之前一起打了CISCN 2023初赛，因为周末睡懒觉晚到了两三个小时导致做这个题的时间不充裕了，最后在比赛结束后半个小时出了，主要原因还是因为没有玩过Yolo，当时记得这个题的解题数是很低的（或者好像是零解的？反正截止至我开始写这篇WP的时间[2023-08-07 18:30]，我在网上并没有搜到WP），本题在选手机器学习底子坚实的前提下主要考验选手入手新的模型和领域的速度以及将对抗样本训练应用上来的速度。

CISCN2023初赛 AdvDetPatch WriteUp

题干

本次竞赛要求选手针对目标检测模型进行对抗攻击。题目提供了1张样例图片（/home/adv/images/stop.png），要求选手在给定的图片中添加一些对抗性补丁，上传带有补丁的图片和代表补丁位置的mask，要求：

使得模型无法正确地检测出图片中的所有物体

并且补丁的面积不能超过图像面积的5%（例如对于640 * 640的图像，patch面积不超过20480 ），就能得到flag。

图像的尺寸、命名、文件格式（.png）和原始图像保持一致。

mask图像只存在0或255两种像素值，其中255代表patch像素占据的位置。文件名保存为mask.png，mask的白色部分代表补丁部分，黑色是未修改部分。

以下为需要选手攻击的图片

解题过程

初步验证

由于我是第一次玩Yolo，先自己跑一下看看能否得到正确的输出，通过在fool_me.py中print(pred)得到如下输出

tensor([[3.38821e+02, 1.65334e+02, 5.22038e+02, 4.83467e+02, 9.34208e-01, 1.10000e+01],
        [4.66704e+02, 2.09673e+02, 6.39832e+02, 5.45919e+02, 9.33491e-01, 1.10000e+01],
        [2.00159e+02, 2.04222e+02, 3.79344e+02, 5.11239e+02, 9.25105e-01, 1.10000e+01],
        [7.07512e+01, 2.37424e+02, 2.40440e+02, 5.33154e+02, 9.14894e-01, 1.10000e+01],
        [7.70359e-01, 2.53848e+02, 1.03618e+02, 5.43242e+02, 9.01769e-01, 1.10000e+01],
        [1.41904e+01, 3.93319e+02, 4.42650e+01, 4.40926e+02, 6.95912e-01, 2.40000e+01],
        [1.30602e+01, 3.96193e+02, 4.70077e+01, 4.42493e+02, 4.05268e-01, 1.10000e+01]])

对此我们需要确定此Tensor中每个Dimension的含义

我们查阅关于Yolo的资料可知，每个向量中前四个元素代表了Bounding Box的范围，第五维代表了置信度，第六维代表了Class(Label)

据此我们可以写出可视化脚本来可视化模型的输出结果，可视化如下

可见根据出题人给出的代码跑出的输出可以正确地被用于在原始图像上标记出所有Stop Sign的范围

接下来我们需要做的就是攻击这个模型，使得没有物体被检测到了

查找资料

根据题目标题，我们正在做的是Adversarial Patch，对抗性补丁，按照我的理解，这与之前看过的在一个图像上贴一个不透明的同时只覆盖部分原始图像的技术是一个东西

目前这项技术比较流行的是在现实世界中的Adv Patch，如下图，挂有Adv Patch的人无法被模型识别出是人类

根据中英文关键词（Yolo Adversarial Attack; Yolo Adversarial Patch; Yolo 对抗补丁; Yolo 对抗攻击），查找到了一篇题为Sparse Adversarial Attack to Object Detection预印本文章，这篇文章正好提供了我们需要的信息，我们只需要看文章中的两张图就知道如何攻击了

上图介绍了攻击的流程，比如确定Mask的形状，通过反向传播获取增加到图像上的扰动等。其中他有两个Preprocess我没太明白，但这不影响我们理解攻击的方式

上图展示了被攻击成功的图像，请注意图像中类似杂讯的十字，这可能需要对图像进行放大才能清晰地看见。我们可以由此认识到：其实Adv Patch就是在最基础的对抗攻击中限制了可以攻击的图像面积，并且被攻击的像素是替换而不是叠加

