针对车牌识别系统的双重对抗攻击

陈先意; 顾军; 颜凯; 江栋; 许林峰; 付章杰

doi:10.11959/j.issn.2096-109x.2023034

您当前的位置：

首页 >

文章列表页 >

针对车牌识别系统的双重对抗攻击

学术论文 | 更新时间：2024-06-03

- 针对车牌识别系统的双重对抗攻击
- Double adversarial attack against license plate recognition system
- 网络与信息安全学报 2023年9卷第3期页码：16-27
- 作者机构：
  
  1. 南京信息工程大学数字取证教育部工程研究中心，江苏南京 210044
  2. 综合业务网理论及关键技术国家重点实验室（西安电子科技大学），陕西西安 710126
- 作者简介：
  
  [ "陈先意（1983- ），男，湖北恩施人，南京信息工程大学副教授，主要研究方向为区块链安全、大数据安全及人工智能安全" ]
  [ "顾军（1996- ），男，江苏盐城人，南京信息工程大学硕士生，主要研究方向为对抗样本、人工智能安全" ]
  [ "颜凯（1998- ），男，江苏淮安人，南京信息工程大学硕士生，主要研究方向为对抗攻击" ]
  [ "江栋（1998- ），男，四川成都人，南京信息工程大学硕士生，主要研究方向为人工智能安全、对抗样本" ]
  [ "许林峰（1998- ），男，江苏南通人，南京信息工程大学硕士生，主要研究方向为信息安全、对抗样本" ]
  [ "付章杰（1983- ），男，河南南阳人，南京信息工程大学教授、博士生导师，主要研究方向为区块链安全、数字取证、人工智能安全" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2021YFB2700900);国家自然科学基金;The National Natural Science Foundation of China(62172232);国家自然科学基金;The National Natural Science Foundation of China(62172233);江苏省杰出青年基金;The Jiangsu Basic Research Programs-Natural Science Foundation(BK20200039);江苏省大气环境与装备技术协同创新中心基金;The Collaborative Innovation Center of Atmospheric Environment and Equipment Technology (CICAEET) Fund
- DOI：10.11959/j.issn.2096-109x.2023034
  中图分类号： TP393
- 网络首发：2023-06，
  
  纸质出版：2023-06-25
- 稿件说明：
移动端阅览
陈先意, 顾军, 颜凯, 等. 针对车牌识别系统的双重对抗攻击[J]. 网络与信息安全学报, 2023,9(3):16-27.

Xianyi CHEN, Jun GU, Kai YAN, et al. Double adversarial attack against license plate recognition system[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 16-27.
陈先意, 顾军, 颜凯, 等. 针对车牌识别系统的双重对抗攻击[J]. 网络与信息安全学报, 2023,9(3):16-27. DOI： 10.11959/j.issn.2096-109x.2023034.

Xianyi CHEN, Jun GU, Kai YAN, et al. Double adversarial attack against license plate recognition system[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 16-27. DOI： 10.11959/j.issn.2096-109x.2023034.

摘要

使用深度神经网络的人工智能系统面对对抗样本的攻击表现出极大的脆弱性。因此，在基于深度神经网络的车牌识别系统（LPR，license plate recognition）场景下，提出针对车牌识别系统的双重对抗攻击（DAA，double adversarial attack）方法。通过添加对抗补丁到车牌的图案位置，使LPR的目标检测子系统不能检测到车牌类；通过在车牌号上添加不规则的单连通区域扰动斑点以模拟自然形成的铁锈、污渍等，使 LPR 的车牌号识别子系统产生误识别。针对车牌研究设计不同形状的对抗补丁、不同颜色的对抗斑点，以此产生对抗车牌，并迁移到物理世界中。实验结果表明，设计出的对抗样本既不会被人眼所察觉，也能够欺骗车牌识别系统，如EasyPR，在物理世界中的攻击成功率能够达到99%。关于LPR的对抗攻击及深度学习的脆弱性研究，对提高车牌识别模型的鲁棒性具有积极促进意义。

