Method and device for generating artistic antagonism background

Abstract

The invention provides an artistic antagonism background generation method and device, and relates to the technical field of computer vision. The method comprises the following steps: acquiring image data sets of different human body actions; processing the data set by adopting an automatic method to obtain a figure area mask and an optimized area mask; generating an image data set for optimizing the confrontation background according to the figure area mask and the optimization area mask; performing enhancement processing on the image data set by adopting an image enhancement method to obtain a figure data set; constructing a physical domain confrontation background generation framework based on the target detection model; constructing a multi-objective loss function; and inputting the figure data set into the framework, calculating a gradient value by adopting a multi-objective loss function, optimizing and updating a pixel value of the confrontation background in a reverse transmission mode until a preset iteration round is reached, and outputting a final confrontation background. According to the invention, the robustness and safety of the visual detection model can be improved.

Description

Technical Field

[0001] The present invention relates to the field of computer vision technology, and in particular to a method and device for generating an artistic adversarial background. Background Art

[0002] With the rapid development of deep learning technology, object detection models based on convolutional neural networks have been widely used in security monitoring, autonomous driving, and smart healthcare. However, these object detection models face serious security threats when deployed in the real world, particularly adversarial attacks. Attackers use designed perturbations, such as adversarial patches, to interfere with model decisions, leading to false or missed detections and severely threatening the safety and reliability of vision systems.

[0003] Adversarial patches are a typical physical-world attack method. They add local patterns, such as stickers and graffiti, to or around the surface of a target object, inducing object detection models to miss or misdetect. Existing technologies have shown that adversarial patches are not only effective against object detection models but can also disrupt face recognition and human pose estimation tasks. Their cross-model and cross-task transferability make them a significant challenge to the security of AI vision systems.

[0004] In terms of defense, traditional methods such as adversarial training and input reconstruction primarily target digital domain attacks and lack robustness to complex perturbations in the physical world, such as illumination variations and viewpoint shifts. Furthermore, existing adversarial patches often employ high-entropy random noise or simple patterns, which have poor visual concealment and are easily detectable by human observers, limiting their practical application.

[0005] Among them, the core of traditional adversarial patch generation methods is to use optimization algorithms, such as gradient descent, to generate local perturbations that can deceive the target model. Typical solutions include: (1) White-box attack: patches are generated through random search strategies, with a high attack success rate, but the computational cost is high and it relies on internal information of the model; (2) Black-box attack: patches are generated through transfer learning without internal information of the model, but the success rate is unstable and easy to detect; (3) Style transfer combined with adversarial attack: Currently, a few studies have attempted to introduce artistic style transfer technology into adversarial patch generation to improve stealth, but they mostly focus on static images, such as traffic signs and face recognition, and have not addressed the challenges of dynamic scenes, such as human detection in videos.

[0006] The shortcomings of the traditional adversarial patch optimization process include: the patch relies on a fixed optimization area, such as the sticker position, but it is difficult to adapt to dynamic human posture changes, such as walking and turning; the color of the patch is distorted or the texture is blurred after printing, resulting in fluctuations in the attack success rate; the patch is sensitive to changes in lighting and angle, resulting in a decrease in the success rate; existing adversarial training mostly uses simple noise samples, which cannot simulate complex attacks in the real world. Summary of the Invention

[0007] To address the technical issues in the prior art of traditional deep neural network object detection models, such as insufficient robustness to complex environmental interference in the physical world and an imbalance between stealth and generalization, the present invention provides a method and device for generating an artistic adversarial background. The technical solution is as follows:

[0008] In one aspect, a method for generating an artistic adversarial background is provided. The method is implemented by a device for generating an artistic adversarial background, and the method includes:

[0009] S1. Obtain an image dataset of different human body movements; process the dataset using an automated method to obtain a human region mask and an optimized region mask;

[0010] S2. Generate an image dataset for optimizing the anti-background based on the person region mask and the optimized region mask; and enhance the image dataset using an image enhancement method to obtain a person dataset.

[0011] S3. Build a physical domain adversarial background generation framework based on the target detection model; build a multi-objective loss function;

[0012] S4. Input the character dataset into the framework, use the multi-objective loss function to calculate the gradient value, optimize and update the pixel value of the adversarial background through the backpropagation method until the preset iteration rounds are reached, and output the final adversarial background.

[0013] Optionally, the multi-objective loss function includes: a detection adversarial loss function, a style loss function, and a content loss function; wherein the multi-objective loss function is expressed by the following formula (1):

[0014] (1)

[0015] in, represents the multi-objective loss function; represents the detection adversarial loss function; represents the style loss function; represents the content loss function.

[0016] Optionally, the detection adversarial loss function is composed of a confidence level and a classification probability of a model; the lower the value of the detection adversarial loss function, the stronger the adversarial performance;

[0017] The style loss function is used to ensure that the style of the adversarial background is consistent with the target style image;

[0018] The content loss function is used to ensure that the content of the adversarial background area is consistent with the content of the target image.

[0019] Optionally, the detection adversarial loss function is expressed by the following formula (2):

[0020] (2)

[0021] in, Represents the detection adversarial loss function value; represents the first hyperparameter set; Represents the output score after the target detection model; represents the second hyperparameter of the setting; Indicates the confidence level of the output result; Represents the classification probability of the target detection model.

[0022] Optionally, the style loss function is expressed by the following formula (3):

[0023] (3)

[0024] in, Represents the style loss function value; Represents the weight coefficient, which refers to the size of the style proportion; A feature map representing the target style image; A feature map representing a candidate adversarial background image; Gram matrix representing the target style image; Gram matrix representing the candidate adversarial background image.

[0025] Optionally, the content loss function is expressed by the following formula (4):

[0026] (4)

[0027] in, Represents the value of the content loss function; The weight coefficient representing the content loss; Represents the target content image; Represents the adversarial background image during the optimization process.

[0028] Optionally, the step S4 inputs the character dataset into the framework, calculates the gradient value using a multi-objective loss function, optimizes and updates the pixel value of the adversarial background by backpropagation until a preset number of iterations is reached, and outputs the final adversarial background, including:

[0029] S41. Input the person dataset into the physical domain adversarial background generation framework based on the target detection model, process it through the target detection model, and output a score;

[0030] S42. Input the output score into the detection adversarial loss function to calculate the recognition confidence and probability of the person in the adversarial background to obtain the detection adversarial loss;

[0031] S43, inputting the acquired adversarial background image into the VGG network model for feature extraction to obtain image features of the adversarial background; inputting the acquired target style image into the VGG network model for feature extraction to obtain features of the target style image; calculating the style loss using a style loss function based on the features of the target style image and the features of the adversarial background image;

[0032] S44, based on the obtained target content image and adversarial background image, calculate the mean error of each pixel of the adversarial background and target content image using a content loss function to obtain a content loss;

[0033] S45. Based on the detection adversarial loss, style loss, and content loss, a reverse iterative method is used to optimize and update the pixels of the adversarial background. When the preset number of rounds is reached, the final adversarial background is output.

[0034] On the other hand, a device for generating an artistic adversarial background is provided. The device is applied to a method for generating an artistic adversarial background. The device includes:

[0035] The first acquisition unit is configured to acquire an image dataset of different human body movements; and process the dataset using an automated method to obtain a human region mask and an optimized region mask.

[0036] A processing unit is configured to generate an image dataset for optimizing the anti-background according to the person region mask and the optimized region mask; and enhance the image dataset using an image enhancement method to obtain a person dataset;

[0037] A construction unit is used to build a physical domain adversarial background generation framework based on the target detection model; and to build a multi-objective loss function;

[0038] The optimization unit is used to input the character dataset into the framework, calculate the gradient value using a multi-objective loss function, optimize and update the pixel value of the adversarial background through backpropagation until a preset number of iterations is reached, and output the final adversarial background.

[0039] Optionally, the multi-objective loss function includes: a detection adversarial loss function, a style loss function, and a content loss function; wherein the multi-objective loss function is expressed by the following formula (1):

[0040] (1)

[0041] in, represents the multi-objective loss function; represents the detection adversarial loss function; represents the style loss function; represents the content loss function.

[0042] Optionally, the detection adversarial loss function is composed of a confidence level and a classification probability of a model; the lower the value of the detection adversarial loss function, the stronger the adversarial performance;

[0043] The style loss function is used to ensure that the style of the adversarial background is consistent with the target style image;

[0044] The content loss function is used to ensure that the content of the adversarial background area is consistent with the content of the target image.

[0045] Optionally, the detection adversarial loss function is expressed by the following formula (2):

[0046] (2)

[0047] in, Represents the detection adversarial loss function value; represents the first hyperparameter set; Represents the output score after the target detection model; represents the second hyperparameter of the setting; Indicates the confidence level of the output result; Represents the classification probability of the target detection model.

[0048] Optionally, the style loss function is expressed by the following formula (3):

[0049] (3)

[0050] in, Represents the style loss function value; Represents the weight coefficient, which refers to the size of the style proportion; A feature map representing the target style image; A feature map representing a candidate adversarial background image; Gram matrix representing the target style image; Gram matrix representing the candidate adversarial background image.

[0051] Optionally, the content loss function is expressed by the following formula (4):

[0052] (4)

[0053] in, Represents the value of the content loss function; The weight coefficient representing the content loss; Represents the target content image; Represents the adversarial background image during the optimization process.

[0054] Optionally, the optimization unit is configured to:

[0055] The person dataset is input into the physical domain adversarial background generation framework based on the target detection model, processed by the target detection model, and the score is output;

[0056] The output score is input into the detection adversarial loss function to calculate the recognition confidence and probability of the person in the adversarial background to obtain the detection adversarial loss;

[0057] Input the acquired adversarial background image into the VGG network model for feature extraction to obtain the image features of the adversarial background; input the acquired target style image into the VGG network model for feature extraction to obtain the features of the target style image; calculate the style loss function based on the features of the target style image and the image features of the adversarial background;

[0058] Based on the acquired target content image and adversarial background image, the mean error of each pixel between the adversarial background and the target content image is calculated using the content loss function to obtain the content loss.

[0059] According to the detection adversarial loss, style loss, and content loss, a reverse iterative method is used to optimize and update the pixels of the adversarial background. When the preset number of rounds is reached, the final adversarial background is output.

[0060] On the other hand, a device for generating an artistic adversarial background is provided, comprising: a processor; and a memory, wherein computer-readable instructions are stored on the memory, and when the computer-readable instructions are executed by the processor, any one of the above-mentioned methods for generating an artistic adversarial background is implemented.

[0061] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction is stored in the storage medium, and the at least one instruction is loaded and executed by a processor to implement any of the above-mentioned methods for generating artistic adversarial backgrounds.

[0062] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0063] An embodiment of the present invention first obtains an image dataset of different human body movements; uses an automated method to process the dataset to obtain a person region mask and an optimized region mask; generates an image dataset for optimizing an adversarial background based on the person region mask and the optimized region mask; uses an image enhancement method to enhance the image dataset to obtain a person dataset; constructs a physical domain adversarial background generation framework based on a target detection model; constructs a multi-objective loss function; inputs the person dataset into the framework, uses the multi-objective loss function to calculate the gradient value, optimizes and updates the pixel value of the adversarial background through a backpropagation method until a preset number of iterations is reached, and outputs the final adversarial background.

[0064] The embodiments of the present invention can solve the shortcomings of traditional deep neural network target detection models, such as insufficient robustness to complex environmental interference in the physical world and imbalance between concealment and generalization, and explore new visual attack and defense strategies. The embodiments of the present invention convert traditional surface pasting to background pasting to achieve adversarial attacks, generate high-quality artistic adversarial backgrounds for adversarial attacks, and improve the robustness and security of visual detection models through the strategy of using offense to promote defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0066] Figure 1 This is a flow chart of a method for generating an artistic adversarial background provided by an embodiment of the present invention;

[0067] Figure 2 This is a structural diagram of a data preprocessing process provided by an embodiment of the present invention;

[0068] Figure 3 This is a schematic diagram of the design principle of an algorithm for generating an artistic adversarial background provided by an embodiment of the present invention;

[0069] Figure 4 This is an effect image generated with a stylized adversarial patch provided by an embodiment of the present invention;

[0070] Figure 5 This is a block diagram of a device for generating an artistic adversarial background provided by an embodiment of the present invention;

[0071] Figure 6 Schematic diagram of the structure of an artistic adversarial background generation device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0072] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0073] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as an "exemplary" in the present invention should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of the word "exemplary" is intended to present concepts in a concrete manner. Furthermore, in the embodiments of the present invention, "and / or" can mean both or either of the two.

[0074] In the embodiments of the present invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, when the distinction is not emphasized, the meanings they convey are the same. The terms "of," "corresponding," and "corresponding" may sometimes be used interchangeably. It should be noted that, when the distinction is not emphasized, the meanings they convey are the same.

[0075] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0076] In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0077] The embodiment of the present invention provides a method for generating an artistic adversarial background, which can be implemented by a device for generating an artistic adversarial background, and the device for generating an artistic adversarial background can be a terminal or a server. Figure 1 The flowchart of the method for generating an artistic adversarial background is shown in FIG. 1 . The processing flow of the method may include the following steps:

[0078] S1. Obtain an image dataset of different human body movements; process the dataset using an automated method to obtain a human region mask and an optimized region mask.

