Three-dimensional point cloud anti-attack method oriented to laser radar guidance

Abstract

The invention relates to a three-dimensional point cloud attack resisting method oriented to laser radar guidance, and the method comprises the steps: dividing an original point cloud into a plurality of space regions, evaluating the contribution value of each region to a classification decision, and selecting a region with the highest contribution as a salient region; calculating the saliency score of each point in the salient region, and dynamically selecting the first K points with the highest saliency score to form a disturbance subset; and carrying out space compact disturbance operation on the subset, introducing a multi-distance joint regularization mechanism to maintain geometric structure consistency in a disturbance process, and generating a confrontation point cloud sample with concealment and attack intensity. The method is beneficial to generating the confrontation sample with higher concealment and attack intensity, a higher attack success rate is realized, and the geometric consistency between the confrontation sample and the original point cloud is effectively kept.

Description

Technical Field

[0001] The present invention relates to the field of counter-attack technology, and in particular to a three-dimensional point cloud counter-attack method for laser radar guidance. Background Art

[0002] 3D point cloud adversarial attacks involve adding tiny perturbations to raw point cloud data, disrupting deep neural networks' recognition and classification, thereby inducing the models to make erroneous decisions. This method can be used to enhance model robustness, but it can pose serious risks in safety-critical scenarios such as autonomous driving and robotics.

[0003] Extensive research in the field has focused on point-based perturbation methods, gradually developing a series of specific strategies. One fundamental approach involves global point perturbation based on the gradient direction. Liu et al. proposed applying the Fast Gradient Method (FGM) directly to point clouds. This approach perturbs the entire point cloud by calculating the gradient of a loss function with respect to point positions and, under the L2 norm constraint, slightly shifting each point in the gradient direction. Xiang et al. further proposed a C&W attack framework for point clouds. This framework optimizes the perturbed point cloud by minimizing a combined objective function between the perturbation distance of each point and maximizing the target loss. Building on this, they designed two types of insertion attacks: cluster-level point insertion inserts a group of neighboring points into the original point cloud to form small clusters, causing interference in the local space; and object-level insertion introduces complete 3D structural fragments (such as a partial object outline) to enhance attack capabilities. These methods all rely on optimizing the perturbation objective function and inserting intervening structures into the point space. Zheng et al. calculated the gradient sensitivity of each point, constructed a saliency map, and identified points with high contribution as keypoints. Subsequently, these points are removed or pulled toward the center of mass of the entire point cloud to minimize structural damage. Wen et al. proposed a geometry-aware regularization method to improve the naturalness and local coherence of adversarial perturbations. This method introduces two geometric constraints into the adversarial objective function: minimizing local curvature changes to maintain surface smoothness of the point cloud; and controlling structural smoothness to prevent sudden changes in local regions. This method effectively suppresses outliers and noticeable distortions. Cai et al. adopted a similar approach, introducing a geometric regularization term but emphasizing the use of the local structural prior of the point cloud. By analyzing the K-neighborhood structure of each point, they maintain the neighborhood topology during perturbation, ensuring that local perturbations do not affect the overall morphological perception. Tsai et al. proposed a KNN-based regularization mechanism embedded in the C&W framework. By constraining the neighborhood distance relationship between each perturbed point and its original point, this mechanism maintains a compact distribution of perturbed points in the local space while suppressing the formation of outliers. At the spatial transformation level, Huang et al. proposed a tangent plane perturbation method. This method first locally fits a tangent plane to each point and transforms the perturbation space from a three-dimensional coordinate system to the tangent plane coordinate system. In this new coordinate system, the perturbation is performed only along the tangent plane, thereby better controlling the perturbation direction and maintaining the surface continuity of the point cloud. Kim et al. designed a lightweight perturbation method that focuses on perturbing or inserting only a very small number of points and sets a point count threshold to limit the perturbation. By constraining the perturbation ratio, this method increases the imperceptibility of the attack and is suitable for practical applications requiring stealth.