Exp

首先需要获取一个Mask，在调试题目的代码后，我发现题目对修改像素的数量其实比较宽松，所以我们采用米字形的Mask以更好地对需要攻击的部分进行扰动，这个Mask可以通过PS绘图后使用Python将灰色像素给去掉（因为题目限制了Mask的像素必须非0即255，所以需要去掉灰色的像素）

有了这个Mask我们就可以开始攻击了，现在移步fool_me.py进行代码修改

首先我们使用随机噪声填充这个Mask

Get Noise

def gen_noise(mask_path, source):
    mask = Image.open(mask_path)
    mask = np.array(mask)
    noise = torch.rand(640, 640, 3)
    noise = noise * 255
    noise = noise.int()
    noise = noise.numpy() * mask
    noise = Image.fromarray(noise.astype(np.uint8))
    noise.save(source)

然后我们需要修改原本验证图像是否攻击成功的代码，其实就是对输入图像求个梯度，然后累加这个梯度，直到攻击成功

Edited Code

# Run inference

   grad = None
   crackFlag = False

   for path, im, im0s, vid_cap, s in dataset:

       dt = [0.0, 0.0, 0.0]
       
       t1 = time_sync()
       im = torch.from_numpy(im).to(device)
       im = im.half() if half else im.float()  # uint8 to fp16/32
       im = im / 255 # 0 - 255 to 0.0 - 1.0
       im.requires_grad = True
       if len(im.shape) == 3:
           im = im[None]  # expand for batch dim
       t2 = time_sync()
       dt[0] += t2 - t1
       assert im.shape == clean_img.shape, "Image shapes must match."
       
       while not crackFlag:

           if grad:
               im = im - grad[0]
               # ensure im is in [0, 1]
               im = torch.clamp(im, 0, 1)

           new_im = im * mask + clean_img * (1 - mask) # eval patch
           # Inference
           print('---------------------Start detecting----------------------')
           pred = model(new_im, augment=augment, visualize=visualize)
           t3 = time_sync()
           dt[1] += t3 - t2

           # NMS
           # pred = non_max_suppression(pred, conf_thres, iou_thres, classes, agnostic_nms, max_det=max_det)
           pred = non_max_suppression(pred, 0.2, iou_thres, classes, agnostic_nms, max_det=max_det) # make conf_thres smaller
           print(pred[0])
           print(pred[0].requires_grad, im.requires_grad)
           try:
               grad = torch.autograd.grad(pred[0][0][4], im)
               # print(grad)
               print(grad[0].max(), grad[0].min())
           except:
               pass

           dt[2] += time_sync() - t3
           if len(pred[0].cpu().detach().numpy()) == 0 and check_patchsize(mask):
               crackFlag = True
               # save im
               im = im.cpu().detach().numpy()
               im = im[0].transpose(1,2,0)
               im = im * 255
               im = im.astype(np.uint8)
               im = cv2.cvtColor(im, cv2.COLOR_RGB2BGR)
               cv2.imwrite("adv_images/stop.png", im)
               print("[*]Cracked, now run fool_me.py")
               # print(getflag())
           elif not check_patchsize(mask):
               print("[*]Too many adversarial pixels!")
           else:
               print("[*]Please remove the object!")

