area of the anti-patch, and are used for controlling the antagonistic attack effect of the anti-patch under the condition of whether the light beam is superposed or not. According to the method, the automatic driving target detection model can be attacked.

Description

Technical Field

[0001] The present invention belongs to the technical field of adversarial attacks, and particularly relates to a trigger-based optical adversarial attack method, system, electronic device, and storage medium. Background Art

[0002] In optical and shadow attacks, there are various methods for calculating the positions of rays, light spots, and shadows on a target, mainly relying on heuristic algorithms, sampling-based methods, rule-based methods, zero-order optimization algorithms, and model-agnostic algorithms, rather than relying on gradients. These methods find the optimal light spot or shadow position by simulating natural phenomena or optimization processes to achieve effective adversarial attacks.

[0003] The existing trigger-based adversary TPatch uses acoustic signals as a trigger mechanism. Acoustic signals can introduce image blur by affecting the image stabilization system of a camera, thereby achieving an attack on the visual perception module. During signal injection, an attacker can inject acoustic signals into the inertial sensor of a target vehicle through an ultrasonic transducer, thereby introducing a controllable blur pattern into the image captured by the camera.

[0004] The disadvantages of existing optical adversarial attack optimization algorithms include: Difficult to control: It is very difficult to precisely control the parameters of optical and shadow attacks (such as the intensity and direction of light, the position and shape of shadows, etc.), requiring complex equipment and delicate adjustments. Compared with gradient-based white-box attacks, the attack success rate of optical / shadow attacks is lower. Unstable effect: Since the gradient cannot be accurately calculated, the attacker can only generate adversarial samples through heuristic or rule-based methods, which may lead to unstable and unpredictable attack effects. In some cases, the adversarial samples cannot successfully mislead the model. Strong environmental dependence: The attack effect highly depends on factors such as the surrounding environmental lighting conditions and the surface reflection characteristics of the target object. Under different lighting conditions (such as day, night, indoor, outdoor), the attack effect will vary significantly.

[0005] The disadvantages of trigger-based adversarial TPatch include: There are some countermeasures in the attack method: (such as image stabilization technology) Modern cameras are usually equipped with image stabilization technology, such as optical image stabilization (OIS) and electronic image stabilization (EIS), which can effectively reduce the impact of vibration on the image. OIS detects the vibration of the camera through a gyroscope or accelerometer and compensates for the vibration by adjusting the position of the lens or sensor to maintain the stability of the image. EIS processes the image through algorithms to reduce the blur caused by vibration. When an autonomous vehicle moves at different speeds, the relative speed between the sound wave and the vehicle changes. This change in relative speed affects the vibration amplitude of the sound wave on the vehicle's camera. For example, when the vehicle moves towards the sound source at a higher speed, the frequency of the sound wave will increase relatively, resulting in an increase in the vibration frequency of the camera. Thus, the blur pattern introduced in the image captured by the camera is not stable. Summary of the Invention

[0006] In view of the above problems, the present invention provides a trigger-based optical adversarial attack method, system, electronic device, and storage medium, particularly a trigger-based optical adversarial attack method, system, electronic device, and storage medium for autonomous driving object detection, aiming to achieve an attack on the autonomous driving object detection model.

[0007] According to the first aspect of the embodiments of the present disclosure, a trigger-based optical adversarial attack method is provided. The method includes optimizing an adversarial patch based on a loss function and designing a trigger. By irradiating a specified area of the adversarial patch with a light beam, the adversarial property of the adversarial patch is activated to achieve an attack on the autonomous driving object detection model. The loss function includes a first loss function of the adversarial patch when there is no light beam in the specified area and a second loss function when a light beam is superimposed on the specified area of the adversarial patch, and is used to control the adversarial attack effect of the adversarial patch in the case of whether the light beam is superimposed or not.

[0008] In some embodiments, optimizing the adversarial patch based on the loss function includes the following steps: Initializing the adversarial patch: Randomly generate an initial adversarial patch; Calculating the loss function: Calculate the first loss function and the second loss function respectively; Updating the adversarial patch: Update the parameters of the adversarial patch according to the gradient of the loss function; Repeating the iteration: Repeatedly calculate the loss function and update the adversarial patch until the attack effect of the adversarial patch under the specified conditions reaches the expectation.

[0009] In some embodiments, during the process of optimizing the adversarial patch, the specified light beam trigger area is enlarged or reduced by a certain proportion to improve the fault tolerance rate of the light beam trigger.

