Image point cloud combined automatic driving target detection adversarial patch generation method

Abstract

The application provides an automatic driving target detection adversarial patch generation method based on image point cloud combination, comprising the following steps: obtaining an original image, performing image enhancement on the original image to obtain an original image after image enhancement; obtaining three-dimensional point cloud data of each region of the original image after image enhancement, and extracting an adversarial region of the original image according to the three-dimensional point cloud data; obtaining the gray value of each pixel point in the adversarial region, and determining an adversarial position according to the gray value of each pixel point in the adversarial region; inputting a preset adversarial patch into the corresponding adversarial position to obtain an adversarial sample, inputting the adversarial sample into a target detection model to obtain a loss function; and iteratively optimizing the target detection model according to the loss function to obtain a final adversarial sample, so that the attack effect and comprehensiveness of the generated adversarial patch are improved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence and deep learning technology, and in particular to a method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion. Background Technology

[0002] Autonomous driving technology is a current research hotspot in the field of artificial intelligence, and its core relies on the accurate identification and detection of key targets such as vehicles, pedestrians, and traffic signs by environmental perception systems. Object detection models, represented by deep learning, have become the cornerstone of autonomous driving perception systems due to their powerful feature extraction and classification capabilities. However, numerous studies in recent years have shown that deep learning models generally suffer from robustness deficiencies and are highly vulnerable to adversarial attacks. Adversarial examples, by adding small, carefully designed perturbations to the original input data, can cause the model to output erroneous results with high confidence, posing a serious challenge to the safety of autonomous driving.

[0003] Existing technologies typically place adversarial patches at preset locations in the image or at random locations. This "one-size-fits-all" or random placement method fails to fully utilize the texture distribution, geometric structure, edge information, and scene semantic information of the target object in the image and point cloud data. As a result, the patches fail to accurately target the most sensitive and critical parts of the target detection model, reducing the targeting and efficiency of the attack, and the attack effect is not ideal. Summary of the Invention

[0004] This invention provides a method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion, in order to solve the problem that the effect of adversarial patch attacks in the prior art is not ideal.

[0005] This invention provides a method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion, comprising: The process involves: acquiring the original image; performing image enhancement on the original image to obtain the enhanced original image; acquiring 3D point cloud data for each region of the enhanced original image; extracting adversarial regions from the original image based on the 3D point cloud data; acquiring the grayscale values ​​of each pixel in the adversarial regions; determining the adversarial positions based on the grayscale values ​​of each pixel in the adversarial regions; inputting a preset adversarial patch into the corresponding adversarial position to obtain adversarial samples; inputting the adversarial samples into the target detection model to obtain the loss function; and iteratively optimizing the target detection model based on the loss function to obtain the final adversarial samples.

[0006] Furthermore, image enhancement is performed on the original image, including: Edge detection is performed on the original image using the Canny algorithm to obtain several contour images. The contour similarity between any target contour image and the other contour images is obtained. Based on the contour similarity between the target contour image and the other contour images, associated contour images of the target contour image are selected. The average contour similarity between each associated contour image and the target contour image is calculated to obtain the image correlation of the target contour image. Based on the contour similarity between the target contour image and the other contour images, differential contour images of the target contour image are selected. The image isolation of the target contour image is determined based on the number of differential contour images. The search area is set according to the image correlation and image isolation, and image enhancement is performed on the original image based on the search area.

[0007] Furthermore, the search area is set based on image correlation and image isolation, including: acquiring a preset contour image library, calculating the similarity between each preset contour image in the preset contour image library and the target contour image; selecting the preset contour image with the highest similarity, extracting the contour range of the preset contour image with the highest similarity, and obtaining the initial contour range; standardizing the image correlation and image isolation of the target contour image respectively, calculating the ratio of the standardized image correlation to the image isolation, and adjusting the initial contour range according to the ratio to obtain the search area.

[0008] Furthermore, image enhancement is performed on the original image based on the search region range, including: obtaining any target pixel in the target contour image; using the target pixel as the center of the adaptive search region; using the search region range of the target contour image as the search region range of the corresponding target pixel to obtain the search region; taking the target contour image corresponding to each pixel as an image block; obtaining the image block and search region of all pixels; and performing non-local mean filtering on the target image based on the image block and search region to obtain the original image after image enhancement.

[0009] Furthermore, adversarial regions of the original image are extracted based on the 3D point cloud data, including: establishing and training a semantic segmentation model to obtain a trained semantic segmentation model; acquiring 3D point cloud data of each region of the original image after image enhancement; inputting the 3D point cloud data into the trained semantic segmentation model to obtain the corresponding region categories; and determining the adversarial regions based on the region categories.

[0010] Furthermore, a semantic segmentation model is established and trained to obtain a trained semantic segmentation model, including: acquiring a preset category image library; determining the 3D point cloud data and corresponding category labels of the preset category images based on the preset category image library; establishing a training sample set based on the 3D point cloud data and corresponding category labels of the preset category images; and training the preset model based on the training sample set to obtain a trained semantic segmentation model.

[0011] Furthermore, determining the adversarial position based on the grayscale values ​​of each pixel in the adversarial region includes: acquiring any target adversarial region, segmenting the target adversarial region to obtain several target region blocks; calculating the degree of difference of any target region block, and selecting the difference region block with the highest degree of difference in the target adversarial region; extracting the regional position of the difference region block, and determining the adversarial position of the target adversarial region based on the regional position of the difference region block.

[0012] Further, calculating the degree of difference for any target region block includes: obtaining the average grayscale value of the target region block; calculating the difference between the average grayscale value of the target region block and the average grayscale value of each other target region block within a preset neighborhood; calculating the average difference between the average grayscale value of the target region block and the average grayscale value of each other target region block within a preset neighborhood to obtain the neighborhood correlation degree; obtaining the average average grayscale value of the other target region blocks outside the preset neighborhood of the target region block; calculating the ratio of the average grayscale value of the target region block to the average average grayscale value of the other target region blocks outside the preset neighborhood to obtain the overall degree of difference; and determining the degree of difference based on the neighborhood correlation degree and the overall degree of difference.

[0013] Furthermore, the adversarial examples are input into the object detection model to obtain the loss function, including: obtaining the true label probability of the object detection model and determining the object detection loss based on the true label probability; obtaining the texture feature smoothness of the adversarial examples and determining the smoothness loss based on the texture feature smoothness; obtaining the color salience of the adversarial examples and determining the salience loss based on the color salience; and establishing a loss function based on the object detection loss, smoothness loss, and salience loss.

[0014] Furthermore, the target detection model is iteratively optimized based on the loss function to obtain the final adversarial sample, including: performing gradient backpropagation on the target detection model based on the loss function, optimizing and updating the pixel values ​​of the adversarial sample until convergence; and outputting the adversarial sample obtained after the iterative optimization as the final adversarial sample.

[0015] This invention provides a method for generating adversarial patches for autonomous driving target detection based on image-point cloud fusion. The method involves acquiring an original image, enhancing it to obtain an enhanced original image, acquiring 3D point cloud data for each region of the enhanced original image, extracting adversarial regions from the 3D point cloud data, acquiring the grayscale values ​​of each pixel in the adversarial regions, determining the adversarial position based on these values, inputting a preset adversarial patch into the corresponding adversarial position to obtain an adversarial sample, inputting the adversarial sample into a target detection model to obtain a loss function, and iteratively optimizing the target detection model based on the loss function to obtain the final adversarial sample. This method achieves better attack performance by generating adversarial patches, thereby improving the attack performance of the adversarial sample image and compromising the accuracy of the attacked target detection model during image recognition. It systematically solves a series of technical problems in existing technologies, such as low attack success rate, poor generalization ability, weak targeting, and insufficient concealment, providing strong technical support for the safety assessment and robustness enhancement of autonomous driving systems. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion, as provided in an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0019] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0020] Figure 1This is a flowchart illustrating the method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion, as provided in an embodiment of the present invention.

[0021] like Figure 1 As shown, the execution subject of the autonomous driving target detection adversarial patch generation method based on image point cloud fusion provided in this embodiment of the invention can be an electronic device, and the method mainly includes the following steps: S101, Obtain the original image, perform image enhancement on the original image, and obtain the enhanced original image; In this embodiment, in autonomous driving scenarios, the raw images captured by the vehicle-mounted camera may be affected by various factors such as ambient lighting, weather, and motion blur, leading to a decrease in image quality. To reduce the interference of this noise on subsequent adversarial region and location extraction, the raw image first needs to be enhanced.

[0022] In some embodiments of this application, image enhancement of the original image includes: performing edge detection on the original image based on the Canny algorithm to obtain several contour images; obtaining the contour similarity between any target contour image and the remaining contour images, and filtering out associated contour images of the target contour image based on the contour similarity between the target contour image and the remaining contour images; calculating the average contour similarity between each associated contour image and the target contour image to obtain the image correlation of the target contour image; filtering out the differential contour images of the target contour image based on the contour similarity between the target contour image and the remaining contour images, and determining the image isolation of the target contour image based on the number of differential contour images; setting a search region range based on the image correlation and image isolation, and performing image enhancement on the original image based on the search region range.

[0023] In this embodiment, the edge contours of objects in the original image are detected using the Canny algorithm, resulting in several contour images. Contour similarity is obtained by calculating the Euclidean distance between the Hu moments of each contour image. Contour images with a similarity greater than a preset similarity threshold are identified as associated contour images. The image correlation of the target contour image is then obtained by calculating the average contour similarity between each associated contour image and the target contour image. Image correlation characterizes the frequency of the target contour image in the original image. If a contour shape appears frequently in the image, it indicates that the contour image may not be a key target region, but rather background or a non-salient region. Contour images with a similarity less than or equal to a preset similarity threshold are identified as differential contour images. The number of differential contour images is determined as the image isolation degree of the target contour image. A higher image isolation degree indicates that the contour image is unique, suggesting that the contour image may be a unique feature. By combining image correlation and image isolation degree, a search region range is set, and then image enhancement is performed on the original image based on this search region range.

[0024] In some embodiments of this application, the search region range is set according to image correlation and image isolation, including: obtaining a preset contour image library, calculating the similarity between each preset contour image in the preset contour image library and the target contour image; selecting the preset contour image with the highest similarity, extracting the contour range of the preset contour image with the highest similarity, and obtaining an initial contour range; standardizing the image correlation and image isolation of the target contour image respectively, calculating the ratio of the standardized image correlation to the image isolation, and adjusting the initial contour range according to the ratio to obtain the search region range.

[0025] In this embodiment, the preset contour image library is a prior knowledge base containing a large number of standard, noise-free, and typical object contours. By extracting the preset contour image with the highest similarity, the reference contour most similar to the target contour image is found, and the minimum bounding rectangle of the contour range of the reference contour is determined as the initial search region range. The search region range is obtained by multiplying the ratio of the image correlation degree to the image isolation degree of the target contour image after standardization by the length and width of the initial search region range, respectively.

[0026] In some embodiments of this application, image enhancement of the original image based on the search region range includes: obtaining any target pixel of the target contour image; using the target pixel as the center of the adaptive search region; using the search region range of the target contour image as the search region range of the corresponding target pixel to obtain the search region; taking the target contour image corresponding to each pixel as an image block; obtaining the image block and search region of all pixels; and performing non-local mean filtering on the target image based on the image block and search region to obtain the original image after image enhancement.

[0027] In this embodiment, when the ratio of image correlation to image isolation of the target contour image after normalization is large, it indicates that the contour is a repetitive texture and may belong to the background. A larger search range is needed to include more background information for filtering. When the ratio is small, it indicates that the contour is a unique feature. The search range should be narrowed to protect the details of the region from being overly smoothed. The original image is then enhanced by non-local mean filtering to obtain the enhanced original image.

[0028] S102, acquire the 3D point cloud data of each region of the original image after image enhancement, and extract the adversarial regions of the original image based on the 3D point cloud data; In some embodiments of this application, the adversarial regions of the original image are extracted based on the three-dimensional point cloud data, including: establishing and training a semantic segmentation model to obtain a trained semantic segmentation model; acquiring three-dimensional point cloud data of each region of the original image after image enhancement; inputting the three-dimensional point cloud data into the trained semantic segmentation model to obtain the corresponding region category; and determining the adversarial region based on the region category.

[0029] In some embodiments of this application, establishing and training a semantic segmentation model to obtain a trained semantic segmentation model includes: acquiring a preset category image library; determining the three-dimensional point cloud data of preset category images and their corresponding category labels based on the preset category image library; establishing a training sample set based on the three-dimensional point cloud data of preset category images and their corresponding category labels; and training the preset model based on the training sample set to obtain a trained semantic segmentation model.

[0030] In this embodiment, a pre-defined image library containing various autonomous driving scenario targets is constructed, such as vehicles, pedestrians, bicycles, and traffic signs. For each image in the library, its corresponding 3D point cloud data needs to be acquired, and each point in the point cloud is manually labeled with its corresponding category. A mature point cloud semantic segmentation network is selected, and the point cloud data containing 3D coordinates and possible reflection intensity information is used as input, with the corresponding category labels as output, to train the network. After training, the model can predict the category of each region in any input point cloud data. The 3D point cloud data of each region of the original image after image enhancement is input into the trained semantic segmentation model to obtain the corresponding region categories. Regions whose categories belong to a pre-defined key category are selected as adversarial regions.

[0031] S103, obtain the grayscale value of each pixel in the adversarial region, and determine the adversarial position based on the grayscale value of each pixel in the adversarial region; In this embodiment, after identifying one or more adversarial regions, it is necessary to further refine the localization within these regions to find the specific adversarial locations that are most sensitive to the target detection model and most prone to misjudgment.

[0032] In some embodiments of this application, determining the adversarial position based on the grayscale value of each pixel in the adversarial region includes: obtaining any target adversarial region, segmenting the target adversarial region to obtain several target region blocks; calculating the degree of difference of any target region block, and selecting the difference region block with the highest degree of difference in the target adversarial region; extracting the regional position of the difference region block, and determining the adversarial position of the target adversarial region based on the regional position of the difference region block.

[0033] In this embodiment, the adversarial region is divided into a series of equal-sized, non-overlapping region blocks. The size of the blocks can be set empirically, for example, 16x16 pixels. For each region block, its degree of difference is calculated. The higher the degree of difference, the more prominent it is within the adversarial region. The difference region block is taken as the final adversarial position.

[0034] In some embodiments of this application, calculating the degree of difference of any target region block includes: obtaining the average gray value of the target region block; calculating the difference between the average gray value of the target region block and the average gray value of each other target region block within a preset neighborhood; calculating the average difference between the average gray value of the target region block and the average gray value of each other target region block within the preset neighborhood to obtain the neighborhood correlation degree; obtaining the average average gray value of the other target region blocks outside the preset neighborhood of the target region block; calculating the ratio of the average gray value of the target region block to the average average gray value of the other target region blocks outside the preset neighborhood to obtain the overall degree of difference; and determining the degree of difference based on the neighborhood correlation degree and the overall degree of difference.

[0035] In this embodiment, the domain correlation degree is calculated by the average difference between the grayscale mean values ​​of the target region block and the other target region blocks in the preset neighborhood. The average grayscale mean value of all region blocks in the entire adversarial region, excluding the target region block and its neighborhood, is calculated. The overall difference degree is determined by the ratio of the grayscale mean value of the target region block to the average grayscale mean value. The domain correlation degree and the overall difference degree are standardized respectively. The ratio of the standardized domain correlation degree to the overall difference degree is calculated to obtain the degree of difference.

[0036] S104, Input the preset adversarial patch into the corresponding adversarial position to obtain the adversarial sample, and input the adversarial sample into the target detection model to obtain the loss function; In some embodiments of this application, the adversarial example is input into the target detection model to obtain a loss function, including: obtaining the true label probability of the target detection model and determining the target detection loss based on the true label probability; obtaining the texture feature smoothness of the adversarial example and determining the smoothness loss based on the texture feature smoothness; obtaining the color salience of the adversarial example and determining the salience loss based on the color salience; and establishing a loss function based on the target detection loss, smoothness loss, and salience loss.

[0037] In this embodiment, after determining the adversarial location, an initial pre-set adversarial patch is placed at the adversarial location in the image to generate an initial adversarial sample. Then, this adversarial sample is input into the target detection model to be attacked, and a loss function including target detection loss, smoothness loss, and salience loss is established.

[0038] S105, the target detection model is iteratively optimized based on the loss function to obtain the final adversarial example.

[0039] In some embodiments of this application, the target detection model is iteratively optimized according to the loss function to obtain the final adversarial sample, including: performing gradient backpropagation on the target detection model based on the loss function, optimizing and updating the pixel values ​​of the adversarial sample until convergence; and outputting the adversarial sample obtained after the iterative optimization as the final adversarial sample.

[0040] In this embodiment, the total loss is calculated relative to the gradient of the adversarial example. Then, gradient descent or its variants are used to update the pixel values ​​of the patch region to minimize the loss. This process is iterative; in each iteration, the pixel values ​​of the patch are updated, and the new adversarial example is re-inputted into the model to calculate the loss. This process is repeated until the loss function converges or a preset maximum number of iterations is reached. The adversarial example obtained after the iterative optimization is completed is output as the final adversarial example.

[0041] It should be noted that all relevant information that may be involved in the various embodiments of the present invention is processed in strict accordance with the requirements of laws and regulations, following the principles of legality, legitimacy, and necessity, based on the reasonable purpose of the business scenario, and is information that users actively provide or generate during the use of the product / service, as well as information obtained with user authorization.

[0042] The information processed by this invention may vary depending on the specific product / service scenario and should be based on the specific scenario in which the user uses the product / service. This may involve user account information, device information, or other related information. This invention will treat the relevant information and its processing with the utmost diligence.

[0043] This invention places great emphasis on the security of relevant information and has adopted reasonable and feasible security protection measures that comply with industry standards to protect user information and prevent unauthorized access, public disclosure, use, modification, damage or loss of relevant information.

[0044] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0045] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0046] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion, characterized in that, include: Obtain the original image, perform image enhancement on the original image, and obtain the enhanced original image; Acquire 3D point cloud data of each region of the original image after image enhancement, and extract adversarial regions of the original image based on the 3D point cloud data; Obtain the grayscale value of each pixel in the adversarial region, and determine the adversarial position based on the grayscale value of each pixel in the adversarial region; Input the preset adversarial patch into the corresponding adversarial position to obtain the adversarial sample, and input the adversarial sample into the target detection model to obtain the loss function; The target detection model is iteratively optimized based on the loss function to obtain the final adversarial example.

2. The method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion according to claim 1, characterized in that, Image enhancement of the original image includes: Edge detection is performed on the original image based on the Canny algorithm to obtain several contour images; Obtain the contour similarity between any target contour image and the remaining contour images, and filter out the associated contour images of the target contour image based on the contour similarity between the target contour image and the remaining contour images. Calculate the mean contour similarity between each associated contour image and the target contour image to obtain the image association degree of the target contour image; Based on the contour similarity between the target contour image and the other contour images, the difference contour images of the target contour image are selected, and the image isolation degree of the target contour image is determined based on the number of difference contour images. The search area is set according to the image correlation and image isolation, and the original image is enhanced according to the search area.

3. The method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion according to claim 2, characterized in that, The search area is defined based on image correlation and image isolation, including: Obtain a preset contour image library and calculate the similarity between each preset contour image in the preset contour image library and the target contour image; Select the preset contour image with the highest similarity, extract the contour range of the preset contour image with the highest similarity, and obtain the initial contour range; The image correlation and image isolation of the target contour image are standardized respectively. The ratio of the standardized image correlation to the image isolation is calculated. The initial contour range is adjusted according to the ratio to obtain the search area range.

4. The method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion according to claim 2, characterized in that, Image enhancement is performed on the original image based on the search region, including: Obtain any target pixel in the target contour image, use the target pixel as the center of the adaptive search region, and use the search region range of the target contour image as the search region range of the corresponding target pixel to obtain the search region; The target contour image corresponding to each pixel is taken as an image block, and the image blocks and search regions of all pixels are obtained. Non-local mean filtering is performed on the target image based on the image blocks and search regions to obtain the original image after image enhancement.

5. The method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion according to claim 1, characterized in that, The adversarial regions of the original image are extracted from the 3D point cloud data, including: Build and train a semantic segmentation model to obtain a trained semantic segmentation model; The three-dimensional point cloud data of each region of the original image after image enhancement is obtained. The three-dimensional point cloud data is then input into the trained semantic segmentation model to obtain the corresponding region categories. The adversarial regions are then determined based on the region categories.

6. The method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion according to claim 5, characterized in that, Build and train a semantic segmentation model to obtain a trained semantic segmentation model, including: Obtain a preset category image library, and determine the 3D point cloud data and corresponding category labels of the preset category images based on the preset category image library; A training sample set is established based on the 3D point cloud data of images of preset categories and their corresponding category labels. The preset model is then trained based on the training sample set to obtain a trained semantic segmentation model.

7. The method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion according to claim 1, characterized in that, The adversarial position is determined based on the grayscale values ​​of each pixel in the adversarial region, including: Obtain any target adversarial region, segment the target adversarial region to obtain several target region blocks; Calculate the degree of difference for any target region block and filter out the region block with the highest degree of difference in the target adversarial region; Extract the location of the difference region block, and determine the adversarial position of the target adversarial region based on the location of the difference region block.

8. The method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion according to claim 7, characterized in that, Calculate the degree of difference for any target region block, including: Obtain the average gray value of the target region block and calculate the difference between the average gray value of the target region block and the average gray value of each other target region block in the preset neighborhood. The neighborhood correlation degree is obtained by calculating the average difference between the grayscale mean of the target area block and the mean of all other target area blocks in the preset neighborhood. Obtain the average gray value of the remaining target regions outside the preset neighborhood of the target region block, calculate the ratio of the average gray value of the target region block to the average gray value of the remaining target regions outside the preset neighborhood, and obtain the overall difference degree. The degree of difference is determined based on the degree of relevance within the domain and the overall degree of difference.

9. The method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion according to claim 1, characterized in that, By inputting adversarial examples into the object detection model, the loss function is obtained, including: Obtain the true label probability of the object detection model, and determine the object detection loss based on the true label probability; Obtain the texture feature smoothness of the adversarial example, and determine the smoothness loss based on the texture feature smoothness; Obtain the color salience of the adversarial example and determine the salience loss based on the color salience; A loss function is established based on the target detection loss, smoothness loss, and salience loss.

10. The method for generating adversarial patches for autonomous driving target detection based on image point cloud fusion according to claim 1, characterized in that, The target detection model is iteratively optimized based on the loss function to obtain the final adversarial examples, including: The target detection model is backpropagated based on the loss function to optimize and update the pixel values ​​of adversarial examples until convergence. The adversarial samples obtained after iterative optimization are output as the final adversarial samples.

Images