Defense method for robust enhanced intelligent system based on diffusion model and adversarial training

Abstract

The invention provides a robust enhanced intelligent system defense method based on a diffusion model and adversarial training, and belongs to the technical field of target detection. The method comprises the steps of generating multi-scene data and performing condition control; the hierarchical data is synthesized, and the authenticity of the data is enhanced; generating a dynamic confrontation sample; determining an adaptive adversarial training strategy; constructing a physical domain multi-modal confrontation sample; performing confrontation training layer by layer in a progressive manner; and detecting the confrontation target. According to the method, the robustness and practicability of the target detection model in a complex environment are remarkably improved through multi-dimensional technical innovation.

Description

Technical Field

[0001] This invention belongs to the field of target detection technology, and in particular relates to a robust enhanced intelligent system defense method based on diffusion model and adversarial training. Background Technology

[0002] As artificial intelligence (AI) technology deeply penetrates the physical space, physical intelligence (PAI) is becoming a core direction for the next generation of AI development. However, physical AI viruses are also quietly emerging, such as physical adversarial examples and physical backdoors—new threats in the real physical world with offensive capabilities. Existing research indicates that these new physical AI viruses, including physical adversarial examples and physical backdoors, possess multimodal collaborative adversarial attack capabilities (capable of simultaneously interfering with multi-spectral sensing such as visible light, infrared, and radar), environmental fusion concealment (perturbation patterns highly consistent with natural physical phenomena), and strong deceptive inducement capabilities (potentially leading to target misidentification or system malfunction), posing a serious threat to our intelligent sensing equipment.

[0003] Adversarial training methods enhance model robustness by combining clean and adversarial examples. Early research focused on image classification, and further extended to object detection, revealing the common underlying mechanisms of classification and localization tasks in adversarial attacks. Since the two tasks share feature maps and exhibit gradient misalignment, directly using the total loss for adversarial training leads to a decrease in model performance (mAP). To address this, the Multi-Task Supervision Source (MTD) adversarial training method was proposed, selecting adversarial examples that maximize the overall task loss for training. However, MTD suffers from class imbalance, potentially leading to specific class losses dominating training. Chen et al. further proposed Class Balanced Adversarial Training (CWAT), which alleviates class imbalance through class loss normalization, improving the model's robustness to all target classes.

[0004] While MTD and CWAT can improve model robustness, they rely on the accurate acquisition of adversarial examples, requiring prior knowledge of the attacker's capabilities and model retraining. Furthermore, adversarial training alters the data distribution, leading to a significant decrease in model accuracy. Moreover, these methods are unable to defend against secondary adversarial attacks. To improve robustness, the literature explores defensive techniques that restrict contextual information, pointing out that spatial contextual information is easily exploited by attackers. For example, two methods are proposed: 1) limiting the model's receptive field by penalizing feature maps outside the bounding box; 2) constructing context-independent datasets (e.g., cropping or blurring target objects). However, these methods are costly and lack generalization, only effective against specific types of contextual attacks.

[0005] To alleviate the feature conflict between clean and adversarial samples during adversarial training, an adversarial-aware robust object detector (RobustDet) is proposed. Its core comprises two modules: 1) an adversarial image discriminator (AID), which learns the distribution differences between adversarial and clean samples through dynamic convolutional weight allocation; and 2) a reconstructed consistent feature module (CFR), which extracts robust features from adversarial samples and reconstructs clean samples. RobustDet improves robustness while mitigating accuracy degradation by separating and fusing the feature distributions of the two types of samples. However, this method requires knowledge of the attack algorithm and model structure, involves significant network modifications, and still cannot resist secondary attacks, limiting its practical application.