[0010] In some embodiments, the trigger is triggered based on a spotlight. When the spotlight irradiates a specified area of the adversarial patch, the trigger detects the light beam and activates the adversarial property of the adversarial patch, and / or is triggered based on a shadow. When the shadow is superimposed on the specified area of the adversarial patch, the trigger detects the shadow and activates the adversarial property of the adversarial patch.

[0011] In some embodiments, the trigger realizes triggering by detecting the light beam features in the image, and determines whether to activate the adversarial property of the adversarial patch based on whether the autonomous driving target detection model misidentifies the adversarial patch with the added light beam or shadow.

[0012] According to a second aspect of the embodiments of the present disclosure, there is provided a trigger-based optical adversarial attack system, which includes an optimized adversarial patch module and a trigger module. The optimized adversarial patch module is used to optimize the adversarial patch based on a loss function, and the trigger module is used to activate the adversarial property of the adversarial patch by irradiating a specified area of the adversarial patch with a light beam, so as to realize an attack on the autonomous driving target detection model. Among them, the loss function includes a first loss function of the adversarial patch when there is no light beam in the specified area and a second loss function when there is a light beam superimposed on the specified area of the adversarial patch, and is used to control the adversarial attack effect of the adversarial patch in the case of whether there is a light beam superimposed or not.

[0013] In some embodiments, optimizing the adversarial patch based on the loss function in the optimized adversarial patch module includes the following steps: Initialize the adversarial patch: randomly generate an initial adversarial patch; Calculate the loss function: calculate the first loss function and the second loss function respectively; Update the adversarial patch: update the parameters of the adversarial patch according to the gradient of the loss function; Repeat iteration: repeatedly calculate the loss function and update the adversarial patch until the attack effect of the adversarial patch under the specified conditions reaches the expectation.

[0014] In some embodiments, the trigger module is triggered based on a spotlight. When the spotlight irradiates a specified area of the adversarial patch, the trigger detects the light beam and activates the adversarial property of the adversarial patch, and / or is triggered based on a shadow. When the shadow is superimposed on the specified area of the adversarial patch, the trigger detects the shadow and activates the adversarial property of the adversarial patch.

[0015] According to a third aspect of the embodiments of the present disclosure, there is provided an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the steps of the above trigger-based optical adversarial attack method are implemented.

[0016] According to a fourth aspect of the embodiments of the present disclosure, a non-transitory computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the above-mentioned trigger-based optical countermeasure attack method are implemented.

[0017] A trigger-based optical countermeasure attack method, system, electronic device, and storage medium provided by the embodiments of the present disclosure aim to attack an autonomous driving target detection model. Specifically, the method of the present invention optimizes a normally harmless adversarial patch and activates its adversarial nature under specific conditions (such as spotlight illumination) to achieve an attack on the target detection model. During the implementation process, a trigger is designed. When the spotlight shines on a specified area of the adversarial patch, the adversarial nature of the patch is activated, resulting in incorrect predictions by the target detection model.

[0018] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings herein are incorporated into the specification and constitute a part of this specification, showing embodiments consistent with the present invention, and are used together with the specification to explain the principles of the present invention.

[0020] Figure 1 is an effect diagram showing that the autonomous driving target detection model in the embodiment of the present invention can still detect the target object when no beam is added; Figure 2 is an effect diagram showing incorrect detection when a beam is added to the autonomous driving target detection model in the embodiment of the present invention; Figure 3 is a schematic structural diagram of the trigger-based optical countermeasure attack system in the embodiment of the present invention; Figure 4 is a schematic diagram of an electronic device in the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0021] The present invention will be further described in detail below with reference to the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present invention, rather than limiting the present invention. Additionally, it should be noted that for the sake of description, only parts related to the present invention rather than all structures are shown in the drawings.

[0022] Before discussing the exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts depict the steps as sequential processes, many of the steps can be implemented in parallel, concurrently, or simultaneously. In addition, the order of the steps can be rearranged. The process can be terminated when its operations are completed, but it can also have additional steps not included in the drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0023] Embodiments of the present invention are directed to a triggered optical countermeasure attack method, system, electronic device, and storage medium, and provide the following embodiments: A triggered optical countermeasure attack method includes optimizing an adversarial patch based on a loss function, designing a trigger, and using a light beam to irradiate a specified area of the adversarial patch to activate the adversarial property of the adversarial patch, thereby achieving an attack on an autonomous driving target detection model. The loss function includes a first loss function of the adversarial patch when there is no light beam in the specified area and a second loss function when a light beam is superimposed on the specified area of the adversarial patch, and is used to control the adversarial attack effect of the adversarial patch in the case of whether a light beam is superimposed or not.

