Model training methods, adversarial example generation methods and related devices

Abstract

This application provides a model training method, an adversarial example generation method, and related apparatus, relating to the field of computer vision. The model training method includes: generating preliminary test samples based on a constructed adversarial example generation model and original images, and determining the realism loss between the preliminary test samples and the original images; performing pixel gradient optimization on the preliminary test samples to generate test samples, and determining the trajectory guidance loss between the test samples and the original images; determining a weighted total loss based on the realism loss and the trajectory guidance loss; and updating the parameters of the adversarial example generation model using backpropagation based on the weighted total loss until the weighted total loss converges. The adversarial example generation model is used to generate adversarial examples. This method aims to improve the success rate of attacks on target detection models by using adversarial examples generated by the trained adversarial example generation model.

Description

Technical Field

[0001] This application relates to computer vision, and more particularly to a model training method, an adversarial example generation method, and related apparatus. Background Technology

[0002] In modern computer vision systems, object detection models, as core components of the perception layer, perform both object classification and localization. However, the sensitivity of the model's algorithmic structure makes it highly susceptible to malicious interference from adversarial examples. Therefore, after training the object detection model, it is necessary to test its robustness by generating adversarial examples.

[0003] In existing technologies, adversarial examples are usually obtained by modifying the pixel values ​​of the input image to induce the target detection model to make false judgments. However, this method has the problem of low success rate in attacking the target detection model. Summary of the Invention

[0004] The model training method, adversarial example generation method, and related apparatus provided in this application are used to attack the target detection model using adversarial examples generated by the trained adversarial example generation model, thereby improving the success rate of attacking the target detection model.

[0005] In a first aspect, embodiments of this application provide a model training method, including:

[0006] Based on the constructed adversarial example generation model and the original image, preliminary test samples are generated, and the realism loss between the preliminary test samples and the original image is determined.

[0007] Pixel gradient optimization is performed on the initial test samples to generate test samples, and the trajectory guidance loss between the test samples and the original image is determined.

[0008] The weighted total loss is determined based on the authenticity loss and trajectory guidance loss;

[0009] Based on the weighted total loss, the parameters of the adversarial example generation model are updated using backpropagation until the weighted total loss converges; the adversarial example generation model is used to generate adversarial examples.

[0010] In one possible implementation, pixel gradient optimization is performed on the initial test samples to generate test samples, including:

[0011] Target detection is performed on the preliminary test samples. Based on the target detection results and the ground truth corresponding to the original image, the recognition bias loss corresponding to the preliminary test samples is determined.

[0012] Using backpropagation, the pixel gradient map is determined based on the recognition bias loss and preliminary test samples;

[0013] Based on the pixel gradient map and the preset step size, the pixel value of any pixel in the preliminary test sample is updated to generate the current temporary sample;

[0014] By using an iterative approach, the target detection is re-performed on the current temporary sample to determine the corresponding recognition bias loss. Then, the optimization is performed along the direction that increases the gradient of the corresponding recognition bias loss to generate test samples.

[0015] In one possible implementation, the pixel value of any pixel in the initial test sample is updated based on the pixel gradient map and a preset step size, including:

[0016] Based on the pixel gradient map, determine the gradient increment direction corresponding to any pixel.

[0017] The disturbance displacement increment is determined based on the product of the gradient increment direction and the preset step size;

[0018] The pixel value of any pixel in the preliminary test sample is updated based on the perturbation displacement increment.

[0019] In one possible implementation, the gradient increment direction is the gradient upward direction that causes the recognition bias loss corresponding to the pixel gradient map.

[0020] In one possible implementation, after generating the current temporary sample, the process further includes:

[0021] Determine the absolute numerical difference between the pixel value at any identical pixel coordinate point in the current temporary sample and the original image;

[0022] When the absolute difference of the value corresponding to the target pixel is determined to be greater than the upper limit of the preset modification radius, the pixel value of the target pixel is updated based on the projection truncation operator; where the target pixel is any pixel in the current temporary sample;

[0023] Update the current temporary sample based on the target pixel after the pixel value is updated.

[0024] In one possible implementation, determining the trajectory-guided loss between the test sample and the original image includes:

[0025] Based on the test samples and the original image, the pixel difference matrix is ​​determined and denoted as the ideal guiding trajectory.

[0026] Based on the adversarial example generation model and the original image, an original perturbation layer is generated;

[0027] Based on the ideal guiding trajectory and the original interference layer, determine the pixel distance at any identical pixel coordinate point;

[0028] The distances between pixels are summed, and the summation value is recorded as the trajectory guidance loss.

[0029] In one possible implementation, determining the pixel distance at any identical pixel coordinate point based on the ideal guiding trajectory and the original interference layer includes:

[0030] Select the pixel points at the same pixel coordinates as the ideal guiding trajectory and the original interference layer, and denote them as the first pixel point and the second pixel point, respectively.

[0031] Calculate the numerical differences of the RGB three channels between the first pixel and the second pixel in turn;

[0032] Sum the numerical differences and record the sum of the differences as the pixel distance.

[0033] In one possible implementation, before determining the weighted total loss based on authenticity loss and trajectory guidance loss, the following steps are also included:

[0034] Based on the adversarial example generation model and the original image, an original perturbation layer is generated, and based on the original perturbation layer, the smoothness loss is determined;

[0035] Target detection is performed on the preliminary test samples. Based on the target detection results and the ground truth corresponding to the original image, the recognition bias loss corresponding to the preliminary test samples is determined.

[0036] The authenticity loss, identification bias loss, trajectory guidance loss, and smoothness loss are weighted and summed, and the weighted sum is recorded as the weighted total loss.

[0037] In one possible implementation, the smoothness loss is determined based on the original interference layer, including:

[0038] By traversing through the data, the absolute value of the grayscale difference between any pixel in the original interference layer and its neighboring pixels is calculated.

[0039] The absolute values ​​of the grayscale differences are summed, and the corresponding summation value is recorded as the smoothness loss.

[0040] In one possible implementation, target detection is performed on the preliminary test samples, and the recognition bias loss corresponding to the preliminary test samples is determined based on the ground truth value corresponding to the target detection result and the original image, including:

[0041] Target detection is performed on the initial test samples to determine the prediction category probability, prediction box position, and target confidence score for any predicted target.

[0042] The class determination bias is determined based on the predicted class probability and the true class corresponding to the original image.

[0043] Based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image, the position regression bias is determined;

[0044] The squared difference between the target confidence score and the ideal misjudged target is denoted as the target score bias.

[0045] The judgment bias, position regression bias, and target score bias are summed, and the summation value is recorded as the recognition bias loss.

[0046] In one possible implementation, the class determination bias is determined based on the predicted class probability and the true class corresponding to the original image, including:

[0047] Calculate the cross-entropy loss between the predicted class probability and the true class, denoted as the class decision bias.

[0048] In one possible implementation, determining the location regression bias based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image includes:

[0049] Calculate the cross-union ratio (CUI) deviation between the predicted bounding box position and the actual bounding box position, denoted as the position regression deviation.

[0050] In one possible implementation, determining the realism loss between the initial test sample and the original image includes:

[0051] Using a quality discrimination network, the first confidence score of the original image and the second confidence score of the preliminary test sample are determined respectively.

[0052] Calculate the squared difference between the first confidence score and the true value label, and calculate the squared difference between the second confidence score and the false value label;

[0053] Calculate the average of the squared first difference and the squared second difference, and denote the average as the authenticity loss.

[0054] In one possible implementation, preliminary test samples are generated based on the constructed adversarial example generation model and the original image, including:

[0055] Based on the adversarial example generation model, features are extracted from the original image, and the extracted features are reconstructed into a numerical matrix, denoted as the original interference layer. The original interference layer has the same size as the original image, and the pixels in the original image correspond one-to-one with the elements in the original interference layer.

[0056] Calculate the sum of the pixel value of any pixel in the original image and its corresponding element, and record the corresponding pixel sum as the sample pixel value;

[0057] A preliminary test sample is generated based on the sample pixel values.

[0058] Secondly, embodiments of this application provide an adversarial example generation method, including:

[0059] Acquire the target image;

[0060] The target image is input into the trained adversarial example generation model to obtain adversarial examples of the target image; wherein the trained adversarial example generation model is a model determined according to the first aspect and / or various possible implementations of the first aspect as described above.

[0061] Thirdly, embodiments of this application provide a model training apparatus, comprising:

[0062] The first loss determination unit is used to generate preliminary test samples based on the constructed adversarial example generation model and the original image, and to determine the realism loss between the preliminary test samples and the original image.

[0063] The second loss determination unit is used to perform pixel gradient optimization on the preliminary test samples, generate test samples, and determine the trajectory guidance loss between the test samples and the original image.

[0064] The third loss determination unit is used to determine the weighted total loss based on the authenticity loss and trajectory guidance loss;

[0065] The parameter update unit is used to update the parameters of the adversarial example generation model based on the weighted total loss using backpropagation, until the weighted total loss converges; wherein, the adversarial example generation model is used to generate adversarial examples.

[0066] In one possible implementation, pixel gradient optimization is performed on the initial test samples to generate test samples, including:

[0067] Target detection is performed on the preliminary test samples. Based on the target detection results and the ground truth corresponding to the original image, the recognition bias loss corresponding to the preliminary test samples is determined.

[0068] Using backpropagation, the pixel gradient map is determined based on the recognition bias loss and preliminary test samples;

[0069] Based on the pixel gradient map and the preset step size, the pixel value of any pixel in the preliminary test sample is updated to generate the current temporary sample;

[0070] By using an iterative approach, the target detection is re-performed on the current temporary sample to determine the corresponding recognition bias loss. Then, the optimization is performed along the direction that increases the gradient of the corresponding recognition bias loss to generate test samples.

[0071] In one possible implementation, the pixel value of any pixel in the initial test sample is updated based on the pixel gradient map and a preset step size, including:

[0072] Based on the pixel gradient map, determine the gradient increment direction corresponding to any pixel.

[0073] The disturbance displacement increment is determined based on the product of the gradient increment direction and the preset step size;

[0074] The pixel value of any pixel in the preliminary test sample is updated based on the perturbation displacement increment.

[0075] In one possible implementation, the gradient increment direction is the gradient upward direction that causes the recognition bias loss corresponding to the pixel gradient map.

[0076] In one possible implementation, after generating the current temporary sample, the process further includes:

[0077] Determine the absolute numerical difference between the pixel value at any identical pixel coordinate point in the current temporary sample and the original image;

[0078] When the absolute difference of the value corresponding to the target pixel is determined to be greater than the upper limit of the preset modification radius, the pixel value of the target pixel is updated based on the projection truncation operator; where the target pixel is any pixel in the current temporary sample;

[0079] Update the current temporary sample based on the target pixel after the pixel value is updated.

[0080] In one possible implementation, determining the trajectory-guided loss between the test sample and the original image includes:

[0081] Based on the test samples and the original image, the pixel difference matrix is ​​determined and denoted as the ideal guiding trajectory.

[0082] Based on the adversarial example generation model and the original image, an original perturbation layer is generated;

[0083] Based on the ideal guiding trajectory and the original interference layer, determine the pixel distance at any identical pixel coordinate point;

[0084] The distances between pixels are summed, and the summation value is recorded as the trajectory guidance loss.

[0085] In one possible implementation, determining the pixel distance at any identical pixel coordinate point based on the ideal guiding trajectory and the original interference layer includes:

[0086] Select the pixel points at the same pixel coordinates as the ideal guiding trajectory and the original interference layer, and denote them as the first pixel point and the second pixel point, respectively.

[0087] Calculate the numerical differences of the RGB three channels between the first pixel and the second pixel in turn;

[0088] Sum the numerical differences and record the sum of the differences as the pixel distance.

[0089] In one possible implementation, before determining the weighted total loss based on authenticity loss and trajectory guidance loss, the following steps are also included:

[0090] Based on the adversarial example generation model and the original image, an original perturbation layer is generated, and based on the original perturbation layer, the smoothness loss is determined;

[0091] Target detection is performed on the preliminary test samples. Based on the target detection results and the ground truth corresponding to the original image, the recognition bias loss corresponding to the preliminary test samples is determined.

[0092] The authenticity loss, identification bias loss, trajectory guidance loss, and smoothness loss are weighted and summed, and the weighted sum is recorded as the weighted total loss.

[0093] In one possible implementation, the smoothness loss is determined based on the original interference layer, including:

[0094] By traversing through the data, the absolute value of the grayscale difference between any pixel in the original interference layer and its neighboring pixels is calculated.

[0095] The absolute values ​​of the grayscale differences are summed, and the corresponding summation value is recorded as the smoothness loss.

[0096] In one possible implementation, target detection is performed on the preliminary test samples, and the recognition bias loss corresponding to the preliminary test samples is determined based on the ground truth value corresponding to the target detection result and the original image, including:

[0097] Target detection is performed on the initial test samples to determine the prediction category probability, prediction box position, and target confidence score for any predicted target.

[0098] The class determination bias is determined based on the predicted class probability and the true class corresponding to the original image.

[0099] Based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image, the position regression bias is determined;

[0100] The squared difference between the target confidence score and the ideal misjudged target is denoted as the target score bias.

[0101] The judgment bias, position regression bias, and target score bias are summed, and the summation value is recorded as the recognition bias loss.

[0102] In one possible implementation, the class determination bias is determined based on the predicted class probability and the true class corresponding to the original image, including:

[0103] Calculate the cross-entropy loss between the predicted class probability and the true class, denoted as the class decision bias.

[0104] In one possible implementation, determining the location regression bias based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image includes:

[0105] Calculate the cross-union ratio (CUI) deviation between the predicted bounding box position and the actual bounding box position, denoted as the position regression deviation.

[0106] In one possible implementation, determining the realism loss between the initial test sample and the original image includes:

[0107] Using a quality discrimination network, the first confidence score of the original image and the second confidence score of the preliminary test sample are determined respectively.

[0108] Calculate the squared difference between the first confidence score and the true value label, and calculate the squared difference between the second confidence score and the false value label;

[0109] Calculate the average of the squared first difference and the squared second difference, and denote the average as the authenticity loss.

[0110] In one possible implementation, preliminary test samples are generated based on the constructed adversarial example generation model and the original image, including:

[0111] Based on the adversarial example generation model, features are extracted from the original image, and the extracted features are reconstructed into a numerical matrix, denoted as the original interference layer. The original interference layer has the same size as the original image, and the pixels in the original image correspond one-to-one with the elements in the original interference layer.

[0112] Calculate the sum of the pixel value of any pixel in the original image and its corresponding element, and record the corresponding pixel sum as the sample pixel value;

[0113] A preliminary test sample is generated based on the sample pixel values.

[0114] Fourthly, embodiments of this application provide an adversarial sample generation apparatus, comprising:

[0115] The acquisition unit is used to acquire the target image;

[0116] A generation unit is used to input a target image into a trained adversarial example generation model to obtain adversarial examples of the target image; wherein the trained adversarial example generation model is a model determined according to the first aspect and / or various possible implementations of the first aspect as described above.

[0117] Fifthly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0118] The memory stores instructions that the computer executes;

[0119] The processor executes computer execution instructions stored in memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above, or to perform the second aspect and / or various possible implementations of the second aspect as described above.

[0120] In a sixth aspect, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect, or to implement the second aspect and / or various possible implementations of the second aspect.

[0121] In a seventh aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect, or implements the second aspect and / or various possible implementations of the second aspect.

[0122] The model training method, adversarial example generation method, and related apparatus provided in this application generate preliminary test samples corresponding to the original image using an adversarial example generation model. Then, pixel gradient optimization is performed on the preliminary test samples, and pixel-level refinement iteration is carried out to obtain refined test samples. The trajectory guidance loss between the test samples and the original image is determined as a supervision signal to guide the output of the adversarial example generation model. This ensures high attack concealment while improving the success rate of the adversarial samples generated by the model in attacking the target detection model under test. Attached Figure Description

[0123] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0124] Figure 1 This is a schematic diagram illustrating a scenario for attack testing of the target detection model provided in this application.

[0125] Figure 2 Flowchart of the model training method provided in this application Figure 1 ;

[0126] Figure 3 A schematic flowchart illustrating the generation of preliminary test samples provided for this application;

[0127] Figure 4 Flowchart of the model training method provided in this application Figure 2 ;

[0128] Figure 5 A schematic flowchart illustrating the process of generating test samples provided in this application;

[0129] Figure 6 Flowchart of the model training method provided in this application Figure 3 ;

[0130] Figure 7 A schematic flowchart illustrating the trajectory guidance loss calculation process provided in this application;

[0131] Figure 8 Flowchart of the model training method provided in this application Figure 4 ;

[0132] Figure 9 A schematic flowchart illustrating the process of calculating the authenticity loss provided for this application;

[0133] Figure 10 A schematic flowchart illustrating the weighted total loss calculation process provided for this application;

[0134] Figure 11 A schematic flowchart illustrating the identification bias loss calculation process provided in this application;

[0135] Figure 12 A schematic block diagram illustrating the training process of the adversarial example generation model provided in this application;

[0136] Figure 13 A schematic flowchart illustrating the training process of the adversarial example generation model provided in this application;

[0137] Figure 14 This is a schematic block diagram illustrating the application scenario of autonomous driving traffic sign detection provided in this application;

[0138] Figure 15 A flowchart illustrating the adversarial example generation method provided in this application;

[0139] Figure 16 A schematic diagram of the structure of the model training device provided in this application;

[0140] Figure 17 A schematic diagram of the adversarial sample generation device provided in this application;

[0141] Figure 18 A schematic diagram of the structure of the electronic device provided in this application.

[0142] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0143] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0144] First, let me explain the terms used in this application:

[0145] Adversarial examples are samples constructed by injecting specific, minimal-amplitude, non-random perturbations into original benign samples. Leveraging the sensitivity of deep learning models' decision boundaries, adversarial examples induce severe biases in the model's judgment of input signals by finding the steepest ascent direction of the model's loss function. This can cause target detectors to miss detections, misclassify, or drift in localization. Adversarial examples play a crucial supporting role in enhancing the robustness verification of visual algorithms and evaluating system security.

[0146] Generative Adversarial Networks (GANs) are a joint probability distribution modeling algorithm consisting of a generator and a discriminator. This algorithm employs a minimax game mechanism for alternating iterative optimization: the perturbation generation network (generator) synthesizes high-fidelity adversarial perturbation signals by capturing the latent manifold distribution characteristics of real data; the quality discrimination network (discriminator) guides the generator's optimization by evaluating the probability density difference between the synthesized signal and the real signal, acting as the discriminator.

[0147] Black-box testing refers to a testing method that probes the performance or security of a system under test solely through the interaction of input signals and output results, without knowing the internal structure, parameter weights, and algorithm implementation of the target system. In the context of adversarial attacks, black-box attacks mean that attackers cannot directly access the gradient information of the detector and can only construct adversarial examples through the predictive feedback of the model output.

[0148] Oversmoothing refers to the image processing phenomenon of covering an image with a uniform layer of white noise, like a thick fog, which causes the loss of image details and is easily detected by defense algorithms.

[0149] Attack Success Rate (ASR) refers to the proportion of samples in an adversarial attack game in which the generated adversarial sample successfully induces the target detection model to produce a pre-defined judgment failure (including but not limited to target miss detection, false positives, or significant bounding box offsets). It is a core indicator for quantitatively evaluating the detection effectiveness of an attack system.

[0150] Adaptive guidance refers to a mechanism that dynamically adjusts the weights of interference intensity in different local regions based on the semantic content of the input image and the feedback gradient of the detector. It aims to conceal the background region while enhancing the attack power on decision-sensitive regions.

[0151] Projection truncation operator: This refers to a mathematical truncation operation used in the iterative generation of adversarial examples to ensure that pixel value updates always remain within a preset modification radius. Within. When the numerical offset of a pixel exceeds the legal range based on the original image. At this time, the operator will force the value to be mapped back to the nearest boundary value, thereby maintaining the attack strength while ensuring the visual imperceptibility of the interference. The value of is usually a very small value (such as 8 / 255).

[0152] In modern computer vision systems, object detection models, as core components of the perception layer, perform the dual functions of object classification and localization. However, the sensitivity of this model's algorithmic structure makes it highly susceptible to malicious interference from adversarial examples. Therefore, a thorough analysis of the generation mechanisms of adversarial attacks and the construction of efficient perturbation schemes are crucial prerequisites for evaluating and improving the robustness of the model.

[0153] Figure 1 This is a schematic diagram illustrating a scenario for attack testing the target detection model provided in this application, such as... Figure 1 As shown, after obtaining the original semantic image (original image), the corresponding interference signal is obtained by using the interference generation network, and then the adversarial image is obtained by combining the original semantic image. On the one hand, the target detection model under test is attacked and tested, and on the other hand, it can be input into the quality discrimination network to guide the interference generation network to optimize.

[0154] Such adversarial attack techniques, especially when dealing with advanced detectors with novel prediction heads or end-to-end architectures, make it difficult for the generated attack samples (adversarial samples) to maintain a stable attack success rate. This limits the ability to covertly detect model security vulnerabilities in complex traffic or security scenarios.

[0155] The model training method and adversarial example generation method provided in this application solve the technical problem of low success rate of attacking target detection models by generating adversarial examples. After generating preliminary test samples corresponding to the original image using the adversarial example generation model, the pixel gradient of the preliminary test samples is optimized and refined at the pixel level through iteration to obtain refined test samples. The trajectory guidance loss between the test samples and the original image is determined as a supervision signal to guide the output of the adversarial example generation model.

[0156] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0157] Figure 2 Flowchart of the model training method provided in this application Figure 1 ,like Figure 2 As shown, the method includes:

[0158] S201. Based on the constructed adversarial example generation model and the original image, generate preliminary test samples and determine the realism loss between the preliminary test samples and the original image.

[0159] In this embodiment, a generator is used as an interference generation network to construct an adversarial example generation model, and its internal parameter weights are set as follows. Using a discriminator as the quality identification network, its internal parameter weights are set as follows: The target detection model under test is denoted as The original image is denoted as x, and the initial test sample is denoted as x. .

[0160] Figure 3 A schematic flowchart for generating preliminary test samples is provided for this application, such as Figure 3 As shown, after constructing the above environment, the original image x is input into the adversarial example generation model to extract its deep semantic features and generate an original interference layer that can mislead the detection logic in the target detection model being tested. Then the original interference layer is obtained. The sample is overlaid with the original image x to generate a preliminary test sample. .

[0161] Next, the original image x is compared with the initial test sample. The image is fed into a quality discrimination network to perform visual concealment verification based on pixel block features. Then, based on the network's recognition results, such as true / false labels, the authenticity loss between the initial test sample and the original image is calculated, denoted as... .

[0162] The loss of authenticity This constraint signal will be fed back to the adversarial example generation model via the backpropagation link. In subsequent training, the adversarial example generation model automatically suppresses the perturbation intensity in non-target regions by performing gradient descent iterative optimization on the squared deviation between the initial test sample discrimination score and the ground truth label 1 in the current training round. This achieves deep fusion of the interference signal and the background texture, ensuring its concealment.

[0163] S202. Perform pixel gradient optimization on the preliminary test samples to generate test samples, and determine the trajectory guidance loss between the test samples and the original image.

[0164] In this embodiment, starting with the initial test sample, a pixel gradient optimization method is used to perform multiple rounds of pixel-level refinement optimization in order to use local gradient information to supplement the prediction accuracy of the model and penetrate the defense of the tested model.

[0165] When performing pixel-level refinement optimization, recognition bias loss can be introduced, which provides a basis for improving the success rate of attacks on the tested target detection model by generated adversarial samples. The recognition bias loss can be a loss that reflects the degree of misjudgment by the tested target detection model, and is determined by the detection results of the target detection model on the preliminary test samples.

[0166] Starting with the initial test sample, along the gradient ascending direction that further amplifies the recognition bias loss, a perturbation displacement increment is added to the value of each pixel in the initial test sample to obtain the current temporary sample for the current round.

[0167] Next, the current temporary sample is input into the target detection model, the recognition bias loss is recalculated, and the above process is repeated until the preset number of rounds is reached to obtain the final test sample, denoted as . .

[0168] After obtaining the test sample Next, the test samples were calculated. The pixel difference between the original image x and the original image x is used as the ideal guiding trajectory, and then the corresponding trajectory guiding loss is obtained based on the ideal guiding trajectory.

[0169] When calculating the trajectory guidance loss, the pixel coordinates of the pixels in the original image can be used as a reference to calculate the original interference layer at each pixel coordinate. The distance between the target trajectory and the ideal guiding trajectory is used as the sum of these distances as the trajectory guiding loss.

[0170] S203. Determine the weighted total loss based on the authenticity loss and trajectory guidance loss.

[0171] In this embodiment, the weighted total loss can be calculated by weighting and summing the authenticity loss and the trajectory guidance loss. When weighting, other sub-losses can also be introduced, such as the identification deviation loss mentioned above and the smoothness loss that can reflect the continuity of the disturbance space. The specific losses introduced can be set according to the actual situation.

[0172] When performing weighted calculations, different weight values ​​can be set for different losses, or the same weight value can be set, but it is necessary to ensure that the sum of all weight values ​​is 1.

[0173] S204. Based on the weighted total loss, the parameters of the adversarial example generation model are updated using backpropagation until the weighted total loss converges; wherein, the adversarial example generation model is used to generate adversarial examples.

[0174] In this embodiment, backpropagation can be used to adjust the weights of the adversarial example generation model based on the derivative of the weighted total loss with respect to the parameters of the adversarial example generation model. Perform gradient descent updates and repeat the above process until the weighted total loss converges, and the adversarial example generation model enters a steady state.

[0175] In this embodiment, initial iterative statistics can be performed on each sub-loss to obtain its initial numerical range under the same dimensions, and the initial scaling factor can be set accordingly to ensure that each sub-loss is on the same order of magnitude. Subsequently, a hyperparameter grid search is performed on the validation dataset to maximize the success rate of subsequent generated adversarial examples in attacking the tested target detection model while ensuring that the visual naturalness score is a constraint objective, and finally determining the optimal fixed scaling combination.

[0176] The model training method provided in this application generates preliminary test samples corresponding to the original image using an adversarial sample generation model. Then, pixel gradient optimization is performed on the preliminary test samples, and pixel-level refinement iteration is carried out to obtain refined test samples. The trajectory guidance loss between the test samples and the original image is determined as a supervision signal to guide the output of the adversarial sample generation model, so that the adversarial sample generation model generates adversarial sample images with higher concealment and attack power, thereby improving the success rate of attacking the target detection model.

[0177] The model training method in this application optimizes the pixel gradient of the initial test samples, enabling the trained adversarial sample generation model to accurately infer the differences in sensitivity of local image to interference. This effectively eliminates the visual visibility caused by "oversmoothing" or visual artifacts, allowing adversarial perturbations to be deeply integrated into the background texture of the image, greatly improving the concealment of the attack.

[0178] Figure 4 Flowchart of the model training method provided in this application Figure 2 ,like Figure 4 As shown, in this embodiment... Figure 2 Based on the examples, the model training method is described in detail, which includes:

[0179] S401. Based on the constructed adversarial example generation model and the original image, generate preliminary test samples and determine the realism loss between the preliminary test samples and the original image.

[0180] S402. Perform target detection on the preliminary test samples, and determine the recognition bias loss corresponding to the preliminary test samples based on the target detection results and the ground truth corresponding to the original image.

[0181] S403. Using backpropagation, based on the recognition bias loss and preliminary test samples, determine the pixel gradient map.

[0182] S404. Based on the pixel gradient map and preset step size, update the pixel value of any pixel in the preliminary test sample to generate the current temporary sample.

[0183] S405. Using an iterative approach, re-detect the target on the current temporary sample, determine the corresponding recognition bias loss, and optimize along the direction that increases the gradient of the corresponding recognition bias loss to generate test samples.

[0184] In this embodiment, preliminary test samples are input into the target detection model. Based on the target recognition results and the ground truth of the original image, the corresponding recognition bias loss is calculated. Then, using backpropagation with the initial test samples as the starting point for optimization, the partial derivative of the recognition bias loss with respect to the coordinates of a given pixel in the original image is calculated, yielding the corresponding pixel gradient map, denoted as... The pixel gradient map calculated in this way can indicate the direction of pixel modification that will maximize the attack success rate (ASR) of the generated adversarial example against the tested target detection model at the pixel level.

[0185] After obtaining the pixel gradient map Then, along the gradient ascent direction that further amplifies the recognition bias loss, a perturbation displacement increment is added to the pixel value of each pixel in the initial test sample to perform directional enhancement update of the pixel value, resulting in the current temporary sample with updated pixel value.

[0186] In one possible implementation, based on the pixel gradient map and a preset step size, the pixel value of any pixel in the initial test sample is updated, including:

[0187] Based on the pixel gradient map, determine the gradient increment direction corresponding to any pixel.

[0188] The disturbance displacement increment is determined based on the product of the gradient increment direction and the preset step size;

[0189] The pixel value of any pixel in the preliminary test sample is updated based on the perturbation displacement increment.

[0190] In one possible implementation, the gradient increment direction is the direction of gradient ascent that causes the recognition bias loss corresponding to the pixel gradient map.

[0191] In this embodiment, when determining the perturbation displacement increment, the product of the gradient increment direction and the preset step size can be selected. In this way, the positive and negative displacement of each pixel in the color space can be directly controlled by the perturbation displacement increment, thereby achieving directional enhancement of the anti-interference strength and improving the attack success rate of the generated adversarial sample on the target detection model under test at the pixel level.

[0192] Then, the next round of optimization is performed, and the current temporary sample is input again into the target detection model. The corresponding recognition bias loss is recalculated, and optimization is performed along the direction that increases the gradient of the corresponding recognition bias loss. The above optimization process of "gradient acquisition-pixel update-projection constraint" is repeated until the set number of iterations (such as 10 or 20 times) is reached, generating the final refined optimal detection sample, i.e., the test sample. .

[0193] S406. Determine the trajectory guidance loss between the test sample and the original image.

[0194] S407. Determine the weighted total loss based on the authenticity loss and trajectory guidance loss.

[0195] S408. Based on the weighted total loss, the parameters of the adversarial example generation model are updated using backpropagation until the weighted total loss converges; wherein, the adversarial example generation model is used to generate adversarial examples.

[0196] In one possible implementation, after generating the current temporary sample, the following steps are also included:

[0197] Determine the absolute numerical difference between the pixel value at any identical pixel coordinate point in the current temporary sample and the original image;

[0198] When the absolute difference of the value corresponding to the target pixel is determined to be greater than the upper limit of the preset modification radius, the pixel value of the target pixel is updated based on the projection truncation operator; where the target pixel is any pixel in the current temporary sample;

[0199] Update the current temporary sample based on the target pixel after the pixel value is updated.

[0200] Figure 5 A schematic flowchart illustrating the process of generating test samples provided in this application is shown below. Figure 5As shown, based on the above embodiments, in order to ensure the imperceptibility of the current temporary sample updated based on the perturbation displacement increment, a projection truncation operator can be introduced to perform amplitude truncation operation on the pixel values ​​in the current temporary sample.

[0201] After completing each round of pixel updates and obtaining the current temporary sample, the absolute difference between the pixel value of the current temporary sample and the pixel value of the original image at the same position is calculated. This absolute difference is used to indicate the numerical offset of the corresponding RGB channel.

[0202] If the absolute difference exceeds the preset modification radius limit (i.e. the maximum allowed pixel color modification threshold), the projection truncation operator is used to forcibly constrain the corresponding pixel value within the radius boundary based on the original image, update the pixel value of the corresponding pixel, and obtain the updated current temporary sample, thereby improving the imperceptibility of the current temporary sample and the final test sample.

[0203] The model training method provided in this application, when generating test samples, utilizes the recognition bias loss and introduces a pixel gradient map. Along the gradient ascent direction that further expands the recognition bias loss, the pixel values ​​are directionally enhanced and updated. The pixel-level gradient feedback significantly enhances the penetration of the added perturbation displacement increment on the target detection model (especially the target detection model based on heterogeneous architecture). This effectively improves the success rate of adversarial examples attacking the tested target detection model in black-box scenarios, and provides a highly concealed and powerful vulnerability detection technology for perception algorithms in high-risk scenarios such as complex traffic.

[0204] Figure 6 Flowchart of the model training method provided in this application Figure 3 ,like Figure 6 As shown, in this embodiment... Figure 2 Based on the examples, the model training method is described in detail, which includes:

[0205] S601. Based on the constructed adversarial example generation model and the original image, generate preliminary test samples and determine the realism loss between the preliminary test samples and the original image.

[0206] S602. Perform pixel gradient optimization on the preliminary test samples to generate test samples;

[0207] S603. Based on the test sample and the original image, determine the pixel difference matrix and denot it as the ideal guiding trajectory;

[0208] S604. Generate the original interference layer based on the adversarial example generation model and the original image;

[0209] S605. Based on the ideal guiding trajectory and the original interference layer, determine the pixel distance at any identical pixel coordinate point;

[0210] S606. The distances between pixels are summed, and the corresponding summation value is recorded as the trajectory guidance loss.

[0211] Figure 7 The schematic flowchart of the trajectory guidance loss calculation process provided in this application is based on the above embodiments, such as... Figure 7 As shown, after producing the test samples, the test samples are first calculated. The pixel difference between the original image x and the pixel difference matrix is ​​obtained. This pixel difference matrix is ​​defined as the optimal detection path, i.e., the ideal guiding trajectory, for the current input content. .

[0212] Then, the original image x is processed using the anti-sample generation model described above to obtain the original interference layer. Then calculate the original interference layer. With the above ideal guiding trajectory Corresponding pixels at the same pixel coordinates Distance (pixel distance) is the sum of the absolute differences between the values ​​of the same spatial coordinates and the values ​​of the three channels R, G, and B under the same channel.

[0213] Then, sum the pixel distances mentioned above to obtain the final trajectory guidance loss. In order to use this trajectory to guide the loss This guides the adversarial example generation model to apply different levels of intervention in different semantic regions (such as the center and edge of the target).

[0214] In one possible implementation, the pixel distance at any identical pixel coordinate point is determined based on the ideal guiding trajectory and the original interference layer, including:

[0215] Select the pixel points at the same pixel coordinates as the ideal guiding trajectory and the original interference layer, and denote them as the first pixel point and the second pixel point, respectively.

[0216] Calculate the numerical differences of the RGB three channels between the first pixel and the second pixel in turn;

[0217] Sum the numerical differences and record the sum of the differences as the pixel distance.

[0218] S607. Determine the weighted total loss based on the authenticity loss and trajectory guidance loss.

[0219] S608. Based on the weighted total loss, the parameters of the adversarial example generation model are updated using backpropagation until the weighted total loss converges; wherein, the adversarial example generation model is used to generate adversarial examples.

[0220] This application provides a model training method that uses the pixel difference matrix between the test sample and the original image as an ideal guiding trajectory to obtain the trajectory guidance loss. This loss is then weighted and summed with smoothness loss, realism loss, and recognition bias loss to obtain a weighted total loss. The time-consuming pixel-level gradient optimization process is transformed into a one-time parameter mapping inference of the neural network, thereby significantly improving the efficiency of adversarial example generation. Furthermore, by combining the generated test samples with pixel gradient optimization, the concealment of the test samples can be improved without destroying the natural texture of the image. This increases the success rate of attacks that trigger severe recognition bias in cross-model black-box evaluation with minimal cost.

[0221] Figure 8 Flowchart of the model training method provided in this application Figure 4 ,like Figure 8 As shown, in this embodiment... Figure 2 Based on the examples, the model training method is described in detail, which includes:

[0222] S801. Based on the constructed adversarial example generation model and the original image, generate preliminary test samples and determine the realism loss between the preliminary test samples and the original image.

[0223] In one possible implementation, preliminary test samples are generated based on the constructed adversarial example generation model and the original image, including:

[0224] Based on the adversarial example generation model, features are extracted from the original image, and the extracted features are reconstructed into a numerical matrix, denoted as the original interference layer. The original interference layer has the same size as the original image, and the pixels in the original image correspond one-to-one with the elements in the original interference layer.

[0225] Calculate the sum of the pixel value of any pixel in the original image and its corresponding element, and record the corresponding pixel sum as the sample pixel value;

[0226] A preliminary test sample is generated based on the sample pixel values.

[0227] In this embodiment, based on the adversarial example generation model, multi-scale convolutional feature extraction is performed in the model's encoding layer, and nonlinear mapping is performed in the bottleneck layer of the model. Subsequently, the model's decoding layer reconstructs the mapped features into a floating-point numerical matrix of the same size as the original image x. This numerical matrix is ​​denoted as the original interference layer. .

[0228] Subsequently, due to the pixels in the original image x being different from those in the original interference layer... The elements in the matrix (i.e., matrix elements in the numerical matrix) correspond one-to-one. Pixel-level arithmetic summation can be performed on both, calculating the sum of pixel values ​​at the same spatial coordinates (pixel coordinates) of the original image x and the original interference layer G(x). This pixel sum is recorded as the sample pixel value. Finally, based on this sample pixel value, a preliminary test sample with the same size as the original image x can be obtained.

[0229] In one possible implementation, determining the realism loss between the initial test sample and the original image includes:

[0230] Using a quality discrimination network, the first confidence score of the original image and the second confidence score of the preliminary test sample are determined respectively.

[0231] Calculate the squared difference between the first confidence score and the true value label, and calculate the squared difference between the second confidence score and the false value label;

[0232] Calculate the average of the squared first difference and the squared second difference, and denote the average as the authenticity loss.

[0233] Figure 9 A schematic flowchart illustrating the process of calculating the authenticity loss provided for this application, such as... Figure 9 As shown, based on the above embodiments, the ideal ground truth label of the original image x is set to 1, and preliminary test samples are used. The ideal false label is 0. The confidence scores of the quality discrimination network for the input original image x and the preliminary test sample are as follows: and .

[0234] First, combine the original image x and the initial test sample. Simultaneously, the data is input into a quality discrimination network to extract the texture and edge distribution features of both images at the local pixel block level, yielding the original image x and the preliminary test sample. The confidence score and the discrimination score are respectively denoted as the first confidence score and the second confidence score.

[0235] Next, the squared difference between the first confidence score and the ideal ground truth label 1 of the original image x is calculated and denoted as the first squared difference; then the second confidence score is calculated and compared with the initial test sample. The squared difference of the ideal false value label 0 is denoted as the second squared difference.

[0236] Finally, the average of the squared first difference and the squared second difference is calculated to obtain the authenticity loss, which reflects the degree of falsehood in the generated perturbation. .

[0237] The technical solution in this embodiment utilizes the statistical perception of local pixel blocks in an image by a quality discrimination network, forcing the adversarial sample generation model to adaptively suppress the perturbation intensity of non-target regions during training. This enables the model trained in this way to generate adversarial samples with high concealment, thereby helping to improve its success rate in attacking the target detection model under test.

[0238] S802. Perform pixel gradient optimization on the preliminary test samples to generate test samples, and determine the trajectory guidance loss between the test samples and the original image.

[0239] S803. Based on the adversarial example generation model and the original image, generate the original interference layer, and determine the smoothness loss based on the original interference layer;

[0240] S804. Perform target detection on the preliminary test samples, and determine the recognition bias loss corresponding to the preliminary test samples based on the target detection results and the ground truth corresponding to the original image.

[0241] S805, Loss of Authenticity Recognition bias loss, trajectory guidance loss The smoothness loss is weighted and summed, and the weighted sum is recorded as the weighted total loss.

[0242] Figure 10 A schematic flowchart illustrating the weighted total loss calculation process provided for this application, such as... Figure 10 As shown, based on the above embodiments, the weighted total loss is set to... Smoothness loss is The identification bias loss is The loss of authenticity is calculated by weighting. Identification bias loss Trajectory-guided loss and smoothness loss The weighted summation is denoted as the weighted total loss. Among them, smoothness loss The corresponding weight is Loss of authenticity The corresponding weight is Identification bias loss The corresponding weight is Trajectory-guided loss The corresponding weight is .

[0243] When performing weighted calculations, you can set... , , and Different weight values ​​can be set, or the same weight value can be set, but the sum of all weight values ​​must be 1.

[0244] In this embodiment, backpropagation can be used to adjust the weights of the adversarial example generation model based on the derivative of the weighted total loss with respect to the parameters of the adversarial example generation model. Perform gradient descent updates and repeat the above process until the weighted total loss converges, and the adversarial example generation model enters a steady state.

[0245] In this embodiment, initial iterative statistics can be performed on each sub-loss to obtain its initial numerical range under the same dimensions, and the initial scaling factor can be set accordingly to ensure that each sub-loss is on the same order of magnitude. Subsequently, a hyperparameter grid search is performed on the validation dataset to maximize the attack success rate of the generated adversarial examples on the tested target detection model while ensuring that the visual naturalness score is a constraint objective, and finally determine the optimal fixed scaling combination.

[0246] S806. Based on the weighted total loss, the parameters of the adversarial example generation model are updated using backpropagation until the weighted total loss converges; wherein, the adversarial example generation model is used to generate adversarial examples.

[0247] In one possible implementation, the smoothness loss is determined based on the original interference layer, including:

[0248] By traversing through the data, the absolute value of the grayscale difference between any pixel in the original interference layer and its neighboring pixels is calculated.

[0249] The absolute values ​​of the grayscale differences are summed, and the corresponding summation value is recorded as the smoothness loss.

[0250] In one possible implementation, target detection is performed on the preliminary test samples. Based on the ground truth value corresponding to the target detection result and the original image, the recognition bias loss corresponding to the preliminary test samples is determined, including:

[0251] Target detection is performed on the initial test samples to determine the prediction category probability, prediction box position, and target confidence score for any predicted target.

[0252] The class determination bias is determined based on the predicted class probability and the true class corresponding to the original image.

[0253] Based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image, the position regression bias is determined;

[0254] The squared difference between the target confidence score and the ideal misjudged target is denoted as the target score bias.

[0255] The judgment bias, position regression bias, and target score bias are summed, and the summation value is recorded as the recognition bias loss.

[0256] In one possible implementation, the class determination bias is determined based on the predicted class probability and the true class corresponding to the original image, including:

[0257] Calculate the cross-entropy loss between the predicted class probability and the true class, denoted as the class decision bias.

[0258] In one possible implementation, the location regression bias is determined based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image, including:

[0259] Calculate the cross-union ratio (CUI) deviation between the predicted bounding box position and the actual bounding box position, denoted as the position regression deviation.

[0260] In this embodiment, a target detection model is set. For preliminary test samples The predicted bounding box position of the target detection result is The predicted class probability is The target confidence score is The ground truth label information corresponding to the original image x includes at least the location of the ground truth bounding box. and real category .

[0261] Figure 11 A schematic flowchart illustrating the identification bias loss calculation process provided in this application is shown below. Figure 11 As shown, based on the above embodiments, firstly, the predicted category probability is calculated. Compared to the real category The cross-entropy loss between them yields the class bias, which reflects the degree of class misjudgment, denoted as . .

[0262] Then, the predicted box position is calculated as follows: relative to the actual frame position The crossover ratio deviation between the two is calculated as the difference in spatial overlap between them, yielding the position regression deviation, which reflects the degree of degradation in positioning accuracy. This deviation is denoted as... .

[0263] Then calculate the target confidence score. The squared difference between the numerical value of the target and the ideal misjudged target yields the target score bias, which reflects the bias in the determination of the target's existence. The value of the ideal misjudged target can be set according to actual needs. For example, if the attack target is set to make a certain object in the original image "disappear", then its ideal score is 0.

[0264] Finally, the above category judgment biases will be addressed. Location regression bias and target score bias The weighted summation is performed, and the output is the recognition bias loss, which reflects the degree of misjudgment by the tested model. This will be used as a benchmark for attack strength and will be used together in subsequent gradient backpropagation optimization.

[0265] Through the methods described above in this embodiment, the preliminary test samples are... Input to the target detection model under test To obtain its current identification bias loss Using the target detection model The feedback establishes an attack strength benchmark, providing a basis for improving the success rate of adversarial examples in attacking the tested target detection model, thereby quantifying the destructive effect of interference signals on the model's judgment logic.

[0266] Through the above technical solutions in the embodiments of this application, under the premise of locking the target detection model parameters, the identification bias loss is transformed from a model training tool into an adversarial attack incentive signal. By setting the reverse attack target, the destructive power is accurately quantified, thereby constructing a unique test target detection model-induced closed-loop attack system.

[0267] Figure 12 A schematic diagram illustrating the training process of the adversarial example generation model provided in this application, such as... Figure 12 As shown, based on the above embodiment, the original image x is input into the constructed adversarial example generation model for feature extraction and reconstruction, resulting in a floating-point numerical matrix of the same size as the original image x. This numerical matrix is ​​denoted as the original interference layer. Then, the original image x and the original interference layer are compared. The samples are overlaid to generate preliminary test samples. .

[0268] Then, the initial test samples The inputs are respectively fed into the quality discrimination network and the target detection model under test. Resulting in a loss of authenticity and identification bias loss .

[0269] Subsequently, based on the initial test samples and identification bias loss Pixel-level gradient optimization is performed, starting with the initial test sample. The partial derivative of the recognition bias loss with respect to the coordinates of each pixel in the original image is calculated to obtain the corresponding pixel gradient map. Along the gradient ascent direction that further amplifies the recognition bias loss, a perturbation displacement increment is added to the pixel value of each pixel in the initial test sample, performing targeted enhancement updates. Through iterative processing, a refined test sample is obtained. .

[0270] After obtaining the test sample Next, the test samples were calculated. The pixel difference between the original image x and the original image x is used as the ideal guiding trajectory, and the corresponding trajectory guiding loss is obtained. .

[0271] Regarding the aforementioned loss of authenticity Identification bias loss Trajectory-guided loss When performing weighted summation, a smoothness loss that reflects the continuity of the perturbation space can also be introduced during the weighting process. .

[0272] Finally, the weighted total loss is obtained by weighted summation. The adversarial example generation model is trained using backpropagation until the weighted total loss converges, at which point the adversarial example generation model enters a steady state.

[0273] The model training method provided in this application, after generating preliminary test samples corresponding to the original image using an adversarial sample generation model, performs pixel gradient optimization on the preliminary test samples and performs pixel-level refinement iterations to obtain refined test samples. It also determines the trajectory guidance loss between the test samples and the original image as a supervision signal to guide the output of the adversarial sample generation model, so that the adversarial sample generation model generates adversarial sample images with higher concealment and attack power, thereby improving the success rate of attacking the target detection model.

[0274] Figure 13 A schematic flowchart illustrating the training process of the adversarial example generation model provided in this application is shown below. Figure 13As shown, based on the above embodiment, initial configuration is first performed. An adversarial example generation model G and a quality discrimination network D are deployed on the computing platform. The quality discrimination network adopts a local block-level discriminative structure, enabling continuous evaluation of the realism of generated samples during training. Simultaneously, the parameters of the target detection model f_target are locked, so that it only serves as an evaluation benchmark for attack success rate and does not participate in gradient updates. This configuration ensures that the subsequent optimization direction of the adversarial example generation model G is entirely focused on improving its ability to mislead the detection model, laying the foundation for generating adversarial examples with both high stealth and high attack success rate.

[0275] After completing the initial configuration as described above, forward interference generation is performed. An adversarial example generation model is used for one forward propagation to generate initial test samples. Under the premise of satisfying the concealment constraint (perturbation amplitude ≤ ε), this sample initially possesses the ability to induce the detector to generate recognition bias, providing an initial sample for subsequent attack success rate assessment, while ensuring that visual naturalness is not compromised.

[0276] After obtaining the initial test samples, a dual evaluation of their stealth and attack success rate is conducted simultaneously. On one hand, the quality discrimination network outputs a higher realism score for the original images and a lower realism score for the initial test samples. By calculating the difference between the two scores and their corresponding ideal labels, the realism loss, reflecting the visual naturalness of the generated samples, is obtained. .

[0277] On the other hand, preliminary test samples are fed into the target detection model under test, which outputs predicted bounding box positions, predicted class probabilities, and target confidence scores. These prediction results are compared with the true label information of the original images to calculate class judgment bias, location regression bias, and target score bias. These biases are then weighted and summed to obtain the recognition bias loss, which reflects the degree of misjudgment by the target detection model. .

[0278] In this embodiment, the two losses mentioned above together constitute the optimization guide of the adversarial sample generation model, ensuring that it improves attack performance without sacrificing the concealment of the sample.

[0279] Then, pixel-level gradient refinement is performed on the obtained preliminary test samples. Based on the recognition bias loss calculated above, local fine-tuning is carried out on the preliminary test samples. Starting from the preliminary test samples, the gradient of the sample pixels is calculated using the recognition bias loss, and small-step updates are performed along the direction that amplifies the recognition bias. Furthermore, during each update, the difference between the current temporary sample and the original image is constrained within a preset perturbation range by using a projection truncation operator.

[0280] After multiple iterations, output test samples. This test sample represents the ideal perturbation direction that maximizes the identification deviation under the current original image content, providing a more accurate attack trajectory reference for the generator network, thereby achieving the best balance between stealth and attack success rate in subsequent optimizations.

[0281] After obtaining the test sample, it is compared with the original noise layer currently output by the adversarial example generation model to construct a guiding signal. The pixel difference matrix between the test sample and the original image is calculated, and this difference is defined as the optimal detection path, i.e., the ideal guiding trajectory, for the current input content. .

[0282] Then, the difference between the original interference layer output by the adversarial example generation model and the ideal guiding trajectory is calculated to obtain the trajectory guiding loss. This loss function guides the adversarial example generation model to adaptively allocate perturbation intensity in different semantic regions, achieving localized perturbation and reducing the possibility of oversmoothing or visual inconsistencies caused by global uniform noise. This not only improves the success rate of the generated adversarial examples in attacking the tested target detection model, but also further enhances the visual concealment of the test samples, achieving synergistic optimization of both.

[0283] Finally, by calculating the sum of the absolute values ​​of the gray-level differences between all adjacent pixels in the original perturbation layer G(x), the smoothness loss reflecting the spatial continuity of the perturbation is obtained. This leads to the calculation of the actual loss obtained through the above process. Identification bias loss Trajectory-guided loss and smoothness loss We perform a weighted summation to obtain the weighted total loss. .

[0284] Using the Adam optimization algorithm, the model weights are updated via backpropagation based on the derivative of the total loss value with respect to the parameters of the adversarial example generation model. Gradient descent updates are performed. The model is continuously optimized through multiple iterations, with convergence and / or determination of the maximum number of iterations. After completing the above training, an adversarial example generation model that balances high stealth and high attack success rate is obtained.

[0285] The trained and converged adversarial example generation model can directly generate adversarial examples with both high stealth and high attack success rate in a single forward inference. Joint evaluation by the quality discrimination network and the object detection model shows that the example is visually natural and seamless, while effectively inducing recognition bias in various heterogeneous object detection models, demonstrating good cross-model transferability. The model training method described in this embodiment internalizes the complex iterative optimization process into static inference of network parameters, significantly improving the efficiency of adversarial example generation and its attack success rate on object detection models, providing a feasible technical solution for large-scale, real-time model security evaluation.

[0286] The following explanation uses autonomous driving traffic sign detection as an example.

[0287] Figure 14 The schematic diagram provided in this application illustrates an application scenario of autonomous driving traffic sign detection, such as... Figure 14 As shown, based on the above embodiments, this scenario includes: an in-vehicle terminal device 1401, a server 1402, an adversarial sample generation model 1403, a quality identification network 1404, a target detection model 1405, and an adversarial evaluation and adaptive guidance module 1406.

[0288] The vehicle-mounted terminal device 1401 is an in-vehicle terminal device in an autonomous vehicle equipped with a forward-looking camera and a computing unit. It is used to collect road scene images containing traffic signs and upload the collected data and corresponding annotations to the server 1402. The server 1402 is a computing platform with graphics computing capabilities, used to centrally deploy the interference generation, quality discrimination, target detection, and adaptive guidance modules of this embodiment. The adversarial example generation model 1403 is an encoder-decoder convolutional generative network that learns a nonlinear mapping from the original scene to pixel-level interference in the image space. Residual blocks and channel attention can be introduced in the bottleneck layer to enhance expressive power. The quality discrimination network 1404 is a block-level convolutional discriminant network that discriminates the local texture and edge distribution of the input image to constrain the visual realism of the generated samples. The target detection model 1405 is a single-stage target detection network, such as a detection model based on anchor boxes or anchor-free mechanisms, which can output the category and location of traffic signs. The adversarial evaluation and adaptive guidance module 1406 integrates the quality identification feedback and detection deviation signal to adaptively guide and optimize the parameters of the adversarial sample generation model 1403, forming an adversarial sample generation capability that can be used for subsequent deployment testing.

[0289] The process in this embodiment is as follows:

[0290] ① The vehicle-mounted terminal device 1401 collects traffic sign images and their corresponding annotation information in the autonomous driving scenario, and uploads them to the server 1402 after processing, which constitutes the training and verification dataset required by the model training method of this application embodiment.

[0291] ② The image preprocessing unit in server 1402 transforms the original image obtained in step ① to a fixed input size (e.g., by scaling and padding while maintaining aspect ratio) and records the corresponding geometric transformation parameters to provide a unified coordinate space for subsequent perturbation application and label mapping.

[0292] ③ Input the preprocessed clear image (original image) into the adversarial example generation model 1403. Obtain the corresponding original interference layer G(x) through one forward propagation, and superimpose it with the preprocessed image at the pixel level to synthesize the preliminary test sample. This sample has the potential to guide the target detection model to produce false detections or false negatives.

[0293] ④ Combine the original image x and the preliminary test sample Simultaneously input into the quality discrimination network 1404, calculate the authenticity loss reflecting the visual realism of the generated samples. At the same time, preliminary test samples will be... The target detection model 1405, with its corresponding annotations, calculates the recognition bias loss based on the differences between the detection results and the true annotations in terms of category judgment, location regression, and target confidence. This is used to quantify the impact of current interference on detection behavior.

[0294] ⑤ On the preliminary test samples After evaluation, the adversarial evaluation and adaptive guidance module 1406 was used as an initial test sample. Starting with the initial test sample, multiple rounds of pixel-level refinement iterations are performed around the recognition bias loss. During iteration, along the gradient ascent direction that further amplifies the recognition bias loss, a perturbation displacement increment is added to the pixel value of each pixel in the initial test sample to perform targeted enhancement updates. After each update, the perturbation amplitude is limited to a preset radius through projection constraints, ultimately yielding the test sample. .

[0295] ⑥ Calculate refined adversarial examples The difference between the original image x and the original image x is taken as the ideal guiding trajectory in the current scene. Then, the original interference layer G(x) output by the adversarial example generation model 1403 is compared pixel by pixel with this ideal guiding trajectory to obtain the trajectory guiding loss. This is used to measure the consistency between the output of the generating network and the refined result.

[0296] ⑦ Simultaneously calculate the smoothness loss for the original interference layer G(x). By measuring the intensity changes between adjacent pixels, the spatial continuity of perturbations is constrained, isolated noise and obvious artifacts are suppressed, thereby improving the visual concealment of adversarial examples in autonomous driving scenarios.

[0297] ⑧ The adversarial evaluation and adaptive guidance module 1406 performs a weighted summation of the authenticity loss, recognition bias loss, trajectory guidance loss, and smoothness loss according to preset weights to obtain the weighted total loss. The weighted total loss is used to perform backpropagation and gradient update on the parameters of the adversarial example generation model 1403, thereby enhancing the ability to mislead the target detection model 1405 while maintaining the realism of the samples.

[0298] ⑨ Repeat steps ③ to ⑧ on multiple traffic scene images on the training dataset to continuously perform adaptive guided optimization of the adversarial example generation model 1403 until the generation network converges, thereby obtaining an interference generation model with stable attack capability in the autonomous driving traffic sign detection task.

[0299] ⑩ The trained and converged adversarial example generation model 1403 is integrated into the test link of the autonomous driving traffic sign detection system. When security verification or regression testing is required, adversarial examples are generated in real time from the input image and compared with the original detection results to evaluate and improve the robustness of the actual deployed system in typical autonomous driving scenarios.

[0300] Figure 15 A flowchart illustrating the adversarial example generation method provided in this application is shown below. Figure 15 As shown, the adversarial example generation method provided in this embodiment includes:

[0301] S1501, Acquire the target image;

[0302] S1502. Input the target image into the trained adversarial example generation model to obtain adversarial examples of the target image; wherein, the trained adversarial example generation model is a model determined according to the model training method in the above embodiment.

[0303] Figure 16 A schematic diagram of the structure of the model training device provided in this application is shown below. Figure 16 As shown, the model training device 1600 provided in this embodiment includes:

[0304] The first loss determination unit 1601 is used to generate preliminary test samples based on the constructed adversarial example generation model and the original image, and to determine the realism loss between the preliminary test samples and the original image.

[0305] The second loss determination unit 1602 is used to perform pixel gradient optimization on the preliminary test samples, generate test samples, and determine the trajectory guidance loss between the test samples and the original image.

[0306] The third loss determination unit 1603 is used to determine the weighted total loss based on the authenticity loss and the trajectory guidance loss;

[0307] The parameter update unit 1604 is used to update the parameters of the adversarial example generation model based on the weighted total loss using backpropagation until the weighted total loss converges; wherein, the adversarial example generation model is used to generate adversarial examples.

[0308] In one possible implementation, pixel gradient optimization is performed on the initial test samples to generate test samples, including:

[0309] Target detection is performed on the preliminary test samples. Based on the target detection results and the ground truth corresponding to the original image, the recognition bias loss corresponding to the preliminary test samples is determined.

[0310] Using backpropagation, the pixel gradient map is determined based on the recognition bias loss and preliminary test samples;

[0311] Based on the pixel gradient map and the preset step size, the pixel value of any pixel in the preliminary test sample is updated to generate the current temporary sample;

[0312] By using an iterative approach, the target detection is re-performed on the current temporary sample to determine the corresponding recognition bias loss. Then, the optimization is performed along the direction that increases the gradient of the corresponding recognition bias loss to generate test samples.

[0313] In one possible implementation, based on the pixel gradient map and a preset step size, the pixel value of any pixel in the initial test sample is updated, including:

[0314] Based on the pixel gradient map, determine the gradient increment direction corresponding to any pixel.

[0315] The disturbance displacement increment is determined based on the product of the gradient increment direction and the preset step size;

[0316] The pixel value of any pixel in the preliminary test sample is updated based on the perturbation displacement increment.

[0317] In one possible implementation, the gradient increment direction is the direction of gradient ascent that causes the recognition bias loss corresponding to the pixel gradient map.

[0318] In one possible implementation, after generating the current temporary sample, the following steps are also included:

[0319] Determine the absolute numerical difference between the pixel value at any identical pixel coordinate point in the current temporary sample and the original image;

[0320] When the absolute difference of the value corresponding to the target pixel is determined to be greater than the upper limit of the preset modification radius, the pixel value of the target pixel is updated based on the projection truncation operator; where the target pixel is any pixel in the current temporary sample;

[0321] Update the current temporary sample based on the target pixel after the pixel value is updated.

[0322] In one possible implementation, determining the trajectory-guided loss between the test sample and the original image includes:

[0323] Based on the test samples and the original image, the pixel difference matrix is ​​determined and denoted as the ideal guiding trajectory.

[0324] Based on the adversarial example generation model and the original image, an original perturbation layer is generated;

[0325] Based on the ideal guiding trajectory and the original interference layer, determine the pixel distance at any identical pixel coordinate point;

[0326] The distances between pixels are summed, and the summation value is recorded as the trajectory guidance loss.

[0327] In one possible implementation, the pixel distance at any identical pixel coordinate point is determined based on the ideal guiding trajectory and the original interference layer, including:

[0328] Select the pixel points at the same pixel coordinates as the ideal guiding trajectory and the original interference layer, and denote them as the first pixel point and the second pixel point, respectively.

[0329] Calculate the numerical differences of the RGB three channels between the first pixel and the second pixel in turn;

[0330] Sum the numerical differences and record the sum of the differences as the pixel distance.

[0331] In one possible implementation, before determining the weighted total loss based on authenticity loss and trajectory guidance loss, the following steps are also included:

[0332] Based on the adversarial example generation model and the original image, an original perturbation layer is generated, and based on the original perturbation layer, the smoothness loss is determined;

[0333] Target detection is performed on the preliminary test samples. Based on the target detection results and the ground truth corresponding to the original image, the recognition bias loss corresponding to the preliminary test samples is determined.

[0334] The authenticity loss, identification bias loss, trajectory guidance loss, and smoothness loss are weighted and summed, and the weighted sum is recorded as the weighted total loss.

[0335] In one possible implementation, the smoothness loss is determined based on the original interference layer, including:

[0336] By traversing through the data, the absolute value of the grayscale difference between any pixel in the original interference layer and its neighboring pixels is calculated.

[0337] The absolute values ​​of the grayscale differences are summed, and the corresponding summation value is recorded as the smoothness loss.

[0338] In one possible implementation, target detection is performed on the preliminary test samples. Based on the ground truth value corresponding to the target detection result and the original image, the recognition bias loss corresponding to the preliminary test samples is determined, including:

[0339] Target detection is performed on the initial test samples to determine the prediction category probability, prediction box position, and target confidence score for any predicted target.

[0340] The class determination bias is determined based on the predicted class probability and the true class corresponding to the original image.

[0341] Based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image, the position regression bias is determined;

[0342] The squared difference between the target confidence score and the ideal misjudged target is denoted as the target score bias.

[0343] The judgment bias, position regression bias, and target score bias are summed, and the summation value is recorded as the recognition bias loss.

[0344] In one possible implementation, the class determination bias is determined based on the predicted class probability and the true class corresponding to the original image, including:

[0345] Calculate the cross-entropy loss between the predicted class probability and the true class, denoted as the class decision bias.

[0346] In one possible implementation, the location regression bias is determined based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image, including:

[0347] Calculate the cross-union ratio (CUI) deviation between the predicted bounding box position and the actual bounding box position, denoted as the position regression deviation.

[0348] In one possible implementation, determining the realism loss between the initial test sample and the original image includes:

[0349] Using a quality discrimination network, the first confidence score of the original image and the second confidence score of the preliminary test sample are determined respectively.

[0350] Calculate the squared difference between the first confidence score and the true value label, and calculate the squared difference between the second confidence score and the false value label;

[0351] Calculate the average of the squared first difference and the squared second difference, and denote the average as the authenticity loss.

[0352] In one possible implementation, preliminary test samples are generated based on the constructed adversarial example generation model and the original image, including:

[0353] Based on the adversarial example generation model, features are extracted from the original image, and the extracted features are reconstructed into a numerical matrix, denoted as the original interference layer. The original interference layer has the same size as the original image, and the pixels in the original image correspond one-to-one with the elements in the original interference layer.

