An infrared countermeasure disturbance method based on topology-pixel decoupling hierarchical optimization

Abstract

The application discloses an infrared counteracting disturbance method based on topology-pixel decoupling layered optimization, and belongs to the technical field of artificial intelligence safety and infrared target recognition counteracting. The method comprises the following steps: inputting an infrared image into a target detection model, extracting detection confidence and gradient saliency information, and initializing a binary mask; adopting a reinforcement learning agent to select a current evolution action; when the action is a local topology adjustment type action, processing the mask by adopting a heuristic discrete search in a micro execution layer; when the action is a pixel expansion type action, performing batch pixel injection on a candidate boundary pixel set; constructing a reward function, updating a reinforcement learning strategy, and iteratively executing the above operation to output an optimal binary counteracting mask meeting an area budget. The application breaks through the shape expression bottleneck of a traditional geometric parameterization method, and significantly improves the disturbance effect and cross-scene robustness on mainstream infrared target detectors under strict pixel sparsity constraints.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and infrared target recognition countermeasures technology, specifically involving an infrared countermeasures perturbation method based on topology-pixel decoupling hierarchical optimization. Background Technology

[0002] Infrared target detection is a crucial foundational capability for tasks such as intelligent security, nighttime surveillance, unmanned platform perception, and border patrol. Unlike visible light imaging, infrared imaging relies primarily on the thermal radiation distribution of the target, exhibiting characteristics such as weak texture, low contrast, and noise sensitivity. This presents greater challenges to the robustness of infrared detection models in complex environments. In recent years, with the widespread application of deep learning detectors (such as YOLO, SSD, and Faster R-CNN) in infrared scenarios, their security issues have received increasing attention. Adversarial examples and adversarial occlusion can significantly reduce detection confidence and even lead to missed detections, thereby affecting the safe and reliable operation of the system.

[0003] Existing infrared countermeasures methods mainly fall into two categories: white-box methods based on continuous optimization and black-box methods based on heuristic search. The former typically optimizes the perturbation in a continuous space first, and then maps it to an implementable binary mask through thresholding. This is prone to the problem of inconsistency between the continuous optimization results and the discrete deployment results, i.e., "binarization error." The latter often uses low-dimensional parametric shapes such as rectangular blocks and curve blocks for searching. Although this avoids some gradient dependencies, its topological representation ability is limited, making it difficult to cover complex and efficient mask structures.

[0004] Furthermore, infrared adversarial mask optimization is essentially a combined optimization problem of high-dimensional discreteness, strict area constraints, and strong non-convexity: on the one hand, pixel-level binary decision-making has high dimensionality and a huge search space; on the other hand, there is a significant trade-off between attack effectiveness and mask area, and traditional single optimization strategies are prone to getting trapped in local optima, making it difficult to simultaneously satisfy high attack success rate and low pixel occupancy rate. Existing methods generally lack a collaborative mechanism between global topology planning and local pixel refinement, resulting in insufficient stability under cross-model, cross-scene, and multi-scale target conditions.

[0005] Therefore, how to efficiently search for high-dimensional discrete masks under strict area budget, while taking into account both global topology exploration and fine-grained pixel utilization, has become a key technical problem that urgently needs to be solved in the field of infrared countermeasures. Summary of the Invention

[0006] To address the aforementioned problems in the existing technology, the technical problem to be solved by the present invention is to provide an infrared counter-perturbation method based on topology-pixel decoupling hierarchical optimization, so as to achieve efficient, stable and controllable mask search under binary discrete constraints, reduce the confidence of the detection model and improve the perturbation success rate, while maintaining strict pixel sparsity constraints.

[0007] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0008] An infrared anti-perturbation method based on topology-pixel decoupling hierarchical optimization includes the following steps:

[0009] S1. Input the infrared image into the target detection model, extract the detection confidence and gradient significance information, initialize the binary mask and establish a hierarchical optimization state;

[0010] S2. A reinforcement learning agent is used to select the current evolutionary action from a predefined set of topological actions at the macro decision-making level;

[0011] S3. When the action is a local topology adjustment action, a heuristic discrete search is used at the micro execution layer to translate, shrink, split or relocate the mask.

