Method for improving robustness of agricultural image segmentation neural network

Abstract

The invention provides a method for improving robustness of an agricultural image segmentation neural network, and belongs to the technical field of agricultural information. According to the characteristics of a plant leaf disease segmentation task, two targeted attack resisting methods and corresponding defense strategies are provided. Gradient-guided Gaussian disturbance attacks are provided, sensitive area mapping is generated based on gradient absolute values, Gaussian kernel smoothing and iterative optimization are combined, and the segmentation result of a damaged disease area is accurate while disturbance visual naturalness is guaranteed. The effectiveness of two attacks is verified on a public data set, under the disturbance constraint which is difficult to perceive by human eyes, six typical plant leaf disease image segmentation models can show vulnerabilities of different degrees to the countermeasure attacks, and the error segmentation rate of a disease area is remarkably improved. Besides, through a joint training strategy of an original sample and an adversarial sample, the anti-interference capability of the model is successfully improved, and the performance reduction amplitude caused by the adversarial attack is successfully reduced while the original segmentation precision is maintained.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of agricultural information technology, and particularly relates to a method for improving the robustness of an agricultural image segmentation neural network. BACKGROUND

[0002] Precision agriculture is the core support for food security and the improvement of agricultural production efficiency, and the early accurate identification and segmentation of plant diseases is a key prerequisite for disease prevention and control. Plant leaf disease segmentation aims to accurately extract pixel-level information of disease areas from complex backgrounds, providing data support for disease severity assessment, disease mechanism analysis, and pesticide application decision-making. Traditional image segmentation methods rely on manually designed features such as color thresholding and texture features. However, plant leaves have differences in varieties, changes in lighting, and irregular disease morphology, which leads to weak generalization ability and limited segmentation accuracy of these methods, making it difficult to meet the actual production needs.

[0003] With the development of deep learning technology, semantic segmentation models based on convolutional neural networks (CNN), such as U-Net and DeepLab series, have shown significant advantages in plant leaf disease segmentation tasks. These models automatically learn discriminative features of disease areas through end-to-end training, effectively overcoming the limitations of traditional methods, and achieving high-precision segmentation on multiple public datasets. Currently, disease segmentation models based on deep learning have gradually landed in practical scenarios and become a core component of intelligent precision agriculture equipment. However, existing researches mostly focus on improving the segmentation performance of models on original samples, ignoring their adversarial robustness, i.e., the stability of models when subjected to minor malicious perturbations.

[0004] Since Goodfellow et al. proposed the concept of adversarial samples, the adversarial vulnerability of deep neural networks has been widely verified in computer vision tasks such as image classification and object detection. In recent years, some researches have begun to focus on adversarial attacks and defenses in semantic segmentation tasks, but these works mostly target general scenarios and do not fully consider the uniqueness of plant leaf disease segmentation. On the one hand, disease areas often have irregular edges and fuzzy boundaries, with small differences in pixels from healthy leaf tissues. On the other hand, adversarial perturbations in practical applications need to meet the requirement of visual imperceptibility, otherwise they cannot constitute an effective threat. Therefore, general attack methods cannot precisely focus on sensitive features of disease areas, and the attack efficiency and stealthiness are insufficient. At the same time, adversarial defense strategies for this specific task have not been systematically studied, which poses potential risks to the practical deployment of models.

[0005] At present, there is no research on the adversarial robustness of plant leaf disease segmentation model, and the applicability of existing general attack and defense methods in this task is still unclear. Considering that the disease segmentation result directly affects the accuracy of subsequent disease control decision, the adversarial vulnerability of the model may lead to serious consequences such as false segmentation of disease area, excessive pesticide application or delayed prevention and control. SUMMARY

[0006] The purpose of the present application is to provide a method for improving the robustness of agricultural image segmentation neural network, which systematically studies the adversarial attack and defense methods for the task characteristics of plant leaf disease segmentation. Two targeted attack strategies are designed to achieve hidden and efficient performance destruction. At the same time, the corresponding defense scheme is proposed to improve the anti-interference ability of the model.

[0007] In order to achieve the above purpose, the technical scheme adopted by the present application is:

[0008] A method for improving the robustness of agricultural image segmentation neural network, which introduces gradient guided Gaussian perturbation attack (GGPA) in plant leaf disease image segmentation model (PLDIS), focuses on segmentation task loss and locates gradient sensitive area, combines Gaussian kernel smoothing and iterative optimization, and accurately destroys the segmentation result of disease area while ensuring the visual nature of perturbation; meanwhile, a joint training defense strategy based on original samples and adversarial samples is designed, which effectively improves the resistance of the model to the two attack methods without significantly losing the original segmentation accuracy.

[0009] As a preferred technical scheme of the present application, the method for improving the robustness of agricultural image segmentation neural network is defined as follows:

[0010] Let the original plant leaf image be , where H and W are the height and width of the image respectively, and the corresponding disease segmentation label is , the goal of adversarial attack is to generate a small perturbation such that the adversarial sample satisfies:

[0011] Visual imperceptibility: the amplitude of adversarial perturbation is constrained by , that is, , The value of directly determines the maximum allowed perturbation amplitude of each pixel of the image;

[0012] Attack effectiveness: the deviation of the segmentation result f(x) of the segmentation model f(·) for the original image x from the true label y is significantly increased, and the missegmentation rate of the disease area is improved;

[0013] Task adaptability: focus on disease area and edge, avoid invalid disturbance on background area, meet the core demand of disease segmentation pixel-level semantic extraction.

[0014] As a preferred technical solution of the application, the gradient guided gaussian perturbation attack (GGPA) generates perturbations that focus on sensitive areas while simulating natural interference through the core architecture of sensitive area gradient mapping, gaussian smooth noise generation and iterative direction memory, the steps are as follows:

[0015] First, calculate the gradient of the segmentation loss on the image, generate the sensitive area mapping by taking the absolute value of the gradient and normalizing , and then introduce the sensitive area enhancement coefficient , get ; if there is no effective area in the initial mapping, select the high sensitive pixel to generate the sensitive area mask (M); secondly, generate gaussian smooth noise and fused perturbation; design a two-dimensional gaussian kernel (G) to simulate the spatial continuity of non-uniform illumination in agricultural scenes, and perform convolution on the basic gaussian noise to get the smooth noise , and generate a low-intensity random noise at the same time; weight by the sensitive area mask M, and combine the gradient scale to fuse , wherein balances the focus intensity of the sensitive area and the overall naturalness, and solves the problem of insufficient pertinence or poor naturalness of general gaussian attack; finally, iterative direction memory and constraint optimization; introduce the direction memory mechanism to retain the historical gradient direction to update the current perturbation direction, avoid the cancellation of perturbation in multiple iterations, and enhance the attack stability; the perturbation generated in each round is constrained by to realize norm constraint, which strictly ensures that the perturbation is difficult for the human eye to detect; after T iterations, the output adversarial sample is continuously optimized by gradient guidance and gaussian smoothing, so that the perturbation accurately acts on the sensitive area of the lesion, while simulating the characteristics of natural interference; the definition of the overall attack process of GGPA is represented by formulas (3-6):

[0016]

[0017]

[0018]

[0019]

[0020] wherein, is the gradient of the L1 loss on the image; is the basic gaussian noise; This is a normalization operation; M is a binary sensitive region mask; Low-intensity noise; β represents the direction of the perturbation with memory; β is the gradient-guided weight. This is the upper limit threshold for the disturbance. This is a pointwise convolution.

[0021] As a preferred embodiment of the present invention, the adversarial defense steps of the PLDI model are as follows:

[0022] A defense approach employing joint training with original samples and adversarial samples integrates adversarial samples into the regular training process. Through a min-max optimization process, the model finds the optimal solution between fitting the original samples and resisting adversarial perturbations. Adversarial training (AT) is represented as the following optimization problem:

[0023]

[0024] in, Segmentation model for plant leaf diseases Parameters; This indicates sampling from the joint data distribution of plant leaf disease images and segmentation labels; It is to counter disturbances of Norm constraints ensure that perturbations are visually imperceptible; This is the adversarial training loss function, used to quantify the model's performance on adversarial examples. The deviation between the segmentation results and the true label y; its mini-maximization structure characterizes the relationship between maximizing the loss to destroy the model through adversarial attacks and minimizing the loss to enhance the robustness of the model through adversarial training;

[0025] During the adversarial training phase, follow this paradigm:

[0026]

[0027] in, For balance coefficient, The loss of the model on the original samples, This represents the model's loss on adversarial examples;

[0028] Due to adversarial examples Shares the truth label y with the original sample x. Adopted and The same composite loss form ensures consistency in the optimization objective:

[0029]

[0030] Where a and b are hyperparameters;

[0031] Through the aforementioned min-max optimization and adversarial training mechanism, the PLDI model can learn the distribution patterns of adversarial perturbations while learning the characteristics of normal diseases. Ultimately, this enables the PLDI model to maintain stable segmentation performance on both original and adversarial samples, providing robust assurance for the accurate identification of plant leaf diseases.

[0032] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] 1. This study is the first to systematically investigate the adversarial robustness of plant leaf disease segmentation models, revealing the adversarial vulnerability of mainstream segmentation models in this task and filling a gap in existing research in the field of agricultural computer vision.

[0034] 2. A task-specific adversarial attack method is proposed. Gradient-guided Gaussian perturbation attack (GGPA) accurately disrupts the segmentation results of diseased areas by focusing on the segmentation task loss and locating gradient-sensitive regions, while ensuring the visual naturalness of the perturbation.

[0035] 3. Design a joint training defense strategy based on original samples and adversarial samples to effectively improve the model's resistance to two attack methods without significantly losing the original segmentation accuracy.

[0036] 4. On the two public datasets ATLDSD and RLDSD, six mainstream segmentation models were comprehensively evaluated, verifying the effectiveness of the proposed attack method and the practicality of the defense strategy, and providing technical support for the robustness optimization of disease segmentation models. Attached Figure Description

[0037] Figure 1 This forms the overall framework of the invention. In Figure (a), the adversarial example X... adv This causes the model f(·) to output results that do not meet expectations. In the defense strategy of this invention, the defense-optimized model fd(·) effectively resists this attack shown in Figure (b). Figure (c) illustrates how adversarial examples are generated, using the ground truth y and adversarial interference. Construction complete. In the defense process shown in Figure (d), the original sample X and the adversarial example X... adv All of these are used to update network parameters θ, thereby helping fd(·) gain the ability to resist attacks.

[0038] Figure 2 Visual contrast for segmentation on the ATLDSD dataset for adversarial attacks. For each row, the images from left to right are: original input, adversarial example, original output, adversarial output of the VM-UNet model, and ground truth.

[0039] Figure 3 Visual contrast for segmentation on the RLDSD dataset to counter adversarial attacks. For each row, the images from left to right are: original input, adversarial example, original output, adversarial output of the VM-UNet model, and ground truth.

[0040] Figure 4 Quantitative results for adversarial training on the ATLDSD and RLDSD datasets. Each column shows the model's Dice (top) and mIoU (bottom). AT represents the model trained adversarially, and NT represents the model not trained adversarially.

[0041] Figure 5 This is the visual result of adversarial training. For each row, the images are: original input, adversarial example, VM-UNet model output, adversarial attack result, VM-UNet defense output, and ground truth. AT (·) represents a VM-UNet model trained adversarially.

[0042] Figure 6 This is the visual result of adversarial training. For each row, the images are: original input, adversarial example, VM-UNet model output, adversarial attack result, VM-UNet defense output, and ground truth. AT (·) represents a VM-UNet model trained adversarially. Detailed Implementation

[0043] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings.

[0044] Example 1

[0045] This invention proposes a method to improve the robustness of neural networks for agricultural image segmentation. The following sections will elaborate on this method from the perspectives of plant leaf disease image segmentation models, adversarial attacks, adversarial defenses, and the adversarial robustness of the PLDIS method.

[0046] 1.1 Learning-based image segmentation model for plant leaf diseases

[0047] Plant leaf disease image segmentation (PLDIS) is a core underlying computer vision task in precision agriculture. Its core objective is to achieve pixel-level precise localization and contour delineation of diseased areas, providing crucial pixel-level data support for decision-making such as disease area segmentation, severity quantification, and precision pesticide application in the field. In recent years, deep learning-based PLDIS models have achieved significant breakthroughs in segmentation accuracy and generalization due to their powerful feature learning capabilities, becoming a research hotspot in this field.

[0048] Although numerous studies have continuously driven the development of the PLDIS method and achieved satisfactory segmentation results in the original sample scenario, the adversarial robustness of the plant leaf disease segmentation model has not been fully discussed, and the impact of malicious adversarial perturbations on the actual deployment security of the model remains a research gap.

[0049] 1.2 Counter-attacks

[0050] Despite the significant success of deep neural networks (DNNs) in many fields, their vulnerability to adversarial examples severely hinders their application in safety-critical domains. Plant leaf disease segmentation is one such domain. While existing adversarial attack methods have achieved some success in general semantic segmentation scenarios, they still exhibit significant adaptability gaps in plant leaf disease segmentation tasks. Research on adversarial attacks specifically targeting plant leaf disease segmentation models has not yet been conducted, and the effectiveness and applicability of general attack methods in this particular task remain unclear.

[0051] 1.3 Countermeasures and Defense

[0052] The core objective of adversarial defense is to improve the decision-making stability of deep neural networks under adversarial examples. This is achieved by optimizing model structure, training strategies, or input preprocessing to reduce the impact of malicious perturbations on model performance and ensure the reliability of system deployment. For semantic segmentation tasks, adversarial defense needs to balance pixel-level segmentation accuracy and robustness, avoiding issues such as blurred lesion edges or missed detection of small lesions caused by the defense mechanism. Therefore, it is more challenging than defense for classification tasks. However, traditional adversarial training uses the PGD strategy, which directly transfers knowledge from classification tasks, but fails to fully consider the pixel-level characteristics of segmentation tasks, resulting in a significant decrease in the segmentation accuracy of the original samples after defense.

[0053] 1.4. Robustness of the PLDIS method against adversarial forces

[0054] Let the original plant leaf image be... (H and W represent the image height and width, respectively), and the corresponding disease segmentation annotations are as follows: The goal of counter-attacks is to generate tiny perturbations. Make the adversarial examples satisfy:

[0055] Visual imperceptibility: counteracting disturbances The amplitude is affected Constraints, i.e. , The value of directly determines the maximum permissible perturbation amplitude for each pixel in the image.

[0056] Attack effectiveness: The segmentation model f(·) significantly increases the deviation between the segmentation result f(x) of the original image x and the true annotation y, and the missegmentation rate of the diseased area is improved.

[0057] Task adaptability: The perturbation focuses on the diseased area and its edges, avoiding ineffective perturbation of the background area, which meets the core requirement of pixel-level semantic extraction of disease segmentation.

[0058] The overall concept of this invention is as follows: Figure 1 As shown. During the attack phase ( Figure 1 (a) will Figure 1 (c) The adversarial examples generated through adversarial attacks are input into the Plant Leaf Disease Segmentation (PLDIS) model, causing the model to output results with reduced segmentation performance. This is aimed at... Figure 1 (b) The two types of adversarial attack threats proposed in this invention are addressed through... Figure 1 (d) The optimized training of the proposed defense strategy can enable the PLDIS model to have robust anti-interference capabilities and effectively resist the damage to segmentation accuracy caused by the above adversarial attacks.

[0059] 1.4.1 Gradient-guided Gaussian perturbation attacks (GGPA)

[0060] Plant leaf disease segmentation faces the dual challenges of complex background interference and non-uniform lighting, making it easy for models to misclassify background areas as lesions or miss interfered lesions. General Gaussian attacks have a uniform noise distribution, making it difficult to focus on key lesion regions, and single-step perturbations lack iterative optimization, resulting in insufficient attack targeting and an inability to balance naturalness and aggressiveness, thus limiting their practicality in real-world field scenarios. To address this, this invention proposes Gradient-Guided Gaussian Perturbation Attack (GGPA). Through a core architecture of sensitive area gradient mapping, Gaussian smoothed noise generation, and iterative direction memory, the perturbation accurately focuses on sensitive lesion regions while simulating natural interference, efficiently disrupting segmentation performance while maintaining visual concealment.

[0061] Specifically, the first step is sensitive region gradient mapping and enhancement. The gradient of the segmentation loss with respect to the image is calculated, and the sensitive region mapping is generated by taking the absolute value of the gradient and normalizing it. Then, the sensitive region enhancement coefficient is introduced. get To address the issue of blurred sensitive area identification in complex backgrounds, this method accurately locates key areas of lesions. If the initial mapping lacks an effective area, highly sensitive pixels are selected to forcibly generate a sensitive area mask (M), providing precise guidance for subsequent perturbation focusing. Secondly, Gaussian smoothed noise and fused perturbations are generated. A two-dimensional Gaussian kernel (G) is designed to simulate the spatial continuity of non-uniform illumination in agricultural scenes, and the basic Gaussian noise is then processed. Convolution is used to smooth the noise. At the same time, low-intensity random noise is generated. By using the sensitive area mask M to... Weighted, and combined with gradient scaling Fusion ,in To balance the focus intensity of sensitive areas with overall naturalness, this addresses the issues of insufficient targeting or poor naturalness in general Gaussian attacks. Finally, iterative direction memory and constraint optimization are implemented. A direction memory mechanism is introduced to retain historical gradient directions for updating the current perturbation direction, preventing perturbation cancellation in multiple iterations and enhancing attack stability. The perturbation generated in each round... pass accomplish Norm constraints are strictly enforced to ensure that the perturbation is imperceptible to the human eye. After T iterations, the output adversarial example is continuously optimized through gradient guidance and Gaussian smoothing to ensure that the perturbation is precisely applied to the lesion-sensitive area, while simulating the characteristics of natural interference. The overall GGPA attack process is defined by formula (3-6):

[0062]

[0063]

[0064]

[0065]

[0066] In order to amplify the pixel-level prediction bias of the model under natural interference, this invention maximizes the L1 distance between the adversarial output and the ground truth. The gradient of the image is given by the L1 loss function. It is based on Gaussian noise. This is a normalization operation. M is a binary sensitive region mask. It is low-intensity noise. The direction of the perturbation is denoted by β. β represents the gradient-guided weight. This represents the upper limit threshold for the disturbance. This is a pointwise convolution.

[0067] The algorithm steps of gradient-guided Gaussian perturbation attack (GGPA) are as follows:

[0068] Input: Segmentation model A batch of clean images shape( ), corresponding real label mask Attack parameters: Gaussian kernel size K, standard deviation Maximum disturbance amplitude Gradient scaling factor β, enhancement factor (For sensitivity map enhancement), iteration count T.

[0069] Output: Adversarial Examples .

[0070] ①: Generate Gaussian kernel The generating formula is Normalize G (summing to 1) and reshape it to The shape.

[0071] ②: Initialize the direction variables from the previous round:

[0072] ③: Calculate the gradient of the loss function with respect to the input image. .

[0073] ④: Regarding the number of iterations Perform the following operations:

[0074] Derivation of the sensitivity map S: Normalization of the absolute value of the gradient. Enhance the sensitivity map through exponentiation. (Normalization to interval) / / Zoom in on highly sensitive areas

[0075] Generate a sensitive mask:

[0076] Generate basic noise: shape Set gradient direction .

[0077] Based on historical information update trends:

[0078] when , ;

[0079] .

[0080] Generate smooth noise: .

[0081] Generate small noise: shape .

[0082] Calculate guided disturbance .

[0083] Clipping disturbance amplitude: .

[0084] Generate adversarial examples: .

[0085] / / Ensure that the pixel value is within the valid range (0-1).

[0086] ⑤: End the loop

[0087] ⑥: Return .

[0088] 1.4.2 Adversarial Defense of the PLDI Model

[0089] To enable the PLDI model to resist adversarial attacks while maintaining its segmentation accuracy on original samples, this invention employs a defense method of joint training with original samples and adversarial samples. AT leverages the fact that adversarial samples and original samples are visually imperceptible and share the same ground truth label, reducing the distance between them in the model's feature space. This allows the model to simultaneously learn normal segmentation features and perturbation-resistant features, achieving a balance between segmentation accuracy and robustness. The core idea of ​​AT is to integrate adversarial samples into the regular training process, using a minimax optimization process to allow the model to find the optimal solution between fitting the original samples and resisting adversarial perturbations. AT can be represented as the following optimization problem:

[0090]

[0091] in, Segmentation model for plant leaf diseases The parameters. This indicates sampling from the joint data distribution of plant leaf disease images and segmentation labels. It is to counter disturbances of Norm constraints ensure that perturbations are visually imperceptible. This is the adversarial training loss function, used to quantify the model's performance on adversarial examples. The deviation between the segmentation results and the true label y is shown. Its mini-maximization structure characterizes the relationship between maximizing the loss to destroy the model through adversarial attacks and minimizing the loss to enhance the model's robustness through adversarial training.

[0092] To achieve this optimization goal, the following paradigm should be followed during the adversarial training phase:

[0093]

[0094] in, This is a balancing coefficient used to adjust the weights of the original sample loss and the adversarial sample loss, avoiding sacrificing the original segmentation accuracy due to excessive focus on adversarial perturbations. This is the loss of the model on the original samples, ensuring basic segmentation performance. To improve the model's loss on adversarial examples, we enhance its resistance to perturbations. These two aspects work together to form the complete optimization objective of adversarial training, ensuring both the model's fit to normal data and forcing the model to learn perturbation-resistant features.

[0095] The design goal is to enable the model to maintain robust segmentation performance on adversarial examples with perturbations. Its core logic is to force the model to learn feature representations that are insensitive to small perturbations by minimizing the loss on adversarial examples. Because adversarial examples... Shares the truth label y with the original sample x. Adopted and The same composite loss form ensures consistency in the optimization objective:

[0096]

[0097] Where a and b are hyperparameters.

[0098] Through the aforementioned min-max optimization and adversarial training mechanism, the PLDI model can learn the distribution patterns of adversarial perturbations while learning the characteristics of normal diseases. Ultimately, this enables the PLDI model to maintain stable segmentation performance on both original and adversarial samples, providing robust assurance for the accurate identification of plant leaf diseases.

[0099] Example 2, Experiment and Results:

[0100] 2.1 Experimental Setup

[0101] a) Dataset

[0102] This invention conducts experiments on two publicly available plant leaf disease segmentation datasets: the Apple Leaf Disease Dataset (ATLDSD) and the Rice Leaf Disease Dataset (RLDSD). The ATLDSD dataset contains 1641 apple leaf images, covering five common disease types, with a uniform image resolution of 256×256. It is divided into training and validation sets in an 8:2 ratio. The RLDSD dataset contains 2005 rice leaf images, covering two typical diseases, with an image resolution of 256×256. It is also divided in an 8:2 ratio.

[0103] b) Baseline Model

[0104] The PLDIS model selected in this invention specifically refers to a semantic segmentation model adapted for the task of segmenting plant leaf disease images. In the experiments, six mainstream semantic segmentation models—UNet, DeepLabv3+, TransUNet, CSWinUNet, SwinUMamba, and VM-UNet—were selected as typical implementations of PLDIS. These models are the core foundational models in the current PLDIS field and are widely used in plant leaf disease segmentation tasks. Their adversarial robustness results directly reflect the general characteristics of similar PLDIS models. Therefore, this invention reveals the adversarial vulnerability of plant leaf disease segmentation models through attack and defense experiments on these six typical PLDIS models.

[0105] All models were trained from scratch, with completely uniform training configurations. The number of training iterations for each model was set to 8 × 10. 4 The batch size was fixed at 2, and the SGD optimizer was used with a learning rate of 1e-3, momentum of 0.9, weight decay of 1e-4, and a random seed of 1337 to ensure reproducibility. The experiments were implemented using the PyTorch framework and a single NVIDIA GeForce RTX 3090 GPU to ensure consistency between training and inference for each model.

[0106] 2.2 Basic Results of Counterattacks

[0107] a) Adversarial Attack Setup: Unless otherwise specified, the adversarial attack used in the experiment is a GGPA attack. Various parameters can be selected for the attack method. To ensure the validity and practicality of the experimental results, the following settings are configured: ∈{1 / 55,2 / 255,4 / 255,8 / 255), α = 2.0 / 255, iteration T∈{1,5,10,15,20}. Perturbation of Norm constraint at threshold The parameter selection comprehensively covers reasonable parameter values, making the experimental results more reliable. Widely used fully supervised image segmentation evaluation metrics, Dice and mIoU, are chosen to evaluate the effectiveness of adversarial attacks. If adversarial examples cause the network-generated images to have significantly lower Dice and mIoU than the original samples, they successfully deceive the PLDIS model. In other words, the greater the difference in metrics between the original sample output and the adversarial sample output, the more vulnerable the PLDIS model is to adversarial attacks.

[0108] b) Quantitative Results and Analysis: Tables 1 and 2 show the results of six typical PLDIS models on the RLDSD and ATLDSD datasets, based on the number of iterations. Maximum disturbance amplitude Quantitative results of adversarial attacks were presented. All models were trained from scratch on the original samples without introducing adversarial training optimization. The experimental results lead to the following conclusions: all PLDIS models exhibit adversarial vulnerability, and adversarial examples significantly degrade segmentation performance. On both datasets, the models showed varying degrees of decrease in mIoU and Dice. On the RLDSD dataset, the average Dice decreased by 45.07%, and the average mIoU decreased by 27.04%. On the ATLDSD dataset, the average Dice decreased by 44.82%, and the average mIoU decreased by 41.20%. Among these, CSWin-UNet's Dice on RLDSD decreased from 80.65% to 19.03%, a drop of 61.62%. VM-UNet's Dice coefficient on ATLDSD decreased from 81.02% to 16.75%, a drop of 64.27%, exhibiting the most severe degradation, thus validating the effectiveness of the attack method.

[0109] Table 1. Validation results of the agricultural segmentation model without adversarial training on the RLDSD dataset, using raw samples and adversarial samples.

[0110] Model mIoU Clean mIoU Adv Dice Clean Dice Adv Precision Clean Precision Adv Recall Clean Recall Adv UNet 0.8225 0.6930 0.7976 0.5995 0.7994 0.5269 0.7958 0.6954 DeepLabV3+ 0.8176 0.5273 0.7909 0.2810 0.8007 0.1996 0.7812 0.4746 TransUNet 0.8282 0.5857 0.8055 0.3970 0.7925 0.5083 0.8190 0.2786 CSWin-UNet 0.8292 0.4644 0.8065 0.1903 0.8221 0.1198 0.7914 0.4629 Swin-UMamba 0.8195 0.6053 0.7932 0.4347 0.8123 0.3502 0.7751 0.5730 VM-UNet 0.8430 0.4614 0.8320 0.2188 0.8280 0.1328 0.8260 0.6205

[0111] Table 2. Validation results of the agricultural segmentation model without adversarial training on the ATLDSD dataset, using original samples and adversarial samples.

[0112] Model mIoU Clean mIoU Adv Dice Clean Dice Adv Recall Clean Recall Adv Precision Clean Precision Adv UNet 0.6307 0.3515 0.7006 0.4125 0.7543 0.5246 0.7497 0.4834 DeepLabV3+ 0.6328 0.2063 0.6992 0.2460 0.5793 0.3312 0.6233 0.2982 TransUNet 0.7483 0.2676 0.8164 0.3122 0.7063 0.2889 0.6768 0.3592 CSWin-UNet 0.6784 0.2159 0.7536 0.2230 0.8257 0.3646 0.7613 0.2973 Swin-UMamba 0.6536 0.4046 0.7261 0.4552 0.6319 0.4192 0.6109 0.4320 VM-UNet 0.7426 0.1681 0.8102 0.1675 0.8580 0.3051 0.8260 0.2382

[0113] c) Visual Results and Analysis: Figures 2 and 3 show the visual comparison results of adversarial attacks on the ATLDSD and RLDSD datasets, respectively. The VM-UNet model is selected as a typical example. This model performs excellently on the original samples, but its performance degrades significantly on adversarial samples, making it easier to visually demonstrate the attack effect. The images in each row of each figure, from left to right, are: the original input image, ... The analysis includes adversarial examples under different configurations, the model's segmentation output of the original samples, the model's segmentation output of the adversarial examples, and the ground truth (GT). Combined with visual comparison, the following core inferences can be drawn:

[0114] 1. Adversarial examples possess strong visual concealment; the perturbations are imperceptible. A comparison of the original input and the adversarial example shows that even with the maximum perturbation amplitude... Under an attack configuration with T=5 iterations, the adversarial sample remained largely unchanged from the original leaf image in terms of leaf texture, color distribution, and original visual features of lesions; the human eye could not distinguish between the two. This characteristic validates the core design goal of the attack method, ensuring that the adversarial sample accurately simulates the covert perturbation threats that may be encountered in real-world applications.

[0115] 2. Adversarial attacks significantly damage the accuracy and completeness of segmentation output, showing a high degree of consistency with quantitative results. Comparison of segmentation outputs reveals that the original segmentation output accurately matches the true labels. Adversarial segmentation outputs, however, exhibit severe performance degradation. On the ATLDSD dataset, lesion areas are extensively misclassified, while healthy leaf areas show significant omissions, with lesion edges completely blurred and extremely low overlap with the true labels. On the RLDSD dataset, adversarial outputs exhibit problems such as broken disease areas and localized misclassifications, severely compromising the completeness and accuracy of the segmentation results.

[0116] The results above show that adversarial attacks significantly reduce the segmentation performance of typical PLDIS models, and the attack effect is affected by the perturbation magnitude, the number of iterations, and the model architecture.

[0117] 2.3 Adversarial Defense Against the PLDIS Model

[0118] a) Adversarial Attack Setup: The adversarial defense employs a de novo adversarial training paradigm, without using any pre-trained weights, ensuring that the defense performance stems entirely from robustness optimization during training. The training configuration is consistent with the undefended model to guarantee a fair comparison. The number of iterations is set to 8 × 10⁻⁶. 4 The batch size is fixed at 2, the optimizer uses SGD, the learning rate is 1e-3, the momentum is 0.9, the weight decay is 1e-4, and the random seed is fixed at 1337. The core loss function for adversarial training adopts a composite form. ,in To counteract the regularization coefficient, a balance is struck between the original sample segmentation accuracy and robustness. The adversarial example generation parameters remain consistent with the attack experiments. Perturbation amplitude... Number of iterations iteration step size During adversarial training, adversarial examples are generated in each iteration and mixed with the original examples in a 1:1 ratio, forcing the model to learn both normal features and perturbation-resistant features simultaneously.

[0119] b) Quantitative results and analysis: Figure 4 This paper presents the comparison results of Dice coefficients and mIoU of six typical PLDIS models on the ATLDSD and RLDSD datasets, with and without adversarial training. The experiments use... , , The attack parameters were used to verify the defensive effectiveness of the adversarial training, and the core conclusions are as follows:

[0120] 1. Adversarial training significantly improves the adversarial robustness of the PLDIS model without sacrificing the performance of the original samples. Without adversarial training, the average Dice (Discretionary Integrity) of the model on the ATLDSD and RLDSD datasets is only 24.89% and 35.35%, respectively. The average mIoU is 24.12% and 55.61%, respectively. After adversarial training, the average Dice increases to 65.52% and 73.60%, representing improvements of 163.2% and 108.2%, respectively. The average mIoU increases to 60.07% and 77.98%, respectively, representing improvements of 149.0% and 40.1%, respectively.

[0121] 2. The robustness improvement varies across different architectures, but all demonstrate significant optimization. Models based on traditional CNN architecture show relatively modest robustness improvements. DeepLabV3+, for example, improved its mIoU (mIoU) on the ATLDSD dataset from 20.63% to 46.15%, a 123.70% increase. Transformer-based models TransUNet and CSWinUNet show moderate improvements. TransUNet, in particular, improved its mIoU on the ATLDSD dataset from 26.76% to 62.31%, a 132.84% increase. Mamba-based models VM-UNet and Swin-UMamba show the most significant robustness improvements, with Swin-UMamba improving its mIoU on the ATLDSD dataset from 18.96% to 61.17%, a 222.62% increase.

[0122] c) Visual Results and Analysis

[0123] Figure 5 and Figure 6 This section presents a comparison of segmentation visual results before and after adversarial training on the ATLDSD and RLDSD datasets. Taking the VM-UNet model as an example, each row from left to right shows: original input, adversarial example, undefended segmentation output, segmentation output after adversarial training, and ground truth label.

[0124] Based on the visual effects, the following conclusions can be drawn:

[0125] 1. Adversarial training effectively mitigates the segmentation degradation problem caused by adversarial attacks. Without defense, the segmentation output of adversarial examples on both datasets suffers from numerous omissions and misclassifications, resulting in completely blurred lesion outlines. After adversarial training, the segmentation output accurately matches the real labels, significantly improving the integrity and localization accuracy of the lesion region, and greatly reducing the difference in segmentation performance compared to the original samples.

[0126] 2. Adversarial training did not compromise the model's ability to segment original samples. A comparison of the segmentation outputs of original samples without defense and after adversarial training shows that both can clearly outline the disease contours, with no significant performance difference. This verifies that adversarial training does not sacrifice performance in normal scenarios, meeting the requirement that the vast majority of samples in practical agricultural applications are original data.

[0127] The results above demonstrate that adversarial training effectively defends against adversarial attacks against the PLDIS model. Compared to the model without a defense strategy, the adversarially trained model exhibits more robust and reliable segmentation performance on adversarial examples. Simultaneously, it maintains good segmentation performance on original samples, fully demonstrating the practical value of this defense method.

[0128] In summary, this invention systematically studies the adversarial robustness of PLDIS models, filling a research gap in the field of agricultural computer vision regarding adversarial attacks and defenses. Through targeted attack method design, defense strategy construction, and multi-dimensional experimental verification, the adversarial vulnerabilities of typical PLDIS models have been revealed and their robustness optimized. First, this invention systematically explores the adversarial robustness of six typical PLDIS models for the first time. Experimental results show that regardless of whether traditional CNN, Transformer, or Mamba architectures are used, existing models exhibit significant performance degradation under covert adversarial perturbations, verifying the prevalence of adversarial threats in this field. Second, a task-specific adversarial attack method is proposed. GGPA is based on gradient-sensitive region localization and combined with Gaussian smoothing to achieve targeted perturbation. While ensuring visual concealment, it efficiently disrupts the model's segmentation performance, and the attack effect is significantly better than general PGD attacks and unguided noise attacks. Furthermore, a joint training defense strategy based on original samples and adversarial samples is adopted, achieving a balance between segmentation accuracy and robustness. This strategy significantly improves the model's segmentation metrics mIoU and Dice on adversarial examples while maintaining the segmentation accuracy of the original samples, and it is universally applicable to different model architectures. Finally, comprehensive evaluations on the two public datasets ATLDSD and RLDSD fully validate the effectiveness of the proposed attack method and the practicality of the defense strategy.

[0129] Furthermore, this invention introduces adversarial robustness as an important evaluation dimension into the field of agricultural computer vision. The proposed method and conclusions can provide a complete technical framework and experimental support for the safe optimization of the PLDIS model, promoting the practical application of robust and reliable smart agriculture technologies.

Claims

1. A method for improving the robustness of neural networks for agricultural image segmentation, characterized in that, This method introduces gradient-guided Gaussian perturbation attack (GGPA) into the Plant Leaf Disease Image Segmentation Model (PLDIS). By focusing on segmentation task loss and locating gradient-sensitive regions, combined with Gaussian kernel smoothing and iterative optimization, it accurately destroys the segmentation results of diseased areas while ensuring the visual naturalness of the perturbation. At the same time, a joint training defense strategy based on original samples and adversarial samples is designed to effectively improve the model's resistance to the two attack methods without significantly losing the original segmentation accuracy.

2. The method for improving the robustness of agricultural image segmentation neural networks as described in claim 1, characterized in that, A method to improve the robustness of neural networks for agricultural image segmentation is defined as follows: Let the original plant leaf image be... Where H and W are the image height and width, respectively, and the corresponding disease segmentation annotations are as follows: The goal of counter-attacks is to generate tiny perturbations. Make the adversarial examples satisfy: Visual imperceptibility: counteracting disturbances The amplitude is affected Constraints, i.e. , The value of directly determines the maximum permissible perturbation amplitude for each pixel in the image; Attack effectiveness: The segmentation model f(·) significantly increases the deviation between the segmentation result f(x) of the original image x and the true annotation y, and the missegmentation rate of the diseased area is improved; Task adaptability: The perturbation focuses on the diseased area and its edges, avoiding ineffective perturbation of the background area, which meets the core requirement of pixel-level semantic extraction of disease segmentation.

3. The method for improving the robustness of agricultural image segmentation neural networks as described in claim 2, characterized in that, The Gradient-Guided Gaussian Perturbation Attack (GGPA) utilizes a core architecture of sensitive region gradient mapping, Gaussian smoothed noise generation, and iterative direction memorization to precisely target the sensitive region while simulating natural disturbances. The steps are as follows: First, the gradient of the segmentation loss with respect to the image is calculated, and the sensitive region mapping is generated by taking the absolute value of the gradient and normalizing it. Then, the sensitive region enhancement coefficient is introduced. get ; If the initial mapping has no effective region, a sensitive region mask (M) is forcibly generated by selecting highly sensitive pixels; secondly, Gaussian smoothed noise and fusion perturbation are generated; a two-dimensional Gaussian kernel (G) is designed to simulate the spatial continuity of non-uniform illumination in agricultural scenes, and the basic Gaussian noise is adjusted accordingly. Convolution is performed to smooth the noise. At the same time, low-intensity random noise is generated. ; through the sensitive area mask M Weighted, and combined with gradient scaling Fusion ,in To balance the intensity of the focus on sensitive areas with the overall naturalness, this approach addresses the issues of insufficient targeting or poor naturalness in general Gaussian attacks. Finally, iterative direction memory and constraint optimization are implemented. A direction memory mechanism is introduced to retain historical gradient directions for updating the current perturbation direction, preventing perturbation cancellation in multiple iterations and enhancing attack stability. The perturbation generated in each round... pass accomplish Norm constraints strictly ensure that the perturbation is imperceptible to the human eye; after T iterations, the output adversarial example is continuously optimized through gradient guidance and Gaussian smoothing to ensure that the perturbation is precisely applied to the lesion-sensitive area, while simulating the characteristics of natural interference; the overall GGPA attack process is defined by formula (3-6): in, The gradient of the image is obtained using L1 loss; Based on Gaussian noise; This is a normalization operation; M is a binary sensitive region mask; Low-intensity noise; β represents the direction of the perturbation with memory; β is the gradient-guided weight. This is the upper limit threshold for the disturbance. This is a pointwise convolution.

4. The method for improving the robustness of agricultural image segmentation neural networks as described in claim 3, characterized in that, The algorithm steps of Gradient-Guided Gaussian Perturbation Attack (GGPA) are as follows: Input: Segmentation model A batch of clean images shape( ), corresponding real label mask Attack parameters: Gaussian kernel size K, standard deviation Maximum disturbance amplitude Gradient scaling factor β, enhancement factor (For sensitivity map enhancement), number of iterations T; Output: Adversarial Examples ; ①: Generate Gaussian kernel The generating formula is Normalize G (summing to 1) and reshape it to The shape; ②: Initialize the direction variables from the previous round: ③: Calculate the gradient of the loss function with respect to the input image. . ④: Regarding the number of iterations Perform the following operations: Derivation of the sensitivity map S: Normalization of the absolute value of the gradient. Enhance the sensitivity map through exponentiation. (Normalization to interval) / / Enlarge the highly sensitive area Generate a sensitive mask: Generate basic noise: shape Set gradient direction . Based on historical information update trends: when , ; . Generate smooth noise: . Generate small noise: shape . Calculate guided disturbance . Clipping disturbance amplitude: . Generate adversarial examples: . / / Ensure pixel values ​​are within the valid range (0-1); ⑤: End the loop ⑥: Return .

5. The method for improving the robustness of agricultural image segmentation neural networks as described in claim 3, characterized in that, The adversarial defense steps of the PLDI model are as follows: A defense approach employing joint training with original samples and adversarial samples integrates adversarial samples into the regular training process. Through a min-max optimization process, the model finds the optimal solution between fitting the original samples and resisting adversarial perturbations. Adversarial training (AT) is represented as the following optimization problem: in, Segmentation model for plant leaf diseases Parameters; This indicates sampling from the joint data distribution of plant leaf disease images and segmentation labels; It is to counter disturbances of Norm constraints ensure that perturbations are visually imperceptible; This is the adversarial training loss function, used to quantify the model's performance on adversarial examples. The deviation between the segmentation results and the true label y; its mini-maximization structure characterizes the relationship between maximizing the loss to destroy the model through adversarial attacks and minimizing the loss to enhance the robustness of the model through adversarial training; During the adversarial training phase, follow this paradigm: in, For balance coefficient, The loss of the model on the original samples, This represents the model's loss on adversarial examples; Due to adversarial examples Shares the truth label y with the original sample x. Adopted and The same composite loss form ensures consistency in the optimization objective: Where a and b are hyperparameters; Through the aforementioned min-max optimization and adversarial training mechanism, the PLDI model can learn the distribution patterns of adversarial perturbations while learning the characteristics of normal diseases. Ultimately, this enables the PLDI model to maintain stable segmentation performance on both original and adversarial samples, providing robust assurance for the accurate identification of plant leaf diseases.

Images