CN110263674B - Anti-reconnaissance camouflage 'invisible clothes' generation method for deep pedestrian re-identification system - Google Patents

Anti-reconnaissance camouflage 'invisible clothes' generation method for deep pedestrian re-identification system Download PDF

Info

Publication number
CN110263674B
CN110263674B CN201910473196.9A CN201910473196A CN110263674B CN 110263674 B CN110263674 B CN 110263674B CN 201910473196 A CN201910473196 A CN 201910473196A CN 110263674 B CN110263674 B CN 110263674B
Authority
CN
China
Prior art keywords
pedestrian
identification system
noise
camera
camouflage
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201910473196.9A
Other languages
Chinese (zh)
Other versions
CN110263674A (en
Inventor
王志波
郑思言
宋梦凯
王骞
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Wuhan University WHU
Original Assignee
Wuhan University WHU
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Wuhan University WHU filed Critical Wuhan University WHU
Priority to CN201910473196.9A priority Critical patent/CN110263674B/en
Publication of CN110263674A publication Critical patent/CN110263674A/en
Application granted granted Critical
Publication of CN110263674B publication Critical patent/CN110263674B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/74—Image or video pattern matching; Proximity measures in feature spaces
    • G06V10/75—Organisation of the matching processes, e.g. simultaneous or sequential comparisons of image or video features; Coarse-fine approaches, e.g. multi-scale approaches; using context analysis; Selection of dictionaries
    • G06V10/751—Comparing pixel values or logical combinations thereof, or feature values having positional relevance, e.g. template matching
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/20—Movements or behaviour, e.g. gesture recognition
    • G06V40/23—Recognition of whole body movements, e.g. for sport training

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Artificial Intelligence (AREA)
  • Health & Medical Sciences (AREA)
  • Evolutionary Computation (AREA)
  • Data Mining & Analysis (AREA)
  • General Health & Medical Sciences (AREA)
  • Human Computer Interaction (AREA)
  • General Engineering & Computer Science (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Psychiatry (AREA)
  • Social Psychology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • Image Processing (AREA)
  • Image Analysis (AREA)

Abstract

The invention discloses a method for generating an anti-reconnaissance camouflage 'invisible clothes' for a deep pedestrian re-identification system, which provides a matching difference minimization optimization method and combines multi-position sampling to generate noise patterns which are variable across cameras and extensible in position, so that the same noise patterns can not be mutually matched at any position of a monitoring area of the pedestrian re-identification system under the shooting of different cameras and are all wrongly matched with a specific user. In addition, the method integrates physical environment factors into the noise pattern generation process, and improves the robustness of information loss of noise in the printing and shooting processes. The anti-reconnaissance camouflage 'invisible clothes' generated by the method can prevent the pedestrian re-identification system from correctly searching and positioning the attacker, and deceive the system to match the attacker with a preset specific user.

