Adversarial patch generation method and device for image-point cloud fusion perception model

Abstract

The present application relates to a method and device for generating adversarial patches for an image-point cloud fusion perception model, which obtains a first image, randomly initializes a mask and a global perturbation according to the first image, and superimposes the global perturbation on the first image according to the mask to obtain a second image; obtains point cloud data corresponding to the first image, inputs the second image and the point cloud data into a neural network model for training, and obtains a perceptual heat map of the neural network model; determines the perceptual type of the neural network model according to the similarity between the perceptual heat map and the actual object distribution; determines the deployment position of the adversarial patch according to the perceptual type, and models the adversarial patch based on the deployment position to obtain a third image; wherein the deployment position of the global perception model includes the environmental background in the first image, and the deployment position of the local perception model includes the target object in the first image; reduces the deployment cost and difficulty of adversarial samples.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence deep learning technology, and in particular to a method and device for generating adversarial patches for an image-point cloud fusion perception model. Background Art

[0002] Deep neural network (DNN) models are widely used in perception tasks such as object detection due to their excellent performance. However, numerous studies have shown that DNN models are vulnerable to adversarial attacks. These attacks create adversarial examples (AEs) by carefully manipulating the DNN model's inputs, forcing the model to make incorrect decisions. Aberrant model behavior can have significant and detrimental consequences, particularly in safety-critical areas such as autonomous driving and intelligent surveillance. This concept has been further developed into physical adversarial examples, demonstrating that adversarial example attacks can be transferred to the physical world and implemented under realistic environmental conditions. For example, physical adversarial examples can have an impact even when the camera is capturing images from different viewing distances or angles. Physical adversarial examples raise the threat level of adversarial attacks, making them a significant and practical threat to DNN models.

[0003] Currently, more advanced DNN perception models typically combine different modal data such as images and point clouds for reasoning. Recent studies have shown that point cloud modal data plays a more important role in fusion perception. Therefore, for such models, the generation of adversarial samples usually focuses on perturbations of point cloud data. For image-point cloud fusion perception models, some common strategies for implementing physical adversarial samples are to use laser diodes to perturb point cloud data, or to use 3D printers to print adversarial objects to simultaneously perturb image and point cloud data. However, perturbation methods based on devices such as laser diodes or 3D printers require perturbation of point cloud data, which is costly and difficult to deploy. Summary of the Invention

[0004] Based on this, it is necessary to provide a method, computer device, computer-readable storage medium and computer program product for generating adversarial patches for image-point cloud fusion perception models that can reduce costs and be easily deployed to address the above technical problems.

[0005] In a first aspect, the present application provides a method for generating adversarial patches for an image-point cloud fusion perception model, comprising:

[0006] Acquire a first image, randomly initialize a mask and a global perturbation according to the first image, and superimpose the global perturbation on the first image according to the mask to obtain a second image;

[0007] Acquire point cloud data corresponding to the first image, input the second image and the point cloud data into a neural network model for training, and obtain a perception heat map of the neural network model;

[0008] Determining the perception type of the neural network model based on the similarity between the perception heat map and the actual object distribution; wherein the perception type of the neural network model includes a global perception model and a local perception model;

[0009] Determine the deployment position of the adversarial patch according to the perception type, and model the adversarial patch based on the deployment position to obtain a third image; wherein the deployment position of the global perception model includes the environmental background in the first image, and the deployment position of the local perception model includes the target object in the first image.

[0010] In one embodiment, the second image and the point cloud data are input into a neural network model for training to obtain a perceptual heat map of the neural network model, including:

[0011] Obtaining a total confidence score of the detection box and a mask area generated by processing the neural network model;

[0012] Taking minimizing the sum of the confidence scores of the detection boxes and the area of ​​the mask as the optimization goal, a gradient descent algorithm is used to perform gradient optimization on the mask and the global perturbation to obtain an optimized mask;

[0013] The optimized mask is used as a perceptual heat map of the neural network model.

[0014] In one embodiment, minimizing the sum of the confidence scores of the detection boxes and the area of ​​the mask is used as an optimization goal, and gradient optimization is performed on the mask and the global perturbation using a gradient descent algorithm to obtain an optimized mask, including:

[0015] Input the sum of the confidence scores of the detection boxes into the mean square error function to obtain the mask loss;

[0016] Inputting the mask area into the mean square error function to obtain the adversarial loss;

[0017] Adding the mask loss and the adversarial loss to obtain a sum value, minimizing the sum value as the optimization target, and performing gradient optimization on the mask and the global perturbation using a gradient descent algorithm to obtain a perceptually sensitive area of ​​the neural network model;

[0018] The optimized mask is determined based on the sensitive area.

[0019] In one embodiment, randomly initializing the mask according to the first image comprises:

[0020] Set the hyperparameters γ and s, and set the variable m and global perturbation p;

[0021] The mask is generated according to the following formula:

[0022] ;

[0023] Wherein, M is the mask, [i, j] is the pixel position, and tanh is the hyperbolic tangent function.

[0024] In one embodiment, determining the perception type of the neural network model based on the similarity between the perception heat map and the actual object distribution includes:

[0025] Inputting the first image and the point cloud data into the neural network model for training, and generating an object detection frame on the first image;

[0026] Set the area surrounded by the object detection frame to 1 and the rest to 0 to obtain a binary matrix of the same size as the first image;

[0027] Determine whether the perceptual heat map and the binary matrix meet the following conditions:

[0028] ;

[0029] Wherein, x is the first image, M x is the perceptual heat map generated for the first image, is the binary matrix, E x is the mean of the expression obtained for the perceptual heat maps generated by different first images, β is a hyperparameter, ⊙ is the Hadamard product operator, and ∑ is the summation operator;

[0030] If the perception heat map and the binary matrix meet the above conditions, it is determined that the perception heat map and the actual object distribution are similar, and the perception type of the neural network model is determined to be a local perception model;

[0031] If the perception heat map and the binary matrix do not meet the above conditions, it is determined that the perception heat map and the actual object distribution are not similar, and the perception type of the neural network model is determined to be a global perception model.

[0032] In one embodiment, modeling the adversarial patch based on the deployment position to obtain a third image includes:

[0033] determining position parameters of the adversarial patch;

[0034] projecting the adversarial patch into a pixel coordinate system of the first image at the deployment position according to the position parameter to obtain a pixel perturbation;

[0035] The pixel perturbation is superimposed on the first image to obtain the third image.

[0036] In one embodiment, projecting the adversarial patch into the pixel coordinate system according to the deployment position to obtain pixel perturbations includes:

[0037] Obtaining device parameters and physical position parameters of the adversarial patch; wherein the device parameters include external parameters of the laser radar and internal parameters of the camera;

[0038] Determine a mapping relationship according to the device parameters, substitute the physical position parameters of the adversarial patch into the mapping relationship, and solve to obtain pixel coordinates;

[0039] A bilinear interpolation algorithm is used to calculate a pixel value corresponding to the pixel coordinate to obtain the pixel disturbance.

[0040] In one embodiment, after superimposing the pixel perturbation on the first image to obtain the third image, the method further includes:

[0041] performing random data augmentation processing on the adversarial patch, and superimposing the adversarial patch after the random data augmentation processing onto the first image to obtain a fourth image;

[0042] Inputting a plurality of the fourth images as samples into the neural network model, and calculating an average value of the neural network loss;

[0043] Taking minimizing the average value of the neural network loss as the optimization goal, a gradient descent algorithm is used to perform gradient optimization on the pixel values ​​of the adversarial patch, and the optimized adversarial patch is used as a new adversarial patch.

[0044] In one embodiment,

[0045] Performing random data augmentation processing on the adversarial patch includes at least one of the following:

[0046] Randomly transforming the size and physical position parameters of the adversarial patch;

[0047] Randomly transforming the contrast, saturation, and brightness of the adversarial patch;

[0048] During the training of the neural network model, superimposing pixel-level random perturbations on the adversarial patch;

[0049] During the training process of the neural network model, pixel-level random perturbations are superimposed on the adversarial patch, and random noise is added to the injected random perturbations.

[0050] In a second aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in the first aspect when executing the computer program.

[0051] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect above.

[0052] In a fourth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect above.

[0053] The above-mentioned adversarial patch generation method, computer device, computer-readable storage medium, and computer program product for the image-point cloud fusion perception model perturbs the original image and generates a corresponding perception heat map. Based on the similarity between the perception heat map and the actual object distribution, the perception type of the neural network model is determined. Different adversarial patch deployment schemes are selected based on the perception type of the neural network model, and the adversarial patches are used to perturb the original image. Compared with related technologies, this method does not require perturbation of point cloud data and generates adversarial samples only in the image modality, making deployment simple and low-cost. Furthermore, by fully leveraging the structural differences of the image-point cloud perception model, it overcomes the insufficient effectiveness of single-modality adversarial samples and helps improve the adversarial effectiveness of adversarial samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A hardware structure block diagram of a terminal for an adversarial patch generation method for an image-point cloud fusion perception model in one embodiment;

[0055] Figure 2 Flowchart of a method for generating adversarial patches for an image-point cloud fusion perception model in one embodiment;

[0056] Figure 3 A schematic diagram of a process for generating a perceptual heat map for a single first image in one embodiment;

[0057] Figure 4 Flowchart of a method for determining a perception type of a neural network model in one embodiment;

[0058] Figure 5 A flowchart of modeling an adversarial patch in one embodiment;

[0059] Figure 6A schematic diagram of a process for deploying countermeasure patches on the ground in one embodiment;

[0060] Figure 7 is a flowchart of a method for generating adversarial patches for an image-point cloud fusion perception model in another embodiment;

[0061] Figure 8 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0063] Unless otherwise defined, technical or scientific terms used in this application shall have the ordinary meanings as understood by persons of ordinary skill in the art to which this application belongs. The terms "a," "an," "the," "these," and similar expressions in this application do not denote limitations on quantity and may be singular or plural. The terms "comprise," "include," "have," and any variations thereof, as used in this application, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include unlisted steps or modules (units) or other steps or modules (units) inherent to the process, method, product, or device. The terms "connected," "connected," "coupled," and similar expressions used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. As used in this application, "plurality" means two or more. "And / or" describes an association between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone; A and B exist simultaneously; or B exists alone. Generally, the character " / " indicates that the objects in the preceding and following relationship are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0064] The method embodiment provided in this embodiment can be executed in a terminal, a computer or a similar computing device. For example, running on a terminal, Figure 1 This is a hardware block diagram of a terminal for generating an adversarial patch for an image-point cloud fusion perception model according to an embodiment of the present application. Figure 1 As shown, the terminal may include one or more ( Figure 1Only one is shown) a processor 101 and a memory 102 for storing data, wherein the processor 101 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA. The above terminal may also include a transmission device 103 for communication functions and an input and output device 104. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above terminal. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0065] The memory 102 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the adversarial patch generation method for the image-point cloud fusion perception model in this embodiment. The processor 101 executes various functional applications and data processing by running the computer program stored in the memory 102, that is, implementing the above-mentioned method. The memory 102 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 102 may further include a memory remotely located relative to the processor 101, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0066] Transmission device 103 is used to receive or transmit data via a network. This network may include a wireless network provided by the terminal's communications provider. In one embodiment, transmission device 103 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, transmission device 103 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0067] In related technologies, perturbation methods based on devices such as laser diodes or 3D printers have the following limitations:

[0068] (1) Since point cloud data needs to be disturbed, professional equipment support is required, which is costly and difficult to deploy.

[0069] (2) These methods often only target certain specific objects (for example, preventing the target detection system from detecting a vehicle), and the range of objects affected by adversarial samples is relatively limited.

[0070] (3) These methods require access to the structure and parameters of the DNN model, but often only use end-to-end methods to optimize adversarial samples, without differentiated adversarial sample generation strategies for specific models, resulting in poor adversarial sample effects.

[0071] Based on the analysis of the above situation, in one embodiment, Figure 2 A flowchart of a method for generating adversarial patches for image-point cloud fusion perception models is provided. This method can be run on Figure 1 For ease of understanding, Figure 3 A schematic diagram of the process of generating a perceptual heat map for a single first image in this embodiment is provided. Figure 2 and Figure 3 , the method comprises the following steps:

[0072] Step S101: Acquire a first image, randomly initialize a mask and a global perturbation according to the first image, and superimpose the global perturbation on the first image according to the mask to obtain a second image.

[0073] The first image is the original image to be generated for the adversarial sample, that is, Figure 3 The unperturbed image in [ 1 ]. The mask and global perturbation have the same shape as the first image. Specifically, the image, mask, and global perturbation can all be represented in a computer using multidimensional arrays: the image is a (3, h, w) multidimensional array, the mask is a (1, h, w) multidimensional array, and the global perturbation is a (3, h, w) multidimensional array. h is the height, and w is the width. Because the image and perturbation contain color information, with three RGB channels, the first digit of the array is 3. The mask and global perturbation are identical to the first image in terms of number of dimensions, spatial size, and shape structure. All three are three-dimensional arrays, with the mask having 1 channel and the image and perturbation having 3 channels. Their spatial dimensions (height h and width w) are the same, namely, shapes (1, h, w), (3, h, w), and (3, h, w), respectively, satisfying the element-wise operation or superposition condition at the same spatial location.

[0074] The channel value of the mask (referred to as mask value) can be 0, 1, or a value between 0 and 1. The channel value of the mask is used to determine whether the pixel at the corresponding position will be processed or how it will be processed.

[0075] Perturbation refers to making small, almost imperceptible modifications to the input data in order to deceive the machine learning model and make it produce incorrect classification results. For example, in image recognition, the color or brightness of some pixels is changed; in point cloud data, the position of the points is slightly moved or their properties such as reflection intensity are changed. In this embodiment, global perturbation refers to changing or interfering with the entire first image, and the perturbation methods include but are not limited to adding noise, changing brightness or contrast, affine transformation, etc. This step superimposes the global perturbation on the first image according to the mask, which can make the adversarial sample difficult to detect while retaining the key information of the image, or ensure that the adversarial effect persists regardless of the angle from which it is observed.

[0076] As an example, when the global perturbation is superimposed on the first image according to the mask, the positions where the mask value is 1 will change the original image content, while the positions where the mask value is 0 will keep the original image content unchanged, thereby obtaining the second image, that is, Figure 3 The perturbed image in .

[0077] Step S102: Obtain point cloud data corresponding to the first image, input the second image and the point cloud data into a neural network model for training, and obtain a perceptual heat map of the neural network model.

[0078] Point cloud data is a collection of discrete points, each representing a location in three-dimensional space. Each point contains coordinate information (x, y, z) and, optionally, attributes such as color and reflectivity. Point clouds can be acquired using LiDAR. For example, in applications such as self-driving cars, robot navigation, and 3D modeling, LiDAR captures the 3D structure of the environment and outputs point cloud data.