[0012] S4. When the action is a pixel expansion type action, batch pixel injection is performed on the candidate boundary pixel set using Bayesian optimization based on the Gaussian process surrogate model.

[0013] S5. Construct a reward function based on the change in detection confidence before and after perturbation and the mask area constraint penalty, update the reinforcement learning policy and iteratively execute S2-S4 to output the optimal binary adversarial mask that satisfies the area budget.

[0014] Preferably, step S1 includes the following steps:

[0015] S1.1 Input infrared image And set a mask area budget threshold. ;

[0016] S1.2 Calculate the object confidence loss using the object detection model. And calculate the input gradient saliency map. ;

[0017] S1.3 Initialize the binary mask based on the high-response region of the input gradient saliency map. ;

[0018] S1.4 Constructing the state vector of a hierarchical Markov decision process ;

[0019] in, Indicates the current detection confidence level. Indicates the area percentage. Indicates a stalled count. This indicates the progress of the normalization iteration.

[0020] Preferably, step S2 specifically includes the following steps:

[0021] S2.1 Defining the Macro-Decision-Making Action Space ;

[0022] Among them, Drift is used for translation fine-tuning, Split is used for topological splitting, Teleport is used for region relocation, Shrink is used for shape shrinking, and Expand is used for pixel expansion.

[0023] S2.2 Constructing the State-Action Value Function and adopt - Greedy strategy for selecting actions: based on probability. Random exploration, with a probability of 1- Choose the action for the t-th iteration. ;

[0024] in, This represents the current state of the reinforcement learning agent; Represents any macroscopic evolutionary action in the candidate action space; This represents the action selected and executed in the t-th iteration; Indicates the scope of macroeconomic decision-making actions; Represents the state vector of a Markov decision process;

[0025] S2.3 After the action is executed, the Q value is updated according to the Bellman update formula.

[0026] Preferably, S3 specifically includes the following steps:

[0027] S3.1 When the action is Drift, perform a greedy search on the discrete displacement set {(0,1),(0,-1),(1,0),(-1,0)} and select the displacement that reduces the target loss to update the mask;

[0028] S3.2 When the action is Shrink, random morphological erosion is performed on the mask boundary pixels, and pixels that contribute little to the perturbation gain are preferentially removed.

[0029] S3.3 When the action is Split, randomly seed new submasks into non-connected regions to enhance multi-region cooperative perturbation;

[0030] S3.4 When the action is Teleport, the mask is repositioned to a new highly salient region when the stall count exceeds the threshold, so as to escape the local optimum.

[0031] Preferably, step S4 specifically includes the following steps:

[0032] S4.1 When the action is Expand, construct the current mask boundary candidate pixel set. ;

[0033] S4.2, Define candidate pixel feature maps ;

[0034] in, Indicates the gradient magnitude. Indicates pixel thermal intensity. Represents the local neighborhood density. Indicates the distance from the center of the mask. This indicates significant semantic priors; Indicates vector transpose;

[0035] S4.3. Apply Gaussian process surrogate model to inject gain into pixels. Modeling;

[0036] S4.4 Update the posterior mean and posterior variance based on the observed samples, and use the UCB acquisition function to perform Top-(K) batch selection;

[0037] S4.5, Set A mid-pixel injection mask is used to complete the high-dimensional discrete expansion update.

[0038] Preferably, S4.4 specifically includes the following steps:

[0039] ;

[0040] in, This represents the balance coefficient between exploration and utilization; This represents the optimal set of pixels for batch injection selected by the UCB acquisition function; Indicates the set of candidate pixels from the current boundary. The candidate subset selected from; This represents the set of candidate pixels for the boundary of the current mask at the t-th iteration; This indicates the number of pixels injected in each Expand action. Indicates candidate boundary pixels; This represents the posterior mean of the injection gain of pixel p after being updated by n historical observation samples. This represents the posterior standard deviation of the injection gain for pixel p.

[0041] Preferably, S5 specifically includes the following steps:

[0042] S5.1 Construct an instant reward function;

[0043] S5.2 Training strategy aimed at maximizing cumulative rewards;

[0044] S5.3 Terminate the search when the perturbation success condition is met or the maximum number of iterations is reached, and output the optimal binary mask. .

[0045] Preferably, S5.1 specifically includes the following steps:

[0046] ;

[0047] ;

[0048] ;

[0049] in, Indicates the decrease in confidence level; Indicates the area constraint penalty coefficient; This indicates a penalty for exceeding the permitted area. This represents the binary mask obtained at the next moment after performing the t-th action; This represents the confidence level of the target detection model in detecting the target at the t-th iteration; This represents any binary perturbation mask to be evaluated; This represents the maximum allowable mask area budget threshold.

[0050] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0051] (1) This invention proposes an infrared counter-perturbation method based on topology-pixel decoupling hierarchical optimization. By decoupling the topology and pixels at two levels, the high-dimensional discrete optimization problem is decomposed into sub-problems that can be solved collaboratively, which significantly improves the search efficiency.

[0052] (2) The present invention optimizes the mask directly in the binary space, avoiding quantization deviation caused by continuous relaxation and thresholding.

[0053] (3) This invention enhances global jump capability through topological actions such as splitting and relocation, effectively reducing the probability of getting trapped in local optima.

[0054] (4) This invention performs batch pixel injection on candidate boundaries through Bayesian optimization, which improves the utilization rate of key pixels and can still obtain high perturbation benefits under a small area budget.

[0055] (5) The present invention has good adaptability and robustness to infrared detectors with different structures and data in different scenarios. Attached Figure Description

[0056] Figure 1 This is a flowchart illustrating the overall process of an embodiment of the present invention. Detailed Implementation

[0057] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0058] like Figure 1 As shown, this embodiment provides an infrared counter-perturbation method based on topology-pixel decoupling hierarchical optimization, including the following steps:

[0059] S1. Input the infrared image to be attacked into the target detection model, extract the detection confidence and gradient significance information, initialize the binary mask and establish a hierarchical optimization state;

[0060] The perturbation state representation is constructed for the input infrared image and the target detection model to form an initial mask and saliency prior, specifically including the following steps:

[0061] S1.1, Obtain the infrared image of the target ( ), and set a mask area budget threshold. ,in, , These represent the height and width of the mask coordinate system after mapping the input infrared image or target region, respectively;

[0062] S1.2, Calculate the object confidence loss using the object detection model ( ), and calculate the input gradient saliency map ( ),in, This represents the gradient operator for calculating the gradient of an input infrared image x; it enables target detection and saliency analysis.

[0063] Input the infrared image x into the target detection model This yields the target bounding box, class confidence score, and target confidence score. For the target to be attacked, either the detection confidence score or the targetability score is selected to construct the object confidence loss. Under white-box conditions, calculate the gradient of the input image:

[0064]

[0065] in, This represents the gradient operator of the loss function with respect to the input image pixels, and S represents the input gradient saliency map. In the specific implementation, the absolute value of the gradient is taken along the channel dimension and averaged to obtain a two-dimensional saliency map. Then, the target bounding box region is cropped and scaled to the mask resolution to initialize the mask seed.

[0066] S1.3 Initialize the binary mask based on the high-response region of the input gradient saliency map. ),in, , These represent the height and width of the mask coordinate system after mapping the input infrared image or target region, respectively;

[0067] S1.4 Constructing the state vector of a hierarchical Markov decision process ( );

[0068] in, The current detection confidence level, For area percentage, For stagnation counting, This is for normalizing the iteration progress.

[0069] S2. A reinforcement learning agent is used to select the current evolution action from a predefined set of topological actions at the macro decision-making level to achieve global policy scheduling;

[0070] At the macro-decision level, reinforcement learning agents select topology evolution actions to achieve global policy scheduling, which specifically includes the following steps:

[0071] S2.1 Defining the Macro-Decision-Making Action Space Among them, Drift is used for translation fine-tuning, Split is used for topological splitting, Teleport is used for region relocation, Shrink is used for shape shrinking, and Expand is used for pixel expansion.

[0072] S2.2 Constructing the State-Action Value Function and adopt - Greedy strategy for selecting actions: based on probability Random exploration, with a probability of (1- Choose the action for the t-th iteration. ;

[0073] in, This represents the current state of the reinforcement learning agent; Represents any macroscopic evolutionary action in the candidate action space; This represents the action selected and executed in the t-th iteration; Indicates the scope of macroeconomic decision-making actions; This represents the state vector of a Markov decision process.

[0074] S2.3 After the action is executed, the Q value is updated according to the Bellman update formula, specifically as follows:

[0075]

[0076] in, For learning rate, This is the discount factor. Represents the state vector of a Markov decision process; This represents the action selected and executed in the t-th iteration; Indicates the execution of an action The instant reward obtained afterward; Indicates the execution of an action The next state after that; Indicates the next state Any action in the selectable action space.

[0077] S3. When the action is a local topology adjustment action, a heuristic discrete search is used at the micro execution layer to translate, shrink, split or relocate the mask.

[0078] At the micro-execution layer, heuristic discrete topology updates are performed for non-expanding actions to achieve rapid adjustment of mask geometry. This includes the following steps:

[0079] S3.1 When the action is Drift, perform a greedy search on the discrete displacement set ({(0,1),(0,-1),(1,0),(-1,0)}) and select the displacement that reduces the target loss to update the mask;

[0080] When the action is Drift, a discrete set of displacements is constructed, such as {(0,1),(0,-1),(1,0),(-1,0)}. Diagonal displacements can also be added according to the iteration stage. For each candidate displacement, the current mask is translated as a whole to obtain a candidate mask, which is then restricted to the target region or effective region. The candidate mask is then applied to the original infrared image, input into the target detection model to calculate the detection confidence, and the candidate mask that results in the lowest detection confidence is selected as the update result. If none of the candidate displacements reduce the confidence, the original mask is kept unchanged.

[0081] S3.2 When the action is Shrink, random morphological erosion is performed on the mask boundary pixels, and pixels that contribute little to the perturbation gain are preferentially removed.

[0082] When the action is Shrink, several activated pixels are selected from the current binary mask, prioritizing boundary pixels or randomly sampled candidate pixels, and each pixel is attempted to be changed from 1 to 0. The detection confidence is recalculated after each pixel is deleted; if deleting the pixel significantly increases the detection confidence, the pixel is restored; otherwise, the deletion result is retained. This process removes pixels that contribute little to the attack gain, reduces the mask area, and improves sparsity.

[0083] S3.3 When the action is Split, randomly seed new submasks into non-connected regions to enhance multi-region cooperative perturbation;

[0084] When the action is Split, firstly, a connected component analysis is performed on the current binary mask to count the number of existing sub-mask regions. If the number of current connected regions is small, an inactive location is randomly selected within the target region or a highly salient region, and this location is set to 1, forming a new sub-mask seed. Subsequent Expand actions can continue to expand around this seed, thereby forming a multi-region cooperative perturbation structure.

[0085] S3.4 When the action is Teleport, the mask is repositioned to a new highly salient region when the stall count exceeds the threshold, so as to escape the local optimum.

[0086] When the optimization process fails to achieve a decrease in confidence within several consecutive iterations, a Teleport action is triggered. This action performs a random global displacement of the current mask within a certain range and restricts the displaced mask to the effective target region, resulting in new candidate topology locations. This operation is used to escape local optima and improve global exploration capabilities.

[0087] S4. When the action is a pixel expansion type action, batch pixel injection is performed on the candidate boundary pixel set using Bayesian optimization based on the Gaussian process surrogate model.

[0088] For the extended action, a Bayesian-optimized pixel injection based on a Gaussian process is performed to achieve a fine-grained search for high-dimensional discrete pixels. This includes the following steps:

[0089] S4.1 When the action is Expand, construct the current mask boundary candidate pixel set. ;

[0090]

[0091] in, This indicates that candidate pixel p has not yet been activated by the current mask at the t-th iteration and belongs to an expansion position that can be added. This indicates that at least one pixel q in the four neighborhoods of candidate pixel p has been activated by the current mask, thus ensuring that the candidate pixel is located in the outer boundary neighborhood of the current mask; p=(i,j) represents the coordinates of the candidate pixel; This represents the four neighborhoods of pixel p; This represents the set of all candidate extended pixels that are adjacent to the current mask and have not yet been activated.

[0092] S4.2, Define candidate pixel feature maps ;

[0093] in, For gradient magnitude, For pixel thermal intensity, For local neighborhood density, Distance from the center of the mask, It is a semantically significant prior; This represents the vector transpose, used to illustrate the feature mapping of candidate pixels. It is in column vector form.

[0094] S4.3. Apply Gaussian process surrogate model to inject gain into pixels. Modeling, specifically:

[0095]

[0096] in, This represents the attack gain resulting from injecting candidate pixel p into the mask; Represent a Gaussian process; Represents the prior mean function; This represents a kernel function used to measure the correlation between the features of two candidate boundary pixels. and This represents two candidate boundary pixels.

[0097] And update the posterior mean based on historical observation samples. With posterior standard deviation .

[0098] S4.4 Update the posterior mean and posterior standard deviation based on the observed samples, and perform Top-(K) batch selection using the UCB (Upper condence bound) acquisition function, specifically as follows:

[0099]

[0100] in, This represents the balance coefficient between exploration and utilization; This represents the optimal set of pixels for batch injection selected by the UCB acquisition function; Indicates the set of candidate pixels from the current boundary. The candidate subset selected from; This represents the set of candidate pixels for the boundary of the current mask at the t-th iteration; This indicates the number of pixels injected in each Expand action. Indicates candidate boundary pixels; This represents the posterior mean of the injection gain of pixel p after being updated by n historical observation samples. Represents pixels The posterior standard deviation of the injection gain.

[0101] S4.5, Set A mid-pixel injection mask is used to complete the high-dimensional discrete expansion update.

[0102] The candidate pixels at the boundary are sorted according to the UCB acquisition function, and the K pixels with the highest scores are selected to form a set. Then try to do it one by one. The middle pixel is set to 1, and the decrease in detection confidence after injection is evaluated. If the injection of a pixel causes a decrease in detection confidence, the pixel is retained and its observation gain is added to the Gaussian process training samples; if no effective gain is generated, the pixel is rolled back. After testing all candidate pixels, the expanded candidate mask is obtained. .

[0103] S5. Construct a reward function based on the change in detection confidence before and after perturbation and the mask area constraint penalty, update the reinforcement learning policy and iteratively execute S2-S4 to output the optimal binary adversarial mask that satisfies the area budget.

[0104] Based on the penalty for decreased detection confidence and area constraint, a reward is constructed and the policy is updated. The process iteratively obtains a binary mask that satisfies the area budget and has a high attack success rate. The specific steps include:

[0105] In each iteration, candidate masks are obtained based on macroscopic actions and microscopic execution results. This is then mapped onto the target bounding box region of the original infrared image to form a full-image binary mask. Candidate adversarial images are then generated as follows. :

[0106] in, This represents the full-image mask mapped to the original image size, where c represents the perturbation fill value. The input detection model yields a new detection confidence score, and the reward function determines whether to accept the update. x represents the infrared image.

[0107] S5.1 Construct an instant reward function, specifically as follows:

[0108]

[0109]

[0110] in, Indicates the decrease in confidence level; This represents the area constraint penalty coefficient, used to adjust the trade-off between the attack effect benefit and the perturbation area constraint; This indicates a penalty for exceeding the permitted area. This represents the binary mask obtained at the next moment after performing the t-th action; This represents the confidence level of the target detection model in detecting the target at the t-th iteration; This represents the detection confidence at the next time step after performing the action and updating the mask; Indicates the execution of an action The instant reward received afterward.

[0111] The penalty for exceeding the area limit is: ;

[0112] where, denotes any binary perturbation mask to be evaluated; denotes the maximum allowable mask area budget threshold.

