Abstract: The problem caused by the structural similarity of easily confused number pairs is the core bottleneck for improving the robustness and accuracy of intelligent water meter recognition in complex scenarios. Adversarial training, as an effective way to enhance adversarial robustness, is difficult to generate directional perturbations for specific pairs of easily confused numbers due to the lack of guidance in existing global uniform perturbation and local perturbation methods. Moreover, it is prone to cause the detection frame to jitter, and the defense strategy is hard to focus on the direction of confusion. To address this issue, an adversarial training method based on confusion awareness was proposed. On the attack side, aiming at the confusion characteristics of easily confused number pairs, a Projected Gradient Descent (PGD)-based attack method, namely Projected Gradient Descent with Branch-Decoupled Adversarial Perturbation (BDAP) and Semantic Morphological Constraints Alignment (SMTCA) (PGD-BS) was proposed.Branch-Decoupled Adversarial Perturbation (BDAP) and Semantic Morphological Constraints (SMC) were introduced to generate structured adversarial perturbations that decouple classification misguidance from localization regression. On the defense side, building upon the TRadeoff-inspired Adversarial DEfense via Surrogate-loss minimization (TRADES) framework, a Confusion-Aware TRADES (CA-TRADES) method was proposed. .Directional Kullback-Leibler (KL) divergence losses with asymmetric confusion weights were introduced only for positive-sample easily confused class pairs and coupled with YOLO losses. Experiments show that the success rate of PGD-BS attack is 9.66 percentage points higher than that of traditional PGD, and the positioning offset is significantly reduced. Under the directed obfuscation attack in this paper, the robustness precision of CA-TRADES is improved by 2.46 percentage points compared with that of TRADES. The single-digit accuracy rate has increased by 2.5 percentage points compared to the Baseline model (Standard trained YOLOV11 model). The effectiveness of this method in the water meter reading recognition project has been verified.

Key words: target detection, adversarial attack, adversarial defense, adversarial training, confusion structure

摘要： 易混淆数字对因结构相似性引发的问题是水表智能识别在复杂场景下提升识别鲁棒性与准确率的核心瓶颈。对抗训练作为增强对抗鲁棒性的一种有效方式，由于现有全局均匀扰动和局部扰动方法缺乏引导，难以生成针对特定易混淆数字对的定向扰动，且易导致检测框抖动，防御策略难以聚焦易混淆方向。针对这一问题，本文提出一种基于混淆感知的对抗训练方法。在攻击侧，针对易混淆数字对的混淆特征，基于投影梯度下降(PGD)提出融合分支解耦扰动与语义形态约束的PGD攻击方法(PGD-BS)，该方法通过引入分支解耦对抗扰动(BDAP)与语义形态约束(SMC)，实现分类误导与定位回归解耦的语义结构化扰动。在防御侧，基于替代损失最小化的权衡启发式对抗防御框架(TRADES)，提出基于混淆感知的TRADES对抗训练(CA-TRADES)方法，该方法仅对正样本易混淆类对引入带非对称混淆权重的方向性Kullback-Leibler(KL)散度损失，并将它与YOLO损失耦合。实验结果表明，PGD-BS攻击成功率相较于传统PGD提升了9.66个百分点，定位偏移显著降低；在本文定向混淆攻击下，CA-TRADES相较于TRADES的鲁棒性精度提升了2.46个百分点；识别准确率相较于Baseline模型(标准训练的YOLOV11模型)提升了2.5个百分点。以上结果验证了该方法在水表读数识别工程中的有效性。

关键词: 目标检测, 对抗攻击, 对抗防御, 对抗训练, 混淆结构