Information processing program, information processing method, and information processing device

Abstract

To improve detection accuracy to a hostile patch attack.SOLUTION: An information processing program makes a computer execute processing for acquiring a first value representing the size of an area of an object included in a first image, specifying a loss ratio to a hostile patch on the basis of a second value representing the smallest size of the hostile patch acquired according to the first value, generating a second image obtained by giving a loss exceeding the loss ratio to the first image, and comparing a first detection result obtained by inputting the first image to an object detection model with a second detection result obtained by inputting the second image to the object detection model.SELECTED DRAWING: Figure 8

Description

Technical Field

[0001] The present invention relates to an information processing program, an information processing method, and an information processing apparatus using image AI such as object detection.

Background Art

[0002] Regarding image AI (Artificial Intelligence) such as object detection, there is an adversarial patch attack that misrecognizes an object to be detected, for example, fraud detection of self-checkout in the retail area, recognition of license plates in the public security area, etc. Note that the adversarial patch is a type of adversarial sample attack and is also called an adversarial sample patch or the like.

[0003] In order to detect an adversarial patch attack, for example, the class output by object detection for an input image subjected to image processing is compared with the class output by object detection for the input image without image processing, and if there is a mismatch, it is determined that the patch attack has been received. Here, as an example of image processing, there are processes such as adding a defect of a straight line with a randomly determined width and interval, and adding a defect of a square with a randomly determined size and position to the input image.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Patent Document 2

Patent Document 3

Patent Document 4

Patent Document 5

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, for example, when imparting random-sized and -positioned defects, there are cases where the defect does not reach the patch, the effectiveness of the patch cannot be reduced, and the patch attack cannot be detected, and consequently, illegal use such as self-resizing or license plate forgery may be overlooked.

[0006] On one aspect, it aims to improve the detection accuracy against adversarial patch attacks.

Means for Solving the Problems

[0007] In one embodiment, the information processing program acquires a first value representing the size of the region of an object included in a first image, specifies a defect rate against an adversarial patch based on a second value representing the minimum size of the adversarial patch acquired according to the first value, generates a second image with defects exceeding the defect rate added to the first image, and causes a computer to execute a process of comparing a first detection result obtained by inputting the first image into an object detection model with a second detection result obtained by inputting the second image into the object detection model.

Effects of the Invention

[0008] On one aspect, the detection accuracy against adversarial patch attacks can be improved.

Brief Description of the Drawings

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, examples of the information processing program, information processing method, and information processing apparatus according to the present embodiment will be described in detail with reference to the drawings. Note that the present embodiment is not limited by this example. Also, the respective examples can be appropriately combined within a non - conflicting range.

[0011] First, the prior art against adversarial patch attacks and its problems will be described. The adversarial patch attack is, for example, an attack that causes misrecognition of an object to be detected when detecting an object from an image using an image AI (for example, an object detection model). Note that existing object detection algorithms include, for example, YOLO (You only Look Once) and Faster R - CNN (Faster Region - based Convolutional Neural Networks).

[0012] FIG. 1 is a diagram for explaining object detection. FIG. 1 is an example of detecting an object using image AI for an input image. In the example of FIG. 1, as the output of object detection, a bounding box which is a rectangular region surrounding the object in the image and a class indicating what the object is (such as a dog, a bicycle, etc.) are shown. Further, for example, a confidence level of the class shown between 0 and 1 may also be output.

[0013] FIG. 2 is a diagram for explaining adversarial patch attack. Adversarial patch attack is a type of adversarial sample attack. For example, as shown in FIG. 2, it is an attack that causes the image AI to misrecognize the object by, for example, pasting an adversarial patch 99 on the object. In the example of FIG. 2, for an input image that was recognized as a banana with a confidence level close to 100%, by using the adversarial patch 99, it can be misrecognized as a toaster with a confidence level close to 100%. Note that for the misrecognition by the adversarial patch 99, in addition to misrecognizing it as a different object as in the example of FIG. 2, for example, making it not recognized as an object, making it recognized that there is an object in a place where there is no object, misrecognizing the bounding box by shifting it from the correct position, etc. are possible. Also, for example, when there are multiple objects to be attacked, it is often the case that an adversarial patch 99 is pasted for each object. Note that adversarial patch attacks include, for example, Adversarial Patch and DPatch, etc.

