Attack method and device of semantic communication system, electronic equipment and medium
By creating a virtual model and training a noise jammer in a semantic communication system, the problem of black-box attacks under unknown system model structures is solved, thereby improving the system's security and robustness.
Patent Information
- Application Number
- CN202210982279.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-08-16
- Publication Date
- 2026-01-13
- Estimated Expiration
- 2042-08-16
Smart Images
Figure CN115567941B_ABST
Abstract
Description
Technical Field
[0001] This application relates to data processing technology, and in particular to an attack method, apparatus, electronic device and medium for a semantic communication system. Background Technology
[0002] In related technologies, semantic communication systems are increasingly being used with the development of various services. Among them, the currently implemented deep learning-based End-to-End Communication System (DLSC) relies on deep neural networks to extract and encode semantic information, and then uses wireless channels to achieve signal transmission.
[0003] Furthermore, semantic communication systems are highly vulnerable to adversarial attacks. These attacks are primarily categorized into white-box and black-box attacks. In white-box attacks, the attacker knows all the internal information and parameters of the model and generates adversarial examples based on the gradients of the given model to attack the network. In black-box attacks, the attacker does not know the model's parameters and structural information; they only know the model's inputs and outputs to generate adversarial examples and then attack the network.
[0004] However, most attacks targeting communication systems in related technologies are carried out when the structure and parameters of the attacked system model are known. There is a lack of methods for attacking systems with unknown internal structures. Summary of the Invention
[0005] This application provides an attack method, apparatus, electronic device, and medium for a semantic communication system. It addresses the problem in related technologies of lacking attack methods for unknown system models and their internal structures.
[0006] According to one aspect of the embodiments of this application, an attack method for a semantic communication system is provided, wherein:
[0007] Create a virtual semantic communication system and obtain an initial proxy model for characterizing the encoder in the virtual semantic communication system, wherein an initial noise jammer is deployed on the transmission channel of the virtual semantic communication system;
[0008] The initial proxy model is trained so that the trained target proxy model can recognize the semantic encoded information transmitted in the virtual semantic communication system.
[0009] Using the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target proxy model, the noise jammer is optimized iteratively until the optimized target noise jammer is obtained.
[0010] The target noise jammer is deployed into the target semantic communication system so that the target noise jammer can perform noise attacks on the target semantic communication system.
[0011] Optionally, in another embodiment based on the method described above in this application, obtaining an initial proxy model for characterizing the encoder in the virtual semantic communication system includes:
[0012] Construct the initial proxy model consisting of a fully convolutional neural network, wherein the output vector dimension of the initial proxy model is the same as the vector dimension of the decoder output of the virtual semantic communication system.
[0013] Optionally, in another embodiment based on the method described above in this application, training the initial agent model includes:
[0014] Obtain a sample dataset, wherein the sample dataset contains multiple sample images and corresponding image classification labels;
[0015] The sample dataset is augmented, and the augmented sample dataset is used to train the initial proxy model.
[0016] Optionally, in another embodiment based on the method described above in this application, after training the initial proxy model using the enhanced sample dataset, the method further includes:
[0017] Using a zero-order optimization algorithm, the gradient parameters of the decoding end of the virtual semantic communication system and the proxy model are determined, and the gradient parameters are fed back to the initial proxy model until the target proxy model is obtained after training.
[0018] During the training of the initial agent model, the parameters of the decoding end and the classifier of the virtual semantic communication system are fixed.
[0019] Optionally, in another embodiment based on the method described above in this application, the step of optimizing and iterating the noise jammer using the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target proxy model includes:
[0020] The original image is input into the target proxy model to obtain the high-dimensional encoding information corresponding to the original image; and the classification label corresponding to the original image is obtained by the classifier of the virtual semantic communication system.
[0021] The noise jammer is optimized iteratively using the particle swarm optimization algorithm with preset distortion and preset accuracy as constraints on the classification label.
[0022] Optionally, in another embodiment based on the method described above in this application, the preset distortion is a value greater than 80%, and the preset accuracy is a value less than 20%.
