A method for generating adversarial samples and a method for defending against adversarial samples
By adding perturbation to the mechanical fault diagnosis system and building a defense network through the adversarial sample generation method, the problem of insufficient robustness of vibration signals in the prior art is solved, and the robustness and defense capabilities of the mechanical fault diagnosis system are improved.
Patent Information
- Application Number
- CN202210357576.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-04-06
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2042-04-06
AI Technical Summary
The existing mechanical fault diagnosis system is based on deep learning methods, which is poorly robust and is susceptible to external perturbations, resulting in identification errors. The existing adversarial sample generation technology is mainly aimed at images and speech, and is not effectively applicable to vibration signals.
A method of adversarial sample generation is proposed, by preprocessing and loss function optimization of the original vibration signal, adding perturbations to generate adversarial samples, and adding data processing layers to the target network to build a defense network to improve robustness.
It effectively improves the robustness of the mechanical fault diagnosis model, can deceive the target network with a higher success rate, significantly reduce the success rate of adversarial attacks, and accelerate the convergence speed of model training.
Smart Images
Figure CN114781600B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of mechanical fault diagnosis, and in particular to an adversarial sample generation method and a method for defending against adversarial samples. Background Art
[0002] With the rapid development of heavy industry and aerospace industry, mechanical fault diagnosis is becoming more and more important to ensure the safe operation and production of equipment. In view of the fact that traditional fault diagnosis methods are difficult to solve the problem of uncertainty in manual extraction, a large number of deep learning feature extraction methods have been proposed, which has greatly promoted the development of mechanical fault diagnosis. Among them, the current mainstream method is based on convolutional neural network diagnosis. The mechanical fault diagnosis system records the vibration signal of the machine and inputs the trained diagnostic system to obtain the current state of the mechanical equipment, thereby locating the fault. However, since most of the existing mechanical fault diagnosis systems are based on deep learning methods, they can achieve very high recognition accuracy under ideal conditions. Although mechanical fault diagnosis methods based on neural networks have made great progress, the existing diagnostic methods have poor robustness and the recognition accuracy is easily affected by external disturbances, resulting in recognition errors.
[0003] To this end, it is necessary to generate adversarial samples to evaluate the robustness of the current model, and the robustness of the model can also be enhanced through adversarial training. Adversarial samples refer to samples that have been intentionally perturbed by the attacker. Their main purpose is to cause the performance of the deep neural network to fail, or even induce the deep learning network to make judgments specified by the attacker. In human perception, adversarial samples should be no different from their corresponding normal samples, but can cause the deep neural network to fail.
[0004] However, most of the existing adversarial sample generation technologies are aimed at images, speech and other directions. For example, the Chinese invention patent with application number CN202111390854.1 (application publication number CN114049537A) discloses an adversarial sample defense method based on convolutional neural networks. In terms of adversarial sample generation for vibration signals, targeted methods have yet to be explored. In addition, for images and audio, the disturbance in the image can be seen by the human eye, and the disturbance in the audio can be heard by the human ear. The distortion measurement method for images and audio often uses the signal-to-noise ratio (SNR) to judge to ensure that the disturbance is as imperceptible as possible. However, because the vibration signal is very complex, neither the human eye nor the human ear can directly identify the disturbance, so the traditional distortion measurement method for adversarial samples is not applicable to vibration signals. Further improvement is needed for this. Summary of the invention
[0005] The first technical problem to be solved by the present invention is to provide a method for generating adversarial samples for the above-mentioned prior art, which is suitable for generating adversarial samples for vibration signals to improve the robustness of the mechanical fault diagnosis model.
[0006] The second technical problem to be solved by the present invention is to provide a defense method for adversarial samples generated by the above method in view of the above-mentioned prior art.
[0007] The technical solution adopted by the present invention to solve the above-mentioned first technical problem is: a method for generating an adversarial sample, which is used to add disturbance to a vibration signal, and is characterized in that it includes the following steps:
[0008] Step 1: Preprocess the original vibration signal sample to obtain the preprocessed sample x t ; The sample x t The sampling sequence is: x t (1), x t (2), …x t (n)…x t (N); n∈{1, 2…N}; N is the sample x t The total number of sampling sequences;
[0009] Step 2: Take the sample x t Input into the target network f and calculate the loss function The initial value of t is 0;
[0010] Step 3: Calculate the updated sample x t+1 ; According to the following formula, the sampling sequence point x t (n) is updated to obtain the updated sampling sequence point x t+1 (n);
[0011]
[0012] Wherein, α is the preset threshold, 0<α<1; For the loss function Find the sampling sequence point x t (n) gradient; For calculation The symbolic function of
[0013]
[0014]
[0015] Let n = 1, 2...N in turn, and get the updated sampling sequence point x t+1 (1), x t+1 (2), …x t+1 (N), that is, the updated sample x is obtained t+1 ;
[0016] Step 4: Update the sample x t+1Measure and get the sample x t+1 The measurement results of
[0017] Specifically: Use a sliding window to convert the sample x t+1 The sampling sequence points are divided into multiple segments of equal length, and the measurement result of each segment is calculated by the following calculation formula, and the average value of the measurement result of each segment is taken as the sample x t+1 The measurement results of
[0018] The calculation formula of the measurement result Cost(s) of a certain segment is:
[0019]
[0020] Among them, mean() is the function for calculating the average value; S is the length of each segment; s is the starting position of a segment; |x0(k)| 2 To calculate the absolute value square of x0(k); |x t+1 (k)-x0(k)| 2 To calculate x t+1 (k)-the square of the absolute value of x0(k);
[0021] Step 5: Determine whether the measurement result in step 4 is greater than the preset measurement threshold. If so, set x t+1 As x t If the adversarial sample is not found, the problem ends; if not, the t value is updated by adding 1 and then goes to step 2.
[0022] As an improvement, in step 1, the original vibration signal sample is preprocessed, specifically:
[0023] Each sampling sequence data in the original vibration signal sample is normalized to [0,1]; the normalization calculation formula is:
[0024]
[0025] Wherein, x is the sampling sequence data, and k(x) is the normalized value of the sampling sequence x.
[0026] Preferably, the target network f in step 2 is a neural network. The neural network may be a convolutional neural network, a deep neural network, etc. commonly used in the prior art.
[0027] The technical solution adopted by the present invention to solve the above second technical problem is: a method for defending against adversarial samples, which is used to defend against vibration signal adversarial samples generated by the above adversarial sample generation method, and is characterized in that it includes the following steps:
[0028] Step a, preprocessing the collected vibration signal samples;
[0029] Step b, adding a data processing layer between different neural network layers in the target network f used in the above adversarial sample generation to construct a defense network;
[0030] The calculation formula of the data processing layer is:
[0031]
[0032] Among them, y i is the output of the data processing layer, x i is the input of the data processing layer, γ and δ are parameters that need to be learned; m is the total number of data input to the data processing layer in each batch; ∈ is a preset constant;
[0033] Step c: Use the multiple vibration signal samples preprocessed in step a to train the constructed defense network to obtain a trained defense network.
[0034] In this solution, the preprocessing in step a is specifically to normalize the collected vibration signal samples to [0, 1].
[0035] Compared with the prior art, the advantages of the present invention are: the adversarial samples constructed in the present invention can deceive the target network with a high success rate and ensure the quality of the constructed vibration signal adversarial samples, and also promote the robustness research of mechanical fault diagnosis systems. In addition, the present invention proposes a simple but very effective defense method for the attack method. The defense method improves the robustness of the model by adding a data processing layer to the target network, thereby improving the defense capability of the target network, which can greatly reduce the success rate of the adversarial attack and also speed up the convergence speed of the target network during training. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] Figure 1 is a principle block diagram of a method for generating adversarial samples in an embodiment of the present invention;
[0037] Figure 2 Schematic diagram of a defense network in an embodiment of the present invention. DETAILED DESCRIPTION
[0038] The present invention is further described in detail below with reference to the accompanying drawings.
[0039] Vibration signals are acquired from mechanical equipment, and mechanical fault diagnosis results are usually obtained by analyzing the vibration signals. The method for generating adversarial samples in this embodiment is used to add disturbances to the vibration signals to improve the robustness of the mechanical fault diagnosis system.
[0040] like Figure 1As shown, the method for generating adversarial samples in this embodiment includes the following steps:
[0041] Step 1: Preprocess the original vibration signal sample to obtain the preprocessed sample x t ; The sample x t The sampling sequence is: x t (1), x t (2), …x t (n)…x t (N); n∈{1, 2…N}; N is the sample x t The total number of sampling sequences; x t (1), x t (2) xt ( n), x t (N) are samples x t The 1st sampling sequence, the 2nd sampling sequence, the nth sampling sequence and the Nth sampling sequence;
[0042] In this embodiment, the preprocessing method is specifically as follows:
[0043] Each sampling sequence data in the original vibration signal sample is normalized to [0,1]; the normalization calculation formula is:
[0044]
[0045] Where x is the sampling sequence data, and k(x) is the normalized value of the sampling sequence x;
[0046] In addition, preprocessing also includes conventional processing such as noise reduction and denoising;
[0047] Step 2: Take the sample x t Input into the target network f and calculate the loss function The initial value of t is 0;
[0048] The target network f is a neural network, which may be a trained convolutional neural network, a deep neural network, a BP neural network, or a neural network in other prior arts whose input is a vibration signal. The specific composition of the neural network refers to the prior art and will not be elaborated here; for example: the BP neural network involved in the gearbox fault diagnosis method based on the improved PSO-BP neural network disclosed in Patent No. ZL202110472851.6;
[0049] Step 3: Calculate the updated sample x t+1 :According to the following formula, the sampling sequence point x t (n) is updated to obtain the updated sampling sequence point x t+1 (n);
[0050]
[0051] Wherein, α is the preset threshold, 0<α<1; For the loss function Find the sampling sequence point x t (n) gradient; For calculation The symbolic function of
[0052]
[0053]
[0054] Let n = 1, 2...N in turn, and get the updated sampling sequence point x t+1 (1), x t+1 (2), …x t+1 (N), that is, the updated sample x is obtained t+1 ;
[0055] Step 4: Update the sample x t+1 Measure and get the sample x t+1 The measurement results of
[0056] Specifically: Use a sliding window to convert the sample x t+1 The sampling sequence points are divided into multiple segments of equal length, and the measurement result of each segment is calculated by the following calculation formula, and the average value of the measurement results of all segments is taken as the sample x t+1 The measurement results of
[0057] The calculation formula of the measurement result Cost(s) of a certain segment is:
[0058]
[0059] Among them, mean() is the function for calculating the average value; S is the length of each segment; s is the starting position of a segment; |x0(k)| 2 To calculate the absolute value square of x0(k); |x t+1 (k)-x0(k)| 2 To calculate x t+1 (k)-the square of the absolute value of x0(k);
[0060] For images and audio that contain information that humans can directly understand, distortion metrics include signal-to-noise ratio, and distance can ensure that the disturbance is as imperceptible as possible. However, due to the complexity of vibration signals, traditional distortion metrics for adversarial samples are not applicable. What limits the implementation of attacks under mechanical fault diagnosis conditions is how to add noise. In practice, noise may appear in the following forms: (i) mechanical movement of the motor; (ii) circuits of equipment within the system; (iii) malicious attacks from computer viruses to change the original data; (iv) physical attacks by applying external forces to the sensor. For this reason, when conducting an attack, the cost of the attack can be understood as the external energy applied to the vibration source; therefore, the metric calculation formula of the above sample can effectively evaluate and measure the adversarial sample;
[0061] Step 5: Determine whether the measurement result in step 4 is greater than the preset measurement threshold. If so, set x t+1 As x t If the adversarial sample is not found, the problem ends; if not, the t value is updated by adding 1 and then goes to step 2.
[0062] In order to defend against the vibration signal adversarial sample generated by the above-mentioned adversarial sample generation method, the adversarial sample defense method in this embodiment includes the following steps:
[0063] Step a, preprocessing the collected vibration signal samples;
[0064] The preprocessing is specifically to normalize the collected vibration signal samples to [0, 1];
[0065] Step b, adding a data processing layer between different neural network layers in the target network f used in the above adversarial sample generation to construct a defense network; Figure 2 As shown, the data processing layer is arranged between any one of the fully connected layers or all the fully connected layers;
[0066] The calculation formula of the data processing layer is:
[0067]
[0068] Among them, y i is the output of the data processing layer, x i is the input of the data processing layer, γ and δ are parameters that need to be learned; m is the total number of data input to the data processing layer in each batch; ∈ is a preset constant;
[0069] However, the target network without this data processing layer loses its robustness because the difference between adversarial samples and original inputs is small and difficult to distinguish. In addition, processing data in the same way can also reduce the instability during adversarial training and help adversarial training to enhance the robustness of the model;
[0070] Step c: Use the multiple vibration signal samples preprocessed in step a to train the constructed defense network to obtain a trained defense network.
[0071] In this embodiment, a continuous vibration signal sampled at 12kHz from the mechanical drive end is used. In order to facilitate training, the data needs to be amplified first. In this embodiment, a single sample length of 2048 and a step length of 28 are used to amplify the original vibration signal data to increase the amount of data; after sampling, 1000 samples are obtained for each type of mechanical state. At the same time, the signal data needs to be standardized to [0, 1] using the normalization method in step 1 above; finally, the data is randomly shuffled and the data set is divided into a training set, a validation set, and a test set according to 6:2:2. The samples in the training set and the validation set can be used to train and verify the constructed defense network, and finally the samples in the test set can be used to test the trained defense network.
[0072] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.
Claims
1. A method for generating an adversarial sample and a method for defending against the adversarial sample, wherein the method for generating an adversarial sample is used to add disturbance to a vibration signal, and the method for defending against the adversarial sample is used to defend against the adversarial sample generated by the method for generating the adversarial sample, and the method is characterized in that: The method for generating adversarial samples includes the following steps: Step 1: Preprocess the original vibration signal sample to obtain the preprocessed sample x t ; The sample x t The sampling sequence is: x t (1), x t (2), …x t (n)…x t (N); n∈{1, 2…N}; N is the sample x t The total number of sampling sequences; Step 2: Take the sample x t Input into the target network f and calculate the loss function The initial value of t is 0; Step 3: Calculate the updated sample x t+1 :According to the following formula, the sampling sequence point x t (n) is updated to obtain the updated sampling sequence point x t+1 (n); Wherein, α is the preset threshold, 0<α<1; For the loss function Find the sampling sequence point x t (n) gradient; For calculation The symbolic function of Let n = 1, 2...N in turn, and get the updated sampling sequence point x t+1 (1), x t+1 (2) ... t+1 (N), that is, the updated sample x is obtained t+1 ; Step 4: Update the sample x t+1 Measure and get the sample x t+1 The measurement results of Specifically: Use a sliding window to convert the sample x t+1 The sampling sequence points are divided into multiple segments of equal length, and the measurement result of each segment is calculated by the following calculation formula, and the average value of the measurement results of all segments is taken as the sample x t+1 The measurement results of The calculation formula of the measurement result Cost(s) of a certain segment is: Among them, mean( ) is the function for calculating the average value; S is the length of each segment; s is the starting position of a segment; |x0(k)| 2 To calculate the absolute value square of x0(k); |x t+1 (k)-x0(k)| 2 To calculate x t+1 (k)-the square of the absolute value of x0(k); Step 5: Determine whether the measurement result in step 4 is greater than the preset measurement threshold. If so, set x t+1 As x t If the adversarial sample is not found, the result is concluded; if not, the t value is updated by adding 1 and then going to step 2; The defense method against adversarial examples includes the following steps: Step a, preprocessing the collected vibration signal samples; Step b, adding a data processing layer between different neural network layers in the target network f used in the above adversarial sample generation to construct a defense network; The calculation formula of the data processing layer is: Among them, y i is the output of the data processing layer, x i is the input of the data processing layer, γ and δ are parameters that need to be learned; m is the total number of data input to the data processing layer in each batch; ∈ is a preset constant; Step c: Use the multiple vibration signal samples preprocessed in step a to train the constructed defense network to obtain a trained defense network.
2. The method for generating an adversarial sample and the method for defending against an adversarial sample according to claim 1, characterized in that: In step 1, the original vibration signal sample is preprocessed, specifically: Each sampling sequence data in the original vibration signal sample is normalized to [0, 1]; the normalization calculation formula is: Wherein, x is the sampling sequence data, and k(x) is the normalized value of the sampling sequence x.
3. The method for generating an adversarial sample and the method for defending against an adversarial sample according to claim 1, characterized in that: In step 2, the target network f is a neural network.
4. The method for generating an adversarial sample and the method for defending against an adversarial sample according to claim 1, characterized in that: The preprocessing in step a is specifically to normalize the collected vibration signal samples to [0, 1].