关键词: 目标检测, 对抗攻击, 对抗防御, 对抗训练, 混淆结构

Abstract: The problem caused by the structural similarity of easily confused number pairs is the core bottleneck for improving the robustness and accuracy of intelligent water meter recognition in complex scenarios. Adversarial training, as an effective way to enhance adversarial robustness, is difficult to generate directional perturbations for specific pairs of easily confused numbers due to the lack of guidance in existing global uniform perturbation and local perturbation methods. Moreover, it is prone to cause the detection frame to jitter, and the defense strategy is hard to focus on the direction of confusion. To address this issue, an adversarial training method based on confusion awareness was proposed. On the attack side, aiming at the confusion characteristics of easily confused number pairs, a Projected Gradient Descent (PGD)-based attack method, namely Projected Gradient Descent with Branch-Decoupled Adversarial Perturbation (BDAP) and Semantic Morphological Constraints Alignment (SMTCA) (PGD-BS) was proposed.Branch-Decoupled Adversarial Perturbation (BDAP) and Semantic Morphological Constraints (SMC) were introduced to generate structured adversarial perturbations that decouple classification misguidance from localization regression. On the defense side, building upon the TRadeoff-inspired Adversarial DEfense via Surrogate-loss minimization (TRADES) framework, a Confusion-Aware TRADES (CA-TRADES) method was proposed. .Directional Kullback-Leibler (KL) divergence losses with asymmetric confusion weights were introduced only for positive-sample easily confused class pairs and coupled with YOLO losses. Experiments show that the success rate of PGD-BS attack is 9.66 percentage points higher than that of traditional PGD, and the positioning offset is significantly reduced. Under the directed obfuscation attack in this paper, the robustness precision of CA-TRADES is improved by 2.46 percentage points compared with that of TRADES. The single-digit accuracy rate has increased by 2.5 percentage points compared to the Baseline model (Standard trained YOLOV11 model). The effectiveness of this method in the water meter reading recognition project has been verified.

Key words: target detection, adversarial attack, adversarial defense, adversarial training, confusion structure