Physical adversarial sample generation method for automatic driving perception system

Abstract

This application discloses a method, electronic device, and computer-readable storage medium for generating physical adversarial examples for autonomous driving perception systems. The method includes: acquiring the original image to be processed and the original adversarial perturbation; inputting the original image superimposed with the original adversarial perturbation into a target detection model to obtain predicted classification results and predicted bounding box results; calculating a joint optimization loss function based on the predicted classification results and predicted bounding box results; the joint optimization loss function includes at least classification loss, regression loss, and repulsion loss; calculating gradient information relative to the adversarial perturbation according to the joint optimization loss function, and iteratively updating the original adversarial perturbation using the gradient information to generate a target adversarial perturbation; and superimposing the target adversarial perturbation onto the original image to generate the final adversarial example. Thus, based on a decoupled head architecture, by physically isolating the optimization paths of classification and regression tasks, gradient interference is effectively eliminated, improving the generation quality and survival rate of adversarial examples.

Description

Technical Field

[0001] This invention relates to the field of safety evaluation and defense technology for autonomous driving systems, and in particular to a method for generating physical adversarial samples for autonomous driving perception systems, an electronic device, and a computer-readable storage medium. Background Technology

[0002] With the rapid development of autonomous driving technology, ensuring its safety and robustness has become crucial. Traditional safety evaluation methods mainly focus on the system's performance under normal operation, but with the emergence of adversarial attacks, existing evaluation methods face new challenges.

[0003] Adversarial examples can induce false detections in autonomous driving systems by projecting optical perturbations, consuming computational resources, interfering with driving decisions, and thus exposing vulnerabilities in the perception system. Therefore, researching the design and generation of adversarial examples is of great significance for exposing vulnerabilities in autonomous driving visual perception systems, improving subsequent vulnerability detection and defense algorithms, and further enhancing the safety of autonomous vehicles.

[0004] Therefore, a method for generating physical adversarial examples for autonomous driving perception systems, an electronic device, and a computer-readable storage medium are needed to solve the above problems. Summary of the Invention

[0005] The purpose of this application is to provide a method, electronic device, and computer-readable storage medium for generating physical adversarial examples for autonomous driving perception systems. Based on a decoupled head architecture, it can effectively eliminate gradient interference by physically isolating the optimized paths of classification and regression tasks, thereby improving the generation quality and survival rate of adversarial examples, so as to develop vulnerability detection algorithms for autonomous driving perception systems and improve the safety of autonomous vehicles.

[0006] To achieve the above objectives: This application provides a method for generating physical adversarial examples for an autonomous driving perception system, comprising: acquiring an original image to be processed and an original adversarial perturbation; inputting the original image superimposed with the original adversarial perturbation into a target detection model to obtain a predicted classification result and a predicted bounding box result; calculating a joint optimization loss function based on the predicted classification result and the predicted bounding box result; the joint optimization loss function includes at least a classification loss, a regression loss, and a repulsion loss; calculating gradient information relative to the adversarial perturbation according to the joint optimization loss function, and using the gradient information to iteratively update the original adversarial perturbation to generate a target adversarial perturbation; and superimposing the target adversarial perturbation onto the original image to generate the final adversarial example.

[0007] In one embodiment, the target detection model employs a decoupled head architecture; the classification loss is calculated based on the classification score output by the classification branch in the decoupled head architecture; and the regression loss is calculated based on the bounding box coordinates output by the regression branch in the decoupled head architecture.

[0008] In one embodiment, the formula for calculating the joint optimization loss function includes: ;in, , and These are the weighting coefficients of the loss function. To counteract disturbances, For the total optimization loss, This is the classification loss, used to minimize the predicted probability of the true class; The regression loss is used to constrain the deviation of the predicted bounding box area from the true value; To eliminate the loss, the distance between the predicted bounding box and the true bounding box is increased.

