CN112686249B - Grad-CAM attack method based on anti-patch - Google Patents
Grad-CAM attack method based on anti-patch Download PDFInfo
- Publication number
- CN112686249B CN112686249B CN202011528278.8A CN202011528278A CN112686249B CN 112686249 B CN112686249 B CN 112686249B CN 202011528278 A CN202011528278 A CN 202011528278A CN 112686249 B CN112686249 B CN 112686249B
- Authority
- CN
- China
- Prior art keywords
- image
- patch
- countermeasure
- confrontation
- grad
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 54
- 238000005457 optimization Methods 0.000 claims abstract description 9
- 238000004364 calculation method Methods 0.000 claims abstract description 5
- 230000006870 function Effects 0.000 claims description 34
- 238000013527 convolutional neural network Methods 0.000 description 6
- 240000001854 junco Species 0.000 description 5
- 238000013528 artificial neural network Methods 0.000 description 4
- 235000015114 espresso Nutrition 0.000 description 4
- 230000008901 benefit Effects 0.000 description 3
- 230000000694 effects Effects 0.000 description 3
- 238000012800 visualization Methods 0.000 description 3
- 230000004913 activation Effects 0.000 description 2
- 230000003044 adaptive effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 2
- 230000003042 antagnostic effect Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000010365 information processing Effects 0.000 description 2
- 230000001537 neural effect Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 238000012549 training Methods 0.000 description 2
- 230000000007 visual effect Effects 0.000 description 2
- PEDCQBHIVMGVHV-UHFFFAOYSA-N Glycerine Chemical compound OCC(O)CO PEDCQBHIVMGVHV-UHFFFAOYSA-N 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000012512 characterization method Methods 0.000 description 1
- 238000013145 classification model Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000003062 neural network model Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Images
Landscapes
- Image Analysis (AREA)
Abstract
The invention provides a Grad-CAM attack method based on anti-patch. The method comprises the following steps: step 1: initializing disturbance z, and generating a countermeasure patch on an input image x according to a set binarization mask m to obtain a countermeasure image x' containing the countermeasure patch; step 2: generating a saliency map of the challenge image x' using the Grad-CAM method; and step 3: calculating a loss function; wherein the optimization objective of the loss function comprises: matching the class of the confrontation image x' with the original class of the input image x; guiding the saliency map of the countermeasure image x' to be biased towards the region of the countermeasure patch; and 4, step 4: updating the disturbance z by using the loss function obtained by calculation to generate a new confrontation image x'; and 5: and (5) repeating the steps 2 to 4 until the set iteration number is reached, and taking the confrontation image x' at the moment as a final confrontation image.
Description
Technical Field
The invention relates to the technical field of interpretable deep learning, in particular to a Grad-CAM attack method based on anti-patch.
Background
As a very typical deep Neural Network model, interpretability and intelligibility of a Convolutional Neural Network (CNN) have important research values. The gradient-based class activation mapping (Grad-CAM) method is a good CNN interpretable method, and realizes the interpretation of the CNN decision result by highlighting the characteristic region related to the specific decision result through a saliency map.
The CNN interpretation method based on the saliency map is important for understanding the characterization and decision of CNN, and also relates to the quality of downstream tasks based on interpretability. However, recent studies have shown that such a saliency map based interpretation method is facing the risk of being attacked, and that the interpretation result of a saliency map can be always biased to a specific region by elaborated countermeasure samples, achieving an invalid interpretation even directed to intentional bias.
