Reversible directed adversarial sample generation and restoration method and system based on channel steganography

Abstract

This application provides a method and system for generating and reconstructing reversible targeted adversarial examples based on channel steganography, relating to the field of computer vision. The method includes: acquiring an original image, a region of interest (ROI), and target category identifiers; generating a structured interference mask based on the category identifiers and sparsifying it to obtain the final interference mask; injecting the interference mask into the ROI using reversible logical operations to generate adversarial examples; implicitly writing attack parameters into a preset bit plane of the image channels to obtain self-contained adversarial examples; extracting the attack parameters from the preset bit plane and reconstructing the interference mask; and using inverse operations to eliminate the interference mask in the ROI to reconstruct the original image. This solves the technical problems of poor spatial selectivity of adversarial perturbations and irreversible loss of original data after the attack in existing technologies.

Description

Technical Field

[0001] This application relates to the field of computer vision technology, and in particular to a method and system for generating and reconstructing reversible directional adversarial examples based on channel steganography. Background Technology

[0002] With the widespread application of deep learning technology in computer vision, model security and data privacy protection have become a focus of attention. Adversarial examples, as special input perturbations, can cause deep neural networks to produce incorrect predictions. Existing adversarial attack techniques typically generate small global perturbations based on gradient information or use random noise to cover the entire image, superimposing globally distributed perturbations on the original image to maximize the loss function. However, this global perturbation strategy suffers from spatial selectivity defects, failing to precisely control the perturbation to act only on specific regions of interest. Adding noise to the background region not only degrades visual quality but is also easily smoothed away by denoising filters as background noise. Furthermore, the separate storage of attack parameters and samples leads to irreversible loss of the original data. Therefore, a method is urgently needed to address the technical problems of poor spatial selectivity of adversarial perturbations and irreversible loss of original data after the attack in existing techniques. Summary of the Invention

[0003] This application provides a method and system for generating and restoring reversible targeted adversarial samples based on channel steganography, which solves the technical problems of poor spatial selectivity of adversarial perturbation and irreversible loss of original data after attack in the prior art.

[0004] To achieve the above objectives, this application adopts the following technical solution: Firstly, a method for generating and reconstructing reversible targeted adversarial samples based on channel steganography is provided. The method includes: acquiring an original image, a region of interest (ROI) of the target to be attacked, and a target category identifier; generating a structured interference mask based on the target category identifier, and performing sparsification processing on the structured interference mask to obtain a final interference mask; injecting the final interference mask into the ROI of the original image using reversible logic operations to generate an adversarial sample; embedding attack parameters in a preset bit plane of the image channel of the adversarial sample using steganography to obtain a self-contained adversarial sample; the attack parameters include the location information of the ROI, the target category identifier, and a random seed; extracting the attack parameters from the preset bit plane of the self-contained adversarial sample, and reconstructing the final interference mask based on the attack parameters; and eliminating the final interference mask in the ROI of the target to be attacked using the inverse operation of reversible logic operations to reconstruct the original image.

[0005] In conjunction with the first aspect mentioned above, in one possible implementation, generating a structured interference mask based on the target category identifier includes: determining the periodic parameter and direction angle based on the target category identifier; and generating the structured interference mask through a periodic function mapping based on the periodic parameter and direction angle.

[0006] In conjunction with the first aspect mentioned above, in one possible implementation, determining the period parameters and orientation angle based on the target category identifier includes: calculating the category index based on the target category identifier; selecting the corresponding target geometric pattern from a preset set of geometric patterns according to the category index, the set of geometric patterns including checkerboard, diagonal, horizontal stripes, vertical stripes and intersecting grids; and determining the period parameters and orientation angle based on the target geometric pattern.

[0007] In conjunction with the first aspect mentioned above, in one possible implementation, the structured interference mask is sparsified to obtain the final interference mask, including: generating a binarized discard matrix and a random noise perturbation matrix using a random algorithm; and performing logical bit operations on the structured interference mask, the binarized discard matrix, and the random noise perturbation matrix to obtain the final interference mask.

[0008] In conjunction with the first aspect mentioned above, in one possible implementation, a reversible logical operation is used to inject the final interference mask into the region of interest (ROI) of the original image to generate adversarial examples. This includes: extracting target image data corresponding to the ROI in the original image; determining the target color channel corresponding to the target image data; performing a reversible logical operation on the target image data in the target color channel based on the final interference mask to obtain perturbed target image data; the reversible logical operation is an XOR operation; replacing the corresponding target image data in the target color channel with the perturbed target image data, while keeping the image data in the non-ROI region unchanged, to generate adversarial examples.

[0009] In conjunction with the first aspect mentioned above, in one possible implementation, the attack parameters are steganographically embedded into a preset bit plane of the image channel of the adversarial sample to obtain a self-contained adversarial sample. This includes: serializing the attack parameters to obtain a binary data stream corresponding to the attack parameters; determining the target image channel of the adversarial sample and the preset bit plane corresponding to the target image channel; replacing the corresponding bits of the preset bit plane of the target image channel with the binary data stream to perform steganographic embedding of the attack parameters, thereby obtaining a self-contained adversarial sample.

[0010] In conjunction with the first aspect mentioned above, in one possible implementation, the attack parameters include the location information of the region of interest, the target category identifier, and a random seed used to generate the final interference mask; the target image channel is an Alpha channel, and the preset bit plane is the least significant bit of the Alpha channel.

[0011] In conjunction with the first aspect mentioned above, in one possible implementation, attack parameters are extracted from a preset bit plane of the self-contained adversarial sample, and the final interference mask is reproduced based on the attack parameters. This includes: extracting a binary data stream from the preset bit plane of the target image channel of the self-contained adversarial sample; parsing the binary data stream to obtain attack parameters, which include the location information of the region of interest, the target category identifier, and a random seed; redetermining the corresponding periodic parameters and orientation angles based on the target category identifiers, and generating a structured interference mask through a periodic function mapping based on the periodic parameters and orientation angles; generating a binarized discard matrix and a random noise perturbation matrix consistent with the adversarial sample generation stage using a random algorithm based on the random seed; and performing logical bit operations on the structured interference mask, the binarized discard matrix, and the random noise perturbation matrix to obtain the reproduced final interference mask.

[0012] In conjunction with the first aspect mentioned above, in one possible implementation, the final interference mask is eliminated in the region of interest (ROI) of the target to be attacked, restoring the original image, by utilizing the inverse operation of reversible logic operations. This includes: determining the position of the ROI in the self-contained adversarial sample based on attack parameters; extracting image data from the target color channel corresponding to the ROI; performing an XOR operation again between the image data in the target color channel and the final interference mask to obtain the restored target image data; replacing the corresponding image data in the target color channel with the restored target image data, while keeping the image data of the non-ROI regions unchanged, to obtain the restored original image.

