Confrontation sample generation method for human body target detection

Abstract

The invention relates to an adversarial sample generation method for human body target detection, and aims to solve the problems of single shape, poor adaptability and limited attack efficiency of an existing adversarial patch and improve the anti-attack robustness of a target detection model. The method comprises the steps of firstly obtaining an original pedestrian image and obtaining an initial detection frame through a target detection model, setting a movable anchor point in each detection frame and limiting a movement range, and randomly moving the anchor points to construct an initial population; smoothly connecting the anchor points through a Catmull-Rom spline algorithm to form a naturally closed patch area, and generating a mask original image; and finally, by taking the lowest detection confidence as a target, iteratively searching an optimal confrontation sample through a differential evolution algorithm. According to the scheme, rich patch shape spaces can be constructed, the method is adaptive to posture and body type differences of single or multiple human body targets, and the generated high-generalization adversarial samples can be used for model adversarial training. Experiments verify that the model trained by the method has significantly improved resistance to shape optimization type adversarial attacks, can effectively cope with various similar attacks, and provides guarantee for detection safety of key scenes such as security monitoring and automatic driving.

Description

Technical Field

[0001] This invention belongs to the field of target detection technology, specifically relating to a method for generating adversarial examples for human target detection. Background Technology

[0002] Deep learning-based human target detection technology has become a core support in key areas such as security monitoring, autonomous driving, and intelligent access control. Its detection accuracy and robustness directly affect the security and reliability of application systems. In security scenarios, accurate human detection is the foundation for abnormal behavior recognition and suspicious target tracking; in the field of autonomous driving, real-time and accurate pedestrian detection is crucial for avoiding collision risks and ensuring driving safety. However, these models have significant security vulnerabilities—they are highly susceptible to malicious attacks using adversarial patches. Attackers can mislead the model by adding carefully designed perturbation patterns to the human body surface, causing erroneous judgments such as missed detections and false detections, thereby leading to safety incidents. Therefore, constructing efficient adversarial sample generation methods is of great practical significance for evaluating and improving the model's resistance to attacks and ensuring the security of real-world application scenarios.

[0003] Current research on adversarial patching for human target detection has made some progress, but many limitations remain. Early adversarial patches mostly adopted fixed shape designs, such as rectangles and circles. These patches have a single shape, making their attack patterns easy for models to learn and their defense threshold low. Subsequent studies have attempted to achieve patch deformation, such as adjusting the shape by controlling the center point and ray length, or achieving finite deformation based on a nine-square grid constraint. However, the former produces patch shapes that are not natural enough, while the latter significantly limits the search space for patch shapes, resulting in insufficient shape variation dimensions. At the same time, most existing technologies focus on adversarial attacks on image classification models, with less design for adaptability to human target detection models. Moreover, most methods adopt a "one-size-fits-all" strategy, using patches of uniform shape for the entire dataset without considering the differences in pose, body shape, clothing, etc., of individual pedestrian targets. This results in weak targeting and generalization of patch attacks, making it difficult to effectively attack human targets with different features. In addition, some methods perform poorly in multi-human target scenarios, failing to generate optimal patches for each pedestrian target in the image, further limiting the attack effectiveness and application scope of adversarial examples.

[0004] Existing adversarial example generation methods for human target detection generally suffer from insufficient patch shape diversity, inadequate adaptive optimization capabilities for individual targets, and poor adaptability to multi-target scenarios. These limitations prevent the generated adversarial examples from fully covering potential shape attack patterns, making it difficult to adequately expose model security vulnerabilities. Consequently, they fail to provide high-quality data support for model adversarial training, leaving the model vulnerable to shape-optimized adversarial patches in practical applications. Therefore, there is an urgent need for an adversarial example generation scheme that can construct rich shape spaces, achieve adaptive optimization for individual pedestrian targets, and adapt to multi-human target scenarios. This would address the shortcomings of existing technologies and provide effective support for improving the robustness of human target detection models. Summary of the Invention

[0005] To address the problems existing in the background art, one aspect of the present invention provides an adversarial example generation method for human target detection, comprising:

[0006] S1: Obtain the original pedestrian image and input the original pedestrian image into the target detection model to obtain the initial detection box of the pedestrian target in the original pedestrian image;

[0007] S2: Set N anchor points in the initial detection bounding box of each pedestrian target in the original pedestrian image, and construct the movement range of each anchor point;

[0008] S3: Randomly move the coordinates of the anchor points within the movement space of each anchor point to construct the initial population;

[0009] S4: For each individual in the population, the patch region corresponding to the individual is obtained by smoothly connecting the N anchor points corresponding to the individual using the Catmull-Rom spline algorithm.

[0010] S5: Mask the original pedestrian image with patches according to the patch regions corresponding to each individual, and generate N masked original images;

[0011] S6: Construct an objective function with the lowest confidence score of the original masked image in the object detection model as the optimization objective. Based on the constructed objective function, use the differential evolution algorithm to search for the optimal original masked image as an adversarial example.

[0012] Another aspect of the present invention provides a system for generating adversarial examples for human target detection, the system comprising a memory and a processor; the memory is used to store an application program; the processor is used to run the application program and execute the aforementioned method for generating adversarial examples for human target detection.

[0013] Another aspect of the present invention provides a computer storage medium storing a remote monitoring program, which, when executed by a processor, implements the aforementioned adversarial example generation method for human target detection.

[0014] The present invention has at least the following beneficial effects

[0015] This invention effectively solves the problems of existing adversarial example generation methods, such as patch shape being monotonous, limited variation space, unnatural morphology, insufficient adaptability to single pedestrian targets, poor adaptability to multi-person target scenarios, and insufficient optimization for target detection models. By setting movable anchor points within the initial detection box of pedestrian targets, and constructing a rich and smooth natural patch shape space using the Catmull-Rom spline algorithm, and then using the differential evolution algorithm to iteratively optimize with the lowest detection confidence as the target, adaptive patch generation for single pedestrian targets is achieved, while also covering multi-person target scenarios. The generated highly generalized adversarial examples can provide high-quality data support for adversarial training of target detection models, significantly improving the model's ability to resist shape-optimized adversarial patch attacks, and greatly enhancing the model's detection robustness and security in key application scenarios such as security monitoring and autonomous driving. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0017] Figure 2 This is a schematic diagram of the patch shape optimization process based on the differential evolution algorithm of the present invention;

[0018] Figure 3 Schematic diagrams of various patches optimized for this invention;

[0019] Figure 4 This is a schematic diagram of some adversarial examples during the iterative optimization process;

[0020] Figure 5 A schematic diagram of a partial adversarial dataset generated for APGM-H;

[0021] Figure 6 A schematic diagram of a partial adversarial dataset generated for DAPatch. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] Please see Figure 1 One aspect of the present invention provides a method for generating adversarial examples for human target detection, comprising:

[0024] S1: Obtain the original pedestrian image and input the original pedestrian image into the target detection model to obtain the initial detection box of the pedestrian target in the original pedestrian image;

[0025] In this embodiment, the acquisition of original pedestrian images needs to cover diverse real-world scenarios. These images can originate from publicly available pedestrian detection datasets (such as Inria and COCO) or images collected in real-world environments, including samples with different lighting conditions, shooting angles, pedestrian poses, and background complexity, ensuring that the generated adversarial examples have strong generalization capabilities. After acquiring the images, necessary preprocessing operations are required, such as unifying image size, normalizing pixel values, and removing redundant noise, to avoid non-target factors interfering with the detection results. Subsequently, the preprocessed original images are input into a fully trained target detection model (such as YOLOv2, YOLOv5, Faster-RCNN, etc.). This type of model extracts image features through deep neural networks, generates candidate boxes, performs classification and regression calculations, and accurately outputs the initial detection box coordinates (such as the upper left corner x1, y1 and the lower right corner x2, y2) for each pedestrian target, clearly defining the specific boundaries of the pedestrian target in the image.