Document 4 ("gharbani, a, ABID, a, & zu, j.interpretation of Neural Networks is framework [ C ]. AAAI 2019: Third-Third AAAI Conference on therefor, 33(1)," 3681-3688, 2018. ") first verifies that BP (reference 1" SIMONYAN K, VEDALDI a, zissman. deep semiconductor Networks: visual analysis protocols [ J ]. arxivpirnprep, arXiv:1312.6034,2013. ") and Integrated graphics (reference 3" sports yam ", tale a, n q. audio analysis documents [ C ]. express vulnerability ] can be used to maximize the two methods of image vulnerability and image vulnerability by using a map of the two methods of image vulnerability and image vulnerability. Document 5 ("DOMBROWSKI A K, ALBER M, ANDERS C, et al. ExPLANTIONS can be manipulated and geometries to blank [ C ]. In NeurIPS 2019: third-third Conference on Neural Information Processing Systems, pp.13589-13600,2019.") further studies that interpretation features specified In The results of methods such as BP, Guided BP (reference 2 "SPRINGENBERG, TOBIAS J, DOSOVITSKIY, et al, marking. guiding for similarity: The net connected volume [ J ]. arXivPrepriarXiv: 1412.6806,2014.") and previously Integrated graphics can be made irrelevant under The constraint of specific loss functions. Document 6 ("HEO J, JOO S, MOON t. food Neural Network interpretation view adaptive Model management [ C ]. In neuroips 2019: third-third Conference on Neural Information Processing Systems, pp.2925-2936,2019.") implements an attack on the Grad-CAM interpretation result by fine-tuning the Model parameters against resistance, using the Model after parameter fine-tuning to guide the Grad-CAM interpretation result always toward a specific region without modifying the input image. In summary, documents 4 and 5 propose attack methods in which results are specifically interpreted by generating a challenge sample whose visual change is imperceptible. Although the confrontation sample has good camouflage characteristics, the confrontation sample is difficult to apply in reality. Meanwhile, documents 4 and 5 do not study the attack against the Grad-CAM method. Although document 6 does not need to add a perturbation to form a countermeasure sample, and can implement an attack on the Grad-CAM method, the adopted parameter tuning method needs to retrain the model, so that the cost of the attack is also large.
Disclosure of Invention
Aiming at the problems that the existing attack method is difficult to apply in reality and is not suitable for Grad-CAM attack or the attack cost is high, the invention provides a Grad-CAM attack method based on anti-patch.
The invention provides a Grad-CAM attack method based on anti-patch, which comprises the following steps:
step 1: initializing disturbance z, and generating a countermeasure patch on an input image x according to a set binarization mask m to obtain a countermeasure image x' containing the countermeasure patch;
step 2: generating a saliency map of the challenge image x' using the Grad-CAM method;
and step 3: calculating a loss function; wherein the optimization objective of the loss function comprises: matching the class of the confrontation image x' with the original class of the input image x; guiding the saliency map of the countermeasure image x' to be biased towards the region of the countermeasure patch;
and 4, step 4: updating the disturbance z by using the loss function obtained by calculation to generate a new confrontation image x';
and 5: and (5) repeating the steps 2 to 4 until the set iteration number is reached, and taking the confrontation image x' at the moment as a final confrontation image.
Further, in step 1, the mask value of the area where the countermeasure patch is located is set to 1, and the mask values of the remaining areas are set to 0.
Further, in step 1, a countermeasure image x' containing a countermeasure patch is obtained according to formula (1):
x′=x⊙(1-m)+z⊙m (1)
where m denotes a binarization mask, and |, denotes a Hadamard product.
Further, step 2 comprises:
calculate the logits score against image x':
(S1,…,Sc,…,SN)=f(x′;θ) (2)
wherein f represents the target network to be attacked, theta represents the weight parameter of the target network f, and ScAnd (3) representing the output score of the class c of the target network f, wherein N represents the total class number, and c is more than or equal to 1 and less than or equal to N.
Further, in step 2, a saliency map of the confrontation image x' is generated according to formula (3)
Wherein A iskA K channel of the highest-level feature map extracted from the input image x by the target network f is represented, wherein K is 1,2,3 …, and K represents the number of channels of the highest-level feature map;represents the weight of the k channel; c denotes the original class of the input image x.
Further, in step 3, an objective function designed to make the class of the confrontation image x' and the original class of the input image x coincide is formula (4):
wherein c represents the original category of the input image, f represents the target network to be attacked, theta represents the weight parameter of the target network f, z represents the disturbance, lossCERepresenting a cross entropy loss function.
Further, in step 3, an objective function for guiding the saliency map of the robust image x' to be biased to the region where the robust patch is located is designed as formula (5):
wherein,the pixel in the ith row and the jth column of the region of the saliency map where the countermeasure patch is located is represented.
Further, in step 3, a Loss function Loss is calculated according to the formula (6):
where λ represents a harmonic parameter between the two optimization objectives.
Further, in step 4, the disturbance z is updated according to the formula (7):
wherein z' represents the updated perturbation; lr represents a learning rate at the time of update; sign represents a sign function, and the value range is { +1, -1 }; loss represents a Loss function;a gradient operator is represented.
The invention has the beneficial effects that:
the method for Grad-CAM attack based on the anti-patch can generate the anti-patch and synthesize the anti-image aiming at the Grad-CAM interpretation result of the target image, guide the Grad-CAM to be biased to the patch area under the condition of ensuring that the image classification result is not changed, and realize the attack on the model interpretation result by optimizing the loss function. In addition, the invention can also generate the universal countermeasure patch by using a batch training method so as to obtain the generalized universal countermeasure patch and realize Grad-CAM attack on other pictures of the same category.
Drawings
Fig. 1 is a schematic flow chart of a method for resisting a patch-based Grad-CAM attack according to an embodiment of the present invention;
FIG. 2 is a flow chart illustrating the generation of a saliency map using Grad-CAM according to an embodiment of the present invention;
FIG. 3 is a diagram illustrating a comparison of Grad-CAM attack results on VGGNet-19-bn models provided by embodiments of the present invention;
fig. 4 is a diagram illustrating comparison of the Grad-CAM attack results on 4 different models according to the embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below with reference to the accompanying drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
An anti-Patch (adaptive Patch) is a Patch image used to attack a neural network image classification system. By adding the countercheck patch on the target image, the target image can be misclassified by the neural network classification model, and the attack on the image classification system is realized. The anti-patch has the advantages of being not limited by the disturbance norm, being capable of realizing large disturbance in a small area, having the advantage of strong practical applicability, and being generally used for anti-attack of a real scene. The invention provides a Grad-CAM attack method based on anti-patch, which uses the anti-patch method for an attack interpretation method instead of the prediction of an attack model.
Example 1
As shown in fig. 1, the present invention provides a method for resisting Grad-CAM attack based on patches, which includes:
s101: initializing disturbance z, and generating a countermeasure patch on an input image x according to a set binarization mask m to obtain a countermeasure image x' containing the countermeasure patch;
specifically, the position of the anti-patch addition can be controlled by the binary mask m, so that the guide position of the Grad-CAM in the subsequent process is controlled.
S102: generating a saliency map of the challenge image x' using the Grad-CAM method;
s103: calculating a loss function; wherein the loss function comprises two optimization objectives, which are respectively: matching the class of the confrontation image x' with the original class of the input image x; guiding the saliency map of the countermeasure image x' to be biased towards the region of the countermeasure patch;
s104: updating the disturbance z by using the loss function obtained by calculation to generate a new confrontation image x';
s105: and (5) repeating the steps S102 to S104 until the set iteration number is reached, and taking the confrontation image x' at the moment as a final confrontation image.
The Grad-CAM attack method based on the anti-patch provided by the embodiment of the invention can generate the anti-patch and synthesize the anti-image aiming at the Grad-CAM interpretation result of the target image, and attack the Grad-CAM interpretation method on the basis of not changing the image classification result, so that the position of the salient region of the target image cannot be accurately positioned, and errors occur. It can be seen that the purpose of the embodiment of the present invention using the countermeasure patch is not to mislead the image classification result, but to be used as an interpretation result of the attack interpretation method.
Example 2
On the basis of the above embodiments, the embodiment of the present invention provides another method for resisting a Grad-CAM attack based on a patch, which includes the following steps:
s201: initializing disturbance z, and generating a countermeasure patch on an input image x according to a set binarization mask m to obtain a countermeasure image x' containing the countermeasure patch;
specifically, the mask value of the area where the countermeasure patch is located is set to 1, and the mask values of the remaining areas are set to 0; then, a countermeasure image x' containing a countermeasure patch is obtained according to the formula (1):
x′=x⊙(1-m)+z⊙m (1)
where m denotes a binarization mask, and |, denotes a Hadamard product.
S202: generating a saliency map of the challenge image x' using the Grad-CAM method;
specifically, as shown in fig. 2, in the class activation graph series method, the Grad-CAM method adopted in this embodiment has a simple implementation process, is general to various networks, and has a good visualization effect. The method comprises the following steps:
first, the logits score for the confrontation image x' is calculated:
(S1,…,Sc,…,SN)=f(x′;θ) (2)
wherein f represents the target network to be attacked, theta represents the weight parameter of the target network f, and ScAnd (3) representing the output score of the class c of the target network f, wherein N represents the total class number, and c is more than or equal to 1 and less than or equal to N.
Wherein A iskA K channel of the highest-level feature map extracted from the input image x by the target network f is represented, wherein K is 1,2,3 …, and K represents the number of channels of the highest-level feature map;represents the weight of the k channel; c denotes the original class of the input image x. Wherein the channel weight is derived from the derivative of a certain class, and therefore the channel weight contains class discrimination information.
S203: calculating a loss function; wherein the loss function comprises two optimization objectives, which are respectively: matching the class of the confrontation image x' with the original class of the input image x; guiding the saliency map of the countermeasure image x' to be biased towards the region of the countermeasure patch;
specifically, the classification result of the antagonistic image using the cross entropy loss constraint in the present embodiment remains unchanged, that is: first, an objective function that makes the class of the countermeasure image x' and the original class of the input image x coincide is designed as formula (4):
wherein c represents the original category of the input image, f represents the target network to be attacked, theta represents the weight parameter of the target network f, z represents the disturbance, lossCERepresenting a cross entropy loss function;
then, an objective function for guiding the saliency map of the confrontation image x' to bias towards the region where the confrontation patch is located is designed as formula (5):
wherein,a pixel of the ith row and the jth column of the area of the saliency map where the anti-patch is located;
specifically, in this embodiment, the saliency map of the saliency image x' is biased to the region where the countermeasure patch is located by summing pixels of the region where the countermeasure patch is located in the saliency map and maximizing the summed value by updating the disturbance.
And finally, integrating the objective functions of the two optimization targets, and calculating according to a formula (6) to obtain a Loss function Loss:
where λ represents a harmonic parameter between the two optimization objectives.
S204: updating the disturbance z by using the loss function obtained by calculation to generate a new confrontation image x';
specifically, the disturbance z is updated according to equation (7):
wherein z' represents the updated perturbation; lr represents a learning rate at the time of update; sign represents a sign function, and the value range is { +1, -1 }; loss represents a Loss function;a gradient operator is represented.
S205: and repeating the steps S202 to S204 until the set iteration number is reached, and taking the confrontation image x' at the moment as a final confrontation image.
According to the Grad-CAM attack method based on the countermeasure patch, the countermeasure patch is generated in a targeted manner, the countermeasure image is synthesized, the Grad-CAM interpretation result is guided to be biased to the patch area under the condition that the image classification result is not changed, and the attack on the interpretation result is finally realized through optimizing the loss function.
In addition, the method and the device can also generate the universal countermeasure patch by using a batch training method so as to obtain the generalized universal countermeasure patch and realize Grad-CAM attack on other pictures of the same category.
In order to verify the effectiveness of the method for resisting Grad-CAM attack based on patches, the invention also provides the following experimental data.
As shown in fig. 3, the visualization results of an example image randomly selected from the ILSVRC2012 verification set and its challenge image are shown. Column 1 represents the input image, subscripts in the form of (class, classification probability); column 2 is Grad-CAM of the input image, subscript (ER)p,ERb) A value; column 3 is a confrontation image generated by processing an input image by the method of the present invention, with subscripts in the form of (category, classification probability); column 4 is Grad-CAM for the confrontational image, subscript (ER)p,ERb) The value is obtained. The ER value represents the ratio of the energy of a certain region in the saliency map to the energy of the whole saliency map. Wherein, ERpEnergy Ratio (ER) representing the area of an image patchbAn Energy value (Energy Ratio) of the picture frame area is represented. The larger the ER value, the higher the Grad-CAM is interested in this area. As can be seen from the Grad-CAM image of the resisting image, the method has good attack effect and can guide the positioning of the target to be biased to the upper left corner patch area.
As shown in fig. 4, a comparison of visualization results of example images is shown, including two input images (the input image is "junco" and is another input image "espresso"), a confrontation image of the two input images, and a Grad-CAM saliency map corresponding to the input image and the confrontation image, the 1 st column being the input image junco, the 2 nd column being the Grad-CAM of the input image junco, the 3 rd column being the confrontation image junco generated for the input image, the 4 th column being the Grad-CAM of the confrontation image junco, the 5 th column being the input image espresso, the 6 th column being the Grad-CAM of the input image espresso, the 7 th column being the confrontation image generated for the input image, and the 8 th column being the Grad-CAM of the confrontation image espresso. The results show that the method has better attack effect on Grad-CAM explanation of 4 networks, namely VGGNet-16, VGGNet-19-bn, ResNet-50 and DenseNet-161.