[0354] Calculate the sum of the pixel value of any pixel in the original image and its corresponding element, and record the corresponding pixel sum as the sample pixel value;

[0355] A preliminary test sample is generated based on the sample pixel values.

[0356] The model training device provided in this embodiment can execute the model training method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0357] Figure 17 A schematic diagram of the adversarial sample generation device provided in this application is shown below. Figure 17 As shown, the adversarial example generation device 1700 provided in this embodiment includes:

[0358] Acquisition unit 1701 is used to acquire the target image;

[0359] The generation unit 1702 is used to input the target image into the trained adversarial example generation model to obtain adversarial examples of the target image; wherein, the trained adversarial example generation model is a model determined according to the model training method in the above embodiment.

[0360] Figure 18 A schematic diagram of the structure of the electronic device provided in this application. Figure 18 As shown, the electronic device 1800 provided in this embodiment includes at least one processor 1801 and a memory 1802. Optionally, the electronic device 1800 further includes a communication component 1803. The processor 1801, the memory 1802, and the communication component 1803 are connected via a bus 1804.

[0361] In a specific implementation, at least one processor 1801 executes computer execution instructions stored in memory 1802, causing at least one processor 1801 to perform the above-described method.

[0362] The specific implementation process of processor 1801 can be found in the above method embodiments, and its implementation principle and technical effect are similar, so it will not be repeated here.

[0363] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0364] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0365] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0366] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0367] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0368] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0369] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0370] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0371] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0372] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0373] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0374] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0375] Finally, it should be noted that other embodiments of this application will readily conceive of by those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and alterations may be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A model training method, characterized in that, include: Based on the constructed adversarial example generation model and the original image, preliminary test samples are generated, and the realism loss between the preliminary test samples and the original image is determined. Pixel gradient optimization is performed on the preliminary test samples to generate test samples, and the trajectory guidance loss between the test samples and the original image is determined. Based on the authenticity loss and the trajectory guidance loss, the weighted total loss is determined; Based on the weighted total loss, the parameters of the adversarial example generation model are updated using backpropagation until the weighted total loss converges; wherein, the adversarial example generation model is used to generate adversarial examples.

2. The method of claim 1, wherein, The step of performing pixel gradient optimization on the preliminary test samples to generate test samples includes: Target detection is performed on the preliminary test samples, and the recognition bias loss corresponding to the preliminary test samples is determined based on the target detection results and the ground truth corresponding to the original image. Using backpropagation, a pixel gradient map is determined based on the recognition bias loss and the preliminary test samples; Based on the pixel gradient map and the preset step size, the pixel value of any pixel in the preliminary test sample is updated to generate the current temporary sample. Using an iterative approach, target detection is re-performed on the current temporary sample to determine the corresponding recognition bias loss. Optimization is then performed along the direction that increases the gradient of the corresponding recognition bias loss to generate the test sample.

3. The method according to claim 2, characterized in that, The step of updating the pixel value of any pixel in the preliminary test sample based on the pixel gradient map and a preset step size includes: Based on the pixel gradient map, determine the gradient increment direction corresponding to any pixel. The disturbance displacement increment is determined based on the product of the gradient increment direction and the preset step size; Based on the disturbance displacement increment, the pixel value of any pixel in the preliminary test sample is updated.

4. The method according to claim 3, characterized in that, The gradient increment direction is the direction in which the gradient increases to compensate for the recognition bias loss corresponding to the pixel gradient map.

5. The method according to any one of claims 2 to 4, characterized in that, After generating the current temporary sample, the process also includes: Determine the absolute numerical difference between the current temporary sample and the pixel value at any identical pixel coordinate point in the original image; When the absolute difference of the value corresponding to the target pixel is determined to be greater than the upper limit of the preset modification radius, the pixel value of the target pixel is updated based on the projection truncation operator; wherein, the target pixel is any pixel in the current temporary sample; The current temporary sample is updated based on the target pixel after the pixel value is updated.

6. The method according to any one of claims 1 to 4, characterized in that, The determination of the trajectory guidance loss between the test sample and the original image includes: Based on the test sample and the original image, the pixel difference matrix is ​​determined and denoted as the ideal guiding trajectory; Based on the adversarial sample generation model and the original image, an original interference layer is generated; Based on the ideal guiding trajectory and the original interference layer, determine the pixel distance at any identical pixel coordinate point; The distances between the pixels are summed, and the summation value is recorded as the trajectory guidance loss.

7. The method according to claim 6, characterized in that, The step of determining the pixel distance at any identical pixel coordinate point based on the ideal guiding trajectory and the original interference layer includes: Select the pixel points at the same pixel coordinates as the ideal guiding trajectory and the original interference layer, and record them as the first pixel point and the second pixel point respectively. Calculate the numerical differences of the RGB three channels between the first pixel and the second pixel in sequence; The numerical differences are summed, and the corresponding sum of differences is recorded as the pixel distance.

8. The method according to claim 1, characterized in that, Before determining the weighted total loss based on the authenticity loss and the trajectory guidance loss, the process also includes: Based on the adversarial example generation model and the original image, an original interference layer is generated, and based on the original interference layer, a smoothness loss is determined; Target detection is performed on the preliminary test samples, and the recognition bias loss corresponding to the preliminary test samples is determined based on the target detection results and the ground truth corresponding to the original image. The authenticity loss, the identification bias loss, the trajectory guidance loss, and the smoothness loss are weighted and summed, and the weighted sum is recorded as the weighted total loss.

9. The method according to claim 8, characterized in that, The determination of smoothness loss based on the original interference layer includes: The absolute value of the grayscale difference between any pixel in the original interference layer and its neighboring pixels is calculated by traversing the graph. The absolute values ​​of the grayscale differences are summed, and the corresponding summation value is recorded as the smoothness loss.

10. The method according to claim 8, characterized in that, The step of performing target detection on the preliminary test samples and determining the recognition bias loss corresponding to the preliminary test samples based on the target detection results and the ground truth corresponding to the original image includes: Target detection is performed on the preliminary test samples to determine the prediction category probability, prediction box position, and target confidence score for any predicted target. Based on the predicted category probability and the true category corresponding to the original image, the category determination bias is determined; Based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image, the position regression deviation is determined; The squared difference between the target confidence score and the ideal misjudged target is calculated and denoted as the target score deviation. The judgment deviation value, the position regression deviation, and the target score deviation are summed, and the corresponding summation value is recorded as the recognition deviation loss.

11. The method according to claim 10, characterized in that, The determination of class determination bias based on the predicted class probability and the true class corresponding to the original image includes: Calculate the cross-entropy loss between the predicted class probability and the true class, and denote it as the class determination bias.

12. The method according to claim 10, characterized in that, The step of determining the position regression deviation based on the predicted bounding box position and the corresponding ground truth bounding box position in the original image includes: The cross-union ratio (CUI) deviation between the predicted bounding box position and the actual bounding box position is calculated and denoted as the position regression deviation.

13. The method according to any one of claims 8-12, characterized in that, Determining the realism loss between the preliminary test sample and the original image includes: Using a quality discrimination network, a first confidence score for the original image and a second confidence score for the preliminary test sample are determined, respectively. Calculate the squared difference between the first confidence score and the true value label, and calculate the squared difference between the second confidence score and the false value label; Calculate the average of the squared first difference and the squared second difference, and denote the average as the authenticity loss.

14. The method according to any one of claims 8-12, characterized in that, The constructed adversarial example generation model and the original image are used to generate preliminary test samples, including: Based on the adversarial example generation model, features are extracted from the original image, and the extracted features are reconstructed into a numerical matrix, denoted as the original interference layer. The original interference layer has the same size as the original image, and the pixels in the original image correspond one-to-one with the elements in the original interference layer. Calculate the sum of the pixel value of any pixel in the original image and the corresponding element, and record the corresponding pixel sum as the sample pixel value; The preliminary test sample is generated based on the sample pixel values.

15. A method for generating adversarial examples, characterized in that, include: Acquire the target image; The target image is input into the trained adversarial example generation model to obtain adversarial examples of the target image; wherein the trained adversarial example generation model is the model determined by the model training method according to any one of claims 1-14.

16. A model training device, characterized in that, include: The first loss determination unit is used to generate preliminary test samples based on the constructed adversarial example generation model and the original image, and to determine the realism loss between the preliminary test samples and the original image. The second loss determination unit is used to perform pixel gradient optimization on the preliminary test sample, generate test samples, and determine the trajectory guidance loss between the test sample and the original image. The third loss determination unit is used to determine the weighted total loss based on the authenticity loss and the trajectory guidance loss; The parameter update unit is used to update the parameters of the adversarial example generation model based on the weighted total loss using backpropagation, until the weighted total loss converges; wherein, the adversarial example generation model is used to generate adversarial examples.

17. An adversarial sample generation device, characterized in that, include: The acquisition unit is used to acquire the target image; A generation unit is used to input the target image into a trained adversarial example generation model to obtain adversarial examples of the target image; wherein the trained adversarial example generation model is a model determined by the model training method according to any one of claims 1-14.

18. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-15.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-15.

20. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-15.

Images