[0024] Specifically, to optimize the adversarial patch, a special loss function is designed, which is divided into two parts: , where: is the loss function of the adversarial patch when there is no light beam at the specified position, and the purpose is to reduce the prediction error of the target model. is the loss function when a light beam is superimposed on the specified position of the adversarial patch, and the purpose is to enhance the prediction error of the target model. Through this design, it is possible to control whether the adversarial patch has an adversarial attack effect respectively in the case of whether a light beam is superimposed or not.

[0025] Specifically, of the loss function consists of three parts: , where is the cross-entropy loss, which is used to measure the difference between the model prediction result and the true label; is the localization loss function, and the mean square error is used to measure the difference between the predicted bounding box and the true bounding box. is a weight coefficient, which is used to balance the relative importance of the localization loss and the classification loss, and can be adjusted through experiments; uses the mean square error to define the confidence loss. is the weight coefficient, which is used to control the influence degree of the confidence loss.

[0026] ​ With the loss function The same form, and The difference is that one is the loss function for positive samples with light trigger, and the other is the loss function for negative samples without light trigger. By comprehensively designing the loss function for positive and negative trigger samples, it is possible to suppress the adversarial patch from being effective in the positive sample state and ineffective in the negative sample state.

[0027] In practical applications, the loss function Adding weights is usually more rigorous.

[0028] By carefully setting up and The total loss function can more accurately guide the training of adversarial patches, enabling them to flexibly demonstrate ideal triggering characteristics in different scenarios.

[0029] Optimizing the adversarial patch based on the loss function includes the following steps: Initialize adversarial patch: randomly generate an initial adversarial patch; Calculate the loss function: Calculate the first loss function separately and the second loss function ; Update the adversarial patch: Update the parameters of the adversarial patch according to the gradient of the loss function; Repeated iteration: Repeatedly calculate the loss function and update the adversarial patch until the attack effect of the adversarial patch under the specified conditions reaches the expected level.

[0030] In the process of optimizing the adversarial patch, the specified area is enlarged or reduced in proportion to improve the fault tolerance of the light beam triggering. Specifically, the adversarial patch based on optical triggering can specify an area when iteratively optimizing the adversarial patch. In order to achieve robustness, this area can be randomly enlarged or reduced by a proportion (such as 20%) during the iterative optimization process, so that the final result has a certain fault tolerance when triggered by light. Even if the light does not perfectly cover the specified area or the coverage area is slightly larger, it can still trigger the adversarial nature of the patch.

[0031] The trigger is based on spotlight triggering, when the spotlight shines on the specified area of ​​the adversarial patch, the trigger detects the light beam and activates the adversarial nature of the adversarial patch, and / or based on shadow triggering, when the shadow is superimposed on the specified area of ​​the adversarial patch, the trigger detects the shadow and activates the adversarial nature of the adversarial patch.

[0032] The trigger is triggered by detecting the light beam features in the image, and determines whether to activate the adversarial nature of the adversarial patch based on whether the autonomous driving target detection model incorrectly recognizes the adversarial patch with added light beams or shadows.

[0033] Specifically, the trigger is used to activate the adversarial nature of the adversarial patch. In an embodiment, a spotlight-based trigger is designed. When the spotlight shines on a specified area of the adversarial patch, the trigger detects the light beam and activates the adversarial nature of the adversarial patch. A shadow-based trigger is also designed. Similarly, when the shadow is superimposed on the specified area of the adversarial patch, the adversarial nature of the adversarial patch is activated.

[0034] The trigger can be implemented based on image processing techniques. By detecting the light beam features (such as brightness, position, etc.) in the image, it is determined whether to activate the adversarial nature of the adversarial patch by whether the model misidentifies the adversarial patch with the added light beam / shadow.

[0035] In a specific embodiment, the process of simulating the light beam at a specified position of the adversarial patch includes: (1) Create a circular uniform brightness mask Assume that the center coordinates of the spotlight are , and the radius is r. Draw a circle on the mask and set the pixel values inside the circle to 1.