[0026] S2: Set N anchor points in the initial detection bounding box of each pedestrian target in the original pedestrian image, and construct the movement range of each anchor point;

[0027] Preferably, the construction of the movement space for each anchor point includes: defining the area of ​​the circle enclosed by the N anchor points as equal to the square of 20% of the diagonal length of the initial detection frame of the pedestrian target; taking the center of the initial detection frame of the pedestrian target as the center point, and calculating the radius of the circle enclosed by the N anchor points based on the area of ​​the circle; evenly distributing the N anchor points in a ring around the center of the circle based on the radius of the circle, thus obtaining the initial positions of the N anchor points; and calculating the movement range of each anchor point based on the height H and width W of the initial detection frame of the pedestrian target.

[0028]

[0029] in, This is a proportionality coefficient, with a value ranging from 0.05 to 0.15; This indicates that the movement range of each anchor point is a radius of [radius value] from its initial position. Inside the circle.

[0030] In this embodiment, a flexible and controllable foundation is provided for subsequent patch generation through scientific anchor point layout and movement range constraints. First, the number of anchor points N needs to be set according to the actual application scenario and target detection accuracy requirements (usually selecting 8 or more positive integers) to ensure that the key control dimensions of the patch shape can be covered. The initial anchor points, which are evenly distributed in a ring, lay the foundation for the subsequent generation of closed and symmetrical patches, ensuring the integrity of the patch shape. The movement range, which is dynamically calculated based on the target size, not only gives the anchor points sufficient freedom to adjust their shape, but also avoids abnormal patch shapes through boundary constraints.

[0031] S3: Randomly move the coordinates of the anchor points within the movement space of each anchor point to construct the initial population;

[0032] Preferably, the construction of the initial population includes: randomly moving the anchor point coordinates within the movement range of each anchor point, repeating the random movement operation K times, and generating an initial population containing K individuals; each individual is a set of anchor point coordinates.

[0033] In this embodiment, a diverse initial population is generated by randomizing anchor point coordinates. The population size K needs to be set in combination with computational efficiency and search comprehensiveness (15 is preferred in the experiment). If the value of K is too small, it will lead to a limited search range and miss the optimal solution; if it is too large, it will increase computational overhead and reduce iteration efficiency. During the construction process, the coordinates of each anchor point are randomly sampled within a moving circle with a set radius R. The sampling process strictly follows the anchor point movement constraints to ensure that the anchor point does not exceed the target detection box or produce abnormal displacement. By repeating this random movement operation K times, an initial population containing K independent individuals is generated, where each individual corresponds to a complete set of anchor point coordinates. Each set of coordinates can construct a unique potential patch shape. All individuals meet the anchor point movement constraints, ensuring that subsequent iterative optimization always revolves around a reasonable patch shape within the target area, greatly improving the targeting and efficiency of the optimization process.

[0034] S4: For each individual in the population, the patch region corresponding to the individual is obtained by smoothly connecting the N anchor points corresponding to the individual using the Catmull-Rom spline algorithm.

[0035] Preferably, the smooth connection of the N anchor points corresponding to an individual using the Catmull-Rom spline algorithm includes: for the first individual... Anchor points Combined with adjacent anchor points , and There are a total of 4 anchor points. Curve segments are generated by fitting a function using the Catmull-Rom spline algorithm. Connect all curve segments end to end to form a closed, smooth patch area.

[0036] In this embodiment, the Catmull-Rom spline algorithm transforms discrete anchor points into continuous closed patch regions, overcoming the limitations of traditional patches with stiff shapes and abrupt transitions. This fitting process precisely controls the curvature and direction of the curves, ensuring that the tangents of each curve segment are parallel to those of adjacent curves at the connection points, resulting in natural transitions and avoiding sharp edges or breaks. After sequentially connecting the curve segments corresponding to all anchor points, a complete, closed patch region with smooth edges is formed. The differences in anchor point coordinates of each individual are transformed into patch shapes of varying forms, fully preserving the diversity advantage of the initial population. The characteristics of the Catmull-Rom spline algorithm ensure that the patch edges are natural and smooth, solving the problem of stiff shapes and easy model recognition of traditional deformed patches, and improving the concealment and practicality of adversarial examples. The closed patch region strictly matches the control range of the anchor points, ensuring that the patch always focuses on the pedestrian target area and avoiding disturbance overflow or incomplete coverage due to irregular shapes. At the same time, each individual corresponds to a unique patch shape, providing a rich set of optimization objects for subsequent differential evolution algorithms.

[0037] S5: Mask the original pedestrian image with patches according to the patch regions corresponding to each individual, and generate N masked original images;

[0038] In this embodiment, a masking operation is used to precisely fuse the generated closed, smooth patch region with the original pedestrian image, transforming it into a masked original image suitable for model evaluation. First, a binary mask matrix is ​​generated based on the patch region corresponding to each individual in the population. The matrix size is identical to the original pedestrian image. Pixel values ​​within the patch region are set to 1 (indicating that adversarial perturbation is allowed), while pixel values ​​outside the region are set to 0 (indicating that the original image pixels are retained), ensuring that the perturbation only affects the pedestrian target region and does not affect the background information. Then, the pre-trained adversarial perturbation pattern is multiplied pixel-by-pixel with the binary mask to obtain the target perturbation region that fits the patch shape. Finally, the Hadamard product operation is used to fuse this perturbation region with the original pedestrian image, achieving precise superposition of the original image background and the patch region perturbation. The number of generated original mask images corresponds one-to-one with the number of individuals in the population. Each image corresponds to a unique combination of patch shape and perturbation, fully preserving the shape diversity advantage of the initial population. Through mask constraints, the adversarial perturbation is accurately focused on the pedestrian target, avoiding background interference that could lead to misjudgment of the model evaluation results, and ensuring the relevance of subsequent confidence calculations. The generated multiple original mask images cover a variety of patch shapes.

[0039] S6: Construct an objective function with the lowest confidence score of the original masked image in the object detection model as the optimization objective. Based on the constructed objective function, use the differential evolution algorithm to search for the optimal original masked image as an adversarial example.

[0040] Preferably, the objective optimization function includes:

[0041]

[0042] in, This indicates the first element in the original pedestrian image. The original mask image obtained after adding patches to individual pedestrian targets; express The first result obtained by the object detection model One detection box; Represents the first in the original pedestrian image Initial detection bounding boxes for individual pedestrian targets; express and The intersection and union ratio; express The number of detection boxes obtained by the object detection model; Find the function that maximizes the value.

[0043] Please see Figure 2 Preferably, the step of searching for the optimal original mask image using the differential evolution algorithm includes:

[0044] S61: For each individual in the current population, generate the original mask image corresponding to each individual through steps S4 and S5;

[0045] S62: Calculate the confidence value of each individual in the current population using the objective function based on the original mask image corresponding to each individual, and record the individual with the lowest confidence value in the current population as the current best individual;

[0046] S63: Determine whether the confidence level of the current best individual is lower than the set threshold or the maximum number of iterations has been reached. If so, output the original masked image corresponding to the current best individual as an adversarial example; otherwise, proceed to step S64.

[0047] S64: For each individual in the current population, randomly select 3 individuals that are different from the current individual from the current population, and generate a variant individual of the current individual through linear combination; cross the variant individual with the current individual to generate a candidate individual, and determine whether the confidence value of the candidate individual is lower than the confidence value of the current individual. If so, replace the current individual in the current population with the candidate individual, generate the population for the next iteration, and repeat steps S61 to S64.

[0048] Preferably, the variant individuals of the current individual include:

[0049] Calculate the variant individuals of the current individual:

[0050]

[0051] in, This represents the coordinates of the z-th anchor point among the mutated individuals of the current individual j; , and This represents the coordinates of the z-th anchor point among three randomly selected individuals from the current population that are different from the current individual; Indicates the scaling factor;

[0052] judge Is it within the movement range of the z-th anchor point? If it exceeds the movement range of the z-th anchor point, then... Truncate to the boundary value of the movement range.

[0053] Preferably, the step of cross-referencing the mutated individual with the current individual to generate candidate individuals includes:

[0054]

[0055] in, Represents the coordinates of the z-th anchor point among the candidate individuals; CR represents a random number uniformly distributed between 0 and 1; This indicates the dimension of the randomly selected anchor point. A random number between 1 and N; This represents the coordinates of the z-th anchor point in the current individual.

[0056] In this embodiment, through a scientifically designed objective function and an efficient differential evolution algorithm, the adversarial sample with the best attack performance is selected from diverse masked original images. By combining a targeted objective function with an efficient differential evolution algorithm, precise screening and iterative optimization from diverse candidates to the optimal sample are achieved. The objective function focuses on minimizing the detection confidence, ensuring that the optimization direction does not deviate from the core requirements. The mutation and crossover mechanisms of differential evolution maintain population diversity and prevent the algorithm from getting trapped in local optima, achieving rapid convergence. The anchor point boundary constraints in the iteration process ensure that the patch shape of the final adversarial sample is natural and smooth and does not exceed the target area, taking into account both attack concealment and rationality. The generated adversarial sample has strong attack performance and high generalization, which can fully expose the model's vulnerabilities under shape optimization attacks, providing high-quality data support for subsequent model adversarial training, directly helping the model improve its resistance to such adversarial attacks, and strengthening its detection robustness and security in key scenarios such as security monitoring and autonomous driving.

[0057] Experimental verification

[0058] This embodiment comprehensively evaluates the performance and generalization ability of the method in defending against shape optimization-type adversarial attacks by standardizing the dataset, benchmark model, and basic patches, combined with visualization results and quantitative data. The specific experimental design and results are as follows:

[0059] This experiment utilizes the Inria dataset, a classic pedestrian detection dataset in computer vision. Designed specifically for training and evaluating pedestrian detection algorithms, this dataset contains 614 training images (annotated with 1208 pedestrian instances) and 288 test images (annotated with 1126 pedestrian instances). The images cover various scenes, lighting conditions, and pose variations, effectively validating the method's effectiveness in complex real-world scenarios. To conduct adversarial defense training, based on the sample distribution of the Inria dataset's training and test sets, the experiment employs the proposed method to batch perturb the 614 training images and 288 test images, generating an adversarial training set of 614 images and an adversarial test set of 288 images with the exact same number of clean samples as the originals. This provides data support for subsequent adversarial training.

[0060] In the experiment, the following were selected: Figure 3 The six patches for pedestrian detection shown are used to generate adversarial examples on the algorithm presented in this paper. Figure 3 (a) is the patch trained by Thys et al. based on the YOLOv2 model. Figure 3 (b) is the patch trained by Hu et al. on the YOLOv2 model. Figure 3 (c) and (d) are patches trained on YOLOv2 and YOLOv3 respectively using the method of Wang et al. Figure 3 (e) and (f) are patches trained by Tan et al. by integrating models such as YOLOv2 and YOLOv3.

[0061] This paper selects YOLOv2, YOLOv5, and Faster-RCNN object detection models as experimental benchmark models. These models were trained on the COCO dataset, which includes human categories. Experiments have verified that their prediction accuracy on the Inria dataset is over 90%.

[0062] This article firstly Figure 3 Based on the six basic patch patterns shown, the proposed method (Adversarial Patch Generation Method for Human Body Targets, APGM-H) is used to optimize adversarial patches for all pedestrian targets in the dataset, generating adversarial training and testing sets with rich patch shape spaces, such as... Figure 4 As shown, Figure 4The first example demonstrates the patch optimization process for two human targets in an image from a dataset. Object_1 focuses on the person in red in the image, showcasing the optimal patch obtained after six population iterations in the differential evolution algorithm. Mask_1 is the corresponding patch mask. Since the algorithm iteratively optimizes patches for a single target, Object_2 optimizes the patch already optimized in Object_1. Similarly, Mask_2 is the corresponding patch mask during its iteration process.

[0063] Finally, after APGM-H... Figure 3 The partial adversarial datasets generated on the six patches shown are as follows: Figure 5 As shown, it is then fused with the clean training set of the Inria dataset to construct a hybrid training set. In this way, adversarial defense training of the object detection model is carried out in the above three models. After the adversarial defense model is trained, the average precision (AP) commonly used in object detection models is used in the validation process. The performance of the model without adversarial training and the defense model trained on the adversarial dataset constructed by the method in this paper on six adversarial patches is shown in Table 1.

[0064] Table 1. Detection performance of the model before and after adversarial training.

[0065]

[0066] Among them, the adversarial patch (APGM-H) is the adversarial test set generated by the method in this paper. YOLOv2 (APGM-H), YOLOv5 (APGM-H), and Faster-RCNN (APGM-H) refer to the defense models trained on the adversarial training set constructed by the algorithm in this paper. The percentage data in Table 1 refer to the AP value of the adversarial test set generated by the corresponding patch on the corresponding model. It can be seen that the model trained on the samples generated by the APGM-H algorithm can resist the attack of shape-optimized adversarial patches. For example, in the experiment, the EmPatch (Y2) patch can reduce the recognition accuracy of the YOLOv2 model without adversarial training to 9.91%, but the YOLOv2 (APGM-H) trained with the adversarial defense method in this paper can basically accurately recognize the adversarial dataset generated by EmPatch (Y2), with an accuracy of 81.34%, which is an improvement of 71.43%. This is because the hybrid training set used in the defense training incorporates diverse adversarial patch samples generated based on shape optimization, enabling the model to fully learn the perturbation features of patches with different anchor point shapes and different coverage ranges. This effectively improves the model's adaptability and generalization ability to shape optimization-type adversarial attacks, thus maintaining stable detection accuracy when facing various adversarial patches.

[0067] To verify the performance of the defense model trained by the proposed method on other shape-optimized patch attacks, experiments were conducted using the DAPatch method of Chen et al. Figure 3 Adversarial datasets were generated on the six patches shown, some of which are as follows: Figure 6 As shown, the generated dataset was used as the test dataset to test the three original models and their corresponding adversarial defense models to verify the effectiveness of the proposed method. The specific detection results are shown in Table 2.

[0068] Table 2. Performance of DAPatch patches on models

[0069]

[0070] As can be seen from Table 2, the adversarial defense model trained by the algorithm in this paper also has a defensive effect against other adversarial patch attack methods based on patch shape optimization. This is because the patch shape optimization algorithm in this paper has a large search space and is targeted. During the adversarial training process, the model fully learns the coverage and shape characteristics of various patches. Therefore, the trained adversarial model can resist similar attack methods.

[0071] Another aspect of the present invention provides a system for generating adversarial examples for human target detection, the system comprising a memory and a processor; the memory is used to store an application program; the processor is used to run the application program and execute the aforementioned method for generating adversarial examples for human target detection.

[0072] Another aspect of the present invention provides a computer storage medium storing a remote monitoring program, which, when executed by a processor, implements the aforementioned adversarial example generation method for human target detection.

[0073] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0074] In summary, this invention effectively solves the problems of existing adversarial example generation methods, such as patch shape being monotonous, limited variation space, unnatural morphology, insufficient adaptability to single pedestrian targets, poor adaptability to multi-person target scenarios, and insufficient optimization for target detection models. By setting movable anchor points within the initial detection box of pedestrian targets, and constructing a rich and smooth natural patch shape space using the Catmull-Rom spline algorithm, and then using the differential evolution algorithm to iteratively optimize with the lowest detection confidence as the target, adaptive patch generation for single pedestrian targets is achieved, while also covering multi-person target scenarios. The generated highly generalized adversarial examples can provide high-quality data support for adversarial training of target detection models, significantly improving the model's resistance to shape-optimized adversarial patch attacks, and greatly enhancing the model's detection robustness and security in key application scenarios such as security monitoring and autonomous driving.

[0075] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for generating adversarial examples for human target detection, characterized in that, include: S1: Obtain the original pedestrian image and input the original pedestrian image into the target detection model to obtain the initial detection box of the pedestrian target in the original pedestrian image; S2: Set N anchor points in the initial detection bounding box of each pedestrian target in the original pedestrian image, and construct the movement range of each anchor point; S3: Randomly move the coordinates of the anchor points within the movement space of each anchor point to construct the initial population; S4: For each individual in the population, the patch region corresponding to the individual is obtained by smoothly connecting the N anchor points corresponding to the individual using the Catmull-Rom spline algorithm. S5: Mask the original pedestrian image with patches according to the patch regions corresponding to each individual, and generate N masked original images; S6: Construct an objective function with the lowest confidence score of the original masked image in the object detection model as the optimization objective. Based on the constructed objective function, use the differential evolution algorithm to search for the optimal original masked image as an adversarial example.

2. The adversarial example generation method for human target detection according to claim 1, characterized in that, The construction of the movement space for each anchor point includes: defining the area of ​​the circle enclosed by the N anchor points as equal to the square of 20% of the diagonal length of the initial detection frame of the pedestrian target; taking the center of the initial detection frame of the pedestrian target as the center point, and calculating the radius of the circle enclosed by the N anchor points based on the area of ​​the circle; evenly distributing the N anchor points in a ring around the center of the circle based on the radius of the circle, thus obtaining the initial positions of the N anchor points; and calculating the movement range of each anchor point based on the height H and width W of the initial detection frame of the pedestrian target. in, This is a proportionality coefficient, with a value ranging from 0.05 to 0.15; This indicates that the movement range of each anchor point is a radius of [radius value] from its initial position. Inside the circle.

3. The adversarial example generation method for human target detection according to claim 2, characterized in that, The construction of the initial population includes: randomly moving the coordinates of the anchor point within the movement range of each anchor point, repeating the random movement operation K times, and generating an initial population containing K individuals; each individual is a set of anchor point coordinates.

4. The adversarial example generation method for human target detection according to claim 1, characterized in that, The smooth connection of the N anchor points corresponding to an individual using the Catmull-Rom spline algorithm includes: for the first individual... Anchor points Combined with adjacent anchor points , and There are a total of 4 anchor points. Curve segments are generated by fitting a function using the Catmull-Rom spline algorithm. Connect all curve segments end to end to form a closed, smooth patch area.

5. The adversarial example generation method for human target detection according to claim 1, characterized in that, The objective optimization function includes: in, This indicates the first element in the original pedestrian image. The original mask image obtained after adding patches to individual pedestrian targets; express The first result obtained by the object detection model One detection box; Represents the first in the original pedestrian image Initial detection bounding boxes for individual pedestrian targets; express and The intersection and union ratio; express The number of detection boxes obtained by the object detection model; Find the function that maximizes the value.

6. The adversarial example generation method for human target detection according to claim 5, characterized in that, The process of searching for the optimal original mask image using the differential evolution algorithm includes: S61: For each individual in the current population, generate the original mask image corresponding to each individual through steps S4 and S5; S62: Calculate the confidence value of each individual in the current population using the objective function based on the original mask image corresponding to each individual, and record the individual with the lowest confidence value in the current population as the current best individual; S63: Determine whether the confidence level of the current best individual is lower than the set threshold or the maximum number of iterations has been reached. If so, output the original masked image corresponding to the current best individual as an adversarial example; otherwise, proceed to step S64. S64: For each individual in the current population, randomly select 3 individuals that are different from the current individual from the current population, and generate a variant individual of the current individual through linear combination; cross the variant individual with the current individual to generate a candidate individual, and determine whether the confidence value of the candidate individual is lower than the confidence value of the current individual. If so, replace the current individual in the current population with the candidate individual, generate the population for the next iteration, and repeat steps S61 to S64.

7. The adversarial example generation method for human target detection according to claim 6, characterized in that, The variant individuals of the current individual include: Calculate the variant individuals of the current individual: in, This represents the coordinates of the z-th anchor point among the mutated individuals of the current individual j; , and This represents the coordinates of the z-th anchor point among three randomly selected individuals from the current population that are different from the current individual; Indicates the scaling factor; judge Is it within the movement range of the z-th anchor point? If it exceeds the movement range of the z-th anchor point, then... Truncate to the boundary value of the movement range.

8. The adversarial example generation method for human target detection according to claim 6, characterized in that, The step of cross-referencing the mutated individual with the current individual to generate candidate individuals includes: in, Represents the coordinates of the z-th anchor point among the candidate individuals; CR represents a random number uniformly distributed between 0 and 1; This indicates the dimension of the randomly selected anchor point. A random number between 1 and N; This represents the coordinates of the z-th anchor point in the current individual.

9. A system for generating adversarial examples for human target detection, characterized in that, The system includes a memory and a processor; the memory is used to store an application program; the processor is used to run the application program and execute an adversarial example generation method for human target detection as described in any one of claims 1 to 8.

10. A computer storage medium, characterized in that, The computer storage medium stores a remote monitoring program, which, when executed by a processor, implements an adversarial example generation method for human target detection as described in any one of claims 1 to 8.

Images