至此，通常来说题目应该已经被Mark为Solved了，但我们得到的输出并不这么认为：

------------------Initializing detector-------------------
Fusing layers... 
Model Summary: 367 layers, 46533693 parameters, 0 gradients
libpng warning: iCCP: known incorrect sRGB profile
---------------------Start detecting----------------------
tensor([[2.31950e+02, 1.63722e+02, 6.37381e+02, 5.43151e+02, 5.21886e-01, 1.10000e+01],
        [4.71159e+02, 2.11284e+02, 6.39552e+02, 5.44185e+02, 4.40381e-01, 1.10000e+01],
        [1.06963e+00, 2.29302e+02, 2.94475e+02, 5.46162e+02, 4.39895e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
C:\Users\Kyriota\AppData\Local\Programs\Python\Python39\lib\site-packages\torch\autograd\__init__.py:276: UserWarning: Error detected in struct torch::autograd::CopySlices. Traceback of forward call that caused the error:
  File "C:\Users\Kyriota\AppData\Local\Programs\Python\Python39\lib\runpy.py", line 197, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "C:\Users\Kyriota\AppData\Local\Programs\Python\Python39\lib\runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "c:\Users\Kyriota\.vscode\extensions\ms-python.python-2023.14.0\pythonFiles\lib\python\debugpy\__main__.py", line 39, in <module>
    cli.main()
  File "c:\Users\Kyriota\.vscode\extensions\ms-python.python-2023.14.0\pythonFiles\lib\python\debugpy/..\debugpy\server\cli.py", line 430, in main
    run()
  File "c:\Users\Kyriota\.vscode\extensions\ms-python.python-2023.14.0\pythonFiles\lib\python\debugpy/..\debugpy\server\cli.py", line 284, in run_file        
    runpy.run_path(target, run_name="__main__")
  File "c:\Users\Kyriota\.vscode\extensions\ms-python.python-2023.14.0\pythonFiles\lib\python\debugpy\_vendored\pydevd\_pydevd_bundle\pydevd_runpy.py", line 321, in run_path
    return _run_module_code(code, init_globals, run_name,
  File "c:\Users\Kyriota\.vscode\extensions\ms-python.python-2023.14.0\pythonFiles\lib\python\debugpy\_vendored\pydevd\_pydevd_bundle\pydevd_runpy.py", line 135, in _run_module_code
    _run_code(code, mod_globals, init_globals,
  File "c:\Users\Kyriota\.vscode\extensions\ms-python.python-2023.14.0\pythonFiles\lib\python\debugpy\_vendored\pydevd\_pydevd_bundle\pydevd_runpy.py", line 124, in _run_code
    exec(code, run_globals)
  File "C:\Users\Kyriota\Desktop\CISCN\ciscn2023_AdvDetPatch\adv\exp.py", line 181, in <module>
    main(opt)
  File "C:\Users\Kyriota\Desktop\CISCN\ciscn2023_AdvDetPatch\adv\exp.py", line 176, in main
    run(**vars(opt))
  File "C:\Users\Kyriota\Desktop\CISCN\ciscn2023_AdvDetPatch\adv\exp.py", line 117, in run
    pred = non_max_suppression(pred, 0.2, iou_thres, classes, agnostic_nms, max_det=max_det) # make conf_thres smaller
  File "C:\Users\Kyriota\Desktop\CISCN\ciscn2023_AdvDetPatch\adv\utils\general.py", line 697, in non_max_suppression
    x[:, 5:] *= x[:, 4:5]  # conf = obj_conf * cls_conf
 (Triggered internally at  C:\actions-runner\_work\pytorch\pytorch\builder\windows\pytorch\torch\csrc\autograd\python_anomaly_mode.cpp:104.)
  return Variable._execution_engine.run_backward(  # Calls into the C++ engine to run the backward pass
[*]Please remove the object!

在这份报错中，我们关注的是adv\utils\general.py的报错

x[:, 5:] = x[:, 4:5] # conf = obj_conf cls_conf

见到了*=操作符以及[]直接对元素的操作，都表明了这是一个inplace操作，inplace操作是PyTorch为了节省内存，提高运行速度而直接在原始变量上进行修改和计算的一种操作方式，详情可以自行Google：Inplace PyTorch，这种操作方式有一个很大的问题就是无法进行AutoGrad自动求梯度，而此处我们恰好需要进行AutoGrad，所以我们需要将此处的Inplace操作修改为非Inplace的操作，具体需要修改的是adv\utils\general.py的Line 696-739，需要将原本的x进行clone()，在clone出的new_x上进行操作，并避免对new_x、x的任意一方进行inplace操作，new_x[:, 5:] = x[:, 5:] * x[:, 4:5]就顺利地避免了这件事

Edited Code

# Compute conf
      new_x = x.clone() # If not clone, it will be an inplace operation
      new_x[:, 5:] = x[:, 5:] * x[:, 4:5]  # conf = obj_conf * cls_conf

      # Box (center x, center y, width, height) to (x1, y1, x2, y2)
      box = xywh2xyxy(new_x[:, :4])

      # Detections matrix nx6 (xyxy, conf, cls)
      if multi_label:
          i, j = (new_x[:, 5:] > conf_thres).nonzero(as_tuple=False).T
          xnew_x = torch.cat((box[i], xnew_x[i, j + 5, None], j[:, None].float()), 1)
      else:  # best class only
          conf, j = new_x[:, 5:].max(1, keepdim=True)
          new_x = torch.cat((box, conf, j.float()), 1)[conf.view(-1) > conf_thres]

      # Filter by class
      if classes is not None:
          new_x = new_x[(new_x[:, 5:6] == torch.tensor(classes, device=new_x.device)).any(1)]

      # Apply finite constraint
      # if not torch.isfinite(x).all():
      #     x = x[torch.isfinite(x).all(1)]

      # Check shape
      n = new_x.shape[0]  # number of boxes
      if not n:  # no boxes
          continue
      elif n > max_nms:  # excess boxes
          new_x = new_x[new_x[:, 4].argsort(descending=True)[:max_nms]]  # sort by confidence

      # Batched NMS
      c = new_x[:, 5:6] * (0 if agnostic else max_wh)  # classes
      boxes, scores = new_x[:, :4] + c, new_x[:, 4]  # boxes (offset by class), scores
      i = torchvision.ops.nms(boxes, scores, iou_thres)  # NMS
      if i.shape[0] > max_det:  # limit detections
          i = i[:max_det]
      if merge and (1 < n < 3E3):  # Merge NMS (boxes merged using weighted mean)
          # update boxes as boxes(i,4) = weights(i,n) * boxes(n,4)
          iou = box_iou(boxes[i], boxes) > iou_thres  # iou matrix
          weights = iou * scores[None]  # box weights
          new_x[i, :4] = torch.mm(weights, new_x[:, :4]).float() / weights.sum(1, keepdim=True)  # merged boxes
          if redundant:
              i = i[iou.sum(1) > 1]  # require redundancy

      output[xi] = new_x[i]