[0014] Such adversarial patch attacks using adversarial patch 99 pose a significant threat to image AIs such as object detection AIs. Figure 3 is a diagram for explaining fraud detection and patch detection techniques. As shown on the left side of Figure 3, for example, in a retail area where surveillance is carried out using surveillance camera footage, a malicious person can stick adversarial patch 99 on high-value goods, causing the self-checkout fraud detection AI, which is a type of object detection AI, to be unable to correctly recognize the goods. As a result, for example, sales losses due to overlooking fraud may occur. Therefore, the industry demands detecting adversarial patch attacks and taking appropriate countermeasures. As an example of such countermeasures, as shown on the right side of Figure 3, when the use of adversarial patch 99 is detected, a rescan can be prompted by the self-checkout's automated voice to prevent sales losses. The detection technique for adversarial patch 99 will be specifically explained using Figure 4.

[0015] Figure 4 is a diagram showing an example of a patch detection technique for adversarial patch attacks. An example of the patch detection technique shown in Figure 4 is to perform image processing on an input image to generate an image with defects, perform object detection on each of the defective image and the original image using an object detection model, and detect the patch by comparing the output classes. In Figure 4, as an example of the defects added to the input image, a plurality of defective lines with randomly determined widths and intervals are added in the vertical direction of the input image. Also, for example, as shown in Figure 4, when the comparison result of the output classes of the original image and the defective image does not match, it is determined that adversarial patch 99 has been used and the object has been misrecognized, and adversarial patch 99 is detected and an alert or the like is notified.

[0016] The patch detection technique as shown in Figure 4 is, for example, a method that utilizes the following two characteristics. As the first characteristic, for example, adversarial patch 99 is vulnerable to image processing, and its attack power decreases when image processing is performed. On the other hand, as the second characteristic, for example, the object detection model is robust to image processing, and it is difficult for the accuracy of object detection by the object detection model to be affected even when image processing is performed.

[0017] Also, by using a patch detection technique as shown in FIG. 4, for example, by checking the output class of the processed image (the image with the defect added), it is possible to confirm what object has been attacked, and a certain degree of explainability is guaranteed. For example, in FIG. 4, since the object detected as "cucumber" in the original image is detected as "banana" in the image with the defect added, it can be seen that the banana has been attacked by the adversarial patch 99. Therefore, for example, in self-checkout, it is possible to prompt the payment for the banana and the like.

[0018] In addition, in FIG. 4, as an example of image processing, the addition of a plurality of defect lines is shown. However, image processing may also include, for example, smoothing, binarization, sharpening, contrast change, brightness change, etc. However, compared with other processes, the defect has the effect of further reducing the attack power of the adversarial patch 99. Also, the defect is not limited to a plurality of defect lines with randomly determined widths and intervals as shown in FIG. 4, and may be, for example, a defect such as a square with randomly determined size and position.

[0019] However, there are also problems with such a patch detection technique by adding defects, which is more effective against adversarial patch attacks. FIG. 5 is a diagram for explaining the problems of the patch detection technique by adding defects. For example, when adding randomly determined defects such as size and position, as shown in FIG. 5, the defect does not reach the adversarial patch 99 (the defect is not added to the adversarial patch 99 on the image), and there is a possibility of missing the patch attack without being able to reduce the attack power of the adversarial patch 99.

[0020] Therefore, in this embodiment, one of the objectives is to perform image processing so that the defect reaches the adversarial patch 99 and improve the detection accuracy against adversarial patch attacks.

[0021] FIG. 6 is a diagram for explaining the imparting of a defect according to the present embodiment. Although details will be described later, in the present embodiment, for example, as shown in FIG. 6, a defect exceeding a defect rate (10% in the example of FIG. 6) specified from the minimum size of the adversarial patch 99 defined in advance with respect to the size of the object is imparted to the (0) input image. As a result, for each object, the adversarial patch 99 on the image can be cut by a certain area or more to reduce the attack power of the patch, and the detection accuracy against the adversarial patch attack can be improved.

[0022] Further, in the present embodiment, for example, as a countermeasure for predicting the defect position and avoiding the imparting of a defect to the adversarial patch 99, as shown in FIG. 6, the (2) direction and offset of the defect (for example, the number of pixels from a predetermined reference position) are randomly determined.

