Adversarial scene generation method and apparatus, terminal and medium

Abstract

The application provides a kind of confrontation scene generation method, device, terminal and medium.The method constructs and executes double-layer nested cycle architecture, architecture contains inner loop and outer loop, method includes: according to original driving scene information, geometric structure condition and the semantic steering vector input generation model of current round, obtain current round effective generated confrontation scene;According to original driving scene information, current round effective generated confrontation scene and the automatic driving system to be measured, obtain the confrontation risk loss of current round, and the confrontation risk loss of current round is used as feedback signal, updates semantic steering vector;With the updated semantic steering vector retrigger the inner loop of next round, form closed loop iteration, until meeting termination condition, output final high-risk confrontation scene.It realizes that generation has both high visual fidelity and physical rationality, and can accurately induce the semantic confrontation scene of automatic driving system perception or decision failure.

Description

Technical Field

[0001] This invention relates to the field of intelligent vehicle testing technology, specifically to a method, apparatus, terminal, and medium for generating adversarial scenarios. Background Technology

[0002] Safety verification for intelligent connected vehicles has shifted from traditional mileage accumulation testing to scenario-based simulation testing methods. The core challenge lies in efficiently covering the long-tailed distribution of extreme conditions in real-world traffic environments. Early simulation testing technologies primarily relied on rule-based scenario generation methods or playback reconstruction techniques based on real road test data. The former uses a pre-defined parameter space (such as speed and distance) for random sampling; while logically sound, the generated scenarios often lack diversity and realism, failing to capture the complexities of the real world. The latter, while offering high fidelity, is limited by the established state of the collected data, unable to flexibly generate previously unseen dangerous interactions, leading to severe sample bias in the robustness assessment of the perception and decision-making systems. To address the problem of sample scarcity, academia introduced adversarial attack theory. Early research focused on pixel-level adversarial perturbations, which involve superimposing invisible micro-noise (such as FGSM and PGD algorithms) onto the input image to induce misidentification in neural networks. However, while such pixel-level attacks are highly effective in the digital domain, they disrupt the natural statistical regularities of images and are difficult to correspond to specific changes in the real physical world. This results in a "semantic gap" between test results and actual road safety risks, making it impossible to effectively guide vehicle improvements in the physical environment.

[0003] Breakthroughs in generative artificial intelligence, particularly the emergence of Generative Adversarial Networks (GANs), Neural Radiation Fields (NeRFs), and Diffusion Models, have provided new technical pathways for constructing high-fidelity, controllable test scenarios, driving the evolution from pixel-level perturbation to semantic-level manipulation. Existing cutting-edge technologies are beginning to explore using generative models to edit specific semantic attributes in scenes, such as altering weather conditions, lighting distribution, or vehicle textures, to generate "semantic adversarial examples." These methods attempt to modify high-level semantic features of images while maintaining the realism of scene illumination to test the boundaries of autonomous driving perception systems. For example, some research utilizes Conditional GANs (cGANs) or CycleGANs for cross-domain style transfer to simulate the visual effects of rain and fog; recent research explores using text-to-image diffusion models for local redrawing, replacing background elements or foreground objects without altering the scene's geometric layout.

[0004] While the aforementioned semantic generation techniques enhance the visual realism of test scenarios, significant technical bottlenecks remain in closed-loop applications for autonomous driving safety testing. Existing generative methods largely focus on improving image quality or randomizing single attributes, lacking a targeted search mechanism for failure modes of the system under test. In other words, current generative models are often "blind"; they can generate realistic snow scenes but struggle to accurately generate the snow texture distribution that "causes a specific autonomous driving model to fail at a specific decision moment." Furthermore, semantic manipulation based purely on 2D image generation often ignores the consistency and physical constraints of 3D space, resulting in flaws in the generated adversarial scenarios' geometric projection or temporal logic (such as incorrect shadow direction or discontinuous object trajectories). These non-physical artifacts are easily filtered out by temporal fusion algorithms, thus failing to constitute an effective attack on high-order autonomous driving systems. Therefore, the industry urgently needs a closed-loop generative scenario adversarial testing solution that integrates high-level semantic control, physical consistency constraints, and risk feedback for the system under test—this is precisely the core technical challenge that this invention aims to address.

[0005] The current technical field involves two closest existing technical solutions: The first and closest existing technology is a cross-domain style transfer testing method based on Generative Adversarial Networks (GANs), typically represented by "DeepRoad" in academia or CycleGAN variants widely used in industry. The core logic of this approach lies in using unpaired image translation technology to map driving images from simulated environments or clear weather to complex weather domains (such as rain, snow, and fog) or different lighting domains (such as nighttime), thereby expanding the test dataset. Its implementation usually involves two adversarial generators and discriminators: the generator attempts to change the texture style of the image while maintaining the original image's geometry (such as lane line positions and traffic sign shapes) to deceive the discriminator; the discriminator is responsible for distinguishing the generated image from real complex weather images. Although this type of method performs well in bridging the visual gap between virtual and real environments, from the perspective of adversarial attacks, its limitations lie in the "blindness of the attack" and the "coarseness of semantic control." This technology primarily performs global style transfer, making it difficult to manipulate specific semantic entities in a scene (such as a particular car or road sign). It cannot achieve localized adversarial processing by "modifying only the road sign texture without altering the background." More importantly, this type of generation process is typically open-loop; the generator aims only to pass the discriminator's visual realism check, without incorporating the recognition results or decision feedback from the backend autonomous driving system into the optimization loop. This results in generated scenes that, while visually resembling rainy days, may not actually be "high-risk rainy days" that could cause autonomous vehicles to malfunction.

[0006] The second, more advanced category of existing technologies, highly relevant to this invention, is text-guided scene editing methods based on diffusion models. These methods have emerged recently with the rise of technologies such as Stable Diffusion and ControlNet. This type of approach utilizes pre-trained large-scale latent diffusion models to guide scene generation or redrawing through text prompts or layout conditions. For example, an operator can input "a truck driving in the snow" and use a Canny edge detection map as a control condition to generate a driving scene with extremely high realism and rich semantic details. Compared to GANs, this type of method represents a qualitative leap in semantic understanding and image quality, enabling "creation from nothing" or semantic replacement of specific regions. However, when applied to autonomous driving safety testing, its core deficiency lies in the lack of "physical adversarial" and "decision sensitivity." Existing diffusion editing primarily relies on the alignment of text and images, rather than the failure probability of the tested system. This means that the system might generate a perfect snow scene image, but if this image cannot induce false detections in autonomous driving perception, it is an invalid sample for testing. Furthermore, the inherent randomness of diffusion models makes it difficult to precisely control physical consistency (such as the consistency of illumination direction and time, and the occlusion relationship between objects), and the generation process is usually extremely slow, making it difficult to meet the needs of rapid and continuous gradient attacks on small changes in the tested system in loop testing. This makes it currently more of an offline data augmentation tool than a real-time adversarial testing system.

[0007] Most existing generation solutions focus on improving the visual quality of images or performing global style transfer, lacking a closed-loop optimization mechanism for real-time feedback from the system under test. This means they cannot automatically adjust the intensity and direction of generation based on the recognition confidence or decision-making bias of the autonomous driving system. Consequently, only a very small number of the massively generated scenes actually trigger and take effect, resulting in extremely low testing efficiency. Furthermore, during scene editing, existing technologies struggle to handle complex local semantic relationships. Often, modifications to weather or background inadvertently disrupt the geometry or physical properties of key driving elements such as lane lines and traffic lights (e.g., shadow direction does not match the light source). This disruption of physical consistency renders the generated test cases logically invalid, interfering with the evaluation of the system's true capabilities and potentially leading to incorrect optimization directions. In short, they either lack precise control over local semantics due to limitations in global style transfer, or while possessing strong semantic generation capabilities, they lack a closed-loop optimization mechanism and physical consistency constraints for risk feedback from the system under test. Summary of the Invention

[0008] To address the shortcomings of existing technologies, this invention proposes a method, device, terminal, and medium for generating adversarial scenarios. The aim is to generate semantic adversarial scenarios that possess both high visual realism and physical plausibility, and can accurately induce perception or decision-making failures in autonomous driving systems, thereby achieving efficient and interpretable safety boundary detection.

