Unmanned system monocular depth estimation credibility evaluation method and device based on black box adversarial perturbation

Abstract

Embodiments of the present disclosure disclose an unmanned system monocular depth estimation credibility evaluation method and device based on black box adversarial perturbation. A specific embodiment of the method comprises: constructing an image data set; performing depth estimation on a target image through a target model; performing three-dimensional reconstruction according to the target image and a first depth map; generating an original texture seed; generating a target texture seed; generating an adversarial sample; generating a second depth image; performing texture parameter optimization on the target texture seed according to the first depth image, the second depth image and a loss function; and generating a credibility evaluation result for the target model according to the optimal texture perturbation. The embodiment provides a guarantee for the reliability of the unmanned system monocular depth estimation task.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of computer technology, particularly the field of artificial intelligence security technology, and specifically to a method and apparatus for assessing the credibility of monocular depth estimation for unmanned systems based on black-box adversarial perturbation. Background Technology

[0002] Monocular depth estimation, as a core technology for environmental perception in unmanned systems, directly determines the operational safety and mission efficiency of autonomous platforms such as unmanned vehicles and drones in complex environments. In particular, in extreme scenarios such as deep space exploration and polar expeditions, visual systems must cope with multiple challenges, including dynamic changes in illumination and interference from various media (such as lunar dust and snow / fog). For example, taking a lunar rover as an example, its visual navigation module faces extremely high dynamic range illumination changes during lunar day-night cycles, causing abrupt changes in depth estimation values ​​in shadowed areas. Furthermore, submicron-level lunar dust coverage formed by electrostatic adsorption can drastically reduce the success rate of feature matching. Similar problems have also appeared in other unmanned systems, exposing the vulnerability of current monocular depth estimation modules in unstructured environments.

[0003] Existing evaluation methods have fundamental limitations in addressing the needs of unmanned systems. First, traditional digital attack methods (such as PGD (Project Gradient Descent) and FGSM (Fast Gradient Sign Method)) generate adversarial examples that only consider the intensity of perturbations in the pixel space for gradient optimization. While this can reveal model weaknesses, it fails to establish a mapping relationship between physical parameters and adversarial modes. Key constraints such as environmental changes and viewpoint changes are not encoded into the attack generation space, leading to systematic biases in the generated adversarial examples in the physical dimension. Second, while existing black-box evaluation techniques (such as SquareAttack) circumvent model dependency issues, their high-dimensional space traversal mechanism triggers exponential query requirements. This computationally intensive characteristic fundamentally conflicts with the real-time requirements of unmanned systems, as the processors on the system cannot handle the limited parallel computing capabilities. Finally, current evaluation systems are disconnected from mission scenarios. In unmanned systems, especially in extreme environments, evaluation metrics can become completely ineffective due to significant environmental differences. For example, pixel-level error metrics (such as MAE (Mean Absolute Error) and RMSE (Root Mean Square Error)) cannot characterize motion control risks triggered by depth anomalies. Summary of the Invention

[0004] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0005] Some embodiments of this disclosure propose a method and apparatus for evaluating the reliability of monocular depth estimation in unmanned systems based on black-box adversarial perturbation, in order to solve the technical problems mentioned in the background section above.

[0006] In a first aspect, some embodiments of this disclosure provide a method for evaluating the credibility of monocular depth estimation in an unmanned system based on black-box adversarial perturbation. The method includes: constructing an image dataset, wherein the image data in the image dataset includes: preprocessed images, viewpoint information, and weather information, and the initial image corresponding to the preprocessed image is acquired by the unmanned system; performing depth estimation on the target image using a target model to obtain a first depth map, wherein the target model is a monocular depth estimation model to be attacked, and the target image is a preprocessed image selected from the image dataset for adversarial attack; performing 3D reconstruction based on the target image and the first depth map to generate a target 3D model; generating an original texture seed under a black-box attack framework; generating a target texture seed through style transfer based on the original texture seed; generating adversarial examples based on the target texture seed and the target 3D model; generating a second depth image based on the target model and the adversarial examples; optimizing the texture parameters of the target texture seed based on the first depth image, the second depth image, and a loss function to generate an optimal texture perturbation; and generating a credibility evaluation result for the target model based on the optimal texture perturbation.

