A time series prediction adversarial attack method based on local perturbation
By generating time-series adversarial examples through local perturbation and differential evolution algorithms, this method solves the problems of existing methods being easily detected and frequently calling the model, and achieves the generation of adversarial examples that are not easily detected, successfully attacking LSTM and TCN models.
Patent Information
- Application Number
- CN202211500734.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-11-28
- Publication Date
- 2026-02-10
- Estimated Expiration
- 2042-11-28
AI Technical Summary
Existing time series adversarial example generation methods are easily detected, and black-box attack methods require frequent calls to the original model, increasing the likelihood of being detected and making it difficult to generate effective adversarial examples.
An adversarial attack method based on local perturbation time series prediction is adopted. Global samples are generated through BIM gradient attack, the sliding window size is analyzed, and the differential evolution algorithm is used to carry out attacks in local intervals. Adversarial samples are generated by combining piecewise functions and BIM global samples to reduce the perturbation range and reduce the perceptibility.
The generated adversarial examples are not easily perceived, can effectively change the model's prediction trend, and can be generated by calling the model's internal information only once. The final generated adversarial examples can successfully attack LSTM and TCN models.
Smart Images
Figure CN115880542B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network attack detection, and in particular to a time series prediction adversarial attack method based on local disturbance. BACKGROUND
[0002] Currently, the white-box attack method in the image field mainly attacks based on model gradient, such as FGSM and BIM, which have good attack effects in image recognition tasks. The black-box attack method in the image field is mainly based on substitute models and genetic algorithms. For example, a pixel attack proposed by some scholars can generate adversarial samples by changing the information of only one pixel in the image. Papernot et al. proposed a black-box method that uses the transferability of substitute models to approximate the target attack model. In addition, the ANGRI and UPSET models based on the generative adversarial network can generate adversarial samples by training the network in a self-supervised mode.
[0003] However, there are few adversarial sample generation methods for time series. Some scholars first studied the problem of time series adversarial attack, although they only conducted experiments on a simulated data set, but the generated samples can successfully attack the k-nearest neighbor classifier. Some scholars use FGSM and BIM to attack the residual network (ResNet) and reduce the accuracy of ResNet in classifying time series. Some scholars extend the white-box method to adversarial attacks that are targeted and universal for time series. Some scholars propose a gradient adversarial transform network (GATN) to generate single-variable and multi-variable time series. In order to maintain the black-box restriction and obtain gradient information, their method needs to train a substitute model through knowledge distillation.
[0004] By contrast, the disturbance of FGSM and BIM is based on the entire sequence, which makes the disturbed sample easy to be perceived and thus the attack fails. Although GATN is a black-box attack, it needs to frequently call the original model to train the substitute model, which will increase the possibility of being perceived. SUMMARY
[0005] Embodiments of the present application provide a time series prediction adversarial attack method based on local disturbance, which can effectively generate adversarial samples that are not easy to perceive and effectively change the prediction trend of the model.
[0006] In order to achieve the above purpose, the present application adopts the following technical solutions.
[0007] A time series prediction adversarial attack method based on local disturbance, comprising:
[0008] Step S1, performing a BIM gradient attack on the original sample to obtain a global attack sample;
[0009] Step S2, analyzing the target attack model of the global attack sample to obtain the size of the sliding window and determine the local interval to which perturbation needs to be added;
[0010] Step S3, randomly selecting sequence points of the global attack sample and the original sample to generate population individuals of the local attack sample;
[0011] Step S4, initializing the population individuals of the local attack sample;
[0012] Step S5, using the population individuals of the local attack sample to attack the local interval intercepted by the sliding window according to the differential evolution algorithm, and for each generation of population, the children are generated by mutation and crossover of the parents of the previous generation;
[0013] Step S6, converting the population individuals into a sequence of 0 and 1 by using a piecewise function, and converting the global attack sample of BIM and the original sample into corresponding time series, calculating the fitness of the time series, and selecting better population individuals of the local attack sample;
[0014] Step S7, retaining the best population individual of the local attack sample;
[0015] Step S8, determining whether the mean square error (MSE) of the target attack model of the local attack sample reaches convergence, and if so, determining that the local attack sample is successful in attack;
[0016] Step S9, adding the local attack sample that is successful in attack to the sequence of adversarial samples.