[0013] Secondly, a reversible directional adversarial sample generation and reconstruction system based on channel steganography is provided to implement any of the methods in the first aspect. The system includes: a data acquisition module for acquiring the original image, the region of interest (ROI) of the target to be attacked, and the target category identifier; an interference mask generation module for generating a structured interference mask based on the target category identifier and performing sparsification processing on the structured interference mask to obtain the final interference mask; an adversarial sample generation module for injecting the final interference mask into the ROI of the original image using reversible logical operations to generate adversarial samples; a parameter steganography module for embedding attack parameters into a preset bit plane of the image channel of the adversarial sample to obtain a self-contained adversarial sample; an attack parameter extraction module for extracting attack parameters from the preset bit plane of the self-contained adversarial sample and reconstructing the final interference mask based on the attack parameters; and an image reconstruction module for eliminating the final interference mask in the ROI of the target to be attacked and reconstructing the original image using the inverse operation of reversible logical operations.

[0014] This application provides a method and system for generating and reconstructing reversible targeted adversarial samples based on channel steganography. It abandons global random noise or gradient perturbation strategies, dynamically generating geometric adversarial masks with specific high-frequency texture features according to the target category. After sparsification, these masks are injected only into specific regions of interest (ROIs) of the image using reversible logical operations. Because the interference exists only in a sparse form in a specific region and acts on a specific channel, conventional defense algorithms based on global statistical characteristics cannot completely eliminate structured noise within the target region through simple smoothing operations. This ensures the continued effectiveness of the attack in complex preprocessing environments and improves the success rate of targeted attacks against modern robust models. Simultaneously, this application embeds the key metadata required for the attack into a preset bit plane of the image's own channels, constructing a parameter self-containment mechanism, making the adversarial sample an independent container. In the reconstruction stage, the extracted parameters are used to reconstruct a completely identical mask, and the reflexivity of the reversible operation is used to perform inverse operations on the target region, completely eliminating geometric noise at the pixel level and restoring clean data completely consistent with the original input.

[0015] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0016] Figure 1 A system architecture diagram of a reversible targeted adversarial sample generation and reconstruction system based on channel steganography provided in this application embodiment; Figure 2 A flowchart illustrating a method for generating and reconstructing reversible targeted adversarial samples based on channel steganography, provided in this application embodiment. Figure 1 ; Figure 3 A flowchart illustrating a method for generating and reconstructing reversible targeted adversarial samples based on channel steganography, provided in this application embodiment. Figure 2 ; Figure 4 A flowchart illustrating a method for generating and reconstructing reversible targeted adversarial samples based on channel steganography, provided in this application embodiment. Figure 3 ; Figure 5 A flowchart illustrating a method for generating and reconstructing reversible targeted adversarial samples based on channel steganography, provided in this application embodiment. Figure 4 ; Figure 6 A flowchart illustrating a method for generating and reconstructing reversible targeted adversarial samples based on channel steganography, provided in this application embodiment. Figure 5 . Detailed Implementation

[0017] In the description of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. The "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "multiple" means two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0018] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0019] The method for generating and reconstructing reversible targeted adversarial samples based on channel steganography provided in this application can be applied to, for example... Figure 1 In the reversible targeted adversarial sample generation and reconstruction system based on channel steganography shown, such as Figure 1 As shown, the system includes: a data acquisition module 101, used to acquire the original image, the region of interest (ROI) of the target to be attacked, and the target category identifier; an interference mask generation module 102, used to generate a structured interference mask based on the target category identifier, and to perform sparsification processing on the structured interference mask to obtain the final interference mask; an adversarial sample generation module 103, used to inject the final interference mask into the ROI of the original image using reversible logic operations to generate adversarial samples; a parameter steganography module 104, used to steganographically embed attack parameters into a preset bit plane of the image channel of the adversarial sample to obtain a self-contained adversarial sample; an attack parameter extraction module 105, used to extract attack parameters from the preset bit plane of the self-contained adversarial sample, and to reproduce the final interference mask based on the attack parameters; and an image restoration module 106, used to eliminate the final interference mask in the ROI of the target to be attacked using the inverse operation of reversible logic operations to restore the original image.

[0020] To address the technical problems of poor spatial selectivity in adversarial perturbation and irreversible loss of original data after an attack in existing technologies, embodiments of this application provide a method for generating and restoring reversible targeted adversarial samples based on channel steganography. Figure 2 A flowchart illustrating the method for generating and reconstructing reversible targeted adversarial samples based on channel steganography provided in this application embodiment. Figure 1 ,like Figure 2 As shown, it includes: S201. Obtain the original image, the region of interest of the target to be attacked, and the target category identifier.

[0021] The original image can be a digital image from any source, such as live footage captured by a camera, locally stored still image files, or a single frame image streamed from a network. The region of interest (ROI) of the target to be attacked can be defined using bounding box coordinates, polygon vertex coordinates, or a mask image, and is used to limit the scope of the adversarial interference. The target category identifier indicates the category that is expected to be misclassified by the model; it can be a category name, category ID number, or category label vector.

[0022] In one possible implementation, the system receives multiple original images, along with multiple regions of interest (ROIs) for each image and target category identifiers for each ROI, either individually or in batches, to concurrently perform generation and reconstruction processes on multiple targets or multiple images in a single run. Furthermore, the target category identifiers can be obtained either manually by the user or automatically generated by a pre-defined automatic detection model after pre-analyzing the original images; this embodiment does not impose any limitations on this method.

[0023] It should be noted that the region of interest and the target category identifier together determine the directionality of the adversarial attack, enabling the generated interference to be concentrated in semantically clear local areas, rather than the uniform perturbation of the entire image in traditional schemes.

[0024] S202. Based on the target category identifier, generate a structured interference mask and perform sparsification processing on the structured interference mask to obtain the final interference mask.

[0025] Structured interference masks, in particular, are two-dimensional masks with specific geometric textures or frequency distribution characteristics, rather than uniform random noise across the entire image. Unlike traditional Gaussian white noise, which has a discrete distribution in the frequency domain, structured interference masks exhibit distinct peaks in the frequency domain, more effectively stimulating the edge and texture responses of convolutional neural networks, thus misleading the model's feature extraction process. Sparsity processing, on the other hand, introduces random or regular discarding mechanisms, ensuring that only a portion of the pixels in the mask retain the interference, while the remaining pixels remain inactive, achieving a balance between interference intensity and concealment.

[0026] In one possible implementation, the generation of the structured interference mask can rely on one or more predefined mapping rules to convert the target category identifier into corresponding geometric pattern parameters, such as spatial period, texture orientation angle, or pattern type index. The mask is then generated through periodic function mapping, geometric primitive superposition, or rule-based texture synthesis. Sparsity processing can be achieved by combining a binarized random dropout matrix, a random noise perturbation matrix, or other sparsity constraints with the structured mask. This combination operation can be logical bitwise operations or arithmetic multiplication and addition operations.

