Physical domain robust adversarial attack method for unmanned aerial vehicle aerial photography target detection

Abstract

The invention relates to the technical field of artificial intelligence security, in particular to a physical domain robust adversarial attack method oriented to unmanned aerial vehicle aerial photography target detection, and aims at challenges of various environmental factors, the method comprises the following steps: initializing a learnable pixel tensor to generate an adversarial patch; inputting the training samples, the adversarial patches and label files of the adversarial patches into a patch conversion module to generate adversarial samples, inputting the adversarial samples into a YOLO target detector, performing weighted summation on each loss item based on the performance of the adversarial patches on each target detection network, constructing a unified optimization target, solving the overall loss for a detection model, and constructing an optimal target; according to the method, the adversarial patch is installed on the top of the vehicle or around the vehicle, so that the ground vehicle can avoid the unmanned aerial vehicle target detection system, and therefore, robustness detection of the aerial photography target detection neural network can be realized.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security technology, specifically to a physical domain robust adversarial attack method for target detection in drone aerial photography. Background Technology

[0002] As is well known, with the rapid development of Deep Neural Networks (DNNs), aerial image target detection systems based on DNNs have demonstrated excellent performance in both accuracy and efficiency. However, related research shows that these systems are highly vulnerable to carefully designed adversarial example attacks—by adding minute perturbations that are imperceptible to the naked eye to the original aerial images, the detector can produce completely different false recognitions or false negatives, leading to serious consequences in critical application scenarios such as intelligent security, environmental monitoring, traffic management, and military reconnaissance.

[0003] Recent research has shown that deep neural networks are vulnerable to adversarial examples. Adversarial examples are samples obtained by adding carefully designed and imperceptible perturbations to an input image, which can induce deep neural networks to produce incorrect predictions. Physical adversarial attacks involve inserting adversarial examples into the physical world to cause errors in the inference of deep neural networks. Due to the widespread application of deep learning technology in the physical world, adversarial attacks in the physical world are even more significant.

[0004] In the field of aerial image target detection, adversarial examples can be broadly categorized into two types: pixel-based adversarial examples and patch-based adversarial examples. Pixel-based adversarial examples generate adversarial perturbations by directly manipulating all or part of the pixels in the input image, thereby disabling target detectors based on deep neural networks. Patch-based adversarial examples, on the other hand, add perturbations to specific regions of the image. They tend to limit the range of perturbations rather than their intensity, making patch-based adversarial examples easier to implement in the real world and posing greater security risks to the deployment and application of deep neural networks.

[0005] Adversarial patching attacks in aerial target detection face multiple technical bottlenecks: First, existing generation methods suffer from insufficient attack concealment due to inefficient optimization functions, resulting in a high probability of target identification. Second, the digital-to-physical domain conversion process suffers significant performance degradation; patches require multiple conversion stages such as printing and data acquisition, making them susceptible to pixel distortion due to printer color differences, acquisition equipment noise, and weather conditions. Third, existing algorithms generally ignore long-distance imaging characteristics, equipment distortion, and complex environmental variables, resulting in insufficient robustness in real-world aerial photography scenarios. Crucially, if such techniques are maliciously used in security-sensitive areas (such as military target concealment), they could lead to serious consequences. This makes addressing the vulnerability of adversarial examples in deep neural network applications a pressing research direction. Current research needs to achieve technological breakthroughs in cross-domain conversion modeling, environmental adaptive optimization, and physical robustness enhancement. Summary of the Invention

[0006] (a) Technical problems to be solved

[0007] Existing research largely focuses on digital domain attacks, which have limited effectiveness against target detection in physical environments. Furthermore, interference from complex environments and varying drone viewing distances significantly weakens the robustness of attacks. To address these shortcomings, this invention provides a physical domain robust adversarial attack method for drone aerial target detection.

[0008] (II) Technical Solution

[0009] To achieve the above objectives, this invention provides the following technical solution: a physical domain robust adversarial attack method for target detection in UAV aerial photography, using a high-resolution image set of vehicles captured by UAVs as the training dataset, and employing a YOLO series neural network for target detection, comprising the following steps:

[0010] S1. Load the deep neural network model used for aerial target detection and prepare training sample images;

[0011] S2. Obtain the initial adversarial patch and transform the initial adversarial patch based on preset transformation parameters;

[0012] S3. Place adversarial patches at the detection boxes of the training samples to generate adversarial samples;

[0013] S4. Input the adversarial examples into the YOLO detector, and design a loss function that takes into account factors such as patch reproducibility, pixel smoothness, significance, and maximizing detection failure.

[0014] S5. Based on the constructed loss function, the Adam optimizer is used to iteratively train the adversarial patch until the preset number of iterations or loss convergence is reached;

[0015] S6. Print and deploy the trained adversarial patch on the top of the vehicle or around the ground where the vehicle is located to carry out the adversarial attack.

[0016] Furthermore, the present invention is improved in that step S1 further includes the following steps:

[0017] S11. Load the deep neural network for aerial target detection.

[0018] S12. Obtain aerial training images containing the target and their detection bounding boxes.

[0019] Furthermore, the present invention includes an anti-patch transformation processing method, the specific operation process of which includes the following steps:

[0020] S21. The patch is initialized as a learnable pixel tensor of a preset base size, and its pixel values ​​are uniformly and randomly sampled within [0,1].

[0021] S22. Perform transformation processing on the initial adversarial patch, including color-texture transformation, scene intensity matching, affine transformation, etc.

[0022] Furthermore, the present invention includes an improvement in generating adversarial examples, the specific operation process of which includes:

[0023] S31. Based on the position and size of the detection box parsed in step S12, determine the region of the target in the initial sample image.

[0024] S32. Based on the preprocessed adversarial patch from step S22, attach it to the target region according to the coordinates and size of the detection box to generate an adversarial training sample image with the patch.

[0025] S33. Secondary processing is performed on the training sample images to obtain adversarial examples. The main processing methods include adding brightness and darkness transformations and weather changes.

[0026] Furthermore, the present invention is improved by using the overall loss function L in step S4. patch This includes total variation loss, overall patch significance loss, maximum detection failure loss, and non-printing loss. The formula for calculating the overall loss function is:

[0027] L patch =αL tv +βL sal +γL nps +δL mdf

[0028] Among them, L tv L represents the total variation loss. sal L represents the overall significant loss. nps L represents non-printing loss. mdfThis represents maximizing the loss for detection failures. α, β, γ, and δ are hyperparameters, representing the weights of each adversarial patch loss term.

[0029] Furthermore, the present invention improves upon this by including an iterative optimization process comprising: calculating the loss using the prediction error of the target detection model, updating the adversarial patch pixels accordingly to improve the interference effect, until a stopping condition is met, at which point the final patch is output, and updating the pixel values ​​of the initial adversarial patch using the following formula:

[0030]

[0031] Where, p k and p k+1 These are the patch pixel values ​​at the k-th and (k+1)-th iterations, respectively. Let Δ(·) be the gradient of the current loss function with respect to the patch, Δ(·) be the update step size determined by the optimizer (e.g., Adam), η be the learning rate, L be the loss function, and Proj be the projection function. C Used to limit the update results to a reasonable pixel range.

[0032] Furthermore, an improvement of the present invention is that the trained adversarial patch is printed and deployed on the top of the vehicle or around the ground where the vehicle is located to carry out a physical adversarial attack.

[0033] (III) Beneficial Effects

[0034] Compared with existing technologies, this invention provides a physical domain robust adversarial attack method for target detection in UAV aerial photography, which has the following beneficial effects:

[0035] This paper presents a physical domain robust adversarial attack method for drone aerial target detection. The adversarial patch generated by this method can fully consider the influence of complex environmental factors. Through patch transformation processing and image enhancement, it can achieve effective adversarial attacks on aerial image target detectors under various environmental conditions, ensuring stable attack results in real aerial photography scenarios.

[0036] The adversarial patch is practically feasible. Through non-printable loss design, it can be produced using conventional printing equipment and is easy to deploy. It can be conveniently applied to real-world scenarios, enabling targets to effectively evade detection and recognition by drone aerial image target detectors, thus achieving effective target concealment.

[0037] By co-optimizing multi-objective loss functions, the effectiveness of the attack is ensured while the stealth of the adversarial patch is improved, making it less likely to be detected by humans or automatic detection systems. It also has cross-model and cross-scene transfer capabilities, and can be used for detection models with different parameter scales and diverse aerial photography scenarios. Attached Figure Description

[0038] Figure 1 This is a flowchart of a physical domain robust adversarial attack method for UAV target detection according to an embodiment of the present invention;

[0039] Figure 2 This is a schematic diagram illustrating the generation principle of an anti-patch according to an embodiment of the present invention;

[0040] Figure 3 This is an image showing the effect of a digital domain adversarial sample attack generated by an adversarial patch generation method according to an embodiment of the present invention.

[0041] Figure 4 This is a diagram illustrating the effect of a physical domain adversarial sample attack generated by an adversarial patch generation method according to an embodiment of the present invention. Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] Currently, most research on physical adversarial attacks against target detection systems focuses on close-range or ground-based scenarios, such as facial recognition, industrial inspection, and autonomous driving. These scenarios are typically close-range and less affected by weather. However, drones operate at high altitudes, with aerial photography distances reaching tens or even hundreds of meters, and are more significantly affected by weather and imaging equipment, making adversarial attacks considerably more difficult. Therefore, research on physical adversarial attacks against drone target detection systems is relatively limited. Furthermore, existing methods typically do not impose constraints on the appearance of adversarial patches, making them easily detectable by observers. At the same time, the transferability of patches is often poor, resulting in low effectiveness across different models and scenarios.

[0044] Please see Figures 1 to 4 The present invention provides the following technical solution: a physical domain robust adversarial attack method for UAV target detection, comprising the following steps:

[0045] refer to Figure 1 One embodiment of the present invention provides a physical domain robust adversarial attack method for UAV target detection, the method comprising the following steps S1–S6:

[0046] Step S1: Load the deep neural network model used for aerial target detection and prepare training sample images.

[0047] In one embodiment of the present invention, the initialization preparation of the aerial detection model and data is obtained in the following manner: First, a deep neural network architecture for aerial target detection is loaded, pre-trained weight parameters are imported, the model is switched to evaluation mode and allocated to a designated computing device (such as a GPU). Simultaneously, the original aerial training image set and its associated annotation information (including target location boxes and category labels) are obtained, and standardized preprocessing operations (such as size adjustment and pixel value normalization) are performed on the images to lay the data foundation for subsequent adversarial patch generation and effect verification.

[0048] In one embodiment of the present invention, a training dataset is obtained from an existing known dataset.

[0049] Specifically, for aerial image targets, the datasets selected were either the existing Side Street dataset or the VisDrone-2019 dataset. The Side Street dataset was chosen as the training dataset, containing 780 training images and 63 test images. All images are labeled car images taken from a 100-meter aerial perspective. The transferability test used the VisDrone-2019 dataset, which contains 6192 training images and 1564 test images. All images were acquired by a drone platform and have different resolutions and scenes. To ensure the validity of the training data, objects occupying less than 0.05% of the image area were removed, and the pixel values ​​of all images were normalized to between 0 and 1. Gray pixels were used to fill the images to maintain the original aspect ratio, and finally, the images were uniformly standardized to a 640×640 pixel size for both training and testing.

[0050] In one embodiment of the present invention, the target is determined according to actual needs, for example, the target is a car.

[0051] Step S2: Obtain the initial adversarial patch and perform transformation processing on the initial adversarial patch based on preset transformation parameters.

[0052] Furthermore, considering the complex environmental factors in the real physical world, such as distance, angle, ambient lighting, and contrast of aerial photography equipment, the optimization of adversarial patches in the digital space must take into account the influence of the actual environment during the optimization process to improve the robustness of adversarial patches to complex environments. Specifically, in one embodiment of the present invention, by transforming the initial adversarial patch to obtain an adversarial patch, and then training and updating based on the obtained adversarial patch, the robustness of the adversarial patch to complex environments can be significantly improved.

