Physical adversarial patch generation method and system for improving mobility based on data enhancement and electronic equipment
Grad-CAM evaluates pixel contribution and blocks data enhancement strategies for non-critical areas, and generates adversarial patches, solving the problem of ignoring pixel contribution differences in the prior art, and achieving efficient migration of adversarial patches between different models.
Patent Information
- Application Number
- CN202510374111.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-27
- Publication Date
- 2025-08-05
AI Technical Summary
Existing data-enhanced approaches fail to fully consider the differences in the importance of different pixels to model decisions when improving the migration of adversarial patches, resulting in limited attack effects of adversarial patches on different models.
By introducing class activation mapping (Grad-CAM), the pixel contribution is evaluated, and the model uses the similar characteristics of the focus area of the same image, data augmentation is performed by masking non-critical areas, adversarial samples are generated, and backpropagation is optimized by optimizing the loss function.
The migration ability of the anti-patch patch in the black box environment is improved, ensuring that the attack success rate of the black box model is high, while also having a significant attack success rate on the black box model.
Smart Images
Figure CN120431440A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of deep neural network machine vision technology, and in particular to a method, system, and electronic device for generating physical adversarial patches with improved transferability based on data enhancement. Background Art
[0002] An adversarial patch is a special type of adversarial example, typically a small image region with a specific perturbation. It is designed to induce incorrect predictions in the target model without modifying the entire input image. Compared to traditional adversarial perturbations, adversarial patches are independent and can be superimposed on the original image to achieve the desired attack.
[0003] Adversarial patch transferability refers to the ability of a well-designed adversarial patch to not only successfully attack a specific model but also maintain a high attack success rate on other models. In real-world scenarios, attackers often lack access to the target model's structure or parameters (such as in black-box scenarios). Transferability allows attackers to generate adversarial patches on known models and apply them to other, unknown models.
[0004] Existing approaches to improve the transferability of adversarial patches include ensemble model training and data transformation-based methods. By jointly training adversarial patches on multiple models, the patches can be simultaneously effective against multiple target models. A typical approach involves using a collection of models and jointly optimizing their gradients during patch generation.
[0005] Most existing data augmentation methods simply perform random transformations (such as cropping, scaling, and rotation) on the input image and adversarial patches to enhance the robustness of the patches and improve their transferability across different models. However, these data augmentation methods still have the following shortcomings:
[0006] During deep neural network (DNN) predictions, different pixels have significantly different importance for model decisions. However, existing input transformation methods (such as random cropping, padding, and grid occlusion) typically perform random processing on all pixels in the input image, failing to fully consider the importance of key pixel regions. This "one-size-fits-all" data augmentation approach makes it difficult to effectively perturb the model's regions of interest, thus limiting the effectiveness of adversarial patches.
[0007] When processing images, deep neural networks typically pay close attention to similar regions, despite varying model architectures. These regions often serve as key decision-making factors for classification or object detection. However, existing methods fail to effectively leverage this property, making it difficult to improve the transferability of adversarial patches by optimizing the distribution of the model's attention regions.
[0008] In summary, existing methods mainly have problems such as ignoring pixel contribution differences and lacking enhancement strategies for model attention. Summary of the Invention
[0009] In response to the problems of existing data enhancement-based adversarial patch transferability improvement, such as ignoring pixel contribution differences and lacking enhancement strategies for model attention, the present invention proposes a physical adversarial patch generation method, system and electronic device based on data enhancement to improve transferability. By introducing Class Activation Mapping (CAM) to evaluate pixel contributions and taking advantage of the fact that different models pay attention to similar areas of the same image, data enhancement is achieved by masking key areas according to a certain ratio, effectively improving the transferability of adversarial patches in a black box environment.
[0010] In order to achieve the above object, the present invention adopts the following technical solutions:
[0011] In a first aspect, the present invention proposes a method for generating physical adversarial patches with improved transferability based on data enhancement, comprising:
[0012] Step 1: Initialize random noise of a predefined size, perform EOT expected transformation on the random noise, and obtain the random noise after EOT expected transformation;
[0013] Step 2: Use data enhancement strategies to enhance the non-important areas of the original image to obtain an enhanced image;
[0014] Step 3: Apply the random noise after the EOT expected transformation to the enhanced image through the adversarial patch application function to generate adversarial samples;
[0015] Step 4: Input the generated adversarial sample into the target detection model, update and optimize it through back propagation of the optimized loss function, and then generate an adversarial patch.
[0016] Furthermore, the random noise is one of a grayscale image, a random image, and an image of a specified path.
[0017] Furthermore, the data enhancement strategy includes:
[0018] Step a: Obtain the CAM heatmap of the original image relative to the pre-trained object detection model through Grad-CAM;
[0019] Step b: Set multiple target ratios, set the high response value part of the CAM heat map to 0, and the low response value part to -1, to obtain multiple (0, -1) mask matrices;
[0020] Step c: After performing a dot product of the mask matrix and the CAM heat map, the mask matrix is fused with the original image according to a uniform preset fusion ratio to obtain multiple enhanced images.
[0021] Furthermore, step 4 also includes applying the optimized loss function to the multiple enhanced images respectively and then calculating the average loss, and using the average loss to perform backpropagation update and optimization to generate the adversarial patch.
[0022] Furthermore, the optimization loss function includes the target detection loss function L det , unprintable loss function L NPS And the overall variation loss function L total :
[0023] loss = L det +L NPS +L total
[0024] Among them, loss is the optimization loss function, the target detection loss function L det The maximum confidence score output by the object detection model is used as the detection loss.
[0025] Furthermore, it also includes evaluating the transferability of the generated adversarial patches;
[0026] The evaluating the transferability of the generated adversarial patch includes: applying the generated adversarial patch to other target detection models through a patch application function for testing, and evaluating the attack success rate of the generated adversarial patch on the other target detection models.
[0027] In a second aspect, the present invention provides a data-enhanced physical adversarial patch generation system for improving transferability, comprising:
[0028] Initialization module: used to initialize random noise of a predefined size, perform EOT expected transformation on the random noise, and obtain the random noise after EOT expected transformation;
[0029] Enhanced image acquisition module: used to perform data enhancement on non-important areas of the original image using data enhancement strategies to obtain enhanced images;
[0030] Adversarial sample generation module: used to apply random noise after the expected EOT transformation to the enhanced image through the adversarial patch application function to generate adversarial samples;
[0031] Adversarial patch acquisition module: used to input the generated adversarial samples into the target detection model, update and optimize them through back propagation of the optimized loss function, and then generate adversarial patches.
[0032] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, a method for generating physical adversarial patches with improved transferability based on data enhancement is implemented as described above.
[0033] Compared with the prior art, the present invention has the following beneficial effects:
[0034] The present invention provides a data-augmented method, system, and electronic device for generating physical adversarial patches with improved transferability. This method applies the principle that each pixel contributes differently to the model, but different models focus on similar areas on the same image. The present invention uses Gradient Camera (GradCAM) to evaluate the contribution of different regions in the input data to the prediction results. It then uses an attention heatmap to mask key model regions at varying scales, indirectly increasing the model's focus on non-critical regions and weakening its focus on key regions, thereby improving the transferability of adversarial patches in a black-box environment. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive effort.
[0036] Figure 1 A schematic diagram of the structure of a method for generating physical adversarial patches with improved transferability based on data enhancement provided by an embodiment of the present invention;
[0037] Figure 2 A flow chart of the data enhancement strategy provided by an embodiment of the present invention;
[0038] Figure 3 A flowchart of the adversarial patch training phase provided by an embodiment of the present invention;
[0039] Figure 4 A flow chart for evaluating the transferability of new adversarial patches provided by an embodiment of the present invention;
[0040] Figure 5 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0041] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.
[0042] like Figure 1 As shown, an embodiment of the present invention provides a method for generating physical adversarial patches with improved transferability based on data enhancement, including:
[0043] S101: Initialize random noise of a predefined size, perform an EOT expected transformation on the random noise, and obtain the random noise after the EOT expected transformation.
[0044] Specifically, the random noise is one of a grayscale image, a random image, and an image of a specified path.
[0045] Specifically, EOT (Expectation Over Transformation) refers to performing multiple random transformations (rotation, scaling, translation, noise, brightness changes) on random noise to simulate the physical environment where patches may change due to different angles, distances, or lighting.
[0046] S102: Perform data enhancement on the non-important areas of the original image using a data enhancement strategy to obtain an enhanced image.
[0047] Specifically, the data enhancement strategy includes:
[0048] Step a: Obtain the CAM heatmap of the original image relative to the pre-trained object detection model through Grad-CAM;
[0049] Step b: Set multiple target ratios, set the high response value part of the CAM heat map to 0, and the low response value part to -1, to obtain multiple (0, -1) mask matrices;
[0050] Step c: perform dot multiplication of the mask matrix and the attention heat map and fuse them with the original image according to a uniform preset fusion ratio to obtain multiple enhanced images.
[0051] In fact, the data enhancement strategy generates a CAM heat map, calculates the class activation map of the original image through the last layer output of the pre-trained target detection model, and identifies the areas in the image that have the greatest impact on the model prediction; the important areas of the pre-trained target detection model are obtained through the CAM heat map, and the non-important areas of the image are enhanced, thereby shifting the model's focus to the areas.
[0052] like Figure 2 As shown in the figure, as an implementable method, the data augmentation strategy uses Grad_CAM to obtain a CAM heat map of the original image relative to a pre-trained target detection model. By setting different ratios q, the parts with high response values (higher than the ratio q) are set to 0, and the parts with low response values (lower than the ratio q) are set to -1, resulting in multiple (0, -1) mask matrices. The mask matrix is dot-multiplied with the CAM heat map and then fused with the original image at a uniform preset ratio to obtain multiple images. The multiple images are a set of enhanced images obtained by applying the data augmentation strategy to the original image. At the same time, the enhanced image can be combined with other enhancement operations to generate more diverse enhanced samples.
[0053] Specifically, the data augmentation strategy uses Grad_CAM to generate a CAM heatmap of the original image. It then mines the areas of the input image that have the greatest impact on the object detector. The pixels in the CAM heatmap that have a significant impact on the object detector's results are masked at a preset ratio. The masked CAM heatmap is then fused with the original image using a blending operation. The enhanced image is generated by blending the masked CAM heatmap with the original image using preset weight parameters.
[0054] S103: Apply the random noise after the expected EOT transformation to the enhanced image through the adversarial patch application function to generate an adversarial sample;
[0055] Specifically, the adversarial patch application function generates a mask by locating the target area, and embeds the optimized patch into the enhanced image to obtain an adversarial sample.
[0056] The adversarial patch application function generates a mask matrix of the same size as the original sample based on the label of the original sample. In the mask matrix, '1' represents the pixel where the adversarial patch is applied, and '0' represents the pixel where the original sample is applied.
[0057] In practice, the output of the adversarial patch application function should be designed according to the variety of random transformation strategies and the diversity of their parameter sets to ensure that each transformation operation and its effects under different parameter settings can be fully characterized, thereby achieving the adaptability of the patch in multiple scenarios.
[0058] S104: Input the generated adversarial sample into the target detection model, update and optimize it through back propagation of the optimized loss function, and then generate an adversarial patch.
[0059] Specifically, if Figure 3 As shown in Figure 2, the adversarial sample is input into the target detection model, and the effectiveness of the adversarial patch is guaranteed by minimizing the maximum confidence score output by the target detection model.
