CN113780280B

CN113780280B - Target detector safety testing method and device, electronic device and storage medium

Info

Publication number: CN113780280B
Application number: CN202111079538.2A
Authority: CN
Inventors: 胡晓林; 胡展豪; 黄思源; 朱小佩
Original assignee: Tsinghua University
Current assignee: Tsinghua University
Priority date: 2021-09-15
Filing date: 2021-09-15
Publication date: 2024-12-13
Anticipated expiration: 2041-09-15
Also published as: CN113780280A

Abstract

The method comprises the steps of sampling a first image to be optimized to obtain a sampled first sub-image, pasting the first sub-image into each sample image labeling area in a training set to obtain a pasted training image, optimizing the first image according to a target detector and the training image to obtain an optimized second image, and reminding a user of paying attention to the use risk of the target detector, wherein the safety reliability of the target detector can be effectively detected by the second image.

Description

Object detector security testing method and device, electronic equipment and storage medium

Technical Field

The disclosure relates to the technical field of computer vision, and in particular relates to a target detector security testing method and device, electronic equipment and a storage medium.

Background

The target detection refers to judging the position of a target in a scene by using a computer, and marking the region of the target by labeling, marking, color marking, key marking and other marking modes. The target detection is used as an automatic positioning algorithm on the image, and has important application in the fields of intelligent camera monitoring, automatic driving, intelligent robots and the like.

Currently popular target detection algorithms may use deep neural networks (Deep Neural Network, DNN) to determine the location and size of the labeling area where each target is located. However, DNNs are found to be disturbed by some specific disturbances, resulting in erroneous or missed decisions. Such disturbances are known as challenge samples, which exist not only in the digital world, but also in the physical world. Such an countermeasure sample may enable the target to be stealth from the target detector. At present, the stealth of the object detector in the physical world usually adopts a patch pattern mode, and the patch pattern can only work under the condition that the patch pattern is opposite to a camera.

Disclosure of Invention

In view of this, the present disclosure proposes a method and apparatus for testing security of an object detector, an electronic device, and a storage medium.

According to one aspect of the disclosure, a security testing method of a target detector is provided, and the security testing method comprises the steps of sampling a first image to be optimized to obtain a sampled first sub-image, pasting the first sub-image into each sample image labeling area in a training set to obtain a pasted training image, wherein the sample image comprises one or more target labeling areas, optimizing the first image according to the target detector and the training image to obtain an optimized second image, and the second image is used for performing security testing on the target detector.

In one possible implementation manner, in the case that the first image is represented as a third image which is periodically arranged, the sampling processing is performed on the first image to be optimized to obtain a sampled first sub-image, and the sampling is performed on the third image by using a circular cutting method to obtain the sampled first sub-image.

In one possible implementation manner, the third image is sampled by an annular cutting method to obtain a sampled first sub-image, and the method comprises the steps of connecting the upper side, the lower side, the left side and the right side of the third image to form a three-dimensional annular image, and sampling a plane expansion image of the three-dimensional annular image to obtain a sampled first sub-image.

In a possible implementation manner, when the first image is represented as a third image which is periodically arranged, the first image is optimized according to the target detector and the training image to obtain an optimized second image, and the method includes optimizing the third image according to the target detector and the training image to obtain a fourth image, and periodically stitching the fourth image to obtain the optimized second image.

In one possible implementation manner, the first image is optimized according to the target detector and the training image to obtain an optimized second image, and the method comprises the steps of optimizing the first image based on a preset loss function to obtain an optimized second image, wherein the loss function comprises a function representing the detection result of the target detector and a function representing the image smoothness of the first image, and the detection result of the target detector comprises the confidence of a target.

In one possible implementation, the optimizing the first image according to the target detector and the training image to obtain an optimized second image includes adjusting values of pixels in the first image through optimization to obtain the second image, so that after the training image is input into the target detector, the obtained detection result is degraded.

In one possible implementation manner, pasting the first sub-image into each sample image labeling area in the training set to obtain a pasted training image comprises the steps of carrying out transformation processing on the first sub-image to obtain a second sub-image matched with a target labeling area in the sample image, and pasting the second sub-image into the sample image labeling area to obtain a pasted training image.

According to another aspect of the disclosure, a security testing device of a target detector is provided, which comprises a sampling module, a pasting module and an optimizing module, wherein the sampling module is used for sampling a first image to be optimized to obtain a sampled first sub-image, the pasting module is used for pasting the first sub-image into each sample image labeling area in a training set to obtain a pasted training image, the sample image comprises one or more target labeling areas, and the optimizing module is used for optimizing the first image according to the target detector and the training image to obtain an optimized second image, and the second image is used for performing security testing on the target detector.

In a possible implementation manner, in the case that the first image is represented as a third image which is periodically arranged, the sampling module includes a circular cutting sampling sub-module, configured to sample the third image by using a circular cutting method, so as to obtain a sampled first sub-image.

In one possible implementation manner, the annular cutting and sampling sub-module is used for connecting the upper side, the lower side, the left side and the right side of the third image to form a three-dimensional circular ring graph, and sampling the plane expansion graph of the three-dimensional circular ring graph to obtain a first sub-image after sampling.

In a possible implementation manner, when the first image is represented as a third image which is periodically arranged, the optimization module is configured to optimize the third image according to the target detector and the training image to obtain a fourth image, and perform periodic stitching processing on the fourth image to obtain an optimized second image.

In one possible implementation, the optimization module is configured to optimize the first image based on a preset loss function to obtain an optimized second image, where the loss function includes a function that indicates a detection result of the target detector and a function that indicates an image smoothness of the first image, and the detection result of the target detector includes a confidence level of the target.

In one possible implementation, the optimization module is configured to adjust values of pixels in the first image by optimization to obtain the second image, so that the obtained detection result is degraded after the training image is input to the target detector.