Abstract

Recent studies have revealed that deep neural networks (DNN) used in artificial intelligence systems are highly vulnerable to adversarial sample-based attacks.To address this issue

a dual adversarial attack method was proposed for license plate recognition (LPR) systems in a DNN-based scenario.It was demonstrated that an adversarial patch added to the pattern location of the license plate can render the target detection subsystem of the LPR system unable to detect the license plate class.Additionally

the natural rust and stains were simulated by adding irregular single-connected area random points to the license plate image

which results in the misrecognition of the license plate number.or the license plate research

different shapes of adversarial patches and different colors of adversarial patches are designed as a way to generate adversarial license plates and migrate them to the physical world.Experimental results show that the designed adversarial samples are undetectable by the human eye and can deceive the license plate recognition system

such as EasyPR.The success rate of the attack in the physical world can reach 99%.The study sheds light on the vulnerability of deep learning and the adversarial attack of LPR

and offers a positive contribution toward improving the robustness of license plate recognition models.

关键词

Keywords

references

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [J ] . arXiv Preprint arXiv:13126199 , 2013 .

潘文雯 , 王新宇 , 宋明黎 , 等 . 对抗样本生成技术综述 [J ] . 软件学报 , 2020 , 31 ( 1 ): 67 - 81 .

PAN W W , WANG X Y , SONG M L , et al . Survey on generating adversarial examples [J ] . Journal of Software , 2020 , 31 ( 1 ): 67 - 81 .

马钰锡 , 张全新 , 谭毓安 , 等 . 面向智能攻击的行为预测研究 [J ] . 软件学报 , 2020 , 32 ( 5 ): 1526 - 1546 .

MA Y Xi , ZHANG Q X , TAN Y A , et al . Research on behavior-prediction for intelligent attacks [J ] . Journal of Software , 2020 , 32 ( 5 ): 1526 - 1546 .

陈晋音 , 沈诗婧 , 苏蒙蒙 , 等 . 车牌识别系统的黑盒对抗攻击 [J ] . 自动化学报 , 2021 , 47 ( 1 ): 121 - 135 .

CHEN J Y , SHEN S J , SU M M , et al . Black-box adversarial attack on license plate recognition system [J ] . Acta Automatica Sinica , 2021 , 47 ( 1 ): 121 - 135 .

BIGGIO B , CORONA I , MAIORCA D , et al . Evasion attacks against machine learning at test time [C ] // Machine Learning and Knowledge Discovery in Databases:European Conference,ECML PKDD 2013,Prague,Czech Republic , 2013 : 387 - 402 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [J ] . arXiv Preprint arXiv:14126572 , 2014 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FROSSARD P . Deepfool:a simple and accurate method to fool deep neural networks [C ] // Proceedings of the IEEE conference on computer vision and pattern recognition,Las Vegas,America , 2016 : 2574 - 2582 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // 2017 ieee symposium on security and privacy (sp),San Jose,CA,USA , 2017 : 39 - 57 .

BROWN T B , MANÉ D , ROY A , et al . Adversarial patch [J ] . arXiv Preprint arXiv:171209665 , 2017 .

EYKHOLT K , EVTIMOV I , FERNANDES E , et al . Robust physical-world attacks on deep learning visual classification [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 1625 - 1634 .

ATHALYE A , ENGSTROM L , ILYAS A , et al . Synthesizing robust adversarial examples [C ] // International Conference on Machine Learning . 2018 : 284 - 293 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FAWZI O , et al . Universal adversarial perturbations [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2017 : 1765 - 1773 .

TSAI T , YANG K , HO T Y , et al . Robust adversarial objects against deep learning models [C ] // Proceedings of the AAAI Conference on Artificial Intelligence,Hilton New York Midtown , 2020 : 954 - 962 .

CHEN S T , CORNELIUS C , MARTIN J , et al . Shapeshifter:Robust physical adversarial attack on faster R-CNN object detector [C ] // Machine Learning and Knowledge Discovery in Databases:European Conference,ECML PKDD 2018,Dublin,Ireland , 2018 : 52 - 68 .

REN S , HE K , GIRSHICK R , et al . Faster R-CNN:Towards real-time object detection with region proposal networks [J ] . Advances in Neural Information Processing Systems , 2015 ,28.

REDMON J , FARHADI A . YOLO9000:better,faster,stronger [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2017 : 7263 - 7271 .

THYS S , VAN R W , GOEDEMÉ T . Fooling automated surveillance cameras:adversarial patches to attack person detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops . 2019 .

XU K , ZHANG G , LIU S , et al . Adversarial t-shirt! evading person detectors in a physical world [C ] // Computer Vision–ECCV 2020:16th European Conference . 2020 : 665 - 681 .

KAZIAKHMEDOV E , KIREEV K , MELNIKOV G , et al . Real-world attack on MTCNN face detection system [C ] // 2019 International Multi-Conference on Engineering,Computer and Information Sciences (SIBIRCON) . 2019 : 422 - 427 .

HUANG L , GAO C , ZHOU Y , et al . Universal physical camouflage attacks on object detectors [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2020 : 720 - 729 .

ZHU X , LI X , LI J , et al . Fooling thermal infrared pedestrian detectors in real world using small bulbs [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . 2021 : 3616 - 3624 .

HU Y C T , KUNG B H , TAN D S , et al . Naturalistic physical adversarial patch for object detectors [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision . 2021 : 7848 - 7857 .

HU Z , HUANG S , ZHU X , et al . Adversarial texture for fooling person detectors in the physical world [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,New Orleans Ernest N . 2022 : 13307 - 13316 .

WANG J , LIU A , YIN Z , et al . Dual attention suppression attack:Generate adversarial camouflage in physical world [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2021 : 8565 - 8574 .

DU A , CHEN B , CHIN T J , et al . Physical adversarial attacks on an aerial imagery object detector [C ] // Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision,New Orleans Ernest N . 2022 : 1796 - 1806 .

WANG D , JIANG T , SUN J , et al . Fca:Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . , 2022 : 2414 - 2422 .

REDMON J , FARHADI A . Yolov3:An incremental improvement [J ] . arXiv Preprint arXiv:180402767 , 2018 .

SURYANTO N , KIM Y , KANG H , et al . Dta:Physical camouflage attacks using differentiable transformation network [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2022 : 15305 - 15314 .

BOCHKOVSKIY A , WANG C Y , LIAO H Y M . Yolov4:Optimal speed and accuracy of object detection [J ] . arXiv Preprint arXiv:200410934 , 2020 .

PURKAIT P , ZHAO C , ZACH C . SPP-Net:Deep absolute pose regression with synthetic views [J ] . arXiv Preprint arXiv:171203452 , 2017 .

LIU S , QI L , QIN H , et al . Path aggregation network for instance segmentation [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 8759 - 8768 .

PARISI R , DI CLAUDIO E D , LUCARELLI G , et al . Car plate recognition by neural networks and image processing [C ] // 1998 IEEE International Symposium on Circuits and Systems (ISCAS) . 1998 : 195 - 198 .

QIAN Y , MA D , WANG B , et al . Spot evasion attacks:Adversarial examples for license plate recognition systems with convolutional neural networks [J ] . Computers ＆ Security , 2020 ,95:101826.

KWON H , BAEK J W . Adv-plate attack:adversarially perturbed plate for license plate recognition system [J ] . Journal of Sensors , 2021 , 2021 : 1 - 10 .

WANG C Y , LIAO H Y M , WU Y H , et al . CSPNet:A new backbone that can enhance learning capability of CNN [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops : 390 - 391 .

浏览量

214

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

车牌识别系统中基于特征不变量的对抗检测

基于光学的物理域对抗攻防综述

基于PatchTracker的对抗补丁防御算法

纵向联邦学习方法及其隐私和安全综述

基于RSA的图像可识别对抗攻击方法