Adversarial sample generation method and device for multi-target unmanned aerial vehicle remote sensing image

Abstract

The invention provides an adversarial sample generation method and device for a multi-target unmanned aerial vehicle remote sensing image, and relates to the technical field of artificial intelligence safety. The method comprises the following steps: inputting an unmanned aerial vehicle remote sensing sample image into a target cutting generator network to generate adversarial disturbance, and superposing the adversarial disturbance into the unmanned aerial vehicle remote sensing sample image to obtain an adversarial sample image; the target clipping generator network comprises a YOLOv8 target detector, a clipper, a size classifier, a multi-scale generation network and a spatial filter; inputting the unmanned aerial vehicle remote sensing sample image and the adversarial sample image into an efficient channel attention mechanism enhancement discriminator, and performing optimization according to a composite loss maximization attack mechanism to obtain the weight of an optimal target clipping generator network; and generating an adversarial sample image of the multi-target unmanned aerial vehicle remote sensing image according to the target shearing generator network loaded with the optimal weight. According to the method, the high-concealment confrontation sample image meeting the complex multi-target scene in the unmanned aerial vehicle remote sensing image can be generated.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer vision and artificial intelligence security, and in particular to a method and device for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images. BACKGROUND

[0002] An unmanned aerial vehicle (UAV) equipped with a high-resolution imaging device can obtain real-time remote sensing images of a multi-target complex scene, and achieve efficient target detection and recognition through a deep learning model. However, the vulnerability of the target detection model poses a security threat to adversarial attacks, which may lead to serious consequences such as military misjudgment and delay in disaster relief. Therefore, generating adversarial samples with high concealment and high attack efficiency has become a key technical requirement for evaluating the robustness of target detection models and improving system security. SUMMARY

[0003] To solve the technical problem of how to generate adversarial samples with high concealment and high attack efficiency in the prior art, the embodiments of the present application provide a method and device for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images. The technical solution is as follows:

[0004] On the one hand, a method for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images is provided, which is implemented by an adversarial sample generation device. The method comprises the following steps:

[0005] S1, obtaining an unmanned aerial vehicle remote sensing sample image.

[0006] S2, inputting the unmanned aerial vehicle remote sensing sample image into a target cut generator network to generate an adversarial perturbation, superimposing the adversarial perturbation on the unmanned aerial vehicle remote sensing sample image to obtain an adversarial sample image.

[0007] The target cut generator network comprises a YOLOv8 target detector, a cutter, a size classifier, a multi-scale generation network and a spatial filter.

[0008] S3, inputting the unmanned aerial vehicle remote sensing sample image and the adversarial sample image into a high-efficiency channel attention mechanism enhanced discriminator, and optimizing the target cut generator network and the high-efficiency channel attention mechanism enhanced discriminator according to a composite loss maximization attack mechanism to obtain the weight of the optimal target cut generator network.

[0009] S4, obtaining a multi-target unmanned aerial vehicle remote sensing image to be generated into an adversarial sample, inputting the multi-target unmanned aerial vehicle remote sensing image into the target cut generator network loaded with the optimal weight to generate an adversarial sample image of the multi-target unmanned aerial vehicle remote sensing image.

[0010] Optionally, in S2, inputting the unmanned aerial vehicle remote sensing sample image into the target cut generator network to generate an adversarial perturbation comprises:

[0011] S21, inputting the unmanned aerial vehicle remote sensing sample image to a YOLOv8 target detector to obtain target bounding box coordinates, and obtaining positioning of the target to be cut in the unmanned aerial vehicle remote sensing sample image according to the target bounding box coordinates.

[0012] S22, cutting the target to be cut according to the positioning by using a cutter to obtain a cut sub-image.

[0013] S23, performing size classification on the cut sub-image by using a size classifier to obtain a classification result.

[0014] S24, inputting the classification result into a multi-scale generation network to obtain a plurality of sub-perturbations, and splicing the plurality of sub-perturbations to obtain a spliced adversarial perturbation.