[0006] The MTD method addresses the adversarial robustness problem of object detection models. Object detection, as a multi-task learning framework combining classification and localization, is susceptible to adversarial attacks. However, existing research largely focuses on attack methods, lacking solutions to improve robustness. This method takes a multi-task perspective, systematically analyzing the interaction between classification and localization tasks and their impact on robustness. MTD first points out that because object detection models share a base network, the loss functions of classification and localization tasks influence each other. Adversarial attacks, through perturbations generated by single-task losses (such as classification losses), can degrade model performance across tasks, a phenomenon known as cross-task attack transfer. Furthermore, the gradient directions of the two tasks are inconsistent (i.e., task gradient misalignment), limiting the effectiveness of traditional adversarial training that directly combines multi-task losses. Summary of the Invention

[0007] To address the aforementioned technical problems, this invention proposes a data augmentation adversarial training algorithm based on a diffusion model to improve the robustness of target detection models. Specifically, this invention discloses a robust enhancement method for intelligent system defense based on a diffusion model and adversarial training. The method includes: Step S1: Generate multi-scenario data and perform condition control; Step S2: Synthesize the hierarchical data and enhance its authenticity; Step S3: Generate dynamic adversarial examples; Step S4: Determine the adaptive adversarial training strategy; Step S5: Construct physical domain multimodal adversarial examples; Step S6: Perform adversarial training in a layered and progressive manner; Step S7: Detect the adversarial target.

[0008] Step S1 specifically includes: Scene semantic encoding: Using a pre-trained text encoding model to convert scene labels into semantic vectors, which serve as conditional inputs to the diffusion model; Scale factor embedding: Introduces an adjustable parameter into the latent space of the diffusion model to control the size of the target object in the generated image; Diffusion model training: Based on the improved Stable Diffusion architecture, scene semantic vectors and scale parameters are fused into the generation process to generate synthetic image data of multiple scenes and scales.

[0009] Step S2 specifically includes: Background-foreground layer generation: Generates a background image that conforms to the semantics of the scene, overlays foreground objects in a specified area using a segmentation mask, and adjusts their size; Physical domain adaptation fine-tuning: The diffusion model is fine-tuned on the real-world dataset. Feature alignment techniques are used to reduce the distribution difference between the synthetic data and the real data, ensuring the physical authenticity of the generated images.

[0010] Step S3 specifically includes: Construct three types of adversarial examples: Adversarial examples for classification: causing the model to misclassify the target by perturbing the image; Adversarial examples in regression: Perturbing the image to make the bounding box position predicted by the model deviate from the true value; Joint adversarial examples: Simultaneously attacking classification and localization tasks to maximize the joint loss of both; Adversarial attack parameter settings: A momentum-based iterative attack method is adopted to limit the perturbation amplitude and ensure that the adversarial sample is visually normal.

[0011] Step S4 specifically includes: Dynamic mixing ratio adjustment: In the initial stage of training, joint adversarial examples are used as the benchmark. As training progresses, the proportion of classification and regression adversarial examples is gradually increased, and the rate of change of the mixing weights is controlled by an exponential function. Task gradient monitoring: Regularly analyze the differences in optimization directions between classification and localization tasks. When the two conflict, reset the hybrid weights to balance task learning.

[0012] Step S5 specifically includes: Differentiable rendering conversion: Using 3D rendering tools, digital adversarial perturbations are converted into printable textures in the physical world to simulate the attack effects under different lighting and perspectives; Cross-modal cooperative attacks: Optimize adversarial textures to achieve interference under multiple sensors based on visible light, near infrared and far infrared, and ensure the cooperativeness of multimodal attacks through feature alignment.

[0013] Step S6 specifically includes: Implement the three-phase training protocol: Initial stage: Inject some physical adversarial examples to improve single-modal robustness; Intermediate stage: Increase the proportion of adversarial examples and introduce cross-modal constraints; Advanced stage: Training with full adversarial examples, combined with dynamic environmental perturbations to enhance adaptability to complex environments; Dynamic environment simulation: Randomly combine light intensity, weather conditions and sensor noise in the simulation platform to generate diverse training environments.

[0014] Step S7 specifically includes: Collect multimodal adversarial samples in visible light, near infrared, and far infrared; input the collected multimodal adversarial samples into a target detection model that has not been adversarially trained; the adversarial samples mislead the target detector to produce false detections; input the collected multimodal adversarial samples in visible light, near infrared, and far infrared into a target detection model that has been adversarially trained; the target detection model detects the adversarial samples.

[0015] This invention is based on a novel adversarial training framework that treats classification and localization tasks as independent sources of adversarial sample generation. Candidate adversarial samples are generated by maximizing the loss of each task, and the sample that maximizes the total loss is selected for training. This method mitigates gradient conflicts through task-oriented domain constraints while simultaneously covering the multi-task attack surface.

[0016] Both the MTD method and this invention target adversarial robustness in object detection, sharing a core commonality in optimizing the conflict between classification and localization tasks through multi-task adversarial training. MTD generates adversarial examples by separating the classification / localization task domains and selects the sample with the maximum total loss for training, mitigating gradient misalignment. This invention, on the other hand, constructs a triple adversarial space encompassing classification, regression, and joint analysis, introduces dynamic weights to adjust the mixing ratio, adaptively balances task conflicts through an exponential function, and adds a joint optimization path. Both improve multi-task robustness through task decoupling, but this invention is more advanced in its adversarial example generation dimensions and optimization mechanisms.

[0017] The improvements of this invention are reflected in the breadth of technology and application scenarios: (1) In terms of data augmentation, MTD relies on existing data, while this invention innovatively introduces a conditional diffusion model to generate multi-scene, multi-resolution data through text prompts and scale factors, and combines physical domain adaptation to improve data diversity; (2) In terms of defense dimension expansion, this invention breaks through the limitations of the digital domain and proposes differentiable rendering mapping and multimodal (visible light / infrared / LiDAR) collaborative attacks to achieve cross-sensor adversarial training, while MTD only targets single-modal digital attacks; (3) In terms of dynamic design, MTD adopts static sample selection, while this invention uses the Hessian matrix to monitor the gradient condition number to trigger weight reset, forming a closed-loop optimization. In addition, this invention embeds knowledge distillation and dynamic modality selection mechanisms to adapt to complex physical environments such as autonomous driving, while MTD focuses on general detection scenarios. Attached Figure Description

[0018] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of a robust enhancement framework according to an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of a robust enhancement adaptive multi-task learning framework according to an embodiment of the present invention.

[0021] Figure 3 This is a schematic diagram of the multimodal adversarial sample hierarchical training process according to an embodiment of the present invention.

[0022] Figure 4 This is a schematic diagram of multimodal target detection (no target detected) before adversarial training according to an embodiment of the present invention.

[0023] Figure 5 This is a schematic diagram of multimodal target detection (capable of detecting targets) after adversarial training according to an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] This invention addresses the technical bottlenecks faced by target detection models in terms of adversarial robustness (insufficient data diversity, lack of multimodal defense, and static task optimization), proposing a differentiated solution from the MTD method. This solution primarily improves upon the following aspects: (1) Data augmentation: Breaking through the limitations of traditional data augmentation, we use text semantic guidance and scale factor control to generate synthetic multimodal data covering multiple scenarios such as cities and rural areas with precise controllable physical size. We also combine digital-physical domain adaptation technology to reduce the distribution difference between generated data and real sensor data, thus solving the problem of insufficient generalization ability caused by MTD's reliance on limited data.

[0026] (2) Modal alignment: Construct a multimodal defense system, use a differentiable renderer to map digital disturbances into intelligent adversarial texture maps that can be realized in the physical world, and design a multimodal feature alignment mechanism so that adversarial attacks can simultaneously interfere with multimodal sensors such as visible light, near infrared and far infrared, overcoming the limitation of MTD targeting only single-modal digital attacks.

[0027] (3) Reorganization of classification and localization tasks: A dynamic closed-loop optimization mechanism is introduced. By monitoring the gradient conflict between classification and localization tasks, multi-task learning is adaptively balanced. Compared with the static sample selection strategy of MTD, the training efficiency and stability are significantly improved, and the problem of task conflict between classification and localization is solved.