[0053] refer to Figure 2In one embodiment of the invention, the adversarial patch is pasted at the center or periphery of the target detection box, with one adversarial patch pasted on each target detection box. The transformation process includes: color-texture transformation, scene intensity matching, and affine transformation. The color-texture transformation module simulates common perturbations in modern image processing (such as RGB / YUV color space conversion, JPEG / WebP compression, and transmission channel noise) and employs a composite noise injection strategy to mitigate the performance degradation of the adversarial patch. Specifically, by adding random noise and high-frequency noise to each color channel, the patch can maintain its attack effect even under color imbalance and compression effects, thereby improving the effectiveness of the adversarial patch in different processing environments. The scene intensity matching module adjusts the intensity distribution of the adversarial sample under different environmental conditions to ensure it can adapt to changes in real-world scenes (such as shooting angle, lighting, and noise). Specifically, it adjusts parameters such as scene contrast, brightness, and noise to ensure the adversarial sample remains effective in diverse environments, thereby improving its robustness in different scenes. The affine transformation module adjusts the shape of the adversarial patch to ensure it can be effectively applied to the target object. Specifically, the patch scales or rotates to adapt to different angles and distances based on the object's shape. This allows the patch to maintain its effectiveness across various object sizes and viewpoints, ensuring its applicability in different scenarios.

[0054] In one embodiment of the present invention, during the training and optimization of the adversarial patch, random high-frequency noise is added to the adversarial patch, causing the image intensity value to randomly change by ±0.1. The contrast of the adversarial patch is also randomly adjusted, ensuring the image intensity remains within the range of [0.8, 1.2]. Simultaneously, the brightness of the adversarial patch is randomly adjusted, causing the image intensity value to increase or decrease by ±0.1. Random uniform noise is also added to the adversarial patch, causing the image intensity to change within a specified range. Furthermore, the adversarial patch is reduced in size to match scene objects of the same physical size, and the adversarial patch is randomly rotated around its center, with a rotation angle ranging from ±20°.

[0055] A composite noise injection strategy is proposed for color-texture conversion, which is specifically determined using the following formula:

[0056] p aug =W c ⊙p+∈

[0057] Among them, W c W is a multiplicative noise vector, where each element follows a uniform distribution U(0.9,1.1), meaning the intensity of each channel is randomly varied. cThe purpose of ⊙p is to simulate the nonlinear coupling of color space transformation and handle channel gain differences. ∈ is a two-dimensional noise that follows a Gaussian distribution N(0, 2 The mean is 0, and the standard deviation is σ = 0.03, ensuring that the noise is imperceptible to the human eye. aug This indicates an enhanced anti-patch.

[0058] In scene intensity matching, a model with potential environmental changes was built, specifically determined using the following formula:

[0059] p'=((p aug ×c f )+b f )+n f

[0060] Among them, c f b represents the scene contrast adjustment factor. f n represents the scene brightness adjustment factor. f This represents the noise factor. By adjusting these parameters, adversarial examples can adapt to various effects in different scenarios, thereby improving the robustness of adversarial patches under various environmental conditions and making them effective in different scenario variations.

[0061] refer to Figure 2 In the upper right and lower right sections, this invention presents an image augmentation module incorporating weather perturbation simulation to enhance the attack stability of adversarial patches in variable environments. This module applies perturbations, including rain, snow, fog, and reduced brightness, to the original training images, constructing training data with diverse environmental distributions. This improves the generalization ability and robustness of the patches under different weather conditions. The aforementioned perturbation strategy references and optimizes the design principles of the existing data augmentation framework Automold, making it more closely aligned with real-world environmental changes in UAV aerial photography scenarios.

[0062] Step S3: Apply adversarial patches to the detection boxes of the training samples to generate adversarial samples.

