基于差分进化的可见—红外行人目标检测诱骗

至洋 胡(合肥工业大学，中国；国防科技大学电子对抗学院，中国)
颢砾 许(国防科技大学电子对抗学院，中国)
皓琪 高(国防科技大学电子对抗学院，中国)
斌 瞿(江淮前沿技术协同创新中心，中国)
梦江 邬(江淮前沿技术协同创新中心，中国)

摘要

当前研究多集中于单波段目标检测器的对抗攻击，而现实场景中多波段检测器更为实用。为更有效地评估多波段检测器的安全性，论文提出一种统一结构对抗样本（Unified Multispectral Adversarial Attack，UMAA），能同时攻击可见光和红外检测器。通过差分进化算法优化对抗样本的纹理、位置和旋转角度，生成可见光对抗样本，再灰度化生成红外对抗样本，从而对两种检测器发起攻击。实验结果表明，该方法具有显著的有效性和鲁棒性。

关键词

对抗样本；多波段目标检测器；差分进化算法

参考

Meiyan D. Mobile payment recognition technology based on face detection algorithm: Mobile Payment Recognition Technology[J]. Concurrency and Computation Practice and Experience, 2018, 30:e4655.

Badue C, Guidolini R, Carneiro R V, et al. Self-driving cars: A survey[J]. Pergamon, 2021.

Redmon J, Farhadi A. 2017. YOLO9000: Better,Faster, Stronger. In 2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI, USA, July 21-26, 2017, 6517–6525. IEEE Computer Society.

A S B, A P K R M, B Q V P, et al. Deep learning and medical image processing for coronavirus (COVID-19) pandemic: A survey[J].Sustainable Cities and Society, 2020.表 1 对抗样本的数量在可见光和红外目标检测器下的攻击效果模态评估准则n1234可见光AP（%）85.952.653.059.7ASR（%）22.350.150.856.1红外AP（%）93.679.675.266.5ASR（%）11.233.339.552.3表 2 对抗样本占目标比例的大小对可见光和红外目标检测器的攻击效果模态评估准则size（%）0.200.220.240.260.280.30可见光AP（%）88.472.973.052.654.460.2ASR（%）22.843.244.550.154.056.2红外AP（%）85.088.073.079.685.880.6ASR（%）20.120.723.333.325.629.2图 3 对抗样本在可见光和红外条件下的攻击效果图

Goodfellow I J, Shlens J, Szegedy C. Explaining and Harnessing Adversarial Examples[J].Computer Science, 2014.

Goodfellow I J, Shlens J, Szegedy C. Explaining and harnessing adversarial examples. In Proceedings of the 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR),2015:27-36.

Carlini N, Wagner D. Towards evaluating the robustness of neural networks. In Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP),2017: 39-57.

Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018.

Zhu X, Hu Z, Huang S, et al. Infrared invisible clothing: Hiding from infrared detectors at multiple angles in real world. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022.

Zhu X, Li X, Li J, et al. Fooling thermal infrared pedestrian detectors in real world using small bulbs. In: Proceedings of the AAAI Conference on Artificial Intelligence, 2021.

Zhu X, Liu Y, Hu Z, et al. Infrared Adversarial Car Stickers[J]. IEEE, 2024.

Wei X, Yu J, Huang Y. Infrared Adversarial Patches with Learnable Shapes and Locations in the Physical World[J].International Journal of Computer Vision, 2024, 132(6):1928-1944.

Hwang S, Park J, Kim N, et al. Multispectral pedestrian detection: Benchmark dataset and baseline. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2015:1037-1045.

Kim T, Yu Y, Ro Y M. Multispectral Invisible Coating: Laminated Visible-Thermal Physical Attack against Multispectral Object Detectors Using Transparent Low-E Films[J]. Proceedings of the AAAI Conference on Artificial Intelligence, 2023,37(1):1151-1159.

Winckler L. Low-Emissivity, Energy-Control, Retroft Window Film. Technical report, Cpflms Incorporated, Fieldale, VA (United States),2012.

Wei X, Huang Y, Sun Y, et al. Unified Adversarial Patch for Cross-modal Attacks in the Physical World[J]. 2023 IEEE/CVF International Conference on Computer Vision (ICCV), 2023:4422-4431.

Hu C, Shi W. (2023). Two-stage optimized unified adversarial patch for attacking visible-infrared cross-modal detectors in the physical world. ArXiv, abs/2312.01789.

Price K V. Differential evolution[M]. Handbook of Optimization. Springer, Berlin, Heidelberg, 2013.

Jia X, Zhu C, Li M, et al. LLVIP: A visible-infrared paired dataset for low-light vision[C]//Proceedings of the IEEE/CVF international conference on computer vision, 2021:3496-3504.

Jocher G, Chaurasia A, Stoken A, et al. ultralytics/yolov5: v6. 2-yolov5 classification models, apple m1, reproducibility, clearml and deci. ai integrations[J]. Zenodo, 2022.

DOI: http://dx.doi.org/10.12345/bdai.v5i8.20942