Description

Anti-reconnaissance camouflage 'invisible clothes' generation method for deep pedestrian re-identification system
Technical Field
The invention relates to the field of artificial intelligence safety, in particular to a method for generating an anti-reconnaissance camouflage 'invisible coat' for a deep pedestrian re-identification system.
Background
With the rapid development of the mobile internet, the continuous upgrade of hardware equipment, the production of mass data and the update of algorithms, the development of Artificial Intelligence (AI) is overwhelming, and human lives are gradually penetrated and deeply changed. At present, artificial intelligence technology based on machine learning and deep learning is widely applied to various fields such as human-computer interaction, vision processing systems, recommendation systems, security diagnosis and protection, and application scenarios thereof include unmanned driving, image recognition, malware detection, malicious mail filtering and the like. It can be said that the arrival of the era of artificial intelligence and the development of data computing and storing capabilities have promoted various field changes. Pedestrian re-identification is a task of matching people of interest under cross-camera, and has wide application in the fields of video surveillance and security, such as suspect and missing person search, cross-camera pedestrian tracking, pedestrian activity analysis, and the like. In recent years, with the rapid development of deep learning technology, a pedestrian re-recognition system based on a deep neural network has achieved a pedestrian matching level close to that of human beings, and is gradually becoming a mainstream method.
However, recent studies have shown that deep neural networks are vulnerable to specific attacks: the input image is added with well-constructed noise which is difficult to be perceived by human beings, so that the deep neural network is induced to work in an abnormal mode, and potential threats such as face recognition, unmanned driving, malicious software detection and the like are formed to various applications based on the deep neural network. Due to the wide deployment and application of the pedestrian re-identification system in the security system, it is important to research whether the deep pedestrian re-identification system is easy to attack. Once a deep pedestrian re-identification system is vulnerable to a particular attack, serious consequences and security threats can arise, for example, criminals can evade the search and location of law enforcement, or spys can invade a monitored confidential area.
Disclosure of Invention
The invention aims to overcome the limitations of the prior art and provides a method for generating an anti-reconnaissance camouflage 'invisible clothes' for a deep pedestrian re-identification system.
The invention discloses a method for generating an anti-reconnaissance camouflage 'invisible clothes' for a deep pedestrian re-identification system, which is characterized by comprising the following steps:
1) setting a specific user which an attacker wants to match to a given pedestrian re-identification system with white-box access authority;
2) constructing a photo group of an attacker under each camera, designing a noise pattern generation method based on multi-position sampling, and generating a noise pattern with an extensible position;
3) the cross-camera variable noise pattern generation method based on the minimized matching difference enables the cross-camera attacker images to be far away from each other and cannot be matched by a pedestrian re-identification system, and enables the noisy images to be matched with a specific user in an error mode;
4) physical environment factors are blended into a noise pattern generation process, and the noise pattern is printed and attached to clothes, so that the pedestrian re-identification system is attacked in a real scene.
Further, the specific process of constructing the picture group of the attacker under each camera is as follows:
the method comprises the steps of collecting a large number of photos of attackers taken at different positions under a monitoring camera, and carrying out basic image transformation on each taken photo to obtain a composite photo, wherein the photos jointly form a noise generation set.
Further, the specific process of step 3) is as follows:
iteratively searching for a variable noise pattern across cameras by solving an optimization problem of minimization of matching similarity of attacker photos taken across cameras; in particular, for pictures taken from m groups of cameras, and for pictures I taken from a particular usertThe following optimization problems are solved:
Figure BDA0002081345040000021
wherein the target pedestrian re-recognition system is denoted as fθ(x, y) sc, wherein x is an image which needs to be inquired by the system, y is a pedestrian photo collected by other cameras, and theta is a model parameter; x'iAdding the noise delta to the x-ray image through the image transformation consistent with the shot person iiThe above is obtained;
wherein each iteration generates a set from noise and a user-specific photo set ItRandomly selecting photos to form quadruple
Figure BDA0002081345040000022
Figure BDA0002081345040000023
Two pictures of an attacker under the same camera,
Figure BDA0002081345040000024
a picture of the attacker at the other camera, ItFor one picture in the group of pictures taken by the particular user, the cross-camera variable noise pattern generation method based on minimization of matching differences solves the following optimization problem:
Figure BDA0002081345040000025
