A physical adversarial sample generation method, system, device and storage medium based on multi-scale filtering

Abstract

The application discloses a kind of physical adversarial sample generation methods, systems, equipment and storage medium based on multiscale filtering, belong to artificial intelligence security field, including S1: obtaining image data;S2: using channel attention and pixel attention to remove fog of foggy day data;S3: using neural renderer and multiscale filtering combination, generate different scale, angle, pitch angle adversarial sample;S4: based on the detection result of target detection model constantly adjust loss function, optimize adversarial texture;S5: output final generated image;The application combines defogging algorithm, restores the definition and contrast of image, so that target detector can still effectively detect adversarial texture under low visibility environment;The adversarial sample generated by the application has robustness under a variety of complex conditions, effectively improves the ability of adversarial target detection.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security, specifically relating to a method, system, device, and storage medium for generating physical adversarial samples based on multi-scale filtering. Background Technology

[0002] Physical adversarial sample generation refers to a method of generating adversarial samples by adding carefully designed patterns to real-world objects using computer technology, so that the objects can mislead the perturbed model.

[0003] Deep neural network (DNN) technology is increasingly widely used in computer vision, achieving remarkable performance in areas such as autonomous driving and security monitoring. However, adversarial example generation, by adding carefully designed perturbations to the input data, can easily cause DNNs to make incorrect judgments, which not only seriously affects the security of the model but also prompts researchers to explore more effective defense strategies.

[0004] Existing methods demonstrate good perturbation effects in close-range scenes, but their success rate drops significantly in long-range scenes. This is because object detectors rely on multi-scale feature fusion to identify targets at different distances. In long-range scenes, target pixel areas are small, and high-frequency signals (such as edge and texture details) are compressed or even lost in the image, making it difficult for adversarial textures to effectively affect the object detector at long distances. Furthermore, traditional adversarial perturbations rely on high-frequency details, which are attenuated by the reduced image resolution at long distances, further weakening their effectiveness.

[0005] In the field of physical adversarial example generation for object detection, although various methods have been proposed, most have significant limitations. Patch-based methods, while capable of generating general image patches, suffer from reduced perturbation capabilities in complex physical scenes. Camouflage-based methods, such as DAS (Dual Attention Suppression Attack, generating adversarial camouflage in the physical world), FCA (learning 3D full-coverage vehicle camouflage for multi-view physical adversarial purposes), DTA (physical camouflage using differentiable transformation networks), MFA (Multi-texture Fusion Attack, robust adversarial camouflage in the physical world), and RAUCA (a novel physical adversarial approach against vehicle detectors by generating robust and accurate camouflage), while improving performance and robustness to some extent, have not effectively addressed the problem of adversarial texture failure at long distances and in complex weather conditions. This is because at long distances, target pixel areas are small, and high-frequency signals are compressed and lost, making it difficult for adversarial textures to affect the target detector; in complex weather conditions, especially fog, image clarity and contrast are reduced, making adversarial textures easily obscured. Meanwhile, adversarial textures generated by traditional methods rely on high-frequency details. At long distances, image resolution decreases, high-frequency details degrade, and the effectiveness is further weakened. Furthermore, in the physical world, adversarial example generation must also consider factors such as lighting and viewpoint changes, which places higher demands on the robustness and adaptability of existing methods. Summary of the Invention

[0006] In response to the problems mentioned in the background art, this invention proposes a method, system, device and storage medium for generating physical adversarial samples based on multi-scale filtering. By decomposing the adversarial texture into features of different scales and filtering the features of each scale, high-frequency noise is removed and key low-frequency features are retained, thereby enhancing the robustness of the adversarial texture at long distances. At the same time, combined with a dehazing algorithm, the clarity and contrast of the image are restored.

[0007] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0008] A method for generating physical adversarial examples based on multi-scale filtering includes the following steps:

[0009] S1: Acquire image data;

[0010] S2: Introduces channel attention and pixel attention mechanisms, and optimizes the dehazing process through a loss function;

[0011] S21: Introduce intersection-over-union loss, object confidence loss, and classification loss into channel attention;

[0012] S22: Introducing smoothing loss into pixel attention enhances the sharpness and detail of the dehazed image while reducing noise;

[0013] S23: Concatenate the feature maps after channel attention processing and the feature maps after pixel attention processing to fuse feature information from different levels and preserve key details of the image.

[0014] S3: Using a combination of neural renderer and multi-scale filtering, adversarial examples of different scales, angles, and pitch angles are generated;

[0015] S31: Wavelet transform is used for multi-scale decomposition to decompose adversarial textures into features of different scales;

[0016] S32: Perform Gaussian filtering on the decomposed features;

[0017] S33: Perform wavelet transform smoothing on the filtered features;

[0018] S4: Continuously adjust the loss function based on the detection results of the object detection model to optimize the adversarial texture;

[0019] S5: Output the final generated image.

[0020] As a preferred option, the specific process in S23 is as follows:

[0021] The two feature maps are merged along the channel dimension, followed by convolution to extract higher-level features, and then upsampling is performed through bilinear interpolation to restore the resolution of the feature maps; finally, a dehazed image is generated through convolution.

[0022] As a preferred option, in S31, wavelet transform is used for multi-scale decomposition, specifically as follows:

[0023] ,

[0024] in, Represents the wavelet coefficients at scale s; This represents the value of the input texture T at position i; N represents the number of image groups in the dataset; This represents the wavelet basis function at scale s and position i; s represents the scale parameter in the multiscale decomposition.

[0025] Preferably, in S33, the specific process of performing wavelet transform smoothing on the filtered features is as follows:

[0026] First, the filtered features are decomposed into wavelet coefficients of different scales;

[0027] Then, thresholding is performed on the high-frequency components to remove noise;

[0028] Finally, the processed wavelet coefficients are recombined using inverse wavelet transform to form the final smooth texture.

[0029] Preferably, the filtered features are first decomposed into wavelet coefficients of different scales, and then the high-frequency components are thresholded to remove noise, specifically as follows:

[0030] ,

[0031] in, Represents the smoothed features The result after wavelet transform and thresholding; This represents the features after Gaussian filtering. Represents the smoothed features Wavelet coefficients obtained by wavelet transform at scale s; This represents the threshold parameter in wavelet transform smoothing.

[0032] As a preferred option, the processed wavelet coefficients are then recombine using inverse wavelet transform to form the final smooth texture.

[0033] ,

[0034] in, This represents the final generated adversarial texture; A set representing scale parameters; Indicates the number of coefficients at scale s; Represents the smoothed features The result after wavelet transform and thresholding; This represents the reconstruction basis function at scale s and position i.

[0035] As a preferred option, in S4, the specific process of continuously adjusting the loss function based on the detection results of the object detection model to optimize the adversarial texture is as follows:

[0036] S41: Calculate the intersection-union ratio loss to measure the degree of overlap between the predicted bounding box and the true bounding box;

[0037] S42: Calculate the object confidence loss, which measures the difference between the confidence that an object exists within the predicted bounding box and the true value;

[0038] S43: Calculate the classification loss, which measures the difference between the probability distribution of object categories within the predicted bounding box and the true distribution;

[0039] The final loss function is:

[0040] ,

[0041] in, Indicates resistance to loss; The weighting coefficients represent the crossover ratio (CUP) loss. The weighting coefficients represent the loss of confidence in an object. The weighting coefficients represent the classification loss. Indicates the crossover and union ratio loss; Indicates the loss of confidence in the object; This represents classification loss.

[0042] A physical adversarial sample generation system based on multi-scale filtering implements the physical adversarial sample generation method based on multi-scale filtering described above. The system includes a data acquisition module, a dehazing optimization module, an adversarial sample generation module, a loss optimization module, and an output module.

[0043] Data acquisition module: used to acquire image data, including image data at different scales, angles, and pitch angles;

[0044] Dehazing optimization module: used to introduce channel attention and pixel attention mechanisms, and optimize the dehazing process through a loss function;

[0045] Adversarial example generation module: Used to generate adversarial examples of different scales, angles, and pitch angles by combining a neural renderer with multi-scale filtering.

[0046] Loss optimization module: used to continuously adjust the loss function based on the detection results of the object detection model and optimize the adversarial texture;

[0047] Output module: Used to output the final generated adversarial sample image.

[0048] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the physical adversarial sample generation method based on multi-scale filtering described above.

[0049] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the physical adversarial sample generation method based on multi-scale filtering described above.

[0050] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0051] (1) This invention combines multi-scale filtering technology and dehazing algorithm to propose a new method for generating physical adversarial samples. By removing high-frequency noise and retaining low-frequency features, it effectively solves the problem of adversarial texture failure under long distance and complex weather conditions. Through adversarial texture multi-scale decomposition, filtering and image dehazing, it improves the robustness and adaptability of adversarial sample generation in long distance and foggy environment, and ensures its effectiveness and naturalness in different scales and environments.

[0052] (2) The present invention decomposes the adversarial texture into features of different scales and filters the features of each scale to remove high-frequency noise and retain key low-frequency features; this strategy enhances the robustness of the adversarial texture at long distances.

[0053] (3) The present invention combines a dehazing algorithm to enhance the adaptability of adversarial textures under complex weather conditions such as fog, which is conducive to improving the robustness and effectiveness of adversarial texture patterns and effectively improving the ability to detect adversarial targets. Attached Figure Description

[0054] Figure 1 This is the overall flowchart of the present invention;

[0055] Figure 2 These are example diagrams of clean samples at different scales in the electronic domain and the adversarial sample generation method proposed in this invention.

[0056] Figure 3 These are example diagrams illustrating clean samples at different scales in the physical domain and the adversarial sample generation method proposed in this invention. Detailed Implementation

[0057] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0058] like Figure 1 As shown, the physical adversarial sample generation method based on multi-scale filtering provided in this embodiment includes the following steps:

[0059] S1: Acquire image data;

[0060] The CARLA simulator was used as a 3D simulator to generate a dataset about the target vehicle. The training set consisted of 12,500 data images, and the test set contained 3,000 data images at different scales and angles.

[0061] S2: Remove fog from foggy data using channel attention and pixel attention, specifically:

[0062] S21: Introduce intersection-over-union loss, object confidence loss, and classification loss into channel attention, specifically:

[0063]

[0064] in, The c-th channel feature map represents the result of weighting the feature map along the channel dimension; c represents the channel index, used to identify different channels in the feature map. represents the Sigmoid function, used to restrict the output of channel attention to the range [0,1], and represents the importance weight of the channel; This indicates a convolution operation used to extract spatial features from a feature map; This represents the ReLU function, used to introduce non-linearity after a convolution operation; This represents the height dimension of the feature map; Represents the width dimension of the feature map; Let represent the eigenvalue of the c-th channel at position (i,j), and let represent the eigenintensity of the channel at that position. This represents the weighting coefficients in the Cross-Union Ratio (CUI) loss function, used to balance the contribution of the loss term; This represents the adversarial loss, used to measure the interference effect of the generated adversarial texture on the target detector.

[0065] Based on intersection-over-union loss, object confidence loss, and classification loss, the network prioritizes channels that are effective in dehazing when assigning channel weights. Simultaneously, it preserves vehicle contour and shape information important for detector decisions, enhancing the weight of low-frequency signals by emphasizing these channels, thereby improving the overall quality of the dehazed image.

[0066] S22: Introducing smoothing loss in pixel attention enhances the sharpness and detail of the dehazed image while reducing unnecessary noise;

[0067] The pixel attention mechanism enhances the sharpness and detail of dehazed images by emphasizing pixel regions containing high-frequency signals. By introducing a smoothing loss, it reduces unwanted high-frequency noise, further optimizing the smoothness and naturalness of the image. This allows the dehazed image to retain high-frequency details while minimizing unnecessary noise.

[0068] Specifically:

[0069]

[0070] in, Pixel attention refers to the weighting of image pixels, emphasizing pixel areas containing high-frequency signals to enhance the clarity and detail of dehazed images; This represents the Sigmoid function, which restricts the output of pixel attention to the range [0,1], representing the importance weight of the pixel; This indicates a convolution operation used to extract spatial features from a feature map; This represents the ReLU function, used to introduce non-linearity after a convolution operation; This represents the feature map of the c-th channel after channel attention processing, which is the result of weighting the feature map along the channel dimension. The weighting coefficients represent the smoothing loss and are used to control the weight of the smoothing loss term in the total loss function. This represents the smoothing loss, used to minimize the differences between adjacent pixels in a texture image, resulting in a smoother texture.

[0071] S23: Concatenate the feature maps processed by channel attention (CA) and pixel attention (PA) to fuse feature information from different levels and preserve key details of the image;

[0072] Feature concatenation is achieved by merging two feature maps along the channel dimension, followed by convolution to extract higher-level features, and then upsampling via bilinear interpolation to restore the resolution of the feature maps. Finally, a single convolution operation generates the dehazed image. Specifically:

[0073]

[0074] in, This is the feature map of the c-th channel after channel attention processing. It is the feature map after pixel attention processing. Indicates feature cascading, This represents the convolution operation. This indicates bilinear interpolation upsampling. This represents the final convolution operation. It is a scaling factor used to generate the dehazed image. .

[0075] S3: Use a neural renderer combined with multi-scale filtering to generate adversarial examples of different scales, angles, and pitch angles;

[0076] S31: Wavelet transform is used for multi-scale decomposition to decompose adversarial textures into features of different scales;

[0077] Multi-scale decomposition is used to process information at different resolutions separately. Low-scale features represent the overall structure of the image, while high-scale features represent details and edges. In this embodiment, wavelet transform is used for multi-scale decomposition, specifically as follows:

[0078]

[0079] in, Represents the wavelet coefficients at scale s; This represents the value of the input texture T at position i; N represents the number of image groups in the dataset; This represents the wavelet basis function at scale s and position i; s represents the scale parameter in the multi-scale decomposition, which controls the scale of the wavelet transform.

