Adversarial Example Generation Method and Device for Multi-Target UAV Remote Sensing Images

Abstract

This invention provides a method and apparatus for generating adversarial examples from multi-target UAV remote sensing images, relating to the field of artificial intelligence security technology. The method includes: inputting UAV remote sensing sample images into a target cropping generator network to generate adversarial perturbations, and superimposing these perturbations onto the UAV remote sensing sample images to obtain adversarial example images; the target cropping generator network includes a YOLOv8 target detector, a cropper, a size classifier, a multi-scale generation network, and a spatial filter; inputting the UAV remote sensing sample images and the adversarial example images into an efficient channel attention mechanism-enhanced discriminator, optimizing it according to a composite loss maximization attack mechanism to obtain the optimal weights of the target cropping generator network; and generating adversarial example images of multi-target UAV remote sensing images based on the target cropping generator network with the optimal weights. This invention can generate highly concealed adversarial example images that satisfy complex multi-target scenes in UAV remote sensing images.

Description

Technical Field

[0001] This invention relates to the fields of computer vision and artificial intelligence security technology, and in particular to a method and apparatus for generating adversarial examples for multi-target UAV remote sensing images. Background Technology

[0002] Unmanned aerial vehicles (UAVs) equipped with high-resolution imaging devices can acquire real-time remote sensing images of complex multi-target scenes and achieve efficient target detection and recognition through deep learning models. However, the vulnerability of target detection models exposes them to security threats from adversarial attacks, potentially leading to serious consequences such as military miscalculations and delays in disaster relief. Therefore, generating highly covert and effective adversarial examples has become a key technical requirement for evaluating the robustness of target detection models and improving system security. Summary of the Invention

[0003] To address the technical problem of generating highly covert and effective adversarial examples in existing technologies, this invention provides a method and apparatus for generating adversarial examples for multi-target UAV remote sensing images. The technical solution is as follows:

[0004] On the one hand, an adversarial example generation method for multi-target UAV remote sensing images is provided. This method is implemented by an adversarial example generation device and includes:

[0005] S1. Acquire remote sensing sample images from UAVs.

[0006] S2. Input the UAV remote sensing sample image into the target shearing generator network to generate adversarial perturbations. Superimpose the adversarial perturbations onto the UAV remote sensing sample image to obtain the adversarial sample image.

[0007] The target shearing generator network includes a YOLOv8 target detector, a shearer, a size classifier, a multi-scale generation network, and a spatial filter.

[0008] S3. Input the UAV remote sensing sample images and adversarial sample images into the efficient channel attention mechanism enhanced discriminator. Optimize the target cut generator network and the efficient channel attention mechanism enhanced discriminator according to the composite loss maximization attack mechanism to obtain the optimal weights of the target cut generator network.

[0009] S4. Obtain multi-target UAV remote sensing images to be used to generate adversarial examples. Input the multi-target UAV remote sensing images into a target clipping generator network with optimal weights to generate adversarial example images of the multi-target UAV remote sensing images.

[0010] Optionally, in S2, the UAV remote sensing sample image is input into the target shearing generator network to generate adversarial perturbations, including:

[0011] S21. Input the UAV remote sensing sample image into the YOLOv8 target detector to obtain the target bounding box coordinates, and obtain the location of the target to be clipped in the UAV remote sensing sample image based on the target bounding box coordinates.

[0012] S22. Based on the positioning, the target to be cut is cut using a cutter to obtain a cut sub-image.

[0013] S23. The size of the cropped sub-image is classified by size classifier to obtain the classification result.

[0014] S24. Input the classification results into a multi-scale generative network to obtain multiple sub-perturbations. Then, concatenate the multiple sub-perturbations to obtain the concatenated adversarial perturbation.

[0015] S25. Perform boundary artifact filtering on the spliced ​​adversarial perturbations using a spatial filter to generate adversarial perturbations.

