基于空间感知的多级损失目标跟踪对抗攻击方法

doi:10.11959/j.issn.1000-436x.2021208

通信学报 ›› 2021, Vol. 42 ›› Issue (11): 242-254.doi: 10.11959/j.issn.1000-436x.2021208

• 学术通信 • 上一篇

基于空间感知的多级损失目标跟踪对抗攻击方法

程旭¹^,²^,³, 王莹莹¹^,², 张年杰¹, 付章杰¹^,², 陈北京¹^,², 赵国英³

¹ 南京信息工程大学计算机学院、软件学院、网络空间安全学院，江苏南京 210044
² 南京信息工程大学数字取证教育部工程研究中心，江苏南京 210044
³ 奥卢大学机器视觉与信号分析研究中心，奥卢 FI-90014

修回日期:2021-09-26 出版日期:2021-11-25 发布日期:2021-11-01
作者简介:程旭（1983− ），男，山西太原人，博士，南京信息工程大学副教授、硕士生导师，主要研究方向为目标检测与跟踪、图像理解、对抗攻击等
王莹莹（1999− ），女，江苏盐城人，南京信息工程大学硕士生，主要研究方向为目标跟踪系统的对抗攻击
张年杰（1997− ），男，江苏泰州人，南京信息工程大学硕士生，主要研究方向为目标跟踪
付章杰（1983− ），男，河南南阳人，博士，南京信息工程大学教授、博士生导师，主要研究方向为人工智能安全、区块链安全、数字取证等
陈北京（1981− ），男，江西赣州人，博士，南京信息工程大学教授、博士生导师，主要研究方向为多媒体内容安全、彩色图像处理、模式识别等
赵国英（1977− ），女，山东聊城人，博士，奥卢大学终身教授、博士生导师，主要研究方向为视频图像处理、模式识别、智能人机交互等
基金资助:
国家自然科学基金资助项目(61802058);国家自然科学基金资助项目(61911530397);国家留学基金资助项目(201908320175);中国博士后科学基金资助项目(2019M651650);江苏省自然科学基金资助项目(BK20201267);江苏省自然科学基金资助项目(BK20200039)

Multi-level loss object tracking adversarial attack method based on spatial perception

Xu CHENG¹^,²^,³, Yingying WANG¹^,², Nianjie ZHANG¹, Zhangjie FU¹^,², Beijing CHEN¹^,², Guoying ZHAO³

¹ School of Computer Science, Nanjing University of Information Science and Technology, Nanjing 210044, China
² Engineering Research Center of Digital Forensics, Ministry of Education, Nanjing University of Information Science and Technology, Nanjing 210044, China
³ Center for Machine Vision and Signal Analysis, University of Oulu, Oulu FI-90014, Finland

Revised:2021-09-26 Online:2021-11-25 Published:2021-11-01
Supported by:
The National Natural Science Foundation of China(61802058);The National Natural Science Foundation of China(61911530397);China Scholarship Council (CSC)(201908320175);China Postdoctoral Science Foundation(2019M651650);The Natural Science Foundation of Jiangsu Province(BK20201267);The Natural Science Foundation of Jiangsu Province(BK20200039)

摘要/Abstract

摘要：

针对现有的对抗扰动技术难以有效地降低跟踪器的判别能力使运动轨迹发生快速偏移的问题，提出一种高效的攻击目标跟踪器方法。首先，所提方法从高层类别和底层特征考虑设计了欺骗损失、漂移损失和基于注意力机制的特征损失来联合训练生成器；然后，将干净图像送入该生成器中，生成对抗样本；最后，利用对抗样本干扰目标跟踪器，导致目标运动轨迹发生偏移，降低跟踪精度。实验结果表明，所提方法在 OTB 数据集上达到了54%的成功率下降和70%的精确度下降，实现了复杂场景下对目标快速有效的攻击。

关键词: 视频监控, 网络安全, 对抗攻击, 深度学习, 目标跟踪

Abstract:

In order to solve the problem that it is difficult for the existing adversarial disturbance techniques to effectively reduce the discrimination ability of the trackers and make the trajectory deviation rapidly, an effective object tracking adversarial attack method was proposed.First, deception loss, drift loss and attention mechanism-based loss was designed to jointly train generator based on the consideration of the high-level categories and the low-level features.Then, the clean image was sent to the trained generator to generate the adversarial samples that were used to interfere with the object trackers, which made the object trajectory deviation and reduced the tracking accuracy.Experimental results show that the proposed method achieves 54% reduction in success rate and 70% reduction in accuracy on OTB dataset, which can attack the object of tracking quickly in complex scenes.

Key words: video surveillance, network security, adversarial attack, deep learning, object tracking

中图分类号:

TP391

程旭, 王莹莹, 张年杰, 付章杰, 陈北京, 赵国英. 基于空间感知的多级损失目标跟踪对抗攻击方法[J]. 通信学报, 2021, 42(11): 242-254.

Xu CHENG, Yingying WANG, Nianjie ZHANG, Zhangjie FU, Beijing CHEN, Guoying ZHAO. Multi-level loss object tracking adversarial attack method based on spatial perception[J]. Journal on Communications, 2021, 42(11): 242-254.

图/表 14

图1

图2

图3

表1

表2

图4

表3

表4

表5

图5

图6

表6

表7

表8

参考文献 42

[1]	BOLME D S , BEVERIDGE J R , DRAPER B A ,et al. Visual object tracking using adaptive correlation filters[C]// Proceedings of 2010 IEEE Computer Society Conference on Computer Vision and Pattern Recognition. Piscataway:IEEE Press, 2010: 2544-2550.
[2]	HENRIQUES J F , CASEIRO R , MARTINS P ,et al. High-speed tracking with kernelized correlation filters[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2015,37(3): 583-596.
[3]	DANELLJAN M , H?GER G , SHAHBAZ K F ,et al. Accurate scale estimation for robust visual tracking[C]// Proceedings of Proceedings of the British Machine Vision Conference 2014.[S.n.:s.l.], 2014: 1-11.
[4]	LI Y , ZHU J K , HOI S C H . Reliable patch trackers:robust visual tracking by exploiting reliable patches[C]// Proceedings of 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Piscataway:IEEE Press, 2015: 353-361.
[5]	DANELLJAN M , H?GER G , KHAN F S ,et al. Learning spatially regularized correlation filters for visual tracking[C]// Proceedings of 2015 IEEE International Conference on Computer Vision (ICCV). Piscataway:IEEE Press, 2015: 4310-4318.
[6]	DANELLJAN M , ROBINSON A , SHAHBAZ K ,et al. Beyond correlation filters:learning continuous convolution operators for visual tracking[C]// Proceedings of the European Conference on Computer Vision. Berlin:Springer, 2016: 472-488.
[7]	WANG N , YEUNG D Y . Learning a deep compact image representation for visual tracking[C]// Proceedings of the Annual Conference on Neural Information Processing Systems. New York:Curran Associates, 2013: 809-817.
[8]	HONG S , YOU T , KWAK S ,et al. Online tracking by learning discriminative saliency map with convolutional neural network[C]// Proceedings of the International Conference on Machine Learning. New York:ACM Press, 2015: 597-606.
[9]	WANG L J , OUYANG W L , WANG X G ,et al. Visual tracking with fully convolutional networks[C]// Proceedings of 2015 IEEE International Conference on Computer Vision (ICCV). Piscataway:IEEE Press, 2015: 3119-3127.
[10]	MA C , HUANG J B , YANG X K ,et al. Hierarchical convolutional features for visual tracking[C]// Proceedings of 2015 IEEE International Conference on Computer Vision (ICCV). Piscataway:IEEE Press, 2015: 3074-3082.
[11]	SONG Y B , MA C , WU X H ,et al. VITAL:Visual tracking via adversarial learning[C]// Proceedings of 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway:IEEE Press, 2018: 8990-8999.
[12]	NAM H , HAN B . Learning multi-domain convolutional neural networks for visual tracking[C]// Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Piscataway:IEEE Press, 2016: 4293-4302.
[13]	BERTINETTO L , VALMADRE J , HENRIQUES J F ,et al. Fully-convolutional Siamese networks for object tracking[C]// Proceedings of the European Conference on Computer Vision. Berlin:Springer, 2016: 850-865.
[14]	LI B , YAN J J , WU W ,et al. High performance visual tracking with Siamese region proposal network[C]// Proceedings of 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway:IEEE Press, 2018: 8971-8980.
[15]	LI B , WU W , WANG Q ,et al. SiamRPN++:evolution of Siamese visual tracking with very deep networks[C]// Proceedings of 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Piscataway:IEEE Press, 2019: 4282-4291.
[16]	ZHU Z , WANG Q , LI B ,et al. Distractor-aware Siamese networks for visual object tracking[C]// Proceedings of the European Conference on Computer Vision. Berlin:Springer, 2018: 101-117.
[17]	VOIGTLAENDER P , LUITEN J , TORR P H S ,et al. Siam R-CNN:visual tracking by Re-detection[C]// Proceedings of 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Piscataway:IEEE Press, 2020: 6577-6587.
[18]	GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples[C]// Proceedings of the third International Conference on Learning Representations. Piscataway:IEEE Press, 2015: 1-11.
[19]	SEYED M , MOOSAVI D , ALHUSSEIN F ,et al. Deepfool:a simple and accurate method to fool deep neural networks[C]// Proceedings of 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Piscataway:IEEE Press, 2016: 2574-2582.
[20]	XIE C H , WANG J Y , ZHANG Z S ,et al. Adversarial examples for semantic segmentation and object detection[C]// Proceedings of 2017 IEEE International Conference on Computer Vision (ICCV). Piscataway:IEEE Press, 2017: 1369-1378.
[21]	MADRY A , MAKELOV A , SCHMIDT L ,et al. Towards deep learning models resistant to adversarial attacks[C]// Proceedings of the Sixth International Conference on Learning Representations. Piscataway:IEEE Press, 2018: 1-28.
[22]	ALEXEY K , IAN G , SAMY B . Adversarial machine learning at scale[J]. arXiv Preprint,arXiv:1611.01236, 2016.
[23]	司念文, 张文林, 屈丹 ,等. 基于对抗补丁的可泛化的 Grad-CAM攻击方法[J]. 通信学报, 2021,42(3): 23-35.
	SI N W , ZHANG W L , QU D ,et al. Generalized Grad-CAM attacking method based on adversarial patch[J]. Journal on Communications, 2021,42(3): 23-35.
[24]	SU J W , VARGAS D V , SAKURAI K . One pixel attack for fooling deep neural networks[J]. IEEE Transactions on Evolutionary Computation, 2019,23(5): 828-841.
[25]	ZHONG Y Y , DENG W H . Towards transferable adversarial attack against deep face recognition[J]. IEEE Transactions on Information Forensics and Security, 2021,16: 1452-1466.
[26]	CHEN X S , YAN X Y , ZHENG F ,et al. One-shot adversarial attacks on visual tracking with dual attention[C]// Proceedings of 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Piscataway:IEEE Press, 2020: 10176-10185.
[27]	JIA S , MA C , SONG Y B ,et al. Robust tracking against adversarial attacks[C]// Proceedings of the European Conference on Computer Vision. Berlin:Springer, 2020: 69-84.
[28]	XIAO C W , LI B , ZHU J Y ,et al. Generating adversarial examples with adversarial networks[C]// Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence.[S.l.:s.n.], 2018: 835-857.
[29]	WEI X X , LIANG S Y , CHEN N ,et al. Transferable adversarial attacks for image and video object detection[C]// Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence.[S.l.:s.n.], 2019: 1-8.
[30]	JANDIAL S , MANGLA P , VARSHNEY S ,et al. AdvGAN++:harnessing latent layers for adversary generation[C]// Proceedings of 2019 IEEE/CVF International Conference on Computer Vision Workshop (ICCVW). Piscataway:IEEE Press, 2019: 2045-2048.
[31]	DEB D , ZHANG J B , JAIN A K . AdvFaces:adversarial face synthesis[C]// Proceedings of 2020 IEEE International Joint Conference on Biometrics (IJCB). Piscataway:IEEE Press, 2020: 1-10.
[32]	BALUJA S , FISCHER I . Adversarial transformation networks:learning to generate adversarial examples[J]. arXiv Preprint,arXiv:1703.09387, 2017.
[33]	YAN B , WANG D , LU H C ,et al. Cooling-shrinking attack:blinding the tracker with imperceptible noises[C]// Proceedings of 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Piscataway:IEEE Press, 2020: 990-999.
[34]	SHARIF M , BHAGAVATULA S , BAUER L ,et al. A general framework for adversarial examples with objectives[J]. ACM Transactions on Privacy and Security, 2019,22(3): 1-30.
[35]	CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks[C]// Proceedings of 2017 IEEE Symposium on Security and Privacy (SP). Piscataway:IEEE Press, 2017: 39-57.
[36]	MOOSAVI-DEZFOOLI S M , FAWZI A , FAWZI O ,et al. Universal adversarial perturbations[C]// Proceedings of 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Piscataway:IEEE Press, 2017: 1765-1773.
[37]	DIN S U , AKHTAR N , YOUNIS S ,et al. Steganographic universal adversarial perturbations[J]. Pattern Recognition Letters, 2020,135: 146-152.
[38]	WU Y , LIM J , YANG M H . Object tracking benchmark[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2015,37(9): 1834-1848.
[39]	FAN H , LIN L T , YANG F ,et al. LaSOT:a high-quality benchmark for large-scale single object tracking[C]// Proceedings of 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Piscataway:IEEE Press, 2019: 5374-5383.
[40]	LI P X , CHEN B Y , OUYANG W L ,et al. GradNet:gradient-guided network for visual object tracking[C]// Proceedings of 2019 IEEE/CVF International Conference on Computer Vision (ICCV). Piscataway:IEEE Press, 2019: 6162-6171.
[41]	GUO Q , XIE X F , JUEFEI-XU F ,et al. SPARK:spatial-aware online incremental attack against visual tracking[C]// Proceedings of the Conference on European Conference on Computer Vision. Berlin:Springer, 2020: 202-219.
[42]	LIANG S Y , WEI X X , YAO S Y ,et al. Efficient adversarial attacks for visual object tracking[C]// Proceedings of the Conference on European Conference on Computer Vision. Berlin:Springer, 2020: 34-50.

数据集	Metric	Original	Attack S	Drop
OTB100	S(↑)	0.696	0.160	0.536
	P(↑)	0.914	0.221	0.693
VOT2018	A(↑)	0.600	0.425	0.175
	R(↓)	0.234	2.992	2.758
	EAO(↑)	0.414	0.052	0.362
LaSOT	P(↑)	0.569	0.062	0.507
	S(↑)	0.496	0.061	0.435

数据集	Metric	Original	Attack SZ	Drop
OTB100	S(↑)	0.696	0.155	0.541
	P(↑)	0.914	0.218	0.696
	A(↑)	0.600	0.395	0.205
VOT2018	R(↓)	0.234	3.030	2.796
	EAO(↓)	0.414	0.047	0.367
LaSOT	S(↓)	0.569	0.055	0.514
	Norm P(↑)	0.496	0.056	0.440

攻击方法	S(↑)	P(↑)
CSA	0.324	0.471
SPARK	0.630	0.887
FAN	0.306	0.544
本文方法	0.155	0.218

L_coarse	L _scale	L _drift	L _feature	OTB100		VOT2018
L_coarse	L _scale	L _drift	L _feature	S(↑)	P(↑)	EAO(↑)
-	-	-	-	0.696	0.914	0.414
√	-	-	-	0.421	0.587	0.099
-	√	-	-	0.443	0.642	0.149
-	-	√	-	0.587	0.791	0.159
-	-	-	√	0.470	0.655	0.142
√	√	-	-	0.349	0.491	0.073
√	√	√	-	0.302	0.423	0.061
√	√	√	√	0.160	0.221	0.047

L_coarse	L _scale	L _drift	L_feature	OTB100		VOT2018
L_coarse	L _scale	L _drift	L_feature	S(↑)	P(↑)	EAO(↑)
-	-	-	-	0.696	0.914	0.414
√	-	-	-	0.406	0.562	0.081
-	√	-	-	0.432	0.621	0.130
-	-	√	-	0.566	0.774	0.161
-	-	-	√	0.436	0.598	0.122
√	√	-	-	0.325	0.472	0.073
√	√	√	-	0.259	0.378	0.056
√	√	√	√	0.155	0.218	0.047

基于空间感知的多级损失目标跟踪对抗攻击方法

Multi-level loss object tracking adversarial attack method based on spatial perception

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 14

参考文献 42

相关文章 15

Metrics

推荐阅读 0

L_coarse	L_scale	L_drift	L_feature	OTB100
L_coarse	L_scale	L_drift	L_feature	S(↑)	P(↑)
-	-	-	-	0.651	0.855
√	-	-	-	0.314	0.463
-	√	-	-	0.346	0.544
-	-	√	-	0.591	0.796
-	-	-	√	0.306	0.439
√	√	-	-	0.263	0.406
√	√	√	-	0.134	0.168
√	√	√	√	0.098	0.154

[1]	陈东昱, 陈华, 范丽敏, 付一方, 王舰. 基于深度学习的随机性检验策略研究[J]. 通信学报, 2023, 44(6): 23-33.
[2]	赵仕祺, 黄小红, 钟志港. 基于信誉的域间路由选择机制的研究与实现[J]. 通信学报, 2023, 44(6): 47-56.
[3]	李荣鹏, 汪丙炎, 张宏纲, 赵志峰. 知识增强的语义通信接收端设计[J]. 通信学报, 2023, 44(6): 70-76.
[4]	马帅, 裴科, 祁华艳, 李航, 曹雯, 王洪梅, 熊海良, 李世银. 基于生成模型的地磁室内高精度定位算法研究[J]. 通信学报, 2023, 44(6): 211-222.
[5]	谢人超, 文雯, 唐琴琴, 刘云龙, 谢高畅, 黄韬. 轨道交通移动边缘计算网络安全综述[J]. 通信学报, 2023, 44(4): 201-215.
[6]	徐明, 张保俊, 伍益明, 应晨铎, 郑宁. 面向网络攻击和隐私保护的多智能体系统分布式共识算法[J]. 通信学报, 2023, 44(3): 117-127.
[7]	康海燕, 龙墨澜. 基于吸收马尔可夫链攻击图的网络攻击分析方法研究[J]. 通信学报, 2023, 44(2): 122-135.
[8]	郭渊博, 李勇飞, 陈庆礼, 方晨, 胡阳阳. 融合Focal Loss的网络威胁情报实体抽取[J]. 通信学报, 2022, 43(7): 85-92.
[9]	曾浩, 母王强, 杨顺平. 高机动目标跟踪ATPM-IMM算法[J]. 通信学报, 2022, 43(7): 93-101.
[10]	杨洁, 董标, 付雪, 王禹, 桂冠. 基于轻量化分布式学习的自动调制分类方法[J]. 通信学报, 2022, 43(7): 134-142.
[11]	杨秀璋, 彭国军, 李子川, 吕杨琦, 刘思德, 李晨光. 基于Bert和BiLSTM-CRF的APT攻击实体识别及对齐研究[J]. 通信学报, 2022, 43(6): 58-70.
[12]	廖勇, 王世义. 高速移动环境下基于RM-Net的大规模MIMO CSI反馈算法[J]. 通信学报, 2022, 43(5): 166-176.
[13]	廖育荣, 王海宁, 林存宝, 李阳, 方宇强, 倪淑燕. 基于深度学习的光学遥感图像目标检测研究进展[J]. 通信学报, 2022, 43(5): 190-203.
[14]	赵增华, 童跃凡, 崔佳洋. 基于域自适应的Wi-Fi指纹设备无关室内定位模型[J]. 通信学报, 2022, 43(4): 143-153.
[15]	廖勇, 程港, 李玉杰. 基于深度展开的大规模MIMO系统CSI反馈算法[J]. 通信学报, 2022, 43(12): 77-88.