Adversarial sample light intensity robustness test data expansion method and system

Abstract

The invention discloses an adversarial sample light intensity robustness test data expansion method, which comprises the steps of generating a digital domain adversarial sample, and making a physical domain adversarial sample based on the digital domain adversarial sample; shooting the physical domain confrontation sample by using a visible light camera to obtain a real shot physical domain confrontation sample image; calculating the incident light intensity of each channel pixel of the visible light detector based on the channel response value of the real-shot physical domain adversarial sample image and the response relationship between the incident spectrum light intensity of each channel pixel and the channel response value; based on the pixel incident light intensity adjustment strategy of each channel, adjusting the pixel incident light intensity of each channel of the visible light detector to obtain the adjusted pixel incident light intensity of each channel of the visible light detector; according to the adjusted incident light intensity of each channel pixel of the visible light detector and the response relation between the incident spectrum light intensity of each channel pixel and the channel response value, a simulation physical domain confrontation sample image is obtained; according to the invention, expansion of adversarial sample light intensity robustness test data can be realized.

Description

Technical Field

[0001] The present invention relates to the field of data enhancement technology, and in particular to a method and system for expanding data for adversarial sample light intensity robustness testing. Background Art

[0002] In the field of image processing, machine learning models based on deep convolutional neural networks have demonstrated outstanding performance in tasks such as image classification, object detection, and recognition. However, the emergence of adversarial examples poses a significant threat to the security of machine learning models. Adversarial examples introduce subtle perturbations to input samples, causing them to produce erroneous predictions. Machine learning complements traditional quantitative methods and represents a technological innovation. Studying adversarial examples can reveal the vulnerabilities of machine learning models and effectively promote the development of adversarial defense technologies, which are of great significance for application scenarios such as autonomous driving and smart homes.

[0003] Currently, most research on adversarial samples is oriented towards the digital domain. Their adversarial sample generation only processes digital images, but fails to consider the impact of changes in ambient light intensity during image acquisition on the adversarial nature of adversarial samples. As a result, the adversarial perturbations finely constructed in the digital domain are easily invalidated under complex and changing conditions. For example, the patent application document with publication number CN119441836A points out that adversarial samples generated in the digital domain are generally difficult to adapt to the real physical world, that is, their adversarial nature is difficult to maintain under different imaging environments and imaging devices; while physical domain adversarial samples are physically realizable adversarial samples in the real world. Their adversarial sample generation generally processes the target surface and often exists in the form of printable patches, labels, and 3D objects. It has not yet combined with factors such as real light intensity changes to deeply reveal the mechanism of adversarial generation, maintenance, and attenuation.

[0004] In the study of light intensity robustness against adversarial examples in both the digital and physical domains, adversarial light intensity robustness test data is crucial. However, adversarial light intensity robustness testing requires a large amount of test data. Using real-world filming is time-consuming, labor-intensive, and inefficient. Therefore, there is an urgent need for a solution to expand adversarial light intensity robustness test data. Summary of the Invention

[0005] The technical problem to be solved by the present invention is how to expand the test data of the robustness of the light intensity of adversarial samples.

[0006] The present invention solves the above technical problems through the following technical means:

[0007] A data expansion method for adversarial sample intensity robustness testing is proposed, including:

[0008] Generate digital domain adversarial samples and create physical domain adversarial samples based on digital domain adversarial samples;

[0009] Use a visible light camera to shoot physical domain adversarial samples to obtain real-shot physical domain adversarial sample images;

[0010] Calculate the incident light intensity of each channel pixel of the visible light detector based on the RGB channel response values of the real-shot physical domain adversarial sample image and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value;

[0011] Based on the incident light intensity adjustment strategy of each channel pixel, the incident light intensity of each channel pixel of the visible light detector is adjusted to obtain the adjusted incident light intensity of each channel pixel of the visible light detector;

[0012] According to the adjusted incident light intensity of pixels in each channel of the visible light detector and the response relationship between the incident spectral light intensity of pixels in each channel of the visible light detector and the response value of the RGB channel, a simulated physical domain adversarial sample image is obtained.

[0013] Furthermore, the step of creating a physical domain adversarial sample based on the digital domain adversarial sample includes:

[0014] At least one printing method selected from color inkjet printing, color laser printing, UV printing, and 3D printing is used to produce a physical domain adversarial sample based on the digital domain adversarial sample.

[0015] Furthermore, before photographing the physical domain adversarial sample using a visible light camera to obtain a real-shot physical domain adversarial sample image, the method further includes:

[0016] The imaging acquisition parameters of the visible light detector are set, wherein the imaging acquisition parameters include camera parameters, position parameters and environmental conditions.

[0017] Furthermore, the response relationship between the incident spectral intensity of each channel pixel of the visible light detector and the RGB channel response value is:

[0018]

[0019] Where, P io_Chan (x, y, λ) represents the incident spectral intensity of the pixel in channel Chan; G(x, y) Chan Indicates the pixel response value of channel Chan; offset Chan (x,y) represents the pixel bias of channel Chan; Gain Chan Indicates the gain of channel Chan; A p represents the pixel area; T in represents the integration time; h represents the Planck constant; c represents the speed of light; QE(λ) represents the quantum efficiency; λ Chan_1 and λ Chan_2Indicates the wavelength integration lower limit and wavelength integration upper limit of channel Chan; λ represents wavelength; channel Chan represents channel R, channel G, or channel B.

[0020] Furthermore, the incident light intensity adjustment strategy for each channel pixel is:

[0021] P′ io_Chan (x,y)=k Chan P io_Chan (x,y)+b Chan

[0022] Where k Chan Indicates the adjustable coefficient of channel Chan, b Chan Indicates the bias of channel Chan, P io_Chan (x,y) represents the pixel incident light intensity of channel Chan, P′ io_Chan (x, y) represents the adjusted pixel incident light intensity of channel Chan, where channel Chan represents channel R, channel G, or channel B.

[0023] Furthermore, obtaining a simulated physical domain adversarial sample image based on the adjusted incident light intensity of pixels in each channel of the visible light detector and the response relationship between the incident spectral light intensity of pixels in each channel of the visible light detector and the RGB channel response value includes:

[0024] Substituting the adjusted incident light intensity of each channel pixel of the visible light detector into the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value, a new RGB channel response value is obtained;

[0025] The new RGB channel response value is corrected using the grayscale threshold to obtain the corrected channel response value;

[0026] Based on the corrected channel response threshold, a simulated physical domain adversarial sample image is obtained.

[0027] Furthermore, the method of correcting the new RGB channel response value by using the grayscale threshold to obtain the corrected channel response value includes:

[0028] Compare the new RGB channel response values with the grayscale threshold, and correct the channel response values greater than the grayscale threshold to the grayscale threshold.

[0029] In addition, the present invention also proposes a data expansion system for adversarial sample light intensity robustness testing, comprising:

[0030] An adversarial sample creation module, used to generate digital domain adversarial samples and create physical domain adversarial samples based on digital domain adversarial samples;

[0031] A real-shot image generation module is used to use a visible light camera to shoot physical domain adversarial samples to obtain real-shot physical domain adversarial sample images;

[0032] The light intensity calculation module is used to calculate the incident light intensity of each channel pixel of the visible light detector based on the RGB channel response value of the real-shot physical domain adversarial sample image and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value;

[0033] A light intensity adjustment module is used to adjust the incident light intensity of pixels in each channel of the visible light detector based on the incident light intensity adjustment strategy of the pixels in each channel, and obtain the adjusted incident light intensity of pixels in each channel of the visible light detector;

[0034] The sample simulation module is used to obtain a simulated physical domain adversarial sample image based on the adjusted incident light intensity of each channel pixel of the visible light detector and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value.

[0035] In addition, the present invention also proposes a device for expanding test data for robustness of light intensity against adversarial samples, which includes a memory and a processor; wherein the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to implement the method for expanding test data for robustness of light intensity against adversarial samples as described above.

[0036] In addition, the present invention also proposes a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned adversarial sample light intensity robustness test data expansion method is implemented.

[0037] The advantages of the present invention are:

[0038] (1) Through the light intensity inversion and adjustment strategy, the response characteristics of the visible light detector are modeled, which not only expands and enriches the adversarial sample light intensity robustness test data, but also further provides input conditions for the security test of the optoelectronic intelligent perception model.

[0039] (2) The response relationship between the incident spectral intensity of each channel pixel of the visible light detector and the response value of the RGB channel is not a mathematical model, but a physical model, which is highly interpretable.

[0040] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of a method for expanding data for robustness testing of light intensity against adversarial samples, according to one embodiment of the present invention;

[0042] Figure 2 2. This is a schematic diagram of a digital domain adversarial sample according to an embodiment of the present invention;

[0043] Figure 3 is a real-shot physical domain adversarial sample image in one embodiment of the present invention;

[0044] Figure 4 is a simulated physical domain adversarial sample image in one embodiment of the present invention;

[0045] Figure 5 1 is a schematic diagram of a data expansion system for robustness testing of light intensity against adversarial samples according to an embodiment of the present invention;

[0046] Figure 6 It is a structural diagram of a data expansion device for adversarial sample light intensity robustness test proposed in one embodiment of the present invention. DETAILED DESCRIPTION

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0048] like Figure 1 As shown, an embodiment of the present invention proposes a method for expanding data for adversarial sample light intensity robustness testing, the method comprising the following steps:

[0049] S10. Generate digital domain adversarial samples, and create physical domain adversarial samples based on the digital domain adversarial samples;

[0050] It should be noted that the digital domain adversarial sample generation method adopted in this embodiment is an existing method, including FGSM (Fast Gradient Sign Method), PGD (Projected Gradient Descent), CW (Carlini & Wagner Attack), MI-FGSM (Momentum Iterative FGSM), ShapeShifter, Full-coverage Camouflage Attack (FCA), etc. This embodiment does not specifically limit the specific digital domain adversarial sample generation method adopted.

[0051] It should be noted that the methods for producing physical domain adversarial samples include color inkjet printing, color laser printing, UV printing (Ultraviolet Printing), 3D printing, etc.

[0052] S20. Use a visible light camera to shoot the physical domain adversarial sample to obtain a real-shot physical domain adversarial sample image;

[0053] S30, calculating the incident light intensity of each channel pixel of the visible light detector based on the RGB channel response values of the real-shot physical domain adversarial sample image and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value;

[0054] S40, adjusting the incident light intensity of the pixels in each channel of the visible light detector based on the incident light intensity adjustment strategy of the pixels in each channel to obtain adjusted incident light intensity of the pixels in each channel of the visible light detector;

[0055] S50. Obtain a simulated physical domain adversarial sample image according to the adjusted incident light intensity of pixels in each channel of the visible light detector and the response relationship between the incident spectral light intensity of pixels in each channel of the visible light detector and the RGB channel response value.

[0056] It should be noted that this embodiment, through a light intensity inversion and adjustment strategy, demonstrates the modeling of visible light detector response characteristics. This not only expands and enriches the data for robustness testing of adversarial light intensity samples, but also provides input conditions for security testing of optoelectronic intelligent perception models. Compared to actual photography and acquisition, this embodiment's method can quickly acquire large amounts of test data, saving manpower and physical costs and achieving high efficiency.

[0057] As a further preferred technical solution, before step S20: photographing the physical domain adversarial sample using a visible light camera to obtain a real-shot physical domain adversarial sample image, the method further includes:

[0058] Set the imaging acquisition parameters of the visible light detector, which include camera parameters, position parameters, and environmental conditions. Use the set visible light camera to shoot the physical domain adversarial sample to obtain the real-shot physical domain adversarial sample image M.

[0059] Specifically in this embodiment, camera parameters include focal length, exposure time, etc.; position parameters include camera azimuth, camera pitch angle, target azimuth, target pitch angle; environmental conditions include temperature, humidity, light level, sunny or cloudy days, etc.

[0060] As a further preferred technical solution, the response relationship between the incident spectral intensity of each channel pixel of the visible light detector and the RGB channel response value is:

[0061]

[0062] Where, P io_Chan (x, y, λ) represents the incident spectral intensity of the pixel in channel Chan, in W / cm 2 / nm; G(x,y) Chan Indicates the pixel response value of channel Chan, in ADU; offset Chan (x,y) represents the pixel bias of channel Chan, in ADU; Gain Chan Indicates the gain of channel Chan, the unit is e - / ADU;A p Indicates pixel area in cm 2 ;T in represents the integration time in seconds; h represents the Planck constant, which is 6.6262×10 -34 J·s; c represents the speed of light, and its value is 3×10 8 m / s; QE(λ) represents quantum efficiency; λ Chan_1 and λ Chan_2 Indicates the wavelength integration lower limit and upper limit of channel Chan, in nm; λ indicates wavelength; channel Chan indicates channel R, channel G, or channel B.

[0063] Specifically, the response relationship between the incident spectral intensity of each pixel of the visible light camera detector and the R channel response value is:

[0064]

[0065] Among them, P io_R (x, y, λ) represents the incident spectral intensity of the R channel pixel; G(x, y) R Indicates the R channel pixel response value; offset R (x,y) represents the R channel pixel bias; Gain R represents the camera R channel gain; λ R_1 Indicates the lower limit of the wavelength integration of the R channel; λ R_2 Indicates the upper limit of the wavelength integration of the R channel.

[0066] Specifically, the response relationship between the incident spectral intensity of each pixel of the visible light camera detector and the G channel response value is:

[0067]

[0068] Among them, P io_G (x, y, λ) represents the incident spectral intensity of the G channel pixel; G(x, y) G Indicates the G channel pixel response value; offset G(x,y) represents the G channel pixel bias; Gain G represents the camera G channel gain; λ G_1 Indicates the lower limit of wavelength integration of G channel; λ G_2 Indicates the upper limit of wavelength integration of channel G.

[0069] Specifically, the response relationship between the incident spectral intensity of each pixel of the visible light camera detector and the B channel response value is:

[0070]

[0071] Among them, P io_B (x, y, λ) represents the incident spectral intensity of the pixel in channel B; G(x, y) B Indicates the B channel pixel response value; offset B (x,y) represents the B channel pixel bias; Gain B represents the camera B channel gain; λ B_1 Indicates the lower limit of the wavelength integration of channel B; λ B_2 Indicates the upper limit of the wavelength integration of channel B.

[0072] As a further preferred technical solution, the strategy for adjusting the incident light intensity of each channel pixel in step S40 is:

[0073] P′ io_Chan (x,y)=k Chan P io_Chan (x,y)+b Chan

[0074] Where k Chan Indicates the adjustable coefficient of channel Chan, b Chan Indicates the bias of channel Chan, P io_Chan (x,y) represents the pixel incident light intensity of channel Chan, P′ io_Chan (x, y) represents the adjusted pixel incident light intensity of channel Chan, where channel Chan represents channel R, channel G, or channel B.

[0075] It should be noted that this embodiment utilizes a pixel-by-pixel incident light intensity adjustment strategy to achieve linear adjustment of light intensity, ensuring that light intensity changes within a reasonable range. The adjustable coefficient and offset are parameters set to achieve linear and effective adjustment of light intensity. The adjustable coefficient is generally between 0 and 2, and the offset should generally be greater than 0.

[0076] Specifically, the strategy for adjusting the incident light intensity of the pixel in the R channel of the visible light camera detector is as follows:

[0077] P′ io_R (x,y)=k R P io_R(x,y)+b R

[0078] Among them, k R Indicates the adjustable coefficient of R channel; b R Indicates the offset size of the R channel.

[0079] The strategy for adjusting the incident light intensity of the pixel in channel G of the visible light camera detector is as follows:

[0080] P′ io_G (x,y)=k G P io_G (x,y)+b G

[0081] Among them, k G Indicates the adjustable coefficient of G channel; b G Indicates the offset size of the G channel.

[0082] The strategy for adjusting the incident light intensity of the pixel in channel B of the visible light camera detector is as follows:

[0083] P′ io_B (x,y)=k B P io_B (x,y)+b B

[0084] Among them, k B Indicates the adjustable coefficient of channel B; b B Indicates the offset size of channel B.

[0085] Therefore, this embodiment uses the strategy of adjusting the incident light intensity of each channel pixel of the detector in the visible light camera to obtain the adjusted incident light intensity P′ of each channel pixel of the detector in the visible light camera. io_R (x,y),P′ io_G (x,y),P′ io_B (x,y).

[0086] As a further preferred technical solution, step S50: obtaining a simulated physical domain adversarial sample image based on the adjusted incident light intensity of each channel pixel of the visible light detector and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value, specifically includes the following steps:

[0087] S51, substituting the adjusted incident light intensity of each channel pixel of the visible light detector into the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value to obtain a new RGB channel response value;

[0088] S52, using the grayscale threshold to correct the new RGB channel response value to obtain a corrected channel response value;

[0089] Specifically, by comparing the new RGB channel response value with the grayscale threshold, the channel response value greater than the grayscale threshold is corrected to the grayscale threshold, and the grayscale threshold is 2 n -1, n represents the number of quantization bits of the detector.

[0090] It should be noted that if the new RGB channel response value is less than or equal to the grayscale threshold, there is no need to correct the RGB channel response value.

[0091] S53. Based on the corrected channel response threshold, obtain a simulated physical domain adversarial sample image M′.

[0092] Specifically, the digital domain adversarial sample generated by the digital domain adversarial sample generation method of this embodiment is as follows: Figure 2 As shown, a visible light camera is used to shoot physical domain adversarial samples to obtain real-shot physical domain adversarial sample images as shown in Figure 3 As shown, the visible light camera is a visible light camera with a focal length of 50mm, the imaging distances are 1m, 3m, and 5m respectively, and the light intensity is 3826lux. Then, the method of this embodiment is used to obtain Figure 4 The simulated physical domain adversarial sample images shown are expanded as test data samples. The imaging distances are 1m, 3m, and 5m, and the set light intensities are 2356lux and 4236lux, respectively.

[0093] In addition, if Figure 5 As shown, another embodiment of the present invention further proposes a data expansion system for adversarial sample light intensity robustness testing, comprising:

[0094] An adversarial sample creation module 10 is used to generate digital domain adversarial samples and create physical domain adversarial samples based on the digital domain adversarial samples;

[0095] A real-shot image generation module 20 is configured to use a visible light camera to shoot a physical domain adversarial sample to obtain a real-shot physical domain adversarial sample image;

[0096] The light intensity calculation module 30 is used to calculate the incident light intensity of each channel pixel of the visible light detector based on the RGB channel response values of the real-shot physical domain adversarial sample image and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response values;

[0097] The light intensity adjustment module 40 is used to adjust the incident light intensity of the pixels of each channel of the visible light detector based on the incident light intensity adjustment strategy of the pixels of each channel, and obtain the adjusted incident light intensity of the pixels of each channel of the visible light detector;

[0098] The sample simulation module 50 is used to obtain a simulated physical domain adversarial sample image based on the adjusted incident light intensity of each channel pixel of the visible light detector and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value.

[0099] As a further preferred technical solution, the response relationship between the incident spectral intensity of each channel pixel of the visible light detector and the RGB channel response value is:

[0100]

[0101] Where, P io_Chan (x, y, λ) represents the incident spectral intensity of the pixel in channel Chan; G(x, y) Chan Indicates the pixel response value of channel Chan; offset Chan (x,y) represents the pixel bias of channel Chan; Gain Chan Indicates the gain of channel Chan; A p represents the pixel area; T in represents the integration time; h represents the Planck constant; c represents the speed of light; QE(λ) represents the quantum efficiency; λ Chan_1 and λ Chan_2 Indicates the wavelength integration lower limit and wavelength integration upper limit of channel Chan; λ represents wavelength; channel Chan represents channel R, channel G, or channel B.

[0102] As a further preferred technical solution, the strategy for adjusting the incident light intensity of each channel pixel is:

[0103] P′ io_Chan (x,y)=k Chan P io_Chan (x,y)+b Chan

[0104] Where k Chan Indicates the adjustable coefficient of channel Chan, b Chan Indicates the bias of channel Chan, P io_Chan (x,y) represents the pixel incident light intensity of channel Chan, P′ io_Chan (x, y) represents the adjusted pixel incident light intensity of channel Chan, where channel Chan represents channel R, channel G, or channel B.

[0105] As a further preferred technical solution, the sample simulation module 50 includes:

[0106] a channel response value calculation unit, configured to substitute the adjusted incident light intensity of each channel pixel of the visible light detector into the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value to obtain a new RGB channel response value;

[0107] The channel response value correction unit is used to correct the new RGB channel response value using the grayscale threshold to obtain a corrected channel response value;

[0108] The simulation unit is used to obtain a simulated physical domain adversarial sample image based on the corrected channel response threshold.

[0109] As a further preferred technical solution, the channel response value correction unit is used to compare the new RGB channel response value with the grayscale threshold, and correct the channel response value greater than the grayscale threshold to the grayscale threshold.

[0110] It should be noted that other embodiments or specific implementation methods of the adversarial sample light intensity robustness test data expansion system of the present invention can refer to the above-mentioned method embodiments and will not be repeated here.

[0111] In addition, if Figure 6 As shown, another embodiment of the present invention further proposes a device for expanding adversarial sample light intensity robustness test data, which includes a memory and a processor; wherein the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to implement the adversarial sample light intensity robustness test data expansion method as described in the above embodiment.

[0112] The electronic device includes a processor, a memory, a communication interface, a display and an input device connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the electronic device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, near field communication (NFC) or other technologies. The display of the electronic device can be a liquid crystal display or an electronic ink display, and the input device of the electronic device can be a touch layer covering the display, or a button, trackball or touchpad provided on the electronic device housing, or an external keyboard, touchpad or mouse.

[0113] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a structural diagram of the part related to the technical solution of the present disclosure, and does not constitute a limitation on the electronic device to which the solution of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0114] In addition, another embodiment of the present invention further proposes a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the adversarial sample intensity robustness test data expansion method as described in the above embodiment is implemented.

[0115] It should be noted that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device), or in conjunction with such instruction execution system, apparatus, or device. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, apparatus, or device, or in conjunction with such instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection portion having one or more wires (electronic device), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing it in another suitable manner if necessary, and then storing it in a computer memory.

[0116] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0117] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0118] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0119] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A method for expanding data for adversarial sample light intensity robustness testing, characterized in that: include: Generate digital domain adversarial samples and create physical domain adversarial samples based on digital domain adversarial samples; Use a visible light camera to shoot physical domain adversarial samples to obtain real-shot physical domain adversarial sample images; Calculate the incident light intensity of each channel pixel of the visible light detector based on the RGB channel response values of the real-shot physical domain adversarial sample image and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value; Based on the incident light intensity adjustment strategy of each channel pixel, the incident light intensity of each channel pixel of the visible light detector is adjusted to obtain the adjusted incident light intensity of each channel pixel of the visible light detector; According to the adjusted incident light intensity of pixels in each channel of the visible light detector and the response relationship between the incident spectral light intensity of pixels in each channel of the visible light detector and the response value of the RGB channel, a simulated physical domain adversarial sample image is obtained.

2. The method for expanding data for adversarial sample light intensity robustness testing according to claim 1, wherein: The method of producing a physical domain adversarial sample based on a digital domain adversarial sample includes: At least one printing method selected from color inkjet printing, color laser printing, UV printing, and 3D printing is used to produce a physical domain adversarial sample based on the digital domain adversarial sample.