[0004] However, existing adversarial attack methods for 3D point clouds still suffer from the following issues: 1) Some existing point-based adversarial attack methods use saliency analysis to select a small number of high-contribution points for perturbation, aiming to improve attack efficiency and control the perturbation range. However, since these salient points are typically dispersed within the point cloud and lack spatial aggregation and global structural constraints, the perturbations exhibit discontinuous and chaotic forms, disrupting the consistency of local geometric structures and, in turn, reducing the imperceptibility of adversarial examples. 2) Existing methods that introduce geometric regularization perturbation constraints still suffer from lax geometric consistency control in practical applications. Most methods only impose constraints locally, making it difficult to maintain the overall structural integrity of the perturbed region. This can easily lead to local geometric distortion and the generation of outliers, causing the overall shape of the adversarial example to deviate from the original point cloud, compromising its naturalness and physical feasibility. Summary of the Invention

[0005] The purpose of the present invention is to provide a three-dimensional point cloud adversarial attack method for lidar guidance, which is conducive to generating adversarial samples with higher concealment and attack strength, achieving a higher attack success rate, and effectively maintaining the geometric consistency between the adversarial samples and the original point cloud.

[0006] In order to achieve the above-mentioned objectives, the technical solution adopted by the present invention is: a three-dimensional point cloud adversarial attack method for lidar guidance, which divides the original point cloud into multiple spatial regions, evaluates the contribution of each region to the classification decision and selects the region with the highest contribution as the salient region; calculates the significance score of each point in the salient region, and dynamically selects the top K points with the highest significance scores to form a perturbation subset; performs a spatially compact perturbation operation on the subset, and introduces a multi-distance joint regularization mechanism to maintain the consistency of the geometric structure during the perturbation process, thereby generating adversarial point cloud samples with concealment and attack strength.

[0007] Furthermore, the method specifically comprises the following steps:

[0008] S1: Load the original point cloud data and its corresponding label information as the input basis for the attack, and load the weight parameters of the model to be attacked;

[0009] S2: Initialize the adversarial point cloud, copy the original point cloud as the initial adversarial sample, and initialize the perturbation offset to zero;

[0010] S3: Apply the farthest point sampling method to the original point cloud to obtain m points as the center points of the spatial region; then, according to the distance relationship between each point and these center points, each point is assigned to the area corresponding to the nearest center point, thus realizing the spatial division of the entire point cloud;

[0011] S4: Calculate the geometric center of the entire point cloud as a reference for subsequent perturbation simulations; use a full permutation strategy to sample each region multiple times; during each sampling, move the points in each region to the geometric center of the point cloud to simulate the situation where the region is removed, and calculate the marginal contribution value of each region to quantify the impact of the region on the model output;

[0012] S5: Sort each region according to its marginal contribution value, select the top K regions with the highest marginal contribution value as the significant regions, calculate the significance scores of the points in the significant regions, and extract the top K points with the highest significance scores as the perturbation objects to form the perturbation subset;

[0013] S6: Iteratively calculate the gradient of the current state of the adversarial point cloud with respect to the total loss function of the model, and extract the sign information of the gradient to determine the perturbation direction;

[0014] S7: Calculate the perturbation amount based on the gradient ratio of the three-dimensional coordinate axis, combined with the perturbation intensity coefficient and the regional index weight, and update the perturbation subset and adversarial point cloud;

[0015] S8: Repeat steps S3 to S7 until the maximum number of iterations is reached, and output the adversarial point cloud sample with the minimum loss.

[0016] Furthermore, in step S5, the specific method for calculating the significance score of the points in the salient region is:

[0017] (1)

[0018] Among them, I i represents the significance score of the i-th point, where the subscript i represents the i-th point, and λ1, λ2, λ3, and λ4 represent weighting coefficients used to balance the contributions of different items; represents the anti-disturbance intensity parameter of the i-th point; represents the consistency parameter of the perturbation direction of the i-th point; represents the shape change intensity parameter of the i-th point; represents the disturbance stability parameter of the i-th point;

[0019] The top K points with the highest significance scores in the salient region are extracted to form the perturbation subset; and the ratio of the perturbation subset to the total number of points in the salient region is defined as p_ratio.

