Granted Patent B2

US 12,597,246 · App. 18/554,498 · Granted Apr 7, 2026

Inventors: Hang Su (Beijing, CN); Yichi Zhang (Beijing, CN); Xinxin Gu (Shanghai, CN); Ze Cheng (Shanghai, CN); Yunjia Wang (Shanghai, CN); Zijian Zhu (Beijing, CN)

Assignees: ROBERT BOSCH GMBH; TSINGHUA UNIVERSITY

G06V10/82G06T11/001G06V10/267G06T2210/12G06V10/776

Abstract

Claims (37)

1 . A method for generating a set of adversarial patches for an image, comprising the following steps:

segmenting the image into a plurality of regions;

selecting a set of target regions from the plurality of regions that satisfies an attacking criterion by discretely searching of the plurality of regions for regions satisfying the attacking criterion; and

generating a set of adversarial patches for the image by using the set of target regions;

wherein a shape of at least one adversarial patch in the set of adversarial patches is optimized by optimizing the selection of the set of target regions;

wherein at least some of the adversarial patches in the set of adversarial patches have different shapes relative to one another.

2 . The method of claim 1 , wherein the segmenting includes:

segmenting the image into the plurality of regions based on a polygon shape or a predetermined number of regions.

3 . The method of claim 1 , wherein the segmenting includes:

segmenting the image into the plurality of regions based on pixels having values within a threshold range.

4 . The method of claim 3 , wherein the segmenting further includes:

changing the plurality of regions into convex shapes by getting a convex envelope for each of the plurality of regions.

5 . The method of claim 1 , wherein the segmenting is constrained to a foreground object of the image.

6 . The method of claim 1 , wherein the selecting includes:

optimizing a probability distribution of a selection vector of the plurality of regions by calculating a search gradient, the selection vector indicating whether each of the plurality of regions is to be selected into the set of target regions; and

selecting the set of target regions based on a selection vector sampled based on the optimized probability distribution.

7 . The method of claim 1 , wherein the generating of the set of adversarial patches includes:

modifying textures of the set of adversarial patches, wherein the modifying includes: optimizing the textures with iterative gradient ascent, or selecting the textures from a texture dictionary.

8 . The method of claim 1 , wherein the selecting is based on a function of an output from a computer vision neural network for the image applied by the set of adversarial patches, a ground-truth label of the image, and a total area of the set of adversarial patches.

9 . The method of claim 8 , wherein the computer vision neural network is used for object detection, and the function is based on a task of misclassification or position shift or disappearing during the object detection.

10 . The method of claim 1 , wherein the segmenting of the image is based on pixels having values with a threshold range, wherein each of the plurality of regions is a superpixel.

11 . The method of claim 1 , wherein at least some of the adversarial patches are each constituted by several adjacent regions of the set of target regions.

12 . The method of claim 1 , wherein each of the different shapes is non-rectangular.

13 . An apparatus for generating a set of adversarial patches for an image, comprising:

a memory; and

at least one processor coupled to the memory and configured to generating a set of adversarial patches for an image, the at least one processor configured to:

segment the image into a plurality of regions;

select a set of target regions from the plurality of regions that satisfies an attacking criterion by discretely searching of the plurality of regions for regions satisfying the attacking criterion; and

generate a set of adversarial patches for the image by using the set of target regions;

wherein a shape of at least one adversarial patch in the set of adversarial patches is optimized by optimizing the selection of the set of target regions;

wherein at least some of the adversarial patches in the set of adversarial patches have different shapes relative to one another.

14 . A non-transitory computer readable medium on which is stored storing computer code for generating a set of adversarial patches for an image, the computer code when executed by a processor, causing the processor to perform the following steps:

segmenting the image into a plurality of regions;

selecting a set of target regions from the plurality of regions that satisfies an attacking criterion by discretely searching of the plurality of regions for regions satisfying the attacking criterion; and

generating a set of adversarial patches for the image by using the set of target regions;

wherein a shape of at least one adversarial patch in the set of adversarial patches is optimized by optimizing the selection of the set of target regions;

wherein at least some of the adversarial patches in the set of adversarial patches have different shapes relative to one another.

Assignments (1)

Continuity (1)

References Cited (13)