[0079] This embodiment trains a neural network model by inputting benign point cloud data (unperturbed point cloud data) and a second image into the model. The model then generates the sum of the confidence scores for the detection boxes and the mask area. With the optimization goal of minimizing the sum of the confidence scores and the mask area, a gradient descent algorithm is used to perform gradient optimization on the mask and the global perturbation, resulting in an optimized mask. The optimized mask serves as the perceptual heatmap for the neural network model. The trained neural network model possesses a certain degree of perceptual capability, and thus can be defined as an image-point cloud fusion perception model.

[0080] It should be noted that the disturbance object in this embodiment is the first image rather than the point cloud data. When training the neural network model, the input objects are benign point cloud data (undisturbed point cloud data) and the second image (disturbed image), which reduces the requirements for professional equipment and is therefore conducive to reducing costs and deployment difficulty.

[0081] In the process of optimizing the mask, the total confidence of the detection box f score Input to the mean square error function MSE to get the mask loss L mask ; Input the mask area M into the mean square error function MSE to obtain the adversarial loss L adv ; Mask loss L mask With adversarial loss L adv The sum is obtained by adding them together. With the optimization goal of minimizing the sum, the gradient descent algorithm is used to perform gradient optimization on the mask and global perturbation to obtain the perceptual sensitive area of ​​the neural network model. The optimized mask is determined based on the sensitive area. Specifically, the mask optimization problem can be formalized as finding the value of the following formula:

[0082] ;

[0083] in, , ; λ is a hyperparameter, which can be 1, and arg min is used to indicate the parameter value that makes the objective function reach the minimum value.

[0084] In this embodiment, the optimization process for the sum of the two loss functions can be viewed as a dual process: minimizing the adversarial loss requires a stronger perturbation to be superimposed on the image, while conversely, minimizing the mask loss results in a smaller perturbation. Therefore, the optimization process eventually converges, yielding the perceptually sensitive region of the neural network model, i.e., the new mask M.

[0085] Step S103: Determine the perception type of the neural network model based on the similarity between the perception heat map and the actual object distribution; wherein the perception type of the neural network model includes a global perception model and a local perception model.

[0086] The actual object is an object contained in the first image. If the perception heat map and the actual object distribution are determined to be similar, the neural network model is determined to be a local perception model; conversely, if the perception heat map and the actual object distribution are determined to be dissimilar, the neural network model is determined to be a global perception model.

[0087] Step S104: determine the deployment location of the adversarial patch according to the perception type, and model the adversarial patch based on the deployment location to obtain a third image; wherein the deployment location of the global perception model includes the environmental background in the first image, and the deployment location of the local perception model includes the target object in the first image.

[0088] For global perception models, the adversarial patch is pasted into the background (e.g., the ground, a wall). For local perception models, the adversarial patch is pasted onto the target object (e.g., a vehicle, a traffic sign). The deployment schemes for the two aforementioned patches are modeled, with parameters controlling the patch size and pasting location to generate simulated patches in the digital domain. In this application, adversarial patches are a means of implementing adversarial examples. Therefore, adversarial examples appearing in some embodiments of this application may be specifically referred to as adversarial patches.

[0089] Because this embodiment only involves image perturbations, compared to related multimodal perturbations (perturbing both the image and point cloud), the effectiveness of image-modal adversarial examples in this embodiment would be insufficient if traditional unimodal adversarial example generation methods were used. To overcome this issue, this embodiment classifies the trained neural network model (image-point cloud fusion perception model) into either a global or local perception model based on the distribution patterns of the perception heatmap. This leverages the structural differences of the image-point cloud perception model and allows for targeted adversarial patch deployment. This overcomes the insufficient effectiveness of unimodal adversarial examples and improves the effectiveness of adversarial examples.

[0090] In the above steps S101 to S104, the original image is perturbed and a corresponding perceptual heat map is generated. Based on the similarity between the perceptual heat map and the actual object distribution, the perceptual type of the neural network model is determined. Different adversarial patch deployment schemes are selected based on the perceptual type of the neural network model, and the adversarial patches are used to perturb the original image. Compared with related technologies, this embodiment does not require perturbation of point cloud data and only generates adversarial samples in the image modality, which is simple to deploy and low-cost. Moreover, this embodiment fully utilizes the differences in the image-point cloud perception model structure, overcomes the problem of insufficient effectiveness of single-modal adversarial samples, and is conducive to improving the adversarial effect of adversarial samples.

[0091] In one embodiment, randomly initializing the mask according to the first image may be achieved by:

[0092] Assume x is the first image, l is the point cloud data corresponding to the first image. This embodiment perturbs only the image modality. Therefore, under the control of mask M, a global perturbation p is superimposed to generate a second image x', where x' = x⊙(1-M) + p⊙M. Here, ⊙ is the Hadamard product operator, and p is the variable to be optimized, specifically a global perturbation of the same size as the first image x.

[0093] Furthermore, in order to better control the granularity of the perceptual heat map and the convergence speed of the optimization process, this embodiment introduces hyperparameters γ and s to generate the mask M. The specific calculation is as follows:

[0094] ;

[0095] Among them, [i, j] is the pixel position, i is the horizontal coordinate, j is the vertical coordinate, m is the variable to be optimized, and tanh is the hyperbolic tangent function.