[0009] In a first aspect, embodiments of this application provide a method for generating adversarial scenarios. The method constructs and executes a two-layer nested loop architecture, comprising an inner loop and an outer loop, wherein the inner loop is nested within each iteration of the outer loop; the method includes: Acquire the original driving scene information and geometric conditions; In each round of the outer loop, the semantic manipulation vector of the current round is obtained; and in the inner loop, the generative model is input based on the original driving scenario information, geometric conditions and the semantic manipulation vector of the current round to obtain the effective generative adversarial scenario of the current round. In the outer loop, based on the original driving scenario information, the effective generated adversarial scenario of the current round, and the tested autonomous driving system, the adversarial risk loss of the current round is obtained, and the adversarial risk loss of the current round is used as a feedback signal. According to the optimization strategy, the semantic manipulation vector is updated by searching in the parameter space for the direction that increases the failure of the adversarial risk loss of the current round. The updated semantic manipulation vector is used to re-trigger the next round of the inner loop, forming a closed loop iteration until the termination condition is met, and the final high-risk adversarial scenario is output.

[0010] Optionally, in the inner loop, based on the original driving scenario information, geometric conditions, and the semantic manipulation vector of the current round, the effective generative adversarial scenario for the current round is obtained by inputting these into the generative model, including: In the inner loop, candidate generative adversarial scenarios are obtained based on the random seed of the current round, the original driving scenario information, the geometric structure conditions, and the semantic manipulation vector. Perform a rationality check on the candidate generation adversarial scenarios; If the test fails, the random seed is updated, and the adversarial scenario is updated and generated based on the updated random seed, the original driving scenario information, the geometric structure conditions, and the semantic manipulation vector. The process continues until the test is passed, at which point a valid generated adversarial scenario for the current round is obtained.

[0011] Optionally, obtaining candidate generative adversarial scenarios based on the random seed of the current round, original driving scene information, geometric structure conditions, and semantic manipulation vectors includes: The original driving scene information is compressed into the latent space, and the latent space is used as a noisy latent variable in the generative model; Convert semantic manipulation vectors into semantic embeddings; Based on the spatial resolution of the original driving scene information, generate the spatial resolution of the geometric structure conditions. New latent variables are obtained based on semantic embedding, spatial resolution, noisy latent variables, random seed of the current round, UNet, and ControlNet; The new latent variables are decoded to obtain candidate generative adversarial scenarios.

[0012] Optionally, the random seed includes the sampling step number t, and the process of obtaining new latent variables based on semantic embedding, spatial resolution, noisy latent variables, the random seed of the current round, UNet, and ControlNet includes: Based on semantic embedding, spatial resolution, noisy latent variables, the random seed of the current round, UNet, and ControlNet, the noisy latent variables of step t-1 are obtained; Based on semantic embedding, spatial resolution, noisy latent variables in step t-1, random seed of the current round, UNet, and ControlNet, the noisy latent variables in step t-2 are obtained. The process continues until new latent variables are obtained based on semantic embedding, spatial resolution, the noisy latent variables from step 1, the random seed of the current round, UNet, and ControlNet.

[0013] Optionally, the random seed further includes semantic guidance strength and physical constraint strength. The step of obtaining the noisy latent variable at step t-1 based on semantic embedding, spatial resolution, noisy latent variable, the random seed of the current round, UNet, and ControlNet includes: The semantic embedding, spatial resolution, and noisy latent variables are input into a model composed of physical constraint strength, UNet, and ControlNet to obtain semantic prediction noise. By inputting the spatial resolution and noisy latent variables into the model composed of the backbone UNet and ControlNet, unconditional prediction noise is obtained. Based on the semantic guidance strength, semantic prediction noise, and unconditional prediction noise, the noisy latent variables at step t-1 are obtained.

[0014] Optionally, the step of obtaining the adversarial risk loss for the current round based on the original driving scenario information, the effective generated adversarial scenario for the current round, and the tested autonomous driving system includes: Based on the original driving scenario information, the relative distance to the target vehicle and the collision time of the target vehicle are obtained; based on the relative distance to the target vehicle and the collision time of the target vehicle, the risk weight of the target vehicle is obtained. The effective adversarial scenario of the current round is input into the autonomous driving system under test to obtain the detection result; the detection result includes the target confidence; the annotation information in the original driving scenario information; and the target perception failure component is obtained based on the detection result and the annotation information. Based on the target perception failure component and the target vehicle risk weight, the adversarial risk loss for the current round is obtained.

[0015] Optionally, the rationality of the candidate generative adversarial scenarios is verified, including: Based on the candidate generative adversarial scenarios, a physical consistency score is obtained; If the physical consistency score is greater than or equal to the preset threshold, the verification passes. If the physical consistency score is less than the preset threshold, the verification will fail.

[0016] Optionally, obtaining the physical consistency score based on the candidate generative adversarial scenarios includes: A lightweight monocular depth estimation network is used to extract and generate depth maps for adversarial scenarios. Normalize the depth map and geometric conditions, and calculate the pixel-level mean square error between the normalized depth map and the geometric conditions to obtain the geometric loss. Based on the candidate generative adversarial scenarios, we obtain the illumination loss and artifact loss; The physical consistency score is obtained based on geometric loss, illumination loss, and artifact loss.

[0017] Optionally, obtaining the illumination loss and artifact loss based on the candidate generative adversarial scenarios includes: The candidate generative adversarial scenarios are divided into regular grid regions; For each grid region, the main illumination direction vector corresponding to the grid region is estimated using an illumination estimation algorithm; Calculate the average direction of the principal illumination direction vector for all grid regions; The illumination loss is obtained based on the main illumination direction vector and the average direction; A fast Fourier transform is performed on the generative adversarial scenario to convert it from the spatial domain to the frequency domain, thus obtaining the spectral energy distribution. The artifact loss is obtained based on the spectral energy distribution.

[0018] Optionally, the step of using the adversarial risk loss of the current round as a feedback signal and updating the semantic manipulation vector by searching in the parameter space according to the optimization strategy in a direction that increases the failure of the adversarial risk loss of the current round includes: Based on the generative adversarial scenario of the current round, a low-dimensional interpretable semantic space is obtained; Based on the low-dimensional interpretable semantic space and the adversarial risk loss of the current round, a proxy model is constructed, and the prediction mean and prediction variance of the proxy model are obtained. By using the acquisition function that maximizes the upper confidence bound to process the predicted mean and predicted variance, the next most valuable selection test parameters are obtained. Update the semantic manipulation vector based on the selected test parameters.

[0019] Optionally, the step of using the adversarial risk loss of the current round as a feedback signal and updating the semantic manipulation vector by searching in the parameter space according to the optimization strategy in a direction that increases the failure of the adversarial risk loss of the current round includes: Based on the adversarial risk loss of the current round, the tested autonomous driving system of the current round, the semantic manipulation vector of the current round, and the effective generative adversarial scenario of the current round, the optimization gradient of the current round is obtained. Update the semantic manipulation vector based on the optimization gradient of the current round and the semantic manipulation vector of the current round.

[0020] Secondly, embodiments of this application provide an adversarial scenario generation apparatus for constructing and executing a two-layer nested loop architecture, the architecture comprising an inner loop and an outer loop, wherein the inner loop is nested within each iteration of the outer loop; the adversarial scenario generation apparatus includes: The data acquisition module is used to acquire the original driving scenario information and geometric conditions; The inner loop module is used to obtain the semantic manipulation vector of the current round in each round of the outer loop; and in the inner loop, input the original driving scene information, geometric structure conditions and the semantic manipulation vector of the current round into the generative model to obtain the effective generative adversarial scene of the current round. The outer loop module is used to obtain the adversarial risk loss of the current round based on the original driving scenario information, the effective adversarial scenario of the current round, and the autonomous driving system under test. It uses the adversarial risk loss of the current round as a feedback signal and searches in the parameter space according to the optimization strategy to update the semantic manipulation vector in the direction that increases the failure of the adversarial risk loss of the current round. The adversarial scenario output module is used to re-trigger the next round of the inner loop with the updated semantic manipulation vector, forming a closed loop iteration until the termination condition is met, and outputting the final high-risk adversarial scenario.

[0021] Thirdly, embodiments of this application provide a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the adversarial scenario generation method as described in any one of the first aspects above.

[0022] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the adversarial scenario generation method as described in any one of the first aspects above.

[0023] Fifthly, embodiments of this application provide a computer program product that, when run on a terminal device, causes the terminal device to execute the adversarial scenario generation method described in any one of the first aspects.

[0024] The beneficial effects of this invention are as follows: 1. Solved the technical challenges of "physically unexplainable" and "poor logical consistency" in adversarial testing scenarios. Corresponding technical features: This invention employs a dual-stream decoupling control mechanism in the generation module and introduces a physical consistency verification module (containing triple verification formulas for geometry, lighting, and artifacts) in the closed loop. ).

[0025] Performance Analysis: Images generated by existing technologies (such as pure pixel perturbation or unconstrained GANs) often exhibit lane line distortion, object suspension, or lighting conflicts, rendering test results invalid in the physical world. This invention, through strong geometric constraints and a physical scoring mechanism, ensures that the generated semantic adversarial examples (such as "heavy rain" and "backlighting") strictly preserve the road topology and perspective relationships of the source scene. This makes the perceptual failures detected in the test no longer algorithmic flaws in digital image processing, but rather system defects that may be induced by the real physical environment, thereby significantly improving test confidence.