[0023] Further, in the present embodiment, for example, as shown in FIG. 6, the (3) edge of the object is specified, and the defect around the edge, which is a major feature for identifying the object, is deleted (no defect is imparted around the edge). Note that, for example, it is difficult to detect the adversarial patch 99 as an object from an image because there are many types of patches and new patches may be created.

[0024] As described above, as shown in FIG. 6, in the present embodiment, it is controlled to cut the adversarial patch 99 by a certain area or more for each object while avoiding the position around the edge including the features of the object.

[0025] [Configuration of Information Processing System 1] Next, an information processing system for implementing such a present embodiment will be described. FIG. 7 is a diagram showing a configuration example of the information processing system 1 according to the present embodiment. As shown in FIG. 7, the information processing system 1 is a system in which, for example, an information processing device 10 and a camera device 100 are communicably connected to each other via a network 50.

[0026] The network 50 can adopt various communication networks such as the Internet and intranet, regardless of whether it is wired or wireless. Further, the network 50 is not a single network and may be configured, for example, by an intranet and the Internet via a network device such as a gateway or other devices (not shown).

[0027] The information processing device 10 is, for example, an information processing device such as a desktop PC (Personal Computer), a notebook PC, or a server computer installed, for example, inside a facility to be monitored and used by facility staff, administrators, etc. Note that the inside of the facility may include not only indoors but also outdoors.

[0028] Further, the information processing device 10 receives, for example, the video captured by the camera device 100 from the camera device 100 in order to detect an adversarial patch attack. Note that the video captured by the camera device 100 is strictly a plurality of captured images captured by the camera device 100, that is, a series of frames of a moving image.

[0029] In addition, the information processing device 10 detects objects such as products and license plates from the images captured by the camera device 100 using, for example, image AI such as an existing object detection model. Note that the detection of objects such as products from the captured images may be, for example, as shown in FIG. 1, where a predetermined area on the image such as a bounding box, which is a rectangular area surrounding the object such as a product, is detected for each object.

[0030] Further, the information processing apparatus 10 acquires, for example, a first value representing the size of the region of an object included in the first image captured by the camera apparatus 100. Further, the information processing apparatus 10 specifies, for example, a loss rate with respect to the adversarial patch based on a second value representing the minimum size of the adversarial patch 99 acquired according to the first value. Further, the information processing apparatus 10 generates, for example, a second image in which a loss exceeding the specified loss rate is added to the first image. Further, the information processing apparatus 10 compares, for example, a first detection result obtained by inputting the first image into an object detection model and a second detection result obtained by inputting the second image into the object detection model. Then, for example, when the comparison result between the first detection result and the second detection result does not match, the information processing apparatus 10 determines that the object has been misrecognized using the adversarial patch 99, detects the adversarial patch 99, and notifies an alert or the like.

[0031] Note that in FIG. 7, the information processing apparatus 10 is shown as a single computer, but it may be a distributed computing system composed of a plurality of computers. Further, the information processing apparatus 10 may be a cloud computer apparatus managed by a service provider that provides cloud computing services.

[0032] The camera apparatus 100 is, for example, a surveillance camera installed inside a facility to be monitored. The camera apparatus 100 captures, for example, products for which accounting is performed at a self-checkout as shown in FIG. 2. Note that, depending on the scale of the facility or the like, instead of one camera apparatus 100 as shown in FIG. 7, there may be a plurality of camera apparatuses 100. The video captured by the camera apparatus 100 is transmitted to the information processing apparatus 10.

[0033] Further, in the information processing system 1, devices other than the devices shown in FIG. 7, such as a self-checkout terminal and an information processing terminal used by a facility staff member or an administrator to notify an alert or the like, may be communicably connected via a network 50 or the like.

[0034] [Functional Configuration of Information Processing Apparatus 10] Next, the functional configuration of the information processing apparatus 10 will be described. FIG. 8 is a diagram showing a functional configuration example of the information processing apparatus 10 according to the present embodiment. As shown in FIG. 8, the information processing apparatus 10 includes a communication unit 20, a storage unit 30, and a control unit 40.

[0035] The communication unit 20 is a processing unit that controls communication with other information processing apparatuses such as the camera device 100, and is, for example, a communication interface such as a network interface card or a USB (Universal Serial Bus) interface.

[0036] The storage unit 30 has a function of storing various data and programs executed by the control unit 40, and is realized by a storage device such as a memory or a hard disk, for example. The storage unit 30 stores image information 31, model information 32, adversarial patch information 33, and the like.

[0037] The image information 31 stores, for example, an image captured by the camera device 100. The image stored in the image information 31 is an image captured by the camera device 100 and transmitted to the information processing apparatus 10, and the image information 31 may store, for example, an identifier for uniquely identifying the captured camera device 100, a shooting date and time, and the like. Further, the image information 31 may store, for example, an image after performing image processing such as object detection, defect addition, image segmentation, and edge extraction, which will be described later, on the image captured by the camera device 100.

[0038] The model information 32 stores information about an object detection model, which is a machine learning model for detecting objects from images captured by the camera device 200, for example, and model parameters for constructing the model. The machine learning model is generated by machine learning using, for example, the video captured by the camera device 100, that is, the captured image as input data, and the region containing the object, the class indicating what the object is, and the confidence level of the class as the correct label. Further, the region containing the object may be, for example, a bounding box that surrounds those regions with a rectangle on the captured image. Also, the model information 32 stores information about a segmentation model, which will be described later, for example, and model parameters for constructing the model.

[0039] The adversarial patch information 33 stores information about the adversarial patch 99, for example. The adversarial patch 99 requires a certain size relative to the size of the object in order to exert its effect on the object to be misrecognized. In other words, the minimum size of the adversarial patch 99 can be defined in advance for each object. Therefore, the adversarial patch information 33 may store, for example, the minimum size of the adversarial patch 99 for each object such as a product, and the loss rate with respect to the minimum size. The loss rate is a value indicating, for example, how much the adversarial patch 99 can be damaged to reduce the attack power of the adversarial patch 99.

[0040] Note that the above information stored in the storage unit 30 is merely an example, and the storage unit 30 can store various information other than the above information.

[0041] The control unit 40 is a processing unit that controls the entire information processing apparatus 10 and is, for example, a processor or the like. The control unit 40 includes an acquisition unit 41, a specification unit 42, a generation unit 43, and a detection unit 44. Each processing unit is an example of an electronic circuit included in the processor or an example of a process executed by the processor.

[0042] The acquisition unit 41 acquires, for example, a first value representing the size of the region of an object included in the first image captured by the camera device 100. Further, the acquisition unit 41 acquires, for example, the position of the object on the first image. The first value representing the size of the region of the object may be, for example, "200×300" indicating the width × height of the pixels in the first image. Also, the position of the object on the first image may be, for example, "(120, 130)" indicating the center coordinates of the object in the first image. Note that, for example, when there are a plurality of objects included in the first image, the first value and the position are acquired for each object. Also, the size of the region of the object may be, for example, the size of the bounding box surrounding the object region obtained from the segmentation model.

[0043] The processing using the segmentation model is a kind of image recognition processing by deep learning called, for example, image segmentation or object segmentation, etc., which divides the region for each object in the input image and recognizes the type of the object. The processing using the segmentation model includes, for example, semantic segmentation, instance segmentation, panoptic segmentation, etc. Semantic segmentation is a method of labeling each pixel of an image, and is strong for extracting amorphous shapes such as sky and road. Instance segmentation is a method of dividing the region for each object in units of object classes, and is strong for extracting cars and people, etc. Panoptic segmentation is a method that combines, for example, semantic segmentation and instance segmentation.

[0044] FIG. 9 is a diagram for explaining instance segmentation. FIG. 9 shows an example in which instance segmentation is performed on the input image shown on the left side, and regions for each object such as a person and an object are extracted. As shown on the right side of FIG. 9, in instance segmentation, even if there are a plurality of cars and a plurality of people (i.e., a plurality of objects of the same class) in the same image, regions can be extracted for each object.

[0045] Further, the acquisition unit 41 acquires the edges of an object in the first image captured by the camera device 100, for example, using an existing edge extraction algorithm such as a Canny filter. Note that the data obtained by edge extraction is, for example, a value indicating the intensity of an edge at each pixel in the image. Also, the acquisition unit 41 acquires edges, that is, edge intensities, for example, using an existing edge extraction algorithm for an initial image (hereinafter referred to as the "initial image") that was captured in advance by the camera device 100 and in which no object is shown (only the background part). The initial image and the image after the edge extraction process is performed on the initial image may be stored in advance in the image information 31 or the like, for example.

