Research method and system for interpretability of adversarial samples for underwater acoustic intelligent camouflage

Abstract

This invention discloses a method and system for studying the interpretability of adversarial examples for underwater acoustic intelligent camouflage, belonging to the fields of digital image processing and underwater acoustic signal processing. The method includes analyzing the distribution of input samples and output labels in multidimensional space to determine a hyperplane partitioning the sample space. The method then demonstrates the existence and composition of adversarial examples based on the l0 and l2 distances between the adversarial examples and the original samples, improving the transparency of the adversarial example working mechanism and ensuring reliable human-computer interaction, functional improvement, and parameter tuning. This method achieves a logical closure for acoustic intelligent camouflage technology, ensuring that designers or operators can utilize interpretable adversarial attack methods to counter enemy defenses.

Description

Technical Field

[0001] The present invention relates to the fields of digital image processing technology and underwater acoustic signal processing technology, and in particular to a research method and system for the explainability of adversarial samples for underwater acoustic intelligent camouflage. Background Art

[0002] Intelligent underwater acoustic camouflage technology will play a vital role in future naval warfare, and its fundamental theories and applied technologies are likely to become new research hotspots. Attacks targeting machine learning model vulnerabilities have long been a hot topic in the fields of artificial intelligence and information security. These attacks, which target the integrity and classification accuracy of machine learning models, are often referred to as "adversarial attacks." In 2013, Szegedy et al. formally defined adversarial examples. They exploited the mapping discontinuities of deep neural networks and designed an optimization method to search for perturbations. This method adds a small perturbation to the original data, misleading the classification model into making an incorrect classification decision. The perturbation is so small that it is barely perceptible to humans.

[0003] In the design of adversarial samples, domestic and foreign scholars have proposed a series of design methods, such as L-FGSM, FGSM, DeepFool, C&W attacks, UPSET, MI-FGSM, JSMA, PS-GAN, etc. The distance measurement (i.e., difference) between the adversarial samples produced by these methods and the original data is usually l0, l2, and l ∞ Three metrics, l0 is the number of non-zero dimensions in each dimension of the perturbation, l2 refers to the Euclidean distance between the original data and the adversarial sample, l ∞represents the maximum magnitude of the adversarial perturbation. Obviously, the design goal is to minimize these three distances as much as possible, but different methods have different definitions and interpretations of how to find this minimum perturbation. Early research by Szegedy et al. argued that adversarial examples reside in the low-probability space of the data manifold, making it difficult to obtain adversarial examples by randomly sampling around data points. Therefore, they proposed searching across the input space using distance minimization equations involving three norms. Researchers at Panasonic's Silicon Valley Laboratory believe that susceptibility to adversarial examples is related to the incorrect choice of objective function or flaws in the training method, rather than to model topology. They designed a defense that minimizes the variance of the network output and has been successful with small perturbations and small datasets. Goodfellow et al. oppose the data manifold interpretation, arguing that neural network models should be understood as high-dimensional linear models, where small adjustments to the dimensions of high-dimensional input samples can force the model to misclassify. Tanay and Griffin question this linear assumption and propose a "boundary tilt" explanation, arguing that adversarial examples can be found by perturbing points from the data manifold to the classification boundary. Based on data distribution, it is believed that adversarial examples are likely to occur along low-variance lines in the data, and therefore are the result of model overfitting. Moosavi-Dezfooli et al. studied the impact of decision boundaries on adversarial examples from the perspective of spatial geometric correlation. Rozsa et al. also believe that most training data lies near the decision boundary and that even small perturbations can push it across it. They believe that this boundary crossing is caused by vanishing gradients during training. There are differing opinions on the design and interpretation of adversarial examples, as the high complexity of deep learning sacrifices model interpretability. Summary of the Invention

[0004] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0005] To this end, one purpose of the present invention is to propose a research method for the explainability of adversarial samples for underwater acoustic intelligent camouflage, which realizes a logical closed loop and ensures that our designers or operators use explainable adversarial attack methods to deal with the enemy's defense measures.

[0006] Another object of the present invention is to propose an adversarial sample explainability research system for underwater acoustic intelligent camouflage.

[0007] To achieve the above objectives, an embodiment of the present invention proposes an interpretability research method for adversarial samples for underwater acoustic intelligent camouflage, which includes the following steps: Step S1, analyzing the distribution of input samples and output labels in multidimensional space, and setting the sample space segmentation using a hyperplane; Step S2, explaining the existence of adversarial samples based on the l0 distance between the adversarial samples and the original samples; Step S3, proving the composition principle of adversarial samples based on the l2 distance between the adversarial samples and the original samples.

[0008] The present invention's method for interpreting adversarial examples for underwater acoustic intelligent camouflage uses deep neural networks as the target, studying the mapping relationship between data space, network structure, and output space. It also explores the existence and composition of adversarial examples between nonlinear discriminant boundaries and their approximate linear boundaries, focusing on both their existence and composition. This approach provides a logical closure for acoustic intelligent camouflage technology, ensuring that designers and operators can utilize interpretable adversarial attack methods to counter enemy defenses.

[0009] In addition, the research method for interpretability of adversarial samples for underwater acoustic intelligent camouflage according to the above embodiment of the present invention may also have the following additional technical features:

[0010] Furthermore, in one embodiment of the present invention, step S1 specifically includes:

[0011] Define the sampling data as n-dimensional sample x={x1,x2,…,x n}, the sample space where it is located Can be p hyperplanes of any form Split into the most subspace C t , each subspace C t The sample points in the same class

[0012] Furthermore, in one embodiment of the present invention, each subspace may belong to the same category or different categories, and subspaces belonging to the same category can be combined arbitrarily.

[0013] Furthermore, in one embodiment of the present invention, step S2 specifically includes:

[0014] Step S201: at the input end of the preset deep neural network, any two subspaces C1 and C2 are given, and the output labels are Sample points x and y belong to two subspaces C1 and C2 respectively. Let d be an n-dimensional vector containing z non-zero elements. Then the relationship between x and y is expressed as y = x + cd, where c is a constant coefficient to achieve perturbation changes of adversarial samples at the input end;

[0015] Step S202: Assume that the preset deep neural network has r activation functions, and the activation function is for each input Output an m-dimensional real vector and regard the preset deep neural network as a The piecewise linear mapping of two different classes and The input quantities x and y are Fine-tune the values of some dimensions in x so that and has the same confidence as y in the network, As adversarial samples, they are classified by the network as

[0016] Step S203: Assume that z components of the input sample x are allowed to be adjusted, and the other components keep their original values. Reduce the input dimension from n to z, and understand the preset deep neural network as a piecewise linear mapping from the z-dimensional input space to the m-dimensional output space. Use the local inverse mapping to find the unique image in the input space corresponding to the broken line, that is, find the adversarial sample.

[0017] Furthermore, in one embodiment of the present invention, step S3 specifically includes:

[0018] Step S301, piecewise linearize the classification boundary to obtain the interface. Specifically, let the disturbance Then the constraint condition of the minimum perturbation min||∈||2 is: a continuous function of the classification boundary And i≠j, x∈C i ,in, The output of the preset deep neural network belongs to The confidence level of the class, For adversarial examples The output class with the highest confidence is l(x+∈)>0 means x+∈ and x belong to the same class, whereas l(x+∈)<0 means x+∈ and x belong to different classes;

[0019] Step S302: Search for the local optimal solution at the piecewise linearization interface to complete the constructive explanation of the adversarial sample. Specifically, for any x∈C i 、 l(x)>0 and l(x * )<0, l(·) is a continuous function, and the adversarial samples in the shaded area satisfy Preset one As the initial value of the adversarial sample, the perturbation is initialized to The process of gradually optimizing the perturbation ∈ is described as finding ||∈ i||2<||∈0||2 and satisfies l(x+∈ i )≈0, and then let∈ g is∈0 along the classification boundary in the gradient direction Projection on ∈ c is the projection of ∈0 on the classification boundary. ∈ g and ∈ c are mutually orthogonal, so we have Adjust ∈ i The calculation formula for the local optimal solution is:

[0020]

[0021] The superscript T of ∈ is the transpose, and w is the piecewise boundary function l(x)=w T The weight coefficient of x+b, (1-ρ) is used as the learning rate of the iterative optimization process; when the l2 norm of the perturbation ∈ satisfies the convergence condition ||∈ i ||2-||∈ i-1 ||2<σ and l(x+∈ i )≈0, obtain its local optimal solution and complete the adversarial sample 's construction.

[0022] To achieve the above objectives, another embodiment of the present invention proposes an adversarial sample explainability research system for underwater acoustic intelligent camouflage, including: a space segmentation module, used to analyze the distribution of input samples and output labels in multidimensional space, and set the sample space segmentation using a hyperplane; an existence explanation module, used to explain the existence of adversarial samples based on the l0 distance between the adversarial samples and the original samples; and a composition principle explanation module, used to prove the composition principle of the adversarial samples based on the l2 distance between the adversarial samples and the original samples.

[0023] The adversarial example explainability research system for underwater acoustic intelligent camouflage, implemented in this embodiment of the present invention, uses deep neural networks to study the mapping relationship between data space, network structure, and output space. It also explores the existence and composition of adversarial examples between nonlinear discriminant boundaries and their approximate linear boundaries, conducting research on both the existence and composition of adversarial examples. This system provides a logical closure for acoustic intelligent camouflage technology, ensuring that designers and operators can utilize explainable adversarial attack methods to counter enemy defenses.

[0024] In addition, the adversarial sample explainability research system for underwater acoustic intelligent camouflage according to the above embodiment of the present invention may also have the following additional technical features:

[0025] Furthermore, in one embodiment of the present invention, the space segmentation module specifically includes:

[0026] Define the sampling data as n-dimensional sample x={x1,x2,…,x n}, the sample space where it is located Can be p hyperplanes of any form Split into the most subspace C t , each subspace C t The sample points in the same class

[0027] Furthermore, in one embodiment of the present invention, each subspace may belong to the same category or different categories, and subspaces belonging to the same category can be combined arbitrarily.

[0028] Furthermore, in one embodiment of the present invention, the existence interpretation module specifically includes:

[0029] The perturbation change unit is used to give any two subspaces C1 and C2 at the input end of the preset deep neural network, and output the label Sample points x and y belong to two subspaces C1 and C2 respectively. Let d be an n-dimensional vector containing z non-zero elements. Then the relationship between x and y is expressed as y = x + cd, where c is a constant coefficient to achieve perturbation changes of adversarial samples at the input end.

[0030] The first mapping unit is used to set the preset deep neural network to have r activation functions, and the activation function is for each input Output an m-dimensional real vector and regard the preset deep neural network as a The piecewise linear mapping of two different classes and The input quantities x and y are Fine-tune the values of some dimensions in x so that and has the same confidence as y in the network, As adversarial samples, they are classified by the network as

[0031] The second mapping unit is used to set the input sample x to allow z components to be adjusted, and the other components to keep their original values, reduce the input dimension from n to z, and understand the preset deep neural network as a piecewise linear mapping from the z-dimensional input space to the m-dimensional output space. The local inverse mapping is used to find the unique image in the input space corresponding to the broken line, that is, to find the adversarial sample.

[0032] Furthermore, in one embodiment of the present invention, the composition principle explanation module specifically includes:

[0033] The piecewise linearization unit is used to piecewise linearize the classification boundary to obtain the interface. Specifically, let the perturbation Then the constraint condition of the minimum perturbation min||∈||2 is: a continuous function of the classification boundary And i≠j, x∈C i ,in, The output of the preset deep neural network belongs to The confidence level of the class, For adversarial examples The output class with the highest confidence is l(x+∈)>0 means x+∈ and x belong to the same class, whereas l(x+∈)<0 means x+∈ and x belong to different classes;

[0034] The optimal solution search unit is used to search for the local optimal solution on the piecewise linear interface to complete the constructive explanation of the adversarial sample. Specifically, for any x∈C i 、 l(x)>0 and l(x * )<0, l(·) is a continuous function, and the adversarial samples in the shaded area satisfy Preset one As the initial value of the adversarial sample, the perturbation is initialized to The process of gradually optimizing the perturbation ∈ is described as finding ||∈ i ||2<||∈0||2 and satisfies l(x+∈ i )≈0, and then let∈ g is∈0 along the classification boundary in the gradient direction Projection on ∈ c is the projection of ∈0 on the classification boundary. ∈ g and ∈ c are mutually orthogonal, so we have Adjust ∈ i The calculation formula for the local optimal solution is:

[0035]

[0036] The superscript T of ∈ is the transpose, and w is the piecewise boundary function l(x)=w T The weight coefficient of x+b, (1-ρ) is used as the learning rate of the iterative optimization process; when the l2 norm of the perturbation ∈ satisfies the convergence condition ||∈ i ||2-||∈ i-1 ||2<σ and l(x+∈ i )≈0, obtain its local optimal solution and complete the adversarial sample 's construction.

[0037] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0039] Figure 1 This is a flowchart of a research method for interpretability of adversarial samples for underwater acoustic intelligent camouflage according to an embodiment of the present invention;

[0040] Figure 2 1. It is a schematic diagram of underwater acoustic signal data samples and hyperplane division of their sample space according to an embodiment of the present invention;

[0041] Figure 3 is a schematic diagram of sample modification of the input space and output space according to an embodiment of the present invention;

[0042] Figure 4 1. It is a schematic diagram of the process of piecewise linearization of classification boundaries and iterative optimization of adversarial samples according to an embodiment of the present invention;

[0043] Figure 5 It is a structural diagram of a system for researching the explainability of adversarial samples for underwater acoustic intelligent camouflage according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0045] To meet the demand for intelligent camouflage in underwater acoustic adversarial environments and ensure both self-awareness and enemy-awareness in adversarial scenarios, interpretability research is essential. This not only ensures the reliability of camouflage technology but also provides closed-loop feedback for the design of adversarial examples in offensive and defensive environments, allowing for appropriate adjustment of perturbation parameters to improve camouflage capabilities. Therefore, the following describes, with reference to the accompanying drawings, a method and system for researching interpretability of adversarial examples for underwater acoustic intelligent camouflage, proposed according to an embodiment of the present invention. First, the method for researching interpretability of adversarial examples for underwater acoustic intelligent camouflage, proposed according to an embodiment of the present invention, will be described with reference to the accompanying drawings.

[0046] Figure 1 It is a structural diagram of a research method for explainability of adversarial samples for underwater acoustic intelligent camouflage according to an embodiment of the present invention.

[0047] like Figure 1As shown in Figure 1, the research method for the explainability of adversarial samples for underwater acoustic intelligent camouflage includes the following steps:

[0048] In step S1, the distribution of input samples and output labels in the multidimensional space is analyzed, and the sample space is segmented and set using a hyperplane.

[0049] Furthermore, in one embodiment of the present invention, step S1 specifically includes:

[0050] Define the sampling data as n-dimensional sample x={x1,x2,…,x n}, the sample space where it is located Can be p hyperplanes of any form Split into the most subspace C t , each subspace C t The sample points in the same class

[0051] Specifically, if Figure 2 As shown in the figure, the sampling data, sample space and recognition system are defined, and the sampling data is defined as an n-dimensional sample x={x1,x2,…,x n}, the sample space where it is located Can be p hyperplanes of any form Split into the most A “subspace” C t , each C t The sample points in the same class Each subspace may belong to the same class or different classes. Subspaces belonging to the same class can be combined arbitrarily without considering the requirements of continuity, convex hull and no holes. In this invention, the recognition system is regarded as a binary classifier, and the output label of the ship recognition is only "target". and "no goal" There are two options, k = 1 or 2. For a trained machine learning system, adjusting the input x may change the output label to another category.

[0052] In step S2, the existence of adversarial samples is explained based on the l0 distance between the adversarial samples and the original samples.

[0053] It should be noted that the l0 norm is mainly used to measure the number of non-zero elements in a vector. The definition of L-0 obtained by LP definition is: In practice, most people give the following alternative definition: ||x||0≠(i)withx i ≠0, that is, the number of all non-zero elements in the vector l0 distance is the difference in the number of non-zero elements between the adversarial sample and the original sample.

[0054] Specifically, we first prove the existence range of adversarial perturbations under l0 distance. At the input of the preset deep neural network, given any two subspaces C1 and C2, and The sample points x and y belong to these two subspaces respectively. Theoretically, only the k components of x need to be changed at the l0 distance (that is, the sample If we change the value of x to y, then we can modify x to y. Let d be an n-dimensional vector containing z non-zero elements; then the relationship between x and y can be expressed as y = x + cd, where c is a constant coefficient. Therefore, as long as c is gradually increased from 0, x can escape from C1 and cross the boundary hyperplane between C1 and C2, thus achieving the perturbation change of the adversarial sample at the input. In most practices, n>2 p Since z=2 satisfies the crossing condition, the number of non-zero entries in d is very small. In practice, we can try to find the sparse quantity d by giving the values of n, p, and z to prove the existence range of the adversarial perturbation at the l0 distance.

[0055] Find adversarial examples In the preset deep neural network, each neuron performs a weighted summation of the input in a typical linear model, and its nonlinear factor is introduced by the cascade activation function. Assume that the network has r activation functions (such as ReLU, Softmax, etc.), and the activation function can be used for each input Output an m-dimensional real vector that provides the confidence in the network that x belongs to one of the m classes The binary classification problem in this project determines m=2. Figure 3 As shown in (a), the network can be regarded as a The piecewise linear mapping of two different classes and The input quantities x and y are Fine-tune the values of some dimensions in x so that and has the same confidence as y in the network, It will be classified as an adversarial sample by the network Here we will include h+∈ as the perturbation quantity into cd and explain it together. In this process, each modification is to the fixed dimensional component in x, that is, x and The l0 distance between them is bounded.

[0056] If we make a smooth transition between two input samples x and y, we can represent it as a straight line:

[0057] x a =(1-a)x+ay, a∈[0,1]

[0058] Among them, x α is a constant. In the input space, x and y can be connected by this straight line, but It is a piecewise linear mapping, so it maps a straight line in the n-dimensional input space to a piecewise broken line in the m-dimensional network output space. This broken line is composed of a finite number of line segments, where each change in direction is caused by the switching of the activation function between positive and negative inputs. Assuming that z components in the input sample x are allowed to be adjusted and the other components keep their original values, the input dimension can be reduced from n to z, so that the network system can be understood as a piecewise linear mapping from the z-dimensional input space to the m-dimensional output space, such as Figure 3 (b) In practice, z ≥ m, but the difference between the two is not large, so a function mapping is implemented between the original image (straight line) in the high-dimensional space and the image (broken line) in the low-dimensional space. Then, the local inverse mapping can be used to find the unique image in the input space corresponding to the broken line, that is, to find the adversarial sample.

[0059] In step S3, the composition principle of the adversarial sample is proved based on the l2 distance between the adversarial sample and the original sample.

[0060] It should be noted that l2 distance is Euclidean distance, which is the straight-line distance between two points:

[0061]

[0062] Specifically, first classify the boundary piecewise linearization and let the perturbation Then the constraint condition of the minimum perturbation min||∈||2 is: a continuous function of the classification boundary And i≠j, x∈C i ,here Indicates that the network output belongs to Confidence of the class. For adversarial examples The output class with the highest confidence is l(x+∈)>0 means x+∈ and x belong to the same class, and l(x+∈)<0 means x+∈ and x belong to different classes. Theoretically, when l(x+∈)=0 is a critical adversarial example. In practice, the classification boundary will be piecewise linearized, such as Figure 3 As shown in Figure 2, the nonlinear classification boundary (blue curve) is approximated as a linear boundary (red broken line). The closed area between the two dividing lines is usually where the adversarial samples can be found. Figure 4Adversarial examples of x can be found in the shaded area. This is described by the formula l(x+∈)+ε=0, where ε>0, indicating that a small space containing adversarial examples exists near the classification boundary l. Furthermore, the function l(·) is very likely non-convex, making it difficult to construct a globally optimal adversarial example for any input sample. However, experiments have shown that it is possible to find a local optimal solution (a suboptimal solution). Specifically, finding a point that falls within the shaded area in Figure 4 can meet the requirements. This suboptimal solution is also highly aggressive, sufficient to deceive machine learning models and achieve intelligent camouflage.

[0063] Then search for the local optimal solution at the segmented linear interface. The embodiment of the present invention intends to search for the local optimal solution at the segmented linear interface to complete the constructive explanation of the adversarial sample. For any x∈C i 、 l(x)>0 and l(x * )<0. l(·) is a continuous function, and the adversarial samples in the shaded area satisfy Given a As the initial value of the adversarial sample, the perturbation is initialized to The process of gradually optimizing the perturbation ∈ can be described as finding ||∈ i ||2<||∈0||2 and satisfies l(x+∈ i )≈0, such as Figure 4 As shown in (a). Figure 4 (b) describes the perturbation amount ∈ during the construction of adversarial samples i Details of iterative optimization, let ∈ g is∈0 along the classification boundary in the gradient direction Projection on ∈ c is the projection of ∈0 on the classification boundary. ∈ g and ∈ c are mutually orthogonal, so we have Adjust ∈ i The calculation formula can be used to obtain the iterative equation of the local optimal solution:

[0064]

[0065] Where the superscript T in ∈ denotes transposition; w is the piecewise boundary function l(x) = w T The weight coefficient of x+b, (1-ρ) is used as the learning rate of the iterative optimization process. Its value can be set empirically, but if it is too large, it may not converge, and if it is too small, it will lead to slow convergence. When the l2 norm of the perturbation ∈ satisfies the convergence condition ||∈ i ||2-||∈ i-1 ||2<σ (σ is a small positive number set by experience) and l(x+∈ i)≈0, we can obtain its local optimal solution and complete the adversarial sample The construction of ∈ i The iterative process and its value range in the l0 and l2 norms can be used as feedback to constrain the solution of the perturbation target equation of the formula, guide the modification and tuning of the equation parameters, and realize the logical closed loop of the entire technical route.

[0066] The research method for interpretability of adversarial samples for underwater acoustic intelligent camouflage proposed in accordance with the embodiment of the present invention has the following beneficial effects: (1) The deceptive attack of underwater acoustic adversarial samples on enemy models should be as self-aware as possible. The existing adversarial sample attack mechanism cannot fully explain the deception process of machine learning models. The embodiment of the present invention realizes a logical closed loop for acoustic intelligent camouflage technology, ensuring that our designers or operators use explainable adversarial attack methods to deal with enemy defense measures; (2) The embodiment of the present invention can study the interpretability of data, models and decisions in the camouflage process, improve the transparency of the adversarial sample working mechanism, and ensure reliable human-computer interaction, function improvement and parameter tuning; (3) A reasonable explanation of the structure and working mechanism of underwater acoustic adversarial disturbance is realized; (4) The reliability of camouflage technology is guaranteed.

[0067] Next, the adversarial sample explainability research system for underwater acoustic intelligent camouflage proposed according to an embodiment of the present invention is described with reference to the accompanying drawings.

[0068] Figure 5 It is a structural diagram of a system for researching the explainability of adversarial samples for underwater acoustic intelligent camouflage according to an embodiment of the present invention.

[0069] like Figure 5 As shown, the system 10 includes: a space segmentation module 100, an existence interpretation module 200 and a composition principle interpretation module 300.

[0070] The spatial segmentation module 100 analyzes the distribution of input samples and output labels in multidimensional space and partitions the sample space using hyperplanes. The existence explanation module 200 explains the existence of adversarial examples based on the l0 distance between the adversarial examples and the original samples. The composition principle explanation module 300 proves the composition principle of the adversarial examples based on the l2 distance between the adversarial examples and the original samples.

[0071] Furthermore, in one embodiment of the present invention, the space segmentation module specifically includes:

[0072] Define the sampling data as n-dimensional sample x={x1,x2,…,x n}, the sample space where it is located Can be p hyperplanes of any form Split into the most subspace Ct , each subspace C t The sample points in the same class

[0073] Furthermore, in one embodiment of the present invention, each subspace may belong to the same category or different categories, and subspaces belonging to the same category can be combined arbitrarily.

[0074] Furthermore, in one embodiment of the present invention, the existence interpretation module specifically includes:

[0075] The perturbation change unit is used to give any two subspaces C1 and C2 at the input end of the preset deep neural network, and output the label Sample points x and y belong to two subspaces C1 and C2 respectively. Let d be an n-dimensional vector containing z non-zero elements. Then the relationship between x and y is expressed as y = x + cd, where c is a constant coefficient to achieve perturbation changes of adversarial samples at the input end.

[0076] The first mapping unit is used to set the preset deep neural network to have r activation functions, and the activation function is for each input Output an m-dimensional real vector and regard the preset deep neural network as a The piecewise linear mapping of two different classes and The input quantities x and y are Fine-tune the values of some dimensions in x so that and has the same confidence as y in the network, As adversarial samples, they are classified by the network as

[0077] The second mapping unit is used to set the input sample x to allow z components to be adjusted, and the other components to keep their original values, reduce the input dimension from n to z, and understand the preset deep neural network as a piecewise linear mapping from the z-dimensional input space to the m-dimensional output space. The local inverse mapping is used to find the unique image in the input space corresponding to the broken line, that is, to find the adversarial sample.

[0078] Furthermore, in one embodiment of the present invention, the composition principle explanation module specifically includes:

[0079] The piecewise linearization unit is used to piecewise linearize the classification boundary to obtain the interface. Specifically, let the perturbation Then the constraint condition of the minimum perturbation min||∈||2 is: a continuous function of the classification boundary And i≠j, x∈C i ,in, The output of the preset deep neural network belongs to The confidence level of the class, For adversarial examples The output class with the highest confidence is l(x+∈)>0 means x+∈ and x belong to the same class, whereas l(x+∈)<0 means x+∈ and x belong to different classes;

[0080] The optimal solution search unit is used to search for the local optimal solution on the piecewise linear interface to complete the constructive explanation of the adversarial sample. Specifically, for any x∈C i 、 l(x)>0 and l(x * )<0, l(·) is a continuous function, and the adversarial samples in the shaded area satisfy Preset one As the initial value of the adversarial sample, the perturbation is initialized to The process of gradually optimizing the perturbation ∈ is described as finding ||∈ i ||2<||∈0||2 and satisfies l(x+∈ i )≈0, and then let∈ g is∈0 along the classification boundary in the gradient direction Projection on ∈ c is the projection of ∈0 on the classification boundary. ∈ g and ∈ c are mutually orthogonal, so we have Adjust ∈ i The calculation formula for the local optimal solution is:

[0081]

[0082] The superscript T of ∈ is the transpose, and w is the piecewise boundary function l(x)=w T The weight coefficient of x+b, (1-ρ) is used as the learning rate of the iterative optimization process; when the l2 norm of the perturbation ∈ satisfies the convergence condition ||∈ i ||2-||∈ i-1 ||2<σ and l(x+∈ i )≈0, obtain its local optimal solution and complete the adversarial sample 's construction.

[0083] It should be noted that the above explanation of the embodiment of the research method for the interpretability of adversarial samples for underwater acoustic intelligent camouflage is also applicable to the system of this embodiment and will not be repeated here.

[0084] The adversarial sample explainability research system for underwater acoustic intelligent camouflage proposed in accordance with the embodiment of the present invention has the following beneficial effects: (1) The deceptive attack of underwater acoustic adversarial samples on the enemy model should be as self-aware as possible. The existing adversarial sample attack mechanism cannot fully explain the deception process of the machine learning model. The embodiment of the present invention realizes a logical closed loop for the acoustic intelligent camouflage technology, ensuring that our designers or operators use explainable adversarial attack methods to deal with the enemy's defense measures; (2) The embodiment of the present invention can study the explainability of data, models and decisions in the camouflage process, improve the transparency of the adversarial sample working mechanism, and ensure reliable human-computer interaction, function improvement and parameter tuning; (3) A reasonable explanation of the structure and working mechanism of underwater acoustic adversarial disturbance is realized; (4) The reliability of the camouflage technology is guaranteed.

[0085] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0086] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0087] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A research method for the interpretability of adversarial samples for underwater acoustic intelligent camouflage, characterized by: The following steps are involved: Step S1: Analyze the distribution of input samples and output labels in multidimensional space, and segment the sample space with a hyperplane; Step S2, based on the difference between the adversarial sample and the original sample Distance acquisition adversarial examples; Step S3, based on the difference between the adversarial sample and the original sample Distance to obtain local optimal solution; The step S2 specifically includes: Step S201: at the input end of the preset deep neural network, any two subspaces are given C 1 and C 2, and the output label has a target No goal , sample points 、 Belong to two subspaces C 1 and C 2. Assume d For one n -dimensional vector containing z non-zero elements, then x and y The relationship is expressed as ,in c is a constant coefficient to achieve the perturbation change of the adversarial sample at the input end; Step S202: Assume that the preset deep neural network has r An activation function is used for each input x ∈ Output a m dimensional real vector, considering the preset deep neural network as a → The piecewise linear mapping of two different classes and Input x and y ,have , , fine-tuning x The value of some dimensions in ,and and y have the same confidence in the network, As adversarial samples, they are classified by the network as ; Step S203: Set the input sample x Allowed z The input dimension is adjusted from n down to z , understand the preset deep neural network as a z dimensional input space to m dimensional output space, and use the local inverse mapping to find the unique image in the input space corresponding to the broken line, that is, to find the adversarial sample. ; The step S3 specifically includes: Step S301, piecewise linearize the classification boundary to obtain the interface. Specifically, let the disturbance , then the minimum perturbation The constraints are: continuous function of the classification boundary ,and , x ∈ C i ,in, The output of the preset deep neural network belongs to The confidence level of the class, For adversarial examples The output class with the highest confidence is , express and x Belong to the same category, otherwise express and x Belong to different categories; Step S302: Search for the local optimal solution at the piecewise linearization interface to complete the constructive explanation of the adversarial sample. Specifically, for any 、 There are l ( x )>0 and , l (·) is a continuous function, and the adversarial examples in the shaded area satisfy , preset a As the initial value of the adversarial sample, the perturbation is initialized to , gradually optimize the perturbation The process is described as finding and satisfy The iterative process, then set for Along the classification boundary in the gradient direction The projection on for Projection on the classification boundary, and are mutually orthogonal, so we have , ,Adjustment The calculation formula for the local optimal solution is: ， in Superscript T is the transpose, w is the piecewise boundary function l ( x )= w T x + b The weight coefficient of As the learning rate of the iterative optimization process; when the perturbation of l 2 norm meets the convergence condition Time , obtain its local optimal solution and complete the adversarial sample 's construction.

2. The research method for interpretability of adversarial samples for underwater acoustic intelligent camouflage according to claim 1 is characterized in that: The step S1 specifically includes: Define sampling data as n-dimensional samples , the sample space where it is located Can be any form p Hyperplane , i=1,…, p Split into the most Subspace , each subspace The sample points in the same class .

3. The research method for interpretability of adversarial samples for underwater acoustic intelligent camouflage according to claim 2 is characterized in that: Each subspace may belong to the same class or different classes, and subspaces belonging to the same class can be combined arbitrarily.

4. A research system for the explainability of adversarial samples for underwater acoustic intelligent camouflage, characterized by: include: The spatial segmentation module is used to analyze the distribution of input samples and output labels in multidimensional space and segment the sample space using hyperplanes; The adversarial sample acquisition module is used to obtain the adversarial sample based on the difference between the adversarial sample and the original sample. Distance acquisition adversarial examples; The local optimal solution acquisition module is used to obtain the optimal solution based on the difference between the adversarial sample and the original sample. Distance to obtain local optimal solution; The adversarial sample acquisition module specifically includes: The perturbation change unit is used to give any two subspaces at the input of the preset deep neural network C 1 and C 2, and the output label has a target No goal , sample points 、 Belong to two subspaces C 1 and C 2. Assume d For one n -dimensional vector containing z non-zero elements, then x and y The relationship is expressed as ,in c is a constant coefficient to achieve the perturbation change of the adversarial sample at the input end; The first mapping unit is used to set the preset deep neural network r An activation function is used for each input x ∈ Output a m dimensional real vector, considering the preset deep neural network as a → The piecewise linear mapping of two different classes and Input x and y ,have , , fine-tuning x The value of some dimensions in ,and and y have the same confidence in the network, As adversarial samples, they are classified by the network as ; The second mapping unit is used to set the input sample x Allowed z The input dimension is adjusted from n down to z , understand the preset deep neural network as a z dimensional input space to m dimensional output space, and use the local inverse mapping to find the unique image in the input space corresponding to the broken line, that is, to find the adversarial sample. ; The local optimal solution acquisition module specifically includes: The piecewise linearization unit is used to piecewise linearize the classification boundary to obtain the interface. Specifically, let the perturbation , then the minimum perturbation The constraints are: continuous function of the classification boundary ,and , x ∈ C i ,in, The output of the preset deep neural network belongs to The confidence level of the class, For adversarial examples The output class with the highest confidence is , express and x Belong to the same category, otherwise express and x Belong to different categories; The optimal solution search unit is used to search for the local optimal solution on the piecewise linear interface to complete the constructive explanation of the adversarial sample. Specifically, for any 、 There are l ( x )>0 and , l (·) is a continuous function, and the adversarial examples in the shaded area satisfy , preset a As the initial value of the adversarial sample, the perturbation is initialized to , gradually optimize the perturbation The process is described as finding and satisfy The iterative process, then set for Along the classification boundary in the gradient direction The projection on for Projection on the classification boundary, and are mutually orthogonal, so we have , ,Adjustment The calculation formula for the local optimal solution is: ， in Superscript T is the transpose, w is the piecewise boundary function l ( x )= w T x + b The weight coefficient of As the learning rate of the iterative optimization process; when the perturbation of l 2 norm meets the convergence condition Time , obtain its local optimal solution and complete the adversarial sample 's construction.

5. The adversarial sample explainability research system for underwater acoustic intelligent camouflage according to claim 4 is characterized in that: The space segmentation module specifically includes: Define sampling data as n-dimensional samples , the sample space where it is located Can be any form p Hyperplane , i=1,…, p Split into the most Subspace , each subspace The sample points in the same class .

6. The adversarial sample explainability research system for underwater acoustic intelligent camouflage according to claim 4 is characterized in that: Each subspace may belong to the same class or different classes, and subspaces belonging to the same class can be combined arbitrarily.

Images