A method, apparatus, device, storage medium, and product for generating adversarial examples.

Abstract

This invention discloses a method, apparatus, device, storage medium, and product for generating adversarial examples. The method includes: acquiring an original image and multiple sets of light sources with different physical parameter vectors; generating a synthetic image set based on the original image and the light sources; constructing and solving an objective function corresponding to the synthetic image set to obtain the target light source physical parameter vector; wherein the objective function aims to minimize the confidence that the synthetic images in the synthetic image set are correctly classified, and uses the light source physical parameter vector as the optimization variable; and generating an adversarial example set based on the synthetic images corresponding to the light sources with the target light source physical parameter vector. By using light itself as an adversarial perturbation, adversarial examples can be generated based on the original image of the target object without altering the original structure or surface texture of the object.

Description

Technical Field

[0001] This invention relates to the field of computer vision technology, and in particular to an adversarial example generation method, apparatus, device, storage medium, and product. Background Technology

[0002] With significant advancements in computing power and machine learning algorithms, deep neural networks have become the primary choice for many computer vision applications. Due to their superior recognition accuracy, deep neural networks are used in safety-critical tasks such as object detection in autonomous driving and facial recognition in security systems. However, if a malicious hacker gains control of the input to a deep neural network, that input could be altered into adversarial examples, which would insecurely affect the network's predictions.

[0003] Existing adversarial attack techniques are mainly divided into two categories: digital domain attacks and physical domain attacks. Digital domain attacks directly add perturbations to image data, but this is difficult to implement in the real physical world. Physical domain attacks usually take the form of stickers, that is, adding adversarial patches to the target or replacing the original target with a poster containing adversarial perturbations. However, these sticker attacks have significant shortcomings: on the one hand, physical adversarial perturbations are poorly concealed and easily detected by observers; on the other hand, when adversarial perturbations migrate from the digital domain to the physical domain, they are often significantly weakened by environmental factors such as changes in lighting, shooting angle, and imaging noise.

[0004] Furthermore, existing sticker attack methods require attackers to have direct contact with the target. In real-world scenarios, many targets are not accessible, such as traffic signs mounted on tall poles, billboards hanging high up, or facility signs located in hazardous areas. Traditional sticker attacks are difficult to implement on such hard-to-reach targets, limiting the application of adversarial attack techniques in evaluating the robustness of deep neural networks. Summary of the Invention

[0005] This invention provides an adversarial sample generation method, apparatus, device, storage medium, and product to address the problems of traditional sticker attack methods, such as poor concealment, high susceptibility to environmental factors, and difficulty in implementation, which limit the application scope of adversarial attack technology in evaluating the robustness of deep neural networks.

[0006] In a first aspect, embodiments of the present invention provide an adversarial example generation method, comprising: The original image and multiple sets of light sources with different physical parameter vectors are acquired, and a synthetic image set is generated based on the original image and the light sources. Construct an objective function corresponding to the synthetic image set and solve the objective function to obtain the target light source physical parameter vector; wherein, the objective function takes minimizing the confidence that the synthetic images in the synthetic image set are correctly classified as the optimization objective, and the light source physical parameter vector is the optimization variable; An adversarial sample set is generated based on the synthetic images corresponding to the light sources in the synthetic image set that have the physical parameter vector of the target light source.

[0007] Secondly, embodiments of the present invention provide an adversarial sample generation apparatus, comprising: The acquisition module is used to acquire the original image and multiple sets of light sources with different physical parameter vectors, and generate a synthetic image set based on the original image and the light sources; An optimization module is used to construct an objective function corresponding to the synthetic image set and solve the objective function to obtain a target light source physical parameter vector; wherein, the objective function takes minimizing the confidence that the synthetic images in the synthetic image set are correctly classified as the optimization objective, and the light source physical parameter vector is the optimization variable; The adversarial example generation module is used to generate an adversarial example set based on the synthetic image corresponding to the physical parameter vector of the target light source in the synthetic image set.

[0008] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the adversarial sample generation method according to any embodiment of the present invention.

[0009] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions that are used to cause a processor to execute the adversarial sample generation method described in any embodiment of the present invention.

[0010] Fifthly, embodiments of the present invention provide a computer program product including a computer program, which, when executed by a processor, implements the adversarial sample generation method described in any embodiment of the present invention.

[0011] The technical solution of this invention involves acquiring an original image and multiple sets of light sources with different physical parameter vectors, and generating a synthetic image set based on the original image and the light sources. An objective function corresponding to the synthetic image set is constructed and solved to obtain the target light source physical parameter vector. The objective function aims to minimize the confidence level of the synthetic images in the synthetic image set being correctly classified, with the light source physical parameter vector as the optimization variable. An adversarial example set is generated based on the synthetic images corresponding to the light sources with the target light source physical parameter vectors in the synthetic image set. By using light itself as an adversarial perturbation, adversarial examples can be generated based on the original image of the target object without altering the original structure or surface texture of the object. Compared to traditional sticker attacks and spray attacks, which require physical contact with the target, this method does not alter the appearance of the target object. It only generates disturbances through lighting. Under normal lighting conditions, the light source may be mistaken for ambient light or reflection. Once the light source is turned off, the target object returns to its original state, making it impossible to trace the source of the attack. Therefore, it has stronger concealment and defense capabilities. It is simple to deploy and reusable, offering greater flexibility and a wide range of attack ranges and applicable scenarios. Furthermore, it performs better under insufficient ambient light conditions. This addresses the problems of traditional sticker attacks, such as poor concealment, susceptibility to environmental factors, and difficulty in implementation, which limit the application of adversarial attack techniques in evaluating the robustness of deep neural networks.

[0012] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a flowchart of an adversarial sample generation method provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of an adversarial sample generation method provided in Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the structure of an adversarial sample generation device provided in Embodiment 3 of the present invention; Figure 4 A schematic diagram of the structure of an electronic device for implementing the adversarial sample generation method of this invention. Detailed Implementation

[0015] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0016] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0017] Example 1 Figure 1 This is a flowchart of an adversarial example generation method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where light itself is used as an adversarial perturbation to generate adversarial examples. This method can be executed by an adversarial example generation device, which can be implemented in hardware and / or software and can be configured in an electronic device. Figure 1 As shown, the method includes: S110. Obtain the original image and multiple sets of light sources with different physical parameter vectors, and generate a synthetic image set based on the original image and the light sources.

[0018] The original image can be considered as an image containing the target object captured by a camera. The target object can be considered as the target of the attack. Optionally, the target object can be a traffic sign installed on a high pole. Since the adversarial example generation method provided in this embodiment uses light itself as an adversarial perturbation, it does not need to change the surface of the object, and compared with traditional sticker attacks, it does not require direct contact with the target. Therefore, the target in this embodiment can be something that cannot be easily touched, such as a road sign hanging high up.

[0019] A composite image set can be considered as a collection of images synthesized from the original image and the effects of the light source.

[0020] In this embodiment, the light source physical parameter vector can be considered as a vector composed of a set of physical parameters representing the characteristics of the light source. This light source is used to illuminate the target object in the original image, causing light interference and attack on the original image. To facilitate adjustment of the light source's characteristic parameters, a spotlight can optionally be used. Spotlights have high temporal coherence and a narrow spectrum, allowing for precise illumination of the target area and independent adjustment of light parameters. Optionally, the parameters in the light source physical parameter vector include: wavelength. The values ​​are: position (x, y), radius r, and intensity α; where the radius r is determined based on the distance between the light source and the target object in the original image and the focal length of the light source.

[0021] For example, the physical parameter vector of the light source It can be described as: .

[0022] The parameters in the physical parameter vector of the light source are described as follows: wavelength The color of the light source can be determined, with only the visible light spectrum considered (typically 380 nm / nm to 750 nm / nm); the wavelength model can be represented by a function that receives a... And return an RGB tuple. Assuming the light beam is circular, the position (x, y) of the light source is used to locate the geometric center of the circle, which consists of the horizontal coordinate x and the vertical coordinate y. The radius r is used to represent the coverage of the light beam emitted by the light source, which can be considered as the area of ​​the region illuminated by the light source. This coverage is determined by two variables: (1) the distance between the light source and the target object; (2) the focal length of the light source. The beam emitted by the spotlight has a certain divergence angle, which is determined by the optical structure of the light source (especially the focal length). When the beam illuminates the target object at a certain distance, it will form a circular spot of a certain size, and the coverage can be considered as the coverage area of ​​the circular spot. Distance is positively correlated with coverage; the farther the distance between the light source and the target object, the wider the beam spreads and the greater the coverage. Focal length is negatively correlated with coverage; the shorter the focal length of the light source, the larger the divergence angle and the greater the coverage. The area of ​​the target object illuminated by the light source can be expressed by the formula The intensity α of a light source is represented by its radius. Larger area illumination makes the target object more noticeable; to prevent it from becoming too conspicuous, the radius of the light source can be determined through physical testing. The intensity α of a light source is affected by both its power and the ambient lighting. The brighter the light source appears, the greater its intensity.

[0023] In this embodiment, in order to generate different light interferences on the original image, it is necessary to obtain multiple sets of light sources with different light source physical parameter vectors θ. Linear image fusion technology is used to combine the original image I with each set of light sources having a light source physical parameter vector θ. Image synthesis is performed to obtain a synthesized image. ,like Among them, the light source Images can be generated and synthesized based on the physical parameter vector θ of the light source. It is cropped to a reasonable range. Then, it is based on each group of light sources with light source physical parameter vectors θ. The generated composite image This constitutes a composite image set.

[0024] S120. Construct the objective function corresponding to the synthetic image set and solve the objective function to obtain the target light source physical parameter vector corresponding to the light source; wherein, the objective function takes minimizing the confidence that the synthetic images in the synthetic image set are correctly classified as the optimization objective, and the light source physical parameter vector corresponding to the light source is the optimization variable.

[0025] The target light source physical parameter vector can be considered as the light source physical parameter vector when the objective function reaches its optimum, serving as an adversarial perturbation for generating adversarial examples.

[0026] In this embodiment, for each synthesized image in the synthesized image set, a classification prediction is performed on the synthesized image to obtain the confidence score of the synthesized image being correctly classified. The optimization objective is to minimize the confidence score of the synthesized images being correctly classified across the entire set, using the physical parameter vector of the light source corresponding to the light source as the optimization variable. By solving the objective function, the physical parameter vector of the light source corresponding to the light source that minimizes the confidence score of the synthesized image being correctly classified is found as the target physical parameter quantity.

[0027] For example, the objective function can be solved using particle swarm optimization and the Lagrange multiplier method, which will not be elaborated in this embodiment.

[0028] S130. Generate an adversarial sample set based on the synthetic images corresponding to the light sources in the synthetic image set that have the physical parameter vectors of the target light source.

[0029] In this embodiment, a synthetic image corresponding to a light source with a target light source physical parameter vector is obtained from the synthetic image set, and an adversarial sample set is generated based on the target synthetic image.

[0030] Although the physical parameter vector of the target light source has been determined However, in practical applications, it is not easy to completely reconstruct the light source from the physical parameter vector of the target light source. For example, the position (x, y) of the light source may be limited by the placement of the target object. Therefore, within an effective range, random image transformations can be performed on the synthetic image corresponding to the physical parameter vector of the target light source to obtain an adversarial example set.

[0031] Optionally, generating an adversarial sample set based on the synthetic image corresponding to the light source having the physical parameter vector of the target light source includes: performing random image transformation on the synthetic image corresponding to the light source having the physical parameter vector of the target light source to obtain the adversarial sample set; wherein, the random image transformation includes viewpoint change, size change and brightness change.

[0032] Specifically, for a synthesized image with a target light source physical parameter vector... The set of adversarial examples can be represented as: ; in, Let g be an adversarial sample set, T(·) be a random image transformation vector, T={view, size, brightness}, where view represents the view transformation parameter, size represents the size (i.e., dimension) transformation parameter, and brightness is the brightness transformation parameter.

[0033] In this embodiment, for traffic sign images, firstly, in areas where driving is on the left, traffic signs are typically located on the left side of the lane, and cameras mounted on moving vehicles rarely capture signs on the right side of the image; secondly, traffic signs are usually placed at a certain height, often above the height of the vehicle, to alert the driver. Given these two findings, a perspective transformation can be considered for the synthesized image. For example, the effective range of the perspective transformation v could be [0°, 45°], which can be considered the perspective from which the camera captures the image containing the traffic sign.

[0034] Because traffic signs vary in size depending on their type and the distance between the vehicle and the sign, the size of the traffic signs appearing in the field of view of the vehicle's camera will differ as the vehicle moves. During optimization, different sizes of traffic signs were used to induce the car to misclassify them in each frame. In generating adversarial examples, only the synthetic image containing the physical parameter vectors of the target light source can be resized.

[0035] Traffic sign colors vary depending on the combination of ambient light and camera settings. For example, on a sunny day, the camera's color will appear brighter. Taking this into account, multiple brightness transformations are used in the adversarial example generation process to provide a wider tonal range. First, the synthetic image with the target light source's physical parameter vector is converted from RGB to YCrCb format, the Luma component (Y) is added, and then the image is converted back to RGB.

[0036] In this embodiment, image transformations such as perspective change, size scaling, and brightness adjustment are introduced during the adversarial example generation process to simulate changes in camera shooting conditions in the real world, covering most shooting situations in real scenes, and exhibiting a high degree of robustness and environmental adaptability.

[0037] The technical solution of this invention involves acquiring an original image and multiple sets of light sources with different physical parameter vectors, and generating a synthetic image set based on the original image and the light sources. An objective function corresponding to the synthetic image set is constructed and solved to obtain the target light source physical parameter vector corresponding to the light source. The objective function aims to minimize the confidence that the synthetic images in the synthetic image set are correctly classified, and uses the light source physical parameter vector corresponding to the light source as the optimization variable. An adversarial example set is generated based on the synthetic images corresponding to the light sources with the target light source physical parameter vector in the synthetic image set. By using light itself as an adversarial perturbation, adversarial examples can be generated based on the original image of the target object without altering the object's original structure or surface texture. Compared to traditional methods such as sticker attacks and spray attacks that require physical contact with the target, this method does not change the appearance of the target object, only generating perturbation through lighting. Under normal lighting conditions, the light source may be mistaken for ambient light or reflection. After the light source is turned off, the target object returns to its original state, making it impossible to trace the source of the attack. Therefore, it has stronger concealment and defensive capabilities. It is simple to deploy and reusable, offering greater flexibility, a wide attack range, and broad applicability. Furthermore, it performs better under insufficient ambient light conditions.

[0038] Example 2 Figure 2 This is a flowchart of an adversarial sample generation method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment refines the steps of constructing the objective function corresponding to the synthetic image set, solving the objective function, and obtaining the target light source physical parameter vector.

[0039] Specifically, constructing the objective function corresponding to the synthetic image set includes: determining the constraint range of the physical parameter vector of the light source corresponding to the light source; performing classification prediction on each synthetic image to obtain the confidence that the synthetic image is correctly classified; constructing the objective function with minimizing the confidence that the synthetic images in the synthetic image set are correctly classified as the optimization objective, the physical parameter vector of the light source corresponding to the light source as the optimization variable, and the constraint range as the constraint condition of the variable.

[0040] Solving the objective function to obtain the target light source physical parameter vector includes: initializing the parameters of the particle swarm; the parameters include the position and velocity of each particle in the particle swarm, the position of each particle represents a set of light source physical parameter vectors, and the light source physical parameter vectors satisfy the constraints; for each particle in the particle swarm, determining the confidence that the synthesized image is correctly classified as the fitness of the particle; updating the individual optimal position of the particle and the global optimal position of the particle swarm according to the fitness; updating the position and velocity of each particle in the particle swarm according to the individual optimal position and the global optimal position, and constraining the updated position according to the constraints; returning to execute the relevant steps of determining the confidence that the synthesized image is correctly classified as the fitness of each particle in the particle swarm, until the iteration termination condition is met; randomly restarting the particle swarm, and returning to the relevant steps of initializing the parameters of the particle swarm, until the iteration termination condition is met, and determining the current position of the particle as the target light source physical parameter vector.

[0041] like Figure 2 As shown, the method includes: S201. Obtain the original image and multiple sets of light sources with different physical parameter vectors, and generate a synthetic image set based on the original image and the light sources.

[0042] S202. Determine the constraint range of the physical parameter vector of the light source corresponding to the light source.

[0043] Specifically, in the search space Internal, light source physical parameter vector It can be described as: ; in, The physical parameter vector of the light source The lower bound constraint vector, The physical parameter vector of the light source The upper limit constraint vector.

[0044] S203. Perform classification prediction on each synthetic image to obtain the confidence level that the synthetic image is correctly classified.

[0045] Yes, for each synthesized image, the synthesized image will be... Input classifier (Or a classification model), obtain the classification prediction result and corresponding confidence score of the synthesized image, and thus determine the confidence score of the synthesized image being correctly classified, that is, the confidence score corresponding to the correct classification prediction result (or correct label y). Among them, the classifier It can be considered a black box model.

[0046] S204. With minimizing the confidence that the synthesized images in the synthesized image set are correctly classified as the optimization objective, the physical parameter vector of the light source corresponding to the light source as the optimization variable, and the constraint range as the constraint condition of the variable, construct the objective function.

[0047] Specifically, the objective function constructed is: .

[0048] In this embodiment, the objective function aims to find a vector of physical parameters of the light source that can deceive the classifier, serving as an adversarial perturbation for generating adversarial examples. Since the classifier is in a black-box setting, gradient-based optimization methods cannot be applied. This method employs particle swarm optimization and a k-random-restart strategy to optimize the objective function.

[0049] S205. Initialize the parameters of the particle swarm and the position and velocity of each particle in each dimension; wherein, the position of each particle in one dimension represents the physical parameter of the light source in one dimension of each set of physical parameter vectors of the light source, and the physical parameter vectors of the light source satisfy the constraints.

[0050] In this embodiment, the parameters of the particle swarm may include: particle number N, particle dimension D, and inertia weight. Single particle learning rate Particle swarm learning rate Number of restarts K, classifier f, and maximum number of iterations .

[0051] Initialize the positions of the particles, the position of each particle in one dimension. Let represent a physical parameter of a light source in one dimension of a set of physical parameter vectors. This physical parameter vector satisfies the following constraints: ; in, `d` represents the initial position of the i-th particle in the d-th dimension, and `d` represents the physical parameters of the light source in the d-th dimension, randomly generated within the constraints. `d=0` represents the wavelength of the light source, `d=1` represents the position of the light source, `d=2` represents the radius of the light source, and `d=3` represents the intensity of the light source. `rand()` represents the function that generates random numbers. and It is a hyperparameter that restricts the value of a particle in the d-th dimension.

[0052] Generate a random number within a preset range (e.g., [-2, 2]) to initialize the particle velocity. Particle velocity can be used to represent the adjustment magnitude and direction of the source physical parameters in each dimension of the source physical parameter vector corresponding to the light source.

[0053] S206. For each particle in the particle swarm, the confidence that the synthesized image is correctly classified is determined as the particle's fitness.

[0054] In this embodiment, the particle's fitness indicates the quality of its current state. Therefore, fitness can accurately evaluate the current state of the light source's physical parameter vector and synthesize the image. Confidence of being correctly classified by the classifier Let this be the fitness of the particle.

[0055] S207. Update the individual optimal position of the particles and the global optimal position of the particle swarm based on fitness.

[0056] Specifically, if the current fitness value is less than the particle's historical best fitness value, then the individual's best position, pbest, is updated to the current position. The fitness values ​​of all particles in the swarm are compared, and the global best position is updated to the position of the particle with the smallest fitness value.

[0057] S208. Update the position and velocity of each particle in the particle swarm in each dimension according to the individual optimal position and the global optimal position, and constrain the updated position according to the constraints.

[0058] Specifically, the velocity of each particle in the particle swarm is updated in each dimension according to the velocity update formula of the particle swarm optimization algorithm, such as: ; in, Let be the velocity of particle i in its d-th dimension after the (k+1)-th iteration. Let d be the velocity of particle i in the d-th dimension after the k-th iteration. For inertial weights, For individual learning factors, As a group learning factor, and A random number within the interval [0,1]. Let be the optimal position of particle i in the d-th dimension after the k-th iteration. This represents the globally optimal position of the particle swarm after the k-th iteration. Optional, and It can be set to a constant of 1, and set... .

[0059] The position of each particle in the particle swarm is updated according to the position update formula of the particle swarm optimization algorithm, such as: ; in, Let be the position of particle i in its d-th dimension after the (k+1)-th iteration. The position of the d-th dimension of particle i after the k-th iteration.

[0060] Updated location Constraint clipping is required. This ensures that each parameter component is within the preset physically feasible range.

[0061] S209. Return to the execution of the relevant steps for each particle in the particle swarm, determining the confidence level of the synthesized image as the particle's fitness, until the iteration termination condition is met.

[0062] In this embodiment, after executing S208, if the iteration termination condition is not met, the process returns to continue executing S206~S208; if the iteration termination condition is met, the iteration terminates. Optionally, the iteration termination condition can be the global optimal position. The classification prediction result of the corresponding synthetic image is inconsistent with the true label, or the current iteration number has reached the maximum iteration number. .

[0063] S210. Randomly restart the particle swarm and return to the steps related to initializing the parameters of the particle swarm until the restart termination condition is met. Determine the position of the current particle in each dimension as the corresponding dimension of the light source physical parameter vector.

[0064] In this embodiment, after each iteration of the particle swarm optimization algorithm terminates, if the restart termination condition is not met, the particle swarm is randomly restarted, and execution returns to steps S205-S209. Each restart randomly initializes the particle swarm. If the restart termination condition is met, the restart and iteration process stops, and the current particle's position in each dimension is determined as the corresponding dimension's physical parameter of the target light source in the physical parameter vector. Optionally, the restart termination condition can be that the number of restarts of the particle swarm reaches a preset number of restarts.

[0065] S211. Generate an adversarial sample set based on the synthetic images corresponding to the light sources with target light source physical parameter vectors in the synthetic image set.

[0066] The technical solution of this embodiment involves acquiring an original image and multiple sets of light sources with different physical parameter vectors, and generating a synthetic image set based on the original image and the light sources; determining the constraint range of the physical parameter vectors corresponding to the light sources; performing classification prediction on each synthetic image to obtain the confidence level of the synthetic image being correctly classified; constructing an objective function with the optimization objective being minimizing the confidence level of the synthetic images correctly classified in the synthetic image set, using the physical parameter vectors corresponding to the light sources as optimization variables, and the constraint range as the constraint condition of the variables; initializing the parameters of the particle swarm and the position and velocity of each particle in the particle swarm; wherein, the position of each particle represents a physical parameter of the light source in the physical parameter vector, and the physical parameter vector satisfies the constraint condition; for each particle in the particle swarm... The process involves: determining the fitness of a particle based on the confidence score of correctly classifying the synthesized image; updating the individual optimal position of the particle and the global optimal position of the particle swarm based on the fitness; updating the position and velocity of each particle in the particle swarm based on the individual optimal position and the global optimal position, and constraining the updated position according to the constraints; returning to execute the steps related to determining the particle's fitness based on the confidence score of correctly classifying the synthesized image for each particle in the particle swarm, until the iteration termination condition is met; randomly restarting the particle swarm and returning to execute the steps related to initializing the parameters of the particle swarm, until the restart termination condition is met, and determining the current particle's position as the target light source physical parameter vector; and generating an adversarial example set based on the synthesized images corresponding to the light sources in the synthesized image set that have the target light source physical parameter vector. Compared to traditional methods such as sticker attacks and spray attacks that require physical contact with the target, the method of this invention does not change the appearance of the target object. It only generates disturbance through lighting. Under normal lighting conditions, the light source may be mistaken for ambient light or reflection. After the light source is turned off, the target object returns to its original state, making it impossible to trace the source of the attack. Therefore, it has stronger concealment and defense. It is simple to deploy and reusable, with greater flexibility, a wide attack range and applicable scenarios. Moreover, the attack effect is better under conditions of insufficient ambient light.

[0067] Furthermore, to address the technical challenge of obtaining model gradients under black-box settings, this invention introduces a particle swarm optimization algorithm. It uses the confidence of the synthesized image on the real label as the fitness function and searches for the optimal lighting parameters through swarm intelligence. This algorithm is applicable to various black-box classification models and is combined with k-random-restart technology to avoid getting trapped in local optima.