在修改了adv\utils\general.py中的inplace操作后，我们的exp就可以正常运行啦

Log

------------------Initializing detector-------------------
Fusing layers... 
Model Summary: 367 layers, 46533693 parameters, 0 gradients
libpng warning: iCCP: known incorrect sRGB profile
---------------------Start detecting----------------------
tensor([[2.99440e+02, 1.65098e+02, 6.39046e+02, 5.46643e+02, 5.57359e-01, 1.10000e+01],
        [9.87518e-01, 2.29487e+02, 2.95075e+02, 5.46320e+02, 4.48890e-01, 1.10000e+01],
        [4.67540e+02, 2.11631e+02, 6.39664e+02, 5.44510e+02, 4.05359e-01, 1.10000e+01],
        [2.26281e+02, 2.03809e+02, 3.72906e+02, 5.13177e+02, 2.52862e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02568) tensor(-0.02769)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.64544e+02, 2.11324e+02, 6.39780e+02, 5.44572e+02, 4.44466e-01, 1.10000e+01],
        [2.97909e+02, 1.64988e+02, 6.39148e+02, 5.46905e+02, 4.07725e-01, 1.10000e+01],
        [1.25335e+01, 2.16234e+02, 3.21994e+02, 5.42364e+02, 3.96188e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02159) tensor(-0.01982)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[2.97461e+02, 1.65155e+02, 6.39086e+02, 5.46568e+02, 4.47543e-01, 1.10000e+01],
        [1.27674e+01, 2.16266e+02, 3.21484e+02, 5.42356e+02, 3.95687e-01, 1.10000e+01],
        [4.66559e+02, 2.11551e+02, 6.39689e+02, 5.44489e+02, 3.58109e-01, 1.10000e+01],
        [2.24259e+02, 2.03079e+02, 3.75759e+02, 5.14603e+02, 2.00155e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02328) tensor(-0.02582)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[2.29764e+02, 1.63141e+02, 6.36678e+02, 5.44628e+02, 3.93021e-01, 1.10000e+01],
        [1.20015e+01, 2.09785e+02, 3.94054e+02, 5.39255e+02, 3.92304e-01, 1.10000e+01],
        [4.63676e+02, 2.11226e+02, 6.39796e+02, 5.44551e+02, 3.89934e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.03840) tensor(-0.02972)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[5.46739e+00, 2.09377e+02, 4.15404e+02, 5.39420e+02, 4.52883e-01, 1.10000e+01],
        [4.61235e+02, 2.10750e+02, 6.39857e+02, 5.44667e+02, 4.21564e-01, 1.10000e+01],
        [3.17969e+02, 1.63581e+02, 5.48315e+02, 5.35918e+02, 2.31240e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01583) tensor(-0.01487)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.61415e+02, 2.10783e+02, 6.39854e+02, 5.44658e+02, 4.19019e-01, 1.10000e+01],
        [6.71468e+00, 2.09764e+02, 4.11786e+02, 5.39314e+02, 4.15713e-01, 1.10000e+01],
        [2.33962e+02, 1.62835e+02, 6.32862e+02, 5.44387e+02, 2.50291e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02130) tensor(-0.02102)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.74260e+00, 2.09793e+02, 4.12019e+02, 5.39302e+02, 4.13334e-01, 1.10000e+01],
        [3.02754e+02, 1.65323e+02, 6.38845e+02, 5.46732e+02, 3.41682e-01, 1.10000e+01],
        [4.70861e+02, 2.11502e+02, 6.39273e+02, 5.45185e+02, 2.92887e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01749) tensor(-0.01496)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[9.69278e+00, 2.10208e+02, 4.03334e+02, 5.39157e+02, 3.75298e-01, 1.10000e+01],
        [3.01532e+02, 1.65306e+02, 6.38896e+02, 5.46712e+02, 3.43980e-01, 1.10000e+01],
        [4.70989e+02, 2.11515e+02, 6.39274e+02, 5.45182e+02, 2.92170e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01465) tensor(-0.01859)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[2.28244e+02, 1.63378e+02, 6.38103e+02, 5.44877e+02, 3.58895e-01, 1.10000e+01],
        [8.05008e-01, 2.31701e+02, 2.91779e+02, 5.46677e+02, 3.49028e-01, 1.10000e+01],
        [4.64350e+02, 2.11181e+02, 6.39744e+02, 5.44553e+02, 3.31244e-01, 1.10000e+01],
        [2.21834e+02, 2.02153e+02, 3.78507e+02, 5.16345e+02, 2.02959e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.03296) tensor(-0.02410)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.93478e+00, 2.10221e+02, 4.13514e+02, 5.39214e+02, 3.81639e-01, 1.10000e+01],
        [4.61900e+02, 2.10729e+02, 6.39779e+02, 5.44686e+02, 3.52377e-01, 1.10000e+01],
        [2.35689e+02, 1.62994e+02, 6.33016e+02, 5.44957e+02, 2.14085e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01133) tensor(-0.01336)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.62111e+02, 2.10766e+02, 6.39778e+02, 5.44674e+02, 3.50585e-01, 1.10000e+01],
        [9.42287e+00, 2.10610e+02, 4.06254e+02, 5.39079e+02, 3.47936e-01, 1.10000e+01],