[0113] S5.2. Training the policy with the goal of maximizing cumulative rewards, which is specifically as follows:

[0114]

[0115] where, denotes the expected cumulative discounted reward of the policy ; denotes taking the expectation under the state-action trajectory distribution induced by the policy ; denotes the maximum number of iteration steps or the termination time; denotes the discount weight of the reward at step t; denotes the action selection policy of the reinforcement learning agent.

[0116] S5.3. Terminate the search when the attack success condition is satisfied or the maximum iteration step is reached, and output the optimal binary mask ; maintain the historically optimal mask during the iteration process:

[0117] where, denotes the optimal binary adversarial mask obtained during the iterative search process; argmin denotes selecting the mask that minimizes the object detection confidence from all candidate masks; denotes the candidate binary mask obtained in the t-th iteration; denotes the number of pixels with a value of 1 in the mask , that is, the perturbation area; denotes the maximum allowable mask area budget threshold.

[0118] The search is terminated when any of the following conditions is satisfied: (1) The detection confidence is lower than the preset attack success threshold <eta, for example, eta=0.5; (2) The target is not detected by the object detection model; (3) The maximum number of iterations T_max is reached; (4) No effective confidence drop occurs for several consecutive iterations.

[0119] This method is applicable to infrared object detection models based on convolution or anchor-based / anchor-free structures, including YOLO series, SSD and Faster R-CNN models.

[0120] The effectiveness and efficiency of the method of the present invention are verified through the following experiments:

[0121] The present application uses AP and ASR indicators as evaluation criteria:

[0122] AP: Average Precision. Given that this application focuses on evaluating the attack effect in a single-target detection scenario, and only considers whether the target is correctly detected for each image, this application defines AP as the percentage of samples in which the model can still correctly detect the target after the attack (i.e., detection accuracy). Its calculation formula is as follows:

[0123]

[0124] in, This represents the total number of test samples. This represents the number of samples correctly identified by the detector.

[0125] ASR: Attack Success Rate, used to measure the proportion of attack samples that successfully disable target detection. Let the total number of test samples be N, and the indicator function be... ,but:

[0126]

[0127] Where N represents the total number of test samples, The generated adversarial example is evaluated using the function. This indicates a successful attack (the confidence level of the detected adversarial sample is below the threshold or it is a missed detection; the threshold is consistent with the inference threshold of the target detector or is preset to 0.5).

[0128] This application follows the publicly available infrared attack evaluation protocol, selects FLIR V2 as the main evaluation set, and filters out Person category samples with a target height greater than 120 pixels, resulting in a total of 1255 test images; at the same time, FLIR V1_3, LLVIP, and MSRS are used for cross-domain generalization evaluation.

[0129] Five mainstream architectures were selected for the detection models: YOLOv3, SSD, Faster R-CNN, YOLOv5, and YOLOv8. To ensure fairness, each detector was trained under its corresponding training configuration before being evaluated against attacks.

[0130] In the comparative experiments, this application selected representative attack methods covering different technical routes as baselines to ensure the comprehensiveness and interpretability of the evaluation conclusions: HCB is a heuristic candidate block search method, belonging to the black-box heuristic rectangle search attack class. It optimizes the position and size of the rectangle patch through group search iteratively without relying on gradient information. Its advantages are simple implementation and good engineering deployability, but it is limited by the expressive power of rectangle shape and is difficult to form complex and effective perturbation topology; AIP is an adversarial infrared patching method or an infrared adversarial patching method based on gradient optimization. It belongs to the white-box continuous optimization and discretization method. It first uses the continuous space to Gradient optimization of perturbations, followed by thresholding mapping to implementable binary masks, has strong gradient exploitation capabilities, but is susceptible to continuous-to-discrete conversion errors, leading to a reduction in actual attack performance. AdvIC represents methods against infrared camouflage or infrared curve attacks, belonging to parametric curve attack methods. It controls the perturbation boundary through curve parameters such as Bezier curves, achieving more flexible shape modeling than rectangles, but it is still a low-dimensional parametric representation with a limited search space. AdvICRS is an improved version of AdvIC, which can be understood as an adversarial infrared curve method that introduces random search, resampling, or robust search strategies. While improving search stability based on curve parameterization, it still belongs to low-dimensional curve parameterization mask representation. Its overall performance is better than general curve methods, but it also suffers from limited topological representation. Ours (this application) is based on Topology-Pixel Decoupling Hierarchical Optimization (TPDHO), which decomposes mask generation into two collaborative levels: reinforcement learning-driven macro-topological decision-making and heuristic / Bayesian optimization-driven micro-pixel execution. Under strict area constraints, it simultaneously considers global exploration capability and fine-grained pixel utilization efficiency, effectively overcoming the shortcomings of existing methods in discretization error and geometric representation bottlenecks. In Table 1, Clean represents the detection results of the original infrared image without any adversarial perturbations, used as a benchmark performance. The AP of Clean in the table reflects the original detection capability of the target detection model on clean samples; since no attack is performed, ASR is usually not calculated and can be represented by "-".

[0131] The experiment adopted a unified evaluation process: under the same area constraint, each method was perturbed and the AP and ASR were statistically analyzed, with a focus on comparing the stability across detectors, data domains and multi-scale scenarios.

[0132] Table 1. Quantitative experimental results comparing methods under different target detectors.

[0133]

[0134] Table 2. Quantitative experimental results comparing different methods on different datasets.

[0135]

[0136] Table 3. Quantitative experimental results comparing methods for targets of different scales.

[0137]

[0138] In Table 3, Small, Medium, and Large represent small-scale, medium-scale, and large-scale targets, respectively. The classification is based on the bounding box size of the target in the infrared image and is used to compare the attack success rate of different methods in multi-scale target scenarios.

[0139] The quantitative experimental results in Tables 1 to 3 demonstrate that the proposed method exhibits significant performance advantages under different detectors, data domains, and target scales. In detector comparison experiments, the proposed method achieves optimal results on SSD, YOLOv5, and YOLOv8, and maintains a high attack success rate on YOLOv3 and Faster R-CNN, indicating its stable destructive capability against different detection mechanisms. In cross-domain experiments, the proposed method maintains high ASR and significantly reduces AP in the four data domains of FLIR V1_3, FLIRV2, LLVIP, and MSRS, demonstrating excellent out-of-domain generalization ability. In multi-scale experiments, the proposed method maintains a high success rate even in the most challenging scenario of Small targets, while remaining stable on Medium and Large scales, indicating that the proposed method can still achieve fine-grained and efficient perturbation optimization under strict area constraints.

[0140] The above results fully demonstrate that the macroscopic topology decision-making + microscopic pixel injection hierarchical mechanism proposed in this application can effectively improve the success rate, cross-domain robustness and scale adaptability of infrared counter-perturbation.

[0141] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An infrared anti-perturbation method based on topology-pixel decoupling hierarchical optimization, characterized in that, Includes the following steps: S1. Input the infrared image into the target detection model, extract the detection confidence and gradient significance information, initialize the binary mask and establish a hierarchical optimization state; S2. A reinforcement learning agent is used to select the current evolutionary action from a predefined set of topological actions at the macro decision-making level; S3. When the action is a local topology adjustment action, a heuristic discrete search is used at the micro execution layer to translate, shrink, split or relocate the mask. S4. When the action is a pixel expansion type action, batch pixel injection is performed on the candidate boundary pixel set using Bayesian optimization based on the Gaussian process surrogate model. S5. Construct a reward function based on the change in detection confidence before and after perturbation and the mask area constraint penalty, update the reinforcement learning policy and iteratively execute S2-S4 to output the optimal binary adversarial mask that satisfies the area budget.

2. The infrared anti-perturbation method based on topology-pixel decoupling hierarchical optimization according to claim 1, characterized in that, S1 specifically includes the following steps: S1.1 Input infrared image And set a mask area budget threshold. ; S1.2 Calculate the object confidence loss using the object detection model. And calculate the input gradient saliency map. ; S1.3 Initialize the binary mask based on the high-response region of the input gradient saliency map. ; S1.4 Constructing the state vector of a hierarchical Markov decision process ; in, Indicates the current detection confidence level. Indicates the area percentage. Indicates a stalled count. This indicates the progress of the normalization iteration.

3. The infrared anti-perturbation method based on topology-pixel decoupling hierarchical optimization according to claim 1, characterized in that, S2 specifically includes the following steps: S2.1 Defining the Macro-Decision-Making Action Space ; Among them, Drift is used for translation fine-tuning, Split is used for topological splitting, Teleport is used for region relocation, Shrink is used for shape shrinking, and Expand is used for pixel expansion. S2.2 Constructing the State-Action Value Function and adopt - Greedy strategy for selecting actions: based on probability. Random exploration, with a probability of 1- Choose the action for the t-th iteration. ; in, This represents the current state of the reinforcement learning agent; Represents any macroscopic evolutionary action in the candidate action space; This represents the action selected and executed in the t-th iteration; This indicates the scope of macroeconomic decision-making actions; Represents the state vector of a Markov decision process; S2.3 After the action is executed, the Q value is updated according to the Bellman update formula.

4. The infrared anti-perturbation method based on topology-pixel decoupling hierarchical optimization according to claim 1, characterized in that, S3 specifically includes the following steps: S3.1 When the action is Drift, perform a greedy search on the discrete displacement set {(0,1),(0,-1),(1,0),(-1,0)} and select the displacement that reduces the target loss to update the mask; S3.2 When the action is Shrink, random morphological erosion is performed on the mask boundary pixels, and pixels that contribute little to the perturbation gain are preferentially removed. S3.3 When the action is Split, randomly seed new submasks into non-connected regions to enhance multi-region cooperative perturbation; S3.4 When the action is Teleport, the mask is repositioned to a new highly salient region when the stall count exceeds the threshold, so as to escape the local optimum.

5. The infrared anti-perturbation method based on topology-pixel decoupling hierarchical optimization according to claim 4, characterized in that, S4 specifically includes the following steps: S4.1 When the action is Expand, construct the current mask boundary candidate pixel set. ; S4.2, Define candidate pixel feature maps ; in, Indicates the gradient magnitude. Indicates pixel thermal intensity. Represents the local neighborhood density. Indicates the distance from the center of the mask. This indicates a significant semantic prior. Indicates vector transpose; S4.

3. Apply Gaussian process surrogate model to inject gain into pixels. Modeling; S4.4 Update the posterior mean and posterior variance based on the observed samples, and use the UCB acquisition function to perform Top-(K) batch selection; S4.5, Set A mid-pixel injection mask is used to complete the high-dimensional discrete expansion update.

6. The infrared anti-perturbation method based on topology-pixel decoupling hierarchical optimization according to claim 5, characterized in that, S4.4 specifically includes the following steps: ； in, This represents the balance coefficient between exploration and utilization; This represents the optimal set of pixels for batch injection selected by the UCB acquisition function; Indicates the set of candidate pixels from the current boundary. The candidate subset selected from; This represents the set of candidate pixels for the boundary of the current mask at the t-th iteration; This indicates the number of pixels injected in each Expand action. Indicates candidate boundary pixels; This represents the posterior mean of the injection gain of pixel p after being updated by n historical observation samples. This represents the posterior standard deviation of the injection gain for pixel p.

7. The infrared anti-perturbation method based on topology-pixel decoupling hierarchical optimization according to claim 1, characterized in that, In S5, the specific steps include: S5.1 Construct an instant reward function; S5.2 Training strategy aimed at maximizing cumulative rewards; S5.3 Terminate the search when the perturbation success condition is met or the maximum number of iterations is reached, and output the optimal binary mask. .

8. The infrared anti-perturbation method based on topology-pixel decoupling hierarchical optimization according to claim 1, characterized in that, S5.1 specifically includes the following: ； ； ； in, Indicates the execution of an action The instant reward obtained afterward Indicates the decrease in confidence level; Indicates the area constraint penalty coefficient; This indicates a penalty for exceeding the permitted area. This represents the binary mask obtained at the next moment after performing the t-th action; This represents the confidence level of the target detection model in detecting the target at the t-th iteration; This represents the detection confidence at the next time step after performing the action and updating the mask; This represents any binary perturbation mask to be evaluated; This represents the maximum allowable mask area budget threshold.

Images