[0027] It should be noted that by establishing a mapping relationship between target category identifiers and mask patterns, this embodiment allows targets of different categories to be subjected to interference from different texture features, thereby improving the targeting and differentiation of attacks. The sparsity processing effectively mitigates the excessive degradation of visual quality caused by full-coverage interference, helping to evade defense detection based on the overall statistical characteristics of the image.

[0028] S203. Using reversible logic operations, the final interference mask is injected into the region of interest of the original image to generate adversarial examples.

[0029] Reversible logic operations are mathematically reflexive operations, meaning that applying the operation twice, or its inverse, to the same operand restores the original operand. Examples include XOR operations and modulo operations (addition, subtraction, and modulo). The injection process only affects image data within the region of interest; image data outside the region of interest remains unchanged.

[0030] In one possible implementation, the system extracts image data from the region of interest in the original image, determines the target color channel to be interfered with, and then performs reversible logical operations on the corresponding pixel values ​​of the image and the corresponding pixel values ​​of the final interference mask one by one on the target color channel to generate perturbed image data. Finally, the perturbed data replaces the original data in the region of interest in the target color channel, forming an adversarial example. The target color channel can be a single channel in the RGB color space, or a channel or composite channel in other color spaces such as YUV or Lab; this embodiment does not limit this.

[0031] It should be noted that limiting the interference to the region of interest and applying it only to specific color channels reduces the degree of human perception of the interference and avoids the easy elimination of all interference information by preprocessing methods such as whole-image filtering, thereby improving the robustness of the attack. At the same time, the reflexivity of reversible logical operations is the foundation for the entire restoration loop to hold, ensuring that subsequent steps can accurately eliminate the interference.

[0032] S204. Steganographically embed the attack parameters into the preset bit plane of the image channel of the adversarial sample to obtain a self-contained adversarial sample.

[0033] Attack parameters refer to the metadata necessary for subsequent steps to reproduce the final interference mask and restore the original image. These parameters may include, for example, the location information of the region of interest, target category identifiers, random seeds, or any combination thereof. A preset bit plane for an image channel refers to a specific bit layer of a channel in the image data, such as the most significant bit, least significant bit, or a fixed bit plane in the middle of a channel. Steganographic embedding refers to replacing the values ​​of corresponding bits in the image channel with attack parameters in binary data form according to preset rules, thus concealing the parameter information within the adversarial example.

[0034] In one possible implementation, the system first serializes the attack parameters, converting them into a binary data stream. Then, it determines the target image channel in the adversarial sample used to carry the steganographic information and the corresponding preset bit plane. Finally, on the preset bit plane of the target image channel, according to a pre-agreed bit substitution rule, the binary data stream replaces the original bit values ​​bit by bit at the corresponding positions, completing the steganographic embedding. The steganized adversarial sample is visually almost indistinguishable from the original adversarial sample, but it internally carries complete attack context information and can be independently restored without an external database.

[0035] It should be noted that the selection of the preset bit plane must balance steganography capacity and imperceptibility. Generally speaking, modifying the least significant bit has the smallest change in pixel value and the slightest visual impact. However, if the amount of data to be embedded is large, it can be extended to multiple bit planes or cross-channel joint steganography. Even if the original image itself does not contain an alpha channel, the system can still implement steganography based on the preset bit plane of the RGB channels, ensuring compatibility with different image formats.

[0036] S205. Extract attack parameters from the preset bit plane of the self-contained adversarial sample, and reproduce the final interference mask based on the attack parameters.

[0037] Among them, reproducing the final interference mask refers to regenerating the final interference mask in the restoration stage that is completely identical to the one generated in the adversarial sample generation stage.

[0038] In one possible implementation, the system reads the steganographic bitstream from a preset bit plane of the target image channel of the self-contained adversarial example and parses the attack parameters through deserialization. Based on the parsed target category identifier, the system repeats the same structured interference mask generation step as in S202; based on the parsed random seed or other consistency parameters, it repeats the same sparsification processing step as in S202, finally obtaining the final interference mask consistent with the injection stage.

[0039] It should be noted that if the attack parameters are insufficient to fully recover the mask, the restoration will not be able to be performed accurately. Therefore, the selection of attack parameters must cover all non-fixed items in the mask generation and sparsification process to ensure the uniqueness and determinism of the reproduction path.

[0040] S206. Using the inverse operation of reversible logic, the final interference mask is eliminated in the region of interest of the target to be attacked, and the original image is restored.

[0041] The reflexivity of the XOR operation is the theoretical basis for the accurate restoration. Since the first XOR injection was performed on the target channel during the adversarial sample stage, performing XOR again on the same target channel using the same reproduced mask in this step can cancel out the interference and restore the original pixel value.

[0042] In one possible implementation, the position of the region of interest in the self-contained adversarial sample is determined according to the attack parameters; image data in the target color channel corresponding to the region of interest is extracted; the image data in the target color channel is XORed with the final interference mask again to obtain the restored target image data; the restored target image data is used to replace the corresponding image data in the target color channel, while keeping the image data of the non-region of interest unchanged, to obtain the restored original image.

[0043] It should be noted that the inverse operation is not limited to the XOR operation; it can be any reversible logical operation used in S203. For example, if S203 uses addition modulo 256 as the injection method, then this step can use subtraction modulo 256 as the inverse operation. The target color channel and region of interest extracted during the restoration process should be consistent with those in the injection stage to ensure spatial alignment of the operation parameters.

[0044] It should also be noted that the restoration process only needs to rely on the self-contained adversarial sample itself, without accessing the original image or external database, fundamentally solving the problems of tracing difficulties and data value loss caused by the separate storage of adversarial data.

[0045] As an example, the system locates the pedestrian area in the target image based on the ROI coordinates in the attack parameters, extracts the blue channel pixel data of the area, performs XOR operation on each pixel with the reproduced final interference mask to cancel the previously injected checkerboard noise, recovers the original blue channel value, and finally integrates the red, green and blue channels while keeping the non-ROI areas unchanged to obtain a lossless restored image that is consistent with the original image at the pixel level.

[0046] This application's embodiments organically integrate targeted local structured interference with a parameter self-contained steganography mechanism, enabling the generated adversarial examples to not only achieve highly covert targeted attacks against specific regions of interest, but also to achieve pixel-level lossless restoration without any external information, effectively solving the technical problems of poor spatial selectivity and irreversible data loss in existing technologies.

[0047] In one possible implementation of the embodiments of this application, combined with Figure 2 ,like Figure 3 As shown, the above S202 can be specifically implemented through the following S301 to S304, which are explained in detail below: S301. Determine the period parameters and direction angle based on the target category identifier.

