A method for generating adversarial attack samples for deep learning signal recognition classifiers

Abstract

The present invention belongs to the field of intelligent wireless device security, and relates to a method for generating adversarial attack samples for a deep learning signal recognition classifier. The present invention provides a method for generating adversarial attack samples for a deep learning signal recognition classifier, which combines the fast gradient sign method and the projected gradient descent method, and uses the Monte Carlo method to randomly initialize the search starting point within the signal sample neighborhood to improve the stability of the gradient calculation. By jointly optimizing the loss function for a batch of signal samples of the same category, adversarial attack samples with good general aggressiveness among similar signal samples are generated. The beneficial effect of the present invention is that the present invention can improve the stability of the gradient calculation in the process of generating adversarial attack samples for a deep learning signal recognition classifier, and at the same time can generate adversarial attack samples with good general aggressiveness among similar samples. The method is simple and the effect is good.

Description

Technical Field

[0001] The present invention belongs to the field of intelligent wireless device security and relates to a method for generating anti-attack samples of a deep learning signal recognition classifier. Background Art

[0002] Communication signals typically employ different modulation schemes depending on their needs. Therefore, modulation recognition technology for communication signals is widely used in both military and civilian applications. Currently, there are two main approaches to automatic radio signal modulation recognition: those based on Bayesian decision theory and those based on statistical machine learning. The implementation of Bayesian decision theory essentially boils down to a multiple hypothesis testing problem. While theoretically sound, it lacks universality, is highly complex to implement, and offers only modest recognition rates. This rate drops sharply, particularly in complex electromagnetic environments and low signal-to-noise ratio (SNR) conditions. With the rise of artificial intelligence (AI), signal modulation recognition based on deep learning and statistical machine learning has gradually become a mainstream research area in this field. Its advantages include a simple and clear technical approach, a feasible algorithm, a straightforward implementation process, and excellent performance, making it suitable for general analog and digital signal recognition. Furthermore, modulation recognition classifiers based on deep learning are robust and adaptable to changes in the electromagnetic environment, effectively performing radio signal modulation recognition even under low SNR conditions.

[0003] While deep learning technology offers numerous advantages, numerous studies have confirmed that deep learning models present significant security risks in practical applications. They are vulnerable to adversarial attack samples, leading to erroneous decisions and potentially serious consequences. To study the impact of adversarial samples on deep learning-based modulation recognition classifiers and improve the robustness and security of deep learning models, it is necessary to investigate methods for generating adversarial attack samples. Current adversarial attack sample generation algorithms for signal recognition classifiers primarily target single samples and rely on searching for adversarial attacks based on the gradient of the deep learning model at that sample point. Implementing such methods on CPUs or GPUs has significant drawbacks due to their limited computational precision, which can result in zero gradients at some samples, preventing the correct computation of adversarial samples. Using a Monte Carlo method to randomly initialize iterative searches within the neighborhood of a signal sample can significantly improve the stability of the adversarial attack computation process. Furthermore, jointly optimizing a loss function for a group of signal samples of the same class can generate adversarial samples that are highly generalizable across similar signals. Summary of the Invention

[0004] The purpose of the present invention is to address the above-mentioned problems and provide a method for generating adversarial attack samples for a signal recognition classifier based on deep learning. The method combines the fast gradient sign method and the projected gradient descent method, and uses the Monte Carlo method to randomly initialize the search starting point within the neighborhood of the signal sample to improve the stability of the gradient calculation. By jointly optimizing the loss function for a batch of signal samples of the same category, adversarial attack samples with good general aggressiveness among similar signal samples are generated.

[0005] The technical solution of the present invention is:

[0006] A method for generating adversarial attack samples for deep learning signal recognition classifiers combines the fast gradient sign method and projected gradient descent method in the adversarial attack field to search for the optimal adversarial attack under a given power budget. Based on the Monte Carlo method, the search starting point is randomly initialized in the neighborhood of the signal sample to improve the stability of the gradient calculation of the deep learning model. By jointly optimizing the loss function for a batch of signal samples sampled from the same category, adversarial attack samples with good general offensiveness among similar signal samples are generated.

[0007] The present invention specifically comprises the following steps:

[0008] S1. Use VT-CNN2 as the classification model and train the model to convergence based on an open source signal dataset for modulation classification.

[0009] S2. Select a batch of signal samples of the same category from the open source signal dataset as the attacked sample set X, with a sample signal-to-noise ratio of SNR, a number of N, and a number of sample features of l; randomly select N from X. sample samples and its corresponding classification labels As the input of the general adversarial sample generation algorithm, N sample ≤N, given the power budget P of the adversarial example max , the loss function of the model The learning rate η, the final remaining learning rate ratio b, the number of iterations per round epochs, and the number of Monte Carlo simulations it_num of the general adversarial sample generation algorithm;

[0010] S3. Initialize the vector delta_UAP=0 for storing the optimal attack sample in the Monte Carlo simulation search process and the recognition accuracy acc of the model on the attacked sample set X at this time=1.0, and initialize the loop counter i=1;

[0011] S4, initialize the model recognition accuracy variable acc1 = 1.0 and the optimal solution vector delta_UAP1 = 0 corresponding to the optimal solution found in each round of iteration, using the random initialization method with 0 as the origin and lPmax Generate an adversarial attack signal vector delta_temp on the hypersphere with a radius and initialize the loop counter j = 1;

[0012] S5. Calculate the gradient of the loss function with respect to delta_temp at :

[0013]

[0014] Then update delta_temp:

[0015]

[0016] S6. Calculate the power P_delta of delta_temp. If P_delta > Pmax, then adjust the power of delta_temp to Pmax;

[0017] S7. Inject the adversarial attack signal vector delta_temp into the set of attacked signal samples, and evaluate the recognition accuracy acc1_temp of the model on X. If acc1_temp < acc1, then:

[0018] acc1 = acc1_temp

[0019] delta_UAP1 = delta_temp

[0020] j = j + 1

[0021] If j ≤ epochs, then go to S5;

[0022] S8. Adjust the power of delta_UAP1 to P max , i = i + 1. If acc1 < acc, then:

[0023] acc = acc1

[0024] delta_UAP = delta_UAP1

[0025] S9. If i ≤ it_num, then go to S4, otherwise output the universal adversarial attack signal delta_UAP.

[0026] The beneficial effects of the present invention are as follows. The present invention can improve the stability of gradient calculation in the process of generating adversarial attack samples for deep learning signal recognition classifiers, and can simultaneously generate adversarial attack samples with good general attack performance among similar samples. The method is simple and the effect is good. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 is a flowchart of the algorithm.

[0028] Figure 2 Schematic diagram of the VT-CNN2 modulation recognition model structure.

[0029] Figure 3 Comparison between the directional attack algorithm based on the fast gradient sign method and the improved algorithm when the PNR is 0dB.

[0030] Figure 4 Comparison between the non-directional attack algorithm based on the fast gradient sign method and the improved algorithm when the PNR is 0dB.

[0031] Figure 5 The figure shows a comparison between the general adversarial sample generation algorithm based on PCA and the present invention when the PNR is 0 dB. DETAILED DESCRIPTION

[0032] The technical solution of the present invention will be further described below with reference to the accompanying drawings and simulations.

[0033] Simulation Example

[0034] This example simulates and verifies the proposed method. It computes general adversarial attack samples for the VT-CNN2 model trained on the RML2016.10a open source modulation recognition signal dataset. For simplicity, the following assumptions are made about the algorithm model and dataset:

[0035] 1. The algorithm model can correctly distinguish different types of signal samples;

[0036] 2. There is no obvious overlap between the distribution areas of different types of signals;

[0037] 3. There is only Gaussian white noise in the dataset;

[0038] 80% of the RML2016.10a open source modulation identification signal dataset is used as a training set, and the remaining 20% ​​is used as a test set. Signals with SNR = 10dB in 9 categories in the test set, including 8PSK, AM-DSB, AM-SSB, BPSK, CPFSK, GFSK, PAM4, QAM64 and QPSK, are selected as attack test samples. sample =150, Pmax is the average power of noise in the signal, η = 0.0006, b = 0.01, epochs = 8, it_num = 100. In terms of simulation environment hardware, the CPU is Intel Core i7-12700, the GPU is NVIDIA GeForce RTX 2070, and the CUDA version is 11.2.

[0039] like Figure 1 As shown, the specific process of this example is:

[0040] S1, press Figure 2 The model structure shown builds the VT-CNN2 model and trains it on the RML2016.10a open source modulation recognition signal dataset until the model converges;

[0041] S2. Select a batch of N signal samples of the same category with a signal-to-noise ratio of SNR from the RML2016.10a open source modulation recognition signal dataset as the attacked sample set X (a single sample is a complex vector), and the number of sample features is l. Then randomly select N from the attacked sample set. sample (N sample ≤N) samples and its corresponding classification labels As the input of the general adversarial sample generation algorithm, the power budget P of the given adversarial sample is max , the loss function of the model The learning rate η, the final remaining learning rate ratio b, the number of iterations per round epochs, and the number of Monte Carlo simulations it_num of the general adversarial sample generation algorithm.

[0042] S3. Initialize the vector delta_UAP=0 for storing the optimal attack sample in the Monte Carlo simulation search process and the recognition accuracy acc=1.0 of the model on the attacked sample set X at this time, and initialize the loop counter i=1.

[0043] S4, initialize the model recognition accuracy variable acc1 = 1.0 and the optimal solution vector delta_UAP1 = 0 corresponding to the optimal solution found in each round of iteration, using the random initialization method with 0 as the origin and lP max Generate an adversarial attack signal vector delta_temp (with the same shape as a single signal sample) on a hypersphere of radius φ and initialize the loop counter j=1.

[0044] S5. Calculation The gradient of the loss function with respect to delta_temp is:

[0045]

[0046] Then update delta_temp:

[0047]

[0048] S6. Calculate the power P_delta of delta_temp. If P_delta>Pmax, adjust the power of delta_temp to Pmax.

[0049] S7. Inject the adversarial attack signal vector delta_temp into the set of attacked signal samples, and evaluate the recognition accuracy acc1_temp of the model on X. If acc1_temp < acc1, then:

[0050] acc1 = acc1_temp

[0051] delta_UAP1 = delta_temp

[0052] j = j + 1

[0053] If j ≤ epochs, go to S5.

[0054] S8. Adjust the power of delta_UAP1 to P max , i = i + 1. If acc1 < acc, then:

[0055] acc = acc1

[0056] delta_UAP = delta_UAP1

[0057] S9. If i ≤ it_num, go to S4, otherwise output the universal adversarial attack signal delta_UAP.

[0058] The simulation results are shown in the figure:

[0059] Figure 3 The figures respectively show the comparison between the single-sample targeted attack algorithm based on the fast gradient sign method and the improved algorithm using the Monte Carlo random initialization method when the PNR is 0 dB. The single-sample targeted attack algorithm based on the fast gradient sign method obtains the adversarial attack signal by calculating the gradient of the loss function at the signal sample for all classes, while the improved algorithm randomly initializes the adversarial attack signal within the sample neighborhood and calculates the gradient of the loss function with respect to the adversarial attack signal. As can be seen from the figure, the improved method improves the problem that the gradient of the loss function at the sample disappears due to the limited hardware precision and the correct adversarial attack signal cannot be calculated by randomly initializing within the sample neighborhood, thus improving the effectiveness of the attack.

[0060] Figure 4 The figures respectively show the comparison between the single-sample untargeted attack algorithm based on the fast gradient sign method and the improved algorithm using the Monte Carlo random initialization method when the PNR is 0 dB. Similar to Figure 3 the results shown, the improved method has better attack effectiveness.

[0061] Figure 5The figures show a comparison between a general adversarial attack algorithm based on principal component analysis (PCA) and the general attack algorithm proposed in the present invention when the PNR is 0 dB. It can be seen from the figure that the performance of the general attack algorithm proposed in the present invention is significantly better than the general adversarial attack algorithm based on principal component analysis (PCA).

Claims

1. A method for generating anti-attack samples for a deep learning signal recognition classifier, characterized in that: It includes the following steps: S1. Use VT-CNN2 as the classification model and train the model to convergence based on the open-source signal dataset for modulation classification; S2. Select a batch of signal samples of the same category from the open source signal dataset as the attacked sample set X, with a sample signal-to-noise ratio of SNR, a number of N, and a number of sample features of l; randomly select N from X. sample samples and its corresponding classification labels As the input of the general adversarial sample generation algorithm, N sample ≤N, given the power budget P of the adversarial example max , the loss function of the model The learning rate η, the final remaining learning rate ratio b, the number of iterations per round epochs, and the number of Monte Carlo simulations it_num of the general adversarial sample generation algorithm; S3. Initialize the vector delta_UAP for saving the optimal attack samples during the Monte Carlo simulation search process as 0, and the recognition accuracy acc of the model on the attacked sample set X at this time as 1.

0. Initialize the loop counter i as 1; S4, initialize the model recognition accuracy variable acc1 = 1.0 and the optimal solution vector delta_UAP1 = 0 corresponding to the optimal solution found in each round of iteration, using the random initialization method with 0 as the origin and lP max Generate an adversarial attack signal vector delta_temp on a hypersphere of radius and initialize the loop counter j = 1; S5. Calculation The gradient of the loss function with respect to delta_temp is: Then update delta_temp: S6. Calculate the power P_delta of delta_temp. If P_delta > Pmax, adjust the power of delta_temp to Pmax; S7. Inject the adversarial attack signal vector delta_temp into the attacked signal sample set, and evaluate the recognition accuracy acc1_temp of the model on X. If acc1_temp < acc1, then: acc1 = acc1_temp delta_UAP1 = delta_temp j = j + 1 If j ≤ epochs, go to S5; S8. Adjust the power of delta_UAP1 to P max , i = i + 1. If acc1 < acc, then: acc = acc1 delta_UAP = delta_UAP1 S9. If i ≤ it_num, go to S4, otherwise output the universal adversarial attack signal delta_UAP.

Images