An abstract automaton-based time series adversarial sample generation method
By using an abstract automaton-based approach, vulnerable samples are screened and small perturbations are applied to marginal positive samples to generate covert, high-quality adversarial samples. This solves the problem of insufficient robustness of recurrent neural networks in time series classification tasks and improves attack efficiency and success rate.
Patent Information
- Application Number
- CN202211343442.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-10-31
- Publication Date
- 2026-01-02
- Estimated Expiration
- 2042-10-31
AI Technical Summary
Existing adversarial example generation methods cannot effectively improve the robustness of recurrent neural networks and are difficult to detect their vulnerabilities, especially in time series classification tasks where there is a lack of effective adversarial example generation methods.
An abstract automaton-based approach is adopted to generate covert and high-quality adversarial samples by screening vulnerable samples. The approach also utilizes a weighted finite automaton to screen sensitive negative samples and apply small perturbations to marginal positive samples to construct adversarial samples.
It improves the efficiency of time series attacks on recurrent neural networks, ensures that the generated samples are well concealed and have a high success rate, reduces the dependence on the quality of the original dataset, and lowers the generation difficulty.
Smart Images
Figure CN115545167B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to deep learning, adversarial attack, and in particular to a time series adversarial sample generation method based on abstract automata. BACKGROUND
[0002] Adversarial sample generation is one of the effective techniques to improve the credibility of neural network classifiers, and related research work has attracted widespread attention. On the one hand, the process of generating adversarial samples often involves attempts to understand and explain the training principles and prediction processes of neural networks, and the generated results are also helpful for people to find and locate the defects of the model; on the other hand, the work in the field of adversarial defense can use the generated adversarial samples to enhance the training data set, thereby improving the robustness of the neural network classifier and helping to resist the interference or malicious attack of unexpected situations that may occur in real-world applications. In the field of computer vision, much progress has been made in the generation of adversarial samples for classifiers based on multilayer perceptron or convolutional neural network. Under certain conditions, the front-line work can even achieve the result of making the model produce an incorrect classification result by only perturbing one pixel in the input image.
[0003] Adversarial attacks have been widely accepted as an effective means to evaluate and even improve the robustness of neural networks before their formal deployment in security-related fields. Common adversarial attack techniques can be divided into two categories: black-box attacks and white-box attacks. For example, the fast gradient sign method based on network linearization, FGSM for short, and the projection gradient descent algorithm, PGD for short, originally used for standard constraint optimization, have been proven to have effects close to FGSM under the infinite norm in recent years. Black-box attack algorithms are mainly based on the transferability principle of adversarial samples, and existing practices include the Newton Fool algorithm, etc., which require less model information, but the attack success rate is usually lower than that of white-box attack algorithms.
[0004] However, these gradient-based adversarial attacks always assume that the target model is directly differentiable, while the unique time recurrent structure of recurrent neural networks cannot be calculated. On the other hand, since time series are more sensitive to perturbations than image data, the current accepted local optimization objective and existing adversarial attack algorithm that minimizes the amount of perturbation for each sample are suspicious, as it seems to be tailored for image data. Therefore, when time series classification has been applied to various real-world safety-critical tasks, and recurrent neural networks are the most effective structure for time series classification, existing methods cannot generate adversarial time series recurrent neural network classifiers. Among them, some algorithms cannot effectively perform adversarial attacks on recurrent neural network classifiers, and some cannot guarantee that the generated adversarial samples meet the constraint of minimal difference. Therefore, how to generate adversarial samples according to the characteristics of recurrent neural network classifiers is still a problem of great research significance. SUMMARY
[0005] In view of the above problems, the problem to be solved by the present application is that there is a lack of effective adversarial sample generation method in recurrent neural networks, which makes it difficult to effectively improve the robustness of recurrent neural networks and find the vulnerabilities of recurrent neural networks. The present application can evaluate its attack ability on neural networks and automatically generate high-quality adversarial samples, solving the problem of lack of effective adversarial attack method for time series recurrent neural networks. The purpose of the present application is to open up a new method of generating adversarial samples for time series based on abstract automata, improve the attack efficiency of time series on recurrent neural networks, and ensure that the generated samples are well hidden and have high attack success rate.