[0060] Specifically, S104 further includes applying the optimized loss function to the multiple enhanced images respectively and then calculating the average loss, and using the average loss to perform backpropagation update and optimization to generate the adversarial patch.
[0061] Specifically, the optimization loss function includes the target detection loss function L det , unprintable loss function L NPS And the overall variation loss function L total :
[0062] loss = L det +L NPS +L total
[0063] Among them, loss is the optimization loss function, and the target detection loss function L det The maximum confidence score output by the object detection model is used as the object detection loss.
[0064] Unprintable loss function L NPS Indicates whether the optimized patch can be printed by a normal printer. For a given adversarial patch p, the unprintable loss function L NPS The expression is:
[0065]
[0066] Among them, p (i,j) represents the pixel at coordinate (i, j) in the adversarial patch p, c ptint Represents a set of printable RGB triples;
[0067] Unprintable loss function L NPS Calculate the loss between the original sample pixel value and the pixel value within the printable range of the printer, and limit the pixels of the adversarial patch to the printable range of the printer by minimizing the unprintable loss; calculate the loss between the original sample pixel value and the pixel value within the printable range of the printer to ensure that the optimized adversarial patch can be printed.
[0068] Overall variation loss function L total represents the total variation of the applied adversarial patch. For a given adversarial patch p, the overall variation loss function L total The expression is:
[0069]
[0070] Among them, p (i,j) Represents the pixel at coordinate (i, j) in the adversarial patch p. The overall variation loss function L total Reduce the noise and unnaturalness of the adversarial patch, so that the generated results are smoother, closer to the real image or have better visual effects.
[0071] Based on the above embodiments, Figure 4 As shown, an embodiment of the present invention also provides a method for evaluating the transferability of a generated adversarial patch, including: applying the generated adversarial patch to other target detection models through a patch application function for testing, and evaluating the attack success rate of the generated adversarial patch on other target detection models.
[0072] Specifically, the transferability is expressed as the attack success rate of applying the adversarial patch generated on one target detection model to another target detection model. Usually, the first target detection model is called a white-box model, and the second target detection model is called a black-box model.
[0073] As an implementable method, the visdrone2019 dataset is used and yolov3 (white box model) is used as a pre-trained target detection model to optimize the adversarial patch. VisDrone2019 is a dataset containing 288 video clips and 10,209 static images. The adversarial patch optimized based on the data augmentation strategy is tested on other target detection models (black box models). Experiments have shown that the present invention effectively shifts the model's area of interest by utilizing the similarity of different models' focus areas on the same image. While ensuring a high attack success rate for the white box model, it also has a similar attack success rate for other black box models.
[0074] Based on the above embodiments, the present invention provides a data-enhanced physical adversarial patch generation system with improved transferability, comprising:
[0075] Initialization module: used to initialize random noise of a predefined size, perform EOT expected transformation on the random noise, and obtain the random noise after EOT expected transformation;
[0076] Enhanced image acquisition module: used to perform data enhancement on non-important areas of the original image using data enhancement strategies to obtain enhanced images;
[0077] Adversarial sample generation module: used to apply random noise after the expected EOT transformation to the enhanced image through the adversarial patch application function to generate adversarial samples;
[0078] Adversarial patch acquisition module: used to input the generated adversarial samples into the target detection model, update and optimize them through back propagation of the optimized loss function, and then generate adversarial patches.
[0079] Based on the above embodiments, Figure 5As shown, an embodiment of the present invention further provides an electronic device, which may include: a processor (processor) 501, a communication interface (Communications Interface) 502, a memory (memory) 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other via the communication bus 504. The processor 501 may call the logic instructions in the memory 503 to execute the method provided in the above embodiment, for example, including:
[0080] S101: Initialize random noise of a predefined size, perform an EOT expected transformation on the random noise, and obtain the random noise after the EOT expected transformation; S102: Use a data enhancement strategy to perform data enhancement on non-important areas of the original image to obtain an enhanced image; S103: Apply the random noise after the EOT expected transformation to the enhanced image through an adversarial patch application function to generate an adversarial sample; S104: Input the generated adversarial sample into the target detection model, update and optimize it through back propagation of the optimized loss function, and generate an adversarial patch.