[0015] S25, performing boundary artifact filtering on the spliced adversarial perturbation by using a spatial filter to generate an adversarial perturbation.

[0016] Optionally, the multi-scale generation network comprises a large target generation network, a medium target generation network and a small target generation network; wherein each target generation network comprises a group of encoder-decoders, the three groups of encoder-decoders have the same structure, and different step sizes and convolution kernel parameters.

[0017] The encoder adopts a five-layer convolution structure, the decoder adopts a five-layer deconvolution structure, and there are four residual networks between the encoder and the decoder.

[0018] Optionally, the efficient channel attention mechanism in S3 enhances the discriminator, comprising: 9 convolution layers; wherein the efficient channel attention mechanism is embedded after the 2nd, 5th and 8th convolution layers.

[0019] Optionally, the composite loss maximization attack mechanism in S3 comprises:

[0020] The classification loss maximization attack and the regression loss maximization attack are constructed, and the classification loss maximization attack and the regression loss maximization attack are composite weighted to obtain the composite loss maximization attack mechanism.

[0021] The classification loss maximization attack maximizes the classification cross-entropy loss of the YOLOv8 target detector through back propagation, and induces misjudgment of the target category.

[0022] The regression loss maximization attack optimizes the CIoU loss and the DFL loss through back propagation.

[0023] Optionally, the calculation formula of the composite weighting is as follows formula (1):

[0024] (1)

[0025] In the formula, represents a composite loss maximization attack, is 0.75, represents a classification loss maximization attack, is 0.15, represents a complete intersection over union loss, is 0.05, represents a distribution focal loss.

[0026] In another aspect, an apparatus for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images is provided. The apparatus is applied to a method for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images. The apparatus comprises:

[0027] A data acquisition module is configured to acquire an unmanned aerial vehicle remote sensing sample image.

[0028] A generation module is configured to input the unmanned aerial vehicle remote sensing sample image into a target cut generator network, generate an adversarial perturbation, superimpose the adversarial perturbation on the unmanned aerial vehicle remote sensing sample image, and obtain an adversarial sample image.

[0029] The target cut generator network comprises a YOLOv8 target detector, a cutter, a size classifier, a multi-scale generation network, and a spatial filter.

[0030] An optimization module is configured to input the unmanned aerial vehicle remote sensing sample image and the adversarial sample image into an efficient channel attention mechanism enhanced discriminator, optimize the target cut generator network and the efficient channel attention mechanism enhanced discriminator according to a composite loss maximization attack mechanism, and obtain a weight of an optimal target cut generator network.

[0031] An output module is configured to acquire a multi-target unmanned aerial vehicle remote sensing image to be generated into an adversarial sample, input the multi-target unmanned aerial vehicle remote sensing image into the target cut generator network loaded with the optimal weight, and generate an adversarial sample image of the multi-target unmanned aerial vehicle remote sensing image.

[0032] Optionally, the generation module is further configured to:

[0033] S21, input the unmanned aerial vehicle remote sensing sample image into the YOLOv8 target detector to obtain target bounding box coordinates, and acquire a positioning of a target to be cut in the unmanned aerial vehicle remote sensing sample image according to the target bounding box coordinates.

[0034] S22, cut the target to be cut according to the positioning through the cutter to obtain a cut sub-image.

[0035] S23, classify the cut sub-image by size through the size classifier to obtain a classification result.

[0036] S24, input the classification result into the multi-scale generation network to obtain a plurality of sub-perturbations, and splice the plurality of sub-perturbations to obtain a spliced adversarial perturbation.

[0037] S25, filtering the spliced adversarial perturbation through a spatial filter to generate an adversarial perturbation.

[0038] Optionally, the multi-scale generation network comprises a large target generation network, a medium target generation network and a small target generation network; wherein each target generation network comprises a group of encoder-decoders, the three groups of encoder-decoders have the same structure, different step sizes and different convolution kernel parameters.

