A robust adversarial camouflage generation method, system, and storage medium for monocular depth estimation in multi-view and complex environments

Abstract

This invention provides a robust adversarial camouflage generation method, system, and storage medium for monocular depth estimation in multi-view and complex environments. The method includes: Step S1, scene data acquisition: acquiring forward image data during vehicle movement; Step S2, adversarial texture rendering; Step S3, multi-view image acquisition: randomly selecting different angles, distances, and bias parameters, obtaining the corresponding camera positions through a transformation function, and using a differentiable renderer to obtain multiple object images with different angles, distances, and offsets, along with corresponding masks; Step S4, complex physical domain environment enhancement; Step S5, adversarial loss: constructing an adversarial loss function; Step S6, multi-view joint optimization. The beneficial effects of this invention are: overcoming the limitations of existing methods for object detection models and their difficulty in directly transferring to regression tasks, achieving robust multi-view adversarial attacks against texture-sensitive models like MDEs in complex physical domains.

Description

Technical Field

[0001] This invention relates to the field of physical adversarial attack technology for computer vision security, and in particular to a multi-view robust adversarial camouflage generation method, system and storage medium for monocular depth estimation in complex environments. Background Technology

[0002] In recent years, physical adversarial camouflage has effectively revealed the vulnerabilities of deep neural networks, especially in the perception modules (object detection, depth estimation, etc.) of autonomous driving systems. Compared with traditional 2D adversarial patches, adversarial camouflage attaches adversarial textures to the surface of target objects, maintaining adversarial behavior across changing viewpoints, thus enabling more covert and robust physical attacks in realistic dynamic environments. However, existing research largely focuses on the implementation of differentiable rendering techniques and the optimization of visual concealment, lacking systematic optimization of gradient conflicts between multiple viewpoints and failing to fully model complex environmental interferences in real-world physical scenes (such as lighting variations, weather effects, motion blur, and sensor noise). This limitation leads to existing methods easily getting trapped in local optima during optimization, resulting in insufficient performance in terms of viewpoint continuity, distance adaptability, and environmental robustness. This makes it difficult to maintain stable attack effects in real-world multi-viewpoint and multi-condition scenarios, restricting its practicality and universality in actual threat scenarios. Therefore, there is an urgent need to construct an adversarial camouflage generation framework that can collaboratively optimize multi-viewpoint consistency and deeply integrate physical environment modeling to improve its attack effectiveness and generalization ability under complex physical conditions.

[0003] Existing adversarial camouflage work mainly focuses on object detection. These methods map adversarial textures to 3D meshes through neural rendering, then capture corresponding 2D car images from different camera positions and embed them into the scene for optimization. Hu et al. developed a highly adversarial and practical adversarial camouflage technique for object detection network models, solving the problem that existing anti-texture patterns cannot support adversarial camouflage from arbitrary angles for devices with surface curvature characteristics. Li et al. proposed a differentiable end-to-end advanced neural renderer and a multi-weather physical enhancement strategy to improve the robustness of adversarial camouflage under different weather conditions. In the field of monocular depth estimation, Chen et al. proposed 3D2Fool, a physically effective 3D texture adversarial camouflage technique. They generated adversarial textures through random texture transformation and physical enhancement methods.

[0004] The shortcomings of existing technology:

[0005] 1. Existing adversarial camouflage techniques primarily target object detection, with very few attacks targeting regression models like MDE. Because MDE models are highly sensitive to texture, direct attack method transfer is ineffective.

[0006] 2. Existing work directly optimizes high-resolution adversarial textures, but this strategy is inefficient and has suboptimal attack effects;

[0007] 3. Existing works using average gradient updates in multi-view joint optimization suffer from gradient conflict issues, resulting in suboptimal performance against adversarial camouflage attacks;

[0008] 4. Existing work does not adequately consider complex environmental conditions. When there is strong local reflection or lens blur, the attack capability is significantly reduced. Summary of the Invention

[0009] To address the problems in existing technologies, this invention provides a robust adversarial camouflage generation method for monocular depth estimation in multi-view scenarios and complex environments, comprising:

[0010] Step S1, Scene Data Acquisition: Acquire forward image data during vehicle movement;

[0011] Step S2, Adversarial texture rendering: Randomly initialize the low-resolution texture of the collected data, sample the low-resolution texture to a high-resolution texture through a progressive upsampling method, generate the transformed 2D texture and map it onto the 3D object, and then obtain the object's view image and mask.

[0012] Step S3, multi-view distance image acquisition: randomly generate different angles, distances and offset parameters, obtain the corresponding camera positions through transformation functions, use a differentiable renderer to obtain multiple object images with different angles, distances and offsets and corresponding binary masks, and then render the object images into the scene image to obtain the adversarial scene image.

[0013] Step S4, Enhancement of Complex Physical Domain Environment: For overexposed and underexposed scenes, a spotlight is simulated as a light source to locally enhance the exposure and darken the target vehicle area, so as to simulate strong light and shadow effects respectively; for local lens blur in weather scenes, a physical scene-based random blur generation mechanism is adopted to simulate local weather effects in space.

[0014] Step S5, Adversarial Loss: Construct an adversarial loss function that includes depth loss and smoothing loss;

[0015] Step S6, multi-view joint optimization: Randomly sort and normalize the gradients of multi-view samples, calculate the correlation between adversarial texture gradients and the actual number of samples under different views, and when significant gradient conflicts are detected, i.e., the negative dot product value is lower than a preset threshold. Then, the normalized gradient is projected onto the direction orthogonal to the conflict gradient to obtain the gradient after conflict elimination. The gradients after processing all views are then averaged to determine the update direction of the joint gradient. The norm of the original average gradient is then used as the magnitude of the joint gradient. Finally, the joint gradient is used to optimize and update the adversarial texture.

[0016] As a further improvement of the present invention, step S1 further includes:

[0017] Step S101: Obtain scene image data of the vehicle in motion: Obtain image data of the camera deployed on the top of the moving vehicle, as well as the internal and external parameters of the camera;

[0018] Step S102, Data preprocessing: Convert the captured scene images into RGB format and adjust their dimensions to the processing dimensions of the target task, ultimately forming a training data set composed of scene images.

[0019] As a further improvement of the present invention, step S2 further includes:

[0020] Step S201, 2D texture initialization: Randomly initialize a low-resolution adversarial texture. , Represent real numbers, h Indicates altitude, w Indicates width;

[0021] Step S202, Progressive texture upsampling: Low-resolution textures are upsampled using a progressive upsampling method. Upsampling to high-resolution textures The specific implementation method is as follows:

[0022] ,

[0023] in, The bilinear weighting based on pixel distance ensures texture continuity and smoothness. It is deconvolution upsampling. It is the kernel size. x,y These are pixel coordinates in a high-resolution image. These are the coordinates of neighboring pixels in a low-resolution image;

[0024] Step S203, 2D Texture Transformation: Using the expectation transformation technique, the data at the texture level is enhanced to generate the transformed 2D adversarial texture. ;

[0025] Step S204, 3D rendering of 2D textures: via a differentiable renderer Map adversarial textures onto the surface of the target 3D model. The parameters in the renderer are used to obtain the vehicle mask. and vehicle images The formula is as follows:

[0026] ,

[0027] in, The image is a rendered vehicle image obtained through a differentiable renderer.

[0028] As a further improvement of the present invention, step S3 specifically includes:

[0029] Randomly generate different perspectives Different distances And the degree of lateral displacement of the vehicle in the scene. Through different Calculate the corresponding camera position Then through a differentiable renderer Get multiple Then Rendered to scene image Image of adversarial scene obtained from :

[0030] .

[0031] As a further improvement of the present invention, in step S4, addressing localized lens blur in the weather scene includes:

[0032] Generates an irregular, organic shape blur within the vehicle mask:

[0033] ,

[0034] in It includes A binary mask with irregular holes.

[0035] ,

[0036] Each hole was originally a circular structure. Its center is located at a random valid pixel. Above, radius is , then connect A circle is generated, and a morphological dilation operation is applied to produce a natural non-polygonal pattern. The complexity parameter is... Controlling the degree of irregularity in shape, Indicates the effective pixel area. Indicates the number of connected circles. It is an expansion operator. This represents the expansion process applied to the initial shape.

[0037] As a further improvement of the present invention, step S5 further includes:

[0038] Step S501, define the depth loss function: construct an adversarial target for depth estimation using the region depth error loss function. This function effectively measures the deviation between the adversarial depth map and the target depth. Defined as:

[0039] ,

[0040] in Indicates the depth of the confrontation. This represents a monocular depth estimation model with parameters. , Indicates the vehicle mask;

[0041] Step S502, define the smoothing loss function: a smoothing regularization term is introduced. This term punishes excessive color changes between adjacent pixels, suppressing high-frequency artifacts and improving the smoothness of texture application. The smoothing loss function... Defined as:

[0042] ,

[0043] in, i,j These are pixel coordinates. It refers to pixels;

[0044] Step S503, Construct the adversarial loss: The overall adversarial loss formula is as follows:

[0045] ,

[0046] in The trade-off between controlling attack effectiveness and texture smoothness.

[0047] As a further improvement of the present invention, step S6 further includes:

[0048] For multiple perspective samples after random shuffling and its corresponding gradient Indicates the first i A combat scenario diagram, in which First, calculate the gradient. and Conflict scores between :

[0049] ,

[0050] in, Then, Projected onto In orthogonal space:

[0051] ,

[0052] in For the first The gradient after the gradient projection. It refers to the first The normalized gradient of each gradient. It refers to the first The normalized gradient of each gradient. As a conflict threshold, projection is only performed when gradients significantly conflict. After all gradients are projected, the gradient is finally optimized. Calculate using the following formula:

[0053] ,

[0054] in, The final normalization direction is scaled using the mean norm of the original gradient. It is a scaling factor, representing the gradient magnitude.

[0055] As a further improvement of the present invention, in step S1, the acquired image data includes image data of the real physical world acquired through real physical vehicles, and image data of the simulated world acquired through a simulation platform.

[0056] The present invention also discloses a multi-view and complex environment robust adversarial camouflage generation system for monocular depth estimation, comprising: a memory, a processor, and a computer program stored in the memory, the computer program being configured to implement the steps of the method described in the present invention when invoked by the processor.

[0057] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0058] The beneficial effects of this invention are: 1. Effectively expands the application scenarios of adversarial attacks: The method of this invention is specifically designed for monocular depth estimation models, overcoming the limitations of existing methods that are mainly aimed at target detection models and difficult to directly transfer to regression tasks. It achieves robust adversarial attacks from multiple perspectives in complex physical domains of texture-sensitive models such as MDEs; 2. Significantly improves optimization efficiency and attack performance: The method of this invention can significantly reduce computational overhead while ensuring attack effectiveness, thereby achieving better attack performance; 3. Effectively alleviates gradient conflicts from multiple perspectives: This invention proposes a multi-view stochastic gradient correction method, which can effectively alleviate gradient conflicts between different perspectives, thereby generating adversarial camouflage with stronger consistency and better attack performance; 4. Enhances attack robustness in complex environments: The method of this invention specifically considers complex interference factors in the real world (such as local strong reflections and lens blur), significantly improving the attack effectiveness of the generated adversarial camouflage under harsh or dynamic conditions, ensuring its practicality in real-world scenarios. Attached Figure Description

[0059] Figure 1 This is a flowchart of the anti-camouflage generation method of the present invention. Detailed Implementation

[0060] like Figure 1 As shown, this invention discloses a robust adversarial camouflage generation method for monocular depth estimation in multi-view and complex environments, comprising:

[0061] Step S1, Scene Data Acquisition: Acquire forward image data of the vehicle during its driving process through real physical scenes and simulation platforms.

[0062] Step S101: Acquire scene image data of the vehicle in motion. Specifically, this requires acquiring image data from a camera deployed on the top of the moving vehicle, as well as the camera's internal and external parameters. This process can acquire image data from the real physical world using a real physical vehicle, or it can acquire image data from a simulated world using a simulation platform (such as CARLA).

[0063] Step S102, Data Preprocessing: Convert the captured scene images into RGB format and adjust their dimensions to match the processing dimensions of the target task (taking a typical monocular depth estimation task as an example, the images are adjusted to...). This ultimately forms a training dataset consisting of scene images. .

[0064] Step S2, Adversarial Texture Rendering: Randomly initialize the low-resolution texture of the collected data, sample the low-resolution texture to a high-resolution texture through a progressive upsampling method, generate the transformed 2D texture and map it onto the 3D object, and obtain the object's view image and mask.

[0065] Step S201, 2D texture initialization: Randomly initialize a low-resolution adversarial texture. (For example: This reduces the number of optimization parameters and improves computational efficiency. Represent real numbers, h Indicates altitude, w Indicates the width.

[0066] Step S202, Progressive Texture Upsampling: Since 3D rendering requires high-resolution images for texture mapping, simple upsampling can easily disrupt texture continuity. This case uses a progressive upsampling method to upsample low-resolution textures. Upsampling to high-resolution textures (For example: The specific implementation method is as follows:

[0067] ,

[0068] in, Bilinear weights based on pixel distance ensure texture continuity and smoothness. It is deconvolution upsampling. It is the kernel size. x,y These are pixel coordinates in a high-resolution image. These are the coordinates of neighboring pixels in a low-resolution image.

[0069] Step S203, 2D Texture Transformation: The Expectation Transform (EoT) technique is introduced for texture-level data augmentation. It primarily simulates physical disturbances such as printing color differences, lighting variations, dynamic shadows, and partial occlusion, improving the robustness of adversarial textures in practical deployments. The transformed 2D adversarial texture is then generated. .

[0070] Step S204, 3D rendering of 2D textures: via a differentiable renderer Map adversarial textures onto the surface of the target 3D model. By using the parameters in the renderer, the vehicle mask can be obtained. and vehicle images The formula is as follows:

[0071] ,

[0072] in, Through a differentiable renderer The resulting rendered image of the vehicle.

[0073] Step S3, multi-view distance image acquisition: Randomly generate different angles, distances and offset parameters, obtain the corresponding camera positions through transformation functions, use a differentiable renderer to obtain multiple object images with different angles, distances and offsets and their corresponding binary masks, and then render the object images into the scene images to obtain adversarial scene images.

[0074] To ensure the robustness of anti-camouflage vehicles across different viewpoints and distances, collaborative optimization is performed using randomly generated vehicle images from various viewpoints and distances during training. Specifically, we randomly generate different viewpoints... Different distances And the degree of lateral displacement of the vehicle in the scene. Through different Calculate the corresponding camera position Then through a differentiable renderer Multiple Then Rendered to scene image Image of adversarial scene obtained from :

[0075] .

[0076] Step S4, Enhancement of Complex Physical Domain Environment:

[0077] Step S401: For overexposed and underexposed scenes, simulate a spotlight as a light source and perform local exposure enhancement and darkening processing on the target vehicle area to simulate strong light and shadow effects respectively, rather than simply adjusting the global brightness of a random triangular area.

[0078] Step S402: To address localized lens blur in weather scenes, a physically based random blur generation mechanism is proposed to simulate localized spatial weather effects (such as partial cloud shadows and lens water droplets). Specifically, we generate irregularly shaped organic blurs within the vehicle mask (vehicle mask):

[0079] ,

[0080] in It includes A binary mask with irregular holes.

[0081] ,

[0082] Each hole was originally a circular structure. Its center is located at a random valid pixel. Above, radius is Then connect A smaller circle is generated, and a morphological dilation operation is applied to produce a natural non-polygonal pattern. Complexity parameter Controlling the degree of irregularity in shape, Indicates the effective pixel area. Indicates the number of connected circles. It is an expansion operator. This represents the expansion process applied to the initial shape, with the aim of smoothing out the originally rigid connections between circles, thus generating a "non-polygonal" organic shape.

[0083] Step S5, Adversarial Loss: Construct adversarial loss functions, including depth loss and smoothing loss.

[0084] Step S501, Depth Loss: This case uses a monocular depth estimation model as an example. The adversarial objective aims to increase the depth estimation distance of the camouflaged vehicle, thereby causing a collision. We construct the adversarial objective for depth estimation using a region depth error loss function, which effectively measures the deviation between the adversarial depth map and the target depth. Adversarial Depth Loss Function Defined as:

[0085] ,

[0086] in Indicates the depth of the confrontation. It's a vehicle mask.

[0087] Step S502, Smoothing Loss: To enhance the physical plausibility and visual naturalness of the generated camouflage pattern, this case introduces a smoothing regularization term. This term effectively suppresses high-frequency artifacts and improves the smoothness of texture application by penalizing excessive color changes between adjacent pixels. Smoothing Loss Function Defined as:

[0088] ,

[0089] in, i,j These are pixel coordinates. It refers to pixels;

[0090] Step S503, Countermeasure Loss: The overall countermeasure loss formula is as follows:

[0091] ,

[0092] in The trade-off between controlling attack effectiveness and texture smoothness.

[0093] Step S6, Multi-view Joint Optimization; Multi-view joint optimization can lead to gradient conflict issues. This case proposes a multi-view stochastic gradient correction method. This method first randomly sorts the gradients of a batch of multi-view samples, and then projects the normalized gradients onto a direction orthogonal to the conflicting gradients to obtain the gradients after conflict resolution. Finally, it averages the gradients processed from all views. We first determine the update direction of the joint gradient, and then use the norm of the original average gradient (the average gradient of all gradients before conflict) as the magnitude of the joint gradient. Specifically, the formal expression of this method is as follows: Normalize all gradients of the randomly shuffled multi-view samples, and then calculate the correlation between the adversarial texture gradient and the actual number of samples under different views. When a significant conflict is detected (i.e., the negative dot product value is lower than a preset threshold), the algorithm returns the gradient to the nearest even value. At time ( ), the normalized gradient is projected onto a direction orthogonal to the conflict gradient to obtain the gradient after conflict resolution, and then the gradients after processing all viewpoints are averaged. We first determine the update direction of the joint gradient, and then use the norm of the original average gradient (the average gradient of all gradients before conflict) as the magnitude of the joint gradient. Specifically, the formal expression of this method is as follows: For multiple viewpoint samples after random shuffling and its corresponding gradient , Indicates the first i A combat scenario diagram, in which This method first calculates the gradient. and Conflict scores between :

[0094] ,

[0095] in, Then we will Projected onto In orthogonal space:

[0096] ,

[0097] in For the first The gradient after the gradient projection. It refers to the first The normalized gradient of each gradient. It refers to the first The normalized gradient of each gradient. As a conflict threshold, projection is only performed when gradients significantly conflict. After all gradients are projected, the gradient is finally optimized. Calculate using the following formula:

[0098] ,

[0099] in, The final normalization direction is scaled using the mean norm of the original gradient. This is a scaling factor, representing the gradient magnitude. The final gradient retains effective information from each viewpoint while avoiding direct conflicts between them, thus improving the performance and stability of multi-view learning.

[0100] The present invention also discloses a multi-view and complex environment robust adversarial camouflage generation system for monocular depth estimation, comprising: a memory, a processor, and a computer program stored in the memory, the computer program being configured to implement the steps of the method described in the present invention when invoked by the processor.

[0101] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0102] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A robust adversarial camouflage generation method for monocular depth estimation in multi-view and complex environments, characterized in that, include: Step S1, Scene Data Acquisition: Acquire forward image data during vehicle movement; Step S2, Adversarial texture rendering: Randomly initialize the low-resolution texture of the collected data, sample the low-resolution texture to a high-resolution texture through a progressive upsampling method, generate the transformed 2D texture and map it onto the 3D object, and then obtain the object's view image and mask. Step S3, multi-view distance image acquisition: randomly generate different angles, distances and offset parameters, obtain the corresponding camera positions through transformation functions, use a differentiable renderer to obtain multiple object images with different angles, distances and offsets and corresponding binary masks, and then render the object images into the scene image to obtain the adversarial scene image. Step S4, Enhancement of Complex Physical Domain Environment: For overexposed and underexposed scenes, a spotlight is simulated as a light source to locally enhance the exposure and darken the target vehicle area, so as to simulate strong light and shadow effects respectively; for local lens blur in weather scenes, a physical scene-based random blur generation mechanism is adopted to simulate local weather effects in space. Step S5, Adversarial Loss: Construct an adversarial loss function that includes depth loss and smoothing loss; Step S6, multi-view joint optimization: Randomly sort and normalize the gradients of multi-view samples, calculate the correlation between adversarial texture gradients and the actual number of samples under different views, and when significant gradient conflicts are detected, i.e., the negative dot product value is lower than a preset threshold. Then, the normalized gradient is projected onto the direction orthogonal to the conflict gradient to obtain the gradient after conflict elimination. The gradients after processing all views are then averaged to determine the update direction of the joint gradient. The norm of the original average gradient is then used as the magnitude of the joint gradient. Finally, the joint gradient is used to optimize and update the adversarial texture.

2. The anti-camouflage generation method according to claim 1, characterized in that, Step S1 further includes: Step S101: Obtain scene image data of the vehicle in motion: Obtain image data of the camera deployed on the top of the moving vehicle, as well as the internal and external parameters of the camera; Step S102, Data preprocessing: Convert the captured scene images into RGB format and adjust their dimensions to the processing dimensions of the target task, ultimately forming a training data set composed of scene images.

3. The anti-camouflage generation method according to claim 1, characterized in that, Step S2 further includes: Step S201, 2D texture initialization: Randomly initialize a low-resolution adversarial texture. Represent real numbers, h Indicates altitude, w Indicates width; Step S202, Progressive texture upsampling: The low-resolution texture is upsampled to a high-resolution texture using a progressive upsampling method. The specific implementation is as follows: ， in, The bilinear weighting based on pixel distance ensures texture continuity and smoothness. It is deconvolution upsampling. It is the kernel size. x,y These are pixel coordinates in a high-resolution image. These are the coordinates of neighboring pixels in a low-resolution image. i , j These are pixel coordinates; Step S203, 2D Texture Transformation: Using the expectation transformation technique, the data at the texture level is enhanced to generate the transformed 2D adversarial texture. ; Step S204, 3D rendering of 2D textures: via a differentiable renderer Map adversarial textures onto the surface of the target 3D model. The parameters in the renderer are used to obtain the vehicle mask. and vehicle images The formula is as follows: ， in, The image is a rendered vehicle image obtained through a differentiable renderer.

4. The anti-camouflage generation method according to claim 1, characterized in that, Step S3 specifically includes: Randomly generate different perspectives Different distances And the degree of lateral displacement of the vehicle in the scene. Through different Calculate the corresponding camera position Then through a differentiable renderer Get multiple Then Rendered to scene image Image of adversarial scene obtained from : 。 5. The anti-camouflage generation method according to claim 1, characterized in that, In step S4, addressing localized lens blur in the weather scene includes: Generates an irregular, organic shape blur within the vehicle mask: ， in It includes A binary mask with irregular holes. ， Each hole was originally a circular structure. Its center is located at a random valid pixel. Above, radius is , then connect A circle is generated, and a morphological dilation operation is applied to produce a natural non-polygonal pattern. The complexity parameter is... Controlling the degree of irregularity in shape, Indicates the effective pixel area. Indicates the number of connected circles. It is an expansion operator. This represents the expansion process applied to the initial shape.

6. The anti-camouflage generation method according to claim 1, characterized in that, Step S5 further includes: Step S501, define the depth loss function: construct an adversarial target for depth estimation using the regional depth error loss function. This function effectively measures the deviation between the adversarial depth map and the target depth. Defined as: ， in Indicates the depth of the confrontation. Indicates parameters Monocular depth estimation model , Indicates the vehicle mask. i , j These are pixel coordinates; Step S502, define the smoothing loss function: a smoothing regularization term is introduced. This term punishes excessive color changes between adjacent pixels, suppressing high-frequency artifacts and improving the smoothness of texture application. The smoothing loss function... Defined as: ， in, i,j These are pixel coordinates. It refers to pixels; Step S503, Construct the adversarial loss: The overall adversarial loss formula is as follows: ， in The trade-off between controlling attack effectiveness and texture smoothness.

7. The anti-camouflage generation method according to claim 1, characterized in that, Step S6 further includes: For multiple perspective samples after random shuffling and its corresponding gradient , Indicates the first i A combat scenario diagram, in which First, calculate the gradient. and Conflict scores between : ， in, This indicates a low-resolution texture. Then, Projected onto In orthogonal space: ， in For the first After projecting the gradient, we need the gradient. It refers to the first The normalized gradient of each gradient. It refers to the first The normalized gradient of each gradient. As a conflict threshold, projection is only performed when gradients significantly conflict. After all gradients are projected, the gradient is finally optimized. Calculate using the following formula: ， in, The final normalization direction is scaled using the mean norm of the original gradient. It is a scaling factor, representing the gradient magnitude.

8. The anti-camouflage generation method according to claim 1, characterized in that, In step S1, the acquired image data includes image data of the real physical world acquired through real physical vehicles, and image data of the simulated world acquired through a simulation platform.

9. A robust adversarial camouflage generation system for monocular depth estimation in multi-view and complex environments, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method of any one of claims 1-8 when invoked by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-8 when invoked by a processor.

Images