[0020] Furthermore, the anti-disturbance intensity parameter The calculation formula is shown in formula (2):

[0021] (2)

[0022] in, The disturbance strength parameter of the i-th point is measured by the gradient vector norm; , , respectively represent the components of the gradient of the i-th point on the x-axis, y-axis and z-axis;

[0023] The disturbance direction consistency parameter The calculation formula of the disturbance direction consistency parameter is shown in formula (3):

[0024] (3)

[0025] wherein, The disturbance direction consistency parameter of the i-th point is measured by the cosine value of the angle between the gradient direction of the i-th point and the vector pointing to the geometric center of the point cloud, reflecting whether the disturbance deviates from the overall structure; The vector pointing to the geometric center of the i-th point is represented by The gradient direction of the i-th point is represented by

[0026] The shape change strength parameter The calculation formula of the shape change strength parameter is shown in formula (4):

[0027] (4)

[0028] wherein, The shape change strength parameter of the i-th point is measured by the Euclidean distance between the i-th point and the geometric center of the point cloud; c represents the geometric center of the point cloud; p i The coordinate position of the i-th point is represented by

[0029] The disturbance stability parameter The calculation formula of the disturbance stability parameter is shown in formula (5):

[0030] (5)

[0031] wherein, The disturbance stability parameter of the i-th point is represented by std; std represents the standard deviation function, mean represents the absolute value average function, and ε is a set minimum value.

[0032] Further, the specific method for generating the adversarial point cloud is as follows:

[0033] For the j-th point in the original point cloud, first determine whether it belongs to the disturbance subset in the saliency region; then calculate the gradient grad of the point under the current classification target, and take the sign of the gradient sign(grad) to represent the disturbance direction; then according to the three-dimensional coordinate axis disturbance proportion Ration, the disturbance strength parameter eps_strength, the disturbance offset offset, and the saliency region index Region idx, jointly determine the direction and amplitude of the disturbance; finally, add the disturbance to the coordinates of the current point as the disturbance result of the point in the i-th iteration;

[0034] The expression of the disturbance is shown in formula (6):

[0035] (6)

[0036] in, represents the original point cloud, represents the adversarial point cloud, idx is the index of the salient region; during the iterative optimization process, the perturbation strength is dynamically adjusted according to the proportion of the selected perturbation points; the perturbation strength eps_strength is calculated using formula (7):

[0037] (7)

[0038] Among them, min_eps represents the lower limit of the attack strength, and max_eps represents the upper limit of the attack strength; min_eps, max_eps and k are all predefined constants; the attack strength is dynamically adjusted according to the ratio p_ratio of the perturbation subset to the total number of points in the significance area.

[0039] Furthermore, in step S6, the expression of the total loss function is shown in formula (8):

[0040] (8)

[0041] (9)

[0042] in, represents the original point cloud, represents the adversarial point cloud; represents the adversarial loss function, which quantifies the effectiveness of the attack; In order to constrain the size of the perturbation to ensure the regularization term of imperceptibility, the regularization term is composed of multiple geometric distances, including Chamfer distance, Hausdorff distance and L2 distance; hyperparameters Used to adjust the balance between attack effect and disturbance amplitude; , , They are all hyperparameters used to control the weight of each loss.

[0043] Furthermore, the expressions of the Chamfer distance, Hausdorff distance and L2 distance are shown in equations (10), (11) and (12), respectively:

[0044] (10)

[0045] (11)

[0046] (12)

[0047] Among them, a represents the point in the adversarial point cloud, b represents the point in the original point cloud, and n is the number of points in the point cloud sample.

[0048] Furthermore, this method is applied to UAV navigation and obstacle avoidance based on lidar guidance and vehicle autonomous driving based on lidar guidance. By generating adversarial point cloud samples with high concealment and attack intensity, it interferes with the training of target detection and tracking models in the lidar guidance system, thereby generating target detection and tracking models with higher robustness.

[0049] The present invention also provides a computer device comprising: at least one processor, at least one memory, and computer program instructions stored in the memory. When the computer program instructions are executed by the processor, they are used to implement the above-mentioned adversarial point cloud generation method, including steps such as calculating the saliency score of the salient area and optimizing multiple distance constraints.

[0050] The present invention also provides a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, are used to implement the above-mentioned adversarial point cloud generation method.

[0051] Compared with existing technologies, the present invention has the following advantages: It proposes a 3D point cloud adversarial attack method based on saliency-driven perturbation and distance constraints, which achieves efficient attack effectiveness without significantly disrupting the geometric structure of the point cloud. By identifying local regions in the point cloud that significantly influence classification decisions and selecting key points with strong salience within these regions for perturbation, the attack effectiveness and imperceptibility of adversarial examples are improved. Furthermore, the present invention designs a dynamic perturbation strategy that adaptively adjusts the number and amplitude of perturbations based on the saliency distribution, achieving precise perturbations of key areas and further enhancing the stealth and adaptability of the attack. During the optimization process, the present invention introduces a multi-distance joint constraint mechanism to constrain the perturbation process, effectively maintaining the integrity and spatial continuity of the point cloud structure while improving the success rate of point cloud adversarial attacks. This method has specific applications in autonomous driving systems, drone navigation, and robotic perception. It can effectively simulate the adversarial interference attacks that lidar sensors may face in real-world environments, helping to improve the robustness and security of target recognition and path planning algorithms. By generating highly concealed adversarial samples, it can be used to evaluate the security of lidar data processing modules and verify protection strategies, promote the reliable operation of related systems in complex dynamic environments, and thus solve the perception accuracy and safety issues of autonomous vehicles and drones in complex traffic and harsh weather conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is an overall framework diagram of the method of an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0054] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present application belongs.

[0055] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0056] This embodiment provides a three-dimensional point cloud adversarial attack method for lidar guidance. The method divides the original point cloud into multiple spatial regions, evaluates the contribution of each region to the classification decision, and selects the region with the highest contribution as the salient region; calculates the saliency score of each point in the salient region, and dynamically selects points with higher saliency scores (the top K points with the highest saliency scores) to form a perturbation subset; performs a spatially compact perturbation operation on the subset, and introduces a multi-distance joint regularization mechanism to maintain the consistency of the geometric structure during the perturbation process, thereby generating adversarial point cloud samples with stealth and attack strength. Figure 1 As shown, the method is specifically performed in the following steps.

[0057] S1: Load the original point cloud data and its corresponding label information as the input basis for the attack, and load the weight parameters of the model to be attacked.

[0058] S2: Initialize the adversarial point cloud, copy the original point cloud as the initial adversarial sample, and initialize the perturbation offset to zero;

[0059] S3: Apply the farthest point sampling (FPS) method to the original point cloud to obtain m points as the center points of the spatial region; then, based on the distance relationship between each point and these center points, each point is assigned to the area corresponding to the nearest center point to achieve spatial division of the entire point cloud.

[0060] S4: Calculate the geometric center of the entire point cloud as a reference for subsequent perturbation simulations; use a full permutation strategy to sample each region multiple times; during each sampling, move the points in each region to the geometric center of the point cloud to simulate the situation where the region is "removed" and calculate the marginal contribution value of each region to quantify the impact of the region on the model output;

[0061] S5: Sort each region according to its marginal contribution value, select the top K regions with the highest marginal contribution value as the significant regions, calculate the significance scores of the points in the significant regions, and extract the top K points with the highest significance scores as the perturbation objects to form the perturbation subset.