[0046] The specifying unit 42 specifies the loss rate for the adversarial patch 99 based on, for example, a second value representing the minimum size of the adversarial patch 99 obtained according to the first value acquired by the acquisition unit 41. The adversarial patch 99 is required to have a certain size relative to the size of the object in order to exert its effect on the object to be misrecognized, for example. Therefore, the minimum size of the adversarial patch 99 can be defined in advance according to the size of the object. Therefore, the specifying unit 42 acquires, for example, the minimum size of the adversarial patch 99 stored in advance for each object from the adversarial patch information 33, and specifies the loss rate for the adversarial patch 99 based on the minimum size. Also, the second value may be, for example, 50 which is 25 percent of the shorter value (width 200) of the size when the first value representing the size of the object region included in the first image is width × height "200×300", and may be width × height "50×50". Then, the specifying unit 42 specifies, for example, the loss rate defined in advance for the minimum size of the adversarial patch 99, that is, the second value. The loss rate is, for example, a value (e.g., 20%) indicating how much the adversarial patch 99 needs to be damaged to reduce the attack power of the adversarial patch 99, and is associated with the minimum size of the adversarial patch 99 and stored in advance in the adversarial patch information 33.

[0047] FIG. 10 is a diagram showing an example of defect addition according to the present embodiment. FIG. 10 is an image of three flowers, and among them, an example in which the adversarial patch 99 is superimposed on the left flower. As shown in step (1) in FIG. 10, for example, when the size of the object (left flower) is width × height “200×300”, the specific part 42 specifies the minimum size of the adversarial patch 99 as width × height “50×50”.

[0048] Returning to the description of FIG. 8, the generation unit 43 generates, for example, a second image in which defects exceeding the defect rate specified by the specific unit 42 are added to the first image captured by the camera device 100. The defect may be added, for example, within the region of the object in the first image. Further, the defects exceeding the defect rate may be randomly determined and generated as long as they exceed the defect rate. For example, when the defect rate is 20% and the second value (the minimum size of the adversarial patch 99) is width × height “50×50”, they may be a plurality of defect lines with a width of 5 pixels and an interval of 25 pixels. In this way, when the defect is a plurality of defect lines, for example, the generation unit 43 randomly determines a combination of the width of the defect line and the interval between the plurality of defect lines so as to exceed the defect rate. The shape of the defect is not limited to a straight line, and may be various shapes such as the outer periphery of a square, a rhombus, a triangle, a circle, a curve, a key line, etc., and the size such as the width corresponding to each shape, and when there are a plurality of defects, their intervals, positions, etc. may be determined so as to exceed the defect rate.

[0049] As shown in step (2) in FIG. 10, the generation unit 43 generates, for example, a plurality of defect lines with a width of 5 pixels and an interval of 25 pixels, which occupy 20% (defect rate) of the minimum size of the adversarial patch 99, i.e., width × height “50×50”, within the region of the corresponding object (left flower).

[0050] Further, the generation unit 43 may, for example, add a defect of a predetermined shape at a predetermined interval, in a predetermined direction, and with a predetermined offset, and at a position corresponding to the interval. The predetermined interval, the predetermined direction, the predetermined offset, and the position corresponding to the interval may be randomly determined within a predetermined range. Note that the direction of the defect may be, for example, the angle of the defect with respect to the horizontal direction, and may be 0°, 45°, 90°, 135°, etc. Also, the offset may be a value of 0 or more and less than or equal to the determined predetermined interval.

[0051] As shown in step (3) in FIG. 10, the generation unit 43, for example, adds a defect line with an angle of 90° and an offset of 10.

[0052] Further, the generation unit 43 may, for example, add a defect outside a predetermined range from the edge of the corresponding object acquired by the acquisition unit 41 among the first images captured by the camera device 100. More specifically, for example, the generation unit 43 calculates the difference (hereinafter referred to as "difference edge") between the edge intensity of the initial image and the edge intensity of the first image for each pixel. Then, the generation unit 43, for example, adds a defect to the first image while avoiding a portion where the difference edge is equal to or greater than a predetermined intensity (which may have a certain width). Note that, for example, if the overlapping portion between a pixel with the difference edge (non-zero) and the defect is equal to or greater than a certain number of pixels, the generation and addition of the defect may be redone from the determination of the shape of the defect, the size such as the width of the defect, and the interval and position between multiple defects if there are multiple defects. Thereby, the generation unit 43 can add a defect with less discontinuity while minimizing the overlapping portion between the vicinity of the object edge and the defect. Also, instead of the difference edge, only the edge intensity of the first image may be used so that a defect is added while avoiding the vicinity of the object edge in the first image (outside a predetermined range from the object edge). Note that the addition of the defect by the generation unit 43 is executed for each object when there are multiple objects included in the first image captured by the camera device 100.