3. The method for expanding data for adversarial sample light intensity robustness testing according to claim 1, wherein: Before photographing the physical domain adversarial sample with a visible light camera to obtain a real-shot physical domain adversarial sample image, the method further includes: The imaging acquisition parameters of the visible light detector are set, wherein the imaging acquisition parameters include camera parameters, position parameters and environmental conditions.

4. The method for expanding data for adversarial sample light intensity robustness testing according to claim 1, wherein: The response relationship between the incident spectral intensity of each channel pixel of the visible light detector and the RGB channel response value is: Where, P io_Chan (x, y, λ) represents the incident spectral intensity of the pixel in channel Chan; G(x, y) Chan Indicates the pixel response value of channel Chan; offset Chan (x,y) represents the pixel bias of channel Chan; Gain Chan Indicates the gain of channel Chan; A p represents the pixel area; T in represents the integration time; h represents the Planck constant; c represents the speed of light; QE(λ) represents the quantum efficiency; λ Chan_1 and λ Chan_2 Indicates the wavelength integration lower limit and wavelength integration upper limit of channel Chan; λ represents wavelength; channel Chan represents channel R, channel G, or channel B.

5. The method for expanding data for adversarial sample light intensity robustness testing according to claim 1, wherein: The strategy for adjusting the incident light intensity of each channel pixel is: P′ io_Chan (x,y)=k Chan P io_Chan (x,y)+b Chan Where k Chan Indicates the adjustable coefficient of channel Chan, b Chan Indicates the bias of channel Chan, P io_Chan (x,y) represents the pixel incident light intensity of channel Chan, P′ io_Chan (x, y) represents the adjusted pixel incident light intensity of channel Chan, where channel Chan represents channel R, channel G, or channel B.

6. The method for expanding data for adversarial sample light intensity robustness testing according to claim 1, wherein: The method of obtaining a simulated physical domain adversarial sample image according to the adjusted incident light intensity of pixels in each channel of the visible light detector and the response relationship between the incident spectral light intensity of pixels in each channel of the visible light detector and the response value of the RGB channel includes: Substituting the adjusted incident light intensity of each channel pixel of the visible light detector into the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value, a new RGB channel response value is obtained; The new RGB channel response value is corrected using the grayscale threshold to obtain the corrected channel response value; Based on the corrected channel response threshold, a simulated physical domain adversarial sample image is obtained.

7. The method for expanding data for adversarial sample light intensity robustness testing according to claim 6, wherein: The method of correcting the new RGB channel response value by using the grayscale threshold to obtain the corrected channel response value includes: Compare the new RGB channel response values with the grayscale threshold, and correct the channel response values greater than the grayscale threshold to the grayscale threshold.

8. A data expansion system for adversarial sample light intensity robustness testing, characterized in that: include: An adversarial sample creation module, used to generate digital domain adversarial samples and create physical domain adversarial samples based on digital domain adversarial samples; A real-shot image generation module is used to use a visible light camera to shoot physical domain adversarial samples to obtain real-shot physical domain adversarial sample images; The light intensity calculation module is used to calculate the incident light intensity of each channel pixel of the visible light detector based on the RGB channel response value of the real-shot physical domain adversarial sample image and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value; A light intensity adjustment module is used to adjust the incident light intensity of pixels in each channel of the visible light detector based on the incident light intensity adjustment strategy of the pixels in each channel, and obtain the adjusted incident light intensity of pixels in each channel of the visible light detector; The sample simulation module is used to obtain a simulated physical domain adversarial sample image based on the adjusted incident light intensity of each channel pixel of the visible light detector and the response relationship between the incident spectral light intensity of each channel pixel of the visible light detector and the RGB channel response value.

9. A data expansion device for adversarial sample light intensity robustness test, characterized in that: The device includes a memory and a processor; wherein the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to implement the adversarial sample light intensity robustness test data expansion method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for expanding adversarial sample light intensity robustness test data according to any one of claims 1 to 7 is implemented.

Images