[0006] The specific technical solution to achieve the purpose of the present application is:
[0007] A method for generating adversarial samples for time series based on abstract automata, characterized by being capable of using the characteristics of weight finite automata to filter the original data set and filter out samples susceptible to attack, and finally generating well-hidden and high-quality adversarial samples using the original time series data set. The method comprises the following specific steps:
[0008] A: According to the original time series data set, set the structure information and activation function parameters of the recurrent neural network, train the recurrent neural network to complete the time series classification task; specifically including:
[0009] A1: Divide the original time series data set into a training set and a test set according to an 8:2 ratio;
[0010] A2: Set the hidden layer and neuron number parameters, and use the Adam optimizer and cross-entropy loss function to train the recurrent neural network to complete the time series classification task;
[0011] A3: Adopting the two standards of test accuracy and loss value Loss, automatically select and update the optimal model in the recurrent neural network trained in A2 to complete the time series classification task; update the selected optimal model when the following two conditions occur: 1) the accuracy of the current model exceeds the optimal model by 1% on the test data set; 2) the accuracy of the current model is greater than the accuracy of the optimal model, but does not exceed 1%, and the loss value of the current model does not exceed the loss value of the optimal model;
[0012] B: Abstract the output sequence of the recurrent neural network and construct a weighted finite automaton, specifically including:
[0013] B1: Regularize the original input data, express all feature values as 0-1 values according to the distribution, so as to provide a unified operation view for subsequent input division; also allows further manual fine-tuning of the granularity of abstract division under the condition of satisfying the above regularization of the original input data, and finally obtains the number of preliminary abstract blocks that the input domain should be divided into;
[0014] B2: Calculate the average difference value of adjacent feature values in each dimension of the input data, and take the difference value reduced by one order of magnitude as the micro difference value, to ensure the effectiveness of input abstract division;
[0015] B3: Further manually fine-tune the granularity of abstract division under the condition of satisfying the calculation of the micro difference value, and finally obtain the number of further refined abstract blocks that the input domain should be divided into;
[0016] B4: Execute on the recurrent neural network for all input sequences in the training data set according to the time step by step, output the explicit representation of the hidden state and record it; perform prediction result abstraction and prediction confidence abstraction on all recorded explicit representations to obtain complete abstract representation and record it;
[0017] B5: Initialize the state vector of the weighted finite automaton; the state vector is an independent initial state set outside all abstract states, and the execution of all input sequences starts from this state, and its physical meaning is that the weighted finite automaton before receiving input will output classification results with equal confidence of each category, corresponding to the all 0 initialization of the original neural network; the hidden state of the recurrent neural network is uniformly initialized in the form of all 0, so the all 0 method is used to construct the initial state vector;
[0018] B6: Establish a statistical transition matrix of the weighted finite automaton; for each abstract state in the abstract state set, record the classification prediction output corresponding to the instance state falling into the abstract state obtained during the execution of the recurrent neural network on the entire training data set, and express each element in the recorded vector as a probability value between 0 and 1 according to the distribution, and take the vector after the probability of the record as a partial vector of the statistical transition matrix;
[0019] B7: Establish a probability output matrix of the weighted finite automaton; record the classification prediction output corresponding to the instance state falling into the abstract state obtained during the execution of the recurrent neural network on the entire training data set, and perform probability on the recorded vector, and express each element in the recorded vector as a probability value between 0 and 1 according to the distribution, and take the vector after the probability of the record as a partial vector of the probability output matrix; thus the construction of the weighted finite automaton is completed;
[0020] C: Find edge positive samples and generate adversarial samples using the constructed weighted finite automaton and the prediction results of the original recurrent neural network, specifically including:
[0021] C1: Use the recurrent neural network and the weighted finite automaton obtained from step B to make predictions on the entire training data set respectively, when the weighted finite automaton predicts correctly and the recurrent neural network predicts incorrectly, it means that compared with other samples that are similar in external representation and actually belong to the same class, the sample is processed and understood by the recurrent neural network for a different latent manifold, so it is predicted for an incorrect class, and the samples that meet this condition are called sensitive negative samples; compare the prediction results of the two and the training set labels, and select the sensitive negative samples in the training data set;
[0022] C2: Find positive samples in the entire training data set that are closest to the sensitive negative samples selected in C1 and have the same actual class, the distance is measured by the distance between the sensitive negative samples and the found positive samples falling into the abstract input block at each time step;
[0023] C3: Determine the sampling granularity of the current round according to the window size and the control hyperparameter, sample within the window according to the sampling granularity, and put all newly obtained samples into the recurrent neural network model for prediction;
[0024] C4: Locate the position of the positive-negative boundary in the prediction result, and update the window size to the matrix difference between the sampling samples on both sides of the position; as the iteration proceeds, the sampling granularity becomes finer round by round, and the latent manifolds corresponding to the samples on both sides of the window continuously approach the classification boundary between the positive and negative manifolds, until the sampling granularity is less than the set adversarial perturbation amplitude, and the positive sample closest to the boundary is the edge positive sample;
[0025] C5: Set the amplitude of the disturbance, allow to adjust the size of the disturbance amplitude under the premise of small difference value, so as to ensure that the small disturbance is always implemented;
[0026] C6: Calculate the size of the disturbance window, the small window is the window with the size less than the time step length of the input sample by one order of magnitude, and the actual selected disturbance window size is flexibly adjusted under this constraint;
[0027] C7: Introduce expert inspection to confirm that the edge positive sample does not deviate from the category pointed by the correct label;
[0028] C8: For qualified edge positive samples, make the disturbance window slide according to the time step and apply the disturbance with the specified direction and amplitude to generate the adversarial sample, and finally store all generated adversarial samples in the adversarial sample set.
[0029] Compared with the existing adversarial attack technology, the advantages of the present application are: a reasonable, efficient and universally applicable time series adversarial sample generation method is proposed, which can be applied to any classifier model with time series output capability, and shows good inclusiveness to the quality of the target model; The concepts of sensitive negative samples and edge positive samples are proposed, and new ideas outside the two common methods of generating global adversarial samples according to gradient and other indicators and generating local adversarial samples by finding sensitive points on original positive samples in mainstream adversarial attack algorithms are explored and practiced, which to some extent reduces the dependence of adversarial attack algorithm on the quality of original data set, reduces the candidate generation space, thereby improving the generation efficiency, and reduces the difficulty of successfully generating adversarial samples by means of small disturbance; The weight finite automaton and its abstract construction algorithm are improved to some extent, including optimization of input abstraction and change of probability transition matrix mode, so that the improved weight finite automaton has better explainability to the original recurrent neural network and can be executed on samples outside the training data set. BRIEF DESCRIPTION OF DRAWINGS
[0030] Figure 1 The method framework diagram of the present application;
[0031] Figure 2 The flowchart of step B of the present application;
[0032] Figure 3 The flowchart of step C of the present application. DETAILED DESCRIPTION
[0033] The present application will be described in detail below in combination with the drawings and specific embodiments. The present embodiment is implemented on the premise of the technical solution of the present application, and gives detailed implementation mode and specific operation process, but the protection scope of the present application is not limited to the following embodiments.
[0034] This invention proposes a time-series adversarial sample generation method based on abstract automata. By utilizing the different generalization boundaries of weighted finite automata and neural networks, vulnerable samples are obtained through screening. Sensitive negative samples and marginal positive samples are then designed to perturb the vulnerable samples, which can efficiently construct adversarial samples with small perturbations and high quality.
