一种新型的目标识别对抗攻击方法研究  

Research on a Novel Target Recognition Adversarial Attack Method

作　　者：官榕林 李秀滢[1] 张健毅 GUAN Ronglin;LI Xiuying;ZHANG Jianyi(Beijing Electronic Science and Technology Institute,Beijing 100070,P.R.China)

机构地区：[1]北京电子科技学院,北京市100070

出　　处：《北京电子科技学院学报》2023年第2期60-70,共11页Journal of Beijing Electronic Science And Technology Institute

基　　金：中央高校基本科研业务费专项资金项目(项目编号:328202264、328202241、3282023038)。

摘　　要：随着人工智能技术的广泛应用,针对机器视觉中目标识别技术的对抗攻击逐渐成为新的研究热点。当前已有的基于对抗补丁的图像攻击方法都是针对较为陈旧的目标检测器,利用这些方法去攻击新型的YOLOv5目标检测器效果很差。针对这一问题,本文以YOLOv5目标检测器为基础,提出了一种基于优化策略的目标识别对抗补丁攻击方法。该攻击方法可以根据每一轮训练图片中的目标置信度自适应地调整对抗补丁的优化权重。实验结果表明,使用该方法生成并优化的对抗补丁,对YOLO系列(包括YOLOv5)的目标检测器表现出良好的攻击效果;将其应用在海报和T恤两种现实场景中,同样具有良好的攻击效果,这说明本文提出的对抗攻击方法具有较强的实用性。With the extensive application of artificial intelligence technology,adversarial attack against the target recognition technology in machine vision has gradually become a new research focus.Existing image attack methods based on the adversarial patch all aim at relatively dated target detectors,with which,attack effect against the new YOLOv5 target detector is poor.To address this problem,an opti-mization strategy-based target recognition adversarial patch attack method on the basis of the YOLOv5 target detector is proposed in this paper,where optimization weight of the adversarial patch could be a-daptively adjusted according to the target confidence coefficient in each round of the training images.Experiment results show that generated and optimized adversarial patch using the proposed method a-chieves good attack effect against the YOLO series target detectors(including the YOLOv5).Good at-tack effects are also obtained when applied to two scenarios of the posts and the T-shirts,indicating that the adversarial attack method proposed in this paper has strong practicability.

关 键 词：对抗补丁 目标识别 YOLOv5 攻击方法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]