[0063] In one embodiment of the present invention, based on the spatial localization information (position coordinates and size parameters) of the detection box obtained in stage S1, the corresponding region of the target in the original image is accurately identified. Subsequently, the adversarial patch preprocessed in stage S2 is fused to the target region according to the geometric properties (coordinates and scale) of the detection box, generating training samples carrying adversarial interference. To further enhance the controllability of the attack effect, it supports the use of preset strategies (such as selectively deploying patches on top of or near the target) and strictly maintains the spatial alignment characteristics of the patch and the detection box, ensuring the accuracy of attack performance evaluation during subsequent optimization.

[0064] Step S4: Input the adversarial examples into the YOLO detector and design a loss function by comprehensively considering factors such as patch reproducibility, pixel smoothness, significance, and maximizing detection failure.

[0065] refer to Figure 2 In the second part, this method adapts the architecture to a typical one-stage aerial target detector to accurately acquire the output of the detector heads at each scale and calculate the gradient of the patch during forward inference. Specifically, for YOLOv3, a detection model consistent with it is constructed, including a Darknet-53-based backbone network structure, preset anchor configuration, input image resolution, and normalization method. The feature map positions of the output of its three-scale detector heads are defined, thereby obtaining classification, confidence, and bounding box prediction results at each scale, and calculating the gradient signal of the adversarial patch accordingly. For YOLOv5, its CSPDarknet backbone, PANet feature fusion path, adaptive anchor generation mechanism, CIoU bounding box loss, Mosaic and MixUp data augmentation strategies are matched, while the non-maximum suppression (NMS) rule and confidence threshold setting in its inference stage are determined. Through the above architecture adaptation, this method can stably extract the gradient required for backpropagation at multiple feature levels and jointly optimize the patch by combining multiple loss functions. Without changing the detector weights, it effectively improves the attack performance of patches in the physical domain and their ability to migrate across architectures.

[0066] refer to Figure 2 In the lower left corner, in one embodiment of the present invention, adversarial samples are input into the YOLO target detector, and the detection loss is calculated using the overall loss function.

[0067] In one embodiment of the present invention, a loss function is constructed that considers patch reproducibility, inter-pixel smoothness of patches, overall patch saliency, and target detection confidence. The loss function is constructed as follows:

[0068] L patch =αL tv +βL sal +γL nps +δL mdf

[0069] Among them, L patch L represents the loss function. tv L represents the total variation loss. sal L represents the overall significant loss. nps L represents non-printing loss. mdf This represents maximizing the loss for detection failures. α, β, γ, and δ are hyperparameters, representing the weights of each adversarial patch loss term.

[0070] Total variation loss Ltv Constraining the smoothness of color transitions between adjacent pixels in the patch reduces high-frequency noise interference, thereby enhancing robustness. The calculation formula is as follows:

[0071]

[0072] Where N represents the number of pixels on a given adversarial patch p, and L represents the number of pixels when adjacent pixels are similar. tv The value is low, while for pixels with large differences, L tv The value is relatively high. p i,j p represents the pixel at coordinates (i,j) in the adversarial patch. i+1,j p represents the pixel at coordinates (i+1,j) in the adversarial patch. i,j+1 The pixel at coordinates (i,j+1) in the adversarial patch is represented by t, which represents the total number of rows (columns) of the patch image. By calculating the total variation between patch pixels, the pixel value changes of the patch are made smoother, thus avoiding the patch from appearing unnatural or abrupt.

[0073] Overall significance loss L sal Based on the RGB color space design, by adjusting the color vibrancy and saturation of the patches, the probability of them being recognized by the target detection system is reduced, thereby improving concealment. The overall saliency loss function is calculated as follows:

[0074]

[0075] yb=0.5×(R+G)-B

[0076]

[0077] In this context, R, G, and B are the values ​​of the patch's three channels in the color space, representing the red, green, and blue components, respectively. rg is the difference between the red and green channels, and yb is the difference between the yellow and blue channels. Converting the R, G, B space to an opposing color space (rg-yb) aligns with the detection system's perceptual characteristics of color contrast. is the Euclidean norm of the standard deviations of rg and yb, representing the degree of dispersion of color differences within a region. It is the Euclidean norm of the average values ​​of rg and yb, representing the overall offset intensity of color differences within the region. The synergistic optimization of the two causes the patch to converge to a uniform neutral tone with low saturation and low contrast, thereby interfering with the detection system.

[0078] Non-printing loss L nps This is used to determine whether colors in an image can be recovered to the closest print color using a printing device. Its value is obtained by calculating the sum of the minimum Euclidean distances between each image element and the nearest print color, using the following formula:

[0079]

[0080] Where, p i,j `p` represents the pixel value in the i-th row and j-th column of patch `p`, indicating the RGB value of that pixel. It is a vector containing the values ​​of the red, green, and blue channels, where `c` ∈ C. C is a predefined color set containing all colors that the printing device can reproduce. `nps` ensures that the color in pixel `p` is as close as possible to the color that the printing device can reproduce.

[0081] Maximize the loss L from detection failure mdf The aim is to improve the success rate of adversarial attacks by attacking the detector's key outputs, thereby effectively concealing or misclassifying the target. The specific calculation formula is as follows:

[0082]

[0083] L mdf = -log(1-max(D) score ))

[0084] Among them, D bbox These are the detected bounding boxes. These are the actual labeled bounding boxes. IoU is used to calculate D. bbox With the true bounding box The overlap between the detected bounding boxes and the ground truth bounding boxes is used to measure the robustness of the match between them. A larger IoU indicates a better match between the detected and ground truth bounding boxes. obj and D class L represents the target score and category score of the detection box, respectively. mdf This is used to minimize the detector's ability to detect camouflaged targets. By minimizing this loss, the goal is to prevent the target detector from correctly detecting the target or from misclassifying it.

[0085] By optimizing the detection confidence loss described above, targets with the final optimized adversarial patch can be made less likely to be detected by aerial drone target detection.

[0086] Step S5: Based on the constructed loss function, the Adam optimizer is used to iteratively train the adversarial patch until the preset number of iterations or loss convergence is reached.

[0087] In one embodiment of the present invention, training sample images are first input into a deep neural network according to a predefined loss function. The initial adversarial patch is then optimized at the pixel level using the network's backpropagation mechanism until the final patch is obtained. Further steps S51-S53 are included:

[0088] Step S51: Input multiple images from the training set into the deep learning model in sequence. After the network's forward inference process, obtain the corresponding object detection prediction box output.

[0089] In one embodiment of the present invention, each training image is input into the model and sequentially processed through convolution, activation, feature fusion and other operations. Finally, several candidate detection boxes are generated at the output, which is the model's prediction of the target location in the image.

[0090] Step S52: Compare the predicted bounding box with the corresponding ground truth bounding box of the image (which is consistent with the initial sample annotation), calculate the loss value based on the difference between the two, and use the loss as the evaluation basis for adversarial patch updates. The patch pixels are iteratively adjusted by the optimizer to improve the interference effect on the detection model.

[0091] Step S53: Determine if the preset stopping condition has been met (e.g., the number of iterations has reached the upper limit or the loss is below a threshold). If met, save the current patch as the final adversarial patch; otherwise, update the patch pixels based on the loss using the optimizer, and return to step S51 to continue iteration. Through this loop, the patch can be continuously adjusted through multiple training sample inputs and gradient updates to balance the model's perturbation effect and physical realizability.

[0092] Furthermore, in one embodiment of the present invention, the adversarial patch is iteratively optimized using a stochastic gradient descent framework. Specifically, the pixel values ​​of the initial adversarial patch are updated using the following formula:

[0093]

[0094] Where, p k and p k+1 These are the patch pixel values ​​at the k-th and (k+1)-th iterations, respectively. Let η be the gradient of the current loss function with respect to the patch, Δ(.) represent the update step size determined by the optimizer (such as Adam), and η be the learning rate. This process can be viewed as adjusting the patch pixels based on the current gradient information in each iteration. The learning rate is set to 1e-3. The optimizer can be flexibly selected and its hyperparameters adjusted appropriately. L represents the total loss function, and Proj is the projection function. C This is used to limit the update results to a reasonable range of pixels. In addition, pixel values ​​can be cropped or mapped after each update to meet physical printability or other constraints, ensuring that the generated patch is feasible for real deployment.

[0095] Furthermore, in one embodiment of the present invention, the adversarial patch attack method may further include: deploying the finally optimized patch into a real scene according to the selected pasting position and method of the adversarial patch in the training sample, so as to carry out an actual attack on the aerial drone target detection system.

[0096] Step S6: Print the trained adversarial patch and deploy it on the top of the vehicle or around the ground where the vehicle is located to carry out the adversarial attack.

[0097] Furthermore, in one embodiment of the present invention, the digital size of the patch image on the vehicle roof is set to 200×200 pixels, corresponding to a physical size of 5×5 cm; the digital size of the patch image around the vehicle's ground is set to 400×25 pixels, corresponding to a physical size of 16×1 cm. The patch image uses a specification of 300g / m³. 2 Printing on coated paper ensures accurate reproduction of pattern details while maintaining good rigidity, guaranteeing the patch's stability and durability against interference in physical environments. The physical domain experiment was set up in a simulated road sand table scene, with cameras installed at a height of approximately 1-2 meters, equivalent to a low-altitude drone filming at an altitude of 200-400 meters. To accurately simulate drone movement, the camera's tilt range was 10°-30°, and its direction, position, and lighting intensity (via bulb brightness) were adjustable to simulate different environmental conditions. The cameras used were industrial color cameras such as the acA1300-60gc and acA2440-20gc, offering different resolutions and frame rates suitable for machine vision tasks such as object detection. The target objects were SUV and sedan models scaled at 1:32 and 1:36 ratios, simulating different types of real vehicles.

[0098] Model training and evaluation were both performed on an NVIDIA RTX 4090 GPU using the Adam optimizer. The learning rate linearly increased from 0.001 to 0.1 in the first three training epochs, and then linearly decreased by the scheduler in each subsequent epoch. If the validation accuracy did not improve within 100 epochs, early stopping was used to terminate training. The total training epochs for the object detection model were 500, with a batch size of 8, implemented using the PyTorch API (v1.11.0). To evaluate the transferability of adversarial patches, experiments were conducted on YOLOv5 models, ranging from the lightweight YOLOv5 Nano (1.9 million parameters) to the heavyweight YOLOv5 Extra Large (87.7 million parameters). The following criteria were used to evaluate the effectiveness of adversarial attacks: a physical domain adversarial attack was considered effective if the target detection confidence decreased by ≥50% or the false negative rate was ≥50%.

[0099] refer to Figure 3 In one embodiment of the present invention, the adversarial patch is pasted at the top and perimeter of the target detection box. By pasting the adversarial patch at each detection box position of the initial sample image, a corresponding sample image is obtained. Figure 3This is a digital domain adversarial sample attack effect diagram. The test sample images have undergone digital enhancement processing, mainly including rain, snow, fog, and brightness reduction. The first column is the test image of the adversarial patch (around the ground where the target is located) after transformation processing and image enhancement optimization, and the second column is the test image of the adversarial patch (top of the target) after transformation processing and image enhancement optimization. Figure 4 Figures show the effects of a scaled-down attack on the physical domain, simulating an aerial detection scenario based on a drone. Figures (1)-(3) show the target detection effect when the drone is 200 meters above the ground: Figure (1) shows the detection effect on the sand table car model, and Figures (2)-(3) show the detection effect when the adversarial patch trained on different versions of YOLOv5 (YOLOv5n, YOLOv5x) is placed on top of the car model. Figures (4)-(6) show the target detection effect when the drone is 350 meters above the ground: Figures (4) and (5) show the detection effect when the drone is perpendicular to the ground and 20 degrees clockwise from the vertical direction of the ground, respectively, and Figure (6) shows the detection result when the adversarial patch is placed around the ground of the sand table car model. Overall, the attack successfully interfered with the detection of the target vehicle using the optimized adversarial patch.

[0100] The adversarial patch attack method for target detection of aerial drones provided in one embodiment of the present invention can fully consider complex environmental factors such as lighting, viewing angle, and shooting distance, ensuring that it can still significantly interfere with target detection under real aerial shooting conditions. Furthermore, the obtained adversarial patch is practically feasible, and through reasonable arrangement, it enables the target to successfully evade identification during aerial shooting, achieving effective concealment. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A physical domain robust adversarial attack method for target detection in UAV aerial photography, characterized in that, Using a high-resolution image set of vehicles taken by drones as the training dataset, the object detection algorithm adopts the YOLO series neural network, including the following steps: S1. Load the deep neural network model used for aerial target detection and prepare training sample images; S2. Obtain the initial adversarial patch and transform the initial adversarial patch based on preset transformation parameters; S3. Place adversarial patches at the detection boxes of the training samples to generate adversarial samples; S4. Input the adversarial examples into the YOLO detector, and design a loss function that takes into account factors such as patch reproducibility, pixel smoothness, significance, and maximizing detection failure. S5. Based on the constructed loss function, the Adam optimizer is used to iteratively train the adversarial patch until the preset number of iterations or loss convergence is reached; S6. Print and deploy the trained adversarial patch on the top of the vehicle or around the ground where the vehicle is located to carry out the adversarial attack.

2. The method for robust physical domain against patch attacks for UAV target detection according to claim 1, characterized in that, Step S1 further includes the following steps: S11. Load the deep neural network for aerial target detection. S12. Obtain aerial training images containing the target and their detection bounding boxes.

3. The physical domain robust anti-patch attack method for UAV target detection according to claim 1, characterized in that, Countermeasure patch transformation processing, the specific operation process includes: S21. The patch is initialized as a learnable pixel tensor of a preset base size, and its pixel values ​​are uniformly and randomly sampled within [0,1]. S22. Perform transformation processing on the initial adversarial patch, including color-texture transformation, scene intensity matching, affine transformation, etc.

4. A physically-domain robust anti-patch attack method for UAV target detection according to claim 1, characterized in that, Generating adversarial examples involves the following steps: S31. Based on the position and size of the detection box parsed in step S12, determine the region of the target in the initial sample image. S32. Based on the preprocessed adversarial patch from step S22, attach it to the target region according to the coordinates and size of the detection box to generate an adversarial training sample image with the patch. S33. Secondary processing is performed on the training sample images to obtain adversarial examples. The main processing methods include adding brightness and darkness transformations and weather changes.

5. A physically-domain robust anti-patch attack method for UAV target detection according to claim 1, characterized in that, The overall loss function L used in step S4 patch This includes total variation loss, overall patch significance loss, maximum detection failure loss, and non-printing loss. The formula for calculating the overall loss function is: L patch =αL tv +βL sal +γL nps +δL mdf Among them, L tv L represents the total variation loss. sal L represents the overall significant loss. nps L represents non-printing loss. mdf This represents maximizing the loss for detection failures. α, β, γ, and δ are hyperparameters, representing the weights of each adversarial patch loss term.

6. A physically-domain robust adversarial attack method for UAV target detection according to claim 1, characterized in that, The iterative optimization process includes: calculating the loss using the prediction error of the target detection model, updating the adversarial patch pixels accordingly to improve the interference effect, and outputting the final patch after the stopping condition is met. The pixel values ​​of the initial adversarial patch are updated using the following formula: Where, p k and p k+1 These are the patch pixel values ​​at the k-th and (k+1)-th iterations, respectively. Let Δ(·) be the gradient of the current loss function with respect to the patch, Δ(·) be the update step size determined by the optimizer (e.g., Adam), η be the learning rate, L be the loss function, and Proj be the projection function. C Used to limit the update results to a reasonable pixel range.

7. A physically-domain robust adversarial attack method for UAV target detection according to claim 1, characterized in that, The trained adversarial patches are printed and deployed on the top of the vehicle or around the ground where the vehicle is located to carry out physical adversarial attacks.

Images