the generated noise has the ability to make the difference between the features extracted from the camera photos smaller and smaller, while making the difference between the features extracted across the camera photos larger and closer to the features of the particular user photo.
Still further, the number of iterations is set to 750 times, or less than 750 times of convergence, i.e., the iterations are completed.
Further, a smoothing and regularizing term is added in the step 4):
TV(δ)＝∑i,j((δi,j-δi+1,j)2+(δi,j-δi,j+1)2)。
further, in the step 4), the noise value is converted into a printer color value range for printing.
Further, adding a random image degradation function in the step 4)
Figure BDA0002081345040000031
Making the noise highly robust against information loss.
Compared with the prior art, the invention has the following beneficial effects:
1) a novel camouflage countercheck method facing a deep pedestrian re-identification system is provided, and anti-reconnaissance camouflage of the target pedestrian re-identification system is completed by generating a 'invisible coat'.
2) An optimization method based on matching difference minimization is provided, and noise patterns which are variable across cameras are generated, cannot be matched with each other under the shooting of different cameras, and are matched with specific users.
3) In the noise pattern generation process, a multi-position sampling strategy is considered, and the generated noise can achieve an attack effect at any position of a monitoring area.
4) In order to improve the robustness of the physical world of the noise pattern, the method integrates physical environment factors into the noise pattern generation process, so that the noise pattern generation process is still effective after information is lost in the printing and shooting process.
Drawings
FIG. 1 is a frame of a method for generating anti-reconnaissance camouflage 'invisible clothes' for a deep pedestrian re-identification system
FIG. 2 is a schematic diagram of disguised attack of a deep pedestrian re-identification system
FIG. 3 is a disguised attack example of a deep pedestrian re-identification oriented system
Detailed Description
The invention considers that the safety problem of deep pedestrian re-identification still does not receive attention, and potential safety threat can be brought when the method is widely applied, so that a generation method of anti-reconnaissance camouflage 'invisible clothes' facing a deep pedestrian re-identification system is urgently needed.
The anti-reconnaissance camouflage 'invisible clothes' generation method for the deep pedestrian re-identification system comprises the following steps:
1) given a pedestrian re-identification system, a query image is input, and the system outputs the similarity and similarity ranking between the images shot under other cameras and the query image. An attacker can access the parameters and weights of the target model and set the specific users that the attacker wants to match to.
The target pedestrian re-identification system may be denoted as fθAnd (x, y) ═ sc, wherein x is the image to be queried by the system, y is the photos of the pedestrian collected by other cameras, theta is the model parameter, and sc is the output of the system, namely the similarity score of a group of photos (x, y) to be matched. The inquired photos are matched with the photo groups G collected by the system under other cameras one by one, and the photos with the highest similarity are output as the final matching result, namely:
Y＝{y1,y2,…,yK}s.tψ(fθ(x,yi))<K
where K is the number of photos with the highest matching score for the output set by the system, and ψ (-) sorts the collected groups of photos from high to low according to the matching score. An attacker takes a trained pedestrian re-recognition system based on a neural network as an attack target, has white-box access authority on a target model, namely parameters and weights capable of accessing the target model, and sets a specific user in the system, so that the attacker is mistakenly matched into the specific user by the system when being inquired.
2) An attacker collecting picture group and a synthetic picture group are constructed, a noise pattern generation method based on multi-position sampling is designed, a noise pattern with an extensible position is generated, and an attack effect can be achieved at any position of a monitoring area.
Forming a noise generation set XcThe method specifically comprises the following steps: the method comprises the steps of collecting a plurality of photos of attackers taken at different positions under a monitoring camera, and carrying out basic image transformation on each taken photo to obtain a composite photo. The composite photograph includes the image obtained by translation, scaling, and brightness transformation.
In the embodiment, the component noise generation set specifically includes that 50 sampling points with different distances and angles are arranged below each camera, and 10 shot pictures are collected at each sampling point; for each captured picture, 5 basic image transformations were randomly selected to generate 5 composite pictures. For one attack, a total of 3000 photos of the synthetic set were constructed.
3) The cross-camera variable noise pattern generation method based on the minimized matching difference enables attacker images under the cross-camera to be far away from each other and cannot be matched by a pedestrian re-recognition system, and enables noisy images to be matched with specific users in an error mode.