[0028] This invention proposes a robust anti-spoofing enhancement method for multimodal intelligent systems based on diffusion generation and dynamic adversarial training. It addresses the cross-domain generalization and gradient conflict issues in classification and localization tasks between the digital and physical domains through a two-stage collaborative optimization mechanism. Figure 1 As shown.

[0029] Multi-Scene Data Augmentation Driven by Diffusion Model: One of the core innovations of this invention lies in constructing a diffusion generation framework with controllable scene and scale, achieving diverse data augmentation through the deep fusion of semantic guidance and physical constraints. Specifically, based on an improved Stable Diffusion architecture, a pre-trained CLIP text encoder maps scene semantic labels (such as city streets and rural intersections) into high-dimensional conditional vectors, which are then injected into the cross-attention layer of the diffusion model to control the overall scene layout of the generated images. Simultaneously, a finely tuned scale factor parameter is introduced into the latent space, adjusting the actual size of target objects through linear interpolation. For example, it generates pedestrians as small as 0.5 meters or vehicles as large as 5 meters, ensuring that the generated adversarial examples cover multi-scale requirements. Furthermore, to further enhance the physical realism of the generated data, a background-foreground layered synthesis strategy is adopted: first, a background image conforming to scene semantics is generated; then, a segmentation mask is used to overlay foreground targets in a specified area, and the physical size of the generated target objects is constrained by a bounding box size loss function. Finally, the diffusion model is fine-tuned for digital-physical domain adaptation on the real acquisition dataset, and then feature distribution alignment techniques (such as MMD loss) are used to reduce the difference between the generated data and the physical acquisition data, so that the details of the synthetic image, such as illumination and material, are close to the acquisition characteristics of the real sensor.

[0030] To address the gradient conflict problem in object detection between classification and localization tasks, this invention designs a dynamic adversarial example hybrid training mechanism. For example... Figure 2 As shown, this strategy first constructs a three-dimensional adversarial attack space: (1) Classification adversarial examples: By iteratively perturbing the input image, the model's prediction of the target category is made to produce the maximum bias (maximize the classification loss). (2) Regression adversarial examples: focus on regressing the coordinates of the bounding box to interfere with localization loss, such as causing the center point of the predicted box to be severely offset; (3) Joint adversarial examples: Simultaneously optimize classification and localization loss to generate perturbations that simultaneously disrupt the output of multiple tasks.

[0031] Based on this, an exponential hybrid weighting function is proposed. Where t is the number of training steps and k is the decay coefficient, dynamically adjusting the mixing ratio of the three types of adversarial examples. In the initial training phase, joint adversarial examples are the primary focus. Approaching 1), the model's defense against complex attacks is strengthened; as training progresses, the proportion of single-task adversarial samples is gradually increased to alleviate optimization oscillations caused by inconsistent gradient directions. In addition, by monitoring the condition number of the Hessian matrix for classification and localization tasks, a weight reset mechanism is triggered when gradient conflicts exceed a threshold, forming a closed-loop optimization system to ensure the balance of multi-task learning.

[0032] To overcome the limitations of digital adversarial training, this invention proposes a multimodal collaborative defense system oriented towards the physical world. First, a differentiable rendering engine (such as Blender Cycles) is used to convert digital adversarial perturbations into physically realizable texture maps. Through joint optimization of material reflectivity and thermal radiation parameters, physically adversarial samples that maintain attack effectiveness under realistic lighting and viewing angle changes are generated. Second, a cross-modal feature alignment mechanism is designed to force adversarial textures to induce consistent feature shifts in visible light, near-infrared, and far-infrared modes. For example, by constraining the similarity of feature spaces across different sensors through contrastive learning, a collaborative interference effect of multi-modal failure in a single attack is achieved. Figure 3 As shown, a layered and progressive strategy is adopted in the training process: in the initial stage, a small number of physical adversarial examples are injected to focus on improving the robustness of single modality; in the intermediate stage, cross-modal consistency loss is introduced to force the model to mine complementary features; in the advanced stage, dynamic environment simulation (such as random rain, fog, motion blur, and other perturbations generated by Unity engine) is combined to progressively enhance the generalization ability in complex environments. Finally, the full-precision model is compressed into a lightweight version through knowledge distillation, and an online modality selection mechanism is deployed to dynamically switch the dominant modality based on sensor confidence to ensure perception stability under extreme conditions.

[0033] First embodiment: Step S1: Multi-scenario data generation and condition control 1. Scene semantic encoding: Use a pre-trained text encoding model to convert scene labels (such as "city street" or "indoor environment") into semantic vectors, which serve as conditional inputs to the diffusion model.

[0034] 2. Scale factor embedding: Introducing adjustable parameters into the latent space of the diffusion model to control the size of target objects (e.g., small pedestrians or large vehicles) in the generated image.

[0035] 3. Training Conditional Diffusion Model: Based on the improved Stable Diffusion architecture, scene semantic vectors and scale parameters are fused into the generation process to generate synthetic image data with multiple scenes and scales.

[0036] Step S2: Hierarchical Data Synthesis and Realism Enhancement 1. Background-foreground layer generation: First, a background image (such as a city street scene) that conforms to the semantics of the scene is generated. Then, foreground objects (such as vehicles and pedestrians) are superimposed on the specified area through segmentation masks, and their size is adjusted.

[0037] 2. Fine-tuning of physical domain adaptation: The diffusion model is fine-tuned on a real dataset, and feature alignment techniques are used to reduce the distribution difference between synthetic and real data, ensuring the physical authenticity of the generated images.

[0038] Step S3: Dynamic adversarial example generation 1. Construct three types of adversarial examples: Adversarial examples for classification: causing the model to misclassify the target by perturbing the image.

[0039] Adversarial examples in regression: Perturb the image to make the bounding box position predicted by the model deviate significantly from the true value.

[0040] Joint adversarial examples: Simultaneously attack classification and localization tasks to maximize the joint loss of both.

[0041] 2. Adversarial attack parameter settings: A momentum-based iterative attack method is adopted to limit the perturbation amplitude and ensure that the adversarial sample has no obvious visual anomalies.

[0042] Step S4: Adaptive Adversarial Training Strategy 1. Dynamic mixing ratio adjustment: In the early stages of training, joint adversarial examples are used as the main focus. As training progresses, the proportion of classification and regression adversarial examples is gradually increased, and the rate of change of the mixed weights is controlled by an exponential function.

[0043] 2. Task gradient monitoring: Regularly analyze the differences in optimization directions between classification and localization tasks. When there is a significant conflict between the two, reset the hybrid weights to balance task learning.

[0044] Step S5: Construction of multimodal adversarial examples in the physical domain 1. Differentiable rendering transformation: Use 3D rendering tools (such as Blender) to convert digital adversarial perturbations into printable textures in the physical world (such as car body stickers) to simulate attack effects under different lighting and perspectives.

[0045] 2. Cross-modal cooperative attacks: Optimize adversarial textures to interfere with models under various sensors, including visible light, near-infrared, and far-infrared, and ensure the synergy of multimodal attacks through feature alignment.

[0046] Step S6: Layered Progressive Adversarial Training Process 1. Three-Phase Training Protocol: Initial stage: Inject a small number of physical adversarial examples, focusing on improving the robustness of single modes (such as visible light).

[0047] Intermediate stage: Increase the proportion of adversarial examples and introduce cross-modal constraints (such as consistency between infrared and visible light features).

[0048] Advanced stage: Training with full adversarial examples and combining dynamic environmental perturbations (such as rain, fog, motion blur) to enhance adaptability to complex environments.

[0049] 2. Dynamic Environment Simulation: In simulation platforms (such as CARLA), light intensity, weather conditions, and sensor noise are randomly combined to generate diverse training environments.

[0050] Step S7: Example of adversarial target detection: like Figure 4 As shown, the first row is a schematic diagram of the collected multimodal adversarial samples in visible light, near infrared, and far infrared. When the collected multimodal adversarial samples are input into the target detection model that has not been adversarially trained, the second row is a schematic diagram of the adversarial samples misleading the target detector and causing false detections. After the collected multimodal adversarial samples are input into the target detection model that has been adversarially trained again, the target detection model can correctly detect the adversarial samples in the third row, reducing the false detection rate of the model.