[0009] In one embodiment, iteratively updating the original adversarial perturbation using the gradient information includes: calculating the perturbation update amount based on the joint optimization loss function using a learning rate with cosine annealing and projected gradient descent; and performing a projection operation on the updated target adversarial perturbation, the projection operation including a preset perturbation threshold. The pruning and spatial constraints based on the threshold truncation mechanism.

[0010] In one embodiment, the formula for iteratively updating the original adversarial perturbation is: ;in, This means that the perturbation will be cropped back to reasonable physical and pixel boundaries. For dynamic learning rate, For the perturbation of the current iteration, The gradient information of the joint optimization loss function with respect to the current perturbation.

[0011] In one embodiment, the step of superimposing the target adversarial perturbation onto the original image to generate the final adversarial sample includes: defining a physical constraint region; and, based on the physical constraint region, applying the target adversarial perturbation to the surface of the original image via a physically attached carrier to generate the adversarial sample.

[0012] In one embodiment, the method further includes: verifying the attack effect of the adversarial perturbation on the target; the attack effect verification includes: generating adversarial samples based on the adversarial perturbation and inputting them into the target detection model; applying non-maximum suppression to filter multiple candidate boxes output by the target detection model to obtain target prediction results; and outputting verification results containing false target survival rate and confidence information.

[0013] In one embodiment, the output includes a verification report containing false target survival rate and confidence information, and then includes: determining whether the false target survival rate in the verification result is lower than a preset threshold; if so, calculating feedback gradient information based on the verification result, or adjusting the target range of the physical constraint region; and performing a second iteration update on the target adversarial perturbation based on the feedback gradient information or the adjusted target range to generate an updated adversarial perturbation.

[0014] This application provides an electronic device, including a processor and a memory storing a computer program, wherein when the processor runs the computer program, the steps of the above method are implemented.

[0015] This application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method.

[0016] This application provides a method, electronic device, and computer-readable storage medium for generating physical adversarial examples for autonomous driving perception systems. The method includes: inputting an original adversarial perturbation and an original image into a target detection model to obtain predicted classification results and predicted bounding box results; calculating a joint optimization loss function based on the predicted classification results and predicted bounding box results; the joint optimization loss function includes at least classification loss, regression loss, and repulsion loss; calculating gradient information relative to the adversarial perturbation according to the joint optimization loss function, and iteratively updating the original adversarial perturbation using the gradient information to generate a target adversarial perturbation; and superimposing the target adversarial perturbation onto the original image to generate the final adversarial example. Thus, based on a decoupled head architecture, by physically isolating the optimization paths of classification and regression tasks, gradient interference is effectively eliminated, improving the generation quality and survival rate of adversarial examples. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a method for generating physical adversarial samples for an autonomous driving perception system, as provided in an embodiment of the present invention.

[0018] Figure 2 An optimization flowchart for countering disturbances is provided for embodiments of the present invention.

[0019] Figure 3A flowchart of an adversarial sample testing method for an autonomous driving system provided in an embodiment of the present invention.

[0020] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0021] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements.

[0022] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, components, features, and elements with the same names in different embodiments of this application may have the same meaning or different meanings, the specific meaning of which must be determined by its interpretation in that specific embodiment or further in conjunction with the context of that specific embodiment.

[0023] It should be understood that although the terms first, second, third, etc., may be used herein to describe various information, such information should not be limited to these terms. These terms are used only to distinguish information of the same type from one another. For example, without departing from the scope of this document, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if," as used herein, can be interpreted as "when," "when," or "in response to determination." Furthermore, as used herein, the singular forms "a," "an," and "the" are intended to also include the plural forms unless the context indicates otherwise. It should be further understood that the terms "comprising," "including," indicate the presence of the stated feature, step, operation, element, component, item, kind, and / or group, but do not exclude the presence, occurrence, or addition of one or more other features, steps, operations, elements, components, items, kinds, and / or groups. The terms "or" and "and / or" as used herein are to be interpreted as inclusive, or mean any one or any combination thereof. Therefore, "A, B, or C" or "A, B, and / or C" means "any one of the following: A; B; C; A and B; A and C; B and C; A, B, and C". Exceptions to this definition will only occur if the combination of elements, functions, steps, or operations is inherently mutually exclusive in some way.

[0024] It should be understood that although the steps in the flowcharts of this application's embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0025] It should be noted that step designations such as S1 and S2 are used in this document for the purpose of more clearly and concisely describing the corresponding content, and do not constitute a substantial limitation on the order. In specific implementation, those skilled in the art may execute S2 first and then S1, etc., but these should all be within the protection scope of this application.

[0026] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0027] In the following description, the use of suffixes such as "module," "part," or "unit" to denote elements is solely for the purpose of illustrative purposes and has no specific meaning in itself. Therefore, "module," "part," or "unit" may be used interchangeably.

[0028] See Figure 1 This application provides a method for generating physical adversarial examples for an autonomous driving perception system. This method can be executed by an electronic device provided in this application, which can be implemented in software and / or hardware. The method provided in this embodiment includes: Step S1: Obtain the original image to be processed and the original adversarial perturbation.

[0029] Original image: refers to the natural scene image or video frame to be processed without adversarial perturbation. The image contains at least one target object to be processed (such as a vehicle, pedestrian, traffic sign, etc.), whose pixel values ​​are within the normal range (e.g., 0-255) and conform to the standard input format of the object detection model (e.g., RGB three-channel image).

[0030] Initial adversarial perturbation: refers to the initial noise matrix or initial texture pattern superimposed on the original image before the iterative optimization process begins. The size of this perturbation matches the original image, and its pixel values ​​can be randomly generated noise (such as Gaussian noise or uniform noise) or initial patches generated based on a pre-trained model. Their numerical range is typically limited to a preset perturbation threshold (e.g., [...]). ,+ ] ), to ensure the concealment of the disturbance.

[0031] In this embodiment, the original image is a background image reflecting the real physical environment, acquired through vehicle-mounted cameras or monitoring equipment. This image serves as the background for adversarial perturbations, simulating the visual state of a target surface (such as a road surface or vehicle body) onto which an adversarial texture is projected by a projection device when it is not attacked. The initial adversarial perturbation refers to the initial pattern generated in advance to simulate the projection beam before gradient iteration updates. In subsequent optimization steps, the initial adversarial perturbation is used as a variable and continuously updated through the gradient descent algorithm, eventually evolving into a target adversarial perturbation (i.e., the final projected pattern) that can effectively deceive the target detection model.

[0032] Step S2: Input the original image with the original adversarial perturbation superimposed into the object detection model to obtain the predicted classification result and the predicted bounding box result.

[0033] Object detection models are pre-trained deep neural network models used in autonomous driving perception systems. They are configured to receive image data as input and output the category labels and spatial location information of target objects in the image.

[0034] Specifically, the object detection model refers to a deep neural network model employing a decoupled detection head design. Structurally, this model separates the processing paths for classification and regression tasks, including: a backbone network for extracting multi-scale feature maps from the input image; a neck network for fusing feature information at different scales (e.g., through a feature pyramid structure); and a decoupled detection head connected to the neck network, containing independent classification and regression branches: the classification branch specifically processes semantic information in the feature maps, outputting the object's class probability distribution (i.e., the predicted classification result); the regression branch specifically processes geometric spatial information in the feature maps, outputting the object's bounding box coordinate offset (i.e., the predicted bounding box result).

[0035] Step S3: Based on the predicted classification results and predicted bounding box results, calculate the joint optimization loss function; the joint optimization loss function includes at least classification loss, regression loss and exclusion loss.

[0036] In this embodiment, jointly optimizing the loss function is the core principle for implementing physical delay attacks.

[0037] The classification loss aims to reduce the model's confidence in correctly classifying the background region, inducing false detections. The regression loss initially guides the predicted bounding box to move towards the attacker's predetermined misleading region. The repulsion loss calculates the negative Euclidean distance between the center point of the predicted bounding box and the original target's true center point. By minimizing this loss (i.e., the negative distance decreases, meaning the positive distance increases), the model is forced to push the predicted bounding box infinitely away from the true target's location, thus creating a significant positioning bias in physical space and misleading the autonomous driving decision-making system.

[0038] Through the weighted joint optimization of the above three losses, the generated adversarial perturbation can simultaneously possess strong classification deception and extreme location disruption.

[0039] Step S4: Calculate the gradient information relative to the adversarial perturbation based on the joint optimization loss function, and use the gradient information to iteratively update the original adversarial perturbation to generate the target adversarial perturbation.

[0040] Gradient information refers to the derivative vector or tensor used in the iterative optimization process of adversarial example generation to indicate the trend of the joint optimization loss function with respect to the adversarial perturbation.

[0041] Specifically, gradient information characterizes the rate and direction of change of the joint optimization loss function value when the pixel values ​​of the adversarial perturbation change slightly, while keeping the original image unchanged. By updating the perturbation along the gradient direction (or its reverse direction, depending on the optimizer settings), the generated adversarial examples can more effectively deceive the object detection model in each iteration.

[0042] In physical delay attacks, this gradient information not only contains the classification and localization error directions required by the attack model, but also implicitly contains the constraint features (such as illumination attenuation, blurring effect, etc.) that propagate back through the physical projection imaging model.

[0043] Target adversarial perturbation refers to the optimal perturbation tensor that is finally converged and determined after an iterative optimization process, and is used to superimpose onto the original image.

[0044] Step S5: Superimpose the target adversarial perturbation onto the original image to generate the final adversarial sample.

[0045] In this embodiment, adversarial examples refer to the final data form or physical entity generated after iterative updates of the joint optimization loss function, which is superimposed with the target adversarial perturbation.

[0046] In the feature space of an autonomous driving perception system, adversarial examples are configured to trigger pre-defined classification errors, localization biases, and spatial exclusion effects.

[0047] In summary, the method provided in the above embodiments, based on a decoupled head architecture, effectively eliminates gradient interference by physically isolating the optimized paths of classification and regression tasks, improves the generation quality and survival rate of adversarial examples, thereby developing a vulnerability detection algorithm for autonomous driving perception systems and improving the safety of autonomous vehicles.

[0048] In one implementation, the target detection model employs a decoupled head architecture; The classification loss is calculated based on the classification score output by the classification branch in the decoupled head architecture; The regression loss is calculated based on the bounding box coordinates output by the regression branch in the decoupled head architecture.

[0049] See Figure 2 Based on a decoupled head architecture, classification and regression tasks are optimized independently, which can ensure that perturbations can effectively act on the physical environment, while avoiding gradient interference between classification and localization tasks.

[0050] A threshold truncation mechanism is applied to the classification branch to filter candidate boxes based on a set confidence threshold, thus avoiding unnecessary high-confidence boxes that waste optimization resources.

[0051] Meanwhile, Gaussian repulsion loss is introduced into the regression branch to optimize the spatial distribution between candidate boxes and prevent excessive overlap of target boxes.

[0052] Finally, a regression distribution-guided strategy is used to optimize the geometric distribution of candidate boxes and increase the coverage area of ​​false targets. By introducing an area penalty mechanism, it is ensured that the generated candidate boxes have a larger physical coverage area, thereby improving the spatial efficiency of the attack.

[0053] Specifically, the classification branch typically consists of a series of convolutional layers, focusing on extracting features rich in semantic context to accurately determine the category of the target (such as distinguishing between vehicles and pedestrians). The regression branch consists of another set of independent convolutional layers, focusing on extracting edge and detail features to accurately predict the center point coordinates and width and height of the bounding box.