Finally, it should be noted that: the above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (6)
1. A method for Grad-CAM attack based on anti-patch is characterized by comprising the following steps:
step 1: initializing disturbance z, and generating a countermeasure patch on an input image x according to a set binarization mask m to obtain a countermeasure image x' containing the countermeasure patch;
step 2: generating a saliency map of the challenge image x' using the Grad-CAM method;
and step 3: calculating a loss function; wherein the optimization objective of the loss function comprises: matching the class of the confrontation image x' with the original class of the input image x; guiding the saliency map of the countermeasure image x' to be biased towards the region of the countermeasure patch; the method specifically comprises the following steps:
the objective function designed so that the class of the confrontation image x' coincides with the original class of the input image x is formula (4):
wherein c represents the original category of the input image, f represents the target network to be attacked, theta represents the weight parameter of the target network f, z represents the disturbance, lossCERepresenting a cross entropy loss function;
designing an objective function which guides the saliency map of the countermeasure image x' to be biased to the region where the countermeasure patch is located as formula (5):
wherein,a pixel of the ith row and the jth column of the area of the saliency map where the anti-patch is located;
combining the formulas (4) and (5) to obtain a final loss function formula (6), and guiding the saliency map of the confrontation image x 'to be biased to the region where the confrontation patch is located under the condition that the category of the confrontation image x' is consistent with the original category of the input image x:
wherein λ represents a harmonic parameter between the two optimization objectives;
and 4, step 4: updating the disturbance z by using the loss function obtained by calculation and generating a new confrontation image x';
and 5: and (5) repeating the steps 2 to 4 until the set iteration number is reached, and taking the confrontation image x' at the moment as a final confrontation image.
2. The method as claimed in claim 1, wherein in step 1, the mask value of the region where the countermeasure patch is located is set to 1, and the mask values of the remaining regions are set to 0.
3. The method according to claim 1, wherein in step 1, a countermeasure image x' containing a countermeasure patch is obtained according to formula (1):
x′=x⊙(1-m)+z⊙m (1)
where m denotes a binarization mask, and |, denotes a Hadamard product.
4. The method of claim 1, wherein step 2 comprises:
calculate the logits score against image x':
(S1,…,Sc,…,SN)=f(x′;θ) (2)
wherein f represents the target network to be attacked, theta represents the weight parameter of the target network f, and ScOutput score representing class c of target network fThe value, N, represents the total number of classes, 1 ≦ c ≦ N.
5. Method according to claim 4, characterized in that in step 2, a saliency map of said contrast image x' is generated according to equation (3)
Wherein A iskA K channel of the highest-level feature map extracted from the input image x by the target network f is represented, wherein K is 1,2,3 …, and K represents the number of channels of the highest-level feature map;represents the weight of the k channel; c denotes the original class of the input image x.