[0096] In one embodiment, Figure 4 As shown in the figure, based on the similarity between the perception heat map and the actual object distribution, the perception type of the neural network model is determined, including the following steps:

[0097] In step S201 , the first image and point cloud data are input into a neural network model for training, and an object detection frame is generated on the first image.

[0098] Step S202 : The area surrounded by the object detection frame is set to 1, and the rest of the area is set to 0, to obtain a binary matrix of the same size as the first image.

[0099] Step S203: Determine whether the perception heat map and the binary matrix meet the preset conditions:

[0100] ;

[0101] Among them, x is the first image, M x is the perceptual heat map generated for the first image (i.e., the optimized mask), is a binary matrix, E x is the mean of the expression obtained for the perceptual heat maps generated by different first images, β is a hyperparameter that can take the value 3, ⊙ is the Hadamard product operator, and ∑ is the summation operator.

[0102] In step S204, if the perception heat map and the binary matrix meet the above conditions, it is determined that the perception heat map and the actual object distribution are similar, and the perception type of the neural network model is determined to be a local perception model.

[0103] In step S205 , if the perception heat map and the binary matrix do not meet the above conditions, it is determined that the perception heat map and the actual object distribution are not similar, and the perception type of the neural network model is determined to be a global perception model.

[0104] In this embodiment, by analyzing the distribution pattern of the perception heat map, a quantitative discrimination rule is designed to ensure accurate judgment of the perception type of the image-point cloud perception model.

[0105] In one embodiment, Figure 5 As shown in Figure 2, modeling the adversarial patch based on the deployment location includes the following steps:

[0106] Step S301: Determine the position parameters of the adversarial patch.

[0107] For ease of understanding, Figure 6 A schematic diagram of the process of deploying anti-patches on the ground is provided. Figure 5 and Figure 6 As shown in Figure 2, assuming that the adversarial patch has a rectangular structure, the rectangular adversarial patch will be deployed on the ground, and several position parameters h, w, x, y and α are used to describe the deployment scheme of the adversarial patch, as follows:

[0108] Set the parameters h and w to control the height and width of the adversarial patch respectively, set the parameters x and y to control the x and y coordinates of the center of the adversarial patch in the 3D radar coordinate system (the xy plane is parallel to the ground), and set the parameter α to control the rotation angle of the adversarial patch in the xy plane.

[0109] Step S302 : Based on the position parameter, project the adversarial patch into the pixel coordinate system of the first image according to the deployment position to obtain pixel perturbation.

[0110] Obtain device parameters and the physical position parameters of the adversarial patch; where the device parameters include the external parameters of the lidar and the internal parameters of the camera; determine a mapping relationship based on the device parameters, substitute the physical position parameters of the adversarial patch into the mapping relationship, and solve to obtain pixel coordinates; use a bilinear interpolation algorithm to calculate the pixel value corresponding to the pixel coordinate to obtain the pixel perturbation.

[0111] Step S303: superimpose the pixel disturbance on the first image to obtain a third image.

[0112] In this embodiment, for any given adversarial patch, a model is created using a corresponding deployment scheme, and the 3D positions of the adversarial patch's vertices in the LiDAR coordinate system are calculated. Based on the camera imaging model and using camera-LiDAR parameters (obtained through joint camera-LiDAR calibration), the pixel positions of the 3D positions projected onto the pixel coordinate system are calculated. Finally, bilinear interpolation is used to calculate the pixel values ​​of the corresponding region. This simulated perturbation is then superimposed on the original first image to produce the third image.

[0113] In one embodiment, after superimposing the pixel perturbation on the first image to obtain the third image, the method further includes:

[0114] The adversarial patch is subjected to random data augmentation processing, and the adversarial patch after random data augmentation processing is superimposed on the first image to obtain a fourth image; multiple fourth images are input into the neural network model as samples, and the average value of the neural network loss is calculated; with minimizing the average value of the neural network loss as the optimization goal, the pixel value of the adversarial patch is gradient optimized using the gradient descent algorithm, and the optimized adversarial patch is used as the new adversarial patch.

[0115] In this embodiment, the data random enhancement process includes at least one of the following:

[0116] (1) Randomly transform the size and physical location parameters of the adversarial patch. Considering the error between the size of the adversarial patch and the actual deployed physical location, the size and physical location of the adversarial patch can be randomly transformed by randomly transforming the location parameters (h, w, x, y, and α) of the adversarial patch.

[0117] (2) Randomly transform the contrast, saturation, and brightness of the adversarial patch. Taking into account the changes in lighting conditions in the physical world, the contrast, saturation, and brightness of the adversarial patch color are randomly transformed within a certain range to simulate the color of the adversarial patch captured by the camera under different lighting conditions.

[0118] (3) During the training of the neural network model, random perturbations at the pixel level are superimposed on the adversarial patch. Taking into account the printing error of the printer color, random perturbations at the pixel level are superimposed on the adversarial patch color when training the neural network model.

[0119] (4) During the training of the neural network model, random perturbations at the pixel level are superimposed on the adversarial patch, and random noise is added to the injected random perturbations. In practical applications, images are often affected by noise from the camera itself and environmental interference. To solve this problem, a small amount of random Gaussian noise can be added to the perturbed image (the second image). This random Gaussian noise does not need to completely conform to the Gaussian distribution, which can improve the physical feasibility of the adversarial sample to a certain extent.