[0007] Secondly, some embodiments of this disclosure provide a reliability assessment device for monocular depth estimation of an unmanned system based on black-box adversarial perturbation. The device includes: a construction unit configured to construct an image data set, wherein the image data in the image data set includes: preprocessed images, viewpoint information, and weather information, and the initial image corresponding to the preprocessed image is acquired by the unmanned system; a depth estimation unit configured to perform depth estimation on a target image using a target model to obtain a first depth map, wherein the target model is a monocular depth estimation model to be attacked, and the target image is a preprocessed image selected from the image dataset for adversarial attack; and a 3D reconstruction unit configured to perform 3D reconstruction based on the target image and the first depth map. The system generates a target 3D model. A first generation unit is configured to generate an original texture seed within a black-box attack framework. A second generation unit is configured to generate a target texture seed based on the original texture seed through style transfer. A third generation unit is configured to generate adversarial examples based on the target texture seed and the target 3D model. A fourth generation unit is configured to generate a second depth image based on the target model and the adversarial examples. A texture parameter optimization unit is configured to optimize the texture parameters of the target texture seed based on the first depth image, the second depth image, and a loss function to generate optimal texture perturbations. A fifth generation unit is configured to generate a credibility evaluation result for the target model based on the optimal texture perturbations.

[0008] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0009] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

[0010] The embodiments disclosed above have the following beneficial effects: The black-box adversarial perturbation-based unmanned system monocular depth estimation credibility assessment method of some embodiments of this disclosure overcomes the technical bottlenecks of traditional methods in terms of environmental adaptability, attack effectiveness, and assessment credibility. By integrating adversarial generation technology, a 3D texture perturbation framework with environmental robustness and query efficiency is constructed, enabling the generation of adversarial examples without relying on prior model knowledge. Combining high-fidelity environmental simulation and physical constraint optimization algorithms, the perception bias of the depth estimation system under multiple stresses such as weathered rock texture interference, high dynamic lighting distortion, and lunar dust suspension interference is quantitatively evaluated, providing assurance for the reliability of unmanned system monocular depth estimation tasks. Attached Figure Description

[0011] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0012] Figure 1 This is a flowchart of some embodiments of the monocular depth estimation credibility assessment method for unmanned systems based on black-box adversarial perturbation according to the present disclosure;

[0013] Figure 2 This is a schematic diagram of the structure of some embodiments of the monocular depth estimation reliability assessment device for unmanned systems based on black-box adversarial perturbation according to the present disclosure;

[0014] Figure 3 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation

[0015] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0016] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0017] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0018] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0019] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0020] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] refer to Figure 1 The diagram illustrates a flowchart 100 of some embodiments of the black-box adversarial perturbation-based monocular depth estimation reliability assessment method for unmanned systems according to this disclosure. This black-box adversarial perturbation-based monocular depth estimation reliability assessment method for unmanned systems includes the following steps:

[0022] Step 101: Construct an image dataset.

[0023] In some embodiments, the implementing entity (e.g., a computing device) of the black-box adversarial perturbation-based unmanned system monocular depth estimation reliability assessment method can construct an image dataset. The image data in the image dataset includes: preprocessed images, viewpoint information, and weather information. For example, the preprocessed images, viewpoint information, and weather information included in the image data can be stored in the form of triples. The viewpoint information can characterize the acquisition angle of the initial image corresponding to the preprocessed image. The weather information can characterize the weather conditions of the initial image corresponding to the preprocessed image at the time of image acquisition. The initial image corresponding to the preprocessed image is acquired by an unmanned system. For example, the initial image can be a lunar surface image acquired by an image acquisition system on a lunar rover.

[0024] It should be noted that the aforementioned computing devices can be either hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or a single terminal device. When the computing device is software, it can be installed on the hardware devices listed above. It can be implemented as, for example, multiple software programs or software modules used to provide distributed services, or as a single software program or software module. No specific limitations are made here.

[0025] In some optional implementations of certain embodiments, the aforementioned execution entity constructs an image data set, including the following steps:

[0026] Step S1: For each initial image in the initial image set, perform the following processing steps:

[0027] Step S11: Based on the contrast adjustment parameters, brightness adjustment parameters, and random noise parameters, perform image preprocessing on the initial image to obtain the preprocessed image corresponding to the initial image.

[0028] In practice, weather enhancement techniques can be used to enhance the initial images collected by unmanned systems, generating pre-processed images that conform to extreme environments (e.g., high light intensity, high dust levels). Specifically, the following formula can be used to preprocess the initial image to generate the corresponding pre-processed image:

[0029] .

[0030] in, This represents the preprocessed image. Indicates the initial image. This indicates the contrast adjustment parameter. This indicates the brightness adjustment parameters. This represents random noise. In particular, The brightness adjustment parameter has positive values ​​to increase image brightness and negative values ​​to decrease image brightness. Random noise is used to simulate dust or fog. By adjusting these three parameters, the preprocessed image is made to more closely resemble a realistic dusty environment.

[0031] Step S12: Obtain the weather information and viewpoint information corresponding to the initial image above.

[0032] In practice, the initial set of images can be represented as:

[0033] .

[0034] in, Represents the initial set of images. Indicates the serial number. This indicates the number of initial images in the initial image set. Indicates the first Zhang's initial image.

[0035] The set of weather information corresponding to the initial set of images can be represented as:

[0036] .

[0037] in, Represents a collection of weather information. Indicates the serial number. This indicates the number of weather entries in the weather information set. Indicates the first Weather information corresponding to the initial image.

[0038] The set of viewpoint information corresponding to the initial set of images can be represented as:

[0039] .

[0040] in, Represents a set of viewpoint information. Indicates the serial number. This indicates the number of viewpoint information items in the viewpoint information set. Indicates the first Viewpoint information corresponding to the initial image.

[0041] Since there is a one-to-one correspondence between the initial images in the initial image set, the weather information in the weather information set, and the viewpoint information in the viewpoint information set, the corresponding weather information in the weather information set and the corresponding viewpoint information in the viewpoint information set can be determined by the sequence number of the initial image in the initial image set.

[0042] Step S13: Based on the preprocessed image corresponding to the initial image, weather information, and viewpoint information, generate image data corresponding to the initial image in the image data set.

[0043] In practice, the preprocessed image corresponding to the initial image, weather information, and viewpoint information can be used as a triple to obtain the corresponding image data.

[0044] Image datasets can be represented as:

[0045] .

[0046] in, Represents a collection of image data. Indicates the serial number. This indicates the number of image data in the image dataset. Indicates the first Image data.

[0047] Step 102: Perform depth estimation on the target image using the target model to obtain the first depth map.

[0048] In some embodiments, the aforementioned execution entity can perform depth estimation on the target image using a target model to obtain a first depth map. The target model is a monocular depth estimation model to be attacked. The target image is a preprocessed image selected from an image dataset for adversarial attacks. The first depth map is a map containing depth information.

[0049] In practice, the target model can be a Monodepth2 model, a Depth-Hints model, etc. The pre-trained weights corresponding to the target model can be obtained and loaded. Then, the target image is used as input to the target model to generate the first depth map corresponding to the target image. The generation of the first depth map can be abstracted into the following formula:

[0050] .

[0051] in, Represents the first depth image. Represent the target model, Indicates pre-trained weights, This represents the target image.

[0052] Step 103: Perform 3D reconstruction based on the target image and the first depth map to generate a 3D model of the target.