[0035] See Figure 1 The framework of this method mainly consists of three parts: selection of the target recurrent neural network, establishment of a weighted finite automaton, and generation of adversarial time series data. The specific steps are as follows:
[0036] A: The selection of the target recurrent neural network falls within the framework of this invention. Figure 1 The steps within the dashed box on the left are primarily responsible for network training; this invention focuses on recurrent neural network (RNN) classification models. A long short-term memory (LSTM) neural network is used, with the number of hidden layers and neurons specified. For the training process, the relatively mature and efficient Adam optimizer is selected, and the cross-entropy loss function is used to calculate the training loss value, with the same number of training rounds performed uniformly. Afterwards, the optimal model is automatically selected and updated from all the RNNs obtained through the above training. Specifically, the selected optimal model is updated when the following two conditions occur: 1) On the test dataset, the accuracy of the current model exceeds that of the optimal model by 1%; 2) On the test dataset, the accuracy of the current model is greater than that of the optimal model, but does not exceed 1%, and the loss value of the current model does not exceed that of the optimal model.
[0037] B: Establishment of a Weighted Finite Automaton; In this invention, a weighted finite automaton needs to be extracted based on the trained recurrent neural network classification model. First, the original input data is regularized, and all feature values are represented as values between 0 and 1 according to a distribution. The average difference between adjacent feature values in each dimension of the input data is calculated, and a difference value reduced by an order of magnitude is taken as a small difference value. Then, the initial state vector is initialized, and the probability abstract matrix and probability output matrix are constructed. By definition, a weighted finite automaton consists of five parts: an abstract alphabet, an abstract state set, an initial state vector, a set of probability transition matrices, and a probability output matrix. After the above steps, a complete and executable weighted finite automaton is obtained.
[0038] C: Adversarial Time Series Generation; This invention proposes a technique that uses an abstractly constructed weighted finite automaton to compare the prediction results with the original recurrent neural network to locate sensitive negative samples in the training dataset, and then generates marginal positive samples that do not exist in the dataset and applies adversarial perturbations to them to generate adversarial samples.
[0039] See Figure 2, the step B specifically comprises:
[0040] B1: first, normalize the original input data, express all feature values as 0-1 values according to the distribution, so as to provide a unified operation view for subsequent input division; also allow further manual fine-tuning of the granularity of abstract division under the condition of normalizing the original input data as described above, and finally obtain the number of preliminary abstract blocks into which the input domain should be divided;
[0041] B2: then, calculate the average difference value of adjacent feature values in each dimension of the input data, and take the difference value reduced by one order of magnitude as the micro-difference value, to ensure the effectiveness of the input abstract division;
[0042] B3: further manually fine-tune the granularity of abstract division under the condition of calculating the micro-difference value as described above, and finally obtain the number of further refined abstract blocks into which the input domain should be divided;
[0043] B4: execute step by step according to the time step on all input sequences in the training data set on the recurrent neural network, output the explicit representation of the hidden state and record it. Perform prediction result abstraction and prediction confidence abstraction on all recorded explicit representations to obtain complete abstract representation and record it;
[0044] B5: initialize the state vector of the weighted finite automaton; the state vector is an independent initial state set outside the abstract state, and the execution of all input sequences starts from this state, which physically means the weight finite automaton before receiving input, as well as the original neural network, which outputs classification results with equal confidence for each category, corresponding to the all-0 initialization of the original neural network. In this method, the hidden state of the recurrent neural network is uniformly initialized as all-0, so the all-0 method is used to construct the initial state vector;
[0045] B6: establish the probability transition matrix of the weighted finite automaton. For each abstract state in the abstract state set, record the classification prediction output corresponding to the instance state falling into the abstract state in the execution process of the recurrent neural network on the entire training data set, and express each element in the recorded vector as a probability value between 0-1 according to the distribution. Assemble the recorded probability vector into a statistical transition matrix;
[0046] B7: establish the probability output matrix of the weighted finite automaton; record the classification prediction output corresponding to the instance state falling into the abstract state in the execution process of the recurrent neural network on the entire training data set, and probabilize the recorded vector, and express each element in the recorded vector as a probability value between 0-1 according to the distribution. Assemble the recorded probability vector into a probability output matrix. At this point, the calculation of all parameters of the weighted finite automaton is complete, and the construction is completed.
[0047] Referring to Figure 3 , the step C specifically comprises:
[0048] C1: using the recurrent neural network and the weighted finite automaton to make prediction on the whole training data set respectively, when the weighted finite automaton makes correct prediction while the recurrent neural network makes wrong prediction, it indicates that compared with other samples which are similar in external representation and actually belong to the same category, the sample is processed and understood by the recurrent neural network for different potential manifold, so as to predict for wrong category, the present application refers to the sample which meets the condition that the weighted finite automaton makes correct prediction while the recurrent neural network makes wrong prediction as sensitive negative sample, comparing the prediction results of the two and the label of the training set, the sensitive negative sample in the training data set is selected;
[0049] C2: finding the positive sample which is closest to the sensitive negative sample selected in C1 in the whole training data set and actually belongs to the same category, the distance is measured by the distance between the abstract input blocks in which the respective time steps of the two samples fall;
[0050] C3: determining the sampling granularity of the current round according to the window size and the control hyperparameter, sampling in the window according to the granularity, and sending all the newly obtained samples to the recurrent neural network for prediction;
[0051] C4: locating the position of the positive-negative boundary in the prediction result, and updating the window size to the matrix difference between the sampling samples on both sides of the position. With the iteration, the sampling granularity becomes finer round by round, and the potential manifolds corresponding to the samples on both sides of the window continuously approach the classification boundary between the positive and negative manifolds, until the sampling granularity is less than the set adversarial perturbation amplitude, and the positive sample closest to the boundary is the edge positive sample;
[0052] C5: setting the amplitude of the adversarial perturbation, allowing the size of the perturbation amplitude to be adjusted under the premise of a small difference value, so as to ensure that the algorithm always implements a small perturbation;
[0053] C6: calculating the size of the perturbation window, the small window is a window with a size one order of magnitude lower than the time step length of the input sample, and the actual perturbation window size is flexibly adjusted under this constraint;
[0054] C7: introducing expert checking to confirm that the edge positive sample does not deviate from the category pointed by the correct label;
[0055] C8: for the qualified edge positive sample, sliding the perturbation window with time step and applying a perturbation with a specified direction and amplitude to generate an adversarial sample, and finally storing the generated adversarial sample in the adversarial sample set.
[0056] The application provides an abstract automaton-based time sequence adversarial sample generation method, proposes an abstract modeling mode based on an automaton to realize sample screening, can efficiently generate concealed high-quality adversarial time sequences, and has a high success rate of constructing adversarial sample attacks on recurrent neural networks.
Claims
1. An abstract automaton-based time series adversarial sample generation method, characterized in that, The method comprises the following specific steps: A: first, according to the original time series data set, set the structure information and activation function parameters of the recurrent neural network, train the recurrent neural network to complete the time series classification task; B: abstract the output sequence of the recurrent neural network, and construct a weighted finite automaton, specifically including: B1: first, normalize the original input data, express all feature values as 0-1 values according to the distribution, so as to provide a unified operation view for subsequent input division; it also allows further manual fine adjustment of the granularity of abstract division under the condition of satisfying the above normalization of the original input data, and finally obtains the number of preliminary abstract blocks that the input domain should be divided into; B2: then, calculate the average difference value of adjacent feature values in each dimension of the input data, and take the difference value reduced by one order of magnitude as the micro difference value, so as to ensure the effectiveness of the input abstract division; B3: further manually fine adjust the granularity of abstract division under the condition of satisfying the calculation of the micro difference value, and finally obtain the number of further refined abstract blocks that the input domain should be divided into; B4: execute on the recurrent neural network all input sequences in the training data set according to time steps, output the explicit representation of the hidden state and record it; perform prediction result abstraction and prediction confidence abstraction on all recorded explicit representations to obtain complete abstract representation and record it; B5: initialize the state vector of the weighted finite automaton; the state vector is an independent initial state set outside all abstract states, and the execution of all input sequences starts from this state, which physically means that the weighted finite automaton before receiving input will output classification results with equal confidence of each category, corresponding to the all 0 initialization of the original neural network; the hidden state of the recurrent neural network is uniformly initialized in the form of all 0, so the all 0 way is adopted to construct the initial state vector; B6: establish the statistical transition matrix of the weighted finite automaton; for each abstract state in the abstract state set, record the classification prediction output corresponding to the instance state falling into the abstract state in the execution process of the recurrent neural network on the entire training data set, and express each element in the recorded vector as a probability value between 0 and 1 according to the distribution, and assemble the recorded probability vector into a statistical transition matrix; B7: establish the probability output matrix of the weighted finite automaton; record the classification prediction output corresponding to the instance state falling into the abstract state in the execution process of the recurrent neural network on the entire training data set, and probabilize the recorded vector, and express each element in the recorded vector as a probability value between 0 and 1 according to the distribution, and assemble the recorded probability vector into a probability output matrix; thus the construction of the weighted finite automaton is completed; C: find the edge positive samples and generate the adversarial samples by using the constructed weighted finite automaton and the prediction results of the original recurrent neural network, specifically including: C1: using the recurrent neural network and the weight finite automaton obtained from step B to make predictions on the entire training data set respectively, when the weight finite automaton makes correct predictions while the recurrent neural network makes wrong predictions, it indicates that compared with other samples that are similar in external representation and actually belong to the same class, the sample is processed and understood by the recurrent neural network for a different potential manifold, so as to predict a wrong class, the samples meeting this condition are called sensitive negative samples; comparing the prediction results of the two and the labels of the training set, the sensitive negative samples in the training data set are selected; C2: finding the positive samples in the entire training data set that are closest to the sensitive negative samples selected in C1 and belong to the same actual class, the distance is measured by the distance between the abstract input blocks in which the sensitive negative samples and the found positive samples fall at each time step; C3: determining the sampling granularity of the current round according to the window size and the control hyperparameter, sampling in the window according to the sampling granularity, and feeding all the newly obtained samples into the recurrent neural network model for prediction; C4: locating the position of the positive-negative boundary in the prediction result, updating the window size to the matrix difference between the sampling samples on both sides of the position; as the iteration proceeds, the sampling granularity becomes finer round by round, and the potential manifolds corresponding to the samples on both sides of the window continuously approach the classification boundary between the positive and negative manifolds, until the sampling granularity is less than the set adversarial perturbation amplitude, and the positive sample closest to the boundary is the edge positive sample; C5: setting the amplitude of the adversarial perturbation, allowing the size of the perturbation amplitude to be adjusted under the premise of a small difference value, so as to ensure that a small perturbation is always implemented; C6: calculating the size of the perturbation window, the small window is a window with a size one order of magnitude lower than the time step length of the input sample, and the actual perturbation window size is flexibly adjusted under this constraint; C7: introducing expert checking to confirm that the edge positive sample does not deviate from the class indicated by the correct label; C8: for qualified edge positive samples, let the perturbation window slide according to the time step and apply a perturbation of a specified direction and amplitude to generate adversarial samples, and finally store all the generated adversarial samples in the adversarial sample set.
2. The abstract automaton-based time series adversarial sample generation method according to claim 1, characterized in that, The step A specifically comprises: A1: dividing the original time series data set into a training set and a test set according to a ratio of 8:2; A2: setting the hidden layer and neuron number parameters, and selecting the Adam optimizer and the cross-entropy loss function to train the recurrent neural network that completes the time series classification task; A3: using the test accuracy and the loss value Loss as two standards to automatically select and update the optimal model in the recurrent neural network that completes the time series classification task trained in A2; the selected optimal model is updated when the following two conditions occur: 1) the accuracy of the current model exceeds that of the optimal model by 1% on the test data set; 2) the accuracy of the current model is greater than that of the optimal model but does not exceed 1% on the test data set, and the loss value of the current model does not exceed that of the optimal model.