[0048] The periodicity parameter controls the spatial repetition spacing of the structured texture, such as the width of adjacent stripes or squares. The orientation angle controls the spatial extension direction of the structured texture, such as the tilt angle of the stripes. These two parameters together determine the geometry of the structured interference mask.

[0049] In one possible implementation, a category index is calculated based on the target category identifier; according to the category index, a corresponding target geometric pattern is selected from a preset set of geometric patterns, which includes checkerboard, diagonal, horizontal stripes, vertical stripes, and intersecting grids; and the periodic parameters and orientation angles are determined based on the target geometric pattern.

[0050] It should be noted that the periodic parameters and orientation angles are calculated from the target category identifier using a mapping function. This mapping function can be a predefined lookup table, hash mapping, or mathematical transformation. For example, the system can maintain a mapping table between category identifiers and periodic parameters and orientation angles, allowing direct lookup of the corresponding values ​​at runtime. The category index can be obtained by performing a modulo operation or hash operation on the target category identifier, used to map any category identifier to a fixed range of pattern indices. Each pattern in the geometric pattern set is pre-associated with a default set of periodic parameters and orientation angles, and small offsets related to the category identifier can be superimposed on top of this to enhance pattern diversity.

[0051] S302. Based on the periodic parameter and direction angle, a structured interference mask is generated through periodic function mapping.

[0052] Periodic function mapping refers to the calculation process of mapping coordinate positions and parameters to mask pixel values ​​using periodic mathematical functions. Periodic functions can be sine, cosine, square wave, or sawtooth wave functions, etc. Structured interference masks exhibit obvious peaks in the frequency domain, strongly stimulating the edge and texture responses of convolutional kernels, thus generating misleading information at the feature map level.

[0053] In one possible implementation, the periodic function mapping can be performed as follows: for coordinates in the mask... For each pixel, the period parameter P and the orientation angle θ are used as inputs to calculate the projection distance of the pixel in the texture direction. This projection distance is then fed into a predetermined periodic function to obtain the grayscale value or the binarized pixel value. For example, for a checkerboard pattern, square wave functions are first applied to the x and y directions respectively and then combined; for a diagonal pattern, the combined projection values ​​of x and y are substituted into the square wave function.

[0054] Preferably, the generation of the structured interference mask satisfies the following formula:

[0055] in, Indicates the position of the c-th basic geometric mask. Pixel value at that location, The mapping function representing the c-th type of geometric pattern, The spatial period of the pattern, Let x be the texture orientation angle, and y be the horizontal and vertical coordinates of the image pixels, respectively. This relationship indicates that the pixel values ​​of the mask are determined by the spatial coordinates after scaling with the periodic parameter and rotating with the orientation angle, under the pattern mapping function.

[0056] It is important to note that the structured interference mask generated by periodic function mapping is fundamentally different from global random noise. Random noise has a relatively uniform energy distribution in the frequency domain and is easily smoothed out by preprocessing steps such as Gaussian filtering or median filtering. In contrast, the frequency domain energy of the structured interference mask is concentrated on several specific frequencies, which highly overlap with the sensitive frequency bands of the convolution kernel. Even after filtering preprocessing, it can still retain sufficient interference energy, ensuring the continued effectiveness of adversarial attacks in complex environments.

[0057] S303. Generate a binarized discard matrix and a random noise perturbation matrix using a random algorithm.

[0058] The binarization discard matrix is ​​a two-dimensional matrix composed of 0s and 1s, used to determine which locations in the structured interference mask are retained and which are discarded, thus achieving spatial sparsity. The random noise perturbation matrix is ​​a two-dimensional matrix composed of random values, used to superimpose small intensity variations at the locations where interference is retained, increasing the non-uniformity of the perturbation.

[0059] In one possible implementation, the binarized drop matrix is ​​generated by a random number generator with a preset drop probability. For each matrix element, a random number between 0 and 1 is generated. If the random number is less than the drop threshold, the element is set to 0; otherwise, it is set to 1. The drop threshold can be adjusted according to the attack intensity requirements; for example, setting it to 0.3 means that approximately 30% of the interfering pixels are dropped. The random noise perturbation matrix is ​​generated by the random number generator for each matrix element, with the random values ​​distributed uniformly, Gaussianly, or other probability distributions. The value range can be controlled within a preset perturbation intensity range.

[0060] It should be noted that the introduction of the binarized discard matrix transforms the interference mask from full-area coverage to sparse distribution. While preserving some of the original semantic information, it implants adversarial features, reducing visual abruptness and simulating the effects of partial occlusion or sticker attacks in the physical world. The random noise perturbation matrix further disrupts the regularity of the structured mask, increasing the difficulty for the defender to reverse-analyze the interference pattern. The generation of both random matrices relies on random seeds, and the fixedness of the seeds ensures accurate reproduction in the subsequent reconstruction stage.

[0061] As an example, the random number generator uses the MT19937 algorithm, with a random seed from the attack parameters as the initialization seed. For a masked region with a resolution of H×W, each element of the binarized discard matrix is ​​set to 0 with a probability of 0.3 and 1 with a probability of 0.7; each element of the random noise perturbation matrix is ​​uniformly sampled from the interval [-15, 15], and is used to fine-tune the retained interference pixel values ​​in subsequent logical bit operations.

[0062] S304. Perform logical bit operations on the structured interference mask, the binarized discard matrix, and the random noise perturbation matrix to obtain the final interference mask.

[0063] In this context, bitwise logical operations refer to performing binary logical operations such as AND, OR, and XOR on the corresponding pixel values ​​of the matrix bit by bit. The bitwise logical operations used in this embodiment result in the following combined effect: the structured interference mask defines the geometric structure and spatial location of the texture, the binarization discard matrix determines the effective pixels in the texture, and the random noise perturbation matrix makes a final fine adjustment to the intensity of the effective pixels.

[0064] In one possible implementation, the final interference mask The generation method is represented as follows: .in, This represents an interference mask; AND indicates a bitwise AND operation. Represents the binarized discard matrix. This represents the random noise perturbation matrix. This operation ensures that the values ​​of the noise perturbation matrix are passed to the final mask only at pixel locations where the structured mask has texture and the discard matrix is ​​marked as retained. In another implementation, logical bitwise operations can also be replaced with arithmetic multiplication-addition operations or reversible algebraic transformations.

[0065] It should be noted that the final interference mask obtained through the logical bit operations of the three components retains the targeted interference capability of the structured texture against the convolutional neural network, while also possessing concealment due to the sparsity and randomness of the superposition. Because of the sparse distribution, the interference does not cover every pixel in the region of interest, visually appearing as a discontinuous, garbled effect rather than a complete color block coverage, thus enhancing the naturalness of the adversarial example to a human observer. Simultaneously, the superposition of the random noise perturbation matrix disrupts the complete regularity of the structured texture, making it difficult for the defender to identify and remove the interference through simple template matching.