Variable noise patterns across the cameras are iteratively found by solving an optimization problem of minimization of matching similarity of aggressor photos taken across the cameras. In particular, for pictures taken from m groups of cameras, and for pictures I taken from a particular usertThe following optimization problems are solved:
Figure BDA0002081345040000051
wherein x'iAdding the noise delta to the x-ray image through the image transformation consistent with the shot person iiObtained as above. In the optimization process, the noise pattern learns the difference between the shapes and the styles of the shot persons under the cross-camera to improve the attack ability of the shot persons, so that the difference between the extracted characteristics of the pictures shot by the shot persons under the cross-camera is increased until the pictures can not be matched with each other correctly and are matched with the pictures of specific users.
Randomly selecting two photos under the same camera in a generated set each time
Figure BDA0002081345040000052
And a picture of other cameras
Figure BDA0002081345040000053
And specifies the set of photographs I taken by the user at the set systemtRandomly selecting a photo tiTo form a quadruple QiThe method is based on a multi-position sampling strategy and adopts a plurality of groups of different QiThe noise pattern is optimized in an iterative mode, and noise delta generated by optimizing a plurality of groups of photos shot at different positions and synthesized can be shot at any position of a monitored area to finish anti-reconnaissance and camouflage attack. XcWill be used to solve the optimization problem of generating noise patterns, from X for each iterationcAnd user-specific photo album ItRandomly selecting photos to form quadruple
Figure BDA0002081345040000054
The generated noise pattern can be made valid at any position of the monitored area by different quadruples. Combining the multi-position-based sampling strategy with the optimization problem, a noise pattern which satisfies the multi-position extensible and variable across cameras can be generated:
Figure BDA0002081345040000055
wherein λ is1And λ2The parameters are hyper-parameters and are used for controlling the influence degree of different optimization items on a final result, and in a specific experiment, lambda is taken1＝0.25，λ1A noise pattern is generated at 0.2. The generated noise has the ability to make the difference between the features extracted from the camera photos smaller and smaller, while making the difference between the features extracted across the camera photos larger and closer to the features of the particular user photo. By selecting the photos at different positions in the generated set and with different synthesis methods, the noise pattern can be made to be equally effective for photos taken at positions that are not "seen". Noise was generated with an ADAM optimizer with the parameters set as follows: learning rate of 0.01, beta1＝0.9，β2＝0.999。
4) The method is characterized in that printing and shooting errors in the physical world are considered, physical environment factors are integrated into a noise pattern generation process, a high-robustness noise pattern is generated, and a 'stealth coat' is printed and attached to attack a pedestrian re-identification system in a real scene.
The influence of noise pattern activity in the printing and shooting processes is considered, physical environment factors are blended into the noise pattern generation process, and a high-robustness noise pattern is generated, so that the pedestrian re-identification system can be subjected to anti-reconnaissance camouflage attack by noise printing and attaching to clothes of an attacker. Firstly, in order to make the generated noise look naturally smooth as the clothes pattern looks like, the method adds a smoothing regularization term to the optimization problem:
Figure BDA0002081345040000061
the regularization term is added to the optimization equation where the coefficient β is 0.001. The method improves the smoothness of the noise by minimizing the difference between the values of the adjacent pixels of the noise pattern, so that an attacker cannot cause doubt when wearing the invisible clothes. The printable color range is then determined
Figure BDA0002081345040000062
And the value range of the noise
Figure BDA0002081345040000063
Errors caused by printing are eliminated; finally, due to the environmental condition in the shooting process and the loss of information caused by shooting noise of camera equipment, the method adds a random image degradation function in the noise generation process
Figure BDA0002081345040000064
Making the noise highly robust against information loss. In the present embodiment, the first and second electrodes are,
the invention has the advantages that:
1) a novel camouflage countercheck method facing a deep pedestrian re-identification system is provided, and anti-reconnaissance camouflage of the target pedestrian re-identification system is completed by generating a 'invisible coat'.
2) An optimization method based on matching difference minimization is provided, and noise patterns which are variable across cameras are generated, cannot be matched with each other under the shooting of different cameras, and are matched with specific users.
3) In the noise pattern generation process, a multi-position sampling strategy is considered, and the generated noise can achieve an attack effect at any position of a monitoring area.
4) In order to improve the robustness of the physical world of the noise pattern, the method integrates physical environment factors into the noise pattern generation process, so that the noise pattern generation process is still effective after information is lost in the printing and shooting process.

Claims (7)

1. A method for generating an anti-reconnaissance camouflage 'invisible coat' for a deep pedestrian re-identification system is characterized by comprising the following steps:
1) setting a specific user which an attacker wants to match to a given pedestrian re-identification system with white-box access authority;
2) constructing a photo group of an attacker under each camera, designing a noise pattern generation method based on multi-position sampling, and generating a noise pattern with an extensible position;
3) the cross-camera variable noise pattern generation method based on the minimized matching difference enables the cross-camera attacker images to be far away from each other and cannot be matched by a pedestrian re-identification system, and enables the noisy images to be matched with a specific user in an error mode;
4) physical environment factors are blended into a noise pattern generation process, and the noise pattern is printed and attached to clothes, so that the pedestrian re-identification system is attacked in a real scene.
2. The method for generating the anti-spy camouflage 'invisible clothes' for the deep pedestrian re-identification system according to claim 1, wherein the method comprises the following steps: the specific process of constructing the picture group of the attacker under each camera is as follows:
the method comprises the steps of collecting a large number of photos of attackers taken at different positions under a monitoring camera, and carrying out basic image transformation on each taken photo to obtain a composite photo, wherein the photos jointly form a noise generation set.
3. The method for generating the anti-spy camouflage 'invisible clothes' for the deep pedestrian re-identification system according to claim 2, wherein the method comprises the following steps: the specific process of the step 3) is as follows:
iteratively searching for a variable noise pattern across cameras by solving an optimization problem of minimization of matching similarity of attacker photos taken across cameras; in particular, for pictures taken from m groups of cameras, and for pictures I taken from a particular usertThe following optimization problems are solved:
Figure FDA0003436756180000011
wherein the target pedestrian re-recognition system is denoted as fθ(x, y) sc, wherein x is an image which needs to be inquired by the system, y is a pedestrian photo collected by other cameras, theta is a model parameter, and sc is the output of the system; x'iThe noise delta is added to the upper x by an image transformation which is consistent with the shot person iiObtained as above；
Wherein each iteration generates a set from noise and a user-specific photo set ItRandomly selecting photos to form quadruple
Figure FDA0003436756180000012
Figure FDA0003436756180000013
Two pictures of an attacker under the same camera,
Figure FDA0003436756180000014
a picture of the attacker at the other camera, ItFor one picture in the group of pictures taken by the particular user, the cross-camera variable noise pattern generation method based on minimization of matching differences solves the following optimization problem:
Figure FDA0003436756180000021
the generated noise has the ability to make the difference between the features extracted from the camera photos smaller and smaller, while making the difference between the features extracted across the camera photos larger and closer to the features of the particular user photo.
4. The method for generating the anti-spy camouflage 'invisible clothes' for the deep pedestrian re-identification system according to claim 3, wherein the method comprises the following steps: the number of iterations is set to 750 times, or the iterations are completed when convergence in 750 times is less than.
5. The method for generating the anti-spy camouflage 'invisible clothes' for the deep pedestrian re-identification system according to claim 2, wherein the method comprises the following steps: adding a smooth regular term in the step 4):
TV(δ)＝∑i,j((δi,j-δi+1,j)2+(δi,j-δi,j+1)2)。
6. the method for generating the anti-spy camouflage 'invisible clothes' for the deep pedestrian re-identification system according to claim 2, wherein the method comprises the following steps: and 4) converting the noise value into a printer color value range for printing in the step 4).
7. The method for generating the anti-spy camouflage 'invisible clothes' for the deep pedestrian re-identification system according to claim 2, wherein the method comprises the following steps: adding a random image degradation function into the step 4)
Figure FDA0003436756180000022
Making the noise highly robust against information loss.
CN201910473196.9A 2019-05-31 2019-05-31 Anti-reconnaissance camouflage 'invisible clothes' generation method for deep pedestrian re-identification system Active CN110263674B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910473196.9A CN110263674B (en) 2019-05-31 2019-05-31 Anti-reconnaissance camouflage 'invisible clothes' generation method for deep pedestrian re-identification system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910473196.9A CN110263674B (en) 2019-05-31 2019-05-31 Anti-reconnaissance camouflage 'invisible clothes' generation method for deep pedestrian re-identification system