[0051] Second embodiment: This invention addresses safety risks in autonomous driving perception by proposing a closed-loop technology system for collaborative attack and defense verification. In the attack verification implementation phase, an adversarial texture pattern with spatial perturbation characteristics is generated using a gradient backpropagation optimization algorithm. This adversarial pattern is then reproduced on the surface of a real vehicle using a micron-level precision inkjet printing process. A virtual test scenario with multiple light source intensities (300-1200 lux) and multiple viewing angles (-45° to +45° yaw angle) is constructed in a simulation platform. Verification shows that adversarial examples can reduce the vehicle detection confidence of the YOLOv3 model to 15% of the baseline value. Using a physical verification device, data from complex conditions such as rain, fog, and backlighting are collected during real-vehicle road tests. Experimental results demonstrate that the false negative rate of adversarially camouflaged targets in the target detection model is extremely high.

[0052] At the implementation level of the defense system, a three-stage enhancement framework is constructed: 1) In the data augmentation stage, a conditional diffusion model is used to generate augmented datasets containing 12 extreme scenarios such as sandstorms and nighttime, and a scale-aware constraint module ensures that the target size error is ≤5%; 2) In the model training stage, a dynamic adversarial trainer is deployed, and a gradient co-optimization mechanism for classification loss and regression loss is established in the Faster R-CNN framework, which can reduce the false detection rate caused by UPC attacks; 3) In the multimodal defense stage, a visible-near-infrared-far-infrared cross-modal feature mapping network is established based on a differentiable renderer, which significantly improves the multimodal fusion detection accuracy compared to monocular vision in rainstorm and nighttime scenarios. In the deployment stage, hierarchical knowledge distillation technology is used to compress the number of model parameters, reduce inference latency, and meet the real-time requirements of autonomous driving.

[0053] After inputting adversarial examples from visible light, near-infrared, and far-infrared into the adversarially trained target detection model, the model can correctly detect the adversarial examples, reducing the false detection rate and false negative rate of the target detector. The schematic diagram is shown below. Figure 4-5 As shown.

[0054] This invention significantly improves the robustness and practicality of target detection models in complex environments through multi-dimensional technological innovation. At the data generation level, the scene-scale controllable generation mechanism based on the conditional diffusion model covers 12 complex scenes, including urban and rural areas, improving scene coverage by 3.2 times compared to traditional GAN ​​methods. Furthermore, the target size control accuracy reaches industry-leading levels (pedestrian size error <5%, vehicle error <3%). Cross-domain detection performance is greatly improved in extreme weather scenarios (such as sandstorms), breaking through the bottlenecks of traditional methods. The dynamic adversarial training strategy ensures the consistency of gradient directions for classification and localization tasks through the construction of a triple adversarial space and adaptive weight adjustment, while reducing the false detection rate against UPC attacks. The physical domain multimodal defense system, utilizing differentiable rendering mapping technology, reduces the success rate of visible light sticker attacks and achieves a defense effect with a false detection rate and false negative rate of less than 10% in visible light, near-infrared, and far-infrared multimodal scenarios. In extreme multimodal failure scenarios (heavy rain + nighttime), the detection accuracy is significantly improved compared to single-modal methods. In terms of lightweight deployment, knowledge distillation is used to compress the number of model parameters, enabling real-time inference on the computing unit. Combined with a dynamic modality selection mechanism, low decision latency is achieved. Overall, the proposed method outperforms traditional methods in key metrics such as adversarial defense rate, multimodal robustness, and training efficiency, providing high-precision, robust, and low-latency perception assurance for high-risk scenarios such as autonomous driving.

[0055] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this invention patent should be determined by the appended claims.