[0062] The specific method for calculating the significance score of points in the salient area is:

[0063] (1)

[0064] Among them, I i represents the significance score of the i-th point, where the subscript i represents the i-th point, and λ1, λ2, λ3, and λ4 represent weighting coefficients used to balance the contributions of different items; represents the anti-disturbance intensity parameter of the i-th point; represents the consistency parameter of the perturbation direction of the i-th point; represents the shape change intensity parameter of the i-th point; represents the disturbance stability parameter of the i-th point.

[0065] The anti-disturbance strength parameter The calculation formula is shown in formula (2):

[0066] (2)

[0067] in, is the perturbation strength parameter of the i-th point, measured by the gradient vector norm; 、 、 Represent the components of the gradient of the i-th point on the x-axis, y-axis, and z-axis respectively.

[0068] The disturbance direction consistency parameter The calculation formula is shown in formula (3):

[0069] (3)

[0070] in, is the consistency parameter of the perturbation direction of the i-th point, which is measured by the cosine value of the angle between the gradient direction of the i-th point and the vector pointing to the geometric center of the point cloud, reflecting whether the perturbation deviates from the overall structure; Represents the vector pointing from the i-th point to the geometric center; Represents the gradient direction of the i-th point.

[0071] The shape change intensity parameter The calculation formula is shown in formula (4):

[0072] (4)

[0073] in, is the shape change intensity parameter of the i-th point, measured by the Euclidean distance between the i-th point and the geometric center of the point cloud. The larger the distance, the greater the potential impact of its disturbance on the overall shape. Points farther from the center are more likely to cause significant deformation of the overall shape. c represents the geometric center of the point cloud. p i Indicates the coordinate position of the i-th point.

[0074] The disturbance stability parameter The calculation formula is shown in formula (5):

[0075] (5)

[0076] in, is the perturbation stability parameter of the i-th point, which is used to evaluate the stability of the perturbation direction of the point. A smaller value indicates a more stable and reliable gradient direction, while a larger value indicates that the point may be in a locally unstable or noise-sensitive area. std represents the standard deviation function, mean represents the absolute value mean function, and ε is the set minimum value. ε is close to 0, which is used to avoid numerical instability problems when the denominator is zero.

[0077] The top K points with the highest significance scores in the salient region are extracted to form the perturbation subset; and the ratio of the perturbation subset to the total number of points in the salient region is defined as p_ratio.

[0078] In this embodiment, the specific method of generating the adversarial point cloud is:

[0079] For the jth point in the original point cloud, first determine whether it belongs to the perturbation subset in the salient region; then calculate the gradient grad of the point under the current classification target, and take its sign sign(grad) to represent the perturbation direction; then according to the three-dimensional coordinate axis perturbation ratio Ration, perturbation strength parameter eps_strength, perturbation offset offset, and salient region index Region idx , jointly determine the direction and amplitude of the disturbance; finally, add the disturbance to the coordinates of the current point as the disturbance result of the point in the i-th iteration;

[0080] The expression of the disturbance is shown in formula (6):

[0081] (6)

[0082] in, represents the original point cloud, represents the adversarial point cloud, idx is the index of the salient region; during the iterative optimization process, the perturbation strength is dynamically adjusted according to the proportion of the selected perturbation points; the perturbation strength eps_strength is calculated using formula (7):

[0083] (7)

[0084] Among them, min_eps represents the lower limit of the attack strength, and max_eps represents the upper limit of the attack strength; min_eps, max_eps and k are all predefined constants; the attack strength is dynamically adjusted according to the ratio p_ratio of the perturbation subset to the total number of points in the significance area.

[0085] S6: Iteratively calculate the gradient of the current state of the adversarial point cloud with respect to the total loss function of the model, and extract the sign information of the gradient to determine the perturbation direction.

