Generative adversarial attack method for deep learning industrial soft measurement model

Abstract

The invention provides a generative adversarial attack method for a deep learning industrial soft measurement model, and the method comprises the following steps: training an agent deep learning soft measurement model based on a constructed observation data set 1, and constructing a generative model; performing peak self-searching based on label data in the constructed observation data set 2 to obtain false output, taking the false output as input of the generative model, and training to obtain an adversarial sample generator; inputting hijacked query data into the adversarial sample generator to obtain an adversarial sample, inputting the adversarial sample into the original soft measurement model, and making false prediction. According to the method, the defects that an existing attack method is poor in universality, insufficient in false prediction reasonability and the like can be overcome, firstly, false prediction of soft measurement has reasonability in numerical value through false output of the self-searching peak, secondly, the mechanism knowledge of the industrial process does not need to be known, an attack generator can be used for directly generating an adversarial sample to carry out attacks, and the attack efficiency is improved. Therefore, the method has applicability to various complex industrial processes.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial soft measurement and industrial information security, and specifically belongs to a generative adversarial attack method for a deep learning industrial soft measurement model. Background Art

[0002] In complex industrial processes, the measurement of key target variables in industrial processes is often challenging due to the influence of complex environments such as high temperature, corrosion and strong magnetic fields. However, it is usually difficult to use hardware sensors to perform stable measurements in complex industrial processes. Therefore, soft sensing methods have been widely studied and applied. Soft sensing methods use the mathematical mapping relationship between easy-to-measure industrial process variables (abbreviated as auxiliary variables) and difficult-to-measure key quality variables (abbreviated as dominant variables) to establish models. This type of soft sensing model can fully simulate the functions of hardware sensors. When predicting dominant variables, it is not affected by the complex environment of the industrial process and has natural advantages in terms of versatility, flexibility and cost.

[0003] Soft sensing methods are usually divided into data-driven methods and mechanism knowledge-driven methods. Since it is difficult for mechanism knowledge-driven soft sensing methods to establish accurate mechanism knowledge models in complex industrial processes, data-driven soft sensing methods have become the current mainstream. Compared with traditional data-driven soft sensing methods based on machine learning, deep learning-based soft sensing methods can achieve higher soft sensing accuracy in most application scenarios. However, such a high-precision soft sensing model has not been widely deployed and applied at present because its security and reliability are being seriously threatened by adversarial attacks.

[0004] Studies have shown that deep neural networks are susceptible to imperceptible adversarial attacks, which can give erroneous output results with high confidence. The deep learning soft sensor model (DLSS) is based on deep neural networks, which are naturally susceptible to adversarial attacks. At the same time, more and more control systems at complex industrial process sites are highly interconnected with corporate and public networks. Attackers can easily exploit various software and hardware vulnerabilities to invade industrial control systems and then carry out malicious adversarial attacks on the DLSS deployed therein. [Small perturbations are enough: Adversarialattacks on time series prediction·Information Sciences, 2022(03):794-812] proposed a time series generator to implement adversarial attacks on DLSS, but since this method requires the real labels of actual test samples, it cannot be truly used for online attacks on DLSS. To address this shortcoming, a direct attack output adversarial attack method (IDAO) was proposed in the paper [Adversarial lattacks on neural-network-based soft sensors: directly attack output·IEEE Transactions on Industrial Informatics, 2022(04): 2443-2451] to carry out adversarial attacks on DLSS. This method cleverly avoids the use of real labels by reconstructing the optimization problem, thereby realizing online attacks on DLSS. However, the IDAO method is limited by the optimization goal, and the generated false output increases the predicted value of each sample numerically. At the initial attack moment, the generated false output value will have an obvious jump compared with the normal output value. These phenomena make the output of IDAO unreasonable, so that the IDAO method can be easily detected by experienced operators, resulting in attack failure.

[0005] In order to overcome the shortcomings of the IDAO method, a mechanism knowledge-guided adversarial attack method (KGAA) was proposed in the literature [When deep learning-based soft sensors encounter reliability challenges: A practical knowledge-guided adversarial lattack and its defense·IEEE Transactions on Industrial Informatics, 2024(02): 2702-2714] to attack DLSS. Compared with the IDAO method, this method avoids the jump of false output values ​​at the initial attack time, and the false outputs at other attack times are all near the mechanism value (the mechanism value refers to the output of the soft measurement model driven by the mechanism knowledge corresponding to DLSS). Such false outputs meet the operator's understanding of the process. Therefore, KGAA has strong concealment and rationality and is difficult to be discovered. However, in some complex industrial processes, the soft measurement model driven by mechanism knowledge is usually difficult to establish, which will limit the universality of the KGAA method. In addition, the existing adversarial attack methods still have the disadvantages of insufficient universality, false output and poor rationality, resulting in a large deviation in the measurement of key target variables in the industrial process, leading to the failure of the adversarial attack. Summary of the invention

[0006] In order to solve the problem that the adversarial attack methods used in existing complex industrial processes have defects, resulting in great deviations in the measurement of key target variables and causing the adversarial attack to fail, the present invention provides a generative adversarial attack method for deep learning industrial soft measurement models.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The present invention provides a generative adversarial attack method for a deep learning industrial soft sensor model, comprising the following steps:

[0009] Based on the self-peak search of the label data in the constructed observation data set 2, a false output is obtained;

[0010] Based on the constructed observation data set 1, a proxy deep learning industrial soft sensor model is trained to construct a generative model, and the false output is used as an input of the generative model to train an adversarial sample generator;

[0011] The adversarial sample generator is input based on the hijacked query data to obtain a false output value.