Publications (2)

Publication Number Publication Date
CN110263674A CN110263674A (en) 2019-09-20
CN110263674B true CN110263674B (en) 2022-02-15

Family

ID=67916439

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910473196.9A Active CN110263674B (en) 2019-05-31 2019-05-31 Anti-reconnaissance camouflage 'invisible clothes' generation method for deep pedestrian re-identification system

Country Status (1)

Country Link
CN (1) CN110263674B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113870095B (en) * 2021-06-25 2022-12-20 中国人民解放军陆军工程大学 Deception target reconnaissance system method based on camouflage patch camouflage

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108491785A (en) * 2018-03-19 2018-09-04 网御安全技术（深圳）有限公司 A kind of artificial intelligence image identification attack defending system

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120069197A1 (en) * 2010-09-16 2012-03-22 Stephen Michael Maloney Method and process of making camouflage patterns
JP2019079374A (en) * 2017-10-26 2019-05-23 株式会社Ｐｒｅｆｅｒｒｅｄ Ｎｅｔｗｏｒｋｓ Image processing system, image processing method, and image processing program

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108491785A (en) * 2018-03-19 2018-09-04 网御安全技术（深圳）有限公司 A kind of artificial intelligence image identification attack defending system

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
Protecting Trajectory From Semantic Attack Considering k-Anonymity,l-Diversity, and t-Closeness;Zhen Tu等;《IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT》;20190331;第16卷(第1期);第264-278页 *
基于深度学习的行人再识别研究综述;徐梦洋;《计算机科学》;20181031;第45卷(第10A期);第119-122页 *

Also Published As

Publication number Publication date
CN110263674A (en) 2019-09-20

Similar Documents

Publication Publication Date Title
Meng et al. Magnet: a two-pronged defense against adversarial examples
Athalye et al. Synthesizing robust adversarial examples
Sharif et al. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition
Deb et al. Advfaces: Adversarial face synthesis
US11657525B2 (en) Extracting information from images
Pinto et al. Face spoofing detection through visual codebooks of spectral temporal cubes
Wang et al. advpattern: Physical-world attacks on deep person re-identification via adversarially transformable patterns
US11941918B2 (en) Extracting information from images
JP5127067B2 (en) Image search apparatus and image search method
Gragnaniello et al. Analysis of adversarial attacks against CNN-based image forgery detectors
Chen et al. Appending adversarial frames for universal video attack
CN114758198A (en) Black box attack method and system for resisting disturbance based on meta-learning
Li et al. DeepBlur: A simple and effective method for natural image obfuscation
Housam et al. Face spoofing detection based on improved local graph structure
Treu et al. Fashion-guided adversarial attack on person segmentation
CN115640609A (en) Feature privacy protection method and device
CN110263674B (en) Anti-reconnaissance camouflage &#39;invisible clothes&#39; generation method for deep pedestrian re-identification system
Li et al. Detecting adversarial patch attacks through global-local consistency
Bashier et al. Face spoofing detection using local graph structure
Zhou et al. Only once attack: fooling the tracker with adversarial template
Liang et al. Poisoned forgery face: Towards backdoor attacks on face forgery detection
CN110428023B (en) Anti-reconnaissance escape attack method for deep pedestrian re-identification system
Nguyen et al. Physical Adversarial Attacks for Surveillance: A Survey
CN111104982B (en) Label-independent cross-task confrontation sample generation method
CN115017501A (en) Image anti-attack sample detection method and system based on uncertainty estimation

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant