An adversarial patch generation method with frequency domain multi-branch and directionality dropout
Patent Information
- Application Number
- CN202610894537.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-06-22
- Publication Date
- 2026-08-28
AI Technical Summary
现有的工作应用模型集成策略来增强黑盒模型间的可转移性，然而，为同一任务找到合适的模型并不容易，在多个模型上训练对抗补丁既费力又昂贵
1.与现有对抗补丁生成方法相比，所生成的补丁视觉自然性及扩展更好；
Smart Images
Figure CN122660979A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of information warfare technology, and in particular relates to a method for generating adversarial patches by incorporating frequency domain multi-branching and directional dropout. Background Technology
[0002] Generally, adversarial attacks can be categorized into white-box and black-box setups. In white-box attacks, the attacker has access to the model; for example, the model architecture and parameters are known. Therefore, adversarial example samples can be directly used to construct the model from the victim's gradients (relative to the input), achieving a high success rate. However, white-box attacks are often completely impractical in real-world applications because the adversary cannot predictably obtain all the information about the victim's model. To overcome this limitation, a common practice in black-box attacks is to explore the inherent characteristics of adversarial samples and their cross-model transferability. Typically, an adversary generates adversarial samples using an alternative model (i.e., the white-box model) and then transfers them to the victim's model (i.e., the black-box model) for attack.
[0003] However, the gap between the substitute model and the victim model is typically large, manifesting as low transferability of adversarial samples. While attacking multiple models simultaneously can improve transferability, collecting a large number of diverse models is extremely difficult, and training a model from scratch is just as time-consuming as scrapping and patching. To address this issue, researchers have proposed multi-model augmentation methods. Typical model augmentation methods aim to generate diverse models by applying loss-preserving transformations to simulate the input. However, all existing research has explored the relationships between different models in the model space, potentially overlooking the essential differences between them.
[0004] Black-box adversarial attacks are categorized into query-based and transfer-based attacks. Query-based attacks assume the target model is freely accessible and typically pre-train adversarial perturbations on a white-box model, then fine-tune them using information from the target black-box model. Frequent queries can expose the attack intent, weakening the attack's stealth. Transfer-based black-box attacks leverage the model-level transferability of adversarial instances to attack the target model without queries, while maintaining the attack's confidentiality. Enhancing model-level transferability is a key challenge for transfer-based black-box attacks. Existing work applies model ensemble strategies to enhance transferability between black-box models; however, finding suitable models for the same task is not easy, and training adversarial patches on multiple models is both laborious and expensive.
[0005] Existing adversarial patch generation methods mostly use many white-box models for attack, which is computationally expensive. While there are many adversarial patch generation methods for classification models, there are almost none for object detection. This application aims to generate adversarial patches for object detection using a single white-box model for attack. Summary of the Invention
[0006] The purpose of this invention is to address the shortcomings of existing adversarial patch generation methods in terms of visual naturalness, configurability, and scalability, and to propose an adversarial patch generation method that incorporates frequency domain multi-branching and directional dropout.
[0007] To achieve the above objectives, the present invention adopts the following technical solution.
[0008] A method for generating adversarial patches by incorporating frequency domain multi-branch and directional dropout includes the following steps: S1. Construct a frequency domain mask; S11. Construct three radial masks and directional masks based on the FFT transformation of the spatial domain image; S11 specifically refers to: S111. Generate the longitudinal and transverse frequency vectors for each frequency point through FFT transformation; S112. Calculate the normalized radii corresponding to the longitudinal and transverse frequency vectors and divide them based on the threshold to obtain the three-segment radial mask.
[0009] The threshold division described in S112 ensures that the three radial masks can be added point by point to cover the entire frequency domain without overlapping.
[0010] S12. Set the direction thresholds for the horizontal and vertical coordinates and construct the direction mask based on these direction thresholds.
[0011] The directional mask described in S12 is used to achieve directional selectivity in the frequency domain.
[0012] S2. Dynamic random dropout mask generation and combination, including the following sub-steps: S21. Generate a dynamic and random dropout mask; The dropout mask follows the RGB shared mask rule; S21, in specific implementation, the number of dropout masks is 6, which correspond to three radial masks multiplied by the horizontal and vertical coordinate direction masks respectively; including, each subspace is an RGB channel, and the 3 channels of each subspace, that is, the RGB channels, all share the same mask; The dropout mask is generated by preserving DC to ensure that the brightness of the spectrogram is controlled to be no less than 80%. S22. Perform FFT transformation on the patch to be processed in the spatial dimension to obtain the spectrum; S23. Combine the results of the obtained spectrograms after dropout masking to obtain a new spectrogram; The combination is achieved by weighting the dropout mask with fixed or variable weights and then summing the results. The fixed weights mentioned in S23, specifically in this embodiment, are selected as 1; The learnable weights mentioned in S23 are obtained by training through OPTIM optimization or FGSM, and these learnable weights are updated through a loss function. The loss function includes: total variational loss and target loss; it is characterized by the following formula:
[0013] in, Ltv It is the total variational loss, which ensures that the optimizer favors images with smooth color transitions and prevents noisy images. Lobj It is the target loss, used to determine whether there is a target; The randomly selected weights are obtained by randomly selecting weights within a certain range; the weights within the certain range conform to a mean or normal distribution. S3. Frequency domain-time domain round trip and pipeline connection, including: based on the spatial dimension, restoring the perturbed spectrum to the time domain patch using inverse fast Fourier transform; numerically pruning the restored time domain patch based on a small threshold range; the small threshold range is: 1e -6 Up to 0.99999; The connection to the pipeline is as follows: the patch obtained by S1 to S3 to restore the time domain is located after enabling median_pool and before expand. The subsequent pipeline includes: random dithering, clamping, cutout, padding, affine transformation and texture mapping. Beneficial effects
[0014] This invention proposes an adversarial patch generation method incorporating frequency domain multi-branching and directional dropout, which has the following advantages compared with existing methods: 1. Compared with existing adversarial patch generation methods, the generated patches have better visual naturalness and scalability; 2. Compared with existing adversarial patch generation methods, it enables seamless integration of configurable drivers and modular insertion; 3. Compared with existing adversarial patch generation methods, this method achieves fine-grained, configurable, and randomly perturbed adversarial patches at the spectral level. Attached Figure Description
[0015] Figure 1 This is a schematic diagram showing the composition and connection of an adversarial patch generation and application device that relies on frequency domain multi-branch and directional dropout. Figure 2This invention provides a method for generating adversarial patches by incorporating frequency domain multi-branching and directional dropout. It is used to compare the complete process of the patch generation pipeline for white-box target recognition in method 2YOLOv5. Figure 3 This invention provides a method for generating adversarial patches by incorporating frequency domain multi-branching and directional dropout. It is used to compare the complete process of the white-box target recognition patch generation pipeline of method 1 (yolov2) during a specific implementation. Figure 4 This is a schematic diagram of the process of constructing the frequency domain mask and radial-directional decoupling in a specific implementation of the adversarial patch generation method with added frequency domain multi-branch and directional dropout of the present invention; Figure 5 This is a schematic diagram of the process of generating and combining dynamic random Dropout masks in the specific implementation of the adversarial patch generation method with frequency domain multi-branch and directional dropout of the present invention; Figure 6 This is a schematic diagram of the process of generating and combining dynamic random Dropout masks in the specific implementation of the adversarial patch generation method with frequency domain multi-branch and directional dropout of the present invention. Detailed Implementation
[0016] The following detailed description, in conjunction with the accompanying drawings and specific embodiments, of an adversarial patch generation method incorporating frequency domain multi-branching and directional dropout proposed in this invention. Example
[0017] Existing adversarial patch generation methods mostly use many white-box models for attack, which is computationally expensive. While there are many adversarial patch generation methods for classification models, there are almost none for object detection. This application aims to generate adversarial patches for object detection using a single white-box model for attack.
[0018] In existing methods, the transfer-based self-integration attack method for object detection generates object detection patches through self-integration. During the training phase, this method uses self-integration strategies (i.e., constrained data augmentation, patch clipping, and model ShakeDrop) to enhance the transferability of well-optimized adversarial patches. During the attack, in the (inference) phase, the generated patches are attached to different images to disrupt the black box settings of the detection process of multiple widely used detectors.
[0019] This application focuses on enhancing model-level transferability by attacking a white-box model rather than model ensemble. The proposed method, based on the original transfer-based self-ensemble attack method for target detection, adds a complete implementation of frequency domain multi-branch + directional dropout to the adversarial patch generation pipeline of this method (i.e., transfer-based self-ensemble adversarial attack for target detection). Figure 1 This is a schematic diagram illustrating the composition and connection of an adversarial patch generation and application device that relies on frequency domain multi-branching and directional dropout. Figure 1 The adversarial patch generation and application device based on frequency domain multi-branch and directional dropout includes a median filtering unit, a frequency domain radial-directional decoupling and degree space dropout module, an expansion unit, a random dithering unit, a truncation unit, a spatial mask unit, a filling unit, an affine transformation unit, a mapping unit, a white-box model, and a patch optimizer.
[0020] Initially, the adversarial patch P is randomly initialized, and a training image set, a white-box object detector fw, and a patch application function T are prepared. During the training phase, only one accessible white-box detector is used. During the attack phase, it is hoped that the patch can be transferred to multiple unknown black-box detectors. First, an enhancement baseline is constructed, which is obtained by adjusting the training strategy. The process is as follows: Step A: Input a batch of training images into the white-box detector fw to obtain the object detection boxes and object confidence in the clean images; Step B: Based on the position of the detection boxes, the current patch P is pasted onto the center region of the target object to generate an adversarial image with the patch; Step C: Re-input the patched image into the white-box detector to obtain the object confidence in the adversarial image; Step D: Calculate the attack loss. The paper uses the average value of the object confidence as the loss by default; Step E: Update the patch P using the basic attack method; where the basic attack method is Adam, SGD, MIM, BIM, or PGD, etc. During this optimization process, the detector network weights are frozen, and only the pixel values of the patch P are updated. Building upon the enhanced baseline, the transfer-based self-integration adversarial attack for object detection introduces data self-integration, model self-integration, and patch self-integration.
[0021] Figure 2 This is a complete process used in the implementation of the adversarial patch generation method with added frequency domain multi-branch and directional dropout in the present invention to connect the pipeline of patch generation for white-box target recognition in method 2 YOLOv5; By employing a dual mechanism of frequency domain multi-branching and directional dropout, the adversarial patch achieves fine-grained, configurable, and random perturbation at the spectral level. Simultaneously, DC retention and RGB shared mask ensure the visual naturalness of the generated patch. The entire solution is seamlessly integrated into existing transfer-based self-integrating adversarial attack frameworks for target detection in a configuration-driven and modular insertion manner, demonstrating good scalability and practical engineering value.
[0022] Comparison Method 2: A transfer-based self-ensemble adversarial attack method for object detection; this adversarial attack method utilizes self-ensemble strategies (i.e., constrained data augmentation, patch pruning, and Shake Drop model) during the training phase to enhance the transferability of well-optimized adversarial patches. Initially, the adversarial patch P is randomly initialized, and a training image set, a white-box object detector fw, and a patch application function T are prepared; during training, only one accessible white-box detector is used, and during the attack phase, it is desired that the patch can be transferred to multiple unknown black-box detectors; the overall optimization objective of Comparison Method 2 is expressed as:
[0023]
[0024] J(τ): Regularization term for the patch (used to prevent unnatural, noisy patterns). First, an enhanced baseline, E-baseline, is constructed. This enhanced baseline is obtained by adjusting the training strategy based on the AdvPatch method. The specific process is as follows: Step A: Input a batch of training images into the white-box detector fw to obtain the target detection boxes and target confidence in the clean images; Step B: Based on the position of the detection box, the current patch P is applied to the center area of the target object to generate an adversarial image with the patch. Step C: Re-input the patched image into the white-box detector to obtain the target confidence in the adversarial image; Step D: Calculate the attack loss. The paper uses the average target confidence level as the loss by default. Step E: Update patch P using basic attack methods; The basic attack methods can be Adam, SGD, MIM, BIM or PGD, etc. During this optimization process, the detector network weights remain frozen, and only the pixel values of patch P are updated; Step 4: Based on the enhanced baseline, three self-integration strategies are introduced for transfer-based self-integration adversarial attacks targeting object detection. The first type is self-integration of data, namely Constrained Data Augmentation; This method performs constrained data augmentation on training images, including slight scaling and cropping, color perturbation, brightness variation, contrast variation, saturation variation, hue variation, and small-angle rotation. The purpose of this strategy is to expand the distribution of input images so that the patch does not fit to the fixed training images, thereby improving the ability to transfer across datasets and scenes. The second type is model self-integration, namely Model ShakeDrop; This method randomly perturbs the residual structure in the detector and constructs multiple virtual model variants by randomly linearly combining the residual branch output and the identity branch; Its forward propagation can be represented as:
[0025] The purpose of this strategy is to simulate the ensemble effect of multiple models when there is only one white-box detector, so that the patch can be adapted to a single model structure, thereby improving the transferability to black-box detectors such as YOLOv3, YOLOv4, YOLOv5, SSD, and Faster R-CNN. The third type is self-integrated patching, also known as Patch Cutout. This method randomly occludes a region in the patch with a certain probability during the training phase; The specific process is as follows: Step A: Randomly sample a center point inside the patch; Step B: Using this point as the center, obscure a square area with a fixed proportion; Step C: Cover the area with the specified fill value; This strategy works similarly to Dropout in model training, reducing the patch's dependence on a local region or texture and preventing the patch from overfitting to a specific image, model, or location. Step 5: After training is completed, a well-optimized adversarial patch is obtained; During the attack phase, the patch is applied to the target object area in the test image; This stage does not require accessing the black-box detector parameters or querying the black-box detector output; Ultimately, this patch was used to attack multiple black-box target detectors, achieving a transfer-based black-box target detection attack based on single-model training.
