Black-box Adversarial Attack On License Plate Recognition

License plate recognition technology is an important part of modern intelligent transportation system,which has a wide range of applications in traffic management,digital security monitoring,vehicle identification,parking management and other scenarios.The application of deep learning on license plate recognition has the advantages of fast recognition speed,high accuracy and strong generalization ability,but at the same time,the model is fragile and vulnerable to the risk of adversarial attack.For the license plate recognition model based on deep learning,the model can misrecognize license plate images with high confidence by input adversarial examples generated by superimposed certain noises.Adversarial attack methods are usually divided into white-box attack and black-box attack.Compared with the white-box attack,which requires to know internal network structure and parameters of the target network,it is more challenging to carry out the blackbox attack directly using the adversarial examples,and it is also more meaningful and valuable for research.In this paper,the adversarial attack in the license plate recognition scene is studied,and the main work and innovation points are as follows.Firstly,we use two white box attack methods,FGSM and DeepFool,respectively,to realize adversarial attack against the license plate character recognition algorithm based on Lenet-5 and the end-to-end license plate recognition algorithm based on CNN.The result shows that the recognition rate of the license plate recognition algorithm can be reduced from 95%to 52% by the two white box attack methods.Secondly,aiming at the black-box scene,use the countermeasure samples generated by the above white box attack to carry out transfer-based attack on the license plate recognition network based on Alex Net and VGG16,and the transfer success rate can reach 50%.In addition,the above license plate character recognition algorithm and end-to-end license plate recognition algorithm were attacked by One-pixel Attack black box attack method,reducing the correct rate of license plate character recognition algorithm from 98% to below6% and the end-to-end license plate recognition algorithm from 98% to below 32%.Through crossover experiments,the stability and portability of the adversarial examples generated by FGSM and DeepFool methods and the concealment of the Black-box Attack method based on One-Pixel Attack was studied.The experimental results show that the performance of several license plate recognition algorithms based on deep learning is poor,and the adversarial examples generated by white-box attack are mobile and rarely restricted by the dependence of the model architecture.In addition,the noise added to the adversarial examples is less visible than the original image.More importantly,no matter whether the attacker knows the network structure and parameters of the target,thesis method successfully attack,which poses a huge challenge to the practical application of the license plate recognition algorithm based on deep learning.