[1] [1] LIU W,ANGUELOV D,ERHAN D,et al.SSD:single shot multibox detector［C］//European Conference on Computer Vision,June 26-July 1,2016,Las Vegas,NV,USA.New York:IEEE Press,2016:21-37.

[2] [2] REDMON J,DIVVALA S,GIRSHICK R,et al.You only look once:unified,real time object detection［C］//Computer Vision and Pattern Recognition,June 26-July 1,2016,Las Vegas,NV,USA.New York:IEEE Press,2016:779-788.

[3] [3] REN S Q,HE K M,GIRSHICK R,et al.Faster RCNN:towards real-time object detection with region proposal networks[J].IEEE Transactions on Pattern Analysis and Machine Intelligence,2017,39(6):1137-1149.

[7] [7] SZEGEDY C,ZAREMBA W,SUTSKEVER I,et al.Intriguing properties of neural networks ［EB/OL］. (2013-12-21) ［2021-12-01］.http://arxiv.org /abs/1312.6199.

[8] [8] AKHTAR N,MIAN A,KARDAN N,et al.Advances in adversarial attacks and defenses in computer vision: a survey[J].IEEE Access,2021,9:155161-155196.

[9] [9] SHARIF M, BAUE L,REITE M K.On the suitability of Lp-norms for creating and preventing adversarial examples［C］//2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, June 18-22,2018,Salt Lake City,USA.New York:IEEE Press,2018:1605-1613.

[10] [10] GRAGNANIELLO D,MARRA F,VERDOLIVA L,et al.Perceptual quality-preserving black-box attack against deep learning image classifiers[J].Pattern Recognition Letters,2021,147:142-149.

[11] [11] LIAO Q,WANG X,KONG B,et al.Transferable adversarial examples for anchor free object detection［C］//2021 IEEE International Conference on Multimedia and Expo,July 5-9,2021,Virtual. New York: IEEE Press,2021:1-6.

[12] [12] LIU X, ANG H,LIU Z, et al.DPatch: an adversarial patch attack on object detectors［C/OL］ //AAAI Workshop on Artificial Intelligence Safety 2019.(2018-06-05)［2022-03-06］.https://arxiv.org/abs/1806.02299.

[13] [13] CHOW K H,LING L,LOPER M,et al.Adversarial objectness gradient attacks in real-time object detection systems［C］//2020 Second IEEE International Conference on Trust,Privacy and Security in Intelligent Systems and Applications,December 1-3,2020,Virtual. New York:IEEE Press,2020:263-272.

[14] [14] XIE C,WANG J,ZHANG Z,et al.Adversarial examples for semantic segmentation and object detection［C］//2017 IEEE International Conference on Computer Vision, October 22-29,2017,Venice,Italy.New York: IEEE Press,2017:1378-1387.

[15] [15] LI Y Z,TIAN D,CHANG M C,et al.Robust adversarial perturbation on deep proposal-based models［C］//British Machine Vision Conference,September 3-6,2018,Newcastle,Britain.BMVC,2018:231.

[16] [16] LI Y, BIAN X,CHANG M C,et al.Exploring the vulnerability of single shot module in object detectors via imperceptible background patches ［EB/OL］.(2019-01-02)［2022-04-23］.http://arxiv.org/abs/2112.03223.

[17] [17] LIU A,LIN W,PAUL M,et al.Just noticeable difference for images with decomposition model for separating edge and textured regions[J]. IEEE Transactions on Circuits and Systems for Video Technology,2010,20(11):1648-1652.

[18] [18] LUO B,LIU Y.Towards imperceptible and robust adversarial example attacks against neural networks［C］//AAAI Conference on Artificial Intelligence,February 2-7,2018,Louisiana,USA.Menlo Park:AAAI Press,2018:1652-1659.

[19] [19] DONG X,CHEN D,BAO J,et al.GreedyFool:Distortion-aware sparse adversarial attack［C］ //Advances in Neural Information Processing Systems 33,December 6-12, 2020,Virtual.New York:Curran Associates,Inc,2020:11226-11236.