[0017] Preferably, the step S2 of analyzing the target attack model of the global attack sample to obtain the size of the sliding window comprises:
[0018] for a time series wherein each element corresponds to the numerical value of a time step, the prediction of the time series is divided into equal-length prediction time periods, and a sliding window is used to divide each prediction time period in the time series while ensuring that each prediction time period can obtain the same degree of perturbation, the size W and the step S of the sliding window should satisfy:
[0019]
[0020] denotes the number of the sliding window.
[0021] Preferably, the step S5 uses the population of local attack samples to attack the local interval intercepted by the sliding window according to the differential evolution algorithm. For each generation population, the children are generated by mutation and crossover of the parents of the last generation, including:
[0022] The population of local attack samples is mutated by differential operation in the differential evolution algorithm:
[0023]
[0024] Where V, X and F represent the mutated individual, the parents and the scale factor, respectively, and i represents the ith member in the population; r1, r2 and r3 are random individuals; g represents the gth generation;
[0025] The mutated member And The operation of completing the crossover is as follows:
[0026]
[0027] Where j represents the jth variable of the candidate solution, is a random value between 0 and 1, and CR represents the probability of crossover, is a random integer, and U is an experimental individual. In the selection stage, if the offspring has a better fitness value than the corresponding parent, the offspring is retained; otherwise, the parent is retained. The selection formula is:
[0028]
[0029] Where represents the fitness function for evaluating the quality of the individual, The value is proportional to the MSE value of the predicted results of the individual.
[0030] Preferably, the step S6 converts the population of individuals into a sequence of 0 and 1 by using a piecewise function, and converts the original sample and the BIM global attack sample into corresponding time series. The time series is subjected to fitness calculation, and the better population of local attack samples is selected, including:
[0031] f represents the target attack model of the local attack sample, and the original time series x is set as Then the MSE of the predicted value of f is ;
[0032] The sequence points in the population individuals are randomly extracted from the global attack sample and the original sample and combined into a sequence. Next, in each generation of the population, the children are generated by the mutation and crossover of the parents of the previous generation, and are converted into a sequence of 0 and 1 by the piecewise function h, the implementation of the partial attack sample is completed, the prediction MSE value f of the individual is calculated, and the result is used as the fitness of the individual. For a better attack sample, the higher the prediction result MSE value of the member, the higher the fitness, and the final winner survives to the next generation. The optimal individual is also converted into a sequence of 0 and 1 by the piecewise function h and combined with BIM as the output of the algorithm. When y is 0, it indicates that the current sequence point is retained as the original sample data. When y is 1, it indicates that the current sequence point uses the data of the corresponding sequence point in the BIM global attack sample. The piecewise function h satisfies:
[0033]
[0034] Preferably, the step S8 judges whether the mean square error MSE of the target attack model of the local attack sample reaches convergence. If the local attack sample attacks successfully, the step S8 includes:
[0035] When the original sample is subjected to a targetless attack, the evolution number of the differential evolution algorithm set by the attacker is run, and then the optimal individual that survives becomes the attack sample. When the prediction accuracy of the optimal individual is greater than or equal to the given target MSE, the attack is stopped, and then other prediction intervals are continuously attacked until a complete adversarial attack list is obtained.
[0036] When the original sample is subjected to a target attack, when the prediction accuracy of the optimal individual is greater than or equal to the given target MSE, it is judged that the attack is successful.
[0037] As can be seen from the technical solutions provided by the above embodiments of the present application, the method described in the embodiments of the present application not only reduces the disturbance range, but also reduces the perceptibility of the adversarial sample. However, the method of the present application only needs to call the internal information of the model once, and then generates the final perturbed sample through the differential evolution algorithm.
[0038] Additional aspects and advantages of the application will be described in the following description, which will become apparent from the following description, or will be learned by practice of the application. BRIEF DESCRIPTION OF DRAWINGS
[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creating laborious work.
[0040] Figure 1 A processing flowchart of a time series prediction adversarial attack method based on local disturbance provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION
[0041] Embodiments of the present application will be described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference signs represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as a limitation on the present application.
[0042] Those skilled in the art can understand that, unless specifically stated, the singular forms "a", "an" and "the" used herein also include the plural forms. It should be further understood that the use of the phrase "comprising" in the specification of the present application means that the features, integers, steps, operations, elements and / or components exist, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we say an element is "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, or there can be intermediate elements. In addition, "connected" or "coupled" used herein can include wireless connection or coupling. The phrase "and / or" used herein includes any one of the associated listed items and all combinations thereof.