[0039] The encoder adopts a five-layer convolution structure, the decoder adopts a five-layer deconvolution structure, and there are four layers of residual networks between the encoder and the decoder.

[0040] Optionally, the efficient channel attention mechanism enhances the discriminator, comprising: 9 convolution layers; wherein the efficient channel attention mechanism is embedded after the 2nd, 5th and 8th convolution layers.

[0041] Optionally, the optimization module is further used for:

[0042] The classification loss maximization attack and the regression loss maximization attack are constructed, and the classification loss maximization attack and the regression loss maximization attack are composite weighted to obtain a composite loss maximization attack mechanism.

[0043] The classification loss maximization attack maximizes the classification cross-entropy loss of the YOLOv8 target detector through back propagation to induce misjudgment of the target class.

[0044] The regression loss maximization attack optimizes the CIoU loss and the DFL loss through back propagation.

[0045] Optionally, the calculation formula of the composite weighting is as follows:

[0046] (1)

[0047] In the formula, the composite loss maximization attack is represented by is 0.75, the classification loss maximization attack is represented by is 0.15, the complete intersection over union loss is represented by is 0.05, and the distribution focus loss is represented by

[0048] ​In another aspect, an adversarial sample generation device is provided, and the device includes a processor and a memory having computer readable instructions stored thereon that, when executed by the processor, implement any of the above-described methods for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images.

[0049] In another aspect, a computer readable storage medium is provided, and the storage medium has at least one instruction stored therein that, when loaded and executed by a processor, implements any of the above-described methods for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images.

[0050] The technical solutions provided by the embodiments of the present application have at least the following beneficial effects:

[0051] In the present application, the method for generating high-concealment adversarial samples for complex multi-target unmanned aerial vehicle remote sensing images is provided, and the method includes inputting the unmanned aerial vehicle remote sensing image into a target cut generator network loaded with optimal weights to obtain adversarial perturbations, and then superimposing the adversarial perturbations onto the original unmanned aerial vehicle remote sensing image to obtain an adversarial sample image with high concealment and high attack. BRIEF DESCRIPTION OF DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0053] Figure 1 is a flowchart of a method for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images provided by an embodiment of the present application;

[0054] Figure 2 is a flowchart of a method for generating high-concealment adversarial samples for complex multi-target unmanned aerial vehicle remote sensing images provided by an embodiment of the present application;

[0055] Figure 3 is a structural schematic diagram of a method for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images provided by an embodiment of the present application;

[0056] Figure 4 is a block diagram of an adversarial sample generation device for multi-target unmanned aerial vehicle remote sensing images provided by an embodiment of the present application;

[0057] Figure 5 is a structural schematic diagram of an adversarial sample generation device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0058] The technical solutions in the present application will be described below with reference to the drawings.

[0059] In the embodiments of the present application, the words "exemplary", "for example", and the like are used to indicate examples, instances, or illustrations. Any embodiment or design solution described as "exemplary" in the present application should not be interpreted as being more preferred or advantageous than other embodiments or design solutions. Rather, the use of the word "exemplary" is intended to present concepts in a concrete manner. In addition, in the embodiments of the present application, the meaning expressed by "and / or" can be both, or can be either one of the two.

[0060] In the embodiments of the present application, "image" and "picture" can be used interchangeably at times. It should be pointed out that when the distinction is not emphasized, the meanings expressed are consistent. "Of", "corresponding" and "corresponding" can be used interchangeably at times. It should be pointed out that when the distinction is not emphasized, the meanings expressed are consistent.

[0061] In the embodiments of the present application, sometimes the subscript such as W1 can be written in the form of non-subscript such as W1. When the distinction is not emphasized, the meanings expressed are consistent.

[0062] In order to make the technical problems, technical solutions and advantages of the present application clearer, specific embodiments will be described in detail below with reference to the drawings.

