A square wave attack method and device for steady-state visual evoked potential paradigm
By obtaining the flicker frequency and EEG amplitude of the brain-computer interface system, a square wave perturbation signal is generated to attack the brain-computer interface system, solving the problem of complex and difficult to achieve in the existing technology, and achieving a simple and easy-to-deploy attack effect.
Patent Information
- Application Number
- CN202210206423.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-03-01
- Publication Date
- 2025-07-25
- Estimated Expiration
- 2042-03-01
AI Technical Summary
The existing escape attack methods for brain-computer interface systems generate disturbance signals that are complex and difficult to implement, and require the start time of each EEG sample, which is difficult to complete during the system operation.
By obtaining the set flickering frequency of all output categories in the system to be attacked, setting the frequency and amplitude of the square wave disturbance signal, and superimposing the square wave disturbance signal on the original signal of the attacked channel, the attack on the system is realized.
The generated anti-perturbation signal waveform is simple and easy to generate. It does not require training samples and start time information, and can directly perturb the original signal and is easy to deploy in real EEG systems.
Smart Images
Figure CN114595447B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of artificial intelligence security, and in particular, to a square wave attack method and device for a steady-state visual evoked potential paradigm. Background Art
[0002] Steady-state visual evoked potential is one of the most popular brain-computer interface paradigms at present, with advantages such as high information transmission rate and short user calibration time. Steady-state visual evoked potential is a neural response to visual stimuli of a specific frequency. When a user gazes at a target flashing at a frequency of 3.5 Hz to 75 Hz, the brain generates an electroencephalogram signal with the same frequency (or several times the target frequency) as the target. Therefore, the classifier only needs to identify the frequency information of the user's electroencephalogram signal to decode the target being gazed at by the user. Currently, there are various machine learning methods to improve the performance of brain-computer interface systems based on steady-state visual evoked potential, such as canonical correlation analysis (CCA), filter bank-based canonical correlation analysis (FBCCA), task-related component analysis (TRCA), etc. Among them, the untrained CCA and FBCCA are the most widely used in current steady-state visual evoked potential brain-computer interface systems due to their simplicity and the absence of the need for calibration data, and are also the target algorithms for the method proposed in the present invention. These algorithms make the brain-computer interface system based on steady-state visual evoked potential faster and more accurate. However, few studies have considered the security of brain-computer interface systems based on steady-state visual evoked potential.
[0003] Recent research has shown that machine learning models are vulnerable to adversarial samples. Adversarial samples refer to normal samples contaminated by deliberately designed tiny perturbations, which are difficult to be detected by the human eye but can easily deceive machine learning models. According to the execution method of adversarial attacks, they can be divided into two types. One is the evasion attack, where the attacker attacks the machine learning model by adding tiny perturbations to the test samples, that is, contaminating the test set. The other is the poisoning attack, where the attacker inserts a backdoor into the training model by contaminating the training set. By adding the backdoor to the test samples, the attacker can easily manipulate the output of the model.
[0004] In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art:
[0005] Existing evasion attack methods for brain-computer interface systems all have the following problems: (1) The generated perturbation signals are very complex, and the signals of different channels are also different, making it difficult to implement; (2) It is necessary to obtain the start time of each electroencephalogram sample to complete the embedding of the perturbation signal, which is difficult to achieve during the operation of the system; (3) It is necessary to insert a perturbation module between the signal preprocessing and the classification algorithm, but basically these two are integrated together, so it is difficult to obtain the data between them. Summary of the Invention
[0006] The objective of the embodiments of the present application is to provide a square wave attack method and device for a steady-state visual evoked potential paradigm, so as to solve the technical problem that the perturbation signal is complex and difficult to implement in the related art.
[0007] According to the first aspect of the embodiments of the present application, a square wave attack method for a steady-state visual evoked potential paradigm is provided, including:
[0008] Obtaining the set flicker frequencies of all output categories in the system to be attacked;
[0009] Setting the frequency of the square wave perturbation signal for the target attack category according to the set flicker frequencies of all output categories;
[0010] Setting the amplitude of the square wave perturbation signal according to the EEG amplitude range of the subject;
[0011] Setting any channel within a predetermined range centered on the occipital region as the channel to be attacked;
[0012] Superimposing the square wave perturbation signal with the frequency and amplitude on the original signal of the channel to be attacked, and attacking the system to be attacked, so that the output of the system to be attacked is changed to the target attack category.
[0013] Further, setting the frequency of the square wave perturbation signal for the target attack category according to the set flicker frequencies of all output categories includes:
[0014] Obtaining a predetermined target attack category;
[0015] Setting the set flicker frequency of the target attack category as the frequency of the square wave perturbation signal.
[0016] According to the second aspect of the embodiments of the present application, a square wave attack device for a steady-state visual evoked potential paradigm is provided, including:
[0017] An obtaining module, configured to obtain the set flicker frequencies of all output categories in the system to be attacked;
[0018] A first setting module, configured to set the frequency of the square wave perturbation signal for the target attack category according to the set flicker frequencies of all output categories;
[0019] A second setting module, configured to set the amplitude of the square wave perturbation signal according to the EEG amplitude range of the subject;
[0020] A third setting module, configured to set any channel within a predetermined range centered on the occipital region as the channel to be attacked;
[0021] An attack module, configured to superimpose the square-wave perturbation signal with the frequency and amplitude on the original signal of the attacked channel, and attack the system to be attacked, so that the output of the system to be attacked is changed to the target attack category.
[0022] Further, according to the set flicker frequencies of all output categories, setting the frequency of the square-wave perturbation signal for the target attack category includes:
[0023] Obtaining a predetermined target attack category;
[0024] Setting the set flicker frequency of the target attack category as the frequency of the square-wave perturbation signal.
[0025] According to a third aspect of the embodiments of the present application, there is provided an electronic device, including:
[0026] One or more processors;
[0027] A memory, configured to store one or more programs;
[0028] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in the first aspect.
[0029] According to a third aspect of the embodiments of the present application, there is provided a computer-readable storage medium, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method as described in the first aspect are implemented.
[0030] The technical solutions provided by the embodiments of the present application may include the following beneficial effects:
[0031] As can be seen from the above embodiments, the present application sets the frequency of the square-wave perturbation signal for the target attack category according to the set flicker frequencies of all output categories in the system to be attacked. When generating adversarial perturbations, no training samples and test samples are required. Only by knowing the target flicker frequency in the current system can perturbations be generated according to the frequency. The adversarial perturbations generated by the present invention using square waves have the advantages of simple waveform and easy generation, and do not require knowing the start time of each EEG sample. By superimposing the square-wave perturbation signal with the frequency and amplitude on the original signal of the attacked channel, the system to be attacked can be attacked. Therefore, compared with the complex perturbations generated by existing attack methods, it is easier to be deployed in a real EEG system; it can directly perturb the original signal without obtaining preprocessed data, making the present invention easier to implement.
[0032] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. Description of the Drawings
[0033] The accompanying drawings here are incorporated into the specification and form a part of this specification, showing embodiments consistent with the present application, and are used together with the specification to explain the principles of the present application.
[0034] Figure 1 It is a flowchart of a square wave attack method for a steady-state visual evoked potential paradigm shown according to an exemplary embodiment.
[0035] Figure 2 It is a flowchart of step S12 shown according to an exemplary embodiment.
[0036] Figure 3 It is a block diagram of a square wave attack device for a steady-state visual evoked potential paradigm shown according to an exemplary embodiment. Detailed implementation manners
[0037] Here, the exemplary embodiments will be described in detail, and the examples are shown in the accompanying drawings. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.
[0038] The terms used in the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. The singular forms "a", "the", and "said" used in the present application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more of the associated listed items.
[0039] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "when" or "while" or "in response to determining".
[0040] Glossary of terms:
[0041] System to be attacked: The system to be attacked in the present invention refers to a brain-computer interface system based on steady-state visual evoked potentials. In this system, multiple targets flash on the screen at different frequencies. When the user uses the system and gazes at one of the targets, the user's electroencephalogram (EEG) signals will exhibit frequency characteristics related to the flashing frequency of the target. The user's EEG signals are preprocessed and then sent to a classification model for target recognition, and the recognized category can be used as the input of the spelling system and the instruction of the control system.
[0042] Figure 1 is a flowchart of a square-wave attack method for a steady-state visual evoked potential paradigm shown according to an exemplary embodiment, as Figure 1 shown. This method is applied to a terminal and may include the following steps:
[0043] Step S11: Obtain the set flashing frequencies of all output categories in the system to be attacked;
[0044] Step S12: Set the frequency of the square-wave perturbation signal for the target attack category according to the set flashing frequencies of all output categories;
[0045] Step S13: Set the amplitude of the square-wave perturbation signal according to the EEG amplitude range of the subject;
[0046] Step S14: Set any channel within a predetermined range centered on the occipital region as the attacked channel;
[0047] Step S15: Superimpose the square-wave perturbation signal with the frequency and amplitude on the original signal of the attacked channel to attack the system to be attacked, so that the output of the system to be attacked is changed to the target attack category.
[0048] As can be seen from the above embodiments, in the present application, the frequency of the square-wave perturbation signal for the target attack category is set according to the set flashing frequencies of all output categories in the system to be attacked. When generating adversarial perturbations, no training samples and test samples are required. Only by knowing the target flashing frequencies in the current system can perturbations be generated according to the frequencies. The adversarial perturbations generated by the present invention using square waves have the advantages of simple waveform and easy generation, and without knowing the start time of each EEG sample, the square-wave perturbation signal with the frequency and amplitude can be superimposed on the original signal of the attacked channel to attack the system to be attacked. Therefore, compared with the complex perturbations generated by existing attack methods, it is easier to be deployed in a real EEG system; it can directly perturb the original signal without obtaining preprocessed data, making the present invention easier to implement.
[0049] In the specific implementation of step S11, obtain the set flashing frequencies of all output categories in the system to be attacked;
[0050] In one embodiment, the system to be attacked is a spelling system with forty targets, including twenty-six letters, ten digits, and four punctuation marks. The forty targets are evenly distributed on the screen in five rows and eight columns. The set blinking frequencies of all output categories are
[0051] In the specific implementation of step S12, according to the set blinking frequencies of all the output categories, set the frequency of the square-wave perturbation signal for the target attack category;
[0052] Specifically, as Figure 2 shown, this step may include the following sub-steps:
[0053] Step S21: Obtain the predetermined target attack category;
[0054] Step S22: Set the set blinking frequency of the target attack category as the frequency of the square-wave perturbation signal;
[0055] In the specific implementation of steps S21 - S22, if the predetermined target attack category is k and the corresponding target on the screen is the digit "1", then set the frequency of the perturbation signal as f k , which is the blinking frequency of the digit "1" on the screen.
[0056] In the specific implementation of step S13, set the amplitude of the square-wave perturbation signal according to the EEG amplitude range of the subject;
[0057] Specifically, the attacker can set it according to the standard deviation of the EEG signal. The attacker can obtain a small number of samples in advance to calculate the channel standard deviation of the EEG signal. Generally speaking, when the amplitude of the attack signal reaches 20% of the standard deviation, the attack effect can be achieved. Suppose N samples are obtained in advance, then the amplitude A can be set as: where, x i (t) represents the signal of the channel to be attacked for the i-th sample, and std() represents obtaining the standard deviation of the signal. Subsequently, the attacker can appropriately adjust the amplitude of the signal according to the attack effect.
[0058] In the specific implementation of step S14, set any one of the channels within a predetermined range centered on the occipital region as the attacked channel;
[0059] Specifically, the activities of steady-state visual evoked potentials are mainly concentrated in the occipital region. Therefore, in the embodiments of the present invention, any one of the channels within a predetermined range centered on the occipital region, that is, any one of several channels close to the center of the occipital region, is set as the attacked channel. In the specific implementation, according to the electrode distribution of the international 10 - 20 system, selecting PO3, POz, PO4, or Oz as the attack channel has the best effect.
[0060] In the specific implementation of step S15, a square wave perturbation signal with the frequency and amplitude is superimposed on the original signal of the attacked channel to attack the system to be attacked, so that the output of the system to be attacked is changed to the target attack category.
[0061] Specifically, after generating the square wave perturbation signal with the frequency and amplitude, the square wave perturbation signal is superimposed on the original signal of the attacked channel, and then the system to be attacked can be attacked, so that the output of the system to be attacked after being attacked is changed to the target attack category. This method does not limit the classification model of the system to be attacked involved. In one embodiment, the classification model can adopt canonical correlation analysis (CCA) or other CCA-based untrained models, and the attack effect is better.
[0062] Corresponding to the foregoing embodiment of the square wave attack method for the steady-state visual evoked potential paradigm, the present application also provides an embodiment of a square wave attack device for the steady-state visual evoked potential paradigm.
[0063] Figure 3 is a block diagram of a square wave attack device for the steady-state visual evoked potential paradigm shown according to an exemplary embodiment. Refer to Figure 3 , the device may include:
[0064] An acquisition module 21, configured to acquire the set flicker frequencies of all output categories in the system to be attacked;
[0065] A first setting module 22, configured to set the frequency of the square wave perturbation signal for the target attack category according to the set flicker frequencies of all output categories;
[0066] A second setting module 23, configured to set the amplitude of the square wave perturbation signal according to the EEG amplitude range of the subject;
[0067] A third setting module 24, configured to set any channel within a predetermined range centered on the occipital region as the attacked channel;
[0068] An attack module 25, configured to superimpose the square wave perturbation signal with the frequency and amplitude on the original signal of the attacked channel to attack the system to be attacked, so that the output of the system to be attacked is changed to the target attack category.
[0069] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment related to the method, and will not be elaborated here.
[0070] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the descriptions of the method embodiments. The device embodiments described above are only illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this application. Those of ordinary skill in the art can understand and implement it without creative work.
[0071] Correspondingly, this application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the square wave attack method for the steady-state visual evoked potential paradigm as described above.
[0072] Correspondingly, this application also provides a computer-readable storage medium, on which computer instructions are stored, and characterized in that when the instructions are executed by a processor, the square wave attack method for the steady-state visual evoked potential paradigm as described above is implemented.
[0073] After considering the specification and practicing the content disclosed herein, those skilled in the art will readily think of other implementation schemes of this application. This application aims to cover any variations, uses or adaptations of this application, and these variations, uses or adaptations follow the general principles of this application and include the common general knowledge or conventional technical means in the technical field not disclosed in this application. The specification and embodiments are only regarded as exemplary, and the true scope and spirit of this application are pointed out by the claims.
[0074] It should be understood that this application is not limited to the exact structure already described and shown in the drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is only limited by the appended claims.
Claims
1. A square-wave attack method for the steady-state visual evoked potential paradigm, characterized in that Including: Obtain the set flashing frequencies of all output categories in the system to be attacked; Set the frequency of the square wave perturbation signal for the target attack category according to the set flashing frequencies of all output categories; Set the amplitude of the square wave perturbation signal according to the EEG amplitude range of the subject; Set any channel within a predetermined range centered on the occipital region as the attacked channel; Superimpose the square wave perturbation signal on the original signal of the attacked channel to attack the system to be attacked, so that the output of the system to be attacked is changed to the target attack category.
2. The method according to claim 1, wherein Setting the frequency of the square wave perturbation signal for the target attack category according to the set flashing frequencies of all output categories includes: Obtain a predetermined target attack category; Set the set flashing frequency of the target attack category as the frequency of the square wave perturbation signal.
3. A square wave attack device for a steady-state visual evoked potential paradigm, characterized in that, Including: An acquisition module for obtaining the set flashing frequencies of all output categories in the system to be attacked; A first setting module for setting the frequency of the square wave perturbation signal for the target attack category according to the set flashing frequencies of all output categories; A second setting module for setting the amplitude of the square wave perturbation signal according to the EEG amplitude range of the subject; A third setting module for setting any channel within a predetermined range centered on the occipital region as the attacked channel; An attack module for superimposing the square wave perturbation signal on the original signal of the attacked channel to attack the system to be attacked, so that the output of the system to be attacked is changed to the target attack category.
4. The device according to claim 3, characterized in that, Setting the frequency of the square wave perturbation signal for the target attack category according to the set flashing frequencies of all output categories includes: Obtain a predetermined target attack category; Set the set flashing frequency of the target attack category as the frequency of the square wave perturbation signal.
5. An electronic device, characterized in that, Including: One or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1-2.
6. A computer-readable storage medium having computer instructions stored thereon, characterized in that, When the instruction is executed by the processor, the steps of the method according to any one of claims 1-2 are implemented.