[0066] As an example, taking the checkerboard pattern in a pedestrian area as an example, the value of the structured interference mask at a certain pixel position is 255, the corresponding position of the binarized discard matrix is ​​1, and the corresponding position of the random noise perturbation matrix is ​​-10. After the bitwise AND operation, the value of the final interference mask at the corresponding position is 245.

[0067] In this embodiment, the periodic parameters and orientation angles are first derived from the category identifier through indexing and pattern selection. Then, the basic texture is generated by periodic function mapping. Finally, the final interference mask with category specificity, high concealment and frequency domain concentration is formed through sparsification and random perturbation logic bit operations, which effectively overcomes the shortcomings of traditional global random noise in terms of spatial selectivity and anti-preprocessing ability.

[0068] In one possible implementation of the embodiments of this application, combined with Figure 2 ,like Figure 4 As shown, the above S203 can be specifically implemented through the following S401 to S403, which are explained in detail below: S401. Extract the target image data corresponding to the region of interest in the original image, and determine the target color channel corresponding to the target image data.

[0069] The target image data refers to the subset of pixel values ​​in the original image within the region of interest that need to be injected to combat interference. The target color channel refers to the specific channel in the image's color space that carries the interference injection, such as the red, green, or blue channel in the RGB color space, or the luminance or chrominance channel in color spaces like YUV or Lab. The shape of the region of interest is not limited to a rectangular bounding box; it can also be any shape defined by a polygon or a mask image. The system extracts the corresponding channel data within this region through methods such as region indexing or pixel traversal.

[0070] In one possible implementation, the system separates the original image into multiple two-dimensional matrices by channel, with each matrix corresponding to a color channel. Then, based on the coordinate range of the region of interest or mask markings, a subset of pixel values ​​is extracted from the matrix corresponding to the target color channel as the target image data. For the original RGB format image, the system labels its three channels as R, G, and B channels, and selects one of them as the target color channel. For common image formats that do not inherently contain an alpha channel, such as JPEG, the system uses any one of the RGB channels as the target color channel for injection, without the need for additional conversion to BGRA format. For formats such as PNG that already contain an alpha channel, the alpha channel can be used for subsequent steganography or independently to carry interference; this application does not impose any restrictions on this.

[0071] It's important to note that limiting the interference to specific color channels rather than injecting into all channels is a design consideration based on the differences in the weight distribution of feature extraction across different channels in convolutional neural networks. Different channels play different semantic roles in the model's convolutional kernel. For example, the blue channel carries relatively little key semantic information about objects in most pre-trained models. Attacking the blue channel can effectively interfere with the model's deep feature representation without significantly affecting human visual perception. Furthermore, applying interference only to a single channel in a local region makes the adversarial example's overall statistical distribution very similar to the original image, making it difficult for traditional defense mechanisms based on global histograms or frequency domain statistics to detect the anomaly.

[0072] Based on the above steps, the system completes the task of accurately extracting local data of the target channel from the original image, ensuring that the interference only affects the specified spatial range and color dimension, while the background area and other channel data are unaffected.

[0073] S402. Based on the final interference mask, perform reversible logic operations on the target image data in the target color channel to obtain the perturbed target image data.

[0074] Among them, the reversible logical operation is the XOR operation.

[0075] In one possible implementation, the system performs an XOR operation on each pixel value in the target image data and the corresponding pixel value in the final interference mask. Taking an 8-bit depth image as an example, each pixel value ranges from 0 to 255. The XOR operation is performed bit by bit on the corresponding bits of the 8-bit binary value. If two bits are the same, the result bit is 0; if two bits are different, the result bit is 1. After the XOR operation, the original pixel values ​​are converted into seemingly random perturbation values, producing a visually sputtering or mosaic effect. For multi-channel images, the XOR operation only applies to pixels within the target color channel; pixel values ​​in other channels are unaffected by this step.

[0076] It should be noted that choosing XOR operation as the injection method is advantageous because its reflexive property can support subsequent lossless restoration. Furthermore, XOR operation is one of the most basic hardware instructions in computer processors, with extremely high execution efficiency and very low latency for pixel-by-pixel processing of large-scale images. It is suitable for adversarial sample generation and restoration scenarios that require real-time or near-real-time processing.

[0077] As an example, in an autonomous driving scenario, the original B-channel value of the pixel at coordinates (1200, 300) in the target image data is 180 (binary 10110100), and the corresponding value in the final interference mask is 85 (binary 01010101). The system performs an XOR operation on the two: 10110100 XOR 01010101 = 11100001, which is 225. The B-channel value of this pixel is updated to 225, visually exhibiting an interference effect that significantly deviates from the original color. Similarly, the B-channel values ​​of all 50,000 pixels in the region of interest are XORed one by one with the corresponding values ​​in the final interference mask to obtain the perturbed target image data for the entire region.

[0078] Based on the above steps, the system uses XOR operations to precisely inject the structured mask into the local region of the target channel, generating a set of perturbation data that is mathematically strictly related to the original data, which is used for subsequent adversarial sample generation and lossless reconstruction.

[0079] S403. Replace the corresponding target image data in the target color channel with the perturbed target image data, while keeping the image data of the non-interest area unchanged, to generate adversarial examples.

[0080] Adversarial examples refer to images that, after being injected with localized structured interference, visually retain the main content of the original image but exhibit significant pixel distortion in specific regions. Such images can cause deep learning models to misidentify targets within the region of interest, while, because the non-interested regions remain unmodified, the overall image appears only slightly different from the original to an average observer.

[0081] In one possible implementation, the system writes the perturbed target image data back to the target color channel at its original coordinates, overwriting the original pixel values. "Writing back" means replacing the original values ​​at the corresponding coordinates in the target color channel matrix with the perturbed data, while leaving the channel values ​​at other coordinates unchanged. Then, the system merges the modified target color channel with the other unmodified color channels to form a complete adversarial example image. During the merging process, all channel data outside the region of interest retain their original image state, and background, environment, and other information are not distorted. Similarly, the original values ​​of non-target channels within the region of interest are also preserved, achieving both spatial and channel selectivity in the perturbation.

[0082] It's important to note that the design principle of keeping the non-interest regions unchanged ensures that adversarial examples highly concentrate their interference in semantically clear local areas. Visually, this more closely resembles natural phenomena like stickers or partial occlusions in the physical world, rather than the artificial modifications commonly seen in digital signal processing. This localization strategy effectively transforms adversarial perturbations from low-frequency background noise, a common feature in traditional global solutions, into high-frequency local textures, making it difficult for defenders to eliminate the interference through simple full-image denoising or smoothing. Furthermore, since the data in the non-interest regions remains unchanged, no calculations are required for these regions during the reconstruction phase, significantly simplifying the reconstruction process.

[0083] In this embodiment, the interference is doubly limited to the region of interest in the spatial dimension and the target color channel in the color dimension. The data in the non-interested region and the non-target channel remain completely in their original state. This allows for effective targeted attacks while preserving the overall visual quality and statistical characteristics of the image to the greatest extent possible. It also enables the restoration operation to accurately lock the region and channel to be processed, achieving an efficient closed loop from injection to elimination.

[0084] In one possible implementation of the embodiments of this application, combined with Figure 2 ,like Figure 5 As shown, the above S204 can be specifically implemented through the following S501 to S503, which are explained in detail below: S501. Serialize the attack parameters to obtain the binary data stream corresponding to the attack parameters.

[0085] The attack parameters include the location information of the region of interest, the target category identifier, and a random seed used to generate the final interference mask.

[0086] In one possible implementation, the system pre-defines the packet format for attack parameters, such as using a fixed-length byte array. The first few bytes store the bounding box coordinates, followed by several bytes storing the target category identifier, and the last few bytes storing the random seed. The system iterates through this byte array byte by byte, expanding each byte into 8 bits to form a binary data stream. If the target category identifier is a string rather than a number, the system can first encode it into ASCII or UTF-8 byte sequences before including it in the packet format. For multi-target attack scenarios, the attack parameters can also include the location information and category identifiers of multiple regions of interest, as well as an independent random seed for each region, arranged sequentially by region during serialization. Furthermore, to ensure correct parsing during the reconstruction phase, a fixed synchronization flag or length indicator field can be appended to the header of the serialized data stream to assist in subsequent bitstream segmentation and parameter unpacking.

[0087] It is important to note that the choice of attack parameters directly determines the feasibility and completeness of the reconstruction. If any key parameter is missing, the reconstruction stage will be unable to accurately reproduce the same final interference mask as the generation stage, leading to incorrect XOR inverse operations and pixel errors in the reconstructed image. Therefore, the types and serialization formats of attack parameters are strictly defined during the system design phase to ensure that the generation and reconstruction ends follow the same protocol. The introduction of a random seed is crucial to ensuring the deterministic nature of mask reproduction. Modern computer random number generators are pseudo-random; as long as the seed is the same, the generated random sequences will be completely identical. This makes the originally non-reproducible random discarding and perturbation processes deterministic.

[0088] S502. Determine the target image channel of the adversarial example and the preset bit plane corresponding to the target image channel.

[0089] In this context, the target image channel refers to the color channel or auxiliary channel used to carry steganographic data in the adversarial example. The preset bit plane refers to the specific bit layer selected as the location for steganographic writing in the binary representation of the pixel value of the target image channel. In this embodiment, the target image channel is the Alpha channel, and the preset bit plane is the least significant bit of the Alpha channel. The Alpha channel is used to control pixel transparency in four-channel image formats such as PNG or TIFF. Its pixel value is typically 8 bits deep, ranging from 0 to 255, where 0 represents complete transparency and 255 represents complete opacity. The least significant bit is the lowest bit (i.e., bit 0) in the 8-bit binary representation of the pixel value. Changing the value of this bit has only about 1 / 256 of the overall transparency, which is almost imperceptible visually.

[0090] In one possible implementation, if the adversarial example itself is in BGRA or RGBA four-channel format and already includes an alpha channel, the system directly selects that alpha channel as the target image channel. If the original adversarial example is in a standard RGB three-channel format such as JPEG, the system can first convert the image to RGBA four-channel format and assign a uniform initial value, such as 255 (completely opaque), to the newly added alpha channel before performing steganography on that alpha channel. For image formats that do not support alpha channels or in application scenarios where it is not appropriate to introduce alpha channels, the system can also select one of the RGB three channels as the target image channel, for example, selecting the least significant bit of the blue channel for steganography, the visual impact of which is also negligible.

[0091] It's important to note that the core consideration for choosing the least significant bit (LSB) for steganographic embedding lies in its imperceptibility. Since the LSB only affects the lowest bit of the pixel value, changing it from 0 to 1 or from 1 to 0 results in a pixel value change of only 1. In a 256-level grayscale or opacity range, the human eye's resolution threshold is typically around 5 to 10, so a change of 1 level is completely imperceptible. Compared to replacing higher bits, LSB steganography does not introduce perceptible noise or texture anomalies into the image, ensuring that the self-contained adversarial example is virtually indistinguishable from the original adversarial example in appearance. One advantage of the alpha channel over the RGB color channels is that changes to the alpha channel value do not affect the color rendering of the image on the screen; they only affect the opacity. Since adversarial examples are typically used in a completely opaque state, modifications to the LSB of the alpha channel are even less significant.

[0092] S503. Replace the corresponding bits of the preset bit plane of the target image channel with binary data stream to perform steganographic embedding of attack parameters and obtain a self-contained adversarial sample.

[0093] In one possible implementation, the system employs a pixel-by-pixel sequential writing strategy. Starting from the first pixel of the image, it sequentially accesses each pixel of the target image channel in a row-first or column-first scanning order, replacing each bit in the binary data stream with the least significant bit of each pixel. For the alpha channel, the replacement operation can be represented as: reading the original value α of a pixel in the alpha channel, clearing the least significant bit of α to zero, and then writing the current bit value from the binary data stream to that bit. This operation can be efficiently implemented using integer bitwise operations. After writing, the system re-merges the modified alpha channel with the remaining unmodified channels to obtain a self-contained adversarial example. When the length of the binary data stream is less than the total number of pixels in the target image channel, the remaining pixel bits remain unchanged; when the data stream length exceeds the limit, the system can perform cyclic writing or multi-bit embedding, but usually the number of attack parameters is much smaller than the number of image pixels, so there is no capacity shortage problem. In the restoration phase, the system only needs to reverse the traversal of pixels in the same order and extract the value of the least significant bit sequentially to restore the binary data stream.

[0094] It should be noted that while least significant bit steganography is simple and efficient, its undetectability depends on the amount of embedded data being sufficiently small relative to the total number of pixels in the image. In this embodiment, the attack parameters are typically only tens to hundreds of bytes. Even a megapixel image provides millions of bits of capacity in its alpha or RGB channels, thus occupying only a very small proportion of the least significant bits. The statistical characteristics of the image, such as its histogram distribution, undergo almost no detectable changes. This characteristic makes it difficult for conventional steganalysis techniques to determine whether a self-contained adversarial example has been steganized, as the attack parameters are concealed within the image.

[0095] This application utilizes the least significant bit of the alpha channel for steganography, encapsulating all the crucial metadata required for image reconstruction within the image itself without significantly altering the image's visual appearance or adversarial effectiveness. This approach makes adversarial examples independent, self-contained data units, fundamentally eliminating problems such as difficulties in data tracing, storage redundancy, and permanent loss of data value caused by separating attack parameters from the sample for storage. Furthermore, this steganography scheme exhibits cross-image format compatibility, supporting not only four-channel image formats with an alpha channel but also extending to the corresponding bit plane of RGB three-channel formats, ensuring broad applicability of the technical solution in practical deployments.

[0096] In one possible implementation of the embodiments of this application, combined with Figure 2 ,like Figure 6 As shown, the above S205 can be implemented by the following S601 to S605, which are explained in detail below: S601. Extract the binary data stream from the preset bit plane of the target image channel of the self-contained adversarial example.

[0097] Extracting the binary data stream refers to reading the bit information steganographically written in a specified bit plane of the image channel from the self-contained adversarial sample according to the same rules agreed upon in the embedding stage, and recovering the original binary sequence corresponding to the attack parameters. The target image channel and the preset bit plane here are consistent with the channels and bit planes used in the steganography embedding in embodiments S501 to S503.

[0098] In one possible implementation, the system separates a two-dimensional matrix of the target image channels from the self-contained adversarial example. Then, following a predetermined scanning order—for example, starting from the top-left pixel of the image and traversing each pixel of the channel in row-major order—it sequentially reads the bit value of each pixel on a preset bit plane and concatenates these bits to form a continuous binary data stream. If a synchronization flag or length indicator field is added to the header of the data stream during steganography embedding, the system first locates the synchronization flag in the binary data stream and then determines the effective bit range of the attack parameters based on the length indicator field, thereby extracting the complete binary data segment of the attack parameters. For cases where the number of attack parameters is extremely small, much smaller than the total number of pixels in the image, the system extracts only the required bits from the least significant bits of the first few pixels, omitting the corresponding bits of the remaining pixels.

[0099] It should be noted that the correctness of the extraction process highly depends on the system adhering to identical conventions at both the generation and reconstruction ends, including the scan start point, scan direction, channel selection, and bit plane position. Deviation in any of these conventions may lead to misalignment of the read bit sequence, resulting in the parsing of incorrect attack parameters, ultimately causing subsequent mask reproduction failures and pixel errors in the reconstructed image.

[0100] Based on the above steps, the system can successfully obtain the complete binary data stream corresponding to the attack parameters by scanning and reading the preset bit plane of the self-contained adversarial sample itself without the need for any external files or database assistance, thus providing a data source for subsequent parameter parsing and mask reproduction.

[0101] S602. Parse the binary data stream to obtain the attack parameters.

[0102] The attack parameters include the location information of the region of interest, the target category identifier, and the random seed.

[0103] In one possible implementation, the system deserializes the binary data stream extracted in S601 according to a preset data structure, restoring it into multiple independent parameters with clear semantics. For example, if the serialization process stipulates that the first 16 bytes store four 32-bit integers representing the bounding box coordinates in sequence... Following this, four bytes store a 32-bit integer representing the target category identifier, and the last four bytes store a 32-bit integer representing the random seed. During parsing, each parameter is read and reconstructed sequentially according to the same order and field length. For variable-length fields that may be included in the attack parameters, such as when the category identifier is a string instead of an integer, the length prefix must be read first, followed by the corresponding length of character data. After parsing, the system obtains a set of reconstructed attack parameter tuples, the contents of which correspond one-to-one with the parameters used in the adversarial sample generation stage.

[0104] Based on the above steps, the system recovers multidimensional attack parameters with clear semantics from a one-dimensional binary bit sequence, realizing the information conversion from steganographic data to understandable metadata.

[0105] S603. Based on the target category identifier, redetermine the corresponding periodic parameters and orientation angles, and generate a structured interference mask through periodic function mapping based on the periodic parameters and orientation angles.

[0106] The process of redetermining the periodic parameters and orientation angles is consistent with the generation logic described in S301. The periodic function mapping is also consistent with the description in S302, where spatial coordinates are scaled by the periodic parameters and rotated by the orientation angle before being fed into a predetermined periodic function to generate mask pixel values ​​with specific geometric textures. The purpose of this step is to re-execute the exact same mask generation operation as the generation stage during the restoration phase, using the category identifiers parsed from the self-contained adversarial examples, to produce a structured interference mask that is completely identical to the one injected.

[0107] In one possible implementation, the system calculates a category index based on the parsed target category identifier, selects the corresponding target geometric pattern from a preset set of geometric patterns, including checkerboard, diagonal, horizontal stripes, vertical stripes and intersecting grids, and then determines the periodic parameters and orientation angles based on the target geometric pattern.

[0108] Preferably, the system assigns coordinates to each pixel in the mask. Apply the following mapping relationship:

[0109] in, Indicates the position of the c-th basic geometric mask. Pixel value at that location, The mapping function representing the c-th type of geometric pattern, The spatial period of the pattern, Let x be the texture orientation angle, and y be the horizontal and vertical coordinates of the image pixels, respectively. This mapping relationship is completely consistent with the formulas in S301 to S304, and the meaning and value range of each parameter are also consistent.

[0110] Based on the above steps, the system independently generates the same structured interference mask as the generation stage at the restoration stage, relying on the parsed target category identifier, providing an accurate texture basis for subsequent logical bit operations to synthesize the final interference mask.

[0111] S604. Based on the random seed, generate a binarized discard matrix and a random noise perturbation matrix consistent with the adversarial sample generation stage using a random algorithm.

[0112] In one possible implementation, the system uses the parsed random seed as a parameter to call a pseudo-random number generator of the same type as the generation stage, such as the MT19937 Mason tweening algorithm, to initialize the seed. The system generates a binarized discard matrix and a random noise perturbation matrix sequentially, following the same order and dimensions as the generation stage. For each element of the binarized discard matrix, a preset discard probability is used as a threshold. The pseudo-random number generator produces a random value between 0 and 1; if the random value is less than the discard threshold, the element is set to 0; otherwise, it is set to 1. For each element of the random noise perturbation matrix, the pseudo-random number generator generates an independent random value within a preset perturbation intensity range, for example, uniformly sampling within the range [-15, 15]. The resolution of both matrices is consistent with the resolution of the region of interest, allowing for pixel-by-pixel operations with the structured interference mask.

[0113] It should be noted that the determinism of reproduction depends entirely on the fixedness of the random seed, which is why the attack parameters in this embodiment must include the random seed and not just the target category identifier and location information. Furthermore, since the seed value is steganographically embedded within the image, the steganized image is almost indistinguishable from the unsteganized version in appearance. The seed will not be lost or separated during transmission and storage, ensuring the executability of the restoration loop.

[0114] Based on the above steps, the system utilizes the determinism of the random seed to accurately reproduce the sparse auxiliary matrix that is exactly the same as that in the generation stage at the restoration stage, thus eliminating the risk of unreproducibility caused by randomness.

[0115] S605. Perform logical bit operations on the structured interference mask, the binarized discard matrix, and the random noise perturbation matrix to obtain the final interference mask after reproduction.

[0116] In one possible implementation, the system uses a structured interference mask. Binarization discard matrix and random noise perturbation matrix ,according to The final interference mask is synthesized pixel by pixel.

[0117] Based on the above steps, the system completes the closed-loop path from parameter extraction to complete mask reproduction, obtaining a final interference mask copy that is completely consistent with the values ​​generated in the generation stage, providing accurate calculation parameters for subsequent lossless restoration.

[0118] The extraction and parsing process in this application relies entirely on the steganographic data carried by the image itself, requiring no external file support. The mask reproduction process depends on the deterministic mapping of the target category identifier and the fixed pseudo-random sequence of the random seed, strictly ensuring that the reproduced mask is completely consistent with the one injected. Through the reproduction mechanism based on parameterized generation and information steganography, the adversarial sample truly becomes a self-contained closed-loop data unit, providing accurate and error-free interference removal data for subsequent inverse operations to restore the original image.

[0119] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0120] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

Claims

1. A method for generating and reconstructing reversible targeted adversarial examples based on channel steganography, characterized in that, The method includes: Acquire the original image, the region of interest of the target to be attacked, and the target category identifier; Based on the target category identifier, the periodic parameters and orientation angle are determined, and a structured interference mask is generated through periodic function mapping; Based on a random seed, a binary discard matrix and a random noise perturbation matrix are generated using a random algorithm. The structured interference mask, the binarized discard matrix, and the random noise perturbation matrix are subjected to logical bit operations to obtain the final interference mask; By using reversible logic operations, the final interference mask is injected into the region of interest of the original image to generate adversarial examples; The attack parameters are steganographically embedded into a preset bit plane of the image channel of the adversarial sample to obtain a self-contained adversarial sample; the attack parameters include the location information of the region of interest, the target category identifier, and the random seed; Attack parameters are extracted from the preset bit plane of the self-contained adversarial sample, and the final interference mask is reproduced based on the attack parameters; By using the inverse operation of the reversible logic operation, the final interference mask is eliminated in the region of interest of the target to be attacked, and the original image is restored.

2. The method according to claim 1, characterized in that, The step of determining the period parameters and direction angle based on the target category identifier includes: Calculate the category index based on the target category identifier; According to the category index, the corresponding target geometric pattern is selected from the preset set of geometric patterns, which includes checkerboard, diagonal, horizontal stripes, vertical stripes and intersecting grids; The periodic parameter and the orientation angle are determined based on the target geometric pattern.

3. The method according to claim 1, characterized in that, The step of injecting the final interference mask into the region of interest of the original image using reversible logic operations to generate adversarial examples includes: Extract the target image data corresponding to the region of interest in the original image; Determine the target color channel corresponding to the target image data; Based on the final interference mask, a reversible logical operation is performed on the target image data in the target color channel to obtain the perturbed target image data; the reversible logical operation is an XOR operation. The perturbated target image data is used to replace the corresponding target image data in the target color channel, while keeping the image data of the non-interest areas unchanged, to generate adversarial examples.

4. The method according to claim 1, characterized in that, The step of embedding attack parameters into a preset bit plane of the image channel of the adversarial sample to obtain a self-contained adversarial sample includes: The attack parameters are serialized to obtain the binary data stream corresponding to the attack parameters; Determine the target image channel of the adversarial example and the preset bit plane corresponding to the target image channel; By replacing the corresponding bits of the preset bit plane of the target image channel with the binary data stream, the steganographic embedding of attack parameters is performed to obtain a self-contained adversarial sample.

5. The method according to claim 4, characterized in that, The attack parameters include the location information of the region of interest, the target category identifier, and a random seed for generating the final interference mask; the target image channel is an alpha channel, and the preset bit plane is the least significant bit of the alpha channel.

6. The method according to claim 1, characterized in that, The step of extracting attack parameters from the preset bit plane of the self-contained adversarial sample and reproducing the final interference mask based on the attack parameters includes: Extract binary data streams from a preset bit plane of the target image channels of a self-contained adversarial example; The binary data stream is parsed to obtain attack parameters, which include the location information of the region of interest, the target category identifier, and the random seed. The corresponding periodic parameters and orientation angles are re-determined based on the target category identifier, and a structured interference mask is generated through periodic function mapping based on the periodic parameters and orientation angles. Based on the random seed, a binarized discard matrix and a random noise perturbation matrix consistent with the adversarial example generation stage are generated using a random algorithm; The structured interference mask, the binarized discard matrix, and the random noise perturbation matrix are subjected to logical bit operations to obtain the final interference mask after reproduction.

7. The method according to claim 1, characterized in that, The step of using the inverse operation of the reversible logic operation to remove the final interference mask in the region of interest of the target to be attacked and restore the original image includes: The location of the region of interest within the self-contained adversarial example is determined based on the attack parameters; Extract image data from the target color channel corresponding to the region of interest; The image data in the target color channel is XORed with the final interference mask again to obtain the recovered target image data. The restored target image data is used to replace the corresponding image data in the target color channel, while keeping the image data of the non-interest areas unchanged, to obtain the restored original image.

8. A system for generating and reconstructing reversible targeted adversarial samples based on channel steganography, used to perform the method according to any one of claims 1 to 7, characterized in that, The system includes: The data acquisition module is used to acquire the original image, the region of interest of the target to be attacked, and the target category identifier; The interference mask generation module is used to determine the periodic parameters and direction angle based on the target category identifier, and generate a structured interference mask through periodic function mapping; based on a random seed, it generates a binary discard matrix and a random noise perturbation matrix through a random algorithm; and performs logical bit operations on the structured interference mask, the binary discard matrix, and the random noise perturbation matrix to obtain the final interference mask. An adversarial example generation module is used to inject the final interference mask into the region of interest of the original image using reversible logical operations to generate adversarial examples; The parameter steganography module is used to embed attack parameters into a preset bit plane of the image channel of the adversarial sample to obtain a self-contained adversarial sample; the attack parameters include the location information of the region of interest, the target category identifier, and the random seed; An attack parameter extraction module is used to extract attack parameters from the preset bit plane of the self-contained adversarial sample, and reproduce the final interference mask based on the attack parameters. The image restoration module is used to eliminate the final interference mask in the region of interest of the target to be attacked and restore the original image by using the inverse operation of the reversible logic operation.

Images