[0086] wherein, the expression of the total loss function is shown as formula (8) :

[0087] (8)

[0088] (9)

[0089] wherein, represents an original point cloud, represents an adversarial point cloud; represents an adversarial loss function, which quantifies the effectiveness of the attack; is a regularization term for constraining the size of the perturbation to ensure imperceptibility, which is jointly composed of multiple geometric distances, including Chamfer distance, Hausdorff distance and L2 distance; and hyperparameter is used to regulate the balance between attack effect and perturbation amplitude; are all hyperparameters, which are used to control the weight of each loss.

[0090] The expressions of the Chamfer distance, Hausdorff distance and L2 distance are shown as formula (10), (11), (12) respectively:

[0091] (10)

[0092] (11)

[0093] (12)

[0094] wherein, a represents a point in the adversarial point cloud, b represents a point in the original point cloud, and n is the number of points in the point cloud sample.

[0095] S7: According to the gradient proportion of the three-dimensional coordinate axis, combined with the perturbation intensity coefficient and the regional index weight, the perturbation amount is calculated, and the perturbation subset and the adversarial point cloud are updated.

[0096] S8: Repeat steps S3-S7 until the maximum number of iterations is reached, and output the adversarial point cloud sample with the minimum loss.

[0097] ​​The three-dimensional point cloud counterattack method for lidar guidance provided by the present invention can be applied to fields such as drone navigation and obstacle avoidance based on lidar guidance and vehicle automatic driving based on lidar guidance. This method addresses the problems of insufficient robustness and lack of protection against adversarial samples in lidar point cloud target recognition. By generating adversarial point cloud samples with high concealment and attack strength, it interferes with the training of target detection and tracking models in the lidar guidance system, thereby generating a target detection and tracking model with higher robustness, thereby improving the safety and reliability of the lidar guidance system.

[0098] The proposed LiDAR-guided 3D point cloud counterattack method addresses the existing problem of countering disturbances, which often struggles to balance attack effectiveness with geometric structure fidelity. It primarily includes the following key technologies:

[0099] First, a perturbation strategy based on saliency analysis is proposed. By calculating the importance of each local area in the point cloud to the classification decision, the most influential salient areas are accurately identified. Based on this, key points with strong saliency are selected as perturbation targets. This enables fine perturbation operations on points within a limited area, significantly improving perturbation efficiency. At the same time, the adversarial point cloud maintains a high degree of visual consistency with the original point cloud, enhancing the imperceptibility of adversarial samples.

[0100] Second, we designed a dynamic perturbation mechanism that adaptively adjusts the number of perturbation points and the perturbation amplitude in each round based on the saliency distribution. This allows the perturbation strategy to flexibly adapt to the current point cloud characteristics and effectively control the spatial distribution of the perturbation, thereby improving the attack stability and generalization ability in different scenarios.

[0101] Third, a multi-distance joint constraint mechanism is constructed. During the optimization process, multiple geometric metrics such as Chamfer distance, Hausdorff distance and L2 distance are introduced as joint regularization terms to guide the perturbation direction, maintain the geometric structure continuity of the point cloud, further enhance the naturalness of adversarial samples at the visual and structural levels, and take into account both attack effectiveness and structural fidelity.

[0102] By integrating these key technologies, this paper constructs a comprehensive LiDAR-guided 3D point cloud adversarial attack method based on saliency-driven and multi-distance constraints. Experimental evaluation on point cloud classification datasets such as ModelNet40 and ShapeNet Part demonstrates that this method significantly outperforms existing methods in terms of attack success rate and imperceptibility.

[0103] Although existing point-based adversarial attack methods have introduced various regularization strategies to improve the imperceptibility of perturbations, they still have certain shortcomings. They often lead to scattered perturbation distribution, the generation of outliers, or unreasonable geometric deformation, which in turn affects the authenticity of the point cloud structure and the concealment of the attack samples. To this end, the innovative three-dimensional point cloud adversarial attack method proposed in this paper dynamically perturbs key points in the salient area based on saliency analysis, adaptively controls the number and amplitude of perturbation points, and maintains the spatial concentration of the perturbation area, thereby effectively reducing geometric structure distortion, improving the naturalness and imperceptibility of adversarial samples, and achieving a more stable point cloud adversarial attack effect with practical application value.

[0104] This embodiment also provides a computer device, comprising: at least one processor, at least one memory, and computer program instructions stored in the memory. When the computer program instructions are executed by the processor, they are used to implement the above-mentioned adversarial point cloud generation method, including steps such as calculating the saliency score of the salient area and optimizing multiple distance constraints.

[0105] This embodiment further provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the computer program instructions are used to implement the above-mentioned adversarial point cloud generation method.

[0106] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0108] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0110] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other manner. Any person skilled in the art may utilize the above-disclosed technical content to modify or modify the present invention into equivalent embodiments. However, any simple modifications, equivalent variations, and modifications to the above embodiments that do not depart from the technical content of the present invention and are based on the technical essence of the present invention remain within the scope of protection of the present invention.

Claims

1. A three-dimensional point cloud counterattack method for laser radar guidance, characterized in that: The original point cloud is divided into multiple spatial regions, the contribution of each region to the classification decision is evaluated, and the region with the highest contribution is selected as the salient region; the significance score of each point in the salient region is calculated, and the top K points with the highest significance scores are dynamically selected to form the perturbation subset; A spatially compact perturbation operation is performed on the subset, and a multi-distance joint regularization mechanism is introduced to maintain the geometric structure consistency during the perturbation process, generating adversarial point cloud samples with concealment and attack strength.

2. The laser radar-guided three-dimensional point cloud counterattack method according to claim 1, characterized in that: The specific steps include: S1: Load the original point cloud data and its corresponding label information as the input basis for the attack, and load the weight parameters of the model to be attacked; S2: Initialize the adversarial point cloud, copy the original point cloud as the initial adversarial sample, and initialize the perturbation offset to zero; S3: Apply the farthest point sampling method to the original point cloud to obtain m points as the center points of the spatial region; then, according to the distance relationship between each point and these center points, each point is assigned to the area corresponding to the nearest center point, thus realizing the spatial division of the entire point cloud; S4: Calculate the geometric center of the entire point cloud as a reference for subsequent disturbance simulations; use a full permutation strategy to sample each area multiple times; At each sampling, the points in each area are moved as a whole to the geometric center of the point cloud to simulate the situation where the area is removed, and the marginal contribution value of each area is calculated to quantify the impact of the area on the model output results; S5: Sort each region according to its marginal contribution value, select the top K regions with the highest marginal contribution value as the significant regions, calculate the significance scores of the points in the significant regions, and extract the top K points with the highest significance scores as the perturbation objects to form the perturbation subset; S6: Iteratively calculate the gradient of the current state of the adversarial point cloud with respect to the total loss function of the model, and extract the sign information of the gradient to determine the perturbation direction; S7: Calculate the perturbation amount based on the gradient ratio of the three-dimensional coordinate axis, combined with the perturbation intensity coefficient and the regional index weight, and update the perturbation subset and adversarial point cloud; S8: Repeat steps S3 to S7 until the maximum number of iterations is reached, and output the adversarial point cloud sample with the minimum loss.

3. The laser radar-guided three-dimensional point cloud counterattack method according to claim 2, characterized in that: In step S5, the specific method for calculating the saliency score of the points in the salient region is: (1) Among them, I i represents the significance score of the i-th point, where the subscript i represents the i-th point, and λ1, λ2, λ3, and λ4 represent weighting coefficients used to balance the contributions of different items; represents the anti-disturbance intensity parameter of the i-th point; represents the consistency parameter of the perturbation direction of the i-th point; represents the shape change intensity parameter of the i-th point; represents the disturbance stability parameter of the i-th point; The top K points with the highest significance scores in the salient region are extracted to form the perturbation subset; and the ratio of the perturbation subset to the total number of points in the salient region is defined as p_ratio.