[0120] In this embodiment, after determining the deployment location of the adversarial patch based on the perception type and modeling the adversarial patch based on the deployment location, a systematic analysis of numerous physical factors influencing the induced perturbation (i.e., errors in the physical world's adversarial patch deployment location and illumination variations, camera noise, and printer color deviation) is performed. The adversarial patch is then randomly augmented using the concept of expected transformation. This augmented patch is then superimposed on the first image to generate a fourth image. Using these fourth images as sample inputs, the average neural network loss of the neural network model is calculated and used as the optimization target to optimize the adversarial patch. This approach compensates for environmental variations and printer color deviation, enhancing the physical robustness of the adversarial sample.

[0121] In one embodiment, multiple fourth images are input as samples into a neural network model, and the average value of the neural network loss is calculated. With minimizing the average value of the neural network loss as the optimization goal, a gradient descent algorithm is used to perform gradient optimization on the pixel values ​​of the adversarial patch, which can be achieved by the following method:

[0122] The adversarial patch, which has undergone random data augmentation, is superimposed on the first image to generate a fourth image. Multiple fourth images are fed into the neural network model as samples to obtain the sum of the detection box confidences and the smoothness of the adversarial patch. The sum of the detection box confidences and the smoothness of the adversarial patch are summed to obtain the neural network loss. The neural network loss of the multiple fourth images is averaged, with minimizing the average neural network loss as the optimization goal. The pixel values ​​of the adversarial patch are gradient-optimized using a gradient descent algorithm, and the optimized adversarial patch is used as the new adversarial patch.

[0123] In this embodiment, the perturbed superposition image (i.e., the fourth image) after random data augmentation is used as the input of the neural network model, and the generation of adversarial patches is transformed into an end-to-end optimization problem. In order to generate more visually natural adversarial patches, the total variation loss L is introduced. tv To optimize the color smoothness of the adversarial patch. The specific calculation formula is as follows:

[0124] ;

[0125] Among them, x i,j represents the pixel value at row i and column j in the adversarial patch.

[0126] For the image-point cloud fusion perception model, this embodiment selects the adversarial loss L adv With the total variational loss L tv The sum of the two is used as the loss function, and the Adam optimizer is used to perform gradient optimization on the pixel values ​​of the adversarial patch through the gradient descent algorithm; it is judged whether the original image after the adversarial patch perturbation meets the adversarial sample requirements; if not, gradient optimization is performed to update the pixel values ​​of the adversarial patch and the next round of iteration is carried out; otherwise, the iteration is stopped and the current adversarial patch is used as the new adversarial patch to enhance the adversarial effect of the adversarial patch.

[0127] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0128] In one embodiment, Figure 7A flowchart of another adversarial patch generation method for image-point cloud fusion perception model is provided, such as Figure 7 As shown, the method includes the following steps:

[0129] Step S401, obtaining the structure and parameters of the image-point cloud fusion perception model;

[0130] Step S402: generating corresponding perception heat maps for different original images based on the image-point cloud fusion perception model, and determining the perception type of the image-point cloud fusion perception model;

[0131] Step S403: determining a deployment location of the adversarial patch based on the perception type of the image-point cloud fusion perception model, and projecting the adversarial patch in the digital domain to the deployment location based on the camera imaging model;

[0132] Step S404: performing data augmentation on the generated adversarial patches to generate multiple randomly transformed images with adversarial patches as input to the image-point cloud fusion perception model;

[0133] Step S405 , using a gradient descent algorithm to iteratively optimize and update the pixel values ​​of the adversarial patch, and when the iterative stop condition is reached or the maximum number of iterations is exceeded, a feasible adversarial patch in the physical domain is obtained.

[0134] Based on the same inventive concept, an embodiment of the present application also provides an electronic device for implementing the above-mentioned adversarial patch generation method for the image-point cloud fusion perception model. The electronic device includes a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above-mentioned method embodiments.

[0135] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0136] Optionally, in this embodiment, the processor may be configured to execute the following steps through a computer program:

[0137] Obtain a first image, randomly initialize a mask and a global perturbation according to the first image, and superimpose the global perturbation on the first image according to the mask to obtain a second image;

[0138] Obtaining point cloud data corresponding to the first image, inputting the second image and the point cloud data into a neural network model for training, and obtaining a perception heat map of the neural network model;

[0139] Determine the perception type of the neural network model based on the similarity between the perception heat map and the actual object distribution; the perception type of the neural network model includes a global perception model and a local perception model;

[0140] Determine the deployment location of the adversarial patch according to the perception type, and model the adversarial patch based on the deployment location to obtain a third image; wherein the deployment location of the global perception model includes the environmental background in the first image, and the deployment location of the local perception model includes the target object in the first image.

[0141] It should be noted that, for specific examples in this embodiment, reference may be made to the examples described in the above embodiments and optional implementation modes, and will not be repeated in this embodiment.

[0142] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor, memory, a communication interface, a display screen, and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal via wired or wireless communication. The wireless communication can be achieved via Wi-Fi, a mobile cellular network, NFC (near-field communication), or other technologies. When executed by the processor, the computer program implements a method for generating adversarial patches for an image-point cloud fusion perception model. The display screen of the computer device can be a liquid crystal display or an electronic ink display. The input device of the computer device can be a touch layer covering the display screen, or keys, a trackball, or a touchpad provided on the computer device housing, or an external keyboard, touchpad, or mouse.

[0143] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0144] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above method embodiments are implemented.

[0145] In one embodiment, a computer program product is provided, comprising a computer program, which implements the steps of any of the above method embodiments when executed by a processor.

[0146] In one embodiment, the computer program, when executed by a processor, implements the following method steps:

[0147] Obtain a first image, randomly initialize a mask and a global perturbation according to the first image, and superimpose the global perturbation on the first image according to the mask to obtain a second image;

[0148] Obtaining point cloud data corresponding to the first image, inputting the second image and the point cloud data into a neural network model for training, and obtaining a perception heat map of the neural network model;

[0149] Determine the perception type of the neural network model based on the similarity between the perception heat map and the actual object distribution; the perception type of the neural network model includes a global perception model and a local perception model;

[0150] Determine the deployment location of the adversarial patch according to the perception type, and model the adversarial patch based on the deployment location to obtain a third image; wherein the deployment location of the global perception model includes the environmental background in the first image, and the deployment location of the local perception model includes the target object in the first image.

[0151] In one embodiment, the computer program, when executed by a processor, implements the following method steps:

[0152] Obtain the total confidence score and mask area of ​​the detection box generated by the neural network model;

[0153] Taking minimizing the sum of the confidence scores of the detection boxes and the mask area as the optimization goal, the gradient descent algorithm is used to perform gradient optimization on the mask and global perturbation to obtain the optimized mask;

[0154] The optimized mask is used as the perceptual heatmap of the neural network model.

[0155] In one embodiment, the computer program, when executed by a processor, implements the following method steps:

[0156] Set the hyperparameters γ and s, and set the variable m and global perturbation p;

[0157] The mask is generated according to the following formula:

[0158] ;

[0159] Where M is the mask, [i, j] is the pixel position, and tanh is the hyperbolic tangent function.

[0160] In one embodiment, the computer program, when executed by a processor, implements the following method steps:

[0161] Inputting the first image and the point cloud data into a neural network model for training, and generating an object detection frame on the first image;

[0162] Set the area surrounded by the object detection frame to 1 and the rest to 0 to obtain a binary matrix of the same size as the first image;

[0163] Determine whether the perceptual heat map and binary matrix meet the following conditions:

[0164] ;

[0165] Among them, x is the first image, M x is the perceptual heat map generated for the first image, is a binary matrix, E x is the mean of the expression obtained for the perceptual heatmaps generated by different first images, β is a hyperparameter, ⊙ is the Hadamard product operator, and ∑ is the summation operator;

[0166] If the perception heat map and the binary matrix meet the above conditions, it is determined that the perception heat map and the actual object distribution are similar, and the perception type of the neural network model is determined to be a local perception model;

[0167] If the perception heat map and the binary matrix do not meet the above conditions, it is determined that the perception heat map and the actual object distribution are not similar, and the perception type of the neural network model is determined to be a global perception model.

[0168] In one embodiment, the computer program, when executed by a processor, implements the following method steps:

[0169] Determine the location parameters of the adversarial patch;

[0170] Based on the position parameter, the adversarial patch is projected into the pixel coordinate system of the first image according to the deployment position to obtain the pixel perturbation;

[0171] The pixel perturbation is superimposed on the first image to obtain a third image.

[0172] In one embodiment, the computer program, when executed by a processor, implements the following method steps:

[0173] Obtain device parameters and the physical location parameters of the adversarial patch; the device parameters include the external parameters of the lidar and the internal parameters of the camera;

[0174] Determine the mapping relationship based on the device parameters, substitute the physical position parameters of the adversarial patch into the mapping relationship, and solve to obtain the pixel coordinates;

[0175] The pixel value corresponding to the pixel coordinate is calculated using a bilinear interpolation algorithm to obtain the pixel perturbation.

[0176] In one embodiment, the computer program, when executed by a processor, implements the following method steps:

[0177] Performing random data augmentation processing on the adversarial patch, and superimposing the adversarial patch after the random data augmentation processing on the first image to obtain a fourth image;

[0178] Inputting the plurality of fourth images as samples into the neural network model, and calculating the average of the neural network loss;

[0179] Taking minimizing the average value of the neural network loss as the optimization goal, the gradient descent algorithm is used to perform gradient optimization on the pixel values ​​of the adversarial patch, and the optimized adversarial patch is used as the new adversarial patch.

[0180] In one embodiment, the computer program, when executed by a processor, implements the following method steps:

[0181] Randomly transform the size and physical location parameters of the adversarial patch;

[0182] Randomly transform the contrast, saturation, and brightness of the adversarial patch;

[0183] During the training of the neural network model, pixel-level random perturbations are superimposed on the adversarial patches;

[0184] During the training of the neural network model, pixel-level random perturbations are superimposed on the adversarial patches, and random noise is added to the injected random perturbations.

[0185] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0186] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the above-described method embodiments. Any reference to a memory, database, or other medium used in the embodiments provided herein may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processors (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), data processing logic devices based on quantum computing, and the like.

[0187] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0188] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for generating adversarial patches for image-point cloud fusion perception models, characterized in that: include: Acquire a first image, randomly initialize a mask and a global perturbation according to the first image, and superimpose the global perturbation on the first image according to the mask to obtain a second image; Acquire point cloud data corresponding to the first image, input the second image and the point cloud data into a neural network model for training, and obtain a perception heat map of the neural network model; Determining the perception type of the neural network model based on the similarity between the perception heat map and the actual object distribution; wherein the perception type of the neural network model includes a global perception model and a local perception model; Determining a deployment location of the adversarial patch according to the perception type, and modeling the adversarial patch based on the deployment location to obtain a third image; wherein the deployment location of the global perception model includes the environmental background in the first image, and the deployment location of the local perception model includes the target object in the first image; The second image and the point cloud data are input into a neural network model for training to obtain a perceptual heat map of the neural network model, including: Obtaining a total confidence score of the detection box and a mask area generated by processing the neural network model; Taking minimizing the sum of the confidence scores of the detection boxes and the area of ​​the mask as the optimization goal, a gradient descent algorithm is used to perform gradient optimization on the mask and the global perturbation to obtain an optimized mask; The optimized mask is used as a perceptual heat map of the neural network model.

2. The method for generating adversarial patches for an image-point cloud fusion perception model according to claim 1, characterized in that: Randomly initializing a mask according to the first image, comprising: Set the hyperparameters γ and s, and set the variable m and global perturbation p; The mask is generated according to the following formula: ； Wherein, M is the mask, [i, j] is the pixel position, and tanh is the hyperbolic tangent function.

3. The method for generating adversarial patches for an image-point cloud fusion perception model according to claim 1, characterized in that: Determining the perception type of the neural network model based on the similarity between the perception heat map and the actual object distribution includes: Inputting the first image and the point cloud data into the neural network model for training, and generating an object detection frame on the first image; Set the area surrounded by the object detection frame to 1 and the rest to 0 to obtain a binary matrix of the same size as the first image; Determine whether the perceptual heat map and the binary matrix meet the following conditions: ； Wherein, x is the first image, M x is the perceptual heat map generated for the first image, is the binary matrix, E x is the mean of the expression obtained for the perceptual heat maps generated by different first images, β is a hyperparameter, ⊙ is the Hadamard product operator, and ∑ is the summation operator; If the perception heat map and the binary matrix meet the above conditions, it is determined that the perception heat map and the actual object distribution are similar, and the perception type of the neural network model is determined to be a local perception model; If the perception heat map and the binary matrix do not meet the above conditions, it is determined that the perception heat map and the actual object distribution are not similar, and the perception type of the neural network model is determined to be a global perception model.

4. The method for generating adversarial patches for an image-point cloud fusion perception model according to claim 1, characterized in that: Modeling the adversarial patch based on the deployment position to obtain a third image includes: determining position parameters of the adversarial patch; projecting the adversarial patch into a pixel coordinate system of the first image at the deployment position according to the position parameter to obtain a pixel perturbation; The pixel perturbation is superimposed on the first image to obtain the third image.

5. The method for generating adversarial patches for an image-point cloud fusion perception model according to claim 4, characterized in that: Projecting the adversarial patch into the pixel coordinate system according to the deployment position to obtain a pixel perturbation includes: Obtaining device parameters and physical position parameters of the adversarial patch; wherein the device parameters include external parameters of the lidar and internal parameters of the camera; Determine a mapping relationship according to the device parameters, substitute the physical position parameters of the adversarial patch into the mapping relationship, and solve to obtain pixel coordinates; A bilinear interpolation algorithm is used to calculate a pixel value corresponding to the pixel coordinate to obtain the pixel disturbance.

6. The method for generating adversarial patches for an image-point cloud fusion perception model according to claim 4, characterized in that: After superimposing the pixel disturbance on the first image to obtain the third image, the method further includes: performing random data augmentation processing on the adversarial patch, and superimposing the adversarial patch after the random data augmentation processing onto the first image to obtain a fourth image; Inputting a plurality of the fourth images as samples into the neural network model, and calculating an average value of the neural network loss; Taking minimizing the average value of the neural network loss as the optimization goal, a gradient descent algorithm is used to perform gradient optimization on the pixel values ​​of the adversarial patch, and the optimized adversarial patch is used as a new adversarial patch.

7. The method for generating adversarial patches for an image-point cloud fusion perception model according to claim 6, characterized in that: Performing random data augmentation processing on the adversarial patch includes at least one of the following: Randomly transforming the size and physical position parameters of the adversarial patch; Randomly transforming the contrast, saturation, and brightness of the adversarial patch; During the training of the neural network model, superimposing pixel-level random perturbations on the adversarial patch; During the training process of the neural network model, pixel-level random perturbations are superimposed on the adversarial patch, and random noise is added to the injected random perturbations.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images