[0043] Those skilled in the art can understand that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as that generally understood by those skilled in the art to which the present application belongs. It should also be understood that terms such as those defined in a general dictionary should be understood to have meanings consistent with those in the context of the prior art, and should not be interpreted with idealized or overly formal meanings unless defined as such.
[0044] For the convenience of understanding the embodiments of the present application, further explanation and description will be made below with reference to the accompanying drawings in several specific embodiments, and each embodiment does not constitute a limitation on the embodiments of the present application.
[0045] The processing flow of a time series prediction adversarial attack method based on local disturbance provided by an embodiment of the present application is shown in the figure Figure 1 and includes the following processing steps:
[0046] Step S1, performing BIM (basic iterative method) gradient attack on the original sample to obtain a global attack sample;
[0047] Step S2, by analyzing the target attack model of the global attack sample, the size of the sliding window is obtained, and the application embodiment selects LSTM (long short-term memory) and TCN (temporal convolutional network) as the target attack model, and uses the default hyperparameters of the Adam optimizer to train the target attack model.
[0048] Step S3, randomly selecting sequence points of the global attack sample and the original sample to generate population individuals of the local attack sample;
[0049] Step S4, initializing the population of the local attack sample;
[0050] Step S5, according to the differential evolution algorithm, the local interval intercepted by the sliding window is attacked, and for each generation population, the child is generated by mutation and crossover of the parents of the last generation;
[0051] Step S6, the population individuals are converted into 0 and 1 sequences by the piecewise function, and the BIM global attack sample and the original sample are converted into corresponding complete time series, the fitness of the time series is calculated, and better population individuals of the local attack sample are selected; Step S7, the best population individual of the local attack sample is reserved;
[0052] Step S8, judging whether the MSE (Mean Square Error) of the target attack model of the local attack sample reaches convergence, if yes, judging that the local attack sample attack is successful;
[0053] Step S9, adding the local attack sample which attacks successfully to the adversarial sample sequence, and returning to execute step S5;
[0054] Further, the global attack sample obtained by the BIM attack algorithm in step S1 comprises:
[0055] Time series prediction is a regression prediction method, which belongs to quantitative prediction, and uses past data for statistical analysis or appropriately processes the data to predict the development trend of things.
[0056] Adversarial attack is defined as that most models in deep learning are vulnerable to adversarial samples and make incorrect judgments. Adversarial sample is defined as an input sample formed by deliberately adding subtle interference in the data set, which causes the model to give an incorrect output with high confidence;
[0057] The attack method of generating adversarial samples to attack the time series prediction deep learning model can be formalized as a constraint optimization problem. f represents the target attack model. For the time series where each element corresponds to the value of the time step. Let the original time series be The MSE of the predicted value of f is Similarly, the perturbation on the sliding window interval can be represented as a vector e(x). The time series is taken as the original sample.
[0058] The advantage of directly obtaining the global sample is that it can save the operation of repeatedly performing BIM attacks in the sliding window. BIM adds perturbations to the sample by iterating with a smaller step, thereby generating stronger adversarial samples while ensuring that each perturbation is within the specified range.
[0059] Further, the S2 finds a suitable sliding window size and step. For the time series prediction process, its main feature is to predict the data of a fixed time T (t+1, t+2,..., t+T) that follows a set of time points (1, 2,..., t) by model training, that is, the prediction of the entire sequence is divided into equal-length prediction time periods. Based on the idea of local attack, the sliding window is used to divide each prediction time period, while ensuring that each prediction time period can receive the same degree of perturbation. Therefore, the size W and step S of the sliding window should satisfy:
[0060]
[0061] represents the number of the sliding window.
[0062] Next, the appropriate sliding window size is obtained according to the above formula combined with the internal prediction structure of the model. Then, the internal space of the sliding window is compared to a black box environment, and the differential evolution algorithm is used for attack.
[0063] Further, the S5, after obtaining the optimal amplitude by BIM, generates local perturbation sequences using the sliding window combined with the characteristics of the time series prediction model, thereby greatly reducing the possibility of being perceived, and at the same time compares the internal space of the sliding window to a black box to seek the optimal attack point. Finally, according to the differential evolution algorithm, the local interval of the global attack sample intercepted by the sliding window is used to attack the corresponding local interval of the original sample. Differential evolution is defined as a random model simulating biological evolution, which saves individuals that adapt to the environment through repeated iteration.
[0064] The population individuals are mutated by differential operation in the differential evolution algorithm:
[0065]
[0066] where V, X and F represent the variant individual, the parent and the scaling factor, respectively. i represents the ith member in the population; r1, r2 and r3 are random individuals; g represents the gth generation. After that, the variant member and The operation of completing crossover is as follows:
[0067]
[0068] where j represents the jth dimension variable of the candidate solution. is a random value between 0 and 1. CR represents the probability of crossover. is a random integer. U is the experimental individual. In the selection stage, if the offspring has a better fitness value than the corresponding parent, the offspring is retained. Otherwise, the parent is retained. The selection formula is:
[0069]
[0070] where represents the fitness function for evaluating the quality of the individual, the value is proportional to the MSE value of the prediction result of the individual, and the purpose is to make the final winner survive to the next generation, and retain better attack samples in the generation of adversarial samples.
[0071] Further, the step S6, for the attack process, the sequence points in the population individual are randomly extracted from the attack sample and the original sample and combined into a sequence. Next, in each generation of the population, the children are generated by the variation and crossover of the parents of the last generation, and are converted into 0 and 1 sequences through the piecewise function h, so as to complete the implementation of the partial attack sample, and then the prediction MSE value f of the individual is calculated, and the result is taken as the fitness of the individual. For better attack samples, the higher the prediction result MSE value of the member, the higher the fitness, and the final winner can survive to the next generation. The optimal individual is also converted into a 0 and 1 sequence through the piecewise function h and combined with BIM as the output of the algorithm, when y takes 0, it indicates that the current sequence point is retained as the original sample data, when y takes 1, it indicates that the current sequence point uses the data of the corresponding sequence point in the BIM global attack sample, so the piecewise function h should satisfy:
[0072]
[0073] Further, the S8, although the attack is formalized as an optimization problem, but not necessarily in practice to find the best solution. The above narrative process gives is the goalless attack, need to run the evolution number of evolutionary algorithm set by the attacker, after the survival of the optimal individual directly become this attack sample, when the optimal individual prediction accuracy to stop the attack, after the convergence of the prediction interval, until the complete list of attack. If the targeted attack, when the optimal individual prediction accuracy greater than or equal to the given target MSE, then the attack is successful.
[0074] For goalless attack, the attacker seeks an optimal solution for the following problem:
[0075]
[0076] Where, and respectively represent the and norm of 𝜖(𝑥). This means that the perturbation is added to maximize the MSE of the target attack model prediction value, which is equivalent to minimizing the prediction accuracy of the original model.
[0077] For targeted attack, the solution is to maximize the prediction MSE value of the given target . The optimization problem is:
[0078]
[0079] Where, represent the MSE of the target prediction value, which means that the difference between the MSE of the attacked model prediction value and the target MSE value is minimized.
[0080] In summary, the perturbation interval of the attack sample of the embodiment of the application is limited to the local interval of the sliding window. Fewer perturbations make it less likely to be observed or detected. The method described in the application can establish different perturbation intervals by adjusting the perturbation degree and different sliding window sizes, and at the same time, due to the selectivity of the differential evolution algorithm, different perturbation samples can also be generated under the same interval.
[0081] The application first proposes a local perturbation strategy based on a sliding window to narrow the perturbation range of the adversarial sample; secondly, a differential evolution algorithm is used to find the optimal attack point, and a segmented function is used to divide the perturbation interval, further narrowing the perturbation range, and completing the semi-white-box attack. The application can generate adversarial samples that are not easy to perceive, and effectively change the prediction trend of the model, and has achieved good attack effect in two challenging tasks of stock trading and power consumption prediction.
[0082] Those skilled in the art can understand that the modules or flows in the drawings are not necessarily required for implementing the present application.
[0083] Those skilled in the art can clearly understand that the present application can be implemented by means of software and necessary universal hardware platform through the above description of the embodiments. Based on such understanding, the technical solutions of the present application can be embodied in the form of software product, which can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes a plurality of instructions for making a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.
[0084] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments mainly describes the difference from other embodiments. Especially, the device or system embodiments are described more simply because they are basically similar to the method embodiments, and the relevant parts can be referred to the part of the method embodiments. The above-described device and system embodiments are only illustrative, and the units described as separate components can be or can not be physically separated, and the components displayed as units can be or can not be physical units, i.e., they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiments according to the actual needs. Those skilled in the art can understand and implement it without creative labor.
[0085] The above describes only the preferred embodiments of the present application, but the protection scope of the present application is not limited to this. Any changes or replacements within the technical scope disclosed by the present application can be easily thought by those skilled in the art without creative labor, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.
Claims
1. A method for adversarial attacks on time series prediction of power consumption based on local perturbations in power consumption forecasting, characterized in that, include: Step S1: Perform BIM gradient attack on the original samples in the power consumption prediction to obtain global attack samples; Step S2: By analyzing the target attack model of the global attack sample, the size of the sliding window is obtained, and the local interval where perturbation needs to be added is determined. Step S3: Randomly select sequence points from the global attack sample and the original sample to generate a population of local attack samples. Step S4: Initialize the population of individuals in the local attack sample; Step S5: Using the local attack sample population individuals, attack the local intervals truncated by the sliding window according to the differential evolution algorithm. For each generation of the population, the children are generated by the mutation and crossover of the previous generation's parents. Step S6: The population individuals are transformed into a sequence of 0s and 1s through a piecewise function, and combined with the BIM global attack samples and the original samples to transform them into corresponding time series. The fitness of the time series is calculated, and population individuals with better local attack samples are selected. Step S7: Retain the best individuals in the population for local attack samples; Step S8: Determine whether the mean square error (MSE) of the target attack model of the local attack sample has converged. If it has converged, then the attack on the local attack sample is considered successful. Step S9: Add the successful local attack samples to the adversarial sample sequence in the power consumption prediction.
2. The method according to claim 1, characterized in that, Step S2, which involves analyzing the target attack model of the global attack sample to obtain the size of the sliding window, includes: For electricity consumption forecast time series Each element corresponds to a numerical value of the time step, which is used to sequence the time series. The predictions are divided into equal-length prediction periods, and a sliding window is used to segment the time series. In each prediction time period, a sliding window is used to ensure that each prediction time period receives the same degree of perturbation. Size and step size It should meet the following requirements: Indicates the number of the sliding window.
3. The method according to claim 2, characterized in that, Step S5 involves using the population of local attack samples to attack the local intervals selected by the sliding window according to the differential evolution algorithm. For each generation of the population, children are generated by the mutation and crossover of the previous generation's parents, including: Individuals in the population of local attack samples mutate through the differential operation in the differential evolution algorithm: in , and These represent the variant individual, the parents, and the scaling factor, respectively. Representing the first in the population One member; 1. 2 and 3 represents a random individual; Representing the generation; Mutant members and The crossover operation is performed as follows: in The candidate solution is represented by the first... dimensional variables, It is a random value between 0 and 1. This represents the probability of crossover. It is a random integer. These are experimental individuals. During the selection phase, if the offspring have a better fitness value than their corresponding parents, the offspring are retained; otherwise, the parents are retained. The selection formula is: in The fitness function represents the assessment of individual quality. The value is directly proportional to the MSE value of the individual prediction result.
4. The method according to claim 3, characterized in that, Step S6 involves transforming the population individuals into a sequence of 0s and 1s using a piecewise function, and combining this with the BIM global attack samples and the original samples to transform them into corresponding time series. Fitness calculations are then performed on these time series to select population individuals with better local attack samples, including: The target attack model representing a local attack sample, with the original time series set. for ,but The predicted value's MSE is ; Sequence points in individuals within the population are randomly selected from the global attack sample and the original sample and combined into a sequence. In each subsequent generation, offspring are generated from the mutations and crossovers of the previous generation's parents, and are processed using a piecewise function. The sequence is converted into 0s and 1s to complete part of the attack sample implementation, and then the individual MSE value is predicted. The fitness of an individual is calculated and used as the result. For better attack samples, members with higher predicted MSE values have higher fitness. Ultimately, the winner survives to the next generation, and the best individual is also determined by a piecewise function. The algorithm transforms 0 and 1 sequences and uses BIM as its output. When y is 0, it indicates that the current sequence point retains the original sample data; when y is 1, it indicates that the current sequence point uses the data of the corresponding sequence point in the BIM global attack sample. (Piecewise function) satisfy: 。 5. The method according to claim 4, characterized in that, Step S8, which involves determining whether the mean square error (MSE) of the target attack model of the local attack sample has converged, and if converged, then determining that the local attack sample has been successfully attacked, includes: When performing a targetless attack on the original sample, after running the number of generations of the differential evolution algorithm set by the attacker, the best surviving individual directly becomes the attack sample. When the prediction accuracy of the best individual is greater than or equal to the given target MSE, the attack stops, and then attacks other prediction intervals continue until a complete list of adversarial attacks is obtained. When a targeted attack is launched on the original sample, the attack is considered successful if the prediction accuracy of the best individual is greater than or equal to the given target MSE.