4. The laser radar-guided three-dimensional point cloud counterattack method according to claim 3, characterized in that: The anti-disturbance strength parameter The calculation formula is shown in formula (2): (2) in, is the perturbation strength parameter of the i-th point, measured by the gradient vector norm; 、 、 Represent the components of the gradient of the i-th point on the x-axis, y-axis, and z-axis respectively; The disturbance direction consistency parameter The calculation formula is shown in formula (3): (3) in, is the consistency parameter of the perturbation direction of the i-th point, which is measured by the cosine value of the angle between the gradient direction of the i-th point and the vector pointing to the geometric center of the point cloud, reflecting whether the perturbation deviates from the overall structure; Represents the vector pointing from the i-th point to the geometric center; Represents the gradient direction of the i-th point; The shape change intensity parameter The calculation formula is shown in formula (4): (4) in, is the shape change intensity parameter of the i-th point, measured by the Euclidean distance between the i-th point and the geometric center of the point cloud; c represents the geometric center of the point cloud; p i Indicates the coordinate position of the i-th point; The disturbance stability parameter The calculation formula is shown in formula (5): (5) in, is the disturbance stability parameter of the i-th point; std represents the standard deviation function, mean represents the absolute value mean function, and ε is the set minimum value.

5. The laser radar-guided three-dimensional point cloud counterattack method according to claim 2, characterized in that: The specific method for generating adversarial point clouds is: For the jth point in the original point cloud, first determine whether it belongs to the perturbation subset in the salient region; then calculate the gradient grad of the point under the current classification target, and take its sign sign(grad) to represent the perturbation direction; then according to the three-dimensional coordinate axis perturbation ratio Ration, perturbation strength parameter eps_strength, perturbation offset offset, and salient region index Region idx , jointly determine the direction and amplitude of the disturbance; finally, add the disturbance to the coordinates of the current point as the disturbance result of the point in the i-th iteration; The expression of the disturbance is shown in formula (6): (6) in, represents the original point cloud, represents the adversarial point cloud, idx is the index of the salient region; during the iterative optimization process, the perturbation strength is dynamically adjusted according to the proportion of the selected perturbation points; the perturbation strength eps_strength is calculated using formula (7): (7) Among them, min_eps represents the lower limit of the attack strength, and max_eps represents the upper limit of the attack strength; min_eps, max_eps and k are all predefined constants; the attack strength is dynamically adjusted according to the ratio p_ratio of the perturbation subset to the total number of points in the significance area.

6. The laser radar-guided three-dimensional point cloud counterattack method according to claim 2, characterized in that: In step S6, the expression of the total loss function is shown in formula (8): (8) (9) in, represents the original point cloud, represents the adversarial point cloud; represents the adversarial loss function, which quantifies the effectiveness of the attack; In order to constrain the size of the perturbation to ensure the regularization term of imperceptibility, the regularization term is composed of multiple geometric distances, including Chamfer distance, Hausdorff distance and L2 distance; hyperparameters Used to adjust the balance between attack effect and disturbance amplitude; , , They are all hyperparameters used to control the weight of each loss.

7. The laser radar-guided three-dimensional point cloud counterattack method according to claim 6, characterized in that: The expressions of the Chamfer distance, Hausdorff distance and L2 distance are shown in formulas (10), (11) and (12) respectively: (10) (11) (12) Among them, a represents the point in the adversarial point cloud, b represents the point in the original point cloud, and n is the number of points in the point cloud sample.

8. The laser radar-guided three-dimensional point cloud counterattack method according to any one of claims 1 to 7, characterized in that: This method is applied to UAV navigation and obstacle avoidance based on lidar guidance and vehicle autonomous driving based on lidar guidance. By generating adversarial point cloud samples with high concealment and attack strength, it interferes with the training of target detection and tracking models in the lidar guidance system, thereby generating target detection and tracking models with higher robustness.

9. A computer device comprising a memory and a processor, characterized in that: When the processor executes the computer program stored in the memory, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images