In one possible implementation manner, the pasting module is used for carrying out transformation processing on the first sub-image to obtain a second sub-image matched with the labeling area of the target in the sample image, and pasting the second sub-image into the labeling area of the sample image to obtain a pasted training image.

According to another aspect of the present disclosure, there is provided an electronic device comprising a processor, a memory for storing processor-executable instructions, wherein the processor is configured to invoke the instructions stored in the memory to perform the above-described method.

According to another aspect of the present disclosure, there is provided a non-transitory computer readable storage medium having stored thereon computer program instructions, wherein the computer program instructions, when executed by a processor, implement the above-described method.

In the embodiment of the disclosure, a first image to be optimized is sampled to obtain a sampled first sub-image, the first sub-image is pasted to each sample image labeling area in a training set to obtain a pasted training image, then the first image is optimized according to a target detector and the training image to obtain an optimized second image, the second image can effectively detect the safety reliability of the target detector, a user is reminded of paying attention to the use risk of the target detector, and the target detector is facilitated to be perfected by a developer of the target detector.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. Other features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments, which proceeds with reference to the accompanying drawings.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate exemplary embodiments, features and aspects of the present disclosure and together with the description, serve to explain the principles of the disclosure.

FIG. 1 illustrates a flow chart of a security test method of a target detector according to an embodiment of the present disclosure;

FIG. 2 illustrates a schematic diagram of a security test method for a random sampling based object detector in accordance with an embodiment of the present disclosure;

FIG. 3 illustrates a schematic diagram of a security testing method for a loop-cut sampling based target detector, according to an embodiment of the present disclosure;

FIG. 4 shows a schematic diagram of a circular cut sampling method according to an embodiment of the present disclosure;

FIG. 5 shows a schematic view of an optimized second image according to an embodiment of the present disclosure;

FIG. 6 illustrates a schematic diagram of security testing of an optimized second image according to an embodiment of the present disclosure;

FIG. 7 illustrates a block diagram of a security testing device of an object detector of an embodiment of the present disclosure;

FIG. 8 illustrates a block diagram of an electronic device according to an embodiment of the disclosure;

fig. 9 shows a block diagram of an electronic device according to an embodiment of the disclosure.

Detailed Description

Various exemplary embodiments, features and aspects of the disclosure will be described in detail below with reference to the drawings. In the drawings, like reference numbers indicate identical or functionally similar elements. Although various aspects of the embodiments are illustrated in the accompanying drawings, the drawings are not necessarily drawn to scale unless specifically indicated.

The word "exemplary" is used herein to mean "serving as an example, embodiment, or illustration. Any embodiment described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments.

The term "and/or" is merely an association relationship describing the associated object, and means that three relationships may exist, for example, a and/or B may mean that a exists alone, while a and B exist together, and B exists alone. In addition, the term "at least one" herein means any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B, C, may mean including any one or more elements selected from the group consisting of A, B and C.

In addition, numerous specific details are set forth in the following detailed description in order to provide a better understanding of the present disclosure. It will be understood by those skilled in the art that the present disclosure may be practiced without some of these specific details. In some instances, methods, means, elements, and circuits well known to those skilled in the art have not been described in detail in order not to obscure the present disclosure.

In the related art, the physical world basically adopts a patch pattern to construct the anti-disturbance aiming at the stealth of the target detector, for example, one or more square patch patterns can be stuck to a flatter part such as a chest of clothes aiming at the stealth of the pedestrian detector, so that the patch patterns are received by the pedestrian detector through a camera and then interfere with the output result. These patterns may be optimally generated by minimizing an objective function that is the maximum of the target presence confidence (Objectness Score) for each of the callout boxes (Bounding Box) in the output of the pedestrian detector.

However, in the related art, regarding a security test method of an object detector, there are the following problems:

First, the stealth method for the object detector in the physical world can only be implemented through one whole patch pattern, and when the object rotates to cover a part of the patch pattern, the stealth effect is greatly reduced. Therefore, the patch pattern plays a stealth role only when the patch pattern is facing the camera, in which case the manner and kind of stealth is largely limited.

Second, in the related art, a simple extension of the patch pattern, such as a way of pasting a plurality of patch patterns, is still difficult to work, because different patches each work as a whole, and it is difficult for some parts of the plurality of patches to be combined together to have a stealth effect.

Third, although the related art can be generalized to optimize 3D models for different objects (e.g., clothes), the simulation process is very complicated, and patch patterns need to be attached to specific positions, which has certain limitations in universality and universality.

Aiming at the problems that the patch pattern can only realize stealth under a specific angle range relative to a camera, the 3D modeling is complex, and the like. The disclosure provides a security testing method of a target detector, which is used for sampling a first image to be optimized to obtain a sampled first sub-image, pasting the first sub-image to each sample image labeling area in a training set to obtain a pasted training image, and optimizing the first image according to the target detector and the training image to obtain an optimized second image. Each part of the second image has a stealth effect, and the stealth effect of the second image can be utilized to realize stealth of the target detector under each shooting angle, so that the stealth effect of the second image can be utilized to effectively detect the safety reliability of the target detector, remind a user of paying attention to the use risk of the target detector, and the detector is beneficial to the improvement of a developer of the target detector.

Fig. 1 shows a flowchart of a security testing method of a target detector according to an embodiment of the present disclosure, as shown in fig. 1, the method including:

In step S1, sampling a first image to be optimized to obtain a sampled first sub-image;

In step S2, the first sub-image is pasted to each sample image labeling area in the training set, so as to obtain a pasted training image, where the sample image includes one or more target labeling areas;

in step S3, the first image is optimized according to the target detector and the training image, so as to obtain an optimized second image, where the second image is used for performing a security test on the target detector.

In one possible implementation, the security testing method of the object detector may be performed by a terminal device or other processing device, where the terminal device may be a User Equipment (UE), a mobile device, a User terminal, a terminal, or the like. The other processing device may be a server or cloud server, etc. In some possible implementations, the security test method may be implemented by way of a processor invoking computer readable instructions stored in a memory.

In one possible implementation manner, in step S1, a first image to be optimized is sampled, so as to obtain a sampled first sub-image. The first image may be a texture pattern of a preset size or a periodically arranged texture pattern, for example, in the case that the first image is a texture pattern of a preset size, random sampling processing may be performed on the first image to obtain a sampled first sub-image, and in the case that the first image is a periodically arranged texture pattern, annular cutting sampling (Toroidal Cropping Sampling, TCS) may be performed on periodically arranged texture pattern units in the first image to obtain a sampled first sub-image. The present disclosure is not limited to the specific size and style of the first image.

In one possible implementation, in step S2, the first sub-image may be first subjected to a random transformation to simulate what happens in the physical world, including, for example, changing the scaling, rotation angle, contrast, brightness, superimposing gaussian noise, etc. on the first sub-image. Then, the transformed first sub-image can be pasted into the labeling area of each sample image in the training set, and a pasted training image is obtained.

When the sample image includes labeling areas of a plurality of targets, the first sub-images can be respectively transformed according to the labeling areas of the plurality of targets, so that the transformed first sub-images are matched with the corresponding labeling areas, and then the transformed first sub-images are respectively pasted to the corresponding labeling areas.

The sample image in the training set may be an image acquired by an image acquisition device (e.g., a camera) and may include one or more targets to be identified, such as a human body, a human face, a vehicle, an object, and the like. The present disclosure does not limit the manner in which the sample image is obtained and the type of the object in the sample image.

The sample image in the training set may include a labeling result of the target to be identified, that is, the target in the sample image in the training set is labeled by labeling, marking, color marking, or key marking. For example, the sample image may be input to a target detector, the target detector performs target detection processing on the sample image to obtain a labeling area of the sample image, or the labeling area of the sample image may be obtained by a manual labeling method, and the method for obtaining the labeling area in the sample image is not limited in this disclosure.

In one possible implementation, in step S3, each training image may be input into the target detector, so that the target detector performs a target detection process on the training image, and a detection result of the target detector may be obtained. The optimized target is that the training image is input to a target detector, so that the target is not detected by the detector, and an error detection result is obtained.

The target detector is used for detecting a target, and can comprise a target detector based on a deep neural network and a target detector of a convolutional neural network, and the type of the target detector is not limited in the present disclosure.

A loss function that deteriorates the detection result of the target detector, for example, a maximum value that minimizes the target presence confidence of the target detector output may be set. The gradient of the loss function relative to the first image can be obtained by using a back propagation algorithm, and the pixel value of each pixel in the first image is adjusted according to the obtained gradient, so that an optimized second image is obtained.

Wherein, according to the obtained gradient update, the antagonism audio information can be combined with a fast gradient direction Method (FAST GRADIENT SIGN Method, FGSM), a projection gradient descent Method (Project GRADIENT DESCENT, PGD) or an adaptive momentum random optimization Method (Adaptive Momentum, adam), and the present disclosure is not limited to the specifically combined algorithm.

The optimized second image may be used to perform a security test on the target detector, e.g., if the target detector passes the security test performed by the second image, the target detector is indicated to be relatively high in security, and if the target detector does not pass the security test performed by the second image, the target detector is indicated to be relatively low in security.

In this way, the first image to be optimized is sampled to obtain a sampled first sub-image, the first sub-image is pasted to each sample image labeling area in the training set to obtain a pasted training image, then the first image can be optimized according to the target detector and the training image to obtain an optimized second image, and the second image can effectively detect the safety reliability of the target detector and remind a user of paying attention to the use risk of the target detector.

In addition, as the partial images (the first sub-images) after the second image is sampled are respectively optimized in the optimization process, each small part in the second image can have the stealth effect on the target detector, and the safety test method of the target detector can have better universality, for example, under the condition that the target detector is a pedestrian, no pattern is required to be printed at a specific position of clothes, and no optimization is required for different clothes. The method can generate a stealth pattern with a preset size based on a security testing method of a randomly sampled target detector or generate a periodic stealth pattern based on a security testing method of a ring-shaped cutting sampled target detector. Therefore, different clothes containing or fully covered with the stealth patterns can be stealth for the target detector under various angles, the safety and reliability of the target detector can be detected according to the stealth effect, the improvement of the target detector by a developer of the target detector is facilitated, and the safety of the target detector is improved.

The security test method of the object detector according to the embodiment of the present disclosure will be described below by taking a security test method of the object detector based on random sampling and a security test method of the object detector based on loop cut sampling as examples.

FIG. 2 illustrates a schematic diagram of a security test method for a random sampling-based object detector, according to an embodiment of the present disclosure, as shown in FIG. 2, where the first image τ is a texture pattern of a preset size (e.g., 600 pixels by 600 pixels) by randomly sampling small images (i.e., first sub-images) of the first image τ) And (3) carrying out optimization in a mode that every small part of the second image obtained through optimization has a stealth effect.

In step S1, in each training step, a random cutting sampling process loop (τ) is performed on the first image τ to be optimized to obtain a sampled first sub-image

In step S2, the first sub-image may be processedPasting the images to the labeling areas of the sample images x in the training set to obtain pasted training images.

In a possible implementation manner, step S2 includes performing a transformation process on the first sub-image to obtain a second sub-image matched with the labeling area of the target in the sample image, and pasting the second sub-image to the labeling area of the sample image to obtain a pasted training image.

For example, for each sample image x in the training set, the labeling area of each target in the sample image x may be obtained by means of manual labeling or by means of detecting a label by the target detector.

The first sub-image can be marked according to the marked area of the sample image xPerforming transformation processing to obtain a second sub-image matched with the labeling areas of the targets in the sample image x, which can facilitate pasting of the corresponding transformed first sub-image in each labeling area

Wherein for the first sub-imageThe transformation process performed may simulate what happens in the physical world, including, for example, changing scaling, rotation angle, contrast, brightness, superimposing gaussian noise, etc. In addition, the transformation process may also use random thin-plate spline (THIN PLATE SPLINE, TPS) deformation to simulate deformation that may occur in an object (e.g., cloth) in the physical world, i.e., parameterize the deformed object by lattice calibration. It should be understood that the present disclosure is not limited to the particular form of transformation process.

Then the first sub-imageAnd pasting the second sub-image obtained after the transformation processing into the labeling area of the sample image x to obtain a pasted training image. The series can be applied to the first sub-imagePerforming transformation processing, and adding sample picture x as M, and representing the pasted training image as

In this way, the first sub-image is transformed before pasting, so that disturbance of objects in the physical world can be modeled, and the effectiveness of a safety detection method for the target detector can be improved.

In step S2, training images are acquiredThereafter, in step S3, the image is trained based on the object detectorAnd optimizing the first image tau to obtain a second image which is used for carrying out security test on the target detector after optimization.

In a possible implementation, step S3 includes adjusting the values of the pixels in the first image by optimization to obtain the second image, so that the detection result obtained is degraded after the training image is input to the target detector.

For example, for a sample image x in the training set, the target detector may accurately detect the target in the sample image x and output an accurate target detection result, while for a sample image added with the first image τ, the target detector may not detect the target or may not detect the target and output an inaccurate or even erroneous target detection result.

The target detector optimizes the first image τ, i.e., iteratively adjusts the pixel values of the first image τ such that the target detector degrades the calculated detection result for the sample image to which the first image τ is added.

In the optimization process, the first sub-images randomly sampled in the first image tau can be respectively processed in each training stepAnd (3) optimizing, and obtaining an optimized second image through multiple rounds of training. Each small portion of the second image has a stealth effect. In this case, even if the sample image to which a part of the second image is attached is input to the target detector, the detection result calculated by the target detector may be deteriorated.

The detection result output by the target detector can comprise one or more of confidence of the existence of the target, confidence of a specific category and predicted detection frame coordinates. The confidence of the existence of the target represents the probability of the existence of the target, the confidence of the specific category represents the probability of the existence of the target of the specific category, and the predicted detection frame coordinates represent the position of the region where the target is located. If it is desired to deteriorate the detection result of the target detector, that is, even if the target detector does not recognize the target object, it is necessary to reduce as much as possible one or more of the confidence in the presence of the target, the confidence in the specific category, and the predicted detection frame coordinates.

In this way, each partial image (first sub-image) after the second image is sampled is respectively optimized in the optimization process, so that each small part in the second image has the stealth effect on the target detector, the universality and the universality of the method can be improved, and when the second image is used for carrying out safety detection on the target detector, the safety test can be effectively carried out on the target detector even if the second image part is blocked.

In one possible implementation, step S3 includes optimizing the first image based on a preset loss function to obtain an optimized second image, wherein the loss function includes a function representing a detection result of the target detector and a function representing image smoothness of the first image, and the detection result of the target detector includes a confidence of a target.

For example, the smaller the function value of the loss function, the sample image x, i.e. the training image, to which the first image τ is pastedThe greater the probability of error of the detection result obtained is input to the target detector, and the higher the image smoothness of the first image τ is. The value of the function of the reduction loss function may be used as a target, and the pixel value of the first image τ may be iteratively adjusted until the optimization is completed, so as to obtain the optimized second image.

Therefore, in the whole training process, the first image τ can be optimized by minimizing the loss function L _obj +αtv (τ), so as to obtain an optimized second image, and the overall optimization objective can be expressed as:

In the formula (1), the loss function may be formed by a weighted sum of a detection result function L _obj of the target detector and a function TV (τ) of the image smoothness, α is a preset weighting coefficient, and may be empirically set, and the specific value of α is not limited in the present disclosure.

In equation (1), the function L _obj of the detection result of the object detector can be expressed as:

The function f represents that the training image M (x, loop (τ)) is input to the target detector, and the target output from the target detector has the maximum value of the confidence. The smaller the value of L _obj, the smaller the maximum value of the target presence confidence output by the target detector, and the lower the accuracy of target detection by the target detector.

It should be appreciated that in equation (2), the function f is merely exemplary of the confidence in the presence of the target by the target detector, and may include one or more of the confidence in the presence of the target, the confidence in the particular class, and the predicted coordinates of the detection frame. The present disclosure is not limited to the specific form of function f.

In equation (1), the function TV (τ) of the image smoothness of the first image τ can be expressed as:

TV(τ)=∑_i,j|τ_i,j-τ_i+1,j|+|τ_i,j-τ_i,j+1| (3)

Where τ _i,j represents the pixel value in the first image τ at coordinates (i, j), the function TV (τ) describes the smoothness of the image by calculating the sum of the absolute value of the difference between each pixel τi, j in the first image τ and the surrounding two pixels τ _i+1,j、τ_i,j+1. TV (τ) can be measured by the total amount of difference between adjacent pixels in the picture, the smaller the value of TV (τ), the more similar each pixel is to the surrounding two pixels, and the smoother the image.

It should be appreciated that the function representing the smoothness of an image is a function that measures the degree of abrupt or noisy changes in the image, and may be a function that determines the similarity of two or more pixels in adjacent or similar pixels, and the present disclosure is not limited to the particular type of function that may represent the smoothness of an image. The second image obtained by optimization can be smoother and more continuous by introducing an image smoothness function term into the loss function.

In this way, the optimized second image can be obtained by minimizing the loss function, and each partial image loop (tau) after the second image is sampled is respectively optimized in the optimization process, so that each small part in the second image has a stealth effect on the target detector, the universality of the second image is improved, and the second image can effectively test the safety of the target detector.

Therefore, by the security testing method of the target detector based on random sampling as shown in fig. 2, each small part of the second image obtained after optimization has a stealth effect by randomly sampling the small image (the first sub-image) in the first image with a preset size for optimization.

However, by the security test method of the object detector based on random sampling, the size of the obtained second image is not able to generate an expandable image as the size of the preset first image, and the versatility of the method is still to be improved. Moreover, the method randomly samples for many times at each position in the first image, so that the efficiency is not high enough, and the effect is poor.

In view of this, fig. 3 is a schematic diagram illustrating a security testing method of a target detector based on ring-shaped cut sampling according to an embodiment of the disclosure, as shown in fig. 3, the first image τ may be an image formed by periodically arranging the third image τ _local, and the small images (i.e., the first sub-image) are cut and sampled in a ring by the periodic pattern unit of the first image τ (i.e., the third image τ _local)) The optimization is performed in such a way that the second image obtained by the optimization is not only a periodically expandable image, but also each small part of the image has a stealth effect.

In a possible implementation manner, in the step S1, in the case that the first image is represented as a third image that is periodically arranged, the step S1 includes sampling the third image by a loop cutting method, so as to obtain a first sub-image after sampling.

For example, the pattern of periodic repetition in the periodically arranged texture pattern τ (i.e., the first image) may be represented by a third image τ _local of a first predetermined size (e.g., 300 pixels×300 pixels), as shown in fig. 3, the first image τ comprising 4 periodically arranged third images τ _local.

The first image τ may include a plurality of third images that are periodically arranged, and the preset size of the third images and the number of the first images including the third images are not limited in this disclosure.

In each training step, the first sub-image of the second predetermined size (e.g., 150 pixels by 150 pixels) may be uniformly randomly cut in the third image τ _local using a circular cutting methodTraining can be expressed asWherein, the present disclosure does not limit the size of the second preset dimension.

In this way, in the case that the first image is formed by the periodic image units (i.e., the third image), the sampling of the first image can be realized by annularly cutting and sampling the periodic image units, and the sampling efficiency is improved. Also, since the first image is constituted by periodic image units, the second image obtained by optimizing the first image may also be period-expandable.

Fig. 4 is a schematic diagram of an annular cutting sampling method according to an embodiment of the disclosure, as shown in fig. 4, in which the annular cutting method is performed on the third image to obtain a sampled first sub-image, and the method includes connecting upper and lower sides, left and right sides of the third image to form a three-dimensional annular graph, and sampling a plane expansion graph of the three-dimensional annular graph to obtain a sampled first sub-image.

For example, as shown in fig. 4, the left square represents the third image τ _local, the upper and lower sides of the third image τ _local may be connected (the edges in the horizontal arrow direction in fig. 4) to obtain a hollow cylinder (the hollow cylinder in the middle of fig. 4), and then the left and right sides of the cylinder are connected (i.e., the edges in the vertical arrow direction in the left square in fig. 4) to obtain a three-dimensional ring (the ring on the right side in fig. 4).

The annular cutting operation loop _torus regards the third image τ _local as a three-dimensional annular surface, and then randomly samples the three-dimensional annular surface that is randomly spread, which is equivalent to randomly sampling the three-dimensional annular surface.

Since the surface of the ring has no edges, such a sampling method is not limited by the edges of the square pattern. And since the first image τ is formed by closely arranging the third image τ _local, randomly slicing the samples on the third image τ _local in a circular slicing manner is equivalent to randomly slicing the samples on the first image τ.

In this way, the annular cutting sampling is performed on the third image, so that random sampling on the first image can be replaced, and the sampling efficiency is improved.

In step S2, the first sub-image may be referred to the random sampling based security test method of the object detector as shown in fig. 2 abovePasting the images to the x marking areas of each sample image in the training set to obtain pasted training imagesAnd will not be described in detail here.

In step S3, based on the object detector and the training imageAnd optimizing the first image tau to obtain a second image which is used for carrying out security test on the target detector after optimization.

In a possible implementation manner, in a case where the first image is represented as a third image that is periodically arranged, step S3 includes:

In step S31, optimizing the third image according to the target detector and the training image to obtain a fourth image;

In step S32, the fourth image is subjected to a periodic stitching process, so as to obtain an optimized second image.

For example, in step S31, the method for testing the security of the target detector based on random sampling as shown in fig. 2 above may be referred to, and the third image τ _local is optimized based on a preset loss function, so as to obtain an optimized fourth image, where the loss function includes a function representing a detection result of the target detector and a function representing an image smoothness of the third image τ _local, and the detection result of the target detector includes a confidence of the target.

The smaller the function value of the loss function, the sample image x, i.e. the training image, to which the third image τ _local is attachedThe greater the probability of error of the detection result obtained is input to the target detector, and the higher the image smoothness of the third image τ _local is. The pixel value of the third image τ _local may be iteratively adjusted with the function value of the reduction loss function as a target until the optimization is completed, resulting in an optimized fourth image.

Therefore, during the whole training process, the third image τ _local may be optimized by minimizing the loss function L _obj+αTV(τ_local), so as to obtain an optimized fourth image, and the overall optimization objective may be expressed as:

in the formula (4), the loss function may be formed by a weighted sum of the detection result function L _obj of the target detector and the function TV (τ _local) of the image smoothness, α is a preset weighting coefficient, and may be empirically set, and the specific value of α is not limited in the present disclosure.

In equation (4), the function L _obj of the detection result of the object detector can be expressed as:

Where the function f represents the training image M (x, loop _torus(τ_local)) is input to the target detector, and the target output by the target detector has a maximum value of confidence. The smaller the value of L _obj, the smaller the maximum value of the target presence confidence output by the target detector, and the lower the accuracy of target detection by the target detector.

It should be appreciated that in equation (5), the function f is merely exemplary of the confidence in the presence of the target by the target detector, and may include one or more of the confidence in the presence of the target, the confidence in the particular class, and the predicted coordinates of the detection frame. The present disclosure is not limited to the specific form of function f.

In equation (4), the function TV (τ _local) of the image smoothness of the third image τ _local can be expressed as:

Wherein, Representing the pixel value at coordinates (i, j) in the third image τ _local, the function TV (τ _local) calculates each pixel in the third image τ _local Respectively with two surrounding pixelsThe method for calculating the absolute value addition of the difference values describes the smoothness of the image. The smaller the value of TV (τ _local), the more similar each pixel is to the surrounding two pixels, the smoother the image.

It should be appreciated that the function representing the smoothness of an image is a function that measures the degree of abrupt or noisy changes in the image, and may be a function that determines the similarity of two or more pixels in adjacent or similar pixels, and the present disclosure is not limited to particular functions that may represent smoothness of an image. And introducing an image smoothness function term into the loss function, so that the fourth image obtained by optimization is smoother and more continuous.

It should be understood that, in the above-mentioned methods for testing the security of the target detector based on the circular cut sampling, the formulas (4) - (6) are substantially the same as the formulas (1) - (3) in the method for testing the security of the target detector based on the random sampling, but the optimization objects of the formulas (1) - (3) are different, the optimization objects of the formulas (1) - (3) are the first image τ, and the optimization objects of the formulas (4) - (6) are the third image τ _local. Whereas in the case where the first image τ is represented as a periodically arranged third image τ _local, the optimization of the third image τ _local corresponds to the optimization of the first image τ.

In this way, an optimized fourth image can be obtained by minimizing the loss function.

In step S32, the fourth image obtained in step S32 is subjected to a periodic stitching process (i.e., the fourth image is tiled one by one), so as to obtain an optimized second image, as shown in fig. 5, which is a schematic diagram of the optimized second image according to an embodiment of the disclosure.

The second image may be obtained by directly periodically stitching the fourth image, and since the number of stitching is not limited, the size of the second image may be arbitrary.

In this way, any individual patch on the second image after optimization has a stealth effect, which is local, continuous. Therefore, the second image has better universality, for example, in the case that the target of the target detector is a pedestrian, the periodic stealth pattern can be generated based on the security test method of the annular cutting sampling target detector without printing the pattern at a specific position of clothes or optimizing for different clothes. Therefore, different clothes containing or fully covered with the stealth patterns can be stealth for the target detector under various angles, the safety and reliability of the target detector can be detected according to the stealth effect, the improvement of the target detector by a developer of the target detector is facilitated, and the safety of the target detector is improved.

In practical applications, for example, for safety testing of pedestrian detectors, stealth texture patterns (i.e., fourth images) can be printed directly on cloth, and clothing made of these cloth has the effect of hiding the pedestrian detectors at various angles. The safety test can be carried out on the pedestrian detector according to the stealth property, if the pedestrian detector can detect the pedestrian penetrating through the stealth cloth, the safety of the pedestrian detector is better, and if the pedestrian detector can not detect the pedestrian penetrating through the stealth cloth, the safety of the pedestrian detector is required to be improved.

It can be seen that the more the stealth effect of the second image is, the more effective the safety of the pedestrian detector can be tested. Fig. 6 is a schematic diagram illustrating safety testing of an optimized second image according to an embodiment of the disclosure, as shown in fig. 6, for a situation in which a part of stealth cloth is blocked (left side picture of fig. 6) for a photographing angle of different cameras of a pedestrian detector, the pedestrian detector does not detect a pedestrian penetrating through the stealth cloth, and the safety of the detector needs to be further enhanced.

Therefore, in the embodiment of the disclosure, a first image to be optimized is sampled to obtain a sampled first sub-image, the first sub-image is pasted to each sample image labeling area in a training set to obtain a pasted training image, then the first image can be optimized according to a target detector and the training image to obtain an optimized second image, the second image can effectively detect the safety reliability of the target detector, and a user is reminded of paying attention to the use risk of the target detector.

Moreover, the disclosure also provides two detection methods, namely a security test method capable of generating a stealth pattern with a preset size based on a randomly sampled target detector or a security test method of a target detector based on annular cutting sampling, and generating a periodic stealth pattern.

The safety testing method of the target detector based on the annular cutting sampling has better universality, and for example, under the condition that the target detector targets at pedestrians, patterns do not need to be printed at specific positions of clothes, and optimization is not needed for different clothes. Therefore, different clothes containing or fully covered with the stealth patterns can be stealth for the target detector under various angles, the safety and reliability of the target detector can be detected according to the stealth effect, the improvement of the target detector by a developer of the target detector is facilitated, and the safety of the target detector is improved.

It will be appreciated that the above-mentioned method embodiments of the present disclosure may be combined with each other to form a combined embodiment without departing from the principle logic, and are limited to the description of the present disclosure. It will be appreciated by those skilled in the art that in the above-described methods of the embodiments, the particular order of execution of the steps should be determined by their function and possible inherent logic.

In addition, the disclosure further provides a security testing device for the target detector, an electronic device, a computer readable storage medium, and a program, where the foregoing may be used to implement any one of the security testing methods for the target detector provided in the disclosure, and corresponding technical schemes and descriptions and corresponding descriptions of method parts are omitted.

Fig. 7 shows a block diagram of a security testing apparatus of an object detector according to an embodiment of the present disclosure, as shown in fig. 7, the apparatus including:

the sampling module 71 is configured to perform sampling processing on a first image to be optimized, so as to obtain a sampled first sub-image;

A pasting module 72, configured to paste the first sub-image into each sample image labeling area in the training set, to obtain a pasted training image, where the sample image includes labeling areas of one or more targets;

And an optimizing module 73, configured to optimize the first image according to the target detector and the training image, and obtain an optimized second image, where the second image is used to perform a security test on the target detector.

In a possible implementation manner, in the case that the first image is represented as a third image which is periodically arranged, the sampling module 71 includes a circular cutting sampling sub-module, configured to sample the third image by using a circular cutting method, so as to obtain a sampled first sub-image.

In a possible implementation manner, in the case that the first image is represented as a third image that is periodically arranged, the optimizing module 73 is configured to optimize the third image according to the target detector and the training image to obtain a fourth image, and perform periodic stitching processing on the fourth image to obtain an optimized second image.

In a possible implementation, the optimizing module 73 is configured to optimize the first image based on a preset loss function, to obtain an optimized second image, where the loss function includes a function that represents a detection result of the target detector and a function that represents an image smoothness of the first image, and the detection result of the target detector includes a confidence level of the target.

In a possible implementation, the optimization module 73 is configured to adjust the values of the pixels in the first image by optimizing to obtain the second image, so that the obtained detection result is degraded after the training image is input to the target detector.

In one possible implementation, the pasting module 72 is configured to transform the first sub-image to obtain a second sub-image that matches the labeling area of the target in the sample image, and paste the second sub-image to the labeling area of the sample image to obtain a pasted training image.

In some embodiments, the security testing device for a target detector provided in the embodiments of the present disclosure may have a function or a module included therein for executing the method described in the above method embodiments, and specific implementation thereof may refer to the description of the above method embodiments, which is not repeated herein for brevity.

The disclosed embodiments also provide a computer readable storage medium having stored thereon computer program instructions which, when executed by a processor, implement the above-described method. The computer readable storage medium may be a non-volatile computer readable storage medium.

The embodiment of the disclosure also provides electronic equipment, which comprises a processor and a memory for storing instructions executable by the processor, wherein the processor is configured to call the instructions stored by the memory so as to execute the method.

The electronic device may be provided as a terminal, server or other form of device.

Fig. 8 illustrates a block diagram of an electronic device 800, according to an embodiment of the disclosure. For example, electronic device 800 may be a mobile phone, computer, digital broadcast terminal, messaging device, game console, tablet device, medical device, exercise device, personal digital assistant, or the like.

Referring to FIG. 8, an electronic device 800 can include one or more of a processing component 802, a memory 804, a power component 806, a multimedia component 808, an audio component 810, an input/output (I/O) interface 812, a sensor component 814, and a communication component 816.

The processing component 802 generally controls overall operation of the electronic device 800, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to perform all or part of the steps of the methods described above. Further, the processing component 802 can include one or more modules that facilitate interactions between the processing component 802 and other components. For example, the processing component 802 can include a multimedia module to facilitate interaction between the multimedia component 808 and the processing component 802.

The memory 804 is configured to store various types of data to support operations at the electronic device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phonebook data, messages, pictures, videos, and so forth. The memory 804 may be implemented by any type or combination of volatile or nonvolatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.

The power supply component 806 provides power to the various components of the electronic device 800. The power components 806 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for the electronic device 800.

The multimedia component 808 includes a screen between the electronic device 800 and the user that provides an output interface. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensor may sense not only the boundary of a touch or slide action, but also the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and/or a rear camera. When the electronic device 800 is in an operational mode, such as a shooting mode or a video mode, the front camera and/or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

The audio component 810 is configured to output and/or input audio signals. For example, the audio component 810 includes a Microphone (MIC) configured to receive external audio signals when the electronic device 800 is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals may be further stored in the memory 804 or transmitted via the communication component 816. In some embodiments, audio component 810 further includes a speaker for outputting audio signals.

The I/O interface 812 provides an interface between the processing component 802 and peripheral interface modules, which may be a keyboard, click wheel, buttons, etc. These buttons may include, but are not limited to, a home button, a volume button, an activate button, and a lock button.

The sensor assembly 814 includes one or more sensors for providing status assessment of various aspects of the electronic device 800. For example, the sensor assembly 814 may detect an on/off state of the electronic device 800, a relative positioning of the components, such as a display and keypad of the electronic device 800, the sensor assembly 814 may also detect a change in position of the electronic device 800 or a component of the electronic device 800, the presence or absence of a user's contact with the electronic device 800, an orientation or acceleration/deceleration of the electronic device 800, and a change in temperature of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include a photosensor, such as a Complementary Metal Oxide Semiconductor (CMOS) or Charge Coupled Device (CCD) image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an acceleration sensor, a gyroscopic sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

The communication component 816 is configured to facilitate communication between the electronic device 800 and other devices, either wired or wireless. The electronic device 800 may access a wireless network based on a communication standard, such as a wireless network (WiFi), a second generation mobile communication technology (2G), a third generation mobile communication technology (3G), a fourth generation mobile communication technology (4G), or a fifth generation mobile communication technology (5G), or a combination thereof. In one exemplary embodiment, the communication component 816 receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component 816 further includes a Near Field Communication (NFC) module to facilitate short range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, ultra Wideband (UWB) technology, bluetooth (BT) technology, and other technologies.

In an exemplary embodiment, the electronic device 800 may be implemented by one or more Application Specific Integrated Circuits (ASICs), digital Signal Processors (DSPs), digital Signal Processing Devices (DSPDs), programmable Logic Devices (PLDs), field Programmable Gate Arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic elements for executing the methods described above.

In an exemplary embodiment, a non-transitory computer readable storage medium is also provided, such as memory 804 including computer program instructions executable by processor 820 of electronic device 800 to perform the above-described methods.

Fig. 9 illustrates a block diagram of an electronic device 1900 according to an embodiment of the disclosure. For example, electronic device 1900 may be provided as a server. Referring to FIG. 9, electronic device 1900 includes a processing component 1922 that further includes one or more processors and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by processing component 1922. The application programs stored in memory 1932 may include one or more modules each corresponding to a set of instructions. Further, processing component 1922 is configured to execute instructions to perform the methods described above.

The electronic device 1900 may also include a power component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input/output (I/O) interface 1958. Electronic device 1900 may operate based on an operating system stored in memory 1932, such as the Microsoft Server operating System (Windows Server), the apple Inc. promoted graphical user interface based operating System (Mac OS XTM), the Multi-user Multi-process computer operating System (UnixTM), the free and open raw code Unix-like operating System (Linux TM), the open raw code Unix-like operating System (FreeBSDTM) or the like.

In an exemplary embodiment, a non-transitory computer readable storage medium is also provided, such as memory 1932, including computer program instructions executable by processing component 1922 of electronic device 1900 to perform the methods described above.

The present disclosure may be a system, method, and/or computer program product. The computer program product may include a computer readable storage medium having computer readable program instructions embodied thereon for causing a processor to implement aspects of the present disclosure.

The computer readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a Static Random Access Memory (SRAM), a portable compact disc read-only memory (CD-ROM), a Digital Versatile Disc (DVD), a memory stick, a floppy disk, a mechanical encoding device, punch cards or intra-groove protrusion structures such as those having instructions stored thereon, and any suitable combination of the foregoing. Computer-readable storage media, as used herein, are not to be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., optical pulses through fiber optic cables), or electrical signals transmitted through wires.

The computer readable program instructions described herein may be downloaded from a computer readable storage medium to a respective computing/processing device or to an external computer or external storage device over a network, such as the internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, fiber optic transmissions, wireless transmissions, routers, firewalls, switches, gateway computers and/or edge servers. The network interface card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium in the respective computing/processing device.

The computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction Set Architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including an object oriented programming language such as SMALLTALK, C ++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, aspects of the present disclosure are implemented by personalizing electronic circuitry, such as programmable logic circuitry, field Programmable Gate Arrays (FPGAs), or Programmable Logic Arrays (PLAs), with state information of computer readable program instructions, which can execute the computer readable program instructions.

Various aspects of the present disclosure are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer-readable program instructions.

These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable medium having the instructions stored therein includes an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus or other devices implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The computer program product may be realized in particular by means of hardware, software or a combination thereof. In an alternative embodiment, the computer program product is embodied as a computer storage medium, and in another alternative embodiment, the computer program product is embodied as a software product, such as a software development kit (Software Development Kit, SDK), or the like.

The foregoing description of the embodiments of the present disclosure has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the various embodiments described. The terminology used herein was chosen in order to best explain the principles of the embodiments, the practical application, or the improvement of technology in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method of security testing of a target detector, the method comprising:

sampling the first image to be optimized to obtain a sampled first sub-image;

Pasting the first sub-image to each sample image labeling area in a training set to obtain a pasted training image, wherein the sample image comprises one or more target labeling areas;

Optimizing the first image according to the target detector and the training image to obtain an optimized second image, wherein the second image is used for carrying out security test on the target detector;

The method for pasting the first sub-image to each sample image labeling area in the training set to obtain a pasted training image comprises the following steps:

performing transformation processing on the first sub-image to obtain a second sub-image matched with the labeling area of the target in the sample image;

pasting the second sub-image to the labeling area of the sample image to obtain a pasted training image;

Optimizing the first image according to the target detector and the training image to obtain an optimized second image, wherein the optimizing comprises the steps of:

Optimizing the first image based on a preset loss function to obtain an optimized second image, wherein the loss function comprises a function representing the detection result of the target detector and a function representing the image smoothness of the first image, and the detection result of the target detector comprises the confidence of a target;

and adjusting the value of each pixel in the first image through optimization to obtain the second image, so that the obtained detection result is deteriorated after the training image is input into the target detector.

2. The method of claim 1, wherein, in the case where the first image is represented as a third image arranged periodically,

The sampling processing is performed on the first image to be optimized to obtain a sampled first sub-image, which comprises the following steps:

And carrying out annular cutting method sampling on the third image to obtain a first sub-image after sampling.

3. The method of claim 2, wherein performing a circular cut sampling on the third image to obtain a sampled first sub-image comprises:

Connecting the upper side, the lower side, the left side and the right side of the third image to form a three-dimensional circular ring graph;

and sampling the plane expansion diagram of the three-dimensional ring diagram to obtain a first sub-image after sampling.

4. The method of claim 1, wherein, in the case where the first image is represented as a third image arranged periodically,

optimizing the third image according to the target detector and the training image to obtain a fourth image;

and performing periodic stitching treatment on the fourth image to obtain an optimized second image.

5. A security testing apparatus for an object detector, comprising:

the sampling module is used for sampling the first image to be optimized to obtain a sampled first sub-image;

the pasting module is used for pasting the first sub-image to each sample image labeling area in the training set to obtain a pasted training image, wherein the sample image comprises one or more target labeling areas;

the optimization module is used for optimizing the first image according to the target detector and the training image to obtain an optimized second image, and the second image is used for carrying out security test on the target detector;

The pasting module is used for carrying out transformation processing on the first sub-image to obtain a second sub-image matched with a labeling area of a target in the sample image;

The optimizing module is used for optimizing the first image based on a preset loss function to obtain an optimized second image, wherein the loss function comprises a function representing the detection result of the target detector and a function representing the image smoothness of the first image, and the detection result of the target detector comprises the confidence of a target;

The optimizing module is used for adjusting the value of each pixel in the first image through optimization to obtain the second image, so that the obtained detection result is deteriorated if the training image is input into the target detector.

6. An electronic device, comprising:

a processor;

A memory for storing processor-executable instructions;

wherein the processor is configured to invoke the instructions stored in the memory to perform the method of any of claims 1 to 4.

7. A computer readable storage medium having stored thereon computer program instructions, which when executed by a processor, implement the method of any of claims 1 to 4.