[0054] In one embodiment, the formula for calculating the joint optimization loss function includes: ; in, , and These are the weighting coefficients of the loss function. To counteract disturbances, For the total optimization loss, This is the classification loss, used to minimize the predicted probability of the true class; The regression loss is used to constrain the deviation of the predicted bounding box area from the true value; To eliminate the loss, the distance between the predicted bounding box and the true bounding box is increased.

[0055] For example, a threshold truncation mechanism is applied to the classification branch to set a confidence threshold. When the confidence level of a candidate bounding box exceeds this threshold, optimization for that box stops. Classification loss: ; in, For the first The predicted probability of each target category. For indicator functions, The classification confidence threshold.

[0056] Introducing Gaussian repulsion loss By calculating the distance between the center coordinates of candidate boxes, overly close candidate boxes are forced to repel each other, preventing them from being eliminated during non-maximum suppression (NMS). Repulsion Loss: ; in, and Candidate boxes and The center coordinates, To control the hyperparameter of the repulsive radius, Let be the Euclidean distance between the centers of the two targets.

[0057] Specifically, the repulsion loss function applies a continuously differentiable penalty to the distance between candidate boxes using a Gaussian kernel, promoting a good distribution of candidate boxes in physical space and avoiding high spatial overlap.

[0058] A regression distribution guidance mechanism is introduced to optimize the geometric distribution of candidate boxes, ensuring that generated false targets cover a larger physical area and improving attack effectiveness. Regression loss: ; in, and These are the width and height of the candidate box, respectively. The maximum scale of the regression features. This is a regression area penalty term.

[0059] Specifically, by normalizing the area of ​​candidate boxes, smaller candidate box areas are penalized, prompting the network to generate target boxes with larger coverage areas, thus ensuring the spatial performance of false targets. In addition, with the guidance of positional divergence, it is ensured that candidate boxes generate effective target boxes with larger receptive fields and fuller coverage areas, avoiding filtering by non-maximum suppression (NMS).

[0060] Based on the above steps, considering classification loss, regression loss and exclusion loss, the perturbation update is performed through a joint optimization objective; ; in, , and These are the weighting coefficients of the loss function. This represents the total optimization loss.

[0061] In one embodiment, the original adversarial perturbation is iteratively updated using gradient information, including: The perturbation update amount is calculated based on the joint optimization loss function using the learning rate of cosine annealing and the projected gradient descent method. The updated target adversarial perturbation is subjected to a projection operation, which includes a projection operation based on a preset perturbation threshold. The pruning and spatial constraints based on the threshold truncation mechanism.

[0062] In the process of generating adversarial perturbations, the projected gradient descent method is used to find the perturbation direction that maximizes the joint optimization loss function in the constraint space. At the same time, the cosine annealing strategy is used to dynamically adjust the update step size (i.e., learning rate) of each iteration to balance the global exploration capability and local convergence accuracy of the attack.

[0063] Specifically, in each iteration t, the joint optimization loss function is first calculated. Regarding the current counter-disturbance gradient information Then, the perturbation is updated in the direction of gradient information ascent. To ensure that the generated adversarial examples are imperceptible in the physical world or comply with the brightness limitations of the projection device, the updated adversarial perturbation must be limited to a preset range (e.g., constraints). ).

[0064] In one embodiment, the formula for iteratively updating the original adversarial perturbation is: ; in, This means that the perturbation will be cropped back to reasonable physical and pixel boundaries. For dynamic learning rate, For the perturbation of the current iteration, This is to jointly optimize the gradient information of the loss function with respect to the current perturbation.

[0065] Specifically, projective gradient descent (PGD) with cosine annealing learning rate scheduling is used to iteratively update the adversarial perturbation. This ensures that the disturbance remains within the physical and pixel boundaries; ; in, This means that the perturbation will be cropped back to reasonable physical and pixel boundaries. For dynamic learning rate, This represents the adversarial perturbation in the current iteration. After multiple iterations and optimizations, the adversarial perturbation... Once convergence is achieved, adversarial examples with maximum effectiveness can be generated.