Claims

1. A robust enhancement method for intelligent system defense based on diffusion model and adversarial training, characterized in that, The method includes: Step S1: Generate multi-scenario data and perform condition control; Step S2: Synthesize the hierarchical data and enhance its authenticity; Step S3: Generate dynamic adversarial examples; Step S4: Determine the adaptive adversarial training strategy; Step S5: Construct physical domain multimodal adversarial examples; Step S6: Perform adversarial training in a layered and progressive manner; Step S7: Detect the adversarial target.

2. The robust enhanced intelligent system defense method based on diffusion model and adversarial training according to claim 1, characterized in that, Step S1 specifically includes: Scene semantic encoding: Using a pre-trained text encoding model to convert scene labels into semantic vectors, which serve as conditional inputs to the diffusion model; Scale factor embedding: Introduces an adjustable parameter into the latent space of the diffusion model to control the size of the target object in the generated image; Diffusion model training: Based on the improved Stable Diffusion architecture, scene semantic vectors and scale parameters are fused into the generation process to generate synthetic image data of multiple scenes and scales.

3. The robust enhanced intelligent system defense method based on diffusion model and adversarial training according to claim 2, characterized in that, Step S2 specifically includes: Background-foreground layer generation: Generates a background image that conforms to the semantics of the scene, overlays foreground objects in a specified area using a segmentation mask, and adjusts their size; Physical domain adaptation fine-tuning: The diffusion model is fine-tuned on the real-world dataset. Feature alignment techniques are used to reduce the distribution difference between the synthetic data and the real data, ensuring the physical authenticity of the generated images.

4. The robust enhanced intelligent system defense method based on diffusion model and adversarial training according to claim 3, characterized in that, Step S3 specifically includes: Construct three types of adversarial examples: Adversarial examples for classification: causing the model to misclassify the target by perturbing the image; Adversarial examples in regression: Perturbing the image to make the bounding box position predicted by the model deviate from the true value; Joint adversarial examples: Simultaneously attacking classification and localization tasks to maximize the joint loss of both; Adversarial attack parameter settings: A momentum-based iterative attack method is adopted to limit the perturbation amplitude and ensure that the adversarial sample is visually normal.

5. The robust enhanced intelligent system defense method based on diffusion model and adversarial training according to claim 4, characterized in that, Step S4 specifically includes: Dynamic mixing ratio adjustment: In the initial stage of training, joint adversarial examples are used as the benchmark. As training progresses, the proportion of classification and regression adversarial examples is gradually increased, and the rate of change of the mixing weights is controlled by an exponential function. Task gradient monitoring: Regularly analyze the differences in optimization directions between classification and localization tasks. When the two conflict, reset the hybrid weights to balance task learning.

6. The robust enhanced intelligent system defense method based on diffusion model and adversarial training according to claim 5, characterized in that, Step S5 specifically includes: Differentiable rendering conversion: Using 3D rendering tools, digital adversarial perturbations are converted into printable textures in the physical world to simulate the attack effects under different lighting and perspectives; Cross-modal cooperative attacks: Optimize adversarial textures to achieve interference under multiple sensors based on visible light, near infrared and far infrared, and ensure the cooperativeness of multimodal attacks through feature alignment.

7. A robust enhanced intelligent system defense method based on diffusion model and adversarial training according to claim 6, characterized in that, Step S6 specifically includes: Implement the three-phase training protocol: Initial stage: Inject some physical adversarial examples to improve single-modal robustness; Intermediate stage: Increase the proportion of adversarial examples and introduce cross-modal constraints; Advanced stage: Training with full adversarial examples, combined with dynamic environmental perturbations to enhance adaptability to complex environments; Dynamic environment simulation: Randomly combine light intensity, weather conditions and sensor noise in the simulation platform to generate diverse training environments.

8. A robust enhanced intelligent system defense method based on diffusion model and adversarial training according to claim 7, characterized in that, Step S7 specifically includes: Collect multimodal adversarial samples in visible light, near infrared, and far infrared; input the collected multimodal adversarial samples into a target detection model that has not been adversarially trained; the adversarial samples mislead the target detector to produce false detections; input the collected multimodal adversarial samples in visible light, near infrared, and far infrared into a target detection model that has been adversarially trained; the target detection model detects the adversarial samples.

Images