Adversarial patch generation optimization method and system combined with time sequence feature information, and storage medium

By combining temporal BEV feature information with traditional methods, the adversarial patch generation process is optimized, which solves the problem of neglecting temporal self-attention and historical BEV features in the existing technology, and achieves more accurate adversarial patch generation, thereby improving the robustness of the autonomous driving model.

CN120894652AActive Publication Date: 2025-11-04HARBIN INSTITUTE OF TECHNOLOGY (SHENZHEN) (INSTITUTE OF SCIENCE AND TECHNOLOGY INNOVATION HARBIN INSTITUTE OF TECHNOLOGY SHENZHEN)
View PDF 2 Cites 0 Cited by

Patent Information

Application Number
CN202511405716.4
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-09-29
Publication Date
2025-11-04
Estimated Expiration
2045-09-29

AI Technical Summary

Technical Problem

Existing adversarial patch optimization methods fail to effectively consider the impact of temporal self-attention mechanisms and historical BEV features in object detection networks, resulting in poor adversarial attack performance, especially in dynamic scenes where the feature propagation effect of adversarial patches is ignored.

Method used

By combining the temporal BEV feature information provided by the adversarial patch with traditional optimization methods, the total loss of the output results of multiple consecutive frames is calculated through multi-frame temporal inference settings. The influence of the BEV feature extraction module and historical BEV is considered in the backpropagation and gradient optimization process, and the final adversarial patch is generated iteratively.

Benefits of technology

It improves the optimization effect of anti-patch, provides more accurate optimization results, covers more data flow branch information, and guides a more precise optimization process.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN120894652A_ABST
    Figure CN120894652A_ABST
Patent Text Reader

Abstract

The invention provides an adversarial patch generation optimization method and system combined with time sequence feature information and a storage medium, and the method comprises the steps: S1, data collection and loading: collecting and loading an open source data set, a simulation data set and a user-defined real scene data set, and obtaining a total loading frame number; step S2, calculating an adversarial patch position: initializing adversarial patch parameters, reading data of a target frame, obtaining annotation parameter information provided by the open source data set, the simulation data set and the user-defined real scene data set, and generating an adversarial image; and S3, batch optimization is carried out in combination with historical BEV information: multi-frame time sequence reasoning setting is adopted, the total loss of continuous multi-frame output results is calculated, back propagation and gradient optimization are carried out based on the total loss, and a final adversarial patch is generated through iteration. The method has the advantages that the time sequence BEV feature information provided by the adversarial patch is combined with a traditional adversarial patch optimization method, and a better optimization effect is obtained.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an optimized method, system, and storage medium for generating adversarial patches using combined temporal feature information. Background Technology

[0002] Deep neural networks (DNNs), as a representative technology of artificial intelligence, are now widely used in various fields of life and production. Although DNNs exhibit excellent performance, they are susceptible to adversarial attacks, leading to erroneous outputs. Currently, several studies have confirmed the feasibility of using adversarial patches to launch adversarial attacks on object detection tasks in the field of autonomous driving, and have used this method to expose the defects of DNNs or autonomous driving models in which DNNs participate in perception and decision-making.

[0003] In practical applications, adversarial patches can enhance the robustness of existing DNNs by participating in adversarial training, or they can be used as a safety assessment indicator to measure whether autonomous driving can accurately perceive the surrounding environment and output correct decision information. Due to its physical realizability, it is of great significance for mitigating the impact of anomalies and promoting the implementation of the technology.

[0004] BEVFormer is a target detection network that uses a temporal self-attention mechanism and historical BEV features to perceive the surrounding environment. Since the participants (targets) in the real scene are constantly moving, historical BEV information is of great help to improve the accuracy of target detection and trajectory prediction.

[0005] Currently, there are adversarial attacks based on adversarial patches, covering various aspects such as hiding real targets and creating fake targets in both the digital and physical domains.

[0006] Cheng et al. placed the adversarial patch on the road surface or the target and optimized it based on the results of each frame, which greatly reduced the performance of the target detection network. Wang et al. placed the adversarial patch on the road surface and optimized it based on the BEV features of each frame, which resulted in an adversarial patch that can effectively create false targets in the real world.

[0007] Traditional adversarial patch optimization methods, while using object detection networks like BEVFormer as the attack target, fail to consider the impact of temporal self-attention mechanisms and historical BEV features employed by these networks on the attack results. These optimization methods optimize the adversarial patch based on the detection results of a single frame (time step), neglecting the feature transfer effect of the adversarial patch in dynamic scenes. Regardless of whether in the digital or physical domain, the BEV information provided by the adversarial patch, like that of other actors, influences subsequent prediction results.

