Image Attack Detection via Local-Global Consistency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current image attack detection methods are ineffective against physical attacks, as they can be easily bypassed, leading to reduced accuracy and increased security risks due to the ease with which attack regions can be generated and undetected.
Innovation Solution
The proposed method involves acquiring an image-to-be-detected, performing global classification recognition, randomly extracting local images based on a defensive rate, and fusing local classification recognition results to determine if the image is under attack, thereby improving detection accuracy by comparing the consistency of global and local recognition results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If simple pre-processing or post-processing means are used to modify pixel values, then the implementation is simple, but the defense level against physical attacks is low and accuracy is reduced
Solution Approach 1:
The patent divides the image into multiple local regions and performs classification recognition on each region separately. By segmenting the image into local parts and analyzing them individually, the system can detect attack regions that might be missed by global analysis alone, thereby improving detection accuracy while maintaining implementation feasibility.
Solution Approach 2:
The patent transitions from single-dimension global classification to multi-dimensional analysis by combining global classification results with local region classification results. This dimensional expansion allows the system to cross-validate results and identify inconsistencies that indicate physical attacks, improving accuracy without significantly complicating the implementation.
2Productivity
If global classification recognition is performed alone, then the process is simple and fast, but it is easy to be bypassed by physical attacks
Solution Approach 1:
The system performs both global classification and local region classification, segmenting the analysis into different spatial scales. This segmentation allows the system to maintain fast global processing while adding localized verification to improve security reliability against physical attacks.
Solution Approach 2:
The system uses feedback by comparing global classification results with local classification results. When inconsistencies are detected between global and local analyses, the system can identify potential physical attacks, thereby improving security reliability while maintaining efficient processing through the feedback mechanism.
3Measurement precision
If local image extraction is performed randomly with calculated target number, then detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent dynamically determines the number of local images to extract based on a calculated target number rather than using a fixed number. This dynamic approach allows the system to adapt the computational complexity to the specific detection needs, improving accuracy when necessary while reducing unnecessary computations when attacks are less likely.
Solution Approach 2:
The system changes the parameter of local image extraction by using a calculated target number that can be adjusted based on detection requirements. This parameter change allows optimization between detection accuracy and computational complexity, enabling the system to achieve high accuracy without always requiring maximum computational resources.
Data Source
AI summary
An image attack detection method includes: acquiring an image-to-be-detected, and performing global classification recognition based on the image-to-be-detected to obtain a global classification recognition result; performing local image extraction randomly based on the image-to-be-detected to obtain a target number of local images, the target number being obtained by calculation according to a defensive rate of a reference image corresponding to the image-to-be-detected; performing local classification recognition based on the target number of local images respectively to obtain respective local classification recognition results, and fusing the respective local classification recognition results to obtain a target classification recognition result; and detecting a similarity between the target classification recognition result and the global recognition result, and determining the image-to-be-detected as an attack image when the target classification recognition result and the global classification recognition result are dissimilar.