[0012] Preferably, the step of obtaining a false output based on the self-peak search of the label data in the constructed observation data set 2 comprises:

[0013] Obtaining a label data curve based on the label data in the constructed observation data set 2;

[0014] Automatically searching for peaks based on the label data in the observation data set 2 to obtain convex peak data points and concave peak data points of the label data curve;

[0015] Expanding the convex peak data points and the concave peak data points respectively to obtain enlarged convex peak data points and enlarged concave peak data points;

[0016] Based on the amplified convex peak data points and the amplified concave peak data points, respectively replacing the convex peak data points and the concave peak data points in the observation data set 2, to obtain a peak amplified observation data set;

[0017] The false output is obtained based on the label data in the peak amplification observation data set 2

[0018] Preferably, the label data in the observation data set 2 is automatically peaked, including:

[0019] Calculate the mean of the label data y;

[0020] Based on the mean value and the preset peak parameter, each label data y in the observation data set 2 is judged to obtain the convex peak starting point and the convex peak ending point, the concave peak starting point and the concave peak ending point of the label data curve;

[0021] Based on the peak end point and the peak start point, determine all the peak regions on the label data curve, and obtain label data corresponding to the peak region in the observation data set 2 to obtain peak data points;

[0022] Based on the concave peak end point and the concave peak start point, all concave peak regions on the label data curve are determined, label data corresponding to the concave peak region in the observation data set 2 is obtained, and the concave peak data point is obtained.

[0023] Preferably, the convex peak data points and the concave peak data points are expanded, comprising:

[0024] Expanding the convex peak data point according to the convex peak magnification coefficient to obtain the amplified convex peak data point;

[0025] The concave peak data point is expanded according to the concave peak magnification coefficient to obtain the magnified concave peak data point.

[0026] Preferably, the constructing of the observation data set 1 and the observation data set 2 includes:

[0027] Hijack the first observation sample x 1 ,

[0028] The first observation sample x 1 Input to the original deep learning industrial soft sensor model, the deep learning industrial soft sensor model outputs the first label data y 1 ;

[0029] The first label data y 1 and the first observed sample x 1 Combine to obtain the observation data set 1;

[0030] A deep neural network constructed by training the observation data set 1 is used to obtain a proxy soft-sensing model;

[0031] Hijack the second observation sample x 2 , the second observation sample x 2 Input to the proxy soft measurement model, the proxy soft measurement model outputs the second label data y 2 ;

[0032] The second label data y 2 and the second observation sample x 2 Combine to obtain the observation data set 2.

[0033] Preferably, the training agent deep learning industrial soft sensor model based on the observation data set 1, constructing a generative model, taking the false output as the input of the generative model, and training to obtain an adversarial sample generator includes:

[0034] Based on the obtained observation dataset 1, an agent deep learning industrial soft sensor model is trained;

[0035] Introducing the agent deep learning industrial soft sensor model into a standard generative adversarial network structure to construct a generative model;

[0036] The false output After inputting into the generative model for training until the model converges, the generator in the generative model is extracted to obtain the adversarial sample generator.

[0037] Preferably, the generative model is trained, comprising:

[0038] Initialize the first parameter θ of the generator G in the generative model g and the second parameter θ of the discriminator D d ;

[0039] Fix the first parameter θ d, use the gradient optimization algorithm to maximize and update the second parameter θ d ;

[0040] Fix the second parameter θ d , use the gradient optimization algorithm to minimize and update the first parameter θ d ;

[0041] The discriminator D and the generator G are alternately trained until the generative model converges, and then the training is terminated, and the discriminator D and the generator G of the generative model are extracted to obtain an adversarial sample generator.

[0042] Preferably, the gradient optimization algorithm is maximized as follows:

[0043]

[0044] Among them, θ d is the second parameter in the discriminator D, M is the total number of data in the observed data set, θ g is the first parameter of the generator G, and x(i) is the data value in the observed data set.

[0045] Preferably, the gradient optimization algorithm is minimized as follows:

[0046]

[0047] Among them, θ d is the second parameter in the discriminator D, M is the total number of data in the observed data set, θ g is the first parameter of the generator G, x(i) is the data value in the observation data set, L represents the soft measurement loss of the generative model, function f represents the proxy soft measurement model, θ represents the known parameters of the soft measurement model, and the max function term represents the concealment loss of the adversarial attack, that is, this term is used to ensure the concealment of the generated adversarial sample. ε represents The maximum distance allowed from y.

[0048] Preferably, the attacker inputs the adversarial sample generator based on the hijacked query data to obtain a false output value, including:

[0049] Based on hijacking, the query sample x′ is input into the adversarial sample generator to obtain the adversarial sample x′ attacked ;

[0050] Based on the adversarial sample x′ attacked The original output of the deep learning industrial soft-sensing model is input to obtain a false output value, thereby realizing adversarial attack.

[0051] Compared with the prior art, the present invention has the following beneficial technical effects:

[0052] The present invention proposes a generative adversarial attack method for deep learning industrial soft sensor model. The method can avoid the shortcomings of poor universality and insufficient rationality of false output of existing attack methods. First, the attack method does not need to be able to establish a mechanism knowledge model of complex industrial processes. The adversarial sample can be directly generated by using a trained adversarial attack generator, so that the method has strong applicability to various complex industrial processes. Secondly, through the proposed automatic peak search, reasonable false output can be generated, so that the final attack result is reasonably floating near the true value, and the characteristics of the data itself are utilized to effectively simulate potential abnormalities or attack modes, so as to avoid the attack result from obviously deviating from the normal value, so that the adversarial attack result is more reasonable than other attack methods. Then, these false outputs are used to train the proxy deep learning industrial soft sensor model, and a generative model is constructed as an adversarial sample generator, which improves the generation efficiency of adversarial samples and ensures the diversity and pertinence of generated samples. The adversarial sample generator can learn and imitate the distribution of real data, and only introduces small disturbances, so that the generated samples can mislead the target model to produce wrong predictions while maintaining the authenticity of the appearance. Finally, by inputting the hijacked query data into the adversarial sample generator to obtain false output values, a covert attack on the industrial soft measurement model is achieved, providing an effective security assessment tool and defense strategy for practical applications in the industry.

[0053] Furthermore, in this method, the comprehensiveness and representativeness of the data are ensured through the carefully constructed observation data set. A labeled data curve is drawn based on the labeled data in the observation data set, which intuitively shows the changing trend and characteristics of the data. Then, the automatic peak-finding technology is used to accurately identify the convex peak data points and concave peak data points on the curve. The convex peak data points and concave peak data points are then expanded respectively to obtain enlarged convex peak data points and enlarged concave peak data points. By amplifying the extreme values ​​in the data, the generated false output is made more significant and deceptive. Finally, the convex peak data points and concave peak data points in the observation data set 2 are replaced by the enlarged convex peak data points and the enlarged concave peak data points to obtain the peak-amplified observation data set. The peak-amplified labeled data curve is obtained based on the labeled data in the peak-amplified observation data set. All corresponding data points on the peak-amplified labeled data curve are false outputs. This false output not only retains the basic characteristics of the original data, but also incorporates artificially designed abnormal patterns, which can effectively mislead deep learning industrial soft measurement models. It improves the generation accuracy and deceptiveness of false outputs, allowing attackers to more accurately simulate and predict the response of the target model. By continuously optimizing and improving the generation method of false outputs, it provides more reliable and secure protection for industrial process monitoring and quality control.

[0054] Furthermore, in this method, by calculating the mean of the label data y, the complexity of peak recognition is simplified, making the recognition process more objective and repeatable. Each label data y in the observation data set is judged one by one based on the mean and the preset peak parameters. By comparing the relationship between the data point and the mean and the peak parameters, the starting and ending points of the convex peaks and concave peaks are accurately identified, ensuring the accuracy and robustness of peak recognition. Then, according to the starting and ending points of the convex peaks and concave peaks, all the convex peak areas and concave peak areas on the label data curve are determined respectively, which significantly improves the accuracy and efficiency of automatic peak search, can more accurately identify the convex peaks and concave peaks on the label data curve, enhances the deceptiveness of the false output, and makes the entire attack process more concealed and difficult to detect.

[0055] Furthermore, in this method, a proxy deep learning industrial soft sensor model is trained based on the obtained observation data set, ensuring that the model can accurately reflect the data characteristics of the industrial process. Subsequently, the model is introduced into the GAN structure to construct a generative model together with the generator and the discriminator. The generative model is input for training. During the training process, the recognition ability of the discriminator D is maximized and the generation error of the generator G is minimized alternately, which promotes the continuous improvement of the capabilities of the generator and the discriminator until the generative model converges. This not only makes full use of the advantages of GAN in generating high-quality samples, but also enhances the pertinence and deceptiveness of the generated samples through false output.

[0056] Furthermore, in this method, the attacker first hijacks the query samples x' of the target system, and inputs these query samples into the previously trained adversarial sample generator, and obtains adversarial samples through the transformation and perturbation of the generator. These adversarial samples embed tiny perturbations that can mislead the deep learning model while maintaining the similarity with the original query samples. The adversarial samples are input into the original deep learning industrial soft measurement model. After receiving these adversarial samples, the model will produce wrong prediction results, i.e., false output values, because it cannot effectively identify the perturbations therein. This not only helps the industry to have a more comprehensive understanding of the security risks of deep learning models, but also enables attackers to accurately control the attack process and results. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A processing flow chart of a generative adversarial attack method for a deep learning industrial soft sensor model proposed by the present invention;

[0058] Figure 2 This is a schematic diagram of the expansion of automatic peak finding in a generative adversarial attack method for a deep learning industrial soft sensor model proposed by the present invention;

[0059] Figure 3A schematic diagram of thermal deformation of a rotor of a rotary power station boiler air preheater and a schematic diagram of gap compensation are provided for an embodiment of the present invention;

[0060] Figure 4 This is a schematic diagram of the expansion of the automatic peak search on the label data in the embodiment;

[0061] Figure 5 A curve diagram showing the change in the loss function value during the training process of the generative model in the embodiment;

[0062] Figure 6 A loss function value variation curve diagram of the soft measurement loss in the training process of the generative model in the embodiment;

[0063] Figure 7 This is the effect diagram of the IDAO method;

[0064] Figure 8 This is the attack effect diagram of RNAA method;

[0065] Fig. 9 The attack effect of a generative adversarial attack method proposed by the present invention on a deep learning industrial soft sensor model;

[0066] Fig.10 A schematic diagram of the degree of change of the first auxiliary variable in a generative adversarial attack method for a deep learning industrial soft sensor model proposed by the present invention;

[0067] Fig.11 A schematic diagram of the degree of change of the second auxiliary variable in a generative adversarial attack method for a deep learning industrial soft sensor model proposed by the present invention;

[0068] Fig.12 A schematic diagram of the degree of change of the third auxiliary variable in a generative adversarial attack method for a deep learning industrial soft sensor model proposed by the present invention;

[0069] Fig.13 A schematic diagram of the degree of change of the fourth auxiliary variable in a generative adversarial attack method for a deep learning industrial soft sensor model proposed by the present invention;

[0070] Fig.14 This is a comparative diagram of IDA0 attack on the third auxiliary variable;

[0071] Fig.15 A schematic diagram showing the comparison of RNAA attack on the third auxiliary variable;

[0072] In the attached figure: 1. rotor; 2. top fan-shaped plate; 3. air leakage gap. DETAILED DESCRIPTION

[0073] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0074] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0075] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0076] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or a communication; it can be a direct connection, or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0077] In the present invention, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may include that the first and second features are in direct contact, or may include that the first and second features are not in direct contact but are in contact through another feature between them. Moreover, a first feature being "above", "above" and "above" a second feature includes that the first feature is directly above and obliquely above the second feature, or simply indicates that the first feature is higher in level than the second feature. A first feature being "below", "below" and "below" a second feature includes that the first feature is directly above and obliquely above the second feature, or simply indicates that the first feature is lower in level than the second feature.

[0078] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0079] The present invention provides a generative adversarial attack method for a deep learning industrial soft sensor model (DLSS). In the method, the attacker establishes a generative adversarial network that integrates a proxy soft sensor model to directly generate corresponding adversarial samples from normal outputs, and uses the adversarial samples to complete the adversarial attack.

[0080] See also Figure 1 The generative anti-attack method for DLSS provided by the present invention specifically includes the following steps:

[0081] Step 1: The attacker obtains false output by self-peaking based on the label data in the constructed observation data set 2;

[0082] Specifically:

[0083] Step 10: The attacker hijacks the first observation sample x 1 , all the first observation samples x hijacked 1 Input to the original soft measurement model (OSS), the original soft measurement model (OSS) outputs the first label data y 1 , the first label data y 1 and the first observation sample x 1 Combined, the observation data set 1 is obtained; among them, the original soft sensor model (OSS) is the initial deep learning industrial soft sensor model (DLSS).

[0084] The observation data set 1 is input into the deep neural network constructed by the attacker, and the deep neural network is trained to obtain the proxy soft sensor model (PSS);

[0085] The attacker hijacks the second observation sample x 2 , the second observation sample x 2 Input into the proxy soft measurement model (PSS), the proxy soft measurement model (PSS) outputs the second label data y 2 ;

[0086] The second label data y 2 and the second observation sample x 2 Combined, we get observation data set 2.

[0087] Step 11, based on the second label data y in the observation data set 2 2 Get the label data curve; based on the second label data y in the observation data set 2 2Automatically find the peaks to obtain the convex peak data points and concave peak data points corresponding to the convex peaks and concave peaks on the label data curve; expand the convex peak data points and concave peak data points respectively to obtain the enlarged convex peak data points and the enlarged concave peak data points; although this operation changes the values ​​of the convex peaks and concave peaks on the label data curve, it maintains the overall data change law of the data curve, making the generated expected attack output reasonable, such as Figure 2 As shown, the solid line is the input label data, and the dotted line is the output after expansion.

[0088] Step 12, the convex peak data points and the concave peak data points in the observation data set 2 are replaced by the amplified convex peak data points and the amplified concave peak data points to obtain the peak amplified observation data set, based on the third label data y in the peak amplified observation data set 3 Get the peak amplification label data curve, all the corresponding data points on the peak amplification label data curve are false outputs

[0089] Among them, step 11 is based on the second label data y in the observation data set 2 2 The convex and concave peaks of the label data curve obtained by automatic peak search include:

[0090] Calculate the second label data y 2 The mean of

[0091] The calculation expression is:

[0092]

[0093] Among them, M is the total number of data, y(i) is the i-th label data in the observation data set 2, and i is a counting variable.

[0094] For each second label data y in observation dataset 2 2 Make a judgment to obtain the convex peak starting point and the convex peak ending point, the concave peak starting point and the concave peak ending point of the label data curve;

[0095] Specifically, if the corresponding second label data y in the label data curve 2 The difference between the (i+1)th label data and the i-th label data is not less than the peak starting parameter ξ top_begin , and the value of the i-th label data y(i) is greater than or equal to when, that is, y(i+1)-y(i)≥ξ top_begin and Among them, 1≤i≤M-2, then the peak starting point of the label data curve is obtained;

[0096] The second label data y after this point on the label data curve 2If the second label data y 2 The difference between the (j+i)th label data and the (i+j-1)th label data does not exceed the peak termination parameter ξ top_begin , and the value of the (j+i)th label data y(j+i) is less than or equal to When y(j+i)-y(i+j-1)≤ξ top_begin and i+2≤j≤M, then the peak end point of the label data curve is obtained;

[0097] Through the peak end point and the peak start point, determine all the peak areas on the label data curve, and obtain the label data y corresponding to the peak area in the observation data set i1 , get the peak data point y t , for all convex peak data points y t According to the peak magnification factor ω, the enlarged peak data point y is obtained. T .

[0098] Peak data point y t The amplification expression is:

[0099] y T =ωy t (2)

[0100] Among them, ω is the peak magnification factor, y T To enlarge the peak data point, y t Peak data points.

[0101] If the corresponding second label data y in the label data curve 2 The difference between the (k+1)th label data and the kth label data is not less than the concave peak starting parameter ζ down_begin , and the value of the k-th label data y(k) is greater than or equal to When y(k+1)-y(k)≥ζ down_begin and Among them, 1≤k≤M-2, then the concave peak starting point of the label data curve is obtained;

[0102] The second label data y after this point on the label data curve 2 If the second label data y 2 The difference between the (k+n)th label data and the (k+n-1)th label data does not exceed the concave peak termination parameter ζ down_end , and the value of the (k+n)th label data y(k+n) is less than or equal to When y(k+n)-y(k+n-1)≤ζ down_end and , k+2≤n≤M, then the concave peak end point of the label data curve is obtained;

[0103] Through the concave peak end point and concave peak start point, determine all the concave peak areas on the label data curve, and obtain the label data y corresponding to the concave peak area in the observation data set i2 , get the concave peak data point y h , for all concave peak data points y h According to the concave peak magnification coefficient ψ, the magnified concave peak data point y is obtained. H .

[0104] Concave peak data point y t The amplification expression is:

[0105] y H =ψy h (3)

[0106] Where ψ is the concave peak magnification factor, y H To enlarge the concave peak data point, y h is the concave peak data point.

[0107] Step 2: Train the proxy DLSS model based on the constructed observation dataset 1 to build a generative model with false output As the training input of the generative model, the adversarial sample generator is trained.

[0108] Specifically:

[0109] Step 20, the attacker trains a proxy DLSS model with the observation dataset 1 constructed in step 10, and then introduces the proxy DLSS model into the standard generative adversarial network (GAN) structure to construct a generative model;

[0110] Step 21: The attacker uses the fake output obtained in step 11 The model training input is input into the generative model, and the generative model is trained. After the generative model is trained until convergence, the generator in the generative model is extracted to obtain the adversarial sample generator.

[0111] Among them, the training of the generative model is specifically as follows:

[0112] The attacker first initializes the first parameter θ of the generator G in the generative model g and the second parameter θ of the discriminator D d , start training the discriminator D in the generative model; fix the first parameter θ g , train the discriminator D to update the second parameter θ of the discriminator D d , the discriminator D is trained using a gradient optimization algorithm to maximize.

[0113] Gradient optimization algorithm to maximize the objective function V 1 The expression is:

[0114]

[0115] Among them, θ d is the second parameter in the discriminator D, M is the total number of data in the observed data set, θ g is the first parameter of the generator G, and x(i) is the data value in the observed data set.

[0116] The parameter update of the discriminator D is to calculate the objective function of the original second parameter θ of the discriminator D d The data value obtained by multiplying the gradient of the optimization algorithm by the learning rate η is combined with the original second parameter θ d After adding, we get the replacement data value, which replaces the original second parameter θ of the discriminator D. d , complete the parameter update of the discriminator D.

[0117] The second parameter θ of the discriminator D d The updated expression is:

[0118]

[0119] Among them, ← represents the assignment symbol, that is, the value on the right side of the ← sign is calculated first, and then the value is assigned to the variable on the left side. is the gradient operator and η is the learning rate of the optimization algorithm.

[0120] The second parameter θ of the discriminator D d After an update, the second parameter θ of the discriminator D is fixed at this time d , then cancel the fixation of the parameters of G and update the first parameter θ by training the generator G g , the training generator G is minimized using a gradient optimization algorithm.

[0121] The objective function V is minimized by the gradient optimization algorithm 2 The expression is:

[0122]

[0123] Among them, θ d is the second parameter in the discriminator D, M is the total number of data in the observed data set, θ g is the first parameter of the generator G, x(i) is the data value in the observation data set, L represents the soft measurement loss of the generative model, function f represents the proxy soft measurement model, θ represents the known parameters of the soft measurement model, and the max function term represents the concealment loss of the adversarial attack, that is, this term is used to ensure the concealment of the generated adversarial sample. ε represents The maximum distance allowed from y.

[0124] The first parameter θ of the generator G g The update is to calculate the objective function of the original first parameter θ of the generator G. g The data value obtained by multiplying the gradient of the optimization algorithm by the learning rate η is combined with the original first parameter θ d The difference replaces the original first parameter θ of the discriminator D d , complete the parameter update of generator G.

[0125] The first parameter θ of the generator G g The updated expression is:

[0126]

[0127] Among them, ← represents the assignment symbol, that is, the value on the right side of the ← sign is calculated first, and then the value is assigned to the variable on the left side. is the gradient operator and η is the learning rate of the optimization algorithm.

[0128] The first parameter θ of the generator G g After updating once, continue to fix the first parameter θ of the generator G at this time g To train the second parameter θ of the discriminator D d , alternately train the discriminator D and the generator G until the generative model converges and then ends the training (the present invention chooses to end the training when the stopping condition is reached, and the set stopping condition is to end the training immediately after reaching a preset number of training rounds e), extract the discriminator D and the generator G of the generative model, and obtain the adversarial sample generator.

[0129] Step 3: The attacker inputs the adversarial sample generator based on the hijacked query data to obtain a false output value.

[0130] Specifically:

[0131] Step 3.1: The attacker first hijacks the query sample x′ and inputs the hijacked query sample x′ into the adversarial sample generator to generate the adversarial sample x′ corresponding to the query sample x′. attacked ;

[0132] Step 3.2: The attacker takes the adversarial sample x′ attacked The original soft sensor model (OSS) is input, that is, input into the original deep learning industrial soft sensor model, and a false output value is output to achieve adversarial attack.

[0133] The following is a verification of a generative adversarial attack method for a deep learning industrial soft sensor model proposed in the present invention through specific implementation:

[0134] This embodiment is an industrial example based on the soft measurement of thermal deformation of the air preheater rotor of a power plant boiler (hereinafter referred to as: air preheater rotor). The feasibility of the proposed generative attack method is verified by judging whether it is concealed, reasonable and stable. The superiority of the proposed generative attack method is confirmed by comparing it with other attack methods.

[0135] The specific process is as follows: First, after the attacker invades the air leakage gap control system of the power plant boiler air preheater, he hijacks the data of the measurement equipment on the data acquisition link to obtain 20,000 first observation samples x 1 (The dimensional information and physical meaning of the data have been detailed in the patent). 1 After inputting the original soft sensor model (OSS) of the rotor thermal deformation in the air leakage gap control system in sequence, the corresponding 20,000 thermal deformation prediction first label data y 1 , the first observation sample x 1 and the first label data y 1 The attacker has 20,000 observation data sets 1. The attacker designs a deep neural network (the network structure and other specific information have been described in the patent), uses this observation data set 1 as a training set, and uses the Adam algorithm to train a proxy soft sensor model (PSS). The proxy soft sensor model, as well as the designed generator and discriminator, together constitute a generative model to be trained. At the same time, the attacker continues to hijack 4,700 second observation samples x 2 , these 4700 second observation samples x 2 Input the proxy soft sensor model (PSS) to obtain the corresponding 4700 second label data y 2 , the second observation sample x at this time 2 and the second label data y 2 This constitutes an observation data set 2 with a data volume of 4700. The second label data y in the observation data set 2 is 2 Input the automatic peak finding algorithm to obtain the desired pseudo output The 4700 second observation samples x in observation dataset 2 2 And the 4700 false outputs obtained at this time As the training set (i.e., as the "input") for training the proposed generative model, the generative model is trained. After the training is completed, the generator in the model is taken out as the adversarial sample generator for standby use. Then, in the online soft measurement stage, the attacker hijacks the real-time query sample x' on the transmission link, inputs the sample into the adversarial sample generator to obtain its corresponding adversarial sample x' attacked , then x′attacked The false thermal deformation output can be obtained by sending it back to the transmission link and inputting the original soft measurement model (OSS) of the rotor thermal deformation. The attacker does not destroy all the defenses of the gap control system. He only needs to hijack the query sample and use the adversarial sample generator to apply a small disturbance to the sample to make the OSS model produce a false prediction, so that the gap control system will make a wrong judgment that the current gap is too large or too small, which will eventually cause the fan plate adjustment mechanism to malfunction and endanger the safety of the production process.

[0136] In this embodiment, 4700 data are used for testing. Starting from the 1850th data of the 4700 data, the attacker begins to perform a generative attack on each data, that is, the query sample x′ at this time is input into the adversarial sample generator to obtain the corresponding adversarial sample x′ attacked , among 4700 data Fig. 9 The attack results of the last 2150 data of 4000 data are shown. It can be seen that there is no obvious value jump at the beginning of the attack, until the predicted value reaches the convex peak part and the expansion occurs. Then, the attack output is consistent with the normal output again, until the predicted value reaches the concave peak part and the expansion occurs. The attack effect shown by the experimental results is in line with expectations. The output (i.e., the expansion part) that is larger or smaller than the normal output will cause the gap control system to misjudge that the current gap is too large or too small, thereby causing the fan plate adjustment mechanism to malfunction. For example, if the false output causes the current air leakage gap to be misjudged as a gap that is too large, the fan plate will be lowered to a low position by the actuator, destroying the normal operation of the air leakage gap control system. If the judgment that the gap is too large is continuously made, the fan plate will be adjusted to the lower limit position (i.e., the lowest position), resulting in continuous friction between the fan plate and the rotor, causing wear and damage to the equipment, and then causing a very serious industrial production safety accident.

[0137] Figure 3 The figure is a schematic diagram of the thermal deformation of the rotor of the rotary power plant boiler air preheater and a schematic diagram of the gap compensation. In this case, a deep learning soft sensor model is established and deployed in the control system to replace the hardware gap sensor to perform stable real-time measurement of the thermal deformation of the rotor 1. According to the measured deformation, the actuator will adjust the position of the fan plate 2 up and down to compensate for the air leakage gap 3 of the air preheater, as shown in Figure 3 In the example given in the article, the system compares the gap value measured by the deep learning soft measurement model with the set value. When the measured value is greater than the set value, it outputs a signal that the gap is too large, and then lowers the fan plate to track the deformed gap, thereby effectively reducing air leakage in the air preheater and avoiding energy waste.

[0138] Figure 4 Schematic diagram of the expansion of automatic peak search on label data in the embodiment, the parameters of automatic peak search are set as: ξ top_begin=0.1,ξ top_end =-0.1, ψ=0.985, ω=1.015, ζ down_begin =-0.1,ζ down_end =0.05, set 4700 test samples (these 4700 data are the label data y in the observation data set 2 of this embodiment), Figure 4 The continuous line segments in the middle are the results of expected false outputs, and the non-connected line segments are the results of implementing the data. The peak-finding results on 4700 test samples show that an ideal expansion effect is achieved in the convex peak and concave peak parts, and the values ​​of the non-peak parts are consistent with the observed data, achieving an excellent peak-finding effect as a whole.

[0139] Figure 5 The loss function value change curve of the training process of the generative model in the embodiment, the proxy soft measurement model in the generative model has a structure of 4-16-48-16-1, the activation function is ReLU, and the Adam optimizer is used for training. The relevant parameters of the optimizer are kept at the default settings. The training data of the model is 20,000 (the data set composed of these 20,000 data is the observation data set 1 of this embodiment), the input dimension of each data is 4, and each dimension represents an auxiliary variable of the soft measurement model, which is the temperature variable at the inlet and outlet of the air duct and the temperature variable at the inlet and outlet of the flue in this embodiment. The output dimension is 1, representing the dominant variable, i.e., the thermal deformation of the rotor. The number of training rounds e of the generative model is set to 500, the discriminator structure is 4-16-48-46-1, and the generator structure of the generative model is 4-16-48-16-4. The generator and discriminator of the generative model are trained using the gradient optimization algorithm, and the learning rate η is set to 10 -3 The dotted line in the figure represents the discriminator loss of the generative model, and the solid line represents the generator loss of the generative model. It can be seen from the figure that as the training rounds proceed, the discriminator loss and the generator loss gradually approach 0.25, and continue to fluctuate around this value to reach the Nash equilibrium state, indicating that the generative model converges well. Finally, the generative model ends the training after reaching the preset number of training rounds e, indicating that during the training process, the discriminator can better guide the generator to generate adversarial samples that are very close to the original input samples, thereby enhancing the concealment of the adversarial samples.

[0140] Figure 6 The loss function value change curve of the soft measurement loss in the training process of the generative model in the embodiment. It can be seen from the figure that with the increase of training rounds, the fitting loss decreases as a whole and gradually stabilizes, indicating that as the training process proceeds, the output obtained after the adversarial sample generated by the generator is input into the PSS can gradually fit the desired false output on, thereby enhancing the false output rationality.

[0141] Figure 7 to Figure 9 The attack effect diagram of the generative adversarial attack and other comparative attack methods in the embodiment is shown in FIG. The generator in the trained generative model is taken out to obtain the desired adversarial sample generator. The generative adversarial attack test is performed according to step 3. The number of test samples is 4000 (which does not overlap with the 4700 test samples in the automatic peak search algorithm). The attack effect of the generative adversarial attack method provided by the present invention is shown in FIG. Fig. 9 As shown in the figure, the horizontal axis represents 4000 test input samples, the vertical axis represents the predicted output value of OSS, the dotted line represents the normal prediction result of the model, and the solid line represents the result of the generative attack. The attack starts at the 1850th sample. It can be seen from the figure that there is no obvious value jump at the beginning of the attack, until the predicted value reaches the convex peak part and expands. Then, the attack output is consistent with the normal output again, until the predicted value reaches the concave peak part and expands. The attack effect shown by the experimental results is in line with expectations. The output (i.e., the expansion part) that is larger or smaller than the normal output will cause the gap control system to misjudge that the current gap is too large or too small, thereby causing the fan plate adjustment mechanism to malfunction. Whether it is the wrong rise or fall of the fan plate, first of all, it will increase the action frequency of the actuator, which will easily reduce the service life of the actuator and the stability of the system regulation. In serious cases, the fan plate will be adjusted to the lowest or highest position. If the fan plate is adjusted to the upper limit position (i.e. the highest position), the air leakage of the air preheater will increase significantly, causing great economic losses and energy waste. If the fan plate is adjusted to the lowest position, there will be a risk of friction between the fan plate and the rotor, which will cause wear and damage to the equipment, and then cause very serious industrial production safety accidents. The generative attack is compared with the IDAO method and the random noise adversarial attack (RNAA) method (the mean of the random noise is set to 0 and the variance is 0.02): Figure 7 The figure shows the attack effect of the IDAO method. In addition to the inherent disadvantage of a significant jump in value at the initial attack point, the attack effect of IDAO is that the predicted values ​​of the rotor thermal deformation are uniformly larger. At the same time, Figure 8 The figure shows the attack effect of the RNAA method. Its attack output is obviously chaotic and volatile. The attack results of the two comparison methods are not reasonable and can be easily discovered by experienced operators, resulting in attack failure. Therefore, it is believed that the generative attack method has better rationality.

[0142] Figure 10 to Figure 13 This is a schematic diagram of the degree of change of the four auxiliary variables after the generative adversarial attack in the embodiment. Figure 10 to Figure 13The values ​​of the auxiliary variables are all normalized. It can be seen that the adversarial samples obtained by the generative adversarial attack method are very close to the original input and maintain the change trend of the original samples. Visually, the changes in the four auxiliary variables are not large, and it is believed that the generative adversarial attack method has strong concealment.

[0143] Figure 14-15 This is a schematic diagram comparing the degree of change of the auxiliary variables after the IDAO attack and the RNAA attack in the embodiment. The figure takes the fourth auxiliary variable as an example for comparison. It can be seen that after the IDAO attack, the values ​​of the auxiliary variables show a uniform downward shift, while after the RNAA attack, the values ​​of the auxiliary variables show obvious up and down fluctuations compared to the normal values. In either case, they deviate greatly from the normal values, which makes it very easy for operators to discover, and thus it is believed that the IDAO and RNAA attacks are not concealed.

[0144] Table 1 shows the attack index results involving rationality and stability obtained by different attack methods in the embodiment. The Pearson correlation coefficient (PCC) is used to evaluate the rationality of the attack method, and the mean absolute percentage error MAPE is used to evaluate the stability of the attack method. It can be seen that the correlation coefficient PCC between the output of the generative attack and the output of the unattacked sample is the largest, indicating that the correlation between the two is stronger and the output obtained by the generative attack is more reasonable. At the same time, the MAPE value of the generative attack changes the least after the model is degraded, while the MAPE indicators of the direct attack output attack IDAO and the random noise attack RNAA have undergone greater changes, indicating that these two attack methods are difficult to maintain the attack effectiveness for a long time. Once the prediction accuracy of the soft measurement model degrades, the attack effects of IDAO and RNAA will deteriorate accordingly, which is reflected in the further increase in the gap between the output value and the true value, making the attack easier to be discovered and leading to the failure of the attack.

[0145] Table 1 shows the attack index results obtained by different attack methods in the embodiment.

[0146] Table 2 shows the attack index results involving concealment obtained by different attack methods in the embodiment, RMSE 1 To RMSE 4 are the root mean square errors between the first to fourth auxiliary variables after the attack and the original auxiliary variables without the attack. It can be seen that the RMSE of the samples after the generative attack on the first auxiliary variable, the third auxiliary variable and the fourth auxiliary variable is 1 、RMSE 3 and RMSE 4 Compared with other attack methods, the RMSE of the generative attack is the smallest. 2It is 0.02 higher than the value of random noise attack, but the RMSE values ​​of the other three auxiliary variables of random noise attack are much larger than the RMSE value of generative adversarial attack. Therefore, it is believed that the error between the adversarial sample and the original auxiliary variable after generative adversarial attack is the smallest.

[0147] Table 2 shows the attack index results related to concealment obtained by different attack methods in the embodiment.

[0148]

[0149] Based on the above analysis, Figure 3 to Figure 15 From the observation of Tables 1-2, it can be clearly seen that the generative adversarial attack method for the deep learning industrial soft measurement model proposed in the present invention is effective and feasible: first of all, this attack method has strong universality and does not require precise mechanism knowledge. By using a trained adversarial sample generator, adversarial samples corresponding to normal samples can be directly generated to implement adversarial attacks. At the same time, it can be seen from the industrial case of air preheater that the false output given by this generative attack method is more reasonable than other existing attack methods, and has better concealment and stability during attack, and is considered to have more powerful attack capabilities.

[0150] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0151] In addition, it should be understood that although this specification is described in accordance with the implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation modes that can be understood by those skilled in the art. The above content is only to illustrate the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A generative adversarial attack method for deep learning industrial soft sensor models, characterized in that: The following steps are involved: Based on the self-peak search of the label data in the constructed observation data set 2, a false output is obtained; Based on the constructed observation data set 1, a proxy deep learning industrial soft sensor model is trained to construct a generative model, and the false output is used as an input of the generative model to train an adversarial sample generator; The adversarial sample generator is input based on the hijacked query data to obtain a false output value.

2. A generative adversarial attack method for a deep learning industrial soft sensor model according to claim 1, characterized in that: The method of obtaining a false output based on the self-peak search of the label data in the constructed observation data set 2 includes: Obtaining a label data curve based on the label data in the constructed observation data set 2; Automatically searching for peaks based on the label data in the observation data set 2 to obtain convex peak data points and concave peak data points of the label data curve; Expanding the convex peak data points and the concave peak data points respectively to obtain enlarged convex peak data points and enlarged concave peak data points; Based on the amplified convex peak data points and the amplified concave peak data points, respectively replacing the convex peak data points and the concave peak data points in the observation data set 2, to obtain a peak amplified observation data set; The false output is obtained based on the label data in the peak amplification observation data set 3. A generative adversarial attack method for a deep learning industrial soft sensor model according to claim 2, characterized in that: The label data in the observation data set 2 is automatically peaked, including: Calculate the mean of the label data y; Based on the mean value and the preset peak parameter, each label data y in the observation data set 2 is judged to obtain the convex peak starting point and the convex peak ending point, the concave peak starting point and the concave peak ending point of the label data curve; Based on the peak end point and the peak start point, determine all the peak regions on the label data curve, and obtain label data corresponding to the peak region in the observation data set 2 to obtain peak data points; Based on the concave peak end point and the concave peak start point, all concave peak regions on the label data curve are determined, label data corresponding to the concave peak region in the observation data set 2 is obtained, and the concave peak data point is obtained.

4. A generative adversarial attack method for a deep learning industrial soft sensor model according to claim 2, characterized in that: The convex peak data points and the concave peak data points are expanded, including: Expanding the convex peak data point according to the convex peak magnification coefficient to obtain the amplified convex peak data point; The concave peak data point is expanded according to the concave peak magnification coefficient to obtain the magnified concave peak data point.

5. A generative adversarial attack method for a deep learning industrial soft sensor model according to claim 1, characterized in that: The constructing of the observation data set 1 and the observation data set 2 includes: Hijack the first observation sample x1, Input the first observation sample x1 into the original deep learning industrial soft sensor model, and the deep learning industrial soft sensor model outputs the first label data y1; Combine the first label data y1 and the first observation sample x1 to obtain the observation data set 1; A deep neural network constructed by training the observation data set 1 is used to obtain a proxy soft-sensing model; Hijacking to obtain a second observation sample x2, inputting the second observation sample x2 into the proxy soft measurement model, and the proxy soft measurement model outputs to obtain second label data y2; The second label data y2 and the second observation sample x2 are combined to obtain the observation data set 2.

6. A generative adversarial attack method for a deep learning industrial soft sensor model according to claim 1, characterized in that: The method of training the agent deep learning industrial soft sensor model based on the observation data set 1, constructing a generative model, using the false output as the input of the generative model, and training to obtain an adversarial sample generator includes: Based on the obtained observation dataset 1, an agent deep learning industrial soft sensor model is trained; Introducing the agent deep learning industrial soft sensor model into a standard generative adversarial network structure to construct a generative model; The false output After inputting into the generative model for training until the model converges, the generator in the generative model is extracted to obtain the adversarial sample generator.

7. A generative adversarial attack method for a deep learning industrial soft sensor model according to claim 6, characterized in that: The generative model is trained, including: Initialize the first parameter θ of the generator G in the generative model g and the second parameter θ of the discriminator D d ; Fix the first parameter θ d , use the gradient optimization algorithm to maximize and update the second parameter θ d ; Fix the second parameter θ d , use the gradient optimization algorithm to minimize and update the first parameter θ d ; The discriminator D and the generator G are trained alternately until the generative model converges, and then the training is terminated, and the generator G of the generative model is extracted to obtain an adversarial sample generator.

8. A generative adversarial attack method for a deep learning industrial soft sensor model according to claim 1, characterized in that: The gradient optimization algorithm is maximized as: Among them, θ d is the second parameter in the discriminator D, M is the total number of data in the observed data set, θ g is the first parameter of the generator G, and x(i) is the data value in the observed data set.

9. A generative adversarial attack method for a deep learning industrial soft sensor model according to claim 1, characterized in that: The gradient optimization algorithm minimizes: Among them, θ d is the second parameter in the discriminator D, M is the total number of data in the observed data set, θ g is the first parameter of the generator G, x(i) is the data value in the observation data set, L represents the soft measurement loss of the generative model, function f represents the proxy soft measurement model, θ represents the known parameters of the soft measurement model, and the max function term represents the concealment loss of the adversarial attack, that is, this term is used to ensure the concealment of the generated adversarial sample. ε represents The maximum distance allowed from y.

10. A generative adversarial attack method for a deep learning industrial soft sensor model according to claim 1, characterized in that: The attacker inputs the adversarial sample generator based on the hijacked query data to obtain false output values, including: Based on hijacking, the query sample x′ is input into the adversarial sample generator to obtain the adversarial sample x′ attacked ; Based on the adversarial sample x′ attacked The original output of the deep learning industrial soft-sensing model is input to obtain a false output value, thereby realizing adversarial attack.

Images