6. A method according to claim 1, characterized in that in step 4, the disturbance z is updated according to equation (7):
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202011528278.8A CN112686249B (en) | 2020-12-22 | 2020-12-22 | Grad-CAM attack method based on anti-patch |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202011528278.8A CN112686249B (en) | 2020-12-22 | 2020-12-22 | Grad-CAM attack method based on anti-patch |
Publications (2)
Publication Number | Publication Date |
---|---|
CN112686249A CN112686249A (en) | 2021-04-20 |
CN112686249B true CN112686249B (en) | 2022-01-25 |
Family
ID=75450532
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202011528278.8A Active CN112686249B (en) | 2020-12-22 | 2020-12-22 | Grad-CAM attack method based on anti-patch |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN112686249B (en) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113436073B (en) * | 2021-06-29 | 2023-04-07 | 中山大学 | Real image super-resolution robust method and device based on frequency domain |
CN113792806B (en) * | 2021-09-17 | 2024-08-23 | 中南大学 | Method for generating countermeasure patch |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107273870A (en) * | 2017-07-07 | 2017-10-20 | 郑州航空工业管理学院 | The pedestrian position detection method of integrating context information under a kind of monitoring scene |
CN110009679A (en) * | 2019-02-28 | 2019-07-12 | 江南大学 | A kind of object localization method based on Analysis On Multi-scale Features convolutional neural networks |
CN110188795A (en) * | 2019-04-24 | 2019-08-30 | 华为技术有限公司 | Image classification method, data processing method and device |
CN112085069A (en) * | 2020-08-18 | 2020-12-15 | 中国人民解放军战略支援部队信息工程大学 | Multi-target countermeasure patch generation method and device based on integrated attention mechanism |
CN112364915A (en) * | 2020-11-10 | 2021-02-12 | 浙江科技学院 | Imperceptible counterpatch generation method and application |
Family Cites Families (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11568183B2 (en) * | 2019-05-26 | 2023-01-31 | International Business Machines Corporation | Generating saliency masks for inputs of models using saliency metric |
-
2020
- 2020-12-22 CN CN202011528278.8A patent/CN112686249B/en active Active
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107273870A (en) * | 2017-07-07 | 2017-10-20 | 郑州航空工业管理学院 | The pedestrian position detection method of integrating context information under a kind of monitoring scene |
CN110009679A (en) * | 2019-02-28 | 2019-07-12 | 江南大学 | A kind of object localization method based on Analysis On Multi-scale Features convolutional neural networks |
CN110188795A (en) * | 2019-04-24 | 2019-08-30 | 华为技术有限公司 | Image classification method, data processing method and device |
CN112085069A (en) * | 2020-08-18 | 2020-12-15 | 中国人民解放军战略支援部队信息工程大学 | Multi-target countermeasure patch generation method and device based on integrated attention mechanism |
CN112364915A (en) * | 2020-11-10 | 2021-02-12 | 浙江科技学院 | Imperceptible counterpatch generation method and application |
Non-Patent Citations (2)
Title |
---|
"Adversarial Patch";Tom B. Brown等;《arXiv》;20180517;第1-6页 * |
"Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localization";Ramprasaath R. Selvaraju等;《arXiv》;20191206;第1-23页 * |
Also Published As
Publication number | Publication date |
---|---|
CN112686249A (en) | 2021-04-20 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN109948658B (en) | Feature diagram attention mechanism-oriented anti-attack defense method and application | |
CN109214327B (en) | Anti-face recognition method based on PSO | |
US20230186056A1 (en) | Grabbing detection method based on rp-resnet | |
CN112686249B (en) | Grad-CAM attack method based on anti-patch | |
CN110136162B (en) | Unmanned aerial vehicle visual angle remote sensing target tracking method and device | |
CN112233129B (en) | Deep learning-based parallel multi-scale attention mechanism semantic segmentation method and device | |
CN108710893B (en) | Digital image camera source model classification method based on feature fusion | |
CN110852393A (en) | Remote sensing image segmentation method and system | |
CN113674140A (en) | Physical countermeasure sample generation method and system | |
WO2022166797A1 (en) | Image generation model training method, generation method, apparatus, and device | |
CN111783551A (en) | Confrontation sample defense method based on Bayes convolutional neural network | |
CN110111346B (en) | Remote sensing image semantic segmentation method based on parallax information | |
CN117649610B (en) | YOLOv-based pest detection method and YOLOv-based pest detection system | |
CN112418032A (en) | Human behavior recognition method and device, electronic equipment and storage medium | |
CN111192206A (en) | Method for improving image definition | |
Wang et al. | Fast smoothing technique with edge preservation for single image dehazing | |
CN114240951A (en) | Black box attack method of medical image segmentation neural network based on query | |
CN116562366A (en) | Federal learning method based on feature selection and feature alignment | |
CN117576724A (en) | Unmanned plane bird detection method, system, equipment and medium | |
CN113935496A (en) | Robustness improvement defense method for integrated model | |
CN113989612A (en) | Remote sensing image target detection method based on attention and generation countermeasure network | |
CN111242839A (en) | Image scaling and cutting method based on scale grade | |
CN114444690B (en) | Migration attack method based on task augmentation | |
CN115510986A (en) | Countermeasure sample generation method based on AdvGAN | |
JP2023063768A (en) | Image descriptor update model and method using graph structure, image matching apparatus, and program |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |