A method for generating adversarial perturbations for EEG signal classification systems

Abstract

This invention discloses an adversarial perturbation generation method for EEG signal classification systems, comprising the following steps: S1, obtaining initial adversarial samples using the PGD method; S2, smoothing the obtained perturbation by convolution with a Gaussian kernel and updating the perturbation; S3, adding the perturbation amount to the original input to obtain adversarial samples; S4, calculating the gradient of the model with respect to the adversarial samples, determining its gradient direction using a sign function, multiplying by the single-step perturbation size, and updating the perturbation; S5, when the perturbation size exceeds the perturbation constraint, projecting the perturbation back to the norm constraint; S6, repeating steps S2 to S5 several times. This invention implements an adversarial perturbation generation method for EEG signal classification systems. While maintaining the attack accuracy of traditional attack methods, this method can generate more misleading adversarial features that are indistinguishable from normal features, exhibiting better performance on EEG data.

Description

Technical Field

[0001] This invention belongs to the field of medical image adversarial sample generation technology, and specifically relates to an adversarial perturbation generation method for electroencephalogram (EEG) signal classification systems. Background Technology

[0002] Brain-computer interfaces (BCIs) enable the brain to control external devices through thought, and one of the core technologies of BCI systems is achieving high-precision classification and recognition of electroencephalogram (EEG) signals. Currently, quantitative EEG analysis based on deep learning models has become the mainstream method in the field of EEG analysis, but research on the robustness of EEG analysis systems is still in its early stages. This study introduces classic adversarial attack algorithms for natural images into an EEG classification model. By comparing the attack performance of several traditional attack methods on a benchmark dataset with different perturbation constraints, it can be found that compared to adversarial attacks on natural images, EEG images require only a small perturbation to deceive the classification model.

[0003] Meanwhile, a significant difference from natural images is that adversarial perturbations often cause more significant distortions in the deep feature space of medical images. Tiny perturbations in medical images produce fundamentally different deep features that are easily separated from normal features. Therefore, from a pathological perspective, it's difficult to say whether medical image attack instances generated by attack methods derived from natural images are truly "adversarial." Regarding EEG signals, traditional adversarial attack algorithms reduce the prediction accuracy of machine learning models by adding a tiny, imperceptible perturbation. However, when adversarial examples generated using traditional methods perturb EEG classification models, they produce square wave artifacts, which are physiologically unreliable.

[0004] To address this, this invention proposes an adversarial algorithm for EEG classification models in brain-computer interface systems. Targeting the characteristics of bioelectrical signals, a smooth adversarial attack method is employed. This method maintains the attack accuracy of traditional attack methods while generating more misleading adversarial features that are indistinguishable from normal features, resulting in better performance on EEG data. Summary of the Invention

[0005] This invention provides an adversarial perturbation generation method for electroencephalogram (EEG) signal classification systems to solve the problems in the prior art.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] An adversarial perturbation generation method for EEG signal classification systems includes the following steps:

[0008] S1. Use the PGD method to obtain initial adversarial examples;

[0009] S2. Smooth the obtained perturbation by convolution with a Gaussian kernel and update the perturbation;

[0010] S3, update the perturbation θ i Adding ' to the original input x yields the adversarial sample x. adv (θ i ′);

[0011] S4. Find the gradient of the model with respect to the adversarial example, use the sign function to find its gradient direction, multiply by the iteration step size α, and update the perturbation.

[0012] S5. When the disturbance magnitude exceeds the disturbance constraint ε, project the disturbance back to L. ∞ Norm constraints;

[0013] S6. Repeat steps S2 to S5 several times.

[0014] Furthermore, step S1 includes the following steps:

[0015] For non-target attacks, perform multiple FGSM attacks, each time with a step size α (α<ε), as shown in formula (1):

[0016]

[0017] Where: x j '' represents the adversarial example obtained in the j-th iteration, x∈R C*T These are the original EEG samples, where R is a real number, C is the number of channels in the EEG signal, T is the duration of the EEG signal, x0′ = x, ε represents the magnitude of the perturbation constraint, and Clip... x,ε (·) indicates that the samples are truncated to the range [x-ε, x+ε], α represents the step size of each iteration, L(·) is the loss function, f(·) is the network model, and x j-1 Let ' represent the adversarial sample obtained in the (j-1)th iteration, and y be the label of that sample. This is the gradient of the model with respect to adversarial examples;

[0018] For the target attack, the update is performed using formula (2). In each iteration, the input is updated along the direction of gradient descent of the target class. After multiple iterations, the final adversarial sample is obtained.

[0019]

[0020] Where: t represents the target class;

[0021] The initial counter-perturbation θ = x is obtained j ′-x.

[0022] Furthermore, step S2 includes the following steps:

[0023] To reduce square wave artifacts in adversarial example generation, a smoothing adversarial perturbation method is used. This method employs Gaussian convolution to weighted average the signal and its neighboring positions, resulting in smoother adversarial examples.

[0024]

[0025] Where: a is the target vector, v is the weight or kernel function, v uses the Gaussian kernel function, n is the length of the target vector, for ease of description, the size of the convolution kernel is set to 2K+1, the element index in the convolution kernel is m, and m takes the values ​​1, 2, 3, ..., 2K+1 in sequence;

[0026] In mathematics, given a Gaussian kernel of size 2K+1 and standard deviation σ, the following kernel function is obtained:

[0027]

[0028] Where: θ i ' represents the adversarial perturbation obtained when repeating the i-th iteration, which is then convolved with g Gaussian kernels and updated:

[0029]

[0030] Where: K(s[k],σ[k]) is a Gaussian kernel of size s[k] and standard deviation σ[k], initialized against the adversarial disturbance θ′0=θ, and the iteration variable for the summation operation is k. This means that k takes the values ​​1, 2, 3, ..., g in sequence and then sums them up.

[0031] Step S3 includes the following steps:

[0032] Adding this perturbation to the clean sample yields the adversarial sample x. adv (θ i ′).

[0033] x adv (θ′ i )=x+θ′ i (6)

[0034] Where: x∈R C*T These are the original EEG samples, where C is the number of channels in the EEG signal, T is the duration of the EEG signal, and x... adv (θ′ i ) indicates that the disturbance θ′ will be countered. i Adversarial examples obtained after smoothing.

[0035] Furthermore, step S4 includes the following steps:

[0036] Find the gradient of the model with respect to the adversarial example, use the sign function to find its gradient direction, multiply it by the iteration step size α, and update the perturbation;

[0037] For non-target attacks, the perturbation is updated using the Fast Gradient Sign Method (FGSM) as shown in formula (7):

[0038]

[0039] Where: θ i ' represents the adversarial perturbation obtained when repeating it for the i-th time, and correspondingly, θ i+1 ′ represents the adversarial perturbation obtained when repeating the (i+1)th time, x adv (θ i ′) indicates that a perturbation θ has been added. i The adversarial examples obtained after ' are given, where α represents the step size of each iteration. This is the gradient of the model in response to adversarial perturbations;

[0040] For a target attack, where t is the target class, the perturbation is updated using formula (8) along the direction of gradient descent of the target class:

[0041]

[0042] Furthermore, step S5 includes the following steps:

[0043] When the magnitude of the disturbance exceeds the disturbance constraint ε, the disturbance is projected back to L. ∞ Norm constraints;

[0044] θ i+1 ′=Clip 0,ε (θ i+1 ′) (9)

[0045] Among them: Clip 0,ε (·) indicates that the perturbation is truncated to [-ε, ε].

[0046] Furthermore, step S6 includes the following steps:

[0047] Repeat steps S2-S5 several times. After the iteration is complete, add the final perturbation to the clean sample x to obtain the final smoothed adversarial sample x. adv (θ i+1 ′).

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] This invention realizes an adversarial perturbation generation method for EEG signal classification systems. While maintaining the attack accuracy of traditional attack methods, this method can generate more misleading adversarial features that are indistinguishable from normal features, and has better performance on EEG data. Attached Figure Description

[0050] Figure 1 This is a flowchart illustrating the usage process of this invention;

[0051] Figure 2 This is a brainwave adversarial sample generation diagram;

[0052] Figure 3 This is a flowchart of the perturbation generation algorithm proposed in this invention;

[0053] Figure 4 This is a comparison image of the generated sample and the original sample in this invention;

[0054] Figure 5 This is a comparison chart of the samples generated in this invention and those generated by the PGD method. Detailed Implementation

[0055] The present invention will be further described below with reference to embodiments.

[0056] Example 1

[0057] An adversarial perturbation generation method for EEG signal classification systems can be achieved by adding, for example... Figure 1 The small perturbation shown causes the machine learning model to output incorrect results, thus producing incorrect control behavior.

[0058] The core idea of ​​adversarial attacks is to increase perturbations in the direction of increasing loss. That is, training the model involves gradient descent on the parameters (reducing loss), while adversarial attacks involve gradient ascent on the input (increasing loss). Although the gradient is calculated when computing the adversarial perturbation, the parameters are not updated because the current adversarial perturbation is optimal for the old parameters. The adversarial perturbation is updated by maximizing the loss function of the adversarial examples. In this embodiment, the PGD projective gradient descent method is used to generate the initial adversarial examples. For non-target attacks, multiple FGSM attacks are performed, each time with a small step size.

[0059] The algorithm updates the adversarial perturbation by maximizing the loss function of the adversarial examples and performs Gaussian smoothing on the generated perturbation to reduce square wave artifacts in the generated samples. The computation flow is as follows: Figure 2 As shown, it generally includes the following steps:

[0060] S1. Use the PGD method to obtain initial adversarial examples;

[0061] In step S1, when generating adversarial examples, the PGD projection gradient descent method is used to generate initial adversarial examples, including the following steps:

[0062] For non-target attacks, perform multiple FGSM attacks, each time with a step size α (α<ε), as shown in formula (1):

[0063]

[0064] Where: x j '' represents the adversarial example obtained in the j-th iteration, x∈R C*T These are the original EEG samples, where R is a real number, C is the number of channels in the EEG signal, T is the duration of the EEG signal, x0′ = x, ε represents the magnitude of the perturbation constraint, and Clip... x,ε (·) indicates that the samples are truncated to the range [x-ε, x+ε], α represents the step size of each iteration, L(·) is the loss function, f(·) is the network model, and x j-1 Let ' represent the adversarial sample obtained in the (j-1)th iteration, and y be the label of that sample. This is the gradient of the model with respect to adversarial examples;

[0065] For the target attack, the update is performed using formula (2). In each iteration, the input is updated along the direction of gradient descent of the target class. After multiple iterations, the final adversarial sample is obtained.

[0066]

[0067] Where: t represents the target class;

[0068] The initial counter-perturbation θ = x is obtained j ′-x.

[0069] S2, the obtained disturbance θ i Smooth the perturbation by convolution with a Gaussian kernel and update the perturbation.

[0070] Step S2 includes the following steps:

[0071] To reduce square wave artifacts in adversarial example generation, a smoothing adversarial perturbation method is used. This method employs Gaussian convolution to weighted average the signal and its neighboring positions, resulting in smoother adversarial examples.

[0072]

[0073] Where: a is the target vector, v is the weight or kernel function, v uses the Gaussian kernel function, n is the length of the target vector, for ease of description, the size of the convolution kernel is set to 2K+1, the element index in the convolution kernel is m, and m takes the values ​​1, 2, 3, ..., 2K+1 in sequence;

[0074] In mathematics, given a Gaussian kernel of size 2K+1 and standard deviation σ, the following kernel function is obtained:

[0075]

[0076] Where: θ i ' represents the adversarial perturbation obtained when repeating the i-th iteration, which is then convolved with g Gaussian kernels and updated:

[0077]

[0078] Where: K(s[k],σ[k]) is a Gaussian kernel of size s[k] and standard deviation σ[k], initialized against the adversarial disturbance θ′0=θ, and the iteration variable for the summation operation is k. This means that k takes the values ​​1, 2, 3, ..., g in sequence and then sums them up.

[0079] S3, update the perturbation θ i Adding ' to the original input x yields the adversarial sample x. adv (θ i ′);

[0080] Step S3 includes the following steps:

[0081] Adding this perturbation to the clean sample yields the adversarial sample x. adv (θ i ′).

[0082] x adv (θ′ i )=x+θ′ i (6)

[0083] Where: x∈R C*T These are the original EEG samples, where C is the number of channels in the EEG signal, T is the duration of the EEG signal, and x... adv (θ′ i ) indicates that the disturbance θ′ will be countered. i Adversarial examples obtained after smoothing.

[0084] S4. Find the gradient of the model with respect to the adversarial example, use the sign function to find its gradient direction, multiply by the iteration step size α, and update the perturbation.

[0085] Step S4 includes the following steps:

[0086] Find the gradient of the model with respect to the adversarial example, use the sign function to find its gradient direction, multiply it by the iteration step size α, and update the perturbation;

[0087] For non-target attacks, the perturbation is updated using the Fast Gradient Sign Method (FGSM) as shown in formula (7):

[0088]

[0089] Where: θ i ' represents the adversarial perturbation obtained when repeating it for the i-th time, and correspondingly, θ i+1 ′ represents the adversarial perturbation obtained when repeating the (i+1)th time, x adv (θ i ′) indicates that a perturbation θ has been added. i The adversarial examples obtained after ' are given, where α represents the step size of each iteration. This is the gradient of the model in response to adversarial perturbations;

[0090] For a target attack, where t is the target class, the perturbation is updated using formula (8) along the direction of gradient descent of the target class:

[0091]

[0092] S5. When the disturbance magnitude exceeds the disturbance constraint ε, project the disturbance back to L. ∞ Norm constraints;

[0093] Step S5 includes the following steps:

[0094] When the magnitude of the disturbance exceeds the disturbance constraint ε, the disturbance is projected back to L. ∞ Norm constraints;

[0095] θ i+1 ′=Clip 0,ε (θ i+1 ′) (9)

[0096] Among them: Clip 0,ε (·) indicates that the perturbation is truncated to [-ε, ε].

[0097] S6. Repeat steps S2 to S5 several times. After the iteration is complete, add the final perturbation to the clean sample x to obtain the final smoothed adversarial sample x. adv (θ i+1 ′).

[0098] In this embodiment 1, the step size α = 0.02 for each iteration, the number of repetitions i = 10, and the kernel size 5 are set. The values ​​of s are set to {5, 7, 11, 15, 19}, and σ is set to {1.0, 3.0, 5.0, 7.0, 10.0}. Comparison with the FGSM and PGD methods shows that the smoothing attack method can deceive the neural network model with minimal perturbation and achieve a slightly higher attack accuracy than FGSM and PGD. Furthermore, it can achieve 100% attack accuracy with less perturbation constraint. Simultaneously, this smoothing attack method can reduce square wave artifacts, resulting in more realistic adversarial examples.

[0099] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for generating adversarial perturbations for electroencephalogram (EEG) signal classification systems, characterized in that, Includes the following steps: S1. Use the PGD method to obtain initial adversarial examples; S2. Smooth the obtained perturbation by convolution with a Gaussian kernel and update the perturbation; S3, update the perturbation θ i Adding ' to the original input x yields the adversarial sample x. adv (θ i ′); S4. Find the gradient of the model with respect to the adversarial example, use the sign function to find its gradient direction, multiply by the iteration step size α, and update the perturbation. S5. When the disturbance magnitude exceeds the disturbance constraint ε, project the disturbance back to L. ∞ Norm constraints; S6. Repeat steps S2 to S5 several times; Step S1 includes the following steps: For non-target attacks, perform multiple FGSM attacks, each time with a step size α (α<ε), as shown in formula (1): Where: x j '' represents the adversarial example obtained in the j-th iteration, x∈R C*T These are the original EEG samples, where R is a real number, C is the number of channels in the EEG signal, T is the duration of the EEG signal, x0′ = x, ε represents the magnitude of the perturbation constraint, and Clip... x,ε (·) indicates that the samples are truncated to the range [x-ε, x+ε], α represents the step size of each iteration, L(·) is the loss function, f(·) is the network model, and x j-1 Let ' represent the adversarial sample obtained in the (j-1)th iteration, and y be the label of that sample. This is the gradient of the model with respect to adversarial examples; For the target attack, the update is performed using formula (2). In each iteration, the input is updated along the direction of gradient descent of the target class. After multiple iterations, the final adversarial sample is obtained. Where: t represents the target class; The initial counter-perturbation θ = x is obtained j ′-x.

2. The method for generating adversarial perturbations for EEG signal classification systems according to claim 1, characterized in that, Step S2 includes the following steps: To reduce square wave artifacts in adversarial example generation, a smoothing adversarial perturbation method is used. This method employs Gaussian convolution to weighted average the signal and its neighboring positions, resulting in smoother adversarial examples. Where: a is the target vector, v is the weight or kernel function, v uses the Gaussian kernel function, n is the length of the target vector, for ease of description, the size of the convolution kernel is set to 2K+1, the element index in the convolution kernel is m, and m takes the values ​​1, 2, 3, ..., 2K+1 in sequence; In mathematics, given a Gaussian kernel of size 2K+1 and standard deviation σ, the following kernel function is obtained: Where: θ i ' represents the adversarial perturbation obtained when repeating the i-th iteration, which is then convolved with g Gaussian kernels and updated: Where: K(s[k],σ[k]) is a Gaussian kernel of size s[k] and standard deviation σ[k], initialized against the perturbation θ0. ′ =θ, where the iteration variable for the summation operation is k. This means that k takes the values ​​1, 2, 3, ..., g in sequence and then sums them up.

3. The method for generating adversarial perturbations for EEG signal classification systems according to claim 2, characterized in that, Step S3 includes the following steps: Adding this perturbation to the clean sample yields the adversarial sample x. adv (θ i ′); x adv (i i ′)=x+θ i ′ (6) Where: x∈R C*T These are the original EEG samples, where C is the number of channels in the EEG signal, T is the duration of the EEG signal, and x... adv (θ i ′) indicates that the disturbance θ′ will be countered. i Adversarial examples obtained after smoothing.

4. The method for generating adversarial perturbations for EEG signal classification systems according to claim 3, characterized in that, Step S4 includes the following steps: Find the gradient of the model with respect to the adversarial example, use the sign function to find its gradient direction, multiply it by the iteration step size α, and update the perturbation; For non-target attacks, the perturbation is updated using the Fast Gradient Sign Method (FGSM) as shown in formula (7): Where: θ i ' represents the adversarial perturbation obtained when repeating it for the i-th time, and correspondingly, θ i+1 ′ represents the adversarial perturbation obtained when repeating the (i+1)th time, x adv (θ i ′) indicates that a perturbation θ has been added. i The adversarial examples obtained after ' are given, where α represents the step size of each iteration. This is the gradient of the model in response to adversarial perturbations; For a target attack, where t is the target class, the perturbation is updated using formula (8) along the direction of gradient descent of the target class: 。 5. The method for generating adversarial perturbations for EEG signal classification systems according to claim 4, characterized in that, Step S5 includes the following steps: When the magnitude of the disturbance exceeds the disturbance constraint ε, the disturbance is projected back to L. ∞ Norm constraints; i i+1 ′=Clip 0,ε (i i+1 ′) (9) Among them: Clip 0,ε (·) indicates that the perturbation is truncated to [-ε, ε].

6. The method for generating adversarial perturbations for an EEG signal classification system according to claim 5, characterized in that, Step S6 includes the following steps: Repeat steps S2-S5 several times. After the iteration is complete, add the final perturbation to the clean sample x to obtain the final smoothed adversarial sample x. adv (θ i+1 ′).

Images