[0066] By employing the above method, the projected gradient descent (PGD) method is used to ensure that the generated adversarial perturbations are always kept within a physically realizable small range. At the same time, the cosine annealing strategy is used to allow the update step size to decrease smoothly from large to small as the iteration process proceeds. Thus, while ensuring the stealth of the attack, the adversarial perturbations that can maximize the joint optimization loss function can be found quickly and accurately.

[0067] In one embodiment, the target adversarial perturbation is superimposed onto the original image to generate the final adversarial example, including: Define the physical constraint region; Based on physically constrained regions, adversarial perturbations are applied to the surface of the original image through a physically attached carrier to generate adversarial examples.

[0068] The physical constraint region refers to the spatiotemporal feasible domain in the physical world that can effectively bear and project against disturbances due to the physical characteristics of the carrier (such as size, shape, rigidity, and optical response range) and the physical laws of the environment (such as light propagation attenuation and motion fuzziness limitation).

[0069] See Figure 3 For example, the raw images of the input from the pre-collected autonomous driving system are obtained, and a physical constraint region mask is defined to ensure that the adversarial perturbation only works within that region; the adversarial perturbation is pre-generated and applied to the target surface by a projector or sticker to generate adversarial samples.

[0070] In one embodiment, the method further includes: Verify the attack effectiveness against the target's counter-disturbance; the attack effectiveness verification includes: Adversarial samples are generated based on the target adversarial perturbation and then input into the target detection model. Nonmaximum suppression is applied to filter multiple candidate boxes output by the target detection model to obtain the target prediction result; Output the verification results, which include information on the survival rate and confidence level of false targets.

[0071] Specifically, after inputting adversarial examples into the object detection model, it generates multiple candidate boxes and assigns a confidence score to each candidate box, calculating the predicted confidence of the target based on the classification branch. Then, non-maximum suppression (NMS) is applied to each candidate box to filter out boxes / candidate boxes with high overlap, retaining valid false targets. Finally, based on the original image and the false targets, the final verification results are output, including statistical information such as the number of false targets that successfully penetrated the perception system of the autonomous driving system, their survival rate, and their confidence scores.

[0072] The verification of adversarial attack effects is integrated into the development and iteration process (CI / CD) of the perception system, forming an automated security defense. Specifically, adversarial perturbations that can successfully deceive the perception system, discovered during the verification phase, along with their corresponding physical scenarios (such as specific lighting, angles, and movement speeds), are saved to form an adversarial scenario library. These known adversarial perturbations are then used to drive a fuzzing framework (such as FuzzSense) to perform targeted mutations, conducting local searches and expansions around these known vulnerabilities. This uncovers more hidden vulnerabilities of the same type in the perception system, enabling iterative updates and allowing the perception system to evolve into a professional security system capable of accurately identifying high-risk adversarial examples.

[0073] It should be noted that after updating the target detection model in the perception system, the actual effectiveness of defense strategies (such as adversarial training and input preprocessing) is quantitatively evaluated by comparing the failure levels of the new and old models under the same adversarial perturbations. If the new model is still easily fooled, it indicates that the vulnerability has not been patched, and the model should be prevented from being deployed online.

[0074] In one implementation, a verification report is output, including information on the survival rate and confidence level of false targets, followed by: Determine whether the survival rate of false targets in the verification results is lower than a preset threshold; If so, calculate the feedback gradient information based on the verification results, or adjust the target range of the physical constraint region; Based on the feedback gradient information or the adjusted target range, the target adversarial perturbation is updated in a second iteration to generate the updated adversarial perturbation.

[0075] The false target survival rate is the proportion of false target frames that are continuously misidentified as valid targets by the perception system in consecutive video frames or multiple physical detections, out of the total number of detection frames.

[0076] The preset threshold is the minimum attack persistence standard set according to actual attack requirements (for example, requiring a fake target to survive for at least 8 out of 10 consecutive frames, i.e., a survival rate threshold of 80%).

[0077] When the survival rate of false targets is lower than the preset threshold, it indicates that the current adversarial perturbation / target adversarial perturbation is easily lost or unstable in the physical environment and needs further optimization.

[0078] Specifically, the mechanism monitors the actual effect of adversarial attacks in a verification environment in real time to determine whether they meet preset performance indicators (i.e., whether the survival rate of false targets is below a threshold). If the expected effect is not achieved, the mechanism will automatically trigger a secondary optimization process: by calculating feedback gradient information to fine-tune the texture features of the perturbation, or by adjusting the target range of the physical constraint region to change the spatial layout of the perturbation, thereby performing targeted secondary iterative updates to the target adversarial perturbation until an updated adversarial perturbation that meets the attack effectiveness requirements is generated, thus ensuring that the final generated target adversarial perturbation has a strong and continuous deception capability in the real physical world.

[0079] In summary, the method provided in the above embodiments, based on a decoupled head architecture, effectively eliminates gradient interference by physically isolating the optimization paths of classification and regression tasks. By jointly optimizing classification loss, regression loss, and repulsion loss, it generates adversarial perturbations for multi-dimensional attacks, improving the quality and survival rate of generated adversarial examples. Furthermore, the generated high-quality adversarial examples can help autonomous driving developers discover logical vulnerabilities in vulnerability detection algorithms within perception systems. By utilizing these high-quality adversarial examples for adversarial training, the perception system can be optimized, thereby improving the overall security of the autonomous driving system.

[0080] Based on the same inventive concept as the foregoing embodiments, this invention provides an electronic device, such as... Figure 4 As shown, the device includes: a processor 310 and a memory 311 storing a computer program; wherein, Figure 4 The processor 310 shown in the diagram does not indicate that there is only one processor 310, but only indicates the positional relationship of the processor 310 relative to other devices. In practical applications, there can be one or more processors 310; similarly, Figure 4 The memory 311 illustrated herein has the same meaning, that is, it is only used to indicate the positional relationship of memory 311 relative to other devices. In practical applications, there can be one or more memories 311. When the processor 310 runs the computer program, the method applied to the above-mentioned device is implemented.

[0081] The device may also include at least one network interface 312. The various components of the device are coupled together via a bus system 313. It is understood that the bus system 313 is used to implement communication between these components. In addition to a data bus, the bus system 313 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 3 The general designated all buses as Bus System 313.

[0082] The memory 311 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 311 described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0083] The memory 311 in this embodiment of the invention is used to store various types of data to support the operation of the device. Examples of this data include: any computer programs used to operate on the device, such as operating systems and applications; contact data; phonebook data; messages; pictures; videos, etc. The operating system includes various system programs, such as the framework layer, core library layer, driver layer, etc., used to implement various basic services and handle hardware-based tasks. Applications can include various applications, such as media players, browsers, etc., used to implement various application services. Here, the program implementing the method of this embodiment of the invention can be included in the application.

[0084] Based on the same inventive concept as the foregoing embodiments, this embodiment also provides a computer-readable storage medium storing a computer program. The computer-readable storage medium can be a magnetic random access memory (FRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM), etc.; it can also be various devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc. When the computer program stored in the computer-readable storage medium is run by a processor, it implements the above method. For the specific steps implemented when the computer program is executed by the processor, please refer to [link to relevant documentation]. Figure 1 The description of the illustrated embodiments will not be repeated here.

[0085] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0086] In this document, the terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, which includes not only the elements listed but also other elements not expressly listed.

[0087] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for generating physical adversarial examples for autonomous driving perception systems, characterized in that, include: Obtain the original image to be processed and the original adversarial perturbation; The original image with the original adversarial perturbation superimposed is input into the target detection model to obtain the predicted classification result and the predicted bounding box result; Based on the predicted classification results and the predicted bounding box results, a joint optimization loss function is calculated; the joint optimization loss function includes at least classification loss, regression loss and exclusion loss. The gradient information relative to the adversarial perturbation is calculated based on the joint optimization loss function, and the original adversarial perturbation is iteratively updated using the gradient information to generate the target adversarial perturbation; The target adversarial perturbation is superimposed onto the original image to generate the final adversarial sample.

2. The method for generating physical adversarial examples for autonomous driving perception systems as described in claim 1, characterized in that, The target detection model adopts a decoupled head architecture; The classification loss is calculated based on the classification score output by the classification branch in the decoupled head architecture; The regression loss is calculated based on the bounding box coordinates output by the regression branch in the decoupled head architecture.

3. The method for generating physical adversarial examples for autonomous driving perception systems as described in claim 2, characterized in that, The formula for calculating the joint optimization loss function includes: ； in, , and These are the weighting coefficients of the loss function. To counteract disturbances, For the total optimization loss, This is the classification loss, used to minimize the predicted probability of the true class; The regression loss is used to constrain the deviation of the predicted bounding box area from the true value; To eliminate the loss, the distance between the predicted bounding box and the true bounding box is increased.

4. The method for generating physical adversarial examples for autonomous driving perception systems as described in claim 3, characterized in that, The iterative update of the original adversarial perturbation using the gradient information includes: The perturbation update amount is calculated based on the joint optimization loss function using the learning rate with cosine annealing and the projected gradient descent method. A projection operation is performed on the updated target adversarial perturbation, the projection operation including a preset perturbation threshold. The pruning and spatial constraints based on the threshold truncation mechanism.

5. The method for generating physical adversarial examples for autonomous driving perception systems as described in claim 4, characterized in that, The formula for iteratively updating the original adversarial perturbation is as follows: ； in, This means that the perturbation will be cropped back to reasonable physical and pixel boundaries. For dynamic learning rate, For the perturbation of the current iteration, The gradient information of the joint optimization loss function with respect to the current perturbation.

6. The method for generating physical adversarial examples for autonomous driving perception systems as described in claim 1, characterized in that, The step of superimposing the target adversarial perturbation onto the original image to generate the final adversarial sample includes: Define the physical constraint region; Based on the physical constraint region, the adversarial perturbation of the target is applied to the surface of the original image through a physically attached carrier to generate the adversarial sample.

7. The method for generating physical adversarial examples for autonomous driving perception systems as described in claim 1, characterized in that, The method further includes: The attack effect of the counter-disturbance on the target is verified; the attack effect verification includes: Adversarial samples are generated based on the target adversarial perturbation and input into the target detection model; Nonmaximum suppression is applied to filter multiple candidate boxes output by the target detection model to obtain the target prediction result; Output the verification results, which include information on the survival rate and confidence level of false targets.

8. The method for generating physical adversarial examples for autonomous driving perception systems as described in claim 7, characterized in that, The output includes a verification report containing false target survival rate and confidence information, followed by: Determine whether the survival rate of false targets in the verification results is lower than a preset threshold; If so, then calculate the feedback gradient information based on the verification results, or adjust the target range of the physical constraint region; Based on the feedback gradient information or the adjusted target range, the target adversarial perturbation is updated in a second iteration to generate the updated adversarial perturbation.

9. An electronic device, characterized in that, include: The processor and the memory storing a computer program implement the steps of the method for generating physical adversarial examples for an autonomous driving perception system as described in any one of claims 1 to 8 when the processor runs the computer program.

10. A computer-readable storage medium, characterized in that, The system contains a computer program that, when executed by a processor, implements the steps of the method for generating physical adversarial samples for an autonomous driving perception system as described in any one of claims 1 to 8.

Images