[0080] S32: Perform Gaussian filtering on the decomposed features;

[0081] High-frequency noise is removed while key features are preserved through Gaussian filtering.

[0082] S33: Perform wavelet transform smoothing on the filtered features;

[0083] To further optimize the smoothness and naturalness of adversarial textures, wavelet transform is applied to the filtered features for smoothing.

[0084] First, the filtered features are decomposed into wavelet coefficients of different scales. Then, the high-frequency components are thresholded to remove noise, specifically as follows:

[0085]

[0086] in, Represents the smoothed features The result after wavelet transform and thresholding is used to remove noise and retain key features; This represents the features after Gaussian filtering. Represents the smoothed features Wavelet coefficients obtained by wavelet transform at scale s; This represents the threshold parameter in wavelet transform smoothing.

[0087] Finally, the processed wavelet coefficients are recombinated using inverse wavelet transform to form the final smooth texture, specifically:

[0088]

[0089] in, This represents the final generated adversarial texture; A set of scale parameters used to represent the different scales involved in multiscale decomposition; This represents the number of coefficients at scale s, used for calculating the inverse wavelet transform; Represents the smoothed features The result after wavelet transform and thresholding is used to remove noise and retain key features; This represents the reconstruction basis function at scale s and position i.

[0090] This series of processes not only removes high-frequency noise from adversarial textures but also preserves key low-frequency features, enabling the target detector to still detect them at long distances and in low visibility conditions.

[0091] S4: Based on the detection results of the object detection model, the loss function is continuously adjusted to optimize the adversarial texture. The specific details are as follows:

[0092] Adversarial loss is calculated by comparing the difference between the target detector's detection results on the adversarial image and the expected false detection results. This loss function typically includes several sub-terms to comprehensively measure the accuracy of the detection.

[0093]

[0094] in, This represents the adversarial loss, used to measure the interference effect of the generated adversarial texture on the target detector; The weighting coefficients represent the crossover ratio (CUP) loss. The weighting coefficients represent the loss of confidence in an object. The weighting coefficients represent the classification loss. , , These represent the weight coefficients of different loss terms, used to balance the contributions of different loss terms such as adversarial loss, smoothing loss, and classification loss to the total loss function; This represents the intersection-union loss, used to optimize adversarial textures to maximize the deviation between the predicted bounding box and the real target. This represents the object confidence loss, enabling the generated adversarial textures to reduce the detector's confidence in the presence of the target vehicle; This represents classification loss, which causes the detector to misclassify the target vehicle.

[0095] S41: Calculate the Intersection over Union (IoU) loss;

[0096] IoU loss is a metric that measures the degree of overlap between the predicted bounding box and the ground truth bounding box. Its calculation formula is:

[0097]

[0098] in, Indicates IoU loss; This represents the overlapping area between the predicted bounding box and the ground truth bounding box. This represents the union region of the predicted bounding box and the true bounding box.

[0099] A smaller IoU loss value indicates a higher degree of overlap between the predicted bounding box and the ground truth bounding box. By minimizing the IoU loss, it can be ensured that the generated adversarial texture maximizes the deviation between the predicted bounding box and the ground truth object, thereby further improving the detection success rate.

[0100] S42: Calculate the confidence loss of the object;

[0101] Object confidence loss It is used to measure the difference between the confidence level of the predicted presence of an object within the bounding box and the true value. The formula for calculation is:

[0102]

[0103] in, It is a real label indicating whether an object exists within the bounding box; This is the predicted confidence score. By minimizing the object confidence loss, it can be ensured that the generated adversarial texture reduces the detector's confidence in the presence of the target vehicle, making it unable to accurately identify the target.

[0104] S43: Calculate the classification loss;

[0105] Classification loss It is used to measure the difference between the predicted probability distribution of object categories within the bounding box and the true distribution. Its calculation formula is:

[0106]

[0107] in, Represents the probability distribution of the true category labels. Let be the predicted class probability distribution, and C be the total number of classes. By minimizing the classification loss, we can ensure that the generated adversarial textures prevent the detector from correctly classifying the target vehicle, effectively enhancing the performance of texture-based physical adversarial example generation.

[0108] S5: Output the final generated image.

[0109] The generated images, or adversarial examples, are produced from the final trained textures. These adversarial examples have an advantage in long-range scenes because multi-scale filtering removes high-frequency noise while preserving low-frequency features, enhancing the robustness of the adversarial textures. This allows the adversarial examples to effectively interfere with the target detector at long distances, preventing it from accurately identifying the target. Simultaneously, by restoring the image's sharpness and contrast, the adversarial textures can effectively interfere with the target detector in low-visibility environments, improving the success rate.

[0110] The effectiveness and efficiency of the method of the present invention were verified through the following experiments:

[0111] 1. Introduction to the dataset;

[0112] CARLA Dataset: The dataset selected in this application is generated using the CARLA simulator as a 3D simulator. The training set consists of 12,500 data images, and the test set has 3,000 data images, including different scales and angles. UE4 is also used as a self-built dataset to generate 5,120 training images and 1,280 test images across four scales, four pitch angles, and eight yaw angles.

[0113] 2. This application uses AP@0.5:0.95 as the evaluation standard;

[0114] AP@0.5:0.95: Average Precision (AP) is a core indicator for measuring the balance between detection precision and recall. In order to comprehensively evaluate the transfer performance of adversarial example generation methods, this application selects AP@0.5:0.95 as the main evaluation criterion. This indicator is obtained by calculating the average AP value in the IoU threshold range [0.5,0.95] with a step size of 0.05.

[0115] This application uses a white-box detector to generate adversarial textures and detects their transferability under different black-box models. YOLO-V3 is used as the white-box model, and YOLO-V5, SSD, Faster R-CNN, and DETR are used as black-box models. All of these models are pre-trained on the COCO dataset.

[0116] The quantitative experimental results of model comparison on the CARLA dataset are as follows:

[0117] Table 1. Experimental results of the present invention on the CARLA dataset.

[0118]

[0119] As shown in Table 1, the adversarial example generation method of this application exhibits significantly superior performance across all detectors and distances, and its ability to adversarially target detection is higher than that of other methods.

[0120] Other existing methods include Raw (raw clean image), DAS (dual attention suppression), FCA (learning 3D full-coverage vehicle camouflage for multi-view physical adversarial), FSD (Full-coverage Invisible Camouflage For Adversarial Targeted Attack), and MFA (multi-texture fusion).

[0121] Raw: The detection success rate of the original clean samples at a distance of X meters using YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD. Raw-fog: The detection success rate of the original clean samples at a distance of X meters under foggy conditions using YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD.

[0122] DAS: Detection success rate at X meters after using DAS with YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD. DAS-fog: Detection success rate at X meters in foggy conditions after using DAS with YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD.

[0123] FCA: Detection success rate at X meters after using FCA with YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD. FCA-fog: Detection success rate at X meters in foggy conditions after using FCA with YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD.

[0124] FSD: Detection success rate at X meters after using FSD with YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD. FSD-fog: Detection success rate at X meters in foggy conditions after using FSD with YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD.

[0125] MFA: Detection success rate at X meters after using MFA with YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD. MFA-fog: Detection success rate at X meters in foggy conditions after using MFA with YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD.

[0126] Our: After using the method of this invention, the detection success rate at X meters after YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD detection. Our-fog: After using the method of this invention, the detection success rate at X meters after YOLO-V3 / YOLO-V5 / Fast R-CNN / SSD detection in foggy conditions.

[0127] In the YOLO-V3 detector, the AP (Adversarial Success Rate) is 2.05% at a distance of 5m and 2.91% at a distance of 10m, while other methods such as Raw, DAS, FCA, FSD, and MFA all have significantly higher APs than the method in this application. This indicates that the method in this application can more effectively counteract vehicle detection systems, preventing them from accurately identifying target vehicles. Even in foggy conditions, the method in this application maintains good adversarial target detection performance, and compared to other methods, its adversarial target detection success rate is relatively stable with distance. This is mainly due to its combination of dehazing and multi-scale filtering algorithms, which can adapt to different distances and weather conditions, ensuring the effectiveness of adversarial textures. Further analysis reveals that the adversarial target detection performance of other methods decreases significantly with increasing detection distance, while the adversarial target detection performance of the method in this application is similar at both long and short distances. This is because the filtering technology used in the neural renderer eliminates high-frequency signals in the image, making distant targets invisible to the detector.

[0128] Table 2 Experimental results of the present invention on a self-built dataset

[0129]

[0130] Table 2 shows the adversarial target detection capabilities of different adversarial example generation methods on a self-built dataset under various detectors and different distances and weather conditions. The DAS method performs well at close range (1.5m and 3m). For example, on the Faster R-CNN detector, its AP reaches 44.29% at 1.5m and 57.62% at 3m. However, as the distance increases to 5m and 10m, the AP drops to 69.22% and 79.75%, respectively, indicating a weakening effect at long distances. The FCA method has a low overall success rate, especially at long distances and in foggy conditions. For instance, on the Faster R-CNN detector, its AP is only 37.22% at 5m and 44.31% at 10m, further decreasing to 32.56% and 40.76% in foggy conditions, indicating insufficient adaptability. The FSD method performs reasonably well at close range, but its performance is less than ideal at long range and in foggy conditions. For example, on the Faster R-CNN detector, its AP is 42.10% at 5m, 49.98% at 10m, and 35.73% and 43.25% in foggy conditions. The MFA method has a low success rate at both close and long ranges, exhibiting some stability, but its overall performance is weak. For instance, on the Faster R-CNN detector, its AP is 34.92% at 5m and 42.33% at 10m. In contrast, the method of this invention demonstrates superior performance across all detectors and distances, with a significantly lower success rate than other methods. For example, on the Faster R-CNN detector, the method of this application has an AP of 27.13% at 5m and 30.01% at 10m, indicating that the method of this application still maintains a high level of adversarial target detection capability in foggy conditions, further highlighting its advantages in complex weather conditions. Specifically, in foggy conditions, the method proposed in this application outperforms other methods in its ability to resist target detection on different detectors. This indicates that the method proposed in this application has good versatility and robustness on different datasets and can effectively cope with various challenges in real-world scenarios. In particular, under complex weather conditions such as fog, its strategy of combining defogging algorithms can significantly improve the anti-target detection effect.

[0131] Table 3. Experimental Results of the Invention in the Physical World

[0132]

[0133] Based on Table 3, the performance of adversarial camouflage in physical space was evaluated and compared with the FCA and MFA methods. Adversarial camouflage was printed using a printer, and the cropped camouflage textures were pasted onto car models to simulate real-world car camouflage. Fog simulation technology was used to simulate real-world fog from the acquired images.

[0134] The test results are shown in Table 3. Compared with other methods, the method of this application also exhibits good mobility in the physical world, especially under long-distance (1.5m and 2m) conditions. In the YOLO-V3 detector, the success rate (ASR) of the method of this invention at distances of 1.5m and 2m is 19.36% and 22.17%, respectively, while the ASR of the FCA method at the same distance is 37.97% and 42.58%, and the ASR of the MFA method is 20.48% and 23.20%. In foggy conditions, the ASR of the method of this invention at distances of 1.5m and 2m is 14.00% and 14.67%, respectively, while the ASR of the FCA method is 32.87% and 34.92%, and the ASR of the MFA method is 13.91% and 16.75%. This indicates that the method of this invention has better mobility and stability in the physical world, especially exhibiting excellent performance under long-distance and foggy conditions.

[0135] Furthermore, similar trends were observed in other detectors. For example, in the YOLO-V5 detector, the ASR of the method of this invention at distances of 1.5m and 2m was 50.58% and 64.75%, respectively, while the FCA method was 54.37% and 80.59%, and the MFA method was 52.28% and 76.98%. In foggy conditions, the ASR of the method of this invention at distances of 1.5m and 2m was 47.40% and 59.79%, respectively, while the FCA method was 49.88% and 76.38%, and the MFA method was 48.75% and 72.85%. This further demonstrates the effectiveness and robustness of the method of this invention in different detectors and environments.

[0136] like Figure 2 As shown, where, Figure 2 (a) in the image is the original image taken in the electronic domain at a distance of 1.5m from the target vehicle; Figure 2 (b) in the image is the original image taken at a distance of 3m from the target vehicle in the electronic domain; Figure 2 (c) in the image is the original image taken 5m away from the target vehicle in the electronic domain; Figure 2 (d) in the image is the original image taken at a distance of 10m from the target vehicle in the electronic domain; Figure 2 (e) in the image is a disturbed image located 1.5m away from the target vehicle in the electronic domain; Figure 2 (f) in the image is a disturbed image located 3m away from the target vehicle in the electronic domain; Figure 2 (g) in the image is the image after disturbance at a distance of 5m from the target vehicle in the electronic domain; Figure 2 (h) is the image in the electronic domain after disturbance, located 10m away from the target vehicle.

[0137] like Figure 3 As shown, where, Figure 3(a) in the image is a disturbed image located 0.5m away from the target vehicle in the physical domain; Figure 3 (b) is a disturbed image located 1m away from the target vehicle in the physical domain; Figure 3 (c) in the image is the image after disturbance at a distance of 1.5m from the target vehicle in the physical domain; Figure 3 (d) is the image after disturbance in the physical domain, which is 2m away from the target vehicle.

[0138] This invention proposes a method for generating physical adversarial examples based on multi-scale filtering, which includes introducing channel attention and pixel attention mechanisms and optimizing the dehazing process through loss functions. Channel attention incorporates cross-union loss, object confidence loss, and classification loss to preserve key information such as vehicle contours and shapes, and enhance the weight of low-frequency signals. The pixel attention mechanism emphasizes the pixel regions containing high-frequency signals, enhancing the clarity and detail of the dehazed image, while introducing a smoothing loss to suppress high-frequency noise. Finally, the feature maps processed by the two attention mechanisms are concatenated to fuse feature information from different levels, generating the dehazed image.

[0139] This invention proposes a method combining multi-scale decomposition, filtering, wavelet transform smoothing, and feature recombination. Wavelet transform is used for multi-scale decomposition, breaking down adversarial textures into features of different scales. Gaussian filtering is applied to the decomposed features to remove high-frequency noise and retain key features. Wavelet transform smoothing is then applied to the filtered features to further optimize the smoothness and naturalness of the texture. Finally, inverse wavelet transform is used to recombine the processed wavelet coefficients, forming the final smooth texture. This method ensures the robustness of the adversarial example generation method under various complex conditions while achieving a visually natural effect.

[0140] Based on the above method, this application provides a physical adversarial sample generation system based on multi-scale filtering, the system comprising:

[0141] The data acquisition module is used to acquire image data, including image data at different scales, angles, and pitch angles.

[0142] The dehazing optimization module introduces channel attention and pixel attention mechanisms, and optimizes the dehazing process through a loss function, specifically including:

[0143] The Channel Attention submodule is used to introduce Cross-Union Loss, Object Confidence Loss, and Classification Loss into Channel Attention.

[0144] The pixel attention submodule is used to introduce a smoothing loss in pixel attention to enhance the sharpness and detail features of the dehazed image and reduce noise.

[0145] The feature fusion submodule is used to concatenate the feature maps after channel attention processing and the feature maps after pixel attention processing, fusing feature information from different levels to generate a dehazed image.

[0146] The adversarial example generation module utilizes a neural renderer combined with multi-scale filtering to generate adversarial examples at different scales, angles, and pitch angles. Specifically, it includes:

[0147] The multi-scale decomposition submodule is used to decompose adversarial textures into features of different scales using wavelet transform.

[0148] The filtering submodule is used to perform Gaussian filtering on the decomposed features.

[0149] The smoothing submodule is used to perform wavelet transform smoothing on the filtered features and generate the final smooth texture through inverse wavelet transform.

[0150] The loss optimization module continuously adjusts the loss function based on the detection results of the object detection model to optimize the adversarial texture, specifically including:

[0151] The Cross-Union Loss Calculation Submodule is used to calculate the Cross-Union Loss between the predicted bounding box and the ground truth bounding box.

[0152] The Object Confidence Loss Calculation Submodule is used to calculate the confidence loss for the presence of objects within the predicted bounding box.

[0153] The classification loss calculation submodule is used to calculate the classification loss for predicting the category of the object within the bounding box.

[0154] The integrated loss submodule is used to integrate the intersection-over-union loss, object confidence loss, and classification loss based on the weight coefficients to generate the final adversarial loss function.

[0155] The output module is used to output the final generated adversarial sample image.

[0156] In this application embodiment, an electronic device is also provided, including: at least one processor; and a memory communicatively connected to the at least one processor, the memory storing a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform any of the above-described methods for generating physical adversarial samples based on multi-scale filtering.

[0157] In practical applications, a processor may include one or more processing cores. The processor executes or runs computer instructions, computer programs, code sets, or instruction sets stored in memory, calls data stored in memory, and performs various functions and processes data as described in this application. The processor may be at least one of a specific application integrated circuit, digital signal processor, digital signal processing device, programmable logic device, field-programmable gate array, central processing unit, controller, microcontroller, and microprocessor. Understandably, for different devices, the electronic devices used to implement the above-described processor functions may also be other types. The memory may be used to store computer instructions, computer programs, code sets, or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, and programs for implementing any of the above-described methods for generating physical adversarial samples based on multi-scale filtering; the data storage area may store data involved in any of the above-described methods for generating physical adversarial samples based on multi-scale filtering.

[0158] In the embodiments of this application, a computer-readable storage medium is also provided for storing a computer program, which is used to cause a computer to execute any of the above-described methods for generating physical adversarial samples based on multi-scale filtering.

[0159] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for generating physical adversarial examples based on multi-scale filtering, characterized in that: Includes the following steps: S1: Acquire image data; S2: Introduces channel attention and pixel attention mechanisms, and optimizes the dehazing process through a loss function; S21: Introduce intersection-over-union loss, object confidence loss, and classification loss into channel attention; S22: Introducing smoothing loss in pixel attention enhances the sharpness and detail of the dehazed image while reducing noise; S23: Concatenate the feature maps after channel attention processing and the feature maps after pixel attention processing to fuse feature information from different levels and preserve key details of the image. S3: Using a combination of neural renderer and multi-scale filtering, adversarial examples of different scales, angles, and pitch angles are generated; S31: Wavelet transform is used for multi-scale decomposition to decompose adversarial textures into features of different scales; S32: Perform Gaussian filtering on the decomposed features; S33: Perform wavelet transform smoothing on the filtered features; S4: Continuously adjust the loss function based on the detection results of the object detection model to optimize the adversarial texture; S5: Output the final generated image.

2. The method for generating physical adversarial examples based on multi-scale filtering according to claim 1, characterized in that: In S23, the specific process is as follows: The two feature maps are merged along the channel dimension, followed by convolution to extract higher-level features, and then upsampling is performed through bilinear interpolation to restore the resolution of the feature maps; finally, a dehazed image is generated through convolution.

3. The method for generating physical adversarial examples based on multi-scale filtering according to claim 1, characterized in that: In S31, wavelet transform is used for multi-scale decomposition, specifically as follows: ， in, Represents the wavelet coefficients at scale s; This represents the value of the input texture T at position i; N represents the number of image groups in the dataset; This represents the wavelet basis function at scale s and position i; s represents the scale parameter in the multiscale decomposition.

4. The method for generating physical adversarial examples based on multi-scale filtering according to claim 1, characterized in that: In S33, the specific process of performing wavelet transform smoothing on the filtered features is as follows: First, the filtered features are decomposed into wavelet coefficients of different scales; Then, thresholding is performed on the high-frequency components to remove noise; Finally, the processed wavelet coefficients are recombined using inverse wavelet transform to form the final smooth texture.

5. The method for generating physical adversarial examples based on multi-scale filtering according to claim 4, characterized in that: First, the filtered features are decomposed into wavelet coefficients of different scales. Then, the high-frequency components are thresholded to remove noise, specifically as follows: ， in, Represents the smoothed features The result after wavelet transform and thresholding; This represents the features after Gaussian filtering. Represents the smoothed features Wavelet coefficients obtained by wavelet transform at scale s; This represents the threshold parameter in wavelet transform smoothing.

6. The method for generating physical adversarial examples based on multi-scale filtering according to claim 4, characterized in that: Finally, the processed wavelet coefficients are recombinated using inverse wavelet transform to form the final smooth texture. ， in, This represents the final generated adversarial texture; A set representing scale parameters; Indicates the number of coefficients at scale s; Represents the smoothed features The result after wavelet transform and thresholding; This represents the reconstruction basis function at scale s and position i.

7. The method for generating physical adversarial examples based on multi-scale filtering according to claim 1, characterized in that: In S4, the specific process of continuously adjusting the loss function based on the detection results of the object detection model to optimize the adversarial texture is as follows: S41: Calculate the intersection-union ratio loss to measure the degree of overlap between the predicted bounding box and the true bounding box; S42: Calculate the object confidence loss, which measures the difference between the confidence that an object exists within the predicted bounding box and the true value; S43: Calculate the classification loss, which measures the difference between the probability distribution of object categories within the predicted bounding box and the true distribution; The final loss function is: ， in, Indicates resistance to loss; The weighting coefficients represent the crossover ratio (CUP) loss. The weighting coefficients represent the loss of confidence in an object. The weighting coefficients represent the classification loss. Indicates the crossover and union ratio loss; Indicates the loss of confidence in the object; This represents classification loss.

8. A physical adversarial sample generation system based on multi-scale filtering, implementing the physical adversarial sample generation method based on multi-scale filtering as described in any one of claims 1 to 7, characterized in that: The system includes a data acquisition module, a dehazing optimization module, an adversarial example generation module, a loss optimization module, and an output module; Data acquisition module: used to acquire image data, including image data at different scales, angles, and pitch angles; Dehazing optimization module: used to introduce channel attention and pixel attention mechanisms, and optimize the dehazing process through a loss function; Adversarial example generation module: Used to generate adversarial examples of different scales, angles, and pitch angles by combining a neural renderer with multi-scale filtering. Loss optimization module: used to continuously adjust the loss function based on the detection results of the object detection model and optimize the adversarial texture; Output module: Used to output the final generated adversarial sample image.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the physical adversarial sample generation method based on multi-scale filtering as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the physical adversarial sample generation method based on multi-scale filtering as described in any one of claims 1 to 7.

Images