[0026] Figure 3This invention provides a complete process for connecting the adversarial patch generation pipeline of method 1 (Yolov2) to method 1 (Yolov2) white-box target recognition patch generation, specifically implementing an adversarial patch generation method incorporating frequency domain multi-branching and directional dropout. The process includes the following steps: The patch is initialized with random values at the beginning; this is achieved by optimizing the patch optimizer. The patch optimizer minimizes the total loss resulting from the three factors. The total loss, comprised of the three factors, is represented by the following formula:
[0027] Where is the non-printing loss, expressed as:
[0028] Ppatch Patch pixel color value Cprint Printable color values This loss represents the unprintable score, and the loss value indicates the factor that a regular printer can represent well in terms of color in a patch; in, Ltv The total variational loss is expressed as:
[0029] This loss ensures that the optimizer favors images with smooth color transitions and prevents noisy images. Lobj It is the target loss, used to determine whether there is a target; The optimization patch is achieved through the following steps: Step a: The patch image is generated and obtained through measures such as rotation, scaling, adding noise, and contrast enhancement; Step b: Place the patched image into the original image and then send it to the YOLOv2 detector for optimization; The detector includes two types of loss: classification loss and target loss; The target loss is used to determine whether there is a target; the classification loss is used to determine what the target is, whether it is a person, a car, or a cat or dog. During the optimization process of the patch optimizer, all weights in the network are frozen, and only the values in the patch are changed to generate a printable adversarial patch that can be used for the personnel detector.
[0030] The present invention provides a method for generating adversarial patches by incorporating frequency domain multi-branch and directional dropout, comprising the following steps: (1) The construction of the frequency domain mask is decoupled from the radial direction, such as Figure 4 As shown, specifically: Step 1) Perform a two-dimensional real fast Fourier transform (FFT) on the single patch P to be processed (shape (1,3,H,W)) in the spatial dimension to obtain the frequency domain complex tensor F = FFT(P); Step 2) On the spectral plane, divide all frequency points according to the frequency radius to construct three radial masks corresponding to low, mid, and high frequencies. , , Specifically, it includes the following sub-steps: Step 2.1) Generate the vertical frequency vector fy (size H×1) and the horizontal frequency vector fx (size 1×W) using torch.fft.fftfreq(H) and torch.fft.rfftfreq(W). f W f = W / / 2+1); Step 2.2) Calculate the normalized radius r for each frequency point. norm =sqrt(fx 2 +fy 2 ) / max(sqrt(fx 2 +fy 2 Using thresholds t1=0.20 and t2=0.50, it was divided into low-frequency (r) norm ≤t1), intermediate frequency (t1) <r norm ≤t2) and high frequency (r) norm >t2) Three segments, making + + =1 (point-by-point addition covers the entire frequency domain and the points do not overlap); Step 3) Introduce a directional mask to achieve directional selectivity in the frequency domain: Let the absolute frequency threshold τ be defined as follows: Cross: |fx|<τ ∨ |fy|<τ; NonCross: otherwise Both satisfy M cross + M noncross = 1; The value of τ ranges from 0.01 to 0.04; specifically, in this embodiment, τ is 0.02. In practice, Step 2) and Step 3) can be interchanged or implemented in parallel.
[0031] Step 4) Multiply the three radial masks obtained in Step 2) and the directional masks obtained in Step 3) point by point, i.e., the Hadamard product, to achieve radial-directional decoupling, resulting in six mutually exclusive subspace masks; M_low_cross = M_low^radial ⊙ M_cross M_low_noncross = M_low^radial ⊙ M_noncross M_mid_cross = M_mid^radial ⊙ M_cross M_mid_noncross = M_mid^radial ⊙ M_noncross M_high_cross = M_high^radial ⊙ M_cross M_high_noncross = M_high^radial ⊙ M_noncross; The six masks mentioned above are mutually exclusive and, when added point by point, still equal to the global mask 1, which satisfies Σ_directionΣ_band M = 1.
[0032] (2) Generate dynamic random Dropout masks and aggregates. In specific implementation, such as... Figure 5 As shown: To increase the randomness of the frequency domain perturbation and prevent the model from overfitting to a fixed spectrum, this paper independently samples a Bernoulli random mask D for each subspace. i The configuration file provides adjustable probability vectors p for the six subspaces. drop =[0.05, 0.10, 0.15, 0.25, 0.20, 0.35]; corresponding to the order [Low-Cross, Low-NonCross, Mid-Cross, Mid-NonCross, High-Cross, High-NonCross]. During each forward propagation, an independent Bernoulli mask D is generated for each subspace according to the above probabilities. i (Value 0 indicates discard, 1 indicates retain), and the DC component (origin of the spectrum) is forced to always be 1: D i [0,0] = 1, to prevent color darkening or mean shift. To maintain color consistency, all channels share the same mask, i.e., in the generation of D... i It is then broadcast to shape (3, H, W_f) to avoid unnatural frequency domain separation noise between different color channels.
[0033] The dynamic total mask for the six subspaces is achieved by weighting the dropout mask with fixed or variable weights and then summing the results. Specifically, in this real-time example, the combination is aggregated by directly adding the elements with fixed weights of 1: The learnable weights are obtained by training through OPTIM optimization or FGSM, and the learnable weights are updated through a loss function. The mask is then applied to the frequency domain tensor F to obtain the perturbed spectrum F' = M. dynamic ⊙ F. This process resamples at each forward, ensuring the time-varying nature and diversity of frequency domain perturbations.
[0034] (3) The connection between the frequency domain and time domain round trips and subsequent pipelines, in specific implementation, such as Figure 6 As shown: The spectrum F' after random dropout is restored to the time-domain patch P'=IFFT(F') using the inverse fast Fourier transform (IFFT). In the implementation, torch.fft.irfft2 is used, performing the inverse transform only on the spatial dimension to ensure the output remains a real-valued tensor and preserves the original data type and device. To prevent misjudgment of transparency due to excessively small values during subsequent texturing, P' is numerically clipped. P' = clamp(P', 1e-6, 0.99999) This threshold is small enough, ranging from 1e-6 to 0.99999, to have almost no impact on visual quality, while ensuring that the conditions in torch.where are correctly determined.
[0035] Subsequently, the trimmed P' is reinjected into the existing PatchRandomApplier pipeline. Frequency domain processing is performed immediately after median_pool (if enabled) and before expand. Subsequent steps maintain the original random dithering → clamp → cutout → padding → affine transformation → texture mapping order. The entire insertion process only affects the original code path through a single forward call to self.freq_tf and the newly added 'freq' flag in patch_aug_gates, ensuring that system behavior is completely consistent with the original when 'freq' is disabled, thus meeting backward compatibility requirements.
[0036] (4) Implementation details and system configuration All of the above hyperparameters are concentrated in the ATTACKER section of the project configuration file configs / demo.yaml. In the PATCH.FREQ block, adjustments can be made using the following example: PATCH: TRANSFORM: ['jitter', 'rotate', 'median_pool', 'cutout', 'freq'] FREQ: BAND_T1: 0.20 # Radial low-frequency threshold BAND_T2: 0.50 # Radial high-frequency threshold ANGULAR_TAU: 0.03 # Direction threshold, disables direction decoupling when τ≤0 DROP_P: [0.05,0.10,0.15,0.25,0.20,0.35] # 6 Subspace dropout probability KEEP_DC: True # Force preservation of DC component RGB_SHARED_MASK: True # Share the same mask across channels At the code implementation level, PatchFrequencyTransform achieves one-time construction and multiple reuse by caching the Mk1 mask grid corresponding to (H, W, device, dtype); each forward only executes rfft2 and irfft2 and probability sampling once, and the computational overhead is almost the same as the original pipeline.
[0037] Furthermore, the performance of the method proposed in this invention is compared with that of method 1 (i.e., method 2), and the conclusions are shown in Table 1: Table 1. Performance comparison of the method proposed in this invention with comparative methods 1 and 2. Black-Box Avg 48.25 19.59 12.38 Convergence speed 1000 epochs 900 epochs 500 epochs In summary, this invention achieves fine-grained, configurable, and random perturbation of adversarial patches at the spectral level through a dual mechanism of frequency domain multi-branching and directional dropout; at the same time, it ensures the visual naturalness of the generated patches through DC retention and RGB shared mask; the entire solution is seamlessly integrated into existing transfer-based self-integrated adversarial attack frameworks for target detection in a configuration-driven and modular insertion manner, and has good scalability and practical engineering value.
[0038] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings, disclosure, and description of the drawings, etc., in carrying out the claimed invention. In the specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. A single processor or other unit can implement several functions listed in the specification. While certain measures are described in different embodiments, this does not mean that these measures cannot be combined to produce good results.
[0039] Although the invention has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made therein without departing from the spirit and scope of the invention. Accordingly, this specification and drawings are merely illustrative of the invention and are to be considered as covering any and all modifications, variations, combinations, or equivalents within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if such modifications and modifications of the invention fall within the scope of the invention and its equivalents, the invention is also intended to include such modifications and modifications.
Claims
1. A method for generating adversarial patches by incorporating frequency domain multi-branching and directional dropout, characterized in that, Includes the following steps: S1. Construct a frequency domain mask; S2. Dynamic random dropout mask generation and combination, including the following sub-steps: S21. Generate a dynamic and random dropout mask; S22. Perform FFT transformation on the patch to be processed in the spatial dimension to obtain the spectrum; S23. Combine the results of the obtained spectrograms after dropout masking to obtain a new spectrogram; S3, Frequency Domain-Time Domain Round Trip and Pipeline Connection, including: Based on the spatial dimension, restoring the perturbed spectrum to the time domain patch through inverse fast Fourier transform; Numerical trimming is performed on the time-domain patch based on a small threshold range.
2. The method for generating adversarial patches with added frequency domain multi-branch and directional dropout according to claim 1, characterized in that, S1 includes the following sub-steps: S11. Construct three radial masks and directional masks based on the FFT transformation of the spatial domain image; S12. Set the direction thresholds for the horizontal and vertical coordinates and construct the direction mask based on these direction thresholds; The directional mask described in S12 is used to achieve directional selectivity in the frequency domain.
3. The method for generating adversarial patches with added frequency domain multi-branch and directional dropout according to claim 2, characterized in that, S11 specifically refers to: S111. Generate the longitudinal and transverse frequency vectors for each frequency point through FFT transformation; S112. Calculate the normalized radii corresponding to the longitudinal and transverse frequency vectors and divide them based on the threshold to obtain the three-segment radial mask.
4. The method for generating adversarial patches with added frequency domain multi-branch and directional dropout according to claim 3, characterized in that, The threshold division described in S112 ensures that the three radial masks can be added point by point to cover the entire frequency domain without overlapping.
5. The method for generating adversarial patches with added frequency domain multi-branch and directional dropout according to claim 1, characterized in that, The dropout mask described in S21 follows the RGB shared mask rule.
6. The method for generating adversarial patches with added frequency domain multi-branch and directional dropout according to claim 5, characterized in that, The dropout mask is preserved by DC during the generation process to ensure that the brightness of the spectrogram is controlled to be no less than 80%.
7. The method for generating adversarial patches with added frequency domain multi-branch and directional dropout according to claim 1, characterized in that, The combination described in S22 is achieved through fixed weights or variable weights.
8. The method for generating adversarial patches with added frequency domain multi-branch and directional dropout according to claim 7, characterized in that, The fixed weight ranges from 0.95 to 1.
05.
9. The method for generating adversarial patches with added frequency domain multi-branch and directional dropout according to claim 1, characterized in that, The combination described in S23 is achieved by weighting the dropout mask with fixed or variable weights and then summing the results.
10. The method for generating adversarial patches with added frequency domain multi-branch and directional dropout according to claim 1, characterized in that, The variable weights are either learnable weights or randomly selected weights.