[0023] According to another aspect of the embodiments of this application, an attack apparatus for a semantic communication system is provided, wherein:
[0024] A creation module is configured to create a virtual semantic communication system and obtain an initial proxy model for characterizing the encoder in the virtual semantic communication system, wherein an initial noise jammer is deployed on the transmission channel of the virtual semantic communication system.
[0025] The training module is configured to train the initial agent model so that the trained target agent model can recognize the semantic encoded information transmitted in the virtual semantic communication system.
[0026] The optimization module is configured to use the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target proxy model to optimize and iterate the noise jammer until an optimized target noise jammer is obtained.
[0027] The deployment module is configured to deploy the target noise jammer into the target semantic communication system so that the target noise jammer can perform a noise attack on the target semantic communication system.
[0028] According to another aspect of the embodiments of this application, an electronic device is provided, comprising:
[0029] Memory, used to store executable instructions; and
[0030] A display is used in conjunction with the memory to execute the executable instructions to perform the attack method of any of the semantic communication systems described above.
[0031] According to another aspect of the embodiments of this application, a computer-readable storage medium is provided for storing computer-readable instructions, which, when executed, perform the operation of any of the attack methods of the semantic communication system described above.
[0032] This application allows for the creation of a virtual semantic communication system (VMS) and the acquisition of an initial proxy model to characterize the encoder within the VMS. An initial noise jammer is deployed on the transmission channel of the VMS. The initial proxy model is trained to enable the trained target proxy model to recognize the semantic encoded information transmitted within the VMS. Using the original image input to the VMS and the semantic encoded information obtained from recognizing the original image using the target proxy model, the noise jammer is iteratively optimized until an optimized target noise jammer is obtained. The target noise jammer is then deployed into the target VMS to launch a noise attack. By applying the technical solution of this application, a proxy model of the VMS encoder can be trained first. Then, using a particle swarm optimization algorithm, this proxy model is used to train a noise generator with the acquired encoded information and output labels. This noise generator is then deployed into the target VMS, adding noise perturbation during the transmission of encoded information into the VMS channel, thereby reducing the accuracy of the classifier in the VMS model. This avoids the problem in related technologies where there is a lack of attack methods for unknown system models.
[0033] The technical solution of this application will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0034] The accompanying drawings, which form part of this specification, illustrate embodiments of this application and, together with the description, serve to explain the principles of this application.
[0035] This application can be more clearly understood with reference to the accompanying drawings and the following detailed description, wherein:
[0036] Figure 1 A schematic diagram of an attack method for a semantic communication system provided in an embodiment of this application is shown;
[0037] Figure 2 This invention provides a schematic diagram of the system architecture for an attack method of a semantic communication system according to an embodiment of this application.
[0038] Figure 3 A flowchart illustrating an attack method for a semantic communication system according to an embodiment of this application is shown.
[0039] Figure 4 This invention provides a schematic diagram of the structure of an electronic device according to an embodiment of the present application.
[0040] Figure 5 This illustration shows a schematic diagram of the structure of an electronic device according to an embodiment of this application;
[0041] Figure 6 A schematic diagram of a storage medium provided in one embodiment of this application is shown. Detailed Implementation
[0042] Various exemplary embodiments of the present application will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values of the components and steps set forth in these embodiments do not limit the scope of the present application.
[0043] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.
[0044] The following description of at least one exemplary embodiment is merely illustrative and is not intended to limit the scope of this application or its application or use.
[0045] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.
[0046] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.
[0047] Furthermore, the technical solutions of the various embodiments of this application can be combined with each other, but only if they are based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by this application.
[0048] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of this application are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indication will also change accordingly.
[0049] The following is combined Figures 1-3 This application describes an attack method for a semantic communication system according to exemplary embodiments thereof. It should be noted that the following application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way. Rather, the embodiments of this application can be applied to any applicable scenario.
[0050] This application also proposes an attack method, apparatus, electronic device, and medium for a semantic communication system.
[0051] Figure 1 A schematic flowchart illustrating an attack method for a semantic communication system according to an embodiment of this application is shown. Figure 1 As shown, the method includes:
[0052] S101, Create a virtual semantic communication system and obtain an initial proxy model for characterizing the encoder in the virtual semantic communication system, wherein an initial noise jammer is deployed on the transmission channel of the virtual semantic communication system.
[0053] S102, Train the initial agent model so that the trained target agent model can recognize the semantic encoded information transmitted in the virtual semantic communication system.
[0054] S103, using the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target agent model, optimizes and iterates the noise jammer until the optimized target noise jammer is obtained.
[0055] S104, Deploy the target noise jammer into the target semantic communication system so that the target noise jammer can carry out noise attacks on the target semantic communication system.
[0056] In related technologies, based on Shannon and Weaver, communication can be divided into three levels: symbol transmission; semantic exchange of transmitted symbols; and the impact of semantic information exchange. When researching communication systems based on Shannon's information theory, researchers primarily focused on syntactic issues, aiming only at the reliable and efficient transmission of bit data. Today, the problems concerning communication reliability and efficiency have been largely resolved. With the increasingly close integration of artificial intelligence and communication technologies, previously temporarily shelved semantic-level issues have re-emerged. Unlike traditional communication, semantic communication aims to transmit information relevant to the transmission target.
[0057] Among them, the semantic communication system constructed using deep neural networks can effectively learn and utilize the semantic information in the transmitted content, enabling its communication performance to far exceed that of traditional communication systems under the same channel environment, thus meeting the requirements of semantic communication. In this system, the encoding model at the transmitting end and the decoding model at the receiving end are replaced by neural networks. Through deep learning, under the influence of simulated real-world channels, the neural networks in the transceiver modules are jointly trained to learn the optimal information encoding and decoding methods.
[0058] In one approach, although DLSC (Deep Learning Communication System) shows great promise, its openness and the sensitivity of neural networks make semantic communication systems vulnerable to adversarial attacks. Adversarial attacks are mainly divided into white-box attacks and black-box attacks. In the former, the attacker knows all the internal information and parameters of the model and generates adversarial examples based on the gradients of the given model to attack the network. In the latter, the attacker does not know the model's parameters and structural information, but only uses the model's inputs and outputs to generate adversarial examples and then attacks the network.
[0059] Currently, many attacks against communication systems involve obtaining the structure and parameters of the system model and then constructing an attack at the physical channel level. This is achieved by training a neural network that can generate adversarial attack perturbation signals. These signals are small and, when superimposed on the original signal, the semantic information is destroyed, and the decoding neural network cannot correctly reconstruct the transmitted content from the superimposed signal.
[0060] However, since business personnel cannot obtain the semantic communication system model in most cases, this application proposes a black-box attack method against DLSC, which is a more common and potentially more harmful attack method.
[0061] In one approach, such as Figure 2 The diagram shown is a system architecture diagram of an attack method proposed in this application for a semantic communication system. Figure 2 As can be seen, this application presents a black-box attack method targeting semantic communication systems. In one embodiment, this application first trains a proxy model of a virtual semantic communication encoder based on a query-based construction method. Then, using a particle swarm optimization algorithm, it trains a noise generator with the acquired encoding information and output labels. This adds noise perturbation during the subsequent transmission of encoded information into the channel, thereby reducing the accuracy of the semantic communication model's classifier. Understandably, this method can be used for evaluating model security in production environments, fusing adversarial examples to train the original model, enriching the training sample space, and helping to improve the robustness and security of semantic communication systems based on deep neural networks.
[0062] Furthermore, such as Figure 3 The diagram shown is a flowchart illustrating the attack method for the semantic communication system proposed in this application, which includes:
[0063] Step 1: Create a virtual semantic communication system.
[0064] Furthermore, this application first requires the construction of an end-to-end virtual semantic communication system model. In one approach, embodiments of this application may use Joint Source Channel Coding (JSCC) for wireless image transmission over multipath fading channels.
[0065] Additionally, autoencoders can be combined with orthogonal frequency division multiplexing (OFDM) to address multipath fading. It should be noted that the encoder and decoder proposed in the virtual semantic communication system model need to be constructed using convolutional neural networks (CNNs) and can directly map source images to complex-valued baseband samples for OFDM transmission. As an example, the decoder can be a JSCC decoder, which can be further combined with explicit channel estimation, equalization, and additional subnets to improve performance.
[0066] Step 2: Obtain the initial proxy model used to characterize the encoder in the virtual semantic communication system, wherein an initial noise jammer is deployed on the transmission channel of the virtual semantic communication system.
[0067] In one approach, the initial proxy model in this application is an automatically constructed model for representing the encoder in the virtual semantic communication system.
[0068] Understandably, related technologies suffer from the problem of lacking access to the internal structure of unknown system models for attack. In other words, attackers can only understand the model's inputs and outputs, not its internal structure. Therefore, to address this issue, this application utilizes a pre-defined method to construct an initial proxy model representing the encoder in a virtual semantic communication system.
[0069] In one approach, during the construction of the proxy model, this embodiment of the application can construct a simple fully convolutional structure, which is well-suited for semantic information extraction and compression. Furthermore, the output of the proxy model is set to have the same dimension as the high-dimensional vector of the encoded information generated by the decoder of the target semantic communication system model, thereby ensuring that after connection to the decoder side, it ultimately has a similar decision boundary to the target semantic communication system model.
[0070] In one approach, embodiments of this application train a proxy model for the encoder, enabling attackers to simulate transmitted information and ensuring the secrecy of data acquisition. The trained proxy model can be used to obtain compressed semantic information transmitted through the channel. This information, along with the original transmitted image information and the output, can be used to optimize the noise generator, thereby improving the query efficiency of subsequent optimizations.
[0071] Step 3: Train the initial proxy model so that the trained target proxy model can recognize the semantic encoded information transmitted in the virtual semantic communication system.
[0072] In this embodiment of the application, during the training of the initial proxy model, a sample dataset is first obtained, which contains multiple sample images and their corresponding image classification labels. Data augmentation is then performed on the sample dataset, and the augmented sample dataset is used to train the initial proxy model.
[0073] In one approach, embodiments of this application can divide the dataset into two parts. For example, a subset of image data can be used to train a proxy model. Subsequently, the other subset of image data can be used to augment the data using data augmentation techniques, such as minor changes like flips, translations, and rotations.
[0074] As an example, D could be used. s+1 =D s +{x+μsgn(J D [DE(x)]):x∈D s To achieve:
[0075] Among them, the D s It is a subset of the sample dataset, D s+1 This is the expanded dataset, where x is D. s One image in the code; DE(x) is the image label output by the decoder; J D [DE(x)] is the Jacobian matrix corresponding to this label. And sgn(J D [DE(x)]) represents the sign of the Jacobian matrix only. As can be seen from the formula, the new D... s+1 From the original D s and the enhanced {x+μsgn(J D [DE(x)]):x∈D s The dataset was merged, doubling its size.
[0076] Furthermore, this embodiment of the application also requires the use of the zeroth-order optimization algorithm (ZOO) to determine the gradient parameters of the decoding end of the virtual semantic communication system and the proxy model, and to feed the gradient parameters back to the initial proxy model until the trained target proxy model is obtained. During the training of the initial proxy model, it is necessary to keep the parameters of the decoding end of the virtual semantic communication system and the classifier fixed.
[0077] Specifically, this application employs a zero-order optimization algorithm, without utilizing first-order derivative information, to estimate the parameter update direction based on a certain number of samplings and the concept of difference. This allows for the estimation of the gradient from the decoding end to the current point, followed by gradient backpropagation.
[0078] In other words, the embodiments of this application demonstrate that the decoder side is the same by training only the proxy model and fixing the parameters of the subsequent decoder and classifier, which are then transferred from the original model training.
[0079] Step 4: Using the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target agent model, optimize and iterate the noise jammer until the optimized target noise jammer is obtained.
[0080] Step 5: Deploy the target noise jammer into the target semantic communication system so that the target noise jammer can launch a noise attack on the target semantic communication system.
[0081] In one embodiment of this application, the original image needs to be input into the target proxy model to obtain the high-dimensional encoded information corresponding to the original image; and the classification label corresponding to the original image output by the classifier of the virtual semantic communication system needs to be obtained. Furthermore, a particle swarm optimization algorithm is also needed to optimize and iterate the noise jammer under the constraints of preset distortion and preset accuracy as the classification label.
[0082] Specifically, in this embodiment, the trained proxy model can obtain high-dimensional encoded information, enabling the output information from the semantic decoder to obtain output labels through a classifier. Using a particle swarm optimization algorithm with constraints of SSIM greater than 80% and ACC less than 20%, through continuous iteration, a noise generator with good attack performance is finally trained. This allows for subsequent attacks by adding noise to the channel of real-time transmitted images, reducing the accuracy of the classifier after the decoder, thus achieving the purpose of a black-box attack.
[0083] This application allows for the creation of a virtual semantic communication system (VMS) and the acquisition of an initial proxy model to characterize the encoder within the VMS. An initial noise jammer is deployed on the transmission channel of the VMS. The initial proxy model is trained to enable the trained target proxy model to recognize the semantic encoded information transmitted within the VMS. Using the original image input to the VMS and the semantic encoded information obtained from recognizing the original image using the target proxy model, the noise jammer is iteratively optimized until an optimized target noise jammer is obtained. The target noise jammer is then deployed into the target VMS to launch a noise attack. By applying the technical solution of this application, a proxy model of the VMS encoder can be trained first. Then, using a particle swarm optimization algorithm, this proxy model is used to train a noise generator with the acquired encoded information and output labels. This noise generator is then deployed into the target VMS, adding noise perturbation during the transmission of encoded information into the VMS channel, thereby reducing the accuracy of the classifier in the VMS model. This avoids the problem in related technologies where there is a lack of attack methods for unknown system models.
[0084] Optionally, in another embodiment based on the method described above in this application, obtaining an initial proxy model for characterizing the encoder in the virtual semantic communication system includes:
[0085] Construct the initial proxy model consisting of a fully convolutional neural network, wherein the output vector dimension of the initial proxy model is the same as the vector dimension of the decoder output of the virtual semantic communication system.
[0086] Optionally, in another embodiment based on the method described above in this application, training the initial agent model includes:
[0087] Obtain a sample dataset, wherein the sample dataset contains multiple sample images and corresponding image classification labels;
[0088] The sample dataset is augmented, and the augmented sample dataset is used to train the initial proxy model.
[0089] Optionally, in another embodiment based on the method described above in this application, after training the initial proxy model using the enhanced sample dataset, the method further includes:
[0090] Using a zero-order optimization algorithm, the gradient parameters of the decoding end of the virtual semantic communication system and the proxy model are determined, and the gradient parameters are fed back to the initial proxy model until the target proxy model is obtained after training.
[0091] During the training of the initial agent model, the parameters of the decoding end and the classifier of the virtual semantic communication system are fixed.
[0092] Optionally, in another embodiment based on the method described above in this application, the step of optimizing and iterating the noise jammer using the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target proxy model includes:
[0093] The original image is input into the target proxy model to obtain the high-dimensional encoding information corresponding to the original image; and the classification label corresponding to the original image is obtained by the classifier of the virtual semantic communication system.
[0094] The noise jammer is optimized iteratively using the particle swarm optimization algorithm with preset distortion and preset accuracy as constraints on the classification label.
[0095] Optionally, in another embodiment based on the method described above in this application, the preset distortion is a value greater than 80%, and the preset accuracy is a value less than 20%.
[0096] Understandably, compared with existing attack methods on semantic communication models, the attack method of this application embodiment can train a proxy model of the encoder using only the input and output results of the voice communication system model. Then, based on the trained noise generator, interference is added to the high-dimensional encoded information during channel transmission, and the transferability is used to achieve the attack on the target semantic communication model.
