电子学报

• •    

基于重要特征的视觉目标跟踪可迁移黑盒攻击方法

姚睿1,2,3, 朱享彬1,2, 周勇1,2, 王鹏3,4, 张艳宁3,4, 赵佳琦1,2   

  1. 1.中国矿业大学计算机科学与技术学院, 江苏 徐州 221116
    2.矿山数字化教育部工程研究中心, 江苏 徐州 221116
    3.空天地海一体化大数据应用技术国家工程实验室, 陕西 西安 710129
    4.西北工业大学计算机学院, 陕西 西安 710129
  • 收稿日期:2022-01-10 修回日期:2022-07-07 出版日期:2023-03-13
    • 作者简介:
    • 姚睿 男,1982年出生,河南南阳人.现为中国矿业大学计算机科学与技术学院教授、博士生导师.主要研究方向为计算机视觉、机器学习.E-mail: ruiyao@cumt.edu.cn
      朱享彬 男,1997年出生,江西赣州人.现为中国矿业大学计算机科学与技术学院硕士研究生.主要研究方向为计算机视觉、机器学习. E-mail: TS20170131P31@cumt.edu.cn
      周勇 男,1974年出生,江苏徐州人.现为中国矿业大学计算机科学与技术学院教授、博士生导师.主要研究方向为机器学习、数据挖掘.E-mail: yzhou@cumt.edu.cn
    • 基金资助:
    • 国家自然科学基金(62172417);江苏省自然科学基金(BK20201346)

Transferable Black Box Attack on Visual Object Tracking Based on Important Features

YAO Rui1,2,3, ZHU Xiang-bin1,2, ZHOU Yong1,2, WANG Peng3,4, ZHANG Yan-ning3,4, ZHAO Jia-qi1,2   

  1. 1.School of Computer Science and Technology,China University of Mining and Technology,Xuzhou,Jiangsu 221116,China
    2.Ministry of Education Engineering Research Center of Mine Digitization,Xuzhou,Jiangsu 221116,China
    3.National Engineering Laboratory for Integrated Aero-Space-Ground-Ocean Big Data Application Technology,Xi’an,Shaanxi 710129,China
    4.School of Computer Science,Northwestern Polytechnical University,Xi’an,Shaanxi 710129,China
  • Received:2022-01-10 Revised:2022-07-07 Online:2023-03-13
    • Supported by:
    • National Natural Science Foundation of China(62172417);Natural Science Foundation of Jiangsu Province(BK20201346)

摘要:

针对目标跟踪的黑盒攻击受到越来越多的关注,来对目标跟踪器的稳健性进行评估.目前大部分的研究都是基于查询的黑盒攻击,尽管取得较好的攻击效果,但在实际应用中往往不能获取大量的查询以进行攻击.本文提出一种基于迁移的黑盒攻击方法,通过对特征中与跟踪目标高度相关而不受源模型影响的重要特征进行攻击,将其重要程度降低,同时增强不重要的特征以实现具有可迁移性的攻击;即通过反向传播获得的所对应的梯度来体现其特征的重要程度,随后通过梯度得到的加权特征以进行攻击.此外,本文使用视频相邻两帧之间相似这一时序信息,提出基于时序感知的特征相似性攻击方法,通过减小相邻帧之间的特征相似度以进行攻击.本文在目前主流的深度学习目标跟踪器上评估了提出的攻击方法,在多个数据集上的实验结果证明了本文方法的有效性及强可迁移性,在OTB数据集中,SiamRPN跟踪模型被攻击后跟踪成功率以及精确度分别下降了71.5%、79.9%.

关键词: 对抗攻击, 视觉目标跟踪, 黑盒攻击, 可迁移性, 重要特征, 特征相似性

Abstract:

Black-box attacks against object tracking are receiving more and more attention to evaluate the robustness of object trackers. Most of the current researches are based on query-based black-box attacks. Although great attack effects are achieved, a large number of queries cannot be obtained for attack in practical application. We propose a transfer based black-box attack method, which attacks the important features in the features that are highly related to the tracking target and are not affected by the source model, reduces their importance, and enhances the unimportant features to realize the transferable attack. Specifically, the corresponding gradient is obtained by back propagation to reflect the importance of its features, and then the weighted feature obtained by the gradient is used to attack. In addition, this paper uses the temporal information of similarity between adjacent video frames to propose a sequential-aware feature similarity attack method to attack the object tracker by reducing the feature similarity between adjacent frames. This paper evaluates the proposed attack method on the current mainstream deep learning target tracker. The experimental results on multiple datasets prove the effectiveness and strong mobility of this method. In OTB benchmark, the tracking success rate and accuracy of SiamRPN tracking model are reduced by 71.5% and 79.9% respectively.

Key words: adversarial attack, visual object tracking, black box attack, transferability, important features, feature similarity

中图分类号: