₀, c₁) is a coordinate of an image center, (o₀, o₁) is a coordinate of a rotation center;

the simulated image examples are obtained under respective adversarial parameters based on the false camera motion modeling, the pixel motion modeling, and the image blur modeling.

In some embodiments, the optimizing the generated simulated image examples by using an adversarial example optimization method to obtain optimal adversarial examples and corresponding adversarial parameters comprises the following steps:

(1) designing optimized functions: different optimized functions are designed for different types of adversarial image examples; wherein three types of adversarial image examples with different effects are taken into consideration: the first type is an adversarial image example with a hiding effect, which makes the depth learning algorithm unable to identify the target object; the second type is an adversarial image example with a creating effect, which creates a target object in the current image that is detectable by the deep learning algorithm; and the third type is an adversarial image example with a changing effect, which enables the deep learning algorithm to detect the target object as another object;

for the adversarial image example with a creating effect, optimization functions are:

min

a
x

,

a
y

,

a
z

,

ω
r

⁢

-

w
3

⁢

S
o
B

⁢

S
o
c

|

C
o

=
T

Σ

p
=
1

m

⁢
U
⁢
o
⁢
p

+

w
4

⁢



B
-
X



p

s
.
t
.

⁢



a
x

+

a
y

+

a
z



<

ε
1



ω
r



<

ε
2

- where o is the number of a target object to be created, C_o=T is a category of the target object to be created,

S
o
B

is a detection confidence of an area of the target object to be created outputted by the deep learning algorithm,

S
o
C

is a detection confidence of a category of the target object to be created outputted by the deep learning algorithm, p is a number of an existed object in the image, m is the number of the existed objects in the image, Uop is an intersection ratio between the area of the object o to be created and the area of the existed object p, w₃and w₄are weight values for balancing effectiveness of the adversarial image examples and example generation cost, ε₁and ε₂are upper limits of influences of an acoustic wave on readings of the accelerometer and the gyroscope respectively;

- for the adversarial image example with a changing effect, optimization functions are:

min

a
x

,

a
y

,

a
z

,

ω
r

⁢

-

w
5

⁢

Upp
′

⁢

S
p

B
⁢

⁢
′

⁢

S
p

C
⁢
′

|

C
p
′

=

T
+

w
6

⁢



B
-
X



p

s
.
t
.

⁢



a
x

+

a
y

+

a
z



<

ε
1



ω
r



<

ε
2

- where p is a number of the target object,

S
p

B
⁢
′

is a detection confidence of a modified area of the target object outputted by the deep learning algorithm,

S
p

C
⁢
″

is a detection confidence of a modified category of the target object outputted by the deep learning algorithm, C_p′=T is the modified category of the target object, Upp′ is an intersection ratio of the area of the target object p before modification and the area of the target object p′ after modification, w₅and w₆are weight values for balancing effectiveness of the adversarial image examples and example generation cost, ε₁and ε₂are upper limits of influences of an acoustic wave on readings of the accelerometer and the gyroscope respectively;

(2) solving optimized functions: the optimized functions are solved by using a Bayesian optimization method to obtain the optimal adversarial parameters.

In some embodiments, the inertial sensor reading injection method may include: determining a resonance frequency of the inertial sensor in the target machine vision system by a frequency scanning; adjusting a resonance frequency of the acoustic wave to introduce a direct current (DC) component into an analog-to-electrical converter so as to stabilize an output of the sensor; and performing an amplitude modulation to shape a waveform outputted from the sensor such that the sensor readings approximate the adversarial parameters.

With the steps, an optimal adversarial parameter for a target object can be injected into the inertial sensor of the target machine vision system by means of an acoustic wave and is used as sensor readings, which will cause an image stabilization module in the target machine vision system to operate to generate particular blurry patterns in an captured real-world image, and in turn to generate an image adversarial example in a physical world.

According to another aspect of the present application, there is provided a system for generating image adversarial examples based on an acoustic wave. The system includes: an acoustic wave-based adversary simulation module, an adversarial example optimization module, and a sensor reading injection module. The acoustic wave-based adversary simulation module is configured for false camera motion modeling, pixel motion modeling and image blur modeling; the adversarial example optimization module is configured for design of optimized functions and solution of optimized functions; and the sensor reading injection module is configured for resonance frequency determination, false reading stabilization, and false reading shaping; the system utilizes the acoustic wave-based adversary simulation module, the adversarial example optimization module and the sensor reading injection module to implement the method for generating image adversarial examples based on an acoustic wave as described above.

According to another aspect of the present application, there is provided a system for generating image adversarial examples based on an acoustic wave. The system includes: means for acquiring an image containing a target object or a target scene; means for generating simulated image examples for the acquired image by using an acoustic wave-based adversarial example simulation model, wherein the simulated image examples have adversarial effects on a deep learning algorithm in a target machine vision system; means for optimizing the generated simulated image examples by using an adversarial example optimization method to obtain optimal adversarial examples and corresponding adversarial parameters; and means for injecting the adversarial parameters into an inertial sensor of the target machine vision system in a manner of an acoustic wave by using an inertial sensor reading injection method, such that the adversarial parameters are used as sensor readings that will cause an image stabilization module in the target machine vision system to operate to generate particular blurry patterns in a generated real-world image so as to generate an image adversarial example in a physical world.

According to yet another aspect of the present application, there is provided a system for generating image adversarial examples based on an acoustic wave. The system includes: a memory for storing instructions; and a processor that executes the instructions stored in the memory to perform the method for generating image adversarial examples based on an acoustic wave as described above.

According to another aspect of the present application, there is provided a non-transitory computer-readable storage medium. The non-transitory computer-readable storage medium has instructions stored thereon, wherein the instructions, when executed by a processor, cause the processor to execute the method for generating image adversarial examples based on an acoustic wave as described above.

Compared with the existing methods for constructing an adversarial example, the method for generating image adversarial examples based on an acoustic wave provided according to the present invention has better practicability and concealment, thereby providing a novel concept for construction of an image adversarial example and providing a new guidance for safety analysis and protection of machine learning.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flowchart illustrating a method for generating image adversarial example based on an acoustic wave according to an embodiment of the present application.

FIG. 2 is a more detailed schematic diagram illustrating for generating image adversarial examples based on an acoustic wave according to an embodiment of the present application.

FIG. 3 is a block diagram illustrating a system for generating image adversarial examples based on an acoustic wave according to an embodiment of the present application.

FIG. 4 is a block diagram illustrating a computing device according to an embodiment of the present application.

DETAILED DESCRIPTION

The present application provides a method and system for generating image adversarial examples based on an acoustic wave. The method uses acoustic waves to affect readings of an inertial sensor of a machine vision system, and thus causes an image stabilization module to implement an erroneous compensation to blur an image, thereby constructing three different types of image adversarial examples.

The method makes full usage of vulnerability of an inertial sensor and a deep learning algorithms in an existing machine vision system, and innovatively proposes to use an acoustic wave to construct an image adversarial example suitable for a physical world, thereby deceiving the machine vision systems. Compared with the existing image adversarial example construction method based on a digital domain, the image adversarial example constructed by the method provided according to embodiments of the present application has stronger applicability in the real physical world; and compared with the existing image adversarial example construction method based on the physical domain, the method provided according to embodiments of the present application does not need to modify an appearance of an object or inject light into the camera, and thus has better concealment.

The present invention will be further described below with reference to the embodiments and the accompanying drawings.

FIG. 1 is a flowchart illustrating a method for generating image adversarial examples based on an acoustic wave according to an embodiment of the present application. As shown in FIG. 1, the method 100 for generating image adversarial examples based on an acoustic wave according to an embodiment of the present application includes the following steps S101-S104.

At S101, an image containing a target object or a target scene is acquired.

At S102, simulated image examples for the acquired image are generated by using an acoustic wave-based adversarial example simulation model, wherein the simulated image examples have adversarial effects on a deep learning algorithm in a target machine vision system.

At S103, the generated simulated image examples are optimized by using an adversarial example optimization method to obtain optimal adversarial examples and corresponding adversarial parameters.

S104, the adversarial parameters are injected into an inertial sensor of the target machine vision system in a manner of an acoustic wave by using an inertial sensor reading injection method, such that the adversarial parameters are used as sensor readings that will cause an image stabilization module in the target machine vision system to operate to generate particular blurry patterns in a generated real-world image so as to generate image adversarial examples in a physical world.

With the steps of the method for generating image adversarial examples based on an acoustic wave according to an embodiment of the present application, an optimal adversarial parameter for a target object can be injected into the inertial sensor of the target machine vision system by means of an acoustic wave and is used as sensor readings, which will cause an image stabilization module in the target machine vision system to operate to generate particular blurry patterns in an captured real-world image, and in turn to generate an image adversarial example in a physical world.

FIG. 2 is a more detailed schematic diagram illustrating a method for generating image adversarial examples based on an acoustic wave according to an embodiment of the present application.

As shown in FIG. 2, in some embodiments, the acoustic wave-based adversarial example simulation model is constructed by the following steps:

(1) false camera motion modeling: An existing machine vision system uses a camera to shoot a target object or scene, and then uses a deep learning algorithm to process an image to achieve perception of surrounding environment or target detection. In order to improve accuracy of the perception and detection, the existing machine vision system uses image stabilization to make compensation, thereby reducing image blurs caused by a camera shake. The image stabilization usually uses an inertial sensor such as an accelerometer and a gyroscope to estimate motion of the camera and an acoustic attack may cause the inertial sensor to have a change in its readings, an acoustic attack for a stable camera may cause the image stabilization to perform an incorrect compensation, which in turn results a blurred image. It is assumed that false readings of the inertial sensor caused by an acoustic attack is M_f={a_x, a_y, a_z, ω_r, ω_p, ω_y}, where a_x, a_y, a_zare false acceleration readings at x, y, z axes of an accelerometer, respectively, ω_r, ω_p, ω_yare false angular velocity readings at roll, pitch, yaw axes of a gyroscope, respectively, and it is assumed that the image stabilization module is operable to perform a complete compensation, and false camera motion caused by the acoustic attack is M_c={−a_x, −a_y, −a_z, −ω_r, −ω_p, −ω_y}. In the present invention, the acoustic wave-based adversarial example simulation model is constructed by four dimensions including three dimensions of x, y, z axes of the accelerometer and one dimension of roll axis of the gyroscope among the six dimensions.

(2) pixel motion modeling. The false camera motion may cause a different imaging position of the target object or the target scene, resulting in occurrence of pixel motion in an output image.

- with respect to the dimension of x axis of the accelerometer, for any pixel in the image, the false camera motion −a_xcauses a pixel displacement of

f

2
⁢
u

⁢

a
x

⁢

T
2

in an opposite direction during an imaging process, where f is a focal length of the camera and u is an object distance of the target object or the target scene, T is a exposure time of the camera;

- with respect to the dimension of y axis of the accelerometer, for any pixel in the image, the false camera motion −a_ycauses a pixel displacement of

f

2
⁢
u

⁢

a
y

⁢

T
2

in an opposite direction during the imaging process;

- with respect to the dimension of z axis of the accelerometer, for any pixel in the image, the false camera motion −a_zcauses a pixel displacement of

r
o

2
⁢
u

⁢

a
Z

⁢

T
2

in a direction far away from a center of the image during the imaging process, where r_ois a distance between the pixel and the center of the image;

- with respect to the dimension of roll axis of the gyroscope, for any pixel in the image, the false camera motion −ω_rcauses pixel displacement of ω_rTr_cin an opposite direction during the imaging process, where r_cis a distance between the pixel and a center of angular velocity rotation;

(3) image blur modeling: pixel motion during the imaging process will cause image blur, wherein false camera motion in dimensions of x axis and y axis of the accelerometer causes linear pixel motion, resulting in linear image blur; false camera in the dimension of z axis of the accelerometer causes radial pixel motion, resulting in radial image blur; and false camera motion in the dimension of roll axis of the gyroscope causes rotary pixel motion, resulting in rotary image blur; wherein a unified image blur model is constructed for the above blurs as follows:

B
⁡

(

i
,
j

)

=

1

n
+
1

⁢

∑

k
=

-
n

0

⁢

X
⁡

(

i
′

⁡

(
k
)

,

j
′

⁡

(
k
)

)

⁢

[

i
′

⁡

(
k
)

,

j
′

⁡

(
k
)

]

T

=

[

u
⁡

(
k
)

,

⁢

v
⁡

(
k
)

]

T

+

[

i
,
j

]

T

⁢

[

u
⁡

(
k
)

,

⁢

v
⁡

(
k
)

]