        [2.33012e+02, 1.63025e+02, 6.34475e+02, 5.44863e+02, 2.41192e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02165) tensor(-0.01778)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[3.04119e+02, 1.65405e+02, 6.38794e+02, 5.46639e+02, 3.50666e-01, 1.10000e+01],
        [9.52650e+00, 2.10631e+02, 4.06190e+02, 5.39065e+02, 3.46781e-01, 1.10000e+01],
        [4.71491e+02, 2.11652e+02, 6.39239e+02, 5.45020e+02, 2.50843e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02018) tensor(-0.01902)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.92395e+00, 2.10629e+02, 4.16032e+02, 5.39267e+02, 3.49018e-01, 1.10000e+01],
        [4.61676e+02, 2.10669e+02, 6.39771e+02, 5.44667e+02, 3.10069e-01, 1.10000e+01],
        [2.31911e+02, 1.63185e+02, 6.34352e+02, 5.45076e+02, 2.31361e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01170) tensor(-0.01174)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[9.05428e+00, 2.11022e+02, 4.08999e+02, 5.39135e+02, 3.22089e-01, 1.10000e+01],
        [4.61794e+02, 2.10688e+02, 6.39771e+02, 5.44658e+02, 3.09146e-01, 1.10000e+01],
        [2.30330e+02, 1.63200e+02, 6.35278e+02, 5.44961e+02, 2.54768e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01150) tensor(-0.01293)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.21933e-01, 2.33057e+02, 2.87871e+02, 5.46809e+02, 3.21319e-01, 1.10000e+01],
        [4.61861e+02, 2.10696e+02, 6.39771e+02, 5.44652e+02, 3.08678e-01, 1.10000e+01],
        [2.29001e+02, 1.63199e+02, 6.36153e+02, 5.44797e+02, 2.82797e-01, 1.10000e+01],
        [2.19337e+02, 2.01094e+02, 3.80560e+02, 5.18359e+02, 2.04086e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.03610) tensor(-0.02654)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[5.68347e+00, 2.10769e+02, 4.25982e+02, 5.39259e+02, 3.29447e-01, 1.10000e+01],
        [4.62003e+02, 2.10736e+02, 6.39775e+02, 5.44642e+02, 3.09927e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.00983) tensor(-0.01211)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.62217e+02, 2.10771e+02, 6.39774e+02, 5.44629e+02, 3.09151e-01, 1.10000e+01],
        [6.18793e+00, 2.11071e+02, 4.24154e+02, 5.39151e+02, 3.06230e-01, 1.10000e+01],
        [2.32386e+02, 1.63424e+02, 6.33786e+02, 5.45476e+02, 2.04663e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02187) tensor(-0.01586)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.22729e+00, 2.11085e+02, 4.24123e+02, 5.39140e+02, 3.06370e-01, 1.10000e+01],
        [3.05818e+02, 1.65497e+02, 6.38405e+02, 5.46541e+02, 2.79065e-01, 1.10000e+01],
        [4.71523e+02, 2.11698e+02, 6.39244e+02, 5.44901e+02, 2.21405e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01001) tensor(-0.01309)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.87506e+00, 2.11398e+02, 4.21776e+02, 5.39026e+02, 2.85813e-01, 1.10000e+01],
        [3.05309e+02, 1.65486e+02, 6.38404e+02, 5.46548e+02, 2.75543e-01, 1.10000e+01],
        [4.71635e+02, 2.11703e+02, 6.39247e+02, 5.44903e+02, 2.21985e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.00883) tensor(-0.01158)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[3.04795e+02, 1.65479e+02, 6.38402e+02, 5.46556e+02, 2.72046e-01, 1.10000e+01],
        [7.72601e+00, 2.11700e+02, 4.18948e+02, 5.38914e+02, 2.68070e-01, 1.10000e+01],
        [4.71737e+02, 2.11707e+02, 6.39250e+02, 5.44905e+02, 2.22759e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02012) tensor(-0.01559)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.63252e+02, 2.10883e+02, 6.39755e+02, 5.44547e+02, 2.69398e-01, 1.10000e+01],
        [6.81540e+00, 2.11608e+02, 4.23172e+02, 5.39060e+02, 2.64795e-01, 1.10000e+01],
        [2.27875e+02, 1.63346e+02, 6.36536e+02, 5.45941e+02, 2.24023e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02240) tensor(-0.01346)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.87582e+00, 2.11620e+02, 4.22965e+02, 5.39048e+02, 2.65191e-01, 1.10000e+01],
        [3.04492e+02, 1.65518e+02, 6.38154e+02, 5.46432e+02, 2.46447e-01, 1.10000e+01],
        [4.66261e+02, 2.11266e+02, 6.39693e+02, 5.44395e+02, 2.22511e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.00883) tensor(-0.00965)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[2.27861e+02, 1.63791e+02, 6.36813e+02, 5.46048e+02, 2.51087e-01, 1.10000e+01],
        [7.54276e+00, 2.11909e+02, 4.20730e+02, 5.38950e+02, 2.49378e-01, 1.10000e+01],
        [4.66363e+02, 2.11283e+02, 6.39697e+02, 5.44387e+02, 2.23032e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02562) tensor(-0.01938)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[5.88934e+00, 2.11406e+02, 4.31660e+02, 5.39174e+02, 2.55222e-01, 1.10000e+01],
        [4.41733e+02, 1.98434e+02, 6.40785e+02, 5.46315e+02, 2.47780e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01241) tensor(-0.01126)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.42144e+02, 1.98801e+02, 6.40774e+02, 5.46288e+02, 2.44499e-01, 1.10000e+01],
        [6.19185e+00, 2.11646e+02, 4.30635e+02, 5.39053e+02, 2.36687e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01627) tensor(-0.01399)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[3.05759e+02, 1.65554e+02, 6.38039e+02, 5.46447e+02, 2.41751e-01, 1.10000e+01],
        [6.22633e+00, 2.11659e+02, 4.30684e+02, 5.39050e+02, 2.34810e-01, 1.10000e+01],
        [4.68911e+02, 2.11582e+02, 6.39671e+02, 5.44300e+02, 2.08955e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01791) tensor(-0.01338)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.11099e+00, 2.11577e+02, 4.32366e+02, 5.39178e+02, 2.29949e-01, 1.10000e+01],
        [4.67445e+02, 2.11376e+02, 6.39696e+02, 5.44351e+02, 2.16738e-01, 1.10000e+01],
        [3.06311e+02, 1.65559e+02, 6.37805e+02, 5.46486e+02, 2.09929e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.00953) tensor(-0.01247)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.67489e+02, 2.11380e+02, 6.39702e+02, 5.44346e+02, 2.17577e-01, 1.10000e+01],
        [6.39536e+00, 2.11776e+02, 4.31496e+02, 5.39074e+02, 2.14570e-01, 1.10000e+01],
        [3.06059e+02, 1.65553e+02, 6.37798e+02, 5.46512e+02, 2.05941e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01595) tensor(-0.01078)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.40094e+00, 2.11787e+02, 4.31503e+02, 5.39063e+02, 2.15568e-01, 1.10000e+01],
        [3.05005e+02, 1.65564e+02, 6.37797e+02, 5.46392e+02, 2.13278e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.00856) tensor(-0.01144)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[5.03036e-01, 2.35432e+02, 2.68015e+02, 5.47268e+02, 2.10955e-01, 1.10000e+01],
        [3.04768e+02, 1.65558e+02, 6.37798e+02, 5.46419e+02, 2.08983e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01639) tensor(-0.01730)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[2.37762e+01, 1.74297e+02, 6.26394e+02, 5.36317e+02, 2.15803e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.02076) tensor(-0.01633)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[3.05007e+02, 1.65532e+02, 6.37837e+02, 5.46464e+02, 2.16731e-01, 1.10000e+01],
        [6.43428e+00, 2.11935e+02, 4.29547e+02, 5.39050e+02, 2.12161e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01565) tensor(-0.01634)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.28447e+00, 2.11858e+02, 4.31250e+02, 5.39170e+02, 2.08235e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.00794) tensor(-0.01184)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.56436e-01, 2.35380e+02, 2.68908e+02, 5.47319e+02, 2.03724e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01649) tensor(-0.01712)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[2.37818e+01, 1.73652e+02, 6.25408e+02, 5.35924e+02, 2.07998e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01791) tensor(-0.01575)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[6.22389e+00, 2.11991e+02, 4.29703e+02, 5.39186e+02, 2.05615e-01, 1.10000e+01],
        [4.66568e+02, 2.11206e+02, 6.39723e+02, 5.44350e+02, 2.01893e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.00740) tensor(-0.01135)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.66580e+02, 2.11211e+02, 6.39728e+02, 5.44346e+02, 2.02418e-01, 1.10000e+01],
        [4.12628e-01, 2.35314e+02, 2.70160e+02, 5.47328e+02, 2.00482e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01451) tensor(-0.01116)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([[4.10477e-01, 2.35314e+02, 2.70265e+02, 5.47322e+02, 2.01308e-01, 1.10000e+01]], grad_fn=<IndexBackward0>)
True True
tensor(0.01699) tensor(-0.01811)
Mask sum is: tensor(53862.)
[*]Please remove the object!
---------------------Start detecting----------------------
tensor([], size=(0, 6))
False True
Mask sum is: tensor(53862.)
[*]Cracked, now run fool_me.py

至此，本题被Mark为Solved

下面的两张图分别为Patch以及被攻击后的图像的可视化检测结果

可以看见被攻击后的图像中检测到的物体置信度都在0.2以下，已经满足题目要求

Prev Home Next

CISCN2023初赛 AdvDetPatch WriteUp

CISCN2023初赛 AdvDetPatch WriteUp

题干

解题过程

初步验证

查找资料

Exp

Comments