[0026] 2. Improve the efficiency of shifting from "blind random generation" to "risk-oriented closed-loop search". Corresponding technical features: This invention constructs a complete feedback loop including a closed-loop adversarial evaluation module and a semantic parameter search module, and in particular, adopts a risk-weighted hybrid loss function ( ) and a Bayesian optimization strategy that incorporates Latin hypercube sampling (LHS) initialization.

[0027] Performance Analysis: Existing generative methods typically lack a feedback mechanism for the System Under Test (SUT), generating massive amounts of samples but failing to hit long-tail scenarios. This invention utilizes real-time perceptual feedback from the SUT (such as confidence decrease and missed detections) as a reward signal, enabling automatic and rapid convergence to the weakest link of the SUT. LHS initialization further solves the sample aggregation problem in the cold start phase, allowing the system to cover the boundary of the high-dimensional parameter space in a very small number of iterations, significantly reducing the time cost and computational consumption of autonomous driving safety verification.

[0028] 3. Improved the "semantic controllability" and "fault traceability" against attacks. Corresponding technical features: This invention employs parameterized semantic manipulation vectors ( As an attack vector, the optimization space is defined in the dimension of interpretable natural language description (such as rainfall, fog density, and light angle).

[0029] Performance Analysis: Compared to gradient-based pixel noise attacks (such as FGSM), the attack vectors generated by this invention can be directly translated into human-readable test reports (e.g., the system failed under the combined conditions of strong light and a wet road surface). This not only helps testers intuitively understand the system's boundaries but also provides clear physical guidance for subsequent model repair and data augmentation, achieving a closed loop of "identifying the problem - explaining the problem - solving the problem".

[0030] In this embodiment, the original driving scenario information and geometric conditions are acquired. In each round of the outer loop, the semantic manipulation vector of the current round is obtained and input into the generative model based on the original driving scenario information, geometric conditions, and the semantic manipulation vector of the current round to trigger the inner loop, thereby obtaining the generated adversarial scenario and the adversarial risk loss of the current round. The adversarial risk loss of the current round is used as a feedback signal, and the semantic manipulation vector is updated by searching in the parameter space according to the optimization strategy to increase the failure of the adversarial risk loss of the current round. The updated semantic manipulation vector is used to re-trigger the inner loop process, forming a closed-loop iteration until the termination condition is met, thus obtaining the adversarial scenario. This achieves the generation of semantic adversarial scenarios that have both high visual realism and physical rationality, and can accurately induce the perception or decision-making failure of the autonomous driving system, thereby achieving efficient and interpretable safety boundary detection. Attached Figure Description

[0031] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0032] Figure 1 This is a flowchart illustrating the first embodiment of the adversarial scenario generation method provided in this application; Figure 2 This is a schematic diagram of the overall process of an adversarial scenario generation method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the process of generating an adversarial scenario according to an embodiment of this application; Figure 4 This is a schematic diagram of the process for calculating the physical consistency score of the adversarial scenario generation method provided in an embodiment of this application; Figure 5This is a schematic diagram of the process for calculating adversarial risk loss in an adversarial scenario generation method provided in an embodiment of this application; Figure 6 This is a schematic diagram of the process of updating semantic manipulation vectors in an adversarial scenario generation method provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of the adversarial scenario generation device provided in the embodiments of this application; Figure 8 This is a schematic diagram of the structure of the terminal device provided in the embodiments of this application. Detailed Implementation

[0033] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0034] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0035] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0036] Figure 1 The diagram illustrates a flowchart of a first embodiment of the adversarial scenario generation method provided in this application. This is intended as an example and not a limitation. The method constructs and executes a two-layer nested loop architecture, which includes an inner loop and an outer loop, with the inner loop nested within each iteration of the outer loop. Figure 1 and Figure 2 As shown, the method may include: S10, Obtain original driving scenario information and geometric conditions ; The inner loop is an inner generation and verification loop; the outer loop is an outer parameter optimization loop. The original driving scenario information... The source scene image is a raw RGB image captured from a real road test or simulator, serving as the base for editing. Geometric conditions. This is a geometric condition map; a control signal that represents the 3D geometry of a scene, such as a depth map, canny map, or semantic segmentation map. It is used to lock the physical layout during the generation process; specifically, it refers to a 2D control signal map that represents the 3D spatial layout and object contours of a driving scene. During generation, it acts as a hard constraint to prevent the geometric positions of roads, vehicles, and buildings in the scene from shifting.

[0037] S20, in each round of the outer loop, obtain the semantic manipulation vector for the current round. ; and in the inner loop, based on the original driving scenario information Geometric conditions and the semantic manipulation vector of the current round Input a generative model, trigger an inner loop, and obtain the effective generative adversarial scenarios for the current round. ; Among them, semantic manipulation vectors This is a set of parameters that control the semantic attributes of the generated scene; it includes text prompt embedding vectors or style latent codes; specifically, it refers to a high-dimensional numerical vector that can be understood and mapped to image visual features by generative artificial intelligence models (such as CLIP Text Encoder). It does not directly correspond to image pixel values, but rather to high-level semantic attributes of the scene (such as weather type, lighting conditions, and road surface material); this vector is usually generated by the parameter search module based on the encoding of natural language prompt words.

[0038] Generate adversarial scenarios This refers to a synthesized image that, after being processed by a generative model, possesses specific semantic attack features (such as specific lighting and texture). The semantic manipulation vector for the current round. The semantic manipulation vector is updated by searching the parameter space according to the optimization strategy to increase the direction of the adversarial risk loss failure in the current round.

[0039] In semantic manipulation vectors Before performing round calculations, the semantic manipulation vectors are... Initialization is performed using Latin hypercube sampling (LHS) for semantic manipulation vectors. Initialization includes: Divide each dimension of the semantic parameter space into There are several equally probable intervals; Generate a random permutation sequence for each dimension and superimpose random jitter within the selected interval; Combine the sampled values ​​from each dimension and inversely normalize them to generate an initial sample set that covers the boundary of the parameter space.

[0040] As one implementation method, in the inner loop, based on the original driving scenario information... Geometric conditions and the semantic manipulation vector of the current round Input a generative model, trigger an inner loop, and obtain the effective generative adversarial scenarios for the current round. Specifically, it includes: A1, in the inner loop, based on the random seed of the current round and the original driving scenario information... Geometric conditions and semantic manipulation vectors Candidate generative adversarial scenarios are obtained. ; In the inner loop, raw driving scenario information is received from the database. ) and geometric conditions ( ), and semantic manipulation vectors from the search module ( Under strict physical constraints that maintain the road topology, traffic sign positions, and obstacle geometry, abstract semantic attack intentions (such as "strong backlighting" and "rainwater accumulation") are rendered into highly realistic visual images. This ensures that the generated test samples are no longer chaotic digital noise, but rather driving scenarios that conform to perspective rules and have clear physical meaning.

[0041] As one implementation method, such as Figure 3 As shown, based on the random seed of the current round and the original driving scenario information... Geometric conditions and semantic manipulation vectors Candidate generative adversarial scenarios are obtained. Specifically, it includes: B1 will store the original driving scenario information. Compressed into the latent space , will the potential space Noisy latent variables in generative models The generative model consists of a backbone UNet network and an auxiliary ControlNet network. The generative model adopts an architecture based on Latent Diffusion Models (LDM) combined with ControlNet.

[0042] Latent variable encoding: using a pre-trained VAE Encoder Source image (original driving scene information) Compressed into the latent space : ; B2 converts semantic manipulation vectors into semantic embeddings. ; Semantic embedding: manipulating semantic vectors (Typically a text prompt or a specific token sequence) via CLIP Text Encoder Convert to semantic embedding : ; B3, based on the original driving scenario information Spatial resolution, generating geometric conditions Spatial resolution ; Physical condition coding: Geometric structure diagram (generating geometric structure conditions) Maintain information consistent with the original driving scenario Same spatial resolution, used as input to ControlNet .