T

=

[

cos
⁢

⁢
α

cos
⁡

(

k
n

⁢
β

+
γ

)

cos
⁢

⁢
δ

sin
⁢

⁢
α

sin
⁡

(

k
n

⁢
β

+
γ

)

sin
⁢

⁢
δ

]

⁡

[

kf
⁢



a
x

+

a
y



⁢

T
2

2
⁢
nu

kfa
z

⁢

T
2

⁢

r
o

2
⁢
nu

]

α
=

arccos
⁡

(

a
x

·

a
y



a
x



⁢



a
y



)

⁢

⁢
β

=

ω
γ

⁢
T
⁢

⁢
γ

=

arctan
⁡

(

j
-

c
1

i
-

c
0

)

⁢

⁢
δ

=

arctan
⁡

(

j
-

0
1

i
-

0
0

)

r
c

=



(

i
,
j

)

,

⁢

(

c
0

,

c
1

)

⁢



2

r
o

=



(

i
,
j

)

,

⁢

(

o
0

,

o
1

)



2

where X is an original image, B is a blurred image, (i,j) is an coordinate of a pixel, B(i,j) is a pixel with an coordinates (i,j) in the blurred image, n is the number of discrete points, (c₀, c₁) is a coordinate of an image center, (o₀, o₁) is a coordinate of a rotation center. The simulated image examples are obtained under respective adversarial parameters based on the false camera motion modeling, the pixel motion modeling, and the image blur modeling.

As shown in FIG. 2, in some embodiments, adversarial example optimization method mainly includes the following steps:

(1) designing optimized functions: different optimized functions are designed for different types of adversarial image examples; wherein three types of adversarial image examples with different effects are taken into consideration: the first type is an adversarial image example with a hiding effect, which makes the depth learning algorithm unable to identify the target object; the second type is an adversarial image example with a creating effect, which creates a target object in the current image that is detectable by the deep learning algorithm; and the third type is an adversarial image example with a changing effect, which enables the deep learning algorithm to detect the target object as another object;

- for the adversarial image example with a hiding effect, optimization functions are:

min

a
x

,

a
y

,

a
z

,

ω
r

⁢

-

w
1

⁢

S
p
B

⁢

S
p
C

+

w
2

⁢



B
-
X



p

s
.
t
.

⁢



a
x

+

a
y

+

a
z



<

ε
1



ω
r



<

ε
2

- where p is a number of the target object,

S
p
B

is a detection confidence of an area of the target object outputted by the deep learning algorithm,

S
p
C

is a detection confidence of a category of the target object outputted by the deep learning algorithm, w₁and w₂are weight values for balancing effectiveness of the adversarial image examples and example generation cost, ε₁and ε₂are upper limits of influences of acoustic waves on readings of the accelerometer and the gyroscope respectively;

- for the adversarial image example with a creating effect, optimization functions are:

min

a
x

,

a
y

,

a
z

,

ω
r

⁢

-

w
3

⁢

S
o
B

⁢

S
o
c

|

C
o

=
T

Σ

p
=
1

m

⁢
U
⁢
o
⁢
p

+

w
4

⁢



B
-
X



p

s
.
t
.

⁢



a
x

+

a
y

+

a
z



<

ε
1



ω
r



<

ε
2

- where o is the number of a target object to be created, C_o=T is a category of the target object to be created,

S
o
B

is a detection confidence of an area of the target object to be created outputted by the deep learning algorithm,

S
o
C

is a detection confidence of a category of the target object to be created outputted by the deep learning algorithm, p is a number of an existed object in the image, m is the number of the existed objects in the image, Uop is an intersection ratio between the area of the object o to be created and the area of the existed object p, w₃and w₄are weight values for balancing effectiveness of the adversarial image examples and example generation cost, ε₁and ε₂are upper limits of influences of acoustic waves on readings of the accelerometer and the gyroscope respectively;

- for the adversarial image example with a changing effect, optimization functions are:

min

a
x

,

a
y

,

a
z

,

ω
r

⁢

-

w
5

⁢

Upp
′

⁢

S
p

B
⁢

⁢
′

⁢

S
p

C
⁢
′

|

C
p
′

=

T
+

w
6

⁢



B
-
X



p

s
.
t
.

⁢



a
x

+

a
y

+

a
z



<

ε
1



ω
r



<

ε
2