[0053] In some embodiments, the aforementioned execution entity can perform 3D reconstruction based on the target image and the first depth map to generate a target 3D model. The target 3D model is a 3D model (3D shape) constructed for the scene corresponding to the target image by combining the 2D target image and the corresponding first depth map. 3D reconstruction can be performed using mesh-based 3D reconstruction models (e.g., MeshMVS model), point cloud-based 3D reconstruction models (e.g., 3D-LMNet model), or voxel-based 3D reconstruction models (e.g., Pix2vox model). The 3D reconstruction process can be abstracted as follows:

[0054] .

[0055] in, Represents the first depth image. Represents the target 3D model. This represents the target image. This indicates the 3D reconstruction process.

[0056] Step 104: Generate the original texture seed under the black-box attack framework.

[0057] In some embodiments, the aforementioned execution entity can generate the original texture seed within a black-box attack framework.

[0058] In some optional implementations of certain embodiments, the aforementioned execution entity generates the original texture seed under a black-box attack framework, including:

[0059] Within the black-box attack framework, the original texture seed is generated through probabilistic sampling and score-based optimization iterations.

[0060] In practice, firstly, for the target region in an image (e.g., a preprocessed image set extracted from multiple image datasets to generate the original texture seed), at least one square sub-region can be randomly selected (e.g., using probability sampling). The target region can be a pre-defined image region within the target image. Secondly, a scoring mechanism is used to evaluate the impact of each square sub-region within the at least one square sub-region on the depth estimation bias. Through multiple rounds of optimization iterations, the position, size, and perturbation intensity of the square sub-regions are dynamically adjusted to obtain the original texture seed. The original texture seed can maximize the prediction error of the target model without significantly altering the visual appearance of the target image, thus serving as the basis for subsequent style transfer and optimization. Specifically, the above optimization iteration process can be abstracted into the following formula:

[0061] .

[0062] in, This represents the image being processed within the image set. and These represent the image height and image width corresponding to the image being processed in the image set, respectively. This indicates the number of images in the image set. Since the square sub-region is square, This represents the original texture seed. Since a square sub-region in the image needs to be dynamically adjusted, the original texture seed is square. The side length of the original texture seed. This represents the coordinates of the original texture seed in the image being processed. This represents the unoptimized raw texture seed. Indicates in Connection Multiple images, Indicates in Connection Multiple images used as references This represents the concatenation function. Represent the target model, Indicates pre-trained weights, This represents the arithmetic mean function. In particular, since the feature dimension corresponding to the output of the target model is... ,therefore, , and All must satisfy the feature dimensions corresponding to the output of the target model.

[0063] In particular, compared to other attack methods targeting monocular depth estimation models, the black-box attack framework allows for model attacks without requiring model information.

[0064] Step 105: Generate the target texture seed based on the original texture seed through style conversion.

[0065] In some embodiments, the aforementioned execution entity can generate a target texture seed based on the original texture seed through style transfer.

[0066] In some optional implementations of some embodiments, the aforementioned execution entity generates a target texture seed based on the original texture seed through style transfer, including:

[0067] By combining basic style features, a neural style transfer algorithm is used to perform style transfer on the original texture seed in order to generate the target texture seed.

[0068] The basic style features include: logo features and natural texture features. In practice, logo features can be architectural signage, etc. Natural texture features can be weathered rock texture features, vegetation texture features, etc.

[0069] In practice, to make adversarial textures (texture seeds) more covert and adaptable in the real world, style transfer is introduced to process the original texture seeds. Specifically, the Neural Style Transfer (NST) algorithm can combine the original texture seed with basic style features to generate a new texture that is both adversarial and scene-coordinated, serving as the target texture seed. The following loss function is used during the style transfer process:

[0070] .

[0071] in, Represented as a content loss function, Represents the style loss function, This represents the total variation loss. and Let these represent the hyperparameters of the style loss function and the total variation loss, respectively. and The default values ​​are 0.1 and 0.01. , and All represent serial numbers. Represents the images in the image set.

[0072] The content loss function measures the similarity between the generated image and the original image at the feature level, ensuring that the generated image maintains semantic structural consistency with the original image. Specifically, the content loss function is shown in the following formula:

[0073] .

[0074] in, This indicates that the generated image is in the convolutional neural network at the 1st rank. Feature maps extracted from layers, This indicates the original image in the convolutional neural network. Feature maps extracted from layers, and These are the channel and spatial location indices of the feature map, respectively.

[0075] The style loss function measures the similarity between the generated image and the target style image in terms of texture and color distribution. In other words, the style loss function encourages the generated image to conform to the target style image in terms of texture features. The style loss function is shown in the following formula:

[0076] .

[0077] in, and The generated image and the target style image are respectively represented in the first... The Gram matrix of the layer, and These are the channel and spatial location indices of the feature map, respectively. Indicates the first The number of channels corresponding to the feature map of the layer. Indicates the first The spatial dimension (i.e., number of pixels) of each channel of the feature map of the layer. Indicates the first The weight of the layer's loss.

[0078] In practice, firstly, to ensure the obtained target texture seed is perturbed, so that it can maximize the interference with monocular depth estimation and preserve texture details as much as possible, a content loss function and a style loss function are set. Furthermore, the environment in which unmanned systems operate often contains landmark features and natural texture features. To combine the texture seed with environmental information as much as possible and improve stealth, a total variation loss is designed to make the generated texture as smooth as possible. This is achieved by optimizing the loss function. This allows the resulting target texture seed to retain both antagonism and a natural appearance.

[0079] As an example, the target model could be the Monodepth2 model.

[0080] Step 106: Generate adversarial examples based on the target texture seed and the target 3D model.

[0081] In some embodiments, the aforementioned execution entity can generate adversarial examples based on the target texture seed and the target 3D model.

[0082] In some optional implementations of some embodiments, the execution entity generates adversarial examples based on the target texture seed and the target 3D model, including:

[0083] Step S1: Attach the above target texture seed to the above target 3D model to generate the attached 3D model.

[0084] In practice, firstly, to ensure the naturalness and continuity of the texture in three-dimensional space, the target texture seed needs to be processed by flipping, folding, and splicing before attachment. Then, the processed target texture seed is attached to the surface of the target three-dimensional model to obtain the attached three-dimensional model.

[0085] Step S2: Perform a two-dimensional projection on the above-attached 3D model to obtain adversarial examples.

[0086] In practice, the aforementioned execution entity can employ neural rendering technology to project the attached 3D model onto a 2D plane, obtaining a projected 2D graphic as an adversarial example. Neural rendering technology combines deep neural networks and a physics engine for rendering. Adversarial examples obtained in this way can effectively simulate the effects of attacks in physical time.

[0087] As an example, taking the lunar exploration scenario of an unmanned vehicle as an example, the neural radiation field algorithm can be used to attach the processed target texture seed to the surface of the target 3D model, and combine it with parameters such as material reflectivity and lunar dust distribution to generate a reproducible 3D point cloud, which can be used to construct the attached 3D model.

[0088] Step 107: Generate a second depth image based on the target model and adversarial examples.

[0089] In some embodiments, the aforementioned execution entity can generate a second depth image based on the target model and adversarial examples. In practice, the adversarial examples can be input into the target model to obtain the second depth image corresponding to the adversarial examples.

[0090] Step 108: Based on the first depth image, the second depth image, and the loss function, optimize the texture parameters of the target texture seed to generate the optimal texture perturbation.

[0091] In some embodiments, the execution entity can optimize the texture parameters of the target texture seed based on the first depth image, the second depth image, and the loss function to generate the optimal texture perturbation. In practice, the loss function can be as follows:

[0092] .

[0093] in, , This represents the mean square error function. Represent the target model, Indicates adversarial examples, Indicates pre-trained weights, Indicates the mask. Indicates hyperparameters, The value can be 0.1 as the default value.

[0094] Furthermore, to ensure the effectiveness of the attack in the physical world, the corresponding printability needs to be considered; therefore, we assume... ,in, Indicates the side length of the texture seed. Represents the set of texture colors of an object. Indicates the color of an object's texture. and All represent serial numbers. express The middle pixel coordinates are The color value at that location is used in conjunction with the object's texture color set. Each element in the dataset is matched using minimum distance to measure its printability. This is achieved by combining the aforementioned loss function to minimize... To achieve the target, repeat steps 102 to 108, adjusting the texture parameters corresponding to the target texture seed in reverse, until... Convergence is achieved, yielding the optimal texture perturbation that maximizes the model error. For example, the number of iterations can be set to 500. Specifically, constraints can be set to counteract the consistency of texture style with the background environment. and used to maximize the output error of the monocular depth estimation model This avoids detection by anomaly detection algorithms in unmanned systems. Furthermore, by maximizing the output error of the monocular depth estimation model, Dynamically adjust the weight of the attack zone.

[0095] Step 109: Generate a credibility evaluation result for the target model based on the optimal texture perturbation.

[0096] In some embodiments, the aforementioned execution entity can generate a credibility evaluation result for the target model based on the optimal texture perturbation. In practice, for a preprocessed image, the preprocessed image and the preprocessed image with the optimal texture perturbation superimposed are used as model inputs to the target model, respectively, to obtain two model outputs. A credibility evaluation result is then generated based on the difference between the two model outputs.

[0097] The embodiments disclosed above have the following beneficial effects: The black-box adversarial perturbation-based unmanned system monocular depth estimation credibility assessment method of some embodiments of this disclosure overcomes the technical bottlenecks of traditional methods in terms of environmental adaptability, attack effectiveness, and assessment credibility. By integrating adversarial generation technology, a 3D texture perturbation framework with environmental robustness and query efficiency is constructed, enabling the generation of adversarial examples without relying on prior model knowledge. Combining high-fidelity environmental simulation and physical constraint optimization algorithms, the perception bias of the depth estimation system under multiple stresses such as weathered rock texture interference, high dynamic lighting distortion, and lunar dust suspension interference is quantitatively evaluated, providing assurance for the reliability of unmanned system monocular depth estimation tasks.

[0098] Experiments show that the method is highly effective against mainstream monocular depth estimation models, such as Monodepth2 and Depth-Hints, with an average depth estimation error of up to 0.88m, representing a 2.1% improvement over suboptimal methods. Furthermore, its efficiency far surpasses conventional genetic algorithms and random search algorithms. In addition, the method presented here demonstrates strong generalization ability and robustness in cross-dataset transfer and against attacks from different weather conditions and image acquisition perspectives.

[0099] Further reference Figure 2 As an implementation of the methods shown in the above figures, this disclosure provides some embodiments of a monocular depth estimation reliability assessment device for unmanned systems based on black-box adversarial perturbation. These device embodiments are similar to... Figure 1 Corresponding to the method embodiments shown, this black-box adversarial perturbation-based monocular depth estimation reliability assessment device for unmanned systems can be specifically applied to various electronic devices.

[0100] like Figure 2 As shown, a monocular depth estimation credibility assessment device 200 for unmanned systems based on black-box adversarial perturbation in some embodiments includes: a construction unit 201, a depth estimation unit 202, a 3D reconstruction unit 203, a first generation unit 204, a second generation unit 205, a third generation unit 206, a fourth generation unit 207, a texture parameter optimization unit 208, and a fifth generation unit 209. The construction unit 201 is configured to construct an image dataset, wherein the image data in the image dataset includes: preprocessed images, viewpoint information, and weather information, and the initial image corresponding to the preprocessed image is acquired by the unmanned system; the depth estimation unit 202 is configured to perform depth estimation on a target image using a target model to obtain a first depth map, wherein the target model is the monocular depth estimation model to be attacked, and the target image is a preprocessed image selected from the image dataset for adversarial attack; the 3D reconstruction unit 203 is configured to perform 3D reconstruction based on the target image and the first depth map to generate a target 3D model; the first generation unit 204 is configured to perform black-box adversarial perturbation on a target image to generate a target 3D model; Within the framework, an original texture seed is generated; a second generation unit 205 is configured to generate a target texture seed based on the original texture seed through style transfer; a third generation unit 206 is configured to generate adversarial examples based on the target texture seed and the target 3D model; a fourth generation unit 207 is configured to generate a second depth image based on the target model and the adversarial examples; a texture parameter optimization unit 208 is configured to optimize the texture parameters of the target texture seed based on the first depth image, the second depth image, and a loss function to generate an optimal texture perturbation; and a fifth generation unit 209 is configured to generate a credibility evaluation result for the target model based on the optimal texture perturbation.

[0101] It is understandable that the units and references described in the black-box-based unmanned system monocular depth estimation reliability assessment device 200 are related to the [unclear text - possibly related to a specific type of device]. Figure 1 The steps in the described method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method are also applicable to the monocular depth estimation reliability evaluation device 200 for unmanned systems based on black-box adversarial perturbation and the units contained therein, and will not be repeated here.

[0102] The following is for reference. Figure 3 It illustrates a schematic diagram of the structure of an electronic device (e.g., a computing device) suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality or scope of the embodiments of this disclosure. Figure 3 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The memory may include a non-volatile storage medium and internal memory. The non-volatile storage medium may store an operating system and a computer program. The computer program includes program instructions that, when executed, cause the processor to perform any of the methods described above. The processor provides computational and control capabilities to support the operation of the entire computer device. The internal memory provides an environment for the execution of the computer program in the non-volatile storage medium; when executed by the processor, the computer program causes the processor to perform any of the methods described above. The network interface is used for network communication, such as sending assigned tasks. Those skilled in the art will understand that... Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the computer device to which the present disclosure is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0103] It should be understood that the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, a general-purpose processor can be a microprocessor or any conventional processor.

[0104] In one embodiment, the processor is configured to run a computer program stored in a memory to perform the following steps: constructing an image dataset, wherein the image data in the image dataset includes: preprocessed images, viewpoint information, and weather information, and the initial image corresponding to the preprocessed image is acquired by an unmanned system; performing depth estimation on a target image using a target model to obtain a first depth map, wherein the target model is a monocular depth estimation model to be attacked, and the target image is a preprocessed image selected from the image dataset for adversarial attacks; performing 3D reconstruction based on the target image and the first depth map to generate a target 3D model; generating an original texture seed under a black-box attack framework; generating a target texture seed based on the original texture seed through style transfer; generating adversarial examples based on the target texture seed and the target 3D model; generating a second depth image based on the target model and the adversarial examples; optimizing the texture parameters of the target texture seed based on the first depth image, the second depth image, and a loss function to generate an optimal texture perturbation; and generating a credibility evaluation result for the target model based on the optimal texture perturbation.

[0105] This disclosure also provides a computer-readable storage medium storing a computer program, the computer program including program instructions, and the method implemented when the program instructions are executed can be referred to the various embodiments of the methods described above.

[0106] The aforementioned computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiments, such as the hard disk or memory of the computer device. Alternatively, the aforementioned computer-readable storage medium may be an external storage device of the computer device, such as a plug-in hard disk, SmartMedia Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the computer device.

[0107] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0108] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A reliability assessment method for monocular depth estimation in unmanned systems based on black-box adversarial perturbation, characterized in that, include: An image dataset is constructed, in which the image data includes: preprocessed images, viewpoint information, and weather information. The initial images corresponding to the preprocessed images are acquired by an unmanned system. The first depth map is obtained by performing depth estimation on the target image using the target model. The target model is the monocular depth estimation model to be attacked, and the target image is a preprocessed image selected from the image dataset for adversarial attack. A 3D model of the target is generated by performing 3D reconstruction based on the target image and the first depth map. Generate the original texture seed under the black-box attack framework; By using style transfer, a target texture seed is generated based on the original texture seed; Based on the target texture seed and the target 3D model, generate adversarial examples; Generate a second depth image based on the target model and adversarial examples; Based on the first depth image, the second depth image, and the loss function, the texture parameters of the target texture seed are optimized to generate the optimal texture perturbation; Based on the optimal texture perturbation, a reliability evaluation result for the target model is generated, wherein the construction of the image dataset includes: For each initial image in the initial image set, perform the following processing steps: Based on the contrast adjustment parameters, brightness adjustment parameters, and random noise parameters, the initial image is preprocessed to obtain the preprocessed image corresponding to the initial image. Obtain the weather information and viewpoint information corresponding to the initial image; Based on the preprocessed image corresponding to the initial image, weather information, and viewpoint information, image data corresponding to the initial image is generated from the image data set, wherein... The process of generating the original texture seed within the black-box attack framework includes: Within the black-box attack framework, the original texture seed is generated through probabilistic sampling and score-based optimization iterations. The process of generating a target texture seed based on the original texture seed through style transfer includes: By combining basic style features, a neural style transfer algorithm is used to style transfer the original texture seed to generate the target texture seed. The basic style features include: signature features and natural texture features.

2. The method according to claim 1, characterized in that, The step of generating adversarial examples based on the target texture seed and the target 3D model includes: The target texture seed is attached to the target 3D model to generate the attached 3D model; The attached 3D model is then projected into two dimensions to obtain adversarial examples.

3. A reliability assessment device for monocular depth estimation of unmanned systems based on black-box adversarial perturbation, characterized in that, include: The construction unit is configured to construct an image dataset, wherein the image data in the image dataset includes: preprocessed images, viewpoint information, and weather information, and the initial images corresponding to the preprocessed images are acquired by an unmanned system; The depth estimation unit is configured to perform depth estimation on the target image using the target model to obtain a first depth map, wherein the target model is the monocular depth estimation model to be attacked, and the target image is a preprocessed image selected from the image dataset for adversarial attack purposes. The 3D reconstruction unit is configured to perform 3D reconstruction based on the target image and the first depth map to generate a 3D model of the target. The first generation unit is configured to generate the original texture seed under the black-box attack framework; The second generation unit is configured to generate a target texture seed based on the original texture seed through style transfer; The third generation unit is configured to generate adversarial examples based on the target texture seed and the target 3D model; The fourth generation unit is configured to generate a second depth image based on the target model and adversarial examples; The texture parameter optimization unit is configured to optimize the texture parameters of the target texture seed based on the first depth image, the second depth image, and the loss function to generate the optimal texture perturbation; The fifth generation unit is configured to generate a credibility evaluation result for the target model based on the optimal texture perturbation, wherein the construction of the image dataset includes: For each initial image in the initial image set, perform the following processing steps: Based on the contrast adjustment parameters, brightness adjustment parameters, and random noise parameters, the initial image is preprocessed to obtain the preprocessed image corresponding to the initial image. Obtain the weather information and viewpoint information corresponding to the initial image; Based on the preprocessed image corresponding to the initial image, weather information, and viewpoint information, image data corresponding to the initial image is generated from the image data set, wherein... The process of generating the original texture seed within the black-box attack framework includes: Within the black-box attack framework, the original texture seed is generated through probabilistic sampling and score-based optimization iterations. The process of generating a target texture seed based on the original texture seed through style transfer includes: By combining basic style features, a neural style transfer algorithm is used to style transfer the original texture seed to generate the target texture seed. The basic style features include: signature features and natural texture features.

4. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 2.

5. A computer-readable medium, characterized in that, It stores a computer program thereon, wherein the computer program, when executed by a processor, implements the method as described in any one of claims 1 to 2.

Images