[0016] Optionally, the multi-scale generation network includes: a large target generation network, a medium target generation network, and a small target generation network; wherein each target generation network includes a set of encoder-decoder, the three sets of encoder-decoder have the same structure, but different stride and convolution kernel parameters.

[0017] The encoder uses a five-layer convolutional structure, the decoder uses a five-layer deconvolutional structure, and there are four layers of residual network between the encoder and the decoder.

[0018] Optionally, the efficient channel attention mechanism in S3 enhances the discriminator, comprising: 9 convolutional layers; wherein an efficient channel attention mechanism is embedded after the 2nd, 5th and 8th convolutional layers.

[0019] Optionally, the composite loss maximization attack mechanism in S3 includes:

[0020] We construct classification loss maximization attack and regression loss maximization attack, and then perform a composite weighting on the classification loss maximization attack and regression loss maximization attack to obtain a composite loss maximization attack mechanism.

[0021] Among them, the classification loss maximization attack maximizes the classification cross-entropy loss of the YOLOv8 object detector through backpropagation, inducing misclassification of the target category.

[0022] The regression loss maximization attack optimizes the CIoU loss and DFL loss together through backpropagation.

[0023] Optionally, the formula for calculating the composite weighted average is as follows (1):

[0024] (1)

[0025] In the formula, This indicates a composite loss maximization attack. It is 0.75. This represents a classification loss maximization attack. It is 0.15. Indicates the loss of complete intersection and union. It is 0.05. This represents the distribution focus loss.

[0026] On the other hand, an adversarial example generation apparatus for multi-target UAV remote sensing images is provided. This apparatus is applied to an adversarial example generation method for multi-target UAV remote sensing images, and includes:

[0027] The data acquisition module is used to acquire remote sensing sample images from UAVs.

[0028] The generation module is used to input UAV remote sensing sample images into the target clipping generator network, generate adversarial perturbations, and superimpose the adversarial perturbations onto the UAV remote sensing sample images to obtain adversarial sample images.

[0029] The target shearing generator network includes a YOLOv8 target detector, a shearer, a size classifier, a multi-scale generation network, and a spatial filter.

[0030] The optimization module is used to input UAV remote sensing sample images and adversarial sample images into the efficient channel attention mechanism enhanced discriminator. Based on the composite loss maximization attack mechanism, the target cut generator network and the efficient channel attention mechanism enhanced discriminator are optimized to obtain the optimal weights of the target cut generator network.

[0031] The output module is used to acquire multi-target UAV remote sensing images to be used for generating adversarial examples. The multi-target UAV remote sensing images are input into a target clipping generator network with optimal weights to generate adversarial example images of the multi-target UAV remote sensing images.

[0032] Optionally, the generation module is further used for:

[0033] S21. Input the UAV remote sensing sample image into the YOLOv8 target detector to obtain the target bounding box coordinates, and obtain the location of the target to be clipped in the UAV remote sensing sample image based on the target bounding box coordinates.

[0034] S22. Based on the positioning, the target to be cut is cut using a cutter to obtain a cut sub-image.

[0035] S23. The size of the cropped sub-image is classified by size classifier to obtain the classification result.

[0036] S24. Input the classification results into a multi-scale generative network to obtain multiple sub-perturbations. Then, concatenate the multiple sub-perturbations to obtain the concatenated adversarial perturbation.

[0037] S25. Perform boundary artifact filtering on the spliced ​​adversarial perturbations using a spatial filter to generate adversarial perturbations.

[0038] Optionally, the multi-scale generation network includes: a large target generation network, a medium target generation network, and a small target generation network; wherein each target generation network includes a set of encoder-decoder, the three sets of encoder-decoder have the same structure, but different stride and convolution kernel parameters.

[0039] The encoder uses a five-layer convolutional structure, the decoder uses a five-layer deconvolutional structure, and there are four layers of residual network between the encoder and the decoder.

[0040] Optionally, an efficient channel attention mechanism enhances the discriminator, comprising: 9 convolutional layers; wherein an efficient channel attention mechanism is embedded after the 2nd, 5th, and 8th convolutional layers.

[0041] Optionally, the optimization module can be further used for:

[0042] We construct classification loss maximization attack and regression loss maximization attack, and then perform a composite weighting on the classification loss maximization attack and regression loss maximization attack to obtain a composite loss maximization attack mechanism.

[0043] Among them, the classification loss maximization attack maximizes the classification cross-entropy loss of the YOLOv8 object detector through backpropagation, inducing misclassification of the target category.

[0044] The regression loss maximization attack optimizes the CIoU loss and DFL loss together through backpropagation.

[0045] Optionally, the formula for calculating the composite weighted average is as follows (1):

[0046] (1)

[0047] In the formula, This indicates a composite loss maximization attack. It is 0.75. This represents a classification loss maximization attack. It is 0.15. Indicates the loss of complete intersection and union. It is 0.05. This represents the distribution focus loss.

[0048] On the other hand, an adversarial example generation device is provided, the adversarial example generation device comprising: a processor; a memory storing computer-readable instructions, wherein when the computer-readable instructions are executed by the processor, any one of the methods described above for generating adversarial examples for multi-target UAV remote sensing images is implemented.

[0049] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction is stored in the storage medium, the at least one instruction being loaded and executed by a processor to implement any of the above-described adversarial example generation methods for multi-target UAV remote sensing images.

[0050] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0051] The present invention provides a method for generating highly covert adversarial examples for complex multi-target UAV remote sensing images. This method involves inputting the UAV remote sensing image into a target clipping generator network with optimal weights to obtain adversarial perturbations, which are then superimposed onto the original UAV remote sensing image to obtain highly covert and highly aggressive adversarial example images. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is a flowchart of an adversarial example generation method for multi-target UAV remote sensing images provided by an embodiment of the present invention;

[0054] Figure 2 This is a flowchart of a method for generating highly covert adversarial samples for complex multi-target UAV remote sensing images provided in an embodiment of the present invention;

[0055] Figure 3 This is a schematic diagram of the structure of an adversarial example generation method for multi-target UAV remote sensing images provided in an embodiment of the present invention;

[0056] Figure 4 This is a block diagram of an adversarial example generation device for multi-target UAV remote sensing images provided in an embodiment of the present invention;

[0057] Figure 5 This is a schematic diagram of the structure of an adversarial sample generation device provided in an embodiment of the present invention. Detailed Implementation

[0058] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0059] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0060] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0061] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0062] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0063] This invention provides a method for generating adversarial examples for multi-target UAV remote sensing images. This method can be implemented by an adversarial example generation device, which can be a terminal or a server. Figure 1 The flowchart shown illustrates an adversarial example generation method for multi-target UAV remote sensing images. The processing flow of this method may include the following steps:

[0064] S1. Acquire remote sensing sample images from UAVs.

[0065] S2. Input the UAV remote sensing sample image into the target shearing generator network to generate adversarial perturbations. Superimpose the adversarial perturbations onto the UAV remote sensing sample image to obtain the adversarial sample image.

[0066] like Figure 2 As shown, the target shearing generator network includes a YOLOv8 target detector, a shearer, a size classifier, a multi-scale generation network, and a spatial filter to eliminate boundary artifacts.

[0067] Optionally, the step S2 above, which involves inputting the UAV remote sensing sample image into the target shearing generator network to generate adversarial perturbations, may include the following steps S21-S25:

[0068] S21. Input the UAV remote sensing sample image into the YOLOv8 target detector to obtain the target bounding box coordinates, and obtain the location of the target to be clipped in the UAV remote sensing sample image based on the target bounding box coordinates.

[0069] In one feasible implementation, the target is located in the original UAV remote sensing image based on the target bounding box coordinates output by YOLOv8, and the located target is cropped to obtain a cropped sub-image.

[0070] S22. Based on the positioning, the target to be cut is cut using a cutter to obtain a cut sub-image.

[0071] S23. The size of the cropped sub-image is classified by size classifier to obtain the classification result.

[0072] In one feasible implementation, the cropped images are classified according to the size threshold of the minimum side length of the cropped images (small target: <65 pixels, medium target: 65-130 pixels, large target: >130 pixels).

[0073] S24. Input the classification results into a multi-scale generative network to obtain multiple sub-perturbations. Then, concatenate the multiple sub-perturbations to obtain the concatenated adversarial perturbation.

[0074] Optionally, the multi-scale generation network includes: a large target generation network, a medium target generation network, and a small target generation network; wherein each target generation network includes a set of encoder-decoder, the three sets of encoder-decoder have the same structure, but different stride and convolution kernel parameters.

[0075] The encoder uses a five-layer convolutional structure, the decoder uses a five-layer deconvolutional structure, and there are four layers of residual network between the encoder and the decoder.

[0076] In one feasible implementation, the cropped sub-images with classification information are input into the corresponding multi-scale generation network (e.g., large targets are input into a large target generation network). The multi-scale generation network contains three sets of encoder-decoders with the same structure, stride, and different convolutional kernel parameters, which respectively process the generation of local perturbations for targets of different sizes. The encoder adopts a five-layer convolutional structure, the decoder adopts a five-layer deconvolutional structure, and there are four layers of residual networks between the encoder and the decoder. All cropped sub-images are combined with the localization information through the sub-perturbations generated by the corresponding multi-scale generation network to obtain the total adversarial perturbation.

[0077] S25. Perform boundary artifact filtering on the spliced ​​adversarial perturbations using a spatial filter to generate adversarial perturbations.

[0078] In one feasible implementation, a noise threshold (0.01) is set to filter the boundary artifacts after sub-perturbation splicing, thereby improving concealment while preserving core countermeasures.

[0079] This invention integrates the YOLOv8 model to provide target location for the target cropping generator. It is embedded as a target model into a generative adversarial network to construct a composite loss maximization attack mechanism, thereby achieving multi-target cooperative attacks. Based on the target localization information provided by YOLOv8 in the target detection module, the target is located and key regions are cropped to obtain cropped sub-images, generating multi-scale local perturbations.

[0080] S3. Input the UAV remote sensing sample images and adversarial sample images into the efficient channel attention mechanism enhanced discriminator. Optimize the target cut generator network and the efficient channel attention mechanism enhanced discriminator according to the composite loss maximization attack mechanism to obtain the optimal weights of the target cut generator network.

[0081] In one feasible implementation, the ECA (Efficient Channel Attention) discriminator architecture mainly consists of 9 convolutional layers, which ultimately output a value between 0 and 1 to represent the probability that the input sample is a real sample. The ECA attention mechanism is embedded after the 2nd, 5th, and 8th convolutional layers of the discriminator to focus on key features, enhance the ability to distinguish between texture and background noise in the target region, improve the discriminator's ability to distinguish between real images and adversarial images, and improve the concealment of generated adversarial examples.

[0082] The ECA-enhanced discriminator of this invention optimizes the authenticity assessment of adversarial examples through a lightweight channel attention mechanism, focuses on key features, and simultaneously trains the generator and discriminator to improve the concealment of generated adversarial examples.

[0083] Optionally, the composite loss maximization attack mechanism in S3 includes:

[0084] We construct classification loss maximization attack and regression loss maximization attack, and then perform a composite weighting on the classification loss maximization attack and regression loss maximization attack to obtain a composite loss maximization attack mechanism.

[0085] Among them, the classification loss maximization attack maximizes the BCE (Binary Cross Entropy) loss of the YOLOv8 object detector through backpropagation, inducing misclassification of the target category.

[0086] The regression loss maximization attack optimizes the CIoU (Complete Intersection over Union) loss and DFL (Distribution Focal Loss) loss jointly through backpropagation.

[0087] Among them, CIoU loss includes crossover ratio, center distance and aspect ratio constraints, while DFL loss enhances regression robustness through discrete probability modeling.

[0088] Optionally, the formula for calculating the composite weighted average is as follows (1):

[0089] (1)

[0090] In the formula, This indicates a composite loss maximization attack. It is 0.75. This represents a classification loss maximization attack. It is 0.15. Indicates the loss of complete intersection and union. It is 0.05. This represents the distribution focus loss.

[0091] This invention combines classification loss maximization attack and regression loss maximization attack, and uses composite weighted attacks to achieve complex multi-target cooperative attacks on UAV remote sensing images.

[0092] S4. Obtain multi-target UAV remote sensing images to be used to generate adversarial examples. Input the multi-target UAV remote sensing images into a target clipping generator network with optimal weights to generate adversarial example images of the multi-target UAV remote sensing images.

[0093] like Figure 3 As shown, this invention discloses a method and system for generating highly covert adversarial examples for complex multi-target UAV remote sensing images, capable of generating highly covert adversarial example images that satisfy complex multi-target scenarios in UAV remote sensing images. The method includes: embedding a YOLOv8 target detection model into a GAN (Generative Adversarial Network), constructing a composite loss maximization mechanism, jointly optimizing classification loss, CIoU geometric constraint loss, and DFL discrete modeling loss to achieve multi-target collaborative attacks; designing a target cropping generator, dynamically locating target regions based on YOLOv8 output, cropping targets using a cropper, classifying cropped targets by size using a size classifier, generating local perturbations through a multi-scale encoder-decoder network, and introducing spatial filtering to eliminate boundary artifacts; and employing an ECA attention mechanism to enhance the discriminator, focusing key features through a lightweight channel attention module to improve the visual covertness of the adversarial examples.

[0094] In this embodiment of the invention, a method for generating highly covert adversarial examples for complex multi-target UAV remote sensing images is provided. This method inputs the UAV remote sensing image into a target clipping generator network with optimal weights to obtain adversarial perturbations, which are then superimposed onto the original UAV remote sensing image to obtain highly covert and highly aggressive adversarial example images.

[0095] Figure 4 This is a block diagram illustrating an adversarial example generation apparatus for multi-target UAV remote sensing images according to an exemplary embodiment. The apparatus is used for an adversarial example generation method for multi-target UAV remote sensing images. (Refer to...) Figure 4 The device includes a data acquisition module 310, a generation module 320, an optimization module 330, and an output module 340. Wherein:

[0096] The data acquisition module 310 is used to acquire remote sensing sample images from UAVs.

[0097] The generation module 320 is used to input the UAV remote sensing sample image into the target clipping generator network, generate adversarial perturbations, and superimpose the adversarial perturbations onto the UAV remote sensing sample image to obtain the adversarial sample image.

[0098] The target shearing generator network includes a YOLOv8 target detector, a shearer, a size classifier, a multi-scale generation network, and a spatial filter.

[0099] The optimization module 330 is used to input UAV remote sensing sample images and adversarial sample images into the efficient channel attention mechanism enhanced discriminator, and optimize the target cut generator network and the efficient channel attention mechanism enhanced discriminator according to the composite loss maximization attack mechanism to obtain the optimal weights of the target cut generator network.

[0100] The output module 340 is used to acquire multi-target UAV remote sensing images to be generated as adversarial examples, input the multi-target UAV remote sensing images into a target clipping generator network with optimal weights, and generate adversarial example images of the multi-target UAV remote sensing images.

[0101] In this embodiment of the invention, a method for generating highly covert adversarial examples for complex multi-target UAV remote sensing images is provided. This method inputs the UAV remote sensing image into a target clipping generator network with optimal weights to obtain adversarial perturbations, which are then superimposed onto the original UAV remote sensing image to obtain highly covert and highly aggressive adversarial example images.

[0102] Figure 5 This is a schematic diagram of the structure of an adversarial sample generation device provided in an embodiment of the present invention, as shown below. Figure 5 As shown, the adversarial example generation device may include the above-mentioned Figure 4The illustrated adversarial example generation apparatus for multi-target UAV remote sensing images. Optionally, the adversarial example generation apparatus 410 may include a first processor 2001.

[0103] Optionally, the adversarial sample generation device 410 may also include a memory 2002 and a transceiver 2003.

[0104] The first processor 2001, memory 2002, and transceiver 2003 can be connected via a communication bus.

[0105] The following is combined Figure 5 A detailed description of each component of the adversarial example generation device 410 is provided below:

[0106] The first processor 2001 is the control center of the adversarial sample generation device 410. It can be a single processor or a collective term for multiple processing elements. For example, the first processor 2001 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0107] Optionally, the first processor 2001 can perform various functions of the adversarial sample generation device 410 by running or executing software programs stored in the memory 2002 and calling data stored in the memory 2002.

[0108] In a specific implementation, as one example, the first processor 2001 may include one or more CPUs, for example... Figure 5 CPU0 and CPU1 are shown in the diagram.

[0109] In a specific implementation, as one example, the adversarial sample generation device 410 may also include multiple processors, for example... Figure 5 The first processor 2001 and the second processor 2004 are shown in the diagram. Each of these processors can be a single-core processor or a multi-core processor. Here, a processor can refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0110] The memory 2002 is used to store the software program that executes the present invention, and is controlled by the first processor 2001 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0111] Optionally, the memory 2002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 2002 may be integrated with the first processor 2001 or may exist independently, and may be connected via the interface circuit of the adversarial sample generation device 410. Figure 5 (Not shown in the image) is coupled to the first processor 2001, and this embodiment of the invention does not specifically limit this.

[0112] The transceiver 2003 is used to communicate with network devices or with terminal devices.

[0113] Alternatively, transceiver 2003 may include a receiver and a transmitter. Figure 5 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the transmitting function.

[0114] Optionally, the transceiver 2003 can be integrated with the first processor 2001, or it can exist independently and be connected to the interface circuit of the adversarial sample generation device 410. Figure 5 (Not shown in the image) is coupled to the first processor 2001, and this embodiment of the invention does not specifically limit this.

[0115] It should be noted that, Figure 5 The structure of the adversarial example generation device 410 shown does not constitute a limitation on the router. Actual knowledge structure identification devices may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0116] Furthermore, the technical effect of the adversarial example generation device 410 can be referred to the technical effect of the adversarial example generation method for multi-target UAV remote sensing images described in the above method embodiments, and will not be repeated here.

[0117] It should be understood that the first processor 2001 in the embodiments of the present invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0118] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0119] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0120] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0121] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0122] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0123] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0124] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0125] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0126] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0127] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0128] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0129] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for generating adversarial samples for multi-target unmanned aerial vehicle remote sensing images, characterized in that, The method comprises: S1, acquiring a UAV remote sensing sample image; S2, inputting the UAV remote sensing sample image into a target clipping generator network to generate an adversarial perturbation, superimposing the adversarial perturbation on the UAV remote sensing sample image to obtain an adversarial sample image; Wherein, the target clipping generator network comprises a YOLOv8 target detector, a clipper, a size classifier, a multi-scale generation network and a spatial filter; S3, inputting the UAV remote sensing sample image and the adversarial sample image into a high-efficiency channel attention mechanism enhanced discriminator, optimizing the target clipping generator network and the high-efficiency channel attention mechanism enhanced discriminator according to a composite loss maximization attack mechanism, and obtaining the weight of the optimal target clipping generator network; S4, acquiring a multi-target UAV remote sensing image to be generated into an adversarial sample, inputting the multi-target UAV remote sensing image into the target clipping generator network loaded with the optimal weight to generate an adversarial sample image of the multi-target UAV remote sensing image; In S2, inputting the UAV remote sensing sample image into the target clipping generator network to generate an adversarial perturbation comprises: S21, inputting the UAV remote sensing sample image into the YOLOv8 target detector to obtain target bounding box coordinates, and acquiring the positioning of the target to be clipped in the UAV remote sensing sample image according to the target bounding box coordinates; S22, clipping the target to be clipped through the clipper according to the positioning to obtain a clipped sub-image; S23, performing size classification on the clipped sub-image through the size classifier to obtain a classification result; S24, inputting the classification result into the multi-scale generation network to obtain a plurality of sub-perturbations, and splicing the plurality of sub-perturbations to obtain a spliced adversarial perturbation; S25, filtering the spliced adversarial perturbation through the spatial filter to generate an adversarial perturbation.

2. The method of claim 1, wherein, The multi-scale generation network comprises a large target generation network, a medium target generation network and a small target generation network; wherein each target generation network comprises a group of encoder-decoders, the three groups of encoder-decoders have the same structure, different step sizes and different convolution kernel parameters; The encoder adopts a five-layer convolution structure, the decoder adopts a five-layer deconvolution structure, and there are four residual networks between the encoder and the decoder.

3. The method of claim 1, wherein, The high-efficiency channel attention mechanism enhanced discriminator in S3 comprises 9 convolution layers; wherein high-efficiency channel attention mechanisms are embedded after the 2nd, 5th and 8th convolution layers.

4. The method of claim 1, wherein, The composite loss maximization attack mechanism in S3 comprises: Constructing a classification loss maximization attack and a regression loss maximization attack, and performing composite weighting on the classification loss maximization attack and the regression loss maximization attack to obtain a composite loss maximization attack mechanism; Wherein, the classification loss maximization attack maximizes the classification cross-entropy loss of the YOLOv8 target detector through back propagation to induce target class misjudgment; The regression loss maximization attack optimizes the CIoU loss and the DFL loss jointly through back propagation.

5. The method of claim 4, wherein, The calculation formula of the composite weighting is as follows: L Adv = - (aL cls + bL CIoU + cL DFL ) (1) where L Adv represents a composite loss maximization attack, a is 0.75, L cls represents a classification loss maximization attack, β is 0.15, L CIoU represents a full intersection over union loss, λ is 0.05, L DFL represents a focal loss.

6. An apparatus for generating adversarial samples for multi-target UAV remote sensing images, the apparatus being configured to implement the method for generating adversarial samples for multi-target UAV remote sensing images according to any one of claims 1-5, wherein, The device comprises: a data acquisition module configured to acquire a UAV remote sensing sample image; a generation module configured to input the UAV remote sensing sample image into a target clipping generator network, generate an adversarial perturbation, superimpose the adversarial perturbation into the UAV remote sensing sample image, and obtain an adversarial sample image; wherein the target clipping generator network comprises a YOLOv8 target detector, a clipper, a size classifier, a multi-scale generation network, and a spatial filter; an optimization module configured to input the UAV remote sensing sample image and the adversarial sample image into a high-efficiency channel attention mechanism enhanced discriminator, optimize the target clipping generator network and the high-efficiency channel attention mechanism enhanced discriminator according to a composite loss maximization attack mechanism, and obtain a weight of an optimal target clipping generator network; an output module configured to acquire a multi-target UAV remote sensing image to be generated into an adversarial sample, input the multi-target UAV remote sensing image into the target clipping generator network loaded with the optimal weight, and generate an adversarial sample image of the multi-target UAV remote sensing image.

7. An adversarial sample generation device, comprising: The adversarial sample generation device comprises: a processor; a memory having computer readable instructions stored thereon, wherein the computer readable instructions, when executed by the processor, implement the method of any one of claims 1 to 5.

8. A computer readable storage medium, characterized in that, The computer readable storage medium stores program code, and the program code can be called and executed by the processor to implement the method of any one of claims 1 to 5.

Images