[0043] B4, based on semantic embedding Spatial resolution Noisy latent variables The new latent variables are obtained from the current round's random seed, UNet, and ControlNet. ; As one implementation, the random seed includes a sampling step number t, based on semantic embedding. Spatial resolution Noisy latent variables The new latent variables are obtained from the current round's random seed, UNet, and ControlNet. Specifically, it includes: C1, based on semantic embedding Spatial resolution Noisy latent variables Using the random seed of the current round, UNet, and ControlNet, we obtain the noisy latent variables at step t-1. ; As one implementation, the random seed also includes semantic guidance strength. and physical constraint strength The semantic embedding Spatial resolution Noisy latent variables Using the random seed of the current round, UNet, and ControlNet, we obtain the noisy latent variables at step t-1. Specifically, it includes: D1, semantic embedding Spatial resolution and noisy latent variables Input consists of physical constraint strength The model, composed of UNet and ControlNet, yields semantic prediction noise. ; The core of the diffusion process is training a denoising network. To predict added to latent variables Noise on the surface. This invention modifies the traditional denoising formula by introducing a physical control term. The parameters of the backbone UNet are defined as follows: The parameters of ControlNet are (Includes trainable copies and zero convolutional layers). In the... During step-by-step denoising, predict noise The calculation is as follows: ; in: For time steps Noisy latent variables.

[0044] This represents the number of sampling steps.

[0045] This is a semantic embedding.

[0046] This refers to spatial resolution.

[0047] UNet as the backbone based on semantics The extracted features are responsible for generating texture styles.

[0048] For ControlNet based on geometric conditions The extracted features are responsible for locking down the spatial structure.

[0049] This is a zero-convolution operation with initial weights of 0, which are gradually increased during training to ensure that the backbone network's generative ability is not compromised in the early stages of training.

[0050] This is the physical constraint strength coefficient (usually set to 1.0).

[0051] D2, spatial resolution and noisy latent variables Input a model consisting of a backbone UNet and a ControlNet, and obtain unconditional prediction noise. ; In the During step-by-step denoising, unconditionally predict noise. The calculation is as follows: ; in: For time steps Noisy latent variables.

[0052] This represents the number of sampling steps.

[0053] This is a semantic embedding.

[0054] This refers to spatial resolution.

[0055] UNet as the backbone based on semantics The extracted features are responsible for generating texture styles.

[0056] For ControlNet based on geometric conditions The extracted features are responsible for locking down the spatial structure.

[0057] This is a zero-convolution operation with initial weights of 0, which are gradually increased during training to ensure that the backbone network's generative ability is not compromised in the early stages of training.

[0058] This is the physical constraint strength coefficient (usually set to 1.0).

[0059] D3, based on semantic guidance strength Semantic prediction noise and unconditional prediction noise The noisy latent variables at step t-1 are obtained. .

[0060] To enhance the effectiveness of semantic attacks (e.g., forcibly generating "extremely strong glare"), a classifier is freely guided during the sampling phase: ; in It is a guiding standard. Time can be significantly enhanced The described characteristics (such as increased rain and fog concentration).

[0061] This is unconditional prediction noise. This is semantic prediction noise.

[0062] To ensure standardized inter-module calls, input and output strictly adhere to the following structure (JSON / Dict format illustration): Input data structure: JSON { "request_id": "UUID_v4_String", "source_latent": "Tensor[Batch, 4, 64, 64]", / / Latent variable corresponding to I_src "geometry_condition": "Tensor[Batch, 3, 512, 512]", / / M_geo, such as a Canny edge map "semantic_vector": "Tensor[Batch, 77, 768]", / / V_sem,CLIPEmbedding "generation_params": { "steps": 50, / / Number of sampling steps "guidance_scale": 7.5, / / Semantic guidance strength s "control_strength": 1.0 / / Physical constraint strength lambda } } Output data structure: JSON { "request_id": "UUID_v4_String", "generated_image": "Tensor[Batch, 3, 512, 512]", / / I_gen, normalized to [-1, 1] "status_code": 200, / / 200: Success, 500: Failure "metadata": { "inference_time_ms": 150 } } C2, based on semantic embedding Spatial resolution Noisy latent variables at step t-1 Using the random seed of the current round, UNet, and ControlNet, we obtain the noisy latent variables in step t-2. ; C3, until based on semantic embedding Spatial resolution Noisy latent variables in step 1 The new latent variables are obtained from the current round's random seed, UNet, and ControlNet. .

[0063] B5, regarding new latent variables Decode the candidate generative adversarial scenarios to obtain them. .

[0064] This application proposes a generative architecture of "geometry-semantic decoupling". It utilizes a control network to independently encode geometric structure information. The semantic manipulation vector is encoded using the cross-attention mechanism of the backbone diffusion network (UNet). It solves the problems of "lane line distortion" and "object drift" that are easily caused by existing GAN or style transfer techniques, which disrupt physical consistency.

[0065] Unlike traditional pixel-level editing, this application performs controlled denoising within a compressed latent space and forcibly injects physical constraints into each feature map layer through zero convolutional layers, achieving semantic redrawing with pixel-level alignment accuracy.

[0066] A zero-convolutional layer specifically refers to a special type of neural network convolutional layer where the weight parameters and biases are initialized to zero. In the physically constrained generative editing module, it is used to connect the control network (ControlNet) to the backbone network, ensuring that during the initial stages of training or fine-tuning, additional physical control signals do not introduce harmful noise into the backbone network, thereby preserving the generative capability of the pre-trained model.

[0067] As one implementation method, for new latent variables Decode the candidate generative adversarial scenarios to obtain them. After that, including: Calculate candidate generative adversarial scenarios pixel variance If pixel variance (Pixel variance threshold, for example, 0.01), determines whether a solid color or black screen image has been generated.

[0068] As one implementation method, for new latent variables Decode the candidate generative adversarial scenarios to obtain them. After that, including: If input geometric structure conditions A matrix consisting entirely of zeros or empty. Automatically invokes built-in lightweight edge detection operators (such as Sobel) from... Real-time extraction of coarse edges as temporary parameters To ensure the generation process is not interrupted, the sample is marked as a "weakly physically constrained sample".

[0069] To ensure the continuity of automated testing, this module has the following built-in exception handling mechanisms: (1) Generate collapse detection: Detection: Calculation output pixel variance .

[0070] Response: If (A threshold, e.g., 0.01), determines whether a solid color or black screen image has been generated. The system will automatically reset the random seed and fine-tune the guidance_scale (decreasing it by 0.5) before retrying. If it fails 3 times consecutively, it returns status_code: 500 (error code) and error message.

[0071] (2) Geometric conditions are missing: Detection: If input It is either a zero matrix or an empty matrix.

[0072] Response: Automatically invokes built-in lightweight edge detection operators (such as Sobel) from Real-time extraction of coarse edges as temporary parameters To ensure the generation process is not interrupted, the sample is marked as a "weakly physically constrained sample".

[0073] A2, adversarial scenario for candidate generation Perform a reasonableness check; As one implementation method, the adversarial scenario of candidate generation Perform a reasonableness check, specifically including: E1, based on candidate generative adversarial scenarios and geometric conditions Physical consistency score obtained ; As one implementation method, as shown in 4, based on the generated adversarial scenario Physical consistency score obtained Specifically, it includes: Ensure the generated image No change to the source scene The three-dimensional layout.

[0074] F1, utilizing a lightweight monocular depth estimation network to extract candidate generative adversarial scenarios. Depth map ; Among them, the lightweight monocular depth estimation network can be MiDaS-Small.

[0075] F2, for depth map and geometric conditions Perform normalization and calculate the normalized depth map. With geometric conditions The geometric loss is obtained by analyzing the pixel-level mean square error between the two pixels. ; As one implementation method, for depth maps and geometric conditions Perform normalization and calculate the normalized depth map. With geometric conditions The geometric loss is obtained by analyzing the pixel-level mean square error between the two pixels. Specifically, it includes: ; in, Geometric loss; For geometric structure conditions; To perform a normalization operation on histogram matching, eliminate absolute scale differences, and focus only on relative depth relationships; This is a depth map.

[0076] F3, based on candidate generative adversarial scenarios Light loss and artifact loss ; As one implementation method, based on candidate generative adversarial scenarios Light loss and artifact loss Specifically, it includes: G1 will select candidate generative adversarial scenarios. Divided into A grid area with specific rules; G2, for each grid region, uses an illumination estimation algorithm to estimate the main illumination direction vector corresponding to the grid region. ; Among them, illumination estimation algorithms are usually based on gradient or shading recovery shape principles.

[0077] G3 calculates the principal illumination direction vector for all grid regions. average direction ; G4, based on the main illumination direction vector and average direction Light loss ; Check whether the lighting logic is consistent across the detection scene.

[0078] Divide the image into For each of the 10 grid cells, estimate the principal illumination direction vector. Calculate the angular variance of the vector field: ; If the variance is too large, it indicates that there are contradictory light sources or shadows in the scene.

[0079] G5, for generating adversarial scenarios Perform a Fast Fourier Transform to convert it from the spatial domain to the frequency domain, and obtain the spectral energy distribution. ; G6, based on spectral energy distribution To obtain artifact loss ; That is, the distribution of spectral energy By comparing the artifact loss with the pre-statistically calculated average spectral patterns of natural images, the artifact loss can be obtained. .

[0080] Generative models are often accompanied by high-frequency noise or checkerboard artifacts. Perform a Fast Fourier Transform (FFT) to analyze the energy distribution anomalies of high-frequency components:

[0081] in It is the statistical regularity of the average spectrum of natural images.

[0082] F4, based on geometric loss Light loss and artifact loss Physical consistency score obtained .

[0083] Among them, physical consistency score This is a quantitative metric used to evaluate whether the lighting direction and shadow logic of a generated image conform to physical laws. Specifically, it refers to a normalized scalar metric (range [0,1]) calculated using a weighted aggregation algorithm to quantify whether the generated image conforms to real-world physical laws. Its calculation integrates losses from three dimensions: geometric structure differences (based on depth estimation), lighting logic conflicts (based on shadow analysis), and frequency domain artifacts (based on spectral analysis). If this score is lower than a preset threshold, the generated image will be judged as an invalid sample.

[0084] As one implementation method, based on geometric loss Light loss and artifact loss Physical consistency score obtained Specifically, it includes: ; It employs a "benchmark deduction" logic, similar to an exam scoring mechanism: Baseline (1): Assume that the generated image was originally perfect (100% physical realism).

[0085] Penalty items ( ): Every physical defect in the image (structural distortion, lighting conflict, digital artifacts) will cause the score to drop.

[0086] Truncation function ( ): Ensure final score Negative values ​​will not occur; they are strictly limited to... Within the range, it is convenient to subsequently set standardized thresholds (such as...). Although the weighted sum of all losses is less than 1 under normal generation conditions, the cutoff function is set to ensure the numerical stability of the score under extreme anomalies.

[0087] in, (Geometric Loss) -- "Has the structure deformed?" Physical meaning: Measures the deviation of the generated image from the original scene's 3D structure. For example, are the lane lines curved? Are the roadside trees shifted? Weight (Usually set to the highest value, such as 0.5): As the most critical indicator, if the geometry changes (e.g., a straight road becomes a curve), the original ground truth (GT) will become invalid, resulting in invalid test results. Therefore, it has the largest penalty weight.

[0088] (Loss of illumination consistency) -- "Does the shadow give it away?" Physical meaning: This measures the consistency of the lighting logic in a scene. For example, if the shadow of a car on the left is cast to the right, while the shadow of a car on the right is cast to the left, or if there are two suns in the sky, the loss value will increase sharply.

[0089] Weight (Usually moderate, such as 0.3): Although lighting errors severely affect visual realism, they are sometimes less fatal to object detection algorithms (SUTs) than geometric deformations, so they are given a secondary weight.

[0090] (Artifact Loss) -- "Is the image messy?" Physical meaning: Measures anomalies in the frequency domain of an image. Generative models are prone to producing high-frequency "checkerboard effects" or unexplained noise, which do not exist in nature.

[0091] Weight (Usually the lowest, such as 0.2): Slight noise is similar to the light sensor noise of a camera. The SUT usually has a certain degree of robustness, so it is given a small deduction weight.

[0092] Suppose the system generates an image of a "rainy intersection": Situation A: The road structure is intact. ), but the shadows are a bit messy ( The image has some noise. ).

[0093] ; result: (Threshold), passed.

[0094] Scenario B: The generator drew the straight lanes crookedly. Although the lighting and image quality are acceptable.

[0095]

[0096] Result: Failure, triggering resampling.

[0097] The formula uses a weighted summation method to map three different dimensions of physical defects (structure, logic, and texture) into a single scalar score, thereby achieving quantitative and automated control over the quality of generated samples.

[0098] Input data structure: JSON { "request_id": "UUID_String", "generated_image": "Tensor[1, 3, 512, 512]", / / I_gen "geometry_ref": "Tensor[1, 1, 512, 512]", / / M_geo (Depth) "config": { "threshold": 0.8, "weights": [0.5, 0.3, 0.2] / / λ1, λ2, λ3 } } Output data structure: JSON { "request_id": "UUID_String", "is_valid": true, / / Pass / Fail flag "physical_score": 0.85, / / S_phys "breakdown": { "geo_error": 0.05, "light_variance": 0.02, "artifact_score": 0.08 } } When generating a "night" scene, the overall pixel value of the image is extremely low, causing the illumination direction estimator to fail and generating a large amount of random error. .

[0099] The module first calculates the average brightness of the image. .like Automatically lower weight Instead of reducing the weight to 0, the weight of frequency domain artifact detection is increased to avoid mistakenly deleting legitimate night scene images.

[0100] The images continuously generated by the generation module consistently failed the physical verification. When the threshold remains low, the following steps are taken: Set a "maximum retry counter" (e.g., Max Retries = 5). If the test fails after reaching the maximum limit, the module will force a reduction in the verification threshold. (Downgrade passed), but the reliability:low flag is marked in the output metadata to inform the subsequent evaluation module to reduce the weight of this sample on parameter updates.

[0101] E2, if the physical consistency score If the value is greater than or equal to the preset threshold, the verification passes. like If the value is 0.8 (e.g., 0.8), then it is considered qualified and the verification is passed.

[0102] E3, if the physical consistency score If the value is less than the preset threshold, the verification will fail.

[0103] like If the value is 0.8 (e.g., 0.8), then it is considered qualified and the verification is passed.

[0104] A3. If the verification fails, update the random seed and base the analysis on the updated random seed and the original driving scenario information. Geometric conditions and semantic manipulation vectors Update and generate adversarial scenarios ; A4, until the verification passes, and the valid generated adversarial scenario for the current round is obtained. .

[0105] Among them, combating risk and loss The higher the value, the more successful the attack (the more severe the SUT failure).

[0106] S30, in the outer loop, based on the original driving scenario information Generative adversarial scenarios that have passed testing And the tested autonomous driving system, to obtain the adversarial risk loss for the current round. and the risk of losses in the current round of confrontation. As a feedback signal, the optimization strategy searches the parameter space to minimize the risk of loss in the current round. The direction of failure increases, and the semantic manipulation vector is updated. ; As one implementation method, such as Figure 5 As shown, the step of basing information on the original driving scenario... Generative adversarial scenarios that have passed testing And the tested autonomous driving system, to obtain the adversarial risk loss for the current round. Specifically, it includes: H1, based on the original driving scenario information The relative distance to the target vehicle is obtained. Collision time with the target vehicle Based on the relative distance to the target vehicle Collision time with the target vehicle The target vehicle risk weight is obtained. ; Among them, the relative distance of the target vehicle Collision time with the target vehicle All are original driving scenario information Pre-labeled information; For each real target in the scene (Depend on Provided), based on its relative distance to the vehicle. and collision time ( Calculate risk weights :

[0107] in: : To prevent small quantities with a denominator of zero.

[0108] : Indicator function that triggers an additional high penalty when TTC is less than a threshold (e.g., 3 seconds).

[0109] Weighting adjustment coefficient.

[0110] H2 will generate adversarial scenarios effectively in the current round. Input the autonomous driving system under test and obtain the test results. The detection results include the target confidence level; based on the original driving scenario information. annotation information in According to the test results and labeling information The target perception failure component is obtained. ; Test results Generative adversarial scenarios that pass the physical consistency check. The system is injected into the autonomous driving system under test (SUT); the perception model (such as an object detection network) inside the autonomous driving system under test performs tests on the generative adversarial scenarios that pass the verification. Perform forward inference; the autonomous driving system under test outputs the detection result, i.e., the predicted bounding box (detection result). .

[0111] Label information (truth box) Information derived from the original driving scenario The annotation information is pre-completed during the data acquisition or simulation generation phase; due to physical constraints, the generative editing module strictly maintains the geometric structure (through geometric structure conditions). (Locking spatial layout), therefore the original driving scenario information The position of the truth box for each target in the middle. Can be directly inherited by candidate generative adversarial scenarios The truth box contains the target category, bounding box coordinates, distance information, etc.

[0112] Compare the predicted bounding boxes output by SUT With truth box Calculate the sensing failure component of a single target:

[0113] in: Intersection over Union (IoU). The lower the IoU (the greater the positional deviation), the greater the loss.

[0114] SUT's confidence score for the target.

[0115] Safety confidence threshold (e.g., 0.5). If the SUT confidence decreases, the loss increases.

[0116] H3, based on the target-perceived failure component Risk weighting of target vehicle To obtain the risk loss of the current round of confrontation. .

[0117] Combating risk and loss The loss function value characterizes the success rate of an attack. A larger value indicates a more severe failure of the System Under Test (SUT) (e.g., high false negative rate, large trajectory deviation). Specifically, it refers to a computational metric that measures the degree of failure of the SUT under adversarial attacks. It does not simply calculate the average accuracy (mAP) of target detection, but rather assigns different weights based on the distance between the target and the vehicle, and the time to collision (TTC). It imposes an exponential penalty on false negatives or false positives of high-risk targets at close range, thereby guiding the attack strategy to prioritize exposing security-critical vulnerabilities.

[0118] Aggregate the losses of all targets by combining risk weights:

[0119] in: Total number of targets in the scene.

[0120] Target number of completely missed detections (IoU=0).

[0121] : False negative penalty coefficient (maximum value), ensuring that induced false negatives are the highest priority attack targets.

[0122] In the generated This may include data anomalies that could cause the underlying SUT to crash, or when the SUT service is offline. Set a timeout (e.g., 500ms). If a timeout occurs, mark it as such. (Invalid test), and record "SUT CrashRisk" in the system log. This may be a very high-value attack (denial-of-service attack), but it should be skipped in the optimization loop to prevent gradient explosion, and stored separately in the "crash test case library".

[0123] because When a drastic visual change (such as complete black) causes the SUT to output an empty list, then... Will because It surges and becomes a maximum value. This is as expected, but for numerical stability, [the following is missing from the original text]. Truncate the value and limit the maximum value to 0. This is to prevent subsequent optimization modules from oscillating.

[0124] Input data structure: JSON { "request_id": "UUID_String", / / Same as the generated module ID "generated_image": "Tensor[1, 3, H, W]", / / I_gen "ground_truth": { "objects": [ { "class_id": 1, / / Vehicle "bbox": [x1, y1, x2, y2], / / 2D truth box "distance_m": 15.5 / / Distance }, ... ] }, "sut_config": { "mode": "black_box", / / or white_box "confidence_threshold": 0.5 } } Output data structure: JSON { "request_id": "UUID_String", "sut_response": { "detected_boxes": [[x1, y1, x2, y2, score], ...], "processing_time_ms": 35 }, "adversarial_loss": 2.85, / / L_adv (scalar) "failure_details": { "miss_rate": 0.2, "critical_object_iou": 0.15 / / Critical target is severely off-target. } } Generative adversarial scenarios that have passed physical consistency verification This is injected into the system under test (SUT) and the perception or decision response of the SUT is obtained in real time. This module compares... With the ground truth of the scene ( ), calculate the adversarial risk loss that comprehensively characterizes the degree of SUT failure ( This loss value not only reflects the false negative rate of a single target, but also incorporates the importance of the target to driving safety through a weighted mechanism (e.g., the weight of nearby vehicles is higher than that of distant background), providing an accurate optimization gradient for subsequent semantic parameter search.

[0125] Unlike traditional offline evaluations that only focus on mean accuracy (mAP), this application designs an asymmetric loss function that focuses on "security boundary breaches." An exponential penalty is applied to target detection deviations in high-risk areas (such as ahead of the vehicle's trajectory), thereby guiding the generator to prioritize attacking areas posing the greatest security threat.

[0126] This application designs a universal interface adaptation layer. For white-box SUTs, the intermediate layer feature map can be directly extracted to calculate the feature offset loss; for black-box SUTs (common business models), the end-to-end behavior loss is calculated based on the output post-processing results (such as trajectory points), ensuring the system's universality for different tested objects.

[0127] As one implementation method, such as Figure 6 As shown, the risk of loss in the current round of confrontation. As a feedback signal, the optimization strategy searches the parameter space to minimize the risk of loss in the current round. The direction of failure increases, and the semantic manipulation vector is updated. Specifically, it includes: J1 generates adversarial scenarios based on the current round. This yields a low-dimensional interpretable semantic space; The attack problem is reduced from a high-dimensional image space to a low-dimensional interpretable semantic space.

[0128] Define a low-dimensional semantic parameter space .

[0129] ; Each component is normalized to . Rainfall intensity; Fog concentration; Lighting angle.

[0130] This makes the optimization problem interpretable and searchable, rather than blindly perturbing the 768-dimensional embedding space of CLIP.

[0131] J2, based on historical observation sets, low-dimensional interpretable semantic space, and adversarial risk loss in the current round. Construct a proxy model and obtain the prediction mean of the proxy model. and prediction variance ; Assuming parameters and the loss of combat The relationship between them follows a function Use a Gaussian process (GP) to approximate .

[0132] Gaussian process GP will be based on historical test results ( , (This gives the predicted mean of the failure level under this semantic condition.) Give the variance of the uncertainty of the prediction. : Given a set of historical observations GP predicts any new point The posterior distribution is a normal distribution:

[0133] in It is the predicted mean (the possible failure level of the SUT). It is the prediction variance (uncertainty).

[0134] To optimize gradient / update amount, used based on Calculated for The direction of the adjustment will be used for the next iteration; Optimize gradient Essentially, it is based on historical observation sets ( The "optimal parameter update amount" is derived from this.

[0135] In autonomous driving adversarial testing, obtain updated directions. A significant challenge is that the entire chain, from "generating images from semantic vectors" to "outputting results from the autonomous driving system (SUT)," is often non-differentiable.

[0136] Gradient-free update based on historical observation set (primary option, for black-box SUT) The Bayesian optimization (BO) algorithm in the "semantic parameter search module" does not actually perform backpropagation differentiation in the traditional sense, but rather... Defined as the optimal transition vector (update value) in the parameter space, its calculation depends entirely on the historical observation set. The specific calculation steps are as follows: Historical experience review: Extracting historical observation sets in These are low-dimensional semantic parameters (such as rainfall and fog concentration). This is to mitigate the corresponding risk of loss.

[0137] Fitting the surrogate model: Using a Gaussian process (GP) to fit these historical data, the mean surface of the objective function is obtained. and uncertainty Calculate the target transition point: By maximizing the acquisition function (such as UCB), find the next point that theoretically maximizes the loss. .

[0138]

[0139] Mapped to update quantity At this point, the actual direction of parameter adjustment (update amount) is mathematically represented as the difference between the current point and the target point:

[0140] Then, the system uses the prompt word template engine and CLIP Text Encoder to generate text with new parameters. The text is mapped to a new high-dimensional vector. Therefore, here It is a discrete update step size inferred probabilistically from historical data.

[0141] J3 uses the Upper Confidence Bound (UCB) acquisition function to predict the mean. and prediction variance Process the data to obtain the next most valuable selection test parameters. ; In order to select the next most valuable test parameter This patent uses a maximum upper confidence bound (UCB) acquisition function:

[0142] in It is a hyperparameter that adjusts the weights of exploration and utilization. The larger the value, the more the system tends to try extreme weather combinations that have never been tested before.

[0143] J4, depending on the selected test parameters Update semantic manipulation vector .

[0144] Selected parameters Map back to the natural language Prompt, then convert it into a vector. .

[0145] Define the template as: ; ; ; Final calculation: ; Input data structure: JSON { "request_id": "UUID_String", "last_loss": 2.85, / / L_adv, feedback from the previous round "iteration_count": 12, / / Current iteration round "optimization_config": { "kappa": 2.5, / / Exploration coefficient "bounds": {"rain": [0,1], "fog": [0,1]} } } Input data structure: JSON { "request_id": "UUID_String", / / new ID "next_parameters": {"rain": 0.9, "fog": 0.2}, / / x_{t+1} "generated_prompt": "A driving scene with heavy rain and slight fog", "semantic_vector": "Tensor[1, 77, 768]", / / V_sem "status": "continue" / / or "converged" } In continuous Parameters generated by round iteration The changes are minimal, and When no further improvements are made, a "random restart" mechanism is triggered. This forces a restart within the parameter space. A new random uniform sampling As input for the next round, and temporarily increased The value is used to forcibly break out of the current local extreme point.

[0146] When the generated complex descriptive terms exceed the maximum token limit of the CLIP model (usually 77 tokens), a built-in "template reducer" is activated. If token overflow is detected, core object words (such as "Road", "Car") and intensity modifiers ("Heavy", "Dark") at the beginning of the template are retained first, while decorative long and complex sentences at the end are automatically discarded.

[0147] Historical datasets at system startup If the value is empty, GP cannot fit. Initialization can be performed using Latin Hypercube Sampling (LHS). Before entering the BO loop, generate 5-10 initial samples covering the parameter space boundaries for warm-up testing.

[0148] The specific method for LHS is as follows: a. Introduction In the early stages of adversarial parameter search using Bayesian optimization (BO), a lack of historical observation data ( Gaussian process (GP) models cannot establish effective mean and variance predictions. If pure random sampling is used, samples are prone to clustering in some areas and sparse in peripheral areas, leading to a bias in the initial model's understanding of the global space.

[0149] This application employs Latin hypercube sampling (LHS), which, through a hierarchical probability strategy, forces a uniform distribution of sampling points across each dimension of the semantic parameter space, thereby minimizing the sample size. This achieves maximum coverage of the parameter space.

[0150] b. LHS Sampling Core Algorithm Steps Assume the semantic parameter space is Dimensions (e.g.) (Rainfall, fog concentration, and angle of illumination) need to be generated. Initial samples (e.g.) ).

[0151] The specific sampling steps are as follows: Step 1: Defining Dimensions and Layering Intervals For the parameter space Dimensions ( Its value range is The range is divided into There are three equally probable, non-overlapping intervals. intervals ( The range of ) is defined as:

[0152] Note: Here, first... The operation is performed in a standard normalized space, and finally mapped back to the actual physical scope.

[0153] Step 2: Generating Orthogonal Arrangements To ensure orthogonality in multidimensional space (i.e., each row and each column has only one sample in each small interval), it is necessary to define orthogonality for each dimension. Generate a arrive random permutation sequence .

[0154]

[0155] For example, if The arrangement of dimension 1 may be The permutation of dimension 2 may be This means that the first sample takes the value of the third interval in dimension 1 and the value of the second interval in dimension 2.

[0156] Step 3: Random jitter within the interval To avoid the value being fixed at the center of the interval, a random offset is added within each selected interval. This generates a... random matrix Each element

[0157] Step 4: Sample coordinate calculation and inverse normalization Calculate the i-th based on the permutation index and random jitter. The sample at the th Normalized coordinates in each dimension :

[0158] Finally, Mapping back to the true physical semantic parameter range The final initial sample is obtained. :

[0159] c. Explanation This method is encapsulated in the initialization subunit of the "semantic parameter search module".

[0160] Triggering condition: System startup, detection of historical database Empty.

[0161] Execution: The CPU executes steps 1-4 above in parallel to generate a file containing... List of vectors .

[0162] Output: The system will sequentially output these... Each vector is fed into the "Physical Constraint Generative Editing Module," and the corresponding vectors are directly collected without Bayesian optimization updates. .

[0163] Results: Constructing the initial dataset This is used for the first fitting of the Gaussian process model.

[0164] As one implementation method, the current round of risk-rewarded losses. As a feedback signal, the optimization strategy searches the parameter space to minimize the risk of loss in the current round. The direction of failure increases, and the semantic manipulation vector is updated. Specifically, it includes: H1, based on the risk of loss in the current round of confrontation. The autonomous driving system under test in the current round The semantic manipulation vector of the current round And the effective generation of adversarial scenarios in the current round To obtain the optimization gradient for the current round ; In autonomous driving adversarial testing, obtain updated directions. A significant challenge is that the entire chain, from "generating images from semantic vectors" to "outputting results from the autonomous driving system (SUT)," is often non-differentiable.

[0165] If both the autonomous driving system under test (SUT) and the diffusion model are white-box and fully differentiable (e.g., in the early joint training phase of the model). This degenerates into the true mathematical gradient (analytic gradient) in traditional deep learning. In this case, its calculation does not rely on long-term historical observation sets, but rather on the data from the current round, using the chain rule to directly calculate the partial derivative of the loss function with respect to the input semantic vector:

[0166] H2, based on the optimization gradient of the current round. and the semantic manipulation vector of the current round Update the semantic manipulation vector.

[0167] The system updates the semantic vector directly using the gradient ascent method:

[0168] in This is the learning rate.

[0169] H1, based on historical risk of loss. Historical test autonomous driving systems Historical semantic manipulation vector And the effective generation of adversarial scenarios in the current round Update semantic manipulation vector 40, with the updated semantic manipulation vector The inner loop is retried to form a closed loop iteration until the termination condition is met, and the final high-risk confrontation scenario is output.

[0170] The termination condition has three specific scenarios; termination occurs if any one of the following conditions is met: 1. Risk threshold trigger (goal achieved): Risk loss in the current round of confrontation ( () is greater than or equal to the preset attack success threshold.

[0171] 2. Algorithm convergence (performance bottleneck): The semantic parameter search algorithm of the outer loop (such as Bayesian optimization) fails to converge in continuous loops. In rounds of iteration, combating risk and loss ( The improvement is less than the preset convergence minimum (set by the user).

[0172] 3. Resource boundary constraints (computing power limit): The number of iterations of the outer loop has reached the preset maximum number of iterations (e.g., 50 times).

[0173] The output "final high-risk confrontation scenario" is actually a data packet containing multi-dimensional context parameters, specifically including parameter sets in the following four dimensions: 1. Visual representation data. This is the most direct output, which is the final image that deceives the autonomous driving system.

[0174] Generate adversarial scenarios ( : A high-quality RGB image (or a sequence of multiple frames) after physical verification through an inner loop is the physical carrier injected into the SUT.

[0175] Physical consistency score ( (and scores for each component): including scores for geometric structure, lighting, etc., used to prove to testers that "this is a valid test image that conforms to the laws of real physics, not a useless image."

[0176] 2. Semantic control parameters The core of this invention (distinguished from pure pixel noise) tells researchers "what caused the failure".

[0177] Semantic manipulation vectors ( ): The latent variable vector in the last round that leads to the system reaching its maximum loss.

[0178] Interpretable physical property values: High-dimensional... The reverse mapping is used to represent concrete parameters that are readable by humans. For example: Weather parameters: Rain_Intensity = 0.85 (heavy rain), Fog_Density = 0.2 (light fog) Lighting parameters: Sun_Elevation = 15 (low sun altitude angle / backlight), Light_Intensity = 0.9 (strong glare) The final generated prompt words are, for example, "driving scenario with heavy rain and strong glare".

[0179] 3. Benchmark and Constraint Data Used to provide a benchmark for comparison, proving that the system's geometric space has not been violated.

[0180] Source scene image ( ): The original base image before editing.

[0181] Geometric structure condition diagram ( ): Depth map or edge map.

[0182] Scene ground truth: The 3D / 2D bounding box coordinates and distance truth values ​​of targets such as vehicles and pedestrians contained in the scene.

[0183] 4. Hazard source tracing and response data The evaluation results documented the specific manifestations of the attack on the autonomous driving system (SUT).

[0184] Ultimately, combating risk and loss ( ): Quantify the overall risk level of the scenario (e.g.) ).

[0185] The response of the system under test ( ): The actual output of SUT when facing this high-risk scenario. For example: Perception recognition box: [x,y, w, h, confidence=0.2] (extremely low confidence); Missed target list: Key target IDs that the system failed to identify (such as "Missed pedestrian 15 meters directly in front").

[0186] This application adopts the Bayesian Optimization (BO) framework, which is very suitable for scenarios where the objective function computation is expensive (requiring rendering + SUT inference) and there is no gradient (Black-box SUT).

[0187] By receiving feedback signals from the closed-loop adversarial assessment module -- adversarial risk loss ( Using black-box optimization algorithms (such as Bayesian optimization) or gradient ascent strategies, we search for the parameter combination that maximizes the failure probability of the SUT in a multidimensional semantic space. The abstract optimization objective can be transformed into a concrete semantic manipulation vector. This determines whether the next round of testing will "increase the rainfall" or "decrease the lighting angle," thereby driving the physical constraint generative editing module to produce more aggressive scenarios.

[0188] Instead of blindly searching in the high-dimensional text embedding space, this application constructs a structured "semantic parameter space" (e.g., ...). This dimensionality reduction mapping mechanism effectively bridges continuous optimization problems with discrete natural language descriptions, ensuring the interpretability of the search direction.

[0189] A dynamic balance strategy for exploration and utilization: Addressing the non-convex nature of the SUT failure boundary, the module incorporates a Gaussian process as a surrogate model. It not only focuses on currently known high-risk areas but also proactively explores unknown and highly uncertain semantic combinations, thereby efficiently uncovering "long-tail effects" that are difficult for human experts to predict.

[0190] In summary, this application obtains the original driving scene information and geometric conditions; in each round of the outer loop, it acquires the semantic manipulation vector of the current round, and inputs it into the generative model based on the original driving scene information, geometric conditions, and the semantic manipulation vector of the current round to trigger the inner loop, thereby obtaining the generated adversarial scene and the adversarial risk loss of the current round; using the adversarial risk loss of the current round as a feedback signal, it searches in the parameter space according to the optimization strategy to increase the direction of the adversarial risk loss of the current round to update the semantic manipulation vector; the updated semantic manipulation vector is used to re-trigger the inner loop process, forming a closed-loop iteration until the termination condition is met, thus obtaining the adversarial scene. This achieves the generation of semantic adversarial scenes that possess both high visual realism and physical plausibility, and can accurately induce perception or decision-making failures in the autonomous driving system, thereby realizing efficient and interpretable safety boundary detection.

[0191] For those consistent with the above, please refer to Figure 7 , Figure 7 This application provides a schematic diagram of the structure of an adversarial scene generation device. It is used to construct and execute a two-layer nested loop architecture, which includes an inner loop and an outer loop, with the inner loop nested within each iteration of the outer loop; as shown... Figure 7 As shown, the adversarial scenario generation device includes: The data acquisition module 701 is used to acquire the original driving scene information and geometric structure conditions; The inner loop module 702 is used to obtain the semantic manipulation vector of the current round in each round of the outer loop; and in the inner loop, input the original driving scene information, geometric structure conditions and the semantic manipulation vector of the current round into the generative model to obtain the effective generative adversarial scene of the current round. The outer loop module 703 is used to obtain the adversarial risk loss of the current round based on the original driving scenario information, the effective adversarial scenario of the current round and the autonomous driving system under test, and use the adversarial risk loss of the current round as a feedback signal to search in the parameter space according to the optimization strategy to increase the direction of the adversarial risk loss of the current round and update the semantic manipulation vector. The adversarial scenario output module 704 is used to re-trigger the next round of the inner loop with the updated semantic manipulation vector, forming a closed loop iteration until the termination condition is met, and outputting the final high-risk adversarial scenario.

[0192] like Figure 8 As shown, this application embodiment also provides a terminal device 2, which includes: at least one processor 20, a memory 21, and a computer program 22 stored in the memory 21 and executable on the at least one processor. The processor 20 and the memory 21 are connected. When the processor 20 executes the computer program 22, it implements the steps in the robot motion planning method embodiment.

[0193] This application also provides a computer storage medium storing a computer program for electronic data interchange, which causes a computer to perform some or all of the steps of any of the adversarial scenario generation methods described in the above method embodiments.

[0194] This application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program that causes a computer to perform some or all of the steps of any of the adversarial scenario generation methods described in the above method embodiments.

[0195] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable storage medium can include at least: any entity or device capable of carrying computer program code to a device / terminal equipment, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable storage media cannot be electrical carrier signals or telecommunication signals.

[0196] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0197] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0198] In the embodiments provided in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0199] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

Claims

1. A method for generating adversarial scenarios, characterized in that, The method constructs and executes a two-level nested loop architecture, which includes an inner loop and an outer loop, wherein the inner loop is nested within each iteration of the outer loop; the method includes: Acquire the original driving scene information and geometric conditions; In each round of the outer loop, the semantic manipulation vector of the current round is obtained; and in the inner loop, the generative model is input based on the original driving scenario information, geometric conditions and the semantic manipulation vector of the current round to obtain the effective generative adversarial scenario of the current round. In the outer loop, based on the original driving scenario information, the effective generated adversarial scenario of the current round, and the tested autonomous driving system, the adversarial risk loss of the current round is obtained, and the adversarial risk loss of the current round is used as a feedback signal. According to the optimization strategy, the semantic manipulation vector is updated by searching in the parameter space for the direction that increases the failure of the adversarial risk loss of the current round. The updated semantic manipulation vector is used to re-trigger the next round of the inner loop, forming a closed loop iteration until the termination condition is met, and the final high-risk adversarial scenario is output.

2. The adversarial scene generation method according to claim 1, characterized in that, In the inner loop, based on the original driving scenario information, geometric conditions, and the semantic manipulation vector of the current round, the generative model is input to obtain the effective generative adversarial scenario for the current round, including: In the inner loop, candidate generative adversarial scenarios are obtained based on the random seed of the current round, the original driving scenario information, the geometric structure conditions, and the semantic manipulation vector. Perform a rationality check on the candidate generation adversarial scenarios; If the test fails, the random seed is updated, and the adversarial scenario is updated and generated based on the updated random seed, the original driving scenario information, the geometric structure conditions, and the semantic manipulation vector. The process continues until the test is passed, at which point a valid generated adversarial scenario for the current round is obtained.

3. The adversarial scene generation method according to claim 2, characterized in that, The process of obtaining candidate generative adversarial scenarios based on the random seed of the current round, original driving scene information, geometric structure conditions, and semantic manipulation vectors includes: The original driving scene information is compressed into the latent space, and the latent space is used as a noisy latent variable in the generative model; Convert semantic manipulation vectors into semantic embeddings; Based on the spatial resolution of the original driving scene information, generate the spatial resolution of the geometric structure conditions. New latent variables are obtained based on semantic embedding, spatial resolution, noisy latent variables, random seed of the current round, UNet, and ControlNet; The new latent variables are decoded to obtain candidate generative adversarial scenarios.

4. The adversarial scene generation method according to claim 3, characterized in that, The random seed includes the sampling step number t. The new latent variables obtained based on semantic embedding, spatial resolution, noisy latent variables, the random seed of the current round, UNet, and ControlNet include: Based on semantic embedding, spatial resolution, noisy latent variables, the random seed of the current round, UNet, and ControlNet, the noisy latent variables of step t-1 are obtained; Based on semantic embedding, spatial resolution, noisy latent variables in step t-1, random seed of the current round, UNet, and ControlNet, the noisy latent variables in step t-2 are obtained. The process continues until new latent variables are obtained based on semantic embedding, spatial resolution, the noisy latent variables from step 1, the random seed of the current round, UNet, and ControlNet.

5. The adversarial scene generation method according to claim 4, characterized in that, The random seed also includes semantic guidance strength and physical constraint strength. The noisy latent variables obtained in step t-1, based on semantic embedding, spatial resolution, noisy latent variables, the random seed of the current round, UNet, and ControlNet, include: The semantic embedding, spatial resolution, and noisy latent variables are input into a model composed of physical constraint strength, UNet, and ControlNet to obtain semantic prediction noise. By inputting the spatial resolution and noisy latent variables into the model composed of the backbone UNet and ControlNet, unconditional prediction noise is obtained. Based on the semantic guidance strength, semantic prediction noise, and unconditional prediction noise, the noisy latent variables at step t-1 are obtained; Alternatively, the rationality verification of the candidate generative adversarial scenarios includes: Based on the candidate generative adversarial scenarios, a physical consistency score is obtained; If the physical consistency score is greater than or equal to the preset threshold, the verification passes. If the physical consistency score is less than the preset threshold, the verification will fail.

6. The adversarial scene generation method according to claim 1, characterized in that, The method of obtaining the adversarial risk loss for the current round based on the original driving scenario information, the effective generated adversarial scenario for the current round, and the tested autonomous driving system includes: Based on the original driving scenario information, the relative distance to the target vehicle and the collision time of the target vehicle are obtained; based on the relative distance to the target vehicle and the collision time of the target vehicle, the risk weight of the target vehicle is obtained. The effective adversarial scenario of the current round is input into the autonomous driving system under test to obtain the detection result; the detection result includes the target confidence; the annotation information in the original driving scenario information; and the target perception failure component is obtained based on the detection result and the annotation information. Based on the target perception failure component and the target vehicle risk weight, the adversarial risk loss for the current round is obtained.

7. The adversarial scene generation method according to claim 1, characterized in that, The step of using the adversarial risk loss of the current round as a feedback signal and updating the semantic manipulation vector by searching in the parameter space according to the optimization strategy to increase the failure of the adversarial risk loss of the current round includes: Based on the generative adversarial scenario of the current round, a low-dimensional interpretable semantic space is obtained; Based on the low-dimensional interpretable semantic space and the adversarial risk loss of the current round, a proxy model is constructed, and the prediction mean and prediction variance of the proxy model are obtained. By using the acquisition function that maximizes the upper confidence bound to process the predicted mean and predicted variance, the next most valuable selection test parameters are obtained. Update the semantic manipulation vector based on the selected test parameters.

8. An adversarial scene generation device, characterized in that, A device for constructing and executing a two-level nested loop architecture, comprising an inner loop and an outer loop, wherein the inner loop is nested within each iteration of the outer loop; the adversarial scenario generation apparatus includes: The data acquisition module is used to acquire the original driving scenario information and geometric conditions; The inner loop module is used to obtain the semantic manipulation vector of the current round in each round of the outer loop; and in the inner loop, input the original driving scene information, geometric structure conditions and the semantic manipulation vector of the current round into the generative model to obtain the effective generative adversarial scene of the current round. The outer loop module is used to obtain the adversarial risk loss of the current round based on the original driving scenario information, the effective adversarial scenario of the current round, and the autonomous driving system under test. It uses the adversarial risk loss of the current round as a feedback signal and searches in the parameter space according to the optimization strategy to update the semantic manipulation vector in the direction that increases the failure of the adversarial risk loss of the current round. The adversarial scenario output module is used to re-trigger the next round of the inner loop with the updated semantic manipulation vector, forming a closed loop iteration until the termination condition is met, and outputting the final high-risk adversarial scenario.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the adversarial scenario generation method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the adversarial scenario generation method as described in any one of claims 1 to 7.

Images