[0053] Further, the generation unit 43 can impart defects, for example, outside the object area in the second image, at a predetermined angle, width, interval, etc. The predetermined angle, width, and interval may be, for example, 90°, 1 pixel, and 10 pixels, respectively. Note that outside the object area in the second image, for example, instead of imparting partial defects, it may be painted entirely black (i.e., all made defective).

[0054] The detection unit 44 compares, for example, a first detection result obtained by inputting a first image captured by the camera device 100 into an object detection model, and a second detection result obtained by inputting a second image generated with defects imparted by the generation unit 43 into the object detection model. Then, when the comparison result between the first detection result and the second detection result does not match, for example, the detection unit 44 notifies an alert. Note that, for example, the detection unit 44 may notify an alert when the output classes do not match in a certain number or more of the second images obtained by inputting each of a plurality of second images generated with defects having the defect rate changed step by step into the object detection model.

[0055] [Flow of processing] Next, with reference to FIG. 11, the patch detection process according to the present embodiment executed by the information processing apparatus 10 will be described along the flow. FIG. 11 is a flowchart showing an example of the flow of the patch detection process according to the present embodiment.

[0056] First, as shown in FIG. 11, the information processing apparatus 10 acquires, for example, an initial state image (initial image) in which no object is shown (only the background part) captured in advance by the camera device 100 from the image information 31 or the like (step S101). Note that when the initial image is not used when imparting defects, step S101 does not have to be executed.

[0057] Next, the information processing apparatus 10 monitors, for example, an input image queue (step S102). The input image queue may be an area where the images transmitted from the camera device 100 at any time are stored as input images in order to perform fraud detection on the images captured by the camera device 100, for example.

[0058] Next, the information processing apparatus 10 determines whether there is an input image in the input image queue, for example (step S103). If there is no input image in the input image queue (step S103: No), the process returns to step S102.

[0059] On the other hand, if there is an input image in the input image queue (step S103: Yes), the information processing apparatus 10 detects an object from the input image using, for example, a segmentation model (step S104). If a plurality of objects are detected from the input image in step S104, the processes in subsequent steps S105 to S107 are executed for each object.

[0060] Next, the information processing apparatus 10 refers to the minimum size of the adversarial patch 99 corresponding to the size of the area of the object detected in step S104 with respect to the adversarial patch information 33, for example (step S105).

[0061] Next, the information processing apparatus 10 specifies a loss rate for the adversarial patch 99 based on the minimum size of the adversarial patch 99 referred to in step S105, for example (step S106).

[0062] Next, the information processing apparatus 10 generates a loss-added image by adding a loss exceeding the loss rate specified in step S106 to the input image, for example (step S107). A more detailed flow of the loss addition process in step S107 will be described later with reference to FIG. 12.

[0063] Next, the information processing apparatus 10 determines, for example, whether there is an object that has not been processed in steps S105 to S107 among the objects detected from the input image in step S104 (step S108). If there is an object that has not been processed (step S108: Yes), the process returns to step S105, and the information processing apparatus 10 repeats steps S105 to S108, for example, until there is no unprocessed object.

[0064] On the other hand, if there is no unprocessed object (step S108: No), the information processing apparatus 10, for example, imparts a partial or overall defect outside the object region in the defect-imparted image generated in step S107 (step S109).

[0065] Next, the information processing apparatus 10 compares, for example, the detection result obtained by inputting the input image into the object detection model with the detection result obtained by inputting the defect-imparted image into the object detection model, and detects the adversarial patch 99 when the comparison result does not match (step S110). After the execution of step S110, the patch detection process shown in FIG. 11 ends.

[0066] Next, with reference to FIG. 12, the defect-imparting process according to the present embodiment executed by the information processing apparatus 10 will be described along the flow. FIG. 12 is a flowchart showing an example of the flow of the defect-imparting process according to the present embodiment. The defect-imparting process shown in FIG. 12 is an example of the details of step S107 of the patch detection process shown in FIG. 11. Further, the defect-imparting process shown in FIG. 12 is an example in the case of imparting a plurality of defect lines as defects.

[0067] First, as shown in FIG. 12, the information processing apparatus 10 determines, for example, the width and interval of the defect lines so as to exceed the defect rate specified in step S106 of the patch detection process shown in FIG. 11 (step S201).

[0068] Next, the information processing apparatus 10 randomly determines, for example, the angle and offset of the defect lines within a predetermined range (step S202).

[0069] Next, the information processing apparatus 10 extracts, for example, the edges of the input image (step S203).

[0070] Next, the information processing apparatus 10 calculates, for each pixel, the difference edge between the edge intensity of the initial image acquired in step S101 of the patch detection process shown in FIG. 11 and the edge intensity of the input image extracted in step S203 (step S204).

[0071] Next, the information processing apparatus 10, for example, avoids the vicinity of the difference edge calculated in step S204 and assigns a missing line to the input image (step S205). After the execution of step S205, the missing line assignment process shown in FIG. 12 ends, and the process proceeds to step S108 of the patch detection process shown in FIG. 11.

[0072] [Effect] As described above, the information processing apparatus 10 acquires a first value representing the size of the region of the object included in the first image, specifies a loss rate for the adversarial patch 99 based on a second value representing the minimum size of the adversarial patch 99 acquired according to the first value, generates a second image in which a loss exceeding the loss rate is added to the first image, and compares a first detection result obtained by inputting the first image into the object detection model with a second detection result obtained by inputting the second image into the object detection model.

[0073] In this way, the information processing apparatus 10 generates a second image by adding a loss exceeding the loss rate with respect to the minimum patch size corresponding to the first value, which is the size of the object detected from the first image, to the first image, and performs object detection from each of the first image and the second image. Then, the information processing apparatus 10 can improve the detection accuracy against adversarial patch attacks by comparing the object detection results of the first image and the second image.

[0074] Further, the process of generating the second image executed by the information processing apparatus 10 includes a process of generating a second image in which a loss is added within the region of the first image.

[0075] As a result, the information processing apparatus 10 can improve the detection accuracy against adversarial patch attacks.

[0076] In addition, the process of generating the second image executed by the information processing apparatus 10 includes, as a defect, a process of generating a second image in which a predetermined shape is given at a predetermined interval, in a predetermined orientation, and with a predetermined offset, and at a position corresponding to the interval.

[0077] As a result, the information processing apparatus 10 can improve the detection accuracy against adversarial patch attacks.

[0078] In addition, the information processing apparatus 10 randomly determines a predetermined interval, a predetermined orientation, a predetermined offset, and a position within a predetermined range.

[0079] As a result, the information processing apparatus 10 can take measures to predict the missing position and avoid adding a defect to the adversarial patch 99, and can improve the detection accuracy against adversarial patch attacks.

[0080] In addition, the information processing apparatus 10 acquires the edge of the object in the first image, and the process of generating the second image executed by the information processing apparatus 10 includes a process of generating a second image in which a defect is added outside a predetermined range from the edge in the first image.

[0081] As a result, the information processing apparatus 10 can delete the defect around the edge, which is a major feature for identifying the object, and can improve the detection accuracy against adversarial patch attacks.

[0082] In addition, when the comparison result between the first detection result and the second detection result does not match, the information processing apparatus 10 notifies an alert.

[0083] As a result, the information processing apparatus 10 can determine that the object is misrecognized using the adversarial patch 99, and can notify an alert that the adversarial patch 99 has been detected.

[0084] [System] The processing procedures, control procedures, specific names, and information including various data and parameters shown in the above documents and drawings may be arbitrarily changed unless otherwise specified. Also, the specific examples, distributions, numerical values, etc. described in the embodiments are merely examples and may be arbitrarily changed.

[0085] In addition, the specific forms of the distribution and integration of the components of each device are not limited to those shown in the drawings. That is, all or part of the components may be functionally or physically distributed and integrated in any unit according to various loads, usage situations, etc. Furthermore, each processing function of each device may be realized in whole or in any part thereof by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

[0086] [Hardware] FIG. 13 is a diagram for explaining a hardware configuration example of the information processing apparatus 10. As shown in FIG. 13, the information processing apparatus 10 includes a communication interface 10a, an HDD (Hard Disk Drive) 10b, a memory 10c, and a processor 10d. Also, each part shown in FIG. 13 is interconnected by a bus or the like.

[0087] The communication interface 10a is a network interface card or the like and communicates with other servers. The HDD 10b stores a program and a DB for operating the functions shown in FIG. 8.

[0088] Processor 10d is a hardware circuit that operates a process for executing each function described in FIG. 8 or the like by reading a program that executes the same processing as each processing unit shown in FIG. 8 from an HDD 10b or the like and expanding it in a memory 10c. That is, this process executes the same functions as each processing unit included in the information processing apparatus 10. Specifically, the processor 10d reads from the HDD 10b or the like a program having the same functions as an acquisition unit 41, a specification unit 42, a generation unit 43, a detection unit 44, and the like. Then, the processor 10d executes a process that executes the same processing as the generation unit 43 or the like.

[0089] As described above, the information processing apparatus 10 operates as an information processing apparatus that executes an operation control process by reading and executing a program that executes the same processing as each processing unit shown in FIG. 8. Further, the information processing apparatus 10 can also realize the same functions as those of the above-described embodiments by reading a program from a recording medium by a medium reading device and executing the read program. Note that the program in this other embodiment is not limited to being executed by the information processing apparatus 10. For example, the present embodiment may be similarly applied when another information processing apparatus executes a program, or when the information processing apparatus 10 and another information processing apparatus cooperate to execute a program.

[0090] In addition, a program that executes the same processing as each processing unit shown in FIG. 8 can be distributed via a network such as the Internet. Further, this program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, a magneto-optical disk (MO), or a digital versatile disc (DVD), and can be executed by being read from the recording medium by a computer.

Description of Reference Numerals

[0091] 1 Information processing system 10 Information processing apparatus 10a Communication interface 10b HDD 10c Memory 10d Processor 20 Communication unit 30 Storage unit 31 Image information 32 Model information 33 Adversarial patch information 40 Control unit 41 Acquisition unit 42 Identification unit 43 Generation unit 44 Detection unit 50 Network 99 Adversarial patch 100 Camera device

Claims

1. Obtain a first value representing the size of the region of the object included in the first image, Based on a second value representing the minimum size of the adversarial patch obtained according to the first value, identify the loss rate for the adversarial patch, Generate a second image by adding a loss exceeding the loss rate to the first image, Compare the first detection result obtained by inputting the first image into an object detection model with the second detection result obtained by inputting the second image into the object detection model An information processing program for causing a computer to execute the process.

2. The process of generating the second image Includes the process of generating the second image by adding the loss within the region of the first image The information processing program according to claim 1, including the process.

3. The process of generating the second image Includes the process of generating the second image by adding, as the loss, a predetermined shape at a predetermined interval, a predetermined orientation, and a predetermined offset, and at a position according to the interval The information processing program according to claim 1, including the process.

4. Randomly determine the predetermined interval, the predetermined orientation, the predetermined offset, and the position within a predetermined range The information processing program according to claim 3, for causing the computer to execute the process.

5. Obtain the edge of the object in the first image Cause the computer to execute the process, The process of generating the second image Includes the process of generating the second image by adding the loss outside a predetermined range from the edge of the first image The information processing program according to claim 1, including the process.

6. When the comparison result between the first detection result and the second detection result is inconsistent, notify an alert The information processing program according to claim 1, for causing the computer to execute the process.

7. Obtain a first value representing the size of the region of the object included in the first image, Based on a second value representing the minimum size of the adversarial patch obtained according to the first value, identify the loss rate for the adversarial patch, Generate a second image by adding a loss exceeding the loss rate to the first image, Compare the first detection result obtained by inputting the first image into an object detection model with the second detection result obtained by inputting the second image into the object detection model An information processing method, characterized in that a computer executes the process.

8. Obtain a first value representing the size of the region of the object included in the first image, Based on a second value representing the minimum size of the adversarial patch obtained according to the first value, identify the loss rate for the adversarial patch, Generate a second image in which a loss exceeding the loss rate is added to the first image, Compare a first detection result obtained by inputting the first image into an object detection model with a second detection result obtained by inputting the second image into the object detection model An information processing apparatus characterized by having a control unit that executes the process.

Images