一种基于二维码对抗样本的物理补丁攻击

Deep learning technology has been widely used in the field of image recognition, and the recognition accuracy is higher than the average level of human beings. However, recent studies have shown that the performance of deep neural network will be greatly reduced due to the presence of adversarial examples. The attacker misleads the classifier to make false prediction by adding a small disturbance to the image to be recognized. On the other hand, the disturbance generated in the digital space can also be transferred to the physical space and used for attack. For this reason, this paper proposes a physical patch attack method based on two-dimensional code antagonism samples, which pastes the generated QR code on the designated position of the road traffic sign surface, making the classifier output the wrong classification. The experimental results show the effectiveness of this method. At the same time, using the counter examples generated in digital space to attack traffic signs in physical space can still maintain a high success rate.