[0097] Optionally, in another embodiment of this application, such as Figure 4 As shown, this application also provides an attack apparatus for a semantic communication system. It includes:
[0098] The creation module 201 is configured to create a virtual semantic communication system and obtain an initial proxy model for characterizing the encoder in the virtual semantic communication system, wherein an initial noise jammer is deployed on the transmission channel of the virtual semantic communication system.
[0099] Training module 202 is configured to train the initial agent model so that the trained target agent model can recognize the semantic encoded information transmitted in the virtual semantic communication system.
[0100] The optimization module 203 is configured to use the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target proxy model to optimize and iterate the noise jammer until an optimized target noise jammer is obtained.
[0101] Deployment module 204 is configured to deploy the target noise jammer into the target semantic communication system so that the target noise jammer can perform noise attacks on the target semantic communication system.
[0102] By applying the technical solution of this application, a proxy model of the encoder of a virtual semantic communication system can be trained first. Then, using a particle swarm optimization algorithm, a noise generator is trained using the acquired encoded information and output labels from this proxy model. This noise generator is then deployed to the semantic communication system to be attacked, thereby adding noise perturbation during the transmission of encoded information into the semantic communication system channel, thus reducing the accuracy of the classifier in the semantic communication model. This avoids the problem in related technologies of lacking methods to attack the system when its internal structure is unknown.
[0103] In another embodiment of this application, the steps of creating module 201, which is configured to be executed, include:
[0104] Construct the initial proxy model consisting of a fully convolutional neural network, wherein the output vector dimension of the initial proxy model is the same as the vector dimension of the decoder output of the virtual semantic communication system.
[0105] In another embodiment of this application, the steps of creating module 201, which is configured to be executed, include:
[0106] Obtain a sample dataset, wherein the sample dataset contains multiple sample images and corresponding image classification labels;
[0107] The sample dataset is augmented, and the augmented sample dataset is used to train the initial proxy model.
[0108] In another embodiment of this application, the steps of creating module 201, which is configured to be executed, include:
[0109] Using a zero-order optimization algorithm, the gradient parameters of the decoding end of the virtual semantic communication system and the proxy model are determined, and the gradient parameters are fed back to the initial proxy model until the target proxy model is obtained after training.
[0110] During the training of the initial agent model, the parameters of the decoding end and the classifier of the virtual semantic communication system are fixed.
[0111] In another embodiment of this application, the steps of creating module 201, which is configured to be executed, include:
[0112] The original image is input into the target proxy model to obtain the high-dimensional encoding information corresponding to the original image; and the classification label corresponding to the original image is obtained by the classifier of the virtual semantic communication system.
[0113] The noise jammer is optimized iteratively using the particle swarm optimization algorithm with preset distortion and preset accuracy as constraints on the classification label.
[0114] In another embodiment of this application, the steps of creating module 201, which is configured to be executed, include:
[0115] The preset distortion is a value greater than 80%, and the preset accuracy is a value less than 20%.
[0116] This application also provides an electronic device for executing the attack method of the above-described semantic communication system. Please refer to... Figure 5 This illustrates a schematic diagram of an electronic device provided by some embodiments of this application. For example... Figure 5 As shown, the electronic device 3 includes: a processor 300, a memory 301, a bus 302, and a communication interface 303. The processor 300, the communication interface 303, and the memory 301 are connected via the bus 302. The memory 301 stores a computer program that can run on the processor 300. When the processor 300 runs the computer program, it executes the attack method of the semantic communication system provided in any of the foregoing embodiments of this application.
[0117] The memory 301 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this device network element and at least one other network element is achieved through at least one communication interface 303 (which can be wired or wireless), such as the Internet, wide area network, local area network, or metropolitan area network.
[0118] Bus 302 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 301 is used to store programs. After receiving an execution instruction, the processor 300 executes the program. The data recognition method disclosed in any of the foregoing embodiments of this application can be applied to the processor 300, or implemented by the processor 300.
[0119] The processor 300 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 300 or by instructions in software form. The processor 300 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 301. The processor 300 reads the information in memory 301 and, in conjunction with its hardware, completes the steps of the above method.
[0120] The electronic device provided in this application embodiment and the attack method of the semantic communication system provided in this application embodiment are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.
[0121] This application also provides a computer-readable storage medium corresponding to the attack method of the semantic communication system provided in the foregoing embodiments. Please refer to... Figure 6 The computer-readable storage medium shown is an optical disc 40, on which a computer program (i.e., a program product) is stored. When the computer program is run by a processor, it executes the attack method of the semantic communication system provided in any of the foregoing embodiments.
[0122] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.
[0123] The computer-readable storage medium provided in the above embodiments of this application and the data identification method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.
[0124] It should be noted that:
[0125] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known structures and techniques have not been shown in detail so as not to obscure the understanding of this specification.
[0126] Similarly, it should be understood that, for the sake of brevity and to aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of this application, various features of this application are sometimes grouped together in a single embodiment, figure, or description thereof. However, this disclosure should not be construed as reflecting a schematic diagram in which the claimed application requires more features than expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of this application.
[0127] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.
[0128] The above description is merely a preferred embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. An attack method for a semantic communication system, characterized in that, include: Create a virtual semantic communication system and obtain an initial proxy model for characterizing the encoder in the virtual semantic communication system, wherein an initial noise jammer is deployed on the transmission channel of the virtual semantic communication system; The initial proxy model is trained so that the trained target proxy model can recognize the semantic encoded information transmitted in the virtual semantic communication system. Using the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target proxy model, the noise jammer is optimized iteratively until the optimized target noise jammer is obtained. The target noise jammer is deployed into the target semantic communication system so that the target noise jammer can perform noise attacks on the target semantic communication system. The step of obtaining the initial proxy model used to characterize the encoder in the virtual semantic communication system includes: Construct the initial proxy model composed of a fully convolutional neural network, wherein the output vector dimension of the initial proxy model is the same as the vector dimension output by the decoding end of the virtual semantic communication system; The training of the initial agent model includes: Obtain a sample dataset, wherein the sample dataset contains multiple sample images and corresponding image classification labels; The sample dataset is augmented, and the augmented sample dataset is used to train the initial proxy model. After training the initial proxy model using the enhanced sample dataset, the method further includes: Using a zero-order optimization algorithm, the gradient parameters of the decoding end of the virtual semantic communication system and the proxy model are determined, and the gradient parameters are fed back to the initial proxy model until the target proxy model is obtained after training. During the training of the initial agent model, the parameters of the decoding end and the classifier of the virtual semantic communication system are fixed. The optimization and iteration of the noise jammer using the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target proxy model includes: The original image is input into the target proxy model to obtain the high-dimensional encoded information corresponding to the original image; and the classification label corresponding to the original image is obtained by the classifier of the virtual semantic communication system. The noise jammer is optimized iteratively using the particle swarm optimization algorithm with preset distortion and preset accuracy as constraints on the classification label.
2. The method as described in claim 1, characterized in that, The preset distortion is a value greater than 80%, and the preset accuracy is a value less than 20%.
3. An attack apparatus for a semantic communication system, used to implement the method of claim 1, characterized in that, in: A creation module is configured to create a virtual semantic communication system and obtain an initial proxy model for characterizing the encoder in the virtual semantic communication system, wherein an initial noise jammer is deployed on the transmission channel of the virtual semantic communication system. The training module is configured to train the initial agent model so that the trained target agent model can recognize the semantic encoded information transmitted in the virtual semantic communication system. The optimization module is configured to use the original image input to the virtual semantic communication system and the semantic encoding information obtained by recognizing the original image using the target proxy model to optimize and iterate the noise jammer until an optimized target noise jammer is obtained. The deployment module is configured to deploy the target noise jammer into the target semantic communication system so that the target noise jammer can perform a noise attack on the target semantic communication system.
4. An electronic device, characterized in that, include: Memory, used to store executable instructions; as well as, A processor, configured to execute the executable instructions with the memory to perform the operation of the attack method of any of the semantic communication systems of claims 1-2.
5. A computer-readable storage medium for storing computer-readable instructions, characterized in that, When the instruction is executed, it performs the operation of the attack method of any of the semantic communication systems described in claims 1-2.