| With the popularity of deep visual networks in safety-related scenarios such as medical diagnosis and autonomous driving,the security of visual networks has gradually become a research hotspot in the academic community.Against this backdrop,adversarial attack technology has emerged,which exposes network security vulnerabilities by generating adversarial samples that are extremely similar to the original image,providing support for defense technology research based on vulnerability remediation.However,existing adversarial attack methods have certain limitations.Firstly,most attack methods target classification networks,making it difficult to transfer to more complex target detection networks,resulting in difficulties in achieving adversarial attacks on target detection networks.Further research is needed on how to conduct adversarial attacks on target detection networks.Secondly,adversarial attack methods in physical scenarios usually generate significant adversarial perturbations,which are easily noticed by humans.How to improve the concealment of adversarial samples in physical scenarios is an important problem to be solved.The main research content of this paper focuses on the above challenges:(1)Research on adversarial attack methods for visual classification networks was carried out,and a single-target optimization function was designed to interfere with the network’s classification function.Finally,this method was validated on multiple datasets,showing that it can interfere with multiple classification networks,causing them to misclassify input images with high confidence as a pre-set category with low semantic similarity to the correct category.(2)To address the difficulty in implementing adversarial attacks on object detection networks,a multi-objective optimization function was designed that considers perturbation concealment,interference with network localization,and classification functions.The objective function includes a function term that considers concealment and constrains the L1 and L2 norms of the perturbation,concentrating the perturbation in the sensitive edge areas of the target while reducing the level of perturbation.The function term that considers interference with network functions can interfere with different functions of the network,such as classification or localization,by setting different hyperparameters.Finally,experimental comparisons showed that this method can generate concealed perturbations while reducing network detection accuracy by39.1%.(3)To address the problem of overly conspicuous adversarial perturbations in physical environments,an adversarial attack method was designed to improve the concealment of adversarial samples for target detection networks.This method uses neural style transfer to disguise the perturbations as natural textures such as rust and snow,improving their concealment in physical environments.At the same time,the Eo T(Expectation over Transformation)algorithm is used to simulate natural transformations such as viewpoint changes in physical environments while updating the perturbations,ensuring their effectiveness as adversarial samples.Finally,comparisons with existing adversarial attack methods in physical environments validated the improved concealment achieved by this method.Testing the network’s susceptibility to adversarial samples in both digital and physical environments validated the effectiveness of this method’s attacks. |