[0063] The embodiments of the present application provide a method for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images. The method can be realized by an adversarial sample generation device, which can be a terminal or a server. As shown in the flow chart of the method for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images, the processing flow of the method can include the following steps: Figure 1

[0064] S1, obtaining an unmanned aerial vehicle remote sensing sample image.

[0065] S2, inputting the unmanned aerial vehicle remote sensing sample image into a target cutting generator network to generate an adversarial perturbation, superimposing the adversarial perturbation on the unmanned aerial vehicle remote sensing sample image to obtain an adversarial sample image.

[0066] As shown in the flow chart of the method for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images, the processing flow of the method can include the following steps: Figure 2 As shown, the target cutting generator network includes a YOLOv8 target detector, a cutter, a size classifier, a multi-scale generation network, and a construction space filter to eliminate boundary artifacts.

[0067] Optionally, the step S2 of inputting the unmanned aerial vehicle remote sensing sample image into the target cutting generator network to generate the adversarial perturbation can include the following steps S21-S25: ​

[0068] S21, inputting the unmanned aerial vehicle remote sensing sample image to a YOLOv8 target detector to obtain target bounding box coordinates, and obtaining positioning of the target to be cut in the unmanned aerial vehicle remote sensing sample image according to the target bounding box coordinates.

[0069] In a feasible implementation, the target is positioned in the original unmanned aerial vehicle remote sensing image based on the target bounding box coordinates output by the YOLOv8, and the positioned target is cut to obtain a cut sub-image.

[0070] S22, cutting the target to be cut according to the positioning by a cutter to obtain a cut sub-image.

[0071] S23, performing size classification on the cut sub-image by a size classifier to obtain a classification result.

[0072] In a feasible implementation, the cut sub-image is classified according to a size threshold of a minimum side length of the cut sub-image (small target: <65 pixels, medium target: 65-130 pixels, and large target: >130 pixels).

[0073] S24, inputting the classification result to a multi-scale generation network to obtain a plurality of sub-perturbations, and splicing the plurality of sub-perturbations to obtain a spliced adversarial perturbation.

[0074] Optionally, the multi-scale generation network comprises a large target generation network, a medium target generation network, and a small target generation network; each target generation network comprises a group of encoder-decoders, the three groups of encoder-decoders have the same structure, different steps, and different convolution kernel parameters.

[0075] The encoder adopts a five-layer convolution structure, the decoder adopts a five-layer deconvolution structure, and there are four residual networks between the encoder and the decoder.

[0076] In a feasible implementation, the cut sub-image with classification information is input to a corresponding multi-scale generation network (for example, a large target is input to a large target generation network), the multi-scale generation network comprises three groups of encoder-decoders having the same structure, different steps, and different convolution kernel parameters, and generates local perturbations for different size targets, respectively. The encoder adopts a five-layer convolution structure, the decoder adopts a five-layer deconvolution structure, and there are four residual networks between the encoder and the decoder. The sub-perturbations generated by all the cut sub-images through the corresponding multi-scale generation network are combined with the positioning information to obtain a total adversarial perturbation.

[0077] S25, performing boundary artifact filtering on the spliced adversarial perturbation by a spatial filter to generate an adversarial perturbation.

[0078] In a feasible implementation, a noise threshold (0.01) is set to filter the boundary artifacts after splicing of the sub-perturbations, to improve the concealment while retaining the core adversarial.

[0079] The integrated YOLOv8 model provides a target position for a target clipping generator, serves as a target model embedded generative adversarial network, constructs a composite loss maximization attack mechanism, realizes multi-target collaborative attack, locates the target according to the target positioning information provided by YOLOv8 in the target detection module, clips the key area to obtain a clipped sub-image, and generates a multi-scale local perturbation.

[0080] S3, inputting the unmanned aerial vehicle remote sensing sample image and the adversarial sample image into the efficient channel attention mechanism enhanced discriminator, optimizing the target clipping generator network and the efficient channel attention mechanism enhanced discriminator according to the composite loss maximization attack mechanism, and obtaining the weight of the optimal target clipping generator network.

[0081] In an available implementation, the architecture of the ECA (Efficient Channel Attention, efficient channel attention mechanism) attention mechanism discriminator mainly consists of 9 convolutional layers, and finally outputs a value between 0 and 1 to represent the probability that the input sample is a real sample. The ECA attention mechanism is embedded after the 2nd, 5th and 8th convolutional layers of the discriminator, focusing on key features and enhancing the ability to distinguish target area textures and background noise, thereby improving the ability of the discriminator to distinguish real images and adversarial images and improving the concealment of the generated adversarial samples.

[0082] The ECA enhanced discriminator optimizes the adversarial sample authenticity evaluation through the lightweight channel attention mechanism, focuses on key features, synchronously trains the generator and the discriminator, and improves the concealment of the generated adversarial samples.

[0083] Optionally, the composite loss maximization attack mechanism in S3 comprises:

[0084] The classification loss maximization attack and the regression loss maximization attack are constructed, the classification loss maximization attack and the regression loss maximization attack are composite weighted, and the composite loss maximization attack mechanism is obtained.

[0085] The classification loss maximization attack maximizes the BCE (Binary Cross Entropy, classification cross entropy) loss of the YOLOv8 target detector through back propagation, and induces misjudgment of the target category.

[0086] The regression loss maximization attack optimizes the CIoU (Complete Intersection over Union, complete intersection over union) loss and the DFL (Distribution Focal Loss, distribution focal loss) through back propagation.

[0087] Wherein, the CIoU loss comprises an intersection-over-union, a center distance and a width-height ratio constraint term, and the DFL loss enhances the regression robustness by discrete probability modeling.

[0088] Optionally, the calculation formula of the composite weight is as follows formula (1):

[0089] (1)

[0090] In the formula, denotes a classification loss maximization attack, is 0.75, denotes a regression loss maximization attack, is 0.15, denotes a complete intersection-over-union loss, is 0.05, denotes a distribution focus loss.

[0091] The present application combines the classification loss maximization attack and the regression loss maximization attack, and realizes the complex multi-target cooperative attack of the unmanned aerial vehicle remote sensing image by using the composite weight of the two attacks.

[0092] S4, obtaining a multi-target unmanned aerial vehicle remote sensing image to be generated into an adversarial sample, inputting the multi-target unmanned aerial vehicle remote sensing image into a target cutting generator network loaded with optimal weights, and generating an adversarial sample image of the multi-target unmanned aerial vehicle remote sensing image.

[0093] As shown in Figure 3 The present application discloses a kind of for complex multi-target unmanned aerial vehicle remote sensing image's high concealment adversarial sample generation method and system, can generate the high concealment adversarial sample image that meets complex multi-target scene in unmanned aerial vehicle remote sensing image.The method comprises: embedding YOLOv8 target detection model into GAN (Generative Adversarial Networks, generative adversarial networks), construct composite loss maximization mechanism, jointly optimize classification loss, CIoU geometric constraint loss and DFL discrete modeling loss, realize multi-target cooperative attack;Design target cutting generator, based on YOLOv8 output dynamic positioning target area, cut target by cutter, carry out size classification to cut target by size classifier, generate local disturbance by multi-scale encoding-decoding network, and introduce spatial filtering to eliminate boundary artifact;Adopt ECA attention mechanism to enhance discriminator, focus key features by lightweight channel attention module, improve the visual concealment of adversarial sample.

[0094] In the embodiment of the present application, the method for generating high-concealment adversarial samples for complex multi-target unmanned aerial vehicle remote sensing images is provided, the unmanned aerial vehicle remote sensing image is input into the target cut generator network loaded with the optimal weight, the adversarial disturbance is obtained, and then the adversarial sample image with high concealment and high attack is obtained by superimposing the adversarial disturbance on the original unmanned aerial vehicle remote sensing image.

[0095] Figure 4 Figure is a block diagram of an adversarial sample generation device for multi-target unmanned aerial vehicle remote sensing images according to an exemplary embodiment, which is used for the method for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images. Referring to Figure 4 The device comprises a data acquisition module 310, a generation module 320, an optimization module 330 and an output module 340. Wherein:

[0096] The data acquisition module 310 is used for acquiring the unmanned aerial vehicle remote sensing sample image.

[0097] The generation module 320 is used for inputting the unmanned aerial vehicle remote sensing sample image into the target cut generator network, generating the adversarial disturbance, superimposing the adversarial disturbance on the unmanned aerial vehicle remote sensing sample image, and obtaining the adversarial sample image.

[0098] The target cut generator network comprises a YOLOv8 target detector, a cutter, a size classifier, a multi-scale generation network and a spatial filter.

[0099] The optimization module 330 is used for inputting the unmanned aerial vehicle remote sensing sample image and the adversarial sample image into the high-efficiency channel attention mechanism enhanced discriminator, optimizing the target cut generator network and the high-efficiency channel attention mechanism enhanced discriminator according to the composite loss maximization attack mechanism, and obtaining the weight of the optimal target cut generator network.

[0100] The output module 340 is used for acquiring the multi-target unmanned aerial vehicle remote sensing image to be generated into the adversarial sample, inputting the multi-target unmanned aerial vehicle remote sensing image into the target cut generator network loaded with the optimal weight, and generating the adversarial sample image of the multi-target unmanned aerial vehicle remote sensing image.

[0101] In the embodiment of the present application, the method for generating high-concealment adversarial samples for complex multi-target unmanned aerial vehicle remote sensing images is provided, the unmanned aerial vehicle remote sensing image is input into the target cut generator network loaded with the optimal weight, the adversarial disturbance is obtained, and then the adversarial sample image with high concealment and high attack is obtained by superimposing the adversarial disturbance on the original unmanned aerial vehicle remote sensing image.

[0102] Figure 5 Figure is a structural schematic diagram of an adversarial sample generation device provided by the embodiment of the present application, as Figure 5 shown, the adversarial sample generation device can comprise the above Figure 4The shown is the adversarial sample generation device for multi-target unmanned aerial vehicle remote sensing image. Optionally, the adversarial sample generation device 410 can include a first processor 2001.

[0103] Optionally, the adversarial sample generation device 410 can further include a memory 2002 and a transceiver 2003.

[0104] The first processor 2001 is connected with the memory 2002 and the transceiver 2003, for example, through a communication bus.

[0105] The specific implementation of the adversarial sample generation device 410 will be described below. Figure 5 The specific implementation of the adversarial sample generation device 410 will be described below.

[0106] The first processor 2001 is the control center of the adversarial sample generation device 410, which can be one processor or a plurality of processing elements. For example, the first processor 2001 is one or more central processing units (CPUs), which can be application specific integrated circuits (ASICs), or one or more integrated circuits configured to implement embodiments of the present application, such as one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGA).

[0107] Optionally, the first processor 2001 can execute various functions of the adversarial sample generation device 410 by running or executing software programs stored in the memory 2002 and calling data stored in the memory 2002.

[0108] In a specific implementation, as an embodiment, the first processor 2001 can include one or more CPUs, such as the CPU0 and CPU1 shown in FIG. Figure 5

[0109] In a specific implementation, as an embodiment, the adversarial sample generation device 410 can also include a plurality of processors, such as the first processor 2001 and the second processor 2004 shown in FIG. Figure 5

[0110] ​​The memory 2002 is used to store the software program for executing the solution of the present invention, and is controlled by the first processor 2001 for execution. The specific implementation method can refer to the above method embodiment and will not be repeated here.

[0111] Alternatively, the memory 2002 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2002 may be integrated with the first processor 2001 or exist independently and accessed through the interface circuit ( Figure 5 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0112] The transceiver 2003 is used to communicate with a network device or a terminal device.

[0113] Optionally, the transceiver 2003 may include a receiver and a transmitter ( Figure 5 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0114] Optionally, the transceiver 2003 may be integrated with the first processor 2001 or may exist independently and communicate with the first processor 2001 through the interface circuit ( Figure 5 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0115] It should be noted that Figure 5 The structure of the adversarial sample generation device 410 shown in the figure does not constitute a limitation on the router. The actual knowledge structure recognition device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0116] In addition, the technical effects of the adversarial sample generation device 410 can refer to the technical effects of the adversarial sample generation method for the multi-target unmanned aerial vehicle remote sensing image described in the above method embodiments, which will not be repeated here.

[0117] It should be understood that the first processor 2001 in the embodiments of the present application can be a central processing unit (CPU), and the processor can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0118] It should also be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically EPROM (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of random access memory (RAM) are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchlink dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM).

[0119] The above-described embodiments can be implemented in whole or in part by software, hardware (such as a circuit), firmware, or any combination thereof. When implemented in software, the above-described embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the processes or functions described in the embodiments of the present application are wholly or partially generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center through a wired (such as infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. containing one or more available medium collections. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state disk.

[0120] It should be understood that the term "and / or" herein merely describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. In addition, the character " / " herein generally represents that the associated objects before and after it are in an "or" relationship, but it can also represent an "and / or" relationship, which can be understood according to the context before and after it.

[0121] In the present application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following" or the like means any combination of the items, including any combination of single or multiple items. For example, at least one of a, b, or c can represent a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.

[0122] It should be understood that in various embodiments of the present application, the size of the sequence number of the above-described processes does not mean the order of execution, and the execution order of the processes should be determined according to their functions and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0123] Those skilled in the art can clearly understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0124] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the devices, apparatuses and units described above can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0125] In several embodiments provided by the present application, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0126] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0127] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit.

[0128] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the present application that essentially contribute to the prior art or the parts of the technical solutions can be embodied in the form of software products. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0129] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for generating adversarial samples for multi-target UAV remote sensing images, characterized in that: The method comprises: S1. Obtain UAV remote sensing sample images; S2. Input the UAV remote sensing sample image into a target clipping generator network to generate an adversarial perturbation, and superimpose the adversarial perturbation onto the UAV remote sensing sample image to obtain an adversarial sample image; The object clipping generator network includes a YOLOv8 object detector, a clipper, a size classifier, a multi-scale generation network, and a spatial filter; S3. Input the UAV remote sensing sample image and the adversarial sample image into the efficient channel attention mechanism enhanced discriminator, optimize the target cut generator network and the efficient channel attention mechanism enhanced discriminator according to the composite loss maximization attack mechanism, and obtain the weight of the optimal target cut generator network; S4. Obtain a multi-target UAV remote sensing image to generate an adversarial sample, input the multi-target UAV remote sensing image into a target clipping generator network loaded with optimal weights, and generate an adversarial sample image of the multi-target UAV remote sensing image.

2. The method for generating adversarial samples for multi-target UAV remote sensing images according to claim 1, characterized in that: The step S2 of inputting the UAV remote sensing sample image into a target clipping generator network to generate adversarial perturbations includes: S21, inputting the UAV remote sensing sample image into the YOLOv8 target detector to obtain target bounding box coordinates, and obtaining the location of the target to be cut in the UAV remote sensing sample image according to the target bounding box coordinates; S22, cutting the target to be cut by the cutter according to the positioning to obtain a cut sub-image; S23, classifying the size of the cut sub-images by the size classifier to obtain a classification result; S24. Inputting the classification result into the multi-scale generative network to obtain multiple sub-perturbations, and splicing the multiple sub-perturbations to obtain a spliced ​​adversarial perturbation; S25 . Perform boundary artifact filtering on the spliced ​​adversarial perturbation through the spatial filter to generate an adversarial perturbation.

3. The adversarial sample generation method for multi-target UAV remote sensing images according to claim 1 is characterized in that: The multi-scale generative network includes: a large target generation network, a medium target generation network, and a small target generation network; wherein each target generation network includes a set of encoder-decoders, and the three sets of encoder-decoders have the same structure but different step sizes and convolution kernel parameters; The encoder adopts a five-layer convolution structure, the decoder adopts a five-layer deconvolution structure, and there is a four-layer residual network between the encoder and the decoder.

4. The method for generating adversarial samples for multi-target UAV remote sensing images according to claim 1, characterized in that: The efficient channel attention mechanism enhanced discriminator in S3 includes: 9 convolutional layers; wherein the efficient channel attention mechanism is embedded after the 2nd, 5th and 8th convolutional layers.

5. The method for generating adversarial samples for multi-target UAV remote sensing images according to claim 1, characterized in that: The compound loss maximization attack mechanism in S3 includes: Constructing a classification loss maximization attack and a regression loss maximization attack, and performing compound weighting on the classification loss maximization attack and the regression loss maximization attack to obtain a compound loss maximization attack mechanism; The classification loss maximization attack maximizes the classification cross entropy loss of the YOLOv8 target detector through back propagation, inducing misjudgment of the target category; The regression loss maximization attack jointly optimizes the CIoU loss and the DFL loss through back-propagation.

6. The method for generating adversarial samples for multi-target UAV remote sensing images according to claim 5, characterized in that: The calculation formula of the composite weighted is as follows (1): （1） Where, represents a compound loss maximization attack, is 0.75, represents the classification loss maximization attack, is 0.15, represents the complete intersection loss, is 0.05, represents the distribution focal loss.

7. A device for generating adversarial samples for multi-target UAV remote sensing images, wherein the device is used to implement the method for generating adversarial samples for multi-target UAV remote sensing images as claimed in any one of claims 1 to 6, characterized in that: The device comprises: Data acquisition module, used to obtain UAV remote sensing sample images; a generation module, configured to input the UAV remote sensing sample image into a target shear generator network, generate an adversarial perturbation, and superimpose the adversarial perturbation onto the UAV remote sensing sample image to obtain an adversarial sample image; The object clipping generator network includes a YOLOv8 object detector, a clipper, a size classifier, a multi-scale generation network, and a spatial filter; an optimization module, configured to input the UAV remote sensing sample image and the adversarial sample image into an efficient channel attention mechanism enhanced discriminator, optimize the target cut generator network and the efficient channel attention mechanism enhanced discriminator according to a compound loss maximization attack mechanism, and obtain the weights of the optimal target cut generator network; The output module is used to obtain a multi-target UAV remote sensing image for generating adversarial samples, input the multi-target UAV remote sensing image into a target clipping generator network loaded with optimal weights, and generate an adversarial sample image of the multi-target UAV remote sensing image.

8. The adversarial sample generation device for multi-target UAV remote sensing images according to claim 7, characterized in that: Inputting the UAV remote sensing sample image into a target shear generator network to generate adversarial perturbations includes: S21, inputting the UAV remote sensing sample image into the YOLOv8 target detector to obtain target bounding box coordinates, and obtaining the location of the target to be cut in the UAV remote sensing sample image according to the target bounding box coordinates; S22, cutting the target to be cut by the cutter according to the positioning to obtain a cut sub-image; S23, classifying the size of the cut sub-images by the size classifier to obtain a classification result; S24. Inputting the classification result into the multi-scale generative network to obtain multiple sub-perturbations, and splicing the multiple sub-perturbations to obtain a spliced ​​adversarial perturbation; S25 . Perform boundary artifact filtering on the spliced ​​adversarial perturbation through the spatial filter to generate an adversarial perturbation.

9. A device for generating adversarial samples, characterized in that: The adversarial sample generation device includes: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program code, which can be called by a processor to execute the method according to any one of claims 1 to 6.

Images