[0079] Among them, the embodiment of the present invention realizes a 360-degree multi-posture attackable confrontation background for different characters; the applicable scenario of the embodiment of the present invention can be attacks on pedestrians on streets and roads.

[0080] In a feasible implementation, the embodiment of the present invention collects an image dataset of different human body movements of a certain group of people or a specific person at a distance of 1.5 meters to 3 meters from a camera.

[0081] Among them, manual labeling and automated methods are used to process the collected data sets; among them, the automated method can use image segmentation models, such as U-Net to divide the human body range and generate masks, or use ready-made tools, such as Photoshop, to perform human body segmentation.

[0082] S2. Generate an image dataset for optimizing the adversarial background based on the person region mask and the optimized region mask; and enhance the image dataset using an image enhancement method to obtain a person dataset.

[0083] In one feasible implementation, an optimization region mask is used to cull the adversarial background optimization region, and a person region mask is used to dynamically cull the person region in the image to eliminate human interference with adversarial background optimization. By recording the polygon vertices in a JSON file to generate a perspective transformation matrix, the adversarial background is placed behind the person to obtain an image dataset for adversarial background optimization.

[0084] Among them, the image enhancement method includes: rotation, translation and brightness change; among them, the embodiment of the present invention sets the rotation range to ±25°, the translation range to ±15% of the image size, and the brightness fluctuation range to ±30%.

[0085] In one feasible implementation, Figure 2 The figure shows a structural schematic diagram of a data preprocessing process provided by an embodiment of the present invention; wherein, Figure (a) is the original scene image, Figure (b) is the character area mask, Figure (c) is the optimized area mask, and Figure (d) is the image after mask processing.

[0086] Among them, image enhancement processing can effectively improve the generalization ability of generated patches to complex physical interferences such as perspective offset and lighting changes.

[0087] S3. Construct a physical domain adversarial background generation framework based on the target detection model; construct a multi-objective loss function.

[0088] Optionally, the multi-objective loss function includes: a detection adversarial loss function, a style loss function, and a content loss function; wherein the multi-objective loss function is expressed by the following formula (1):

[0089] (1)

[0090] in, represents the multi-objective loss function; represents the detection adversarial loss function; represents the style loss function; represents the content loss function.

[0091] Optionally, a detection adversarial loss function, which is composed of the confidence and the classification probability of the model; the lower the value of the detection adversarial loss function, the stronger the adversarial;

[0092] Among them, the style loss function is used to ensure that the style of the adversarial background is consistent with the target style image;

[0093] Among them, the content loss function is used to ensure that the content of the adversarial background area is consistent with the target content.

[0094] S4. Input the character dataset into the framework, use the multi-objective loss function to calculate the gradient value, optimize and update the pixel value of the adversarial background through the backpropagation method until the preset iteration rounds are reached, and output the final adversarial background.

[0095] Among them, such as Figure 3 The figure shows a design principle diagram of an algorithm for generating an artistic adversarial background, provided by an embodiment of the present invention. In one feasible implementation, an initial character dataset is obtained, including various actions of different characters. The dataset is preprocessed to obtain character and background masks. An initial background image, a target style image, and a target content image are obtained. The background is sampled and perspective-transformed, and then placed behind the character in the digital domain and subjected to data augmentation to obtain the character dataset. The character dataset is input into an object detection model such as Yolov5 to obtain the probability and confidence of character recognition. The background image is optimized and updated by calculating the detection adversarial loss, content loss, and style loss to obtain the final adversarial background.

[0096] Optionally, the specific implementation process of S4 includes S41-S45:

[0097] S41. Input the person dataset into the physical domain adversarial background generation framework based on the target detection model, process it through the target detection model, and output a score;

[0098] Among them, the target detection model is used for processing and the output score is expressed by the following formula (2):

[0099] (2)

[0100] in, It is a person dataset; For the Yolov5 target detection model, Represents the output score after passing the target detection model.

[0101] S42. Input the output score into the detection adversarial loss function to calculate the recognition confidence and probability of the person in the adversarial background to obtain the detection adversarial loss;

[0102] Optionally, the detection adversarial loss function is expressed by the following formula (3):

[0103] (3)

[0104] in, Represents the detection adversarial loss function value; represents the first hyperparameter set; Represents the output score after the target detection model; represents the second hyperparameter of the setting; Indicates the confidence of the output result. In the target detection model, it represents whether a specific object exists in the identified area. If the confidence value drops to a certain threshold, it means that the target detection model has not identified a specific object in the area. Represents the classification probability of the target detection model, indicating the probability of human class in the recognition result.

[0105] Among them, choose The value indicates that the anti-identification ability of the attack is enhanced. A larger value means that the model is more likely to make mistakes.

[0106] S43, inputting the acquired adversarial background image into the VGG network model for feature extraction to obtain image features of the adversarial background; inputting the acquired target style image into the VGG network model for feature extraction to obtain features of the target style image; calculating the style loss using a style loss function based on the features of the target style image and the features of the adversarial background image;

[0107] Among them, according to the feature map of the adversarial background image, the Gram matrix is ​​used to calculate the inner product of the feature map to capture the correlation between the features, which is expressed by the following formula (4):

[0108] (4)

[0109] Where X represents the feature map of the adversarial background image;

[0110] Optionally, the style loss function is expressed by the following formula (5):

[0111] (5)

[0112] in, represents the style loss function; Represents the weight coefficient, which refers to the size of the style proportion; A feature map representing the target style image; A feature map representing a candidate adversarial background image; Gram matrix representing the target style image; Gram matrix representing the candidate adversarial background image.

[0113] Among them, by calculating the target style image and the candidate adversarial background image By minimizing the square of the matrix difference and its bi-norm, the candidate adversarial background image can gradually approach the target image in style.

[0114] S44, based on the obtained target content image and adversarial background image, calculate the mean error of each pixel of the adversarial background and target content image using a content loss function to obtain a content loss;

[0115] Optionally, the content loss function is expressed by the following formula (6):

[0116] (6)

[0117] in, Represents the value of the content loss function; The weight coefficient representing the content loss; Represents the target content image; Represents the adversarial background image during the optimization process.

[0118] in, is the weight coefficient of content loss, which is used to control the importance of content matching in the overall loss optimization.

[0119] Among them, the content loss function ensures that the content of the adversarial background area is consistent with the target content.

[0120] Among them, by calculating the squared difference of the two norms between the feature map of the target content image and the feature map of the adversarial background image and minimizing the loss, the features of the adversarial background image can be gradually brought closer to the features of the target content, thereby ensuring the consistency of the adversarial background image and the overall image at the content level.

[0121] S45. Based on the detected adversarial loss value, style loss value, and content loss, a reverse iterative method is used to optimize and update the pixels of the adversarial background. When the preset number of rounds is reached, the final adversarial background is output.

[0122] The content loss function is used to maintain consistency between the adversarial background and the original content, ensuring that important structural information of the target image is not lost in visual perception. By calculating the Euclidean distance between the target content features and the adversarial patch features and minimizing this loss, the team can ensure that the generated image maintains a high degree of semantic similarity to the original image.

[0123] Among them, the style transfer loss function is obtained by The matrix measures the style characteristics of the image, making the adversarial patch closer to a specific art painting in terms of visual style. By minimizing the difference between the adversarial background and the target art style image Due to the differences in the matrix, the team was able to effectively transfer the artistic style features to the adversarial background, giving it the visual effects of a specific artistic style.

[0124] Among them, the adversarial loss function guides the generated samples to successfully deceive the target classifier, causing it to misclassify or output a specific category, so that the final generated adversarial background not only has an artistic style visually, but also has strong attack capabilities.

[0125] Among them, such as Figure 4 The figure shows a rendering of a stylized adversarial background generation provided by an embodiment of the present invention; wherein, the upper portion of the rendering is the initial image, and the lower portion is the corresponding optimized adversarial background.

[0126] In a feasible implementation, an embodiment of the present invention draws inspiration from style transfer technology and proposes an adversarial background generation method that combines adversarial and stylistic art. By combining adversarial loss and content and style loss, an adversarial background that resembles a stylized art painting is effectively generated.

[0127] In one feasible implementation, this embodiment integrates style transfer technology into the adversarial attack framework, proposing a method for generating a stylized adversarial background with both artistic expression and attack effectiveness. By constructing a multi-objective loss function that integrates adversarial attack objectives with style transfer objectives, such as artistic style similarity and content fidelity, this method achieves an organic combination of high offensiveness and artistic style. While maintaining the attack success rate, it significantly improves visual concealment. For example, a lotus pattern adversarial background is more easily accepted by the target audience in surveillance scenarios and easily attracts attention.

[0128] An embodiment of the present invention first obtains an image dataset of different human body movements; uses an automated method to process the dataset to obtain a person region mask and an optimized region mask; generates an image dataset for optimizing an adversarial background based on the person region mask and the optimized region mask; uses an image enhancement method to enhance the image dataset to obtain a person dataset; constructs a physical domain adversarial background generation framework based on a target detection model; constructs a multi-objective loss function; inputs the person dataset into the framework, uses the multi-objective loss function to calculate the gradient value, optimizes and updates the pixel value of the adversarial background through a backpropagation method until a preset number of iterations is reached, and outputs the final adversarial background.

[0129] The embodiments of the present invention can solve the shortcomings of traditional deep neural network target detection models, such as insufficient robustness to complex environmental interference in the physical world and imbalance between concealment and generalization, and explore new visual attack and defense strategies. The embodiments of the present invention convert traditional surface pasting to background pasting to achieve adversarial attacks, generate high-quality artistic adversarial backgrounds for adversarial attacks, and improve the robustness and security of visual detection models through the strategy of using offense to promote defense.

[0130] Figure 5 This is a block diagram of a device for generating an artistic adversarial background according to an exemplary embodiment, wherein the device is used in a method for generating an artistic adversarial background. Figure 5 The device includes a first acquisition unit 510, a processing unit 520, a construction unit 530, and an optimization unit 540.

[0131] The first acquisition unit 510 is configured to acquire an image dataset of different human body movements; and process the dataset using an automated method to obtain a human region mask and an optimized region mask.

[0132] The processing unit 520 is configured to generate an image dataset for optimizing the anti-background image according to the person region mask and the optimized region mask; and enhance the image dataset using an image enhancement method to obtain a person dataset.

[0133] A construction unit 530 is used to construct a physical domain adversarial background generation framework based on the target detection model; and to construct a multi-objective loss function;

[0134] The optimization unit 540 is used to input the character dataset into the framework, calculate the gradient value using a multi-objective loss function, optimize and update the pixel value of the adversarial background through backpropagation until a preset number of iterations is reached, and output the final adversarial background.

[0135] Optionally, the multi-objective loss function includes: a detection adversarial loss function, a style loss function, and a content loss function; wherein the multi-objective loss function is expressed by the following formula (1):

[0136] (1)

[0137] in, represents the multi-objective loss function; represents the detection adversarial loss function; represents the style loss function; represents the content loss function.

[0138] Optionally, the detection adversarial loss function is composed of a confidence level and a classification probability of a model; the lower the value of the detection adversarial loss function, the stronger the adversarial performance;

[0139] The style loss function is used to ensure that the style of the adversarial background is consistent with the target style image;

[0140] The content loss function is used to ensure that the content of the adversarial background area is consistent with the content of the target image.

[0141] Optionally, the detection adversarial loss function is expressed by the following formula (2):

[0142] (2)

[0143] in, Represents the detection adversarial loss function value; represents the first hyperparameter set; Represents the output score after the target detection model; represents the second hyperparameter of the setting; Indicates the confidence level of the output result; Represents the classification probability of the target detection model.

[0144] Optionally, the style loss function is expressed by the following formula (3):

[0145] (3)

[0146] in, Represents the style loss function value; Represents the weight coefficient, which refers to the size of the style proportion; A feature map representing the target style image; A feature map representing a candidate adversarial background image; Gram matrix representing the target style image; Gram matrix representing the candidate adversarial background image.

[0147] Optionally, the content loss function is expressed by the following formula (4):

[0148] (4)

[0149] in, Represents the value of the content loss function; The weight coefficient representing the content loss; Represents the target content image; Represents the adversarial background image during the optimization process.

[0150] Optionally, the optimization unit 340 is configured to:

[0151] The person dataset is input into the physical domain adversarial background generation framework based on the target detection model, processed by the target detection model, and the score is output;

[0152] The output score is input into the detection adversarial loss function to calculate the recognition confidence and probability of the person in the adversarial background to obtain the detection adversarial loss;

[0153] Input the acquired adversarial background image into the VGG network model for feature extraction to obtain the image features of the adversarial background; input the acquired target style image into the VGG network model for feature extraction to obtain the features of the target style image; calculate the style loss function based on the features of the target style image and the image features of the adversarial background;

[0154] Based on the acquired target content image and adversarial background image, the mean error of each pixel between the adversarial background and the target content image is calculated using the content loss function to obtain the content loss.

[0155] According to the detection adversarial loss, style loss, and content loss, a reverse iterative method is used to optimize and update the pixels of the adversarial background. When the preset number of rounds is reached, the final adversarial background is output.

[0156] An embodiment of the present invention first obtains an image dataset of different human body movements; uses an automated method to process the dataset to obtain a person region mask and an optimized region mask; generates an image dataset for optimizing an adversarial background based on the person region mask and the optimized region mask; uses an image enhancement method to enhance the image dataset to obtain a person dataset; constructs a physical domain adversarial background generation framework based on a target detection model; constructs a multi-objective loss function; inputs the person dataset into the framework, uses the multi-objective loss function to calculate the gradient value, optimizes and updates the pixel value of the adversarial background through a backpropagation method until a preset number of iterations is reached, and outputs the final adversarial background.

[0157] The embodiments of the present invention can solve the shortcomings of traditional deep neural network target detection models, such as insufficient robustness to complex environmental interference in the physical world and imbalance between concealment and generalization, and explore new visual attack and defense strategies. The embodiments of the present invention convert traditional surface pasting to background pasting to achieve adversarial attacks, generate high-quality artistic adversarial backgrounds for adversarial attacks, and improve the robustness and security of visual detection models through the strategy of using offense to promote defense.

[0158] Figure 6 FIG. 1 is a schematic diagram of a device for generating an artistic adversarial background according to an embodiment of the present invention. Figure 6 As shown, the artistic adversarial background generation device may include the above Figure 5Optionally, the artistic adversarial background generating device 610 may include a first processor 2001 .

[0159] Optionally, the artistic adversarial background generation device 610 may further include a memory 2002 and a transceiver 2003 .

[0160] The first processor 2001, the memory 2002 and the transceiver 2003 may be connected via a communication bus.

[0161] The following combination Figure 6 The components of the artistic adversarial background generation device 610 are described in detail:

[0162] The first processor 2001 is the control center of the artistic adversarial background generation device 610 and can be a single processor or a collective term for multiple processing elements. For example, the first processor 2001 can be one or more central processing units (CPUs), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs) or one or more field programmable gate arrays (FPGAs).

[0163] Optionally, the first processor 2001 may execute various functions of the artistic adversarial background generating device 610 by running or executing a software program stored in the memory 2002 and calling data stored in the memory 2002 .

[0164] In a specific implementation, as an embodiment, the first processor 2001 may include one or more CPUs, such as Figure 6 CPU0 and CPU1 are shown in FIG.

[0165] In a specific implementation, as an embodiment, the artistic adversarial background generation device 610 may also include multiple processors, such as Figure 6 1 and 2. The first processor 2001 and the second processor 2004 are shown in FIG. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). A processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0166] The memory 2002 is used to store the software program for executing the solution of the present invention, and is controlled by the first processor 2001 for execution. The specific implementation method can refer to the above method embodiment and will not be repeated here.

[0167] Alternatively, the memory 2002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but not limited thereto. The memory 2002 may be integrated with the first processor 2001 or exist independently and accessed through the interface circuit ( Figure 6 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0168] The transceiver 2003 is used to communicate with a network device or a terminal device.

[0169] Optionally, the transceiver 2003 may include a receiver and a transmitter ( Figure 6 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0170] Optionally, the transceiver 2003 may be integrated with the first processor 2001 or may exist independently and be connected to the artistic adversarial background generation device 610 through an interface circuit ( Figure 6 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0171] It should be noted that Figure 6 The structure of the artistic adversarial background generating device 610 shown in the figure does not constitute a limitation on the router. The actual knowledge structure recognition device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0172] In addition, the technical effects of the artistic adversarial background generation device 610 can refer to the technical effects of the artistic adversarial background generation method described in the above method embodiment, and will not be repeated here.

[0173] It should be understood that the first processor 2001 in the embodiment of the present invention may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, etc.

[0174] It should also be understood that the memory in the embodiments of the present invention may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0175] The above embodiments can be implemented in whole or in part via software, hardware (e.g., circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions or computer programs. When loaded or executed on a computer, the processes or functions described in accordance with the embodiments of the present invention are fully or partially performed. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired means (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium accessible by a computer or a data storage device such as a server or data center that contains a collection of one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. The semiconductor media can be a solid-state drive.

[0176] It should be understood that the term "and / or" as used herein simply describes a relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A alone, A and B together, or B alone. A and B can be singular or plural. Furthermore, the character " / " as used herein generally indicates an "or" relationship between the associated objects, but it may also indicate an "and / or" relationship. For specific understanding, please refer to the context.

[0177] In this disclosure, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, "at least one of a, b, or c" can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0178] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0179] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0180] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0181] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of the device or unit, which can be electrical, mechanical or other forms.

[0182] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0183] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0184] If the functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or the portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include various media that can store program code, such as USB flash drives, mobile hard drives, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical disks.