[0008] While Cheng et al.'s method demonstrated effectiveness on multi-frame data, their optimization was based solely on the adversarial patch's performance in a single frame, neglecting the patch's impact on historical BEVs and the valuable information it might provide during gradient propagation. Similarly, while this research utilized BEV features for optimization, it also failed to consider the information embedded in historical BEVs by the adversarial patch. Summary of the Invention

[0009] To address the shortcomings of existing technologies, this invention provides an optimization method for generating adversarial patches that combines temporal feature information. By integrating the temporal BEV feature information provided by the adversarial patch with traditional adversarial patch optimization methods, a better optimization effect can be achieved.

[0010] This invention discloses an optimized method for generating adversarial patches using joint temporal feature information, comprising: Step S1, Data Collection and Loading: Collect and load open-source datasets, simulation datasets, and custom real-world scenario datasets to obtain the total number of loaded frames; Step S2, calculate the position of the adversarial patch: initialize the adversarial patch parameters, read the target frame data, and obtain the annotation parameter information provided by the open source dataset, simulation dataset, and custom real scene dataset. This information is uniformly provided by the data collector. Based on the obtained parameters, calculate the position of the corner point of the adversarial patch in the global coordinate system and generate the adversarial image accordingly. Step S3, batch optimization based on historical BEV information: adopt multi-frame temporal inference setting, calculate the total loss of output results of multiple consecutive frames, perform backpropagation and gradient optimization based on the total loss, and iteratively generate the final adversarial patch.

[0011] As a further improvement of the present invention, step S1 specifically includes: Step S101, Open Source Dataset: Obtain parameter information using the open source dataset: transformation matrix from vehicle coordinate system to global coordinate system. T e2g and the transformation matrix from the global coordinate system to the camera coordinate system T g2c ; Step S102, Simulation Dataset: The dataset obtained by real-time rendering using simulation software, and parameter information similar to that in step S101 obtained according to the settings of the simulation software; Step S103, Customize real-world dataset: Acquire data through self-deployed sensor devices, perform custom annotations on the data, and obtain parameter information similar to that in step S101 based on sensor parameters; Step S104: Select steps S101, S102, and S103 to construct continuous frame data of any scene in the dataset, and set the number of preheating frames for a certain scene. N pre Number of frames used in training N etu By default, the last frame used in training is the target frame. Frame t Add the two frame counts together to get the total number of loaded frames. N load .

[0012] As a further improvement of the present invention, in step S101, parameter information is obtained using open-source datasets commonly used in the field of autonomous driving, such as NuScenes and KITTI; the global coordinate system to camera coordinate system transformation matrix... T g2c Transformation matrix from global coordinate system to local coordinate system T g2e Local coordinate system to radar coordinate system transformation matrix T e2l Transformation matrix from radar coordinate system to camera coordinate system T l2c Obtained by performing matrix multiplication.

[0013] As a further improvement of the present invention, step S2 specifically includes: Step S201, Initialize adversarial patch parameters: Set the shape and size of the adversarial patch, randomly generate it based on the target mean and variance, or read it from an existing pattern to obtain the adversarial patch pattern. P Determine the corner location of the anti-patch. : , in Corner tl The row vector representing the coordinates of the top left corner point. Corner tr , Corner br , Corner bl These represent the coordinate row vectors for the top right, bottom right, and bottom left sides, respectively. W , H These represent the width and height of the adversarial patch, respectively, with the default unit being meters. They also determine the ideal displacement of the adversarial patch's coordinates within the target frame. , where Δ x Δ y Δ z In the vehicle coordinate system x axis, y axis, zThe displacement of the axis, and in the local coordinate system x axis, y axis, z The positive axes represent the angles of rotation forward, left, and up, respectively. α , β , γ ; Step S202: Obtain relevant parameters of the target frame; read the data of the target frame to obtain the parameter information mentioned in step S101; Step S203: Calculate the global coordinates of the corner points of the adversarial patch; first, construct the rotation matrix. R With transformation matrix T p2e : , in, R x ( γ ) 、R y ( β ) 、R z ( γ The corner points are respectively located around the local coordinate system. x Axis rotation α Spend, y Axis rotation β Spend, z Axis rotation γ The rotation matrix of degrees is defined as follows: , , , Then, the global coordinates of the corner points of the anti-patch were calculated. Corners global And save it for later use: , Step S204: Generate adversarial image; traverse all loaded frames and obtain the first... k ={0, …, N load -1} frames Frame k The parameter information mentioned in step S101 is then used to transform the coordinates of the adversarial patch corner points in the global coordinate system to the coordinates in the camera coordinate system in each subsequent frame. : , in It is the first k The transformation matrix from global coordinate system to camera coordinate system for a frame. xk 、y k 、z k The first and second in the camera coordinate system are respectively k Frame-based anti-patch corner x axis, y axis 、z The axis column vector is then used to normalize the coordinates of the adversarial patch corner points in the camera coordinate system, thus obtaining the coordinates of the adversarial patch corner points in the image coordinate system. : , The adversarial patch pattern was then scaled up. Frame k The original image image k The size is then determined, and perspective transformation is performed based on the positions of the original corner points and the target corner points to obtain the perspective-transformed image in the original image. image k Scenario-based adversarial patch : , , in Resize ( P, image k ) will counter the patch P Zoom to image image k size, These are the coordinates of the four corner points of the scaled adversarial patch, starting from the top left and moving clockwise, in the image coordinate system. , They are respectively image k The width and height of the image, and then based on the adversarial patch... The mask is calculated at the position in the middle as follows. : , in for exist( i, j The pixel value at () is used; finally, the original image is... image k Counter-patch images and mask Fusion Generative Adversarial Images : , After generating the adversarial image, the corresponding original image is replaced with the adversarial image to obtain adversarial data.

[0014] As a further improvement of the present invention, step S3 specifically includes: Step S301, Initial Frame Inference: Output the inference result of the initial frame, and at the same time generate the BEV information of the initial frame and use it as the historical BEV information of the next frame for inference. Step S302, Non-initial frame inference: Combine the BEV information of the previous frame to participate in inference, and combine the BEV information of the previous frame to output the BEV information of the current frame, output the inference result of the frame, and at the same time generate the BEV information of the current frame combined with the BEV information of the previous frame as the historical BEV information of the next frame to participate in inference. Step S303, Batch optimization: Optimize the batches of frames generated during training. N etu The loss is selectively calculated for each result, the selected loss is accumulated and backpropagated, the gradient of the adversarial patch is then obtained and optimized, and the final adversarial patch is obtained after several iterations.

[0015] As a further improvement of the present invention, in step S303, the adversarial patch will participate in subsequent inferences after participating in the BEV of a certain frame inference, and the impact of the BEV feature extraction module and historical BEV on the result loss will be considered during backpropagation.

[0016] As a further improvement of the present invention, in step S303, the result of the target frame is necessary, while the results of other frames are optional.

[0017] The present invention also discloses an adversarial patch generation optimization system with joint temporal feature information, comprising: a memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when invoked by the processor.

[0018] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0019] The beneficial effects of this invention are: 1. The method of this invention combines the temporal BEV feature information provided by the adversarial patch with the optimization method of the traditional adversarial patch, and obtains better optimization results; 2. The method of this invention takes into account the influence of the BEV feature extraction module and historical BEV on the result loss during backpropagation, so the final loss will cover multiple data flow branches, contain more information, and guide more accurate optimization results. Attached Figure Description

[0020] Figure 1 This is the overall optimized process of the method of the present invention. Detailed Implementation

[0021] This invention discloses an optimized method for generating adversarial patches using joint temporal feature information, comprising: Step S1, Data Collection and Loading: Collect and load open-source datasets, simulation datasets, and custom real-world scenario datasets to obtain the total number of loaded frames; Step S2, Calculate the adversarial patch position: Initialize the adversarial patch parameters, read the data of the target frame, obtain the parameter information mentioned in the open source dataset, calculate the global coordinates of the corner points of the adversarial patch, and generate the adversarial image; Step S3, batch optimization based on historical BEV (bird's-eye view) information: adopt multi-frame temporal inference setting, calculate the total loss of output results of multiple consecutive frames, perform backpropagation and gradient optimization based on the total loss, and iteratively generate the final adversarial patch.

[0022] Step S1 specifically includes: Step S101, Open source dataset: Use commonly used open source datasets in the field of autonomous driving, such as NuScenes and KITTI, to obtain the parameter information provided by the dataset (1) Transformation matrix from vehicle coordinate system to global coordinate system T e2g and (2) Global coordinate system to camera coordinate system transformation matrix T g2c (This can be achieved using a global to local coordinate system transformation matrix) T g2e Local coordinate system to radar coordinate system transformation matrix T e2l Transformation matrix from radar coordinate system to camera coordinate system T l2c (Obtained by performing matrix multiplication.) Note: The original transformation matrices mentioned above are used for column coordinate operations. For ease of explanation in the following text, these transformation matrices are transposes of the original matrices and are all applicable to row coordinates. Furthermore, the transformation matrix from coordinate system a to coordinate system b is... T a2b ,and( T a2b ) -1 =T b2a This represents the transformation matrix from coordinate system b to coordinate system a, and will not be further explained later.

[0023] Step S102, Simulation Dataset; The dataset is obtained by real-time rendering using simulation software such as CARLA, and parameter information similar to that in step S101 is obtained according to the settings of the simulation software.

[0024] Step S103, Customize Real-Scene Dataset: Acquire data by deploying your own sensor devices, perform custom annotations on the data, and obtain parameter information similar to that in S101 based on the sensor parameters.

[0025] Step S104: Select steps S101, S102, and S103 to construct continuous frame data of any scene in the dataset, and set the number of preheating frames for a certain scene. N pre Number of frames used in training N etu (By default, the last frame used in training is the target frame) Frame t Add the two frame counts together to get the total number of loaded frames. N load .

[0026] Step S2 specifically includes: Step S201, Initialize adversarial patch parameters: Set the shape and size of the adversarial patch, randomly generate it based on the target mean and variance, or read it from an existing pattern to obtain the adversarial patch pattern. P Determine the corner location of the anti-patch. Corners init : , in Corner tl The row vector representing the coordinates of the top left corner point, and similarly, in clockwise order, there are row vectors representing the top right, bottom right, and bottom left corner points. W , H These represent the width and height of the adversarial patch, respectively, with the default unit being meters. The coordinates of the adversarial patch are also determined. Frame t Ideal displacement , where Δ x Δy and Δz are respectively in the vehicle coordinate system x axis, y axis, z The displacement of the axis, and in the local coordinate system ( x axis, y axis, z The positive axes are forward, left, and up, respectively, representing the angles of rotation. α , β , γ .

[0027] Step S202, Obtain target frame related parameters: Read target frame Frame t The data is used to obtain the parameter information mentioned in step S101.

[0028] Step S203, calculate the global coordinates of the corner points of the adversarial patch: first construct the rotation matrix. R With transformation matrix T p2e : , T x2y From x Coordinate system transformation (to same as 2) y The transformation matrix of the coordinate system; A T For the transpose of matrix A, since Translation ego_patch Since the matrix is ​​a row vector, the last column of the transformation matrix is ​​the offset, so transpose is used to construct the correct transformation matrix. in, R x (γ), R y (β)、R z (γ) The corner points are respectively circumferential in the local coordinate system. x Axis rotation α Spend, y Axis rotation β Spend, z Axis rotation γ The rotation matrix of degrees is defined as follows: , , , Then, the global coordinates of the corner points of the anti-patch were calculated. Corners global And save it for later use: , Step S204, Generate adversarial image: Traverse all loaded frames and obtain the first... k ={0, …, N load -1} frames Frame k The parameter information mentioned in step S101 is then used to transform the coordinates of the adversarial patch corner points in the global coordinate system to the coordinates in the camera coordinate system in each subsequent frame. : , in It is the first k The transformation matrix from global coordinate system to camera coordinate system for a frame. xk 、y k 、z k The first and second in the camera coordinate system are respectively k The x, y, and z column vectors of the adversarial patch corner points are generated. Then, the coordinates of the adversarial patch corner points in the camera coordinate system are normalized to obtain their coordinates in the image coordinate system. : , The adversarial patch pattern was then scaled up. Frame k The original image image k Size, then perform perspective transformation based on the positions of the original corner points and the target corner points, to obtain the perspective transformed... image k Scenario-based adversarial patch : , , in Resize ( P, image k ) will counter the patch P Zoom to image image k size, These are the coordinates of the four corner points of the scaled adversarial patch, starting from the top left and moving clockwise, in the image coordinate system. , They are respectively image k The width and height of the image. Then, based on the adversarial patch... The mask is calculated at the position in the middle as follows. : , in for exist( i, j The pixel value at () is then calculated. Finally, the original image is... image k Counter-patch images and mask Fusion Generative Adversarial Images : , After generating the adversarial image, the corresponding original image is replaced with the adversarial image to obtain adversarial data.

[0029] Step S3 includes: Experimental setup: Overall data flow direction as follows Figure 1As shown. Assume a batch of target frames is the [number missing]. t Frame, participating in the first t The first two frames of frame inference are respectively the first two frames of the frame inference. t-1 Frame, First t-2 Frame. The red line in the diagram represents the first frame. t-1 The direction of frame data flow affects the first t-1 Frame output results R t-1 and the output result of frame t R t The experiment only considers N etu The inference results of each frame participating in training will N etu The inference results are collected into a list, and the loss for each inference result is calculated and summed to form the total loss. After the total loss is calculated, backpropagation is performed, and then the gradient of the adversarial patch is obtained and optimized. After several iterations, the final adversarial patch is obtained.

[0030] Step S301, Initial Frame Inference. Since the initial frame is the first frame of the batch training, no historical BEV information is involved in the inference. This part of the inference will output the inference result of this frame, and at the same time generate the BEV information of this frame and use it as the historical BEV information for the next frame in the inference.

[0031] Step S302, Non-initial frame inference. During inference, the non-initial frame incorporates the BEV information from the previous frame and outputs the BEV information for the current frame. This part of the inference will output the inference result for that frame, while simultaneously generating the BEV information for the current frame, combined with the BEV information from the previous frame, as historical BEV information for the next frame to participate in the inference.

[0032] Step S304, Batch optimization: This involves optimizing the batches of frames generated during training. N etu The loss is selectively calculated for each result (target frame). Frame t The result of the first frame is necessary, while the results of other frames are optional. The selected loss is accumulated and backpropagated. The BEV of the adversarial patch after participating in the inference of a certain frame will also participate in subsequent inferences. Therefore, the backpropagation takes into account the impact of the BEV feature extraction module and the historical BEV on the result loss. Thus, the final loss will cover multiple data stream branches, containing more information and guiding more accurate optimization results.

[0033] The present invention also discloses an adversarial patch generation optimization system with joint temporal feature information, comprising: a memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when invoked by the processor.

[0034] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0035] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. An optimized method for generating adversarial patches using joint temporal feature information, characterized in that, include: Step S1, Data Collection and Loading: Collect and load open-source datasets, simulation datasets, and custom real-world scenario datasets to obtain the total number of loaded frames; Step S2, calculate the position of the adversarial patch: initialize the adversarial patch parameters, read the target frame data, and obtain the annotation parameter information provided by the open source dataset, simulation dataset, and custom real scene dataset. This information is uniformly provided by the data collector. Based on the obtained parameters, calculate the position of the corner point of the adversarial patch in the global coordinate system and generate the adversarial image accordingly. Step S3, batch optimization based on historical BEV information: adopt multi-frame temporal inference setting, calculate the total loss of output results of multiple consecutive frames, perform backpropagation and gradient optimization based on the total loss, and iteratively generate the final adversarial patch.

2. The method for optimizing anti-patch generation according to claim 1, characterized in that, Step S1 specifically includes: Step S101, Open Source Dataset: Obtain parameter information using the open source dataset: transformation matrix from vehicle coordinate system to global coordinate system. T e2g and the transformation matrix from the global coordinate system to the camera coordinate system T g2c ; Step S102, Simulation Dataset: The dataset obtained by real-time rendering using simulation software, and parameter information similar to that in step S101 obtained according to the settings of the simulation software; Step S103, Customize real-world dataset: Acquire data through self-deployed sensor devices, perform custom annotations on the data, and obtain parameter information similar to that in step S101 based on sensor parameters; Step S104: Select steps S101, S102, and S103 to construct continuous frame data of any scene in the dataset, and set the number of preheating frames for a certain scene. N pre Number of frames used in training N etu By default, the last frame used in training is the target frame. Frame t Add the two frame counts together to get the total number of loaded frames. N load .

3. The method for optimizing anti-patch generation according to claim 2, characterized in that, In step S101, parameter information is obtained using NuScenes and KITTI, open-source datasets commonly used in the field of autonomous driving; the global coordinate system to camera coordinate system transformation matrix... T g2c Transformation matrix from global coordinate system to local coordinate system T g2e Local coordinate system to radar coordinate system transformation matrix T e2l Transformation matrix from radar coordinate system to camera coordinate system T l2c Obtained by performing matrix multiplication.

4. The method for optimizing anti-patch generation according to claim 2, characterized in that, Step S2 specifically includes: Step S201, Initialize adversarial patch parameters: Set the shape and size of the adversarial patch, randomly generate it based on the target mean and variance, or read it from an existing pattern to obtain the adversarial patch pattern. P Determine the corner location of the anti-patch. Corners init : , in Corner tl The row vector representing the coordinates of the top left corner point. Corner tr , Corner br , Corner bl These represent the coordinate row vectors for the top right, bottom right, and bottom left sides, respectively. W , H These represent the width and height of the adversarial patch, respectively, with the default unit being meters. They also determine the ideal displacement of the adversarial patch's coordinates within the target frame. , where Δ x Δ y Δ z In the vehicle coordinate system x axis, y axis, z The displacement of the axis, and in the local coordinate system x axis, y axis, z The positive axes represent the angles of rotation forward, left, and up, respectively. α , β , γ ; Step S202: Obtain relevant parameters of the target frame; read the data of the target frame to obtain the parameter information mentioned in step S101; Step S203: Calculate the global coordinates of the corner points of the adversarial patch; first, construct the rotation matrix. R With transformation matrix T p2e : , in, A T This is the transpose of matrix A. R x ( γ ) 、R y ( β ) 、R z ( γ The corner points are respectively located around the local coordinate system. x Axis rotation α Spend, y Axis rotation β Spend, z Axis rotation γ The rotation matrix of degrees is defined as follows: , , , Then, the global coordinates of the corner points of the anti-patch were calculated. Corners global And save it for later use: , Step S204: Generate adversarial image; traverse all loaded frames and obtain the first... k ={0, …, N load -1} frames Frame k The parameter information mentioned in step S101 is then used to transform the coordinates of the adversarial patch corner points in the global coordinate system to the coordinates in the camera coordinate system in each subsequent frame. : , in It is the first k The transformation matrix from global coordinate system to camera coordinate system for a frame. x k 、y k 、z k The first and second in the camera coordinate system are respectively k Frame-based anti-patch corner x axis, y axis 、z The axis column vector is then used to normalize the coordinates of the adversarial patch corner points in the camera coordinate system, thus obtaining the coordinates of the adversarial patch corner points in the image coordinate system. : , The adversarial patch pattern was then scaled up. Frame k The original image image k The size is then determined, and perspective transformation is performed based on the positions of the original corner points and the target corner points to obtain the perspective-transformed image in the original image. image k Scenario-based adversarial patch : , , in Resize ( P, image k ) will counter the patch P Zoom to image image k size, These are the coordinates of the four corner points of the scaled adversarial patch, starting from the top left and moving clockwise, in the image coordinate system. , They are respectively image k The width and height of the image, and then based on the adversarial patch... The mask is calculated at the position in the middle as follows. : , in for exist( i, j The pixel value at () is used; finally, the original image is... image k Counter-patch images and mask Fusion Generative Adversarial Images : , After generating the adversarial image, the corresponding original image is replaced with the adversarial image to obtain adversarial data.

5. The method for optimizing anti-patch generation according to claim 1, characterized in that, Step S3 specifically includes: Step S301, Initial Frame Inference: Output the inference result of the initial frame, and at the same time generate the BEV information of the initial frame and use it as the historical BEV information of the next frame for inference. Step S302, Non-initial frame inference: Combine the BEV information of the previous frame to participate in inference, and combine the BEV information of the previous frame to output the BEV information of the current frame, output the inference result of the frame, and at the same time generate the BEV information of the current frame combined with the BEV information of the previous frame as the historical BEV information of the next frame to participate in inference. Step S303, Batch optimization: Optimize the batches of frames generated during training. N etu The loss is selectively calculated for each result, the selected loss is accumulated and backpropagated, the gradient of the adversarial patch is then obtained and optimized, and the final adversarial patch is obtained after several iterations.

6. The method for optimizing anti-patch generation according to claim 5, characterized in that, In step S303, the adversarial patch will participate in subsequent inferences after participating in the BEV of a certain frame inference. During backpropagation, the impact of the BEV feature extraction module and historical BEV on the result loss is considered.

7. The method for optimizing anti-patch generation according to claim 5, characterized in that, In step S303, the result of the target frame is necessary, while the results of other frames are optional.

8. An adversarial patch generation optimization system that combines temporal feature information, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method of any one of claims 1-7 when invoked by the processor.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-7 when invoked by a processor.

Citation Information

Patent Citations

  • Multi-mode BEV look-around perception method, device and equipment and storage medium

    CN117392625A

  • Method and system for generating adversarial attacks on video recognition models

    US11776241B1