[0081] In addition, when the logic instructions in the above-mentioned memory 503 are implemented in the form of a software functional unit and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
[0082] In summary, the data augmentation strategy proposed in this paper constructs an effective adversarial sample generation framework by extracting the attention of different image regions, masking the high-response regions with a set ratio, and then proportionally fusing the transferred sample's attention regions with the original image. The adversarial patches generated in this way not only achieve a high attack success rate in white-box models but also exhibit good transferability, with a significant attack success rate against black-box models as well, validating the effectiveness and versatility of the method.
[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.
Claims
1. A method for generating physical adversarial patches with improved transferability based on data augmentation, characterized in that: include: Step 1: Initialize random noise of a predefined size, perform EOT expected transformation on the random noise, and obtain the random noise after EOT expected transformation; Step 2: Use data enhancement strategies to enhance the non-important areas of the original image to obtain an enhanced image; Step 3: Apply the random noise after the EOT expected transformation to the enhanced image through the adversarial patch application function to generate adversarial samples; Step 4: Input the generated adversarial sample into the target detection model, update and optimize it through back propagation of the optimized loss function, and then generate an adversarial patch.
2. The method for generating physical adversarial patches with improved transferability based on data enhancement according to claim 1, characterized in that: The random noise is one of a grayscale image, a random image, and an image of a specified path.
3. The method for generating physical adversarial patches with improved transferability based on data enhancement according to claim 1, characterized in that: The data enhancement strategy includes: Step a: Obtain the CAM heatmap of the original image relative to the pre-trained object detection model through Grad-CAM; Step b: Set multiple target ratios, set the high response value part of the CAM heat map to 0, and the low response value part to -1, to obtain multiple (0, -1) mask matrices; Step c: After performing a dot product of the mask matrix and the CAM heat map, the mask matrix is fused with the original image according to a uniform preset fusion ratio to obtain multiple enhanced images.
4. The method for generating physical adversarial patches with improved transferability based on data enhancement according to claim 3, characterized in that: The step 4 further includes applying the optimized loss function to the multiple enhanced images respectively and then calculating the average loss, and using the average loss to perform backpropagation update and optimization to generate the adversarial patch.
5. The method for generating physical adversarial patches with improved transferability based on data enhancement according to claim 4, characterized in that: The optimization loss function includes the target detection loss function L det , unprintable loss function L NPS And the overall variation loss function L total : loss=L det +L NPS +L total Among them, loss is the optimization loss function, the target detection loss function L det The maximum confidence score output by the object detection model is used as the detection loss.
6. The method for generating physical adversarial patches with improved transferability based on data enhancement according to claim 1, characterized in that: It also includes evaluating the transferability of the generated adversarial patches; The evaluating the transferability of the generated adversarial patch includes: applying the generated adversarial patch to other target detection models through a patch application function for testing, and evaluating the attack success rate of the generated adversarial patch on the other target detection models.
7. A data-augmented physical adversarial patch generation system with improved transferability, characterized in that: include: Initialization module: used to initialize random noise of a predefined size, perform EOT expected transformation on the random noise, and obtain the random noise after EOT expected transformation; Enhanced image acquisition module: used to perform data enhancement on non-important areas of the original image using data enhancement strategies to obtain enhanced images; Adversarial sample generation module: used to apply random noise after the expected EOT transformation to the enhanced image through the adversarial patch application function to generate adversarial samples; Adversarial patch acquisition module: used to input the generated adversarial samples into the target detection model, update and optimize them through back propagation of the optimized loss function, and then generate adversarial patches.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for generating a physical adversarial patch with improved transferability based on data enhancement is implemented as described in any one of claims 1 to 6.