[0036] , for a color image, there are usually three channels (RGB). To apply the mask to each channel, the two-dimensional mask needs to be extended to a three-dimensional mask image , where c = 0, 1, 2 represent the red, green, and blue channels respectively, and different color light effects can be simulated.

[0037] (2) Simulate the light shining on a certain position of the patch (the mask position ), , represents the pixel value of the color channel c at the original adversarial patch coordinates (x, y), represents the area outside the mask which does not require light triggering and remains unchanged.

[0038] represents that the position of the adversarial patch at the mask is triggered by light, and the light intensity is k.

[0039] For the area within Figure 1 , simulate the effect of it being illuminated with intensity k. When no light beam is added, the target object can still be detected, as shown in Figure 2 . When a light beam is added, the detection model makes a wrong prediction, as shown in .

[0040] ​Another embodiment is used to illustrate a trigger-based optical countermeasure attack system 300. The system 300 includes an optimized countermeasure patch module 310 and a trigger module 320. The optimized countermeasure patch module 310 is used to optimize the countermeasure patch based on a loss function. The trigger module 320 is used to irradiate a specified area of the countermeasure patch with a light beam to activate the adversarial property of the countermeasure patch and achieve an attack on the autonomous driving target detection model. Among them, the loss function includes a first loss function of the countermeasure patch when there is no light beam in the specified area and a second loss function when a light beam is superimposed on the specified area of the countermeasure patch, and is used to control the adversarial attack effect of the countermeasure patch in the case of whether there is light beam superposition or not.

[0041] Optimizing the countermeasure patch based on the loss function in the optimized countermeasure patch module 310 includes the following steps: Initialize the countermeasure patch: Randomly generate an initial countermeasure patch; Calculate the loss function: Calculate the first loss function and the second loss function respectively; Update the countermeasure patch: Update the parameters of the countermeasure patch according to the gradient of the loss function; Repeat iteration: Repeat calculating the loss function and updating the countermeasure patch until the attack effect of the countermeasure patch under the specified conditions reaches the expectation.

[0042] The trigger module 320 is triggered based on a spotlight. When the spotlight irradiates the specified area of the countermeasure patch, the trigger detects the light beam and activates the adversarial property of the countermeasure patch, and / or is triggered based on a shadow. When the shadow is superimposed on the specified area of the countermeasure patch, the trigger detects the shadow and activates the adversarial property of the countermeasure patch.

[0043] In addition to the above modules, the system 300 may further include other components. However, since these components are not related to the content of the embodiments of the present disclosure, their illustrations and descriptions are omitted here.

[0044] For the other specific working processes of the trigger-based optical countermeasure attack system 300, refer to the description of the above-mentioned trigger-based optical countermeasure attack method embodiment, and details are not described herein again.

[0045] Another embodiment is used to illustrate that the system of the present invention can also be implemented by means of Figure 4 the architecture of the computing device shown. Figure 4 The architecture of the computing device is shown. As Figure 4 shown, a computer system 410, a system bus 430, one or more CPUs 440, an input / output 420, a memory 450, etc. The memory 450 can store various data or files used for computer processing and / or communication and program instructions executed by the CPU, including the trigger-based optical countermeasure attack method of the embodiment. Figure 4 The architecture shown is only exemplary, and when implementing different devices, adjust according to actual needsFigure 4 One or more components therein. The memory 450, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the trigger-based optical countermeasure attack method in the embodiments of the present invention (for example, the optimization countermeasure patch module 310 and the trigger module 320 in the trigger-based optical countermeasure attack system 300). One or more CPUs 440 execute various functional applications and data processing of the system of the present invention by running the software programs, instructions, and modules stored in the memory 450, that is, implement the above-mentioned trigger-based optical countermeasure attack method, which includes optimizing the countermeasure patch based on a loss function, designing a trigger, and using a light beam to irradiate a specified area of the countermeasure patch to activate the adversarial nature of the countermeasure patch to achieve an attack on the autonomous driving target detection model. Among them, the loss function includes a first loss function of the countermeasure patch when there is no light beam in the specified area and a second loss function when a light beam is superimposed on the specified area of the countermeasure patch, which is used to control the adversarial attack effect of the countermeasure patch in the case of whether a light beam is superimposed or not.

[0046] Of course, the processor of the server provided by the embodiments of the present invention is not limited to performing the method operations as described above, and can also perform related operations in the trigger-based optical countermeasure attack method provided by any embodiment of the present invention.

[0047] The memory 450 may mainly include a program storage area and a data storage area. Among them, the program storage area can store an operating system and application programs required for at least one function; the data storage area can store data created according to the use of the terminal, etc. In addition, the memory 450 may include high-speed random access memory and may also include non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some instances, the memory 450 may further include a memory remotely provided with respect to one or more CPUs 440, and these remote memories can be connected to the device through a network. Examples of the above-mentioned network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0048] The input / output 420 can be used to receive input digital or character information and generate key signal inputs related to the user settings and function control of the device. The input / output 420 may further include a display device such as a display screen.

[0049] Embodiments of the present invention also provide a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the trigger-type optical countermeasure attack method described in the above embodiments. The computer-readable storage medium of the embodiments of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of the computer-readable storage medium include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer-readable storage medium can be any tangible medium that contains or stores a program, and this program can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0050] The computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries the computer-readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, and this computer-readable medium can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0051] The program code contained on the storage medium can be transmitted by any suitable medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0052] In addition, for the other specific working processes of a non-transitory computer-readable storage medium, reference can be made to the description of the embodiments of the trigger-type optical countermeasure attack method above, and details will not be repeated here.

[0053] The present invention discloses a trigger-type optical countermeasure attack method, system, electronic device, and storage medium for autonomous driving target detection. The application fields and application methods include: Traffic Sign Recognition System Attack: By posting carefully designed adversarial patches on traffic signs and using the trigger-based optical adversarial attack method proposed in this paper, the adversarial effect can be activated under specific lighting conditions (such as spotlight illumination). For example, sticking an adversarial patch on a stop sign. Normally, the vehicle's object detection model can correctly identify the stop sign, but under the trigger condition, the model will misclassify it as other signs, causing the autonomous vehicle not to stop or make wrong decisions. This kind of attack directly interferes with the accurate recognition of traffic signs by autonomous vehicles and affects driving decisions.

[0054] Vehicle Detection System Attack: For the vehicle detection function of autonomous vehicles, a similar method can also be adopted. Set adversarial patches on the surface of other vehicles. When specific optical trigger conditions are met, the detection model of the autonomous vehicle will make misclassifications, such as misclassifying the vehicle in front as other objects or failing to detect the vehicle, which can easily lead to collision accidents and seriously threaten driving safety.

[0055] Pedestrian Detection and Avoidance System Attack: Arrange adversarial patches on pedestrians or the surrounding environment of pedestrians and use the optical trigger mechanism to interfere with the pedestrian detection system of autonomous vehicles. When the trigger condition is met, the vehicle detection model cannot correctly detect pedestrians or misclassifies pedestrians as other objects, resulting in the vehicle being unable to avoid pedestrians in time and increasing the risk of pedestrian casualties.

[0056] Road Scene Understanding System Attack: Set adversarial interferences on various elements in the road scene, such as road boundaries and lane lines. Under specific optical conditions, the road scene understanding model of the autonomous vehicle will have a wrong perception of the road structure. For example, misclassifying lane lines, which causes the vehicle to deviate from the lane and endangers the safety of itself and other road users.

[0057] Autonomous Driving Sensor Fusion System Attack: Autonomous vehicles rely on the fusion information of multiple sensors (such as cameras, radars, etc.) to make decisions. By interfering with the images captured by the camera, an adversarial effect can be generated under specific optical triggers, affecting the sensor fusion algorithm. For example, the interfered image information does not match the radar information, resulting in errors in the fusion system and further causing deviations in the vehicle's decision-making and control.

[0058] In addition to adding light-triggered adversarial patches to target objects, light-triggered adversarial billboards can also be used. Some research has generated a perturbed billboard (very similar to a conventional billboard) that can mislead the autonomous driving model. Since this adversarial sample is very similar to the original billboard, its concealment is very high, but its persistence has achieved a misleading attack on most passing vehicles and it is easy to detect abnormalities.

[0059] Combine an adversarial billboard with optical triggering to design an adversarial billboard that is triggered only when illuminated by a spotlight. It can be selectively triggered to mislead passing autonomous vehicles and reduce their vigilance.

[0060] Integrating the technical solutions provided by the above embodiments, a trigger-based optical adversarial attack method, system, electronic device, and storage medium are aimed at attacking the object detection model of autonomous driving. Specifically, the method of the present invention optimizes an ordinarily harmless adversarial patch and activates its adversarial nature under specific conditions (such as spotlight illumination) to achieve an attack on the object detection model. During the implementation process, a trigger is designed. When the spotlight illuminates a specified area of the adversarial patch, the adversarial nature of the patch is activated, resulting in incorrect predictions by the object detection model.