[0185] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for generating an artistic adversarial background, characterized in that: The method comprises: S1. Obtain an image dataset of different human body movements; process the dataset using an automated method to obtain a human region mask and an optimized region mask; S2. Generate an image dataset for optimizing the anti-background based on the person region mask and the optimized region mask; and enhance the image dataset using an image enhancement method to obtain a person dataset. S3. Build a physical domain adversarial background generation framework based on the target detection model; build a multi-objective loss function; S4. Input the character dataset into the framework, use the multi-objective loss function to calculate the gradient value, optimize and update the pixel value of the adversarial background through the backpropagation method until the preset iteration rounds are reached, and output the final adversarial background.

2. The method for generating an artistic adversarial background according to claim 1, characterized in that: The multi-objective loss function includes: a detection adversarial loss function, a style loss function, and a content loss function; wherein the multi-objective loss function is expressed by the following formula (1): （1） in, represents the multi-objective loss function; represents the detection adversarial loss function; represents the style loss function; represents the content loss function.

3. The method for generating an artistic adversarial background according to claim 2, characterized in that: The detection adversarial loss function is composed of a confidence level and a classification probability of the model; the lower the value of the detection adversarial loss function, the stronger the adversarial performance; The style loss function is used to ensure that the style of the adversarial background is consistent with the target style image; The content loss function is used to ensure that the content of the adversarial background area is consistent with the content of the target image.

4. The method for generating an artistic adversarial background according to claim 2, wherein: The detection adversarial loss function is expressed by the following formula (2): （2） in, Represents the detection adversarial loss function value; represents the first hyperparameter set; Represents the output score after the target detection model; represents the second hyperparameter of the setting; Indicates the confidence level of the output result; Represents the classification probability of the target detection model.

5. The method for generating an artistic adversarial background according to claim 2, wherein: The style loss function is expressed by the following formula (3): （3） in, Represents the style loss function value; Represents the weight coefficient, which refers to the size of the style proportion; A feature map representing the target style image; A feature map representing a candidate adversarial background image; Represents the target style image Gram matrix; Gram matrix representing the candidate adversarial background image.

6. The method for generating an artistic adversarial background according to claim 2, characterized in that: The content loss function is expressed by the following formula (4): （4） in, Represents the value of the content loss function; The weight coefficient representing the content loss; Represents the target content image; Represents the adversarial background image during the optimization process.

7. The method for generating an artistic adversarial background according to claim 1, characterized in that: The S4 inputs the character dataset into the framework, calculates the gradient value using a multi-objective loss function, optimizes and updates the pixel value of the adversarial background by backpropagation until a preset number of iterations is reached, and outputs the final adversarial background, including: S41. Input the person dataset into the physical domain adversarial background generation framework based on the target detection model, process it through the target detection model, and output a score; S42. Input the output score into the detection adversarial loss function to calculate the recognition confidence and probability of the person in the adversarial background to obtain the detection adversarial loss; S43, inputting the acquired adversarial background image into the VGG network model for feature extraction to obtain image features of the adversarial background; inputting the acquired target style image into the VGG network model for feature extraction to obtain features of the target style image; calculating the style loss using a style loss function based on the features of the target style image and the features of the adversarial background image; S44, based on the obtained target content image and adversarial background image, calculate the mean error of each pixel of the adversarial background and target content image using a content loss function to obtain a content loss; S45. Based on the detection adversarial loss, style loss, and content loss, a reverse iterative method is used to optimize and update the pixels of the adversarial background. When the preset number of rounds is reached, the final adversarial background is output.

8. A device for generating an artistic adversarial background, wherein the device is used to implement the method for generating an artistic adversarial background according to any one of claims 1 to 7, characterized in that: The device comprises: The first acquisition unit is configured to acquire an image dataset of different human body movements; and process the dataset using an automated method to obtain a human region mask and an optimized region mask. A processing unit is configured to generate an image dataset for optimizing the anti-background according to the person region mask and the optimized region mask; and enhance the image dataset using an image enhancement method to obtain a person dataset; A construction unit is used to build a physical domain adversarial background generation framework based on the target detection model; and to build a multi-objective loss function; The optimization unit is used to input the character dataset into the framework, calculate the gradient value using a multi-objective loss function, optimize and update the pixel value of the adversarial background through backpropagation until a preset number of iterations is reached, and output the final adversarial background.

9. A device for generating an artistic adversarial background, characterized in that: The device for generating the artistic adversarial background includes: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program code, which can be called by a processor to execute the method according to any one of claims 1 to 7.

Images