[0068] Example 3 Figure 3 This is a schematic diagram of an adversarial sample generation device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: an acquisition module 310, an optimization module 320, and an adversarial example generation module 330; wherein: The acquisition module 310 is used to acquire an original image and multiple sets of light sources with different physical parameter vectors, and generate a synthetic image set based on the original image and the light sources; The optimization module 320 is used to construct an objective function corresponding to the synthetic image set and solve the objective function to obtain the target light source physical parameter vector; wherein, the objective function takes minimizing the confidence that the synthetic images in the synthetic image set are correctly classified as the optimization objective and the light source physical parameter vector as the optimization variable; The adversarial example generation module 330 is used to generate an adversarial example set based on the synthetic image corresponding to the physical parameter vector of the target light source in the synthetic image set.

[0069] This invention provides an adversarial example generation device. It acquires an original image and multiple sets of light sources with different physical parameter vectors, and generates a synthetic image set based on the original image and the light sources. It constructs and solves an objective function corresponding to the synthetic image set to obtain the target light source physical parameter vector. The objective function aims to minimize the confidence level of the synthetic images in the synthetic image set being correctly classified, and uses the light source physical parameter vector as the optimization variable. An adversarial example set is generated based on the synthetic images corresponding to the light sources in the synthetic image set that have the target light source physical parameter vector. By using light itself as an adversarial perturbation, adversarial examples can be generated based on the original image of the target object without altering the original structure or surface texture of the object. Compared to traditional methods such as sticker attacks and spray attacks that require physical contact with the target, this method does not change the appearance of the target object. It only creates disturbance through lighting. Under normal lighting conditions, the light source may be mistaken for ambient light or reflection. After the light source is turned off, the target object returns to its original state, making it impossible to trace the source of the attack. Therefore, it has stronger concealment and defense. It is simple to deploy and reusable, with greater flexibility, a wide attack range, and a wide range of applicable scenarios. Moreover, it is more effective in low ambient light conditions.

[0070] Optionally, the optimization module 320 includes an objective function construction unit; The objective function construction unit is specifically used for: Determine the constraint range of the physical parameter vector of the light source corresponding to the light source; Each of the synthesized images is classified and predicted separately to obtain the confidence level that the synthesized image is correctly classified; The objective function is constructed with the goal of minimizing the confidence that the synthesized images in the synthesized image set are correctly classified, the light source physical parameter vector corresponding to the light source as the optimization variable, and the constraint range as the constraint condition of the variable.

[0071] Optionally, the optimization module 320 includes an objective function solving unit; The objective function solving unit is specifically used for: Initialize the parameters of the particle swarm and the position and velocity of each particle in the particle swarm in each dimension; wherein, the position of each particle in one dimension represents the light source physical parameter in one dimension of each set of light source physical parameter vectors, and the light source physical parameter vectors satisfy the constraints. For each particle in the particle swarm, the confidence that the synthesized image is correctly classified is determined as the fitness of the particle. The individual optimal position of the particle and the global optimal position of the particle swarm are updated based on the fitness. The position and velocity of each particle in the particle swarm in each dimension are updated based on the individual optimal position and the global optimal position, and the updated position is constrained according to the constraints. Return to the relevant steps for each particle in the particle swarm, determining the confidence that the synthesized image is correctly classified as the fitness of the particle, until the iteration termination condition is met; The particle swarm is randomly restarted, and the steps for initializing the particle swarm parameters are returned until the restart termination condition is met. The current position of the particle in each dimension is determined as the corresponding dimension of the light source physical parameter vector.

[0072] Optionally, the adversarial example generation module 330 is specifically used for: Random image transformation is performed on the synthetic image corresponding to the light source with the physical parameter vector of the target light source to obtain an adversarial sample set; The random image transformations include perspective changes, size changes, and brightness changes.

[0073] Optionally, the parameters in the physical parameter vector of the light source include: wavelength, position, radius, and intensity; The radius is determined based on the distance between the light source and the target object in the original image and the focal length of the light source.

[0074] The adversarial sample generation apparatus provided in the embodiments of the present invention can execute the adversarial sample generation method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0075] Example 4 Figure 4A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0076] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0077] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0078] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as adversarial example generation methods.

[0079] In some embodiments, the adversarial example generation method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the adversarial example generation method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the adversarial example generation method by any other suitable means (e.g., by means of firmware).

[0080] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0081] In some embodiments, the adversarial example generation method may be implemented as a computer program, which is implicitly included in a computer program product. When executed by a processor, the computer program implements the adversarial example generation method of the present invention. The computer program product can be understood as a software product that primarily implements its solution through a computer program. The computer program used to implement the method of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer program causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer program may be executed entirely on a machine, partially on a machine, partially on a remote machine as a standalone software package, or entirely on a remote machine or server.

[0082] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0083] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0084] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0085] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0086] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0087] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for generating adversarial examples, characterized in that, include: The original image and multiple sets of light sources with different physical parameter vectors are acquired, and a synthetic image set is generated based on the original image and the light sources. Construct an objective function corresponding to the synthetic image set and solve the objective function to obtain the target light source physical parameter vector; wherein, the objective function takes minimizing the confidence that the synthetic images in the synthetic image set are correctly classified as the optimization objective, and the light source physical parameter vector is the optimization variable; An adversarial sample set is generated based on the synthetic images corresponding to the light sources in the synthetic image set that have the physical parameter vector of the target light source.

2. The method according to claim 1, characterized in that, The objective function for constructing the synthetic image set includes: Determine the constraint range of the physical parameter vector of the light source corresponding to the light source; Each of the synthesized images is classified and predicted separately to obtain the confidence level that the synthesized image is correctly classified; The objective function is constructed with the goal of minimizing the confidence that the synthesized images in the synthesized image set are correctly classified, the light source physical parameter vector corresponding to the light source as the optimization variable, and the constraint range as the constraint condition of the variable.

3. The method according to claim 2, characterized in that, Solving the objective function to obtain the target light source physical parameter vector includes: Initialize the parameters of the particle swarm and the position and velocity of each particle in the particle swarm in each dimension; wherein, the position of each particle in one dimension represents the light source physical parameter in one dimension of each set of light source physical parameter vectors, and the light source physical parameter vectors satisfy the constraints. For each particle in the particle swarm, the confidence that the synthesized image is correctly classified is determined as the fitness of the particle. The individual optimal position of the particle and the global optimal position of the particle swarm are updated based on the fitness. The position and velocity of each particle in the particle swarm in each dimension are updated based on the individual optimal position and the global optimal position, and the updated position is constrained according to the constraints. Return to the relevant steps for each particle in the particle swarm, determining the confidence that the synthesized image is correctly classified as the fitness of the particle, until the iteration termination condition is met; The particle swarm is randomly restarted, and the steps for initializing the particle swarm parameters are returned until the restart termination condition is met. The current position of the particle in each dimension is determined as the corresponding dimension of the light source physical parameter vector.

4. The method according to claim 1, characterized in that, Generate an adversarial sample set based on the synthetic image corresponding to the light source having the physical parameter vector of the target light source, including: Random image transformation is performed on the synthetic image corresponding to the light source with the physical parameter vector of the target light source to obtain an adversarial sample set; The random image transformation includes at least one of perspective change, size change, and brightness change.

5. The method according to any one of claims 1-4, characterized in that, The parameters in the physical parameter vector of the light source include wavelength, position, radius, and intensity; The radius is determined based on the distance between the light source and the target object in the original image and the focal length of the light source.

6. An adversarial sample generation device, characterized in that, include: The acquisition module is used to acquire the original image and multiple sets of light sources with different physical parameter vectors, and generate a synthetic image set based on the original image and the light sources; An optimization module is used to construct an objective function corresponding to the synthetic image set and solve the objective function to obtain a target light source physical parameter vector; wherein, the objective function takes minimizing the confidence that the synthetic images in the synthetic image set are correctly classified as the optimization objective, and the light source physical parameter vector is the optimization variable; The adversarial example generation module is used to generate an adversarial example set based on the synthetic image corresponding to the physical parameter vector of the target light source in the synthetic image set.

7. The apparatus according to claim 6, characterized in that, The optimization module includes an objective function construction unit; the objective function construction unit is specifically used for: Determine the constraint range of the physical parameter vector of the light source corresponding to the light source; Each of the synthesized images is classified and predicted separately to obtain the confidence level that the synthesized image is correctly classified; The objective function is constructed with the goal of minimizing the confidence that the synthesized images in the synthesized image set are correctly classified, the light source physical parameter vector corresponding to the light source as the optimization variable, and the constraint range as the constraint condition of the variable.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the adversarial sample generation method according to any one of claims 1-5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the adversarial sample generation method according to any one of claims 1-5.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the adversarial sample generation method according to any one of claims 1-5.

Images