[0061] In this article, the term "comprising", "including", or any other variant thereof is intended to cover non-exclusive inclusion, such that a step or method comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such step or method.

[0062] The above content is a further detailed description of the present invention in combination with specific preferred embodiments. It cannot be determined that the specific implementation of the present invention is limited only to these descriptions. For those of ordinary skill in the technical field to which the present invention pertains, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should all be regarded as belonging to the protection scope of the present invention.

Claims

1. A triggered optical countermeasure attack method, characterized in that: The method includes optimizing the adversarial patch based on a loss function, and designing a trigger to illuminate a designated area of ​​the adversarial patch with a light beam to activate the adversarial nature of the adversarial patch and implement an attack on an autonomous driving target detection model, wherein the loss function includes a first loss function of the adversarial patch when there is a lack of a light beam in the designated area and a second loss function when there is a light beam superimposed on the designated area of ​​the adversarial patch, and is used to control the adversarial attack effect of the adversarial patch when the light beam is superimposed or not.

2. The triggered optical counterattack method according to claim 1, characterized in that: Optimizing the adversarial patch based on the loss function includes the following steps: Initialize adversarial patch: randomly generate an initial adversarial patch; Calculate loss function: calculate the first loss function and the second loss function respectively; Update the adversarial patch: Update the parameters of the adversarial patch according to the gradient of the loss function; Repeated iteration: Repeatedly calculate the loss function and update the adversarial patch until the attack effect of the adversarial patch under the specified conditions reaches the expected level.

3. The triggered optical counterattack method according to claim 2, characterized in that: During the optimization of the countermeasure patch, the designated beam trigger area is enlarged or reduced in proportion to improve the fault tolerance of the beam trigger.

4. The triggered optical counterattack method according to claim 1, characterized in that: The trigger is based on a spotlight trigger, when the spotlight shines on the designated area of ​​the adversarial patch, the trigger detects the light beam and activates the adversarial nature of the adversarial patch, and / or based on a shadow trigger, when the shadow is superimposed on the designated area of ​​the adversarial patch, the trigger detects the shadow and activates the adversarial nature of the adversarial patch.

5. The triggered optical counterattack method according to claim 4, characterized in that: The trigger is triggered by detecting the light beam feature in the image, and determines whether to activate the adversarial nature of the adversarial patch based on whether the autonomous driving target detection model incorrectly recognizes the adversarial patch to which the light beam or shadow is added.

6. A triggered optical countermeasure attack system, characterized in that: The system includes an adversarial patch optimization module and a trigger module. The adversarial patch optimization module is used to optimize the adversarial patch based on a loss function. The trigger module is used to use a light beam to illuminate a designated area of ​​the adversarial patch to activate the adversarial nature of the adversarial patch and implement an attack on an autonomous driving target detection model. The loss function includes a first loss function of the adversarial patch when there is a lack of a light beam in the designated area and a second loss function when there is a light beam superimposed on the designated area of ​​the adversarial patch, which is used to control the adversarial attack effect of the adversarial patch when the light beam is superimposed or not.

7. The triggered optical countermeasure attack system according to claim 6, characterized in that: The optimization of adversarial patches based on the loss function in the optimization adversarial patch module includes the following steps: Initialize adversarial patch: randomly generate an initial adversarial patch; Calculate loss function: calculate the first loss function and the second loss function respectively; Update the adversarial patch: Update the parameters of the adversarial patch according to the gradient of the loss function; Repeated iteration: Repeatedly calculate the loss function and update the adversarial patch until the attack effect of the adversarial patch under the specified conditions reaches the expected level.

8. The triggered optical countermeasure attack system according to claim 6, characterized in that: The trigger module is based on spotlight triggering. When the spotlight shines on the designated area of ​​the adversarial patch, the trigger detects the light beam and activates the adversarial nature of the adversarial patch, and / or based on shadow triggering. When the shadow is superimposed on the designated area of ​​the adversarial patch, the trigger detects the shadow and activates the adversarial nature of the adversarial patch.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the triggered optical countermeasure attack method according to any one of claims 1 to 5 are implemented.

10. A non-transitory computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instructions are executed by the processor, the steps of the triggered optical countermeasure attack method according to any one of claims 1 to 5 are implemented.

Images