An adversarial sample generation method and device for signal data

Abstract

The present application relates to the field of anti-artificial intelligence, in particular to a kind of signal data's adversarial sample generation method and device. Including: original IQ signal is divided into training set and test set, and it is converted into constellation type training set and test set, using constellation type training set and test set to train deep neural network model, obtain the signal recognition model after training;The sample of constellation type is input into signal recognition model, the saliency area of input sample is calculated using image explainability method, and the global disturbance of input sample is calculated using gradient-based method, according to saliency area and global disturbance to obtain saliency area disturbance;Saliency area disturbance is added on input sample to generate adversarial sample, and the adversarial sample of constellation type is converted into IQ signal type adversarial sample. The present application can interfere and attack signal recognition model, provide technical means and support for electromagnetic space signal deception countermeasure.

Description

Technical Field

[0001] This invention relates to the field of anti-artificial intelligence, and in particular to a method and apparatus for generating adversarial examples for signal data. Background Technology

[0002] In recent years, artificial intelligence has played a crucial role in military fields such as situational awareness, information processing, command and control, decision support, and unmanned combat systems. Among these, intelligent image recognition methods, represented by deep convolutional neural networks, have achieved significant breakthroughs, continuously improving the performance of optical and SAR (Synthetic Aperture Radar) image scene classification, target detection and recognition, semantic segmentation, change detection, and other tasks. This has greatly enhanced the combat effectiveness of reconnaissance weapons and equipment, and improved the intelligence reconnaissance and counter-reconnaissance capabilities of combat troops.

[0003] In the field of signal recognition, signals possess unique attributes such as phase, amplitude, and power. Therefore, complex signals are generally used to represent signals during signal processing. The real and imaginary parts of a complex signal are orthogonal I and Q signals, respectively. A constellation diagram is a set of coordinates of several points on a two-dimensional plane and is a commonly used method for analyzing digital modulated signals. The two dimensions of the two-dimensional coordinates correspond to the I and Q signals, respectively. The geometry of the constellation diagram mainly reflects the spatial distribution of the amplitude and phase of the modulated signal. Any digital amplitude-phase modulated signal can be uniquely represented using a constellation diagram. Therefore, by effectively utilizing the amplitude and phase differences on the constellation diagrams of different modulated signals, various types of modulated signals can be correctly identified.

[0004] However, in complex environments, AI-based signal classification algorithms have certain shortcomings in terms of data and model structure, leading to poor robustness and susceptibility to misleading and deception. To improve model robustness and avoid being misled and deceived, adversarial examples are used to train the model in practical applications. If the model is not deceived by adversarial examples, it indicates strong robustness. How to obtain highly perturbative adversarial examples to enhance model training is a technical problem that needs to be solved.

[0005] Therefore, given the shortcomings of existing technologies, how to generate more effective classification models for adversarial sample interference signals is a problem to be solved in this technical field. Summary of the Invention

[0006] In response to the shortcomings of existing artificial intelligence technologies, this invention is mainly used to quickly generate adversarial examples to interfere with signal classification models and deceive intelligent models.

[0007] The embodiments of the present invention adopt the following technical solutions: In a first aspect, the present invention provides a method for generating adversarial examples for signal data, specifically comprising: dividing the original IQ signal into a training set and a test set, and converting them into a constellation graph type training set and test set; using the constellation graph type training set and test set to train a deep neural network model to obtain a trained signal recognition model; inputting the constellation graph type samples into the signal recognition model; calculating the salient regions of the input samples using image interpretability methods; calculating the global perturbation of the input samples using gradient-based methods; obtaining the salient region perturbation based on the salient regions and the global perturbation; adding the salient region perturbation to the input samples to generate adversarial examples; and converting the constellation graph type adversarial examples into IQ signal type adversarial examples.

[0008] Preferably, dividing the original IQ signal into a training set and a test set specifically includes: obtaining a sample dataset of the original IQ signal data, and dividing the sample dataset into a training set and a test set according to a preset ratio based on the sample label of each original IQ data in the sample dataset.

[0009] Preferably, the step of converting it into a constellation diagram type training and test set specifically includes: according to the encoding method corresponding to different modulation methods of the original IQ signal, using the I-channel signal and Q-channel signal in the original IQ signal as the horizontal and vertical coordinates of the data in the constellation diagram, respectively, calculating the two-dimensional coordinates corresponding to each original IQ signal based on the values ​​of the I-channel signal and Q-channel signal, and using the set of two-dimensional coordinates of the original IQ signal as the constellation diagram dataset; and dividing the constellation diagram dataset corresponding to the original IQ signal into corresponding training and test sets according to the division of the training and test sets of the original IQ signal.

[0010] Preferably, the step of training the deep neural network model using a constellation-graph type training set and test set to obtain the trained signal recognition model specifically includes: constructing a deep neural network model, optimizing the training of the deep neural network model using a constellation-graph type training set, and testing it using a constellation-graph type test set; adjusting the network structure and parameters of the deep neural network model according to the test results until a deep neural network model with classification performance that meets the requirements is obtained, and using it as a signal recognition model.

[0011] Preferably, the step of inputting constellation-type samples into the signal recognition model and calculating the salient region of the input samples using image interpretability methods specifically includes: obtaining the signal data feature map extracted by the last convolutional layer of the signal recognition model; obtaining the sub-vectors corresponding to the target classification in the input samples, calculating the importance of each feature map to the target classification based on the sub-vectors; weighted summing of each feature map and the importance corresponding to the feature map to obtain the corresponding activation mapping of each target classification on the sample, and using the interpretability saliency map corresponding to the activation mapping as the salient region of the sample.

[0012] Preferably, the step of using a gradient-based method to calculate the global perturbation of the input sample specifically includes: performing backpropagation to derive the input sample based on the loss function of the signal recognition model, and obtaining the global perturbation based on the initial perturbation threshold and the number of iterations.

[0013] Preferably, obtaining the salient region perturbation based on the salient region and the global perturbation specifically includes: preprocessing the salient region to obtain the matrix corresponding to the salient region; combining the matrix and the global perturbation to obtain the intersection, thereby obtaining the perturbation value at the position corresponding to the salient region, and using the perturbation value as the salient region perturbation.

[0014] Preferably, the preprocessing of the salient regions to obtain the matrix corresponding to the salient regions specifically includes: constructing a matrix with the same size as the input sample; for each element of the matrix, when the value of the interpretability saliency map element of the salient region is greater than 0, the value of the element at the corresponding position in the matrix is ​​1, otherwise, the value of the element is 0.

[0015] Preferably, the step of adding salient region perturbation to the input sample to generate adversarial samples specifically includes: adding salient region perturbation to constellation diagram type samples to generate perturbation samples; when the perturbation samples and input samples are classified inconsistently in the signal recognition model, the perturbation samples are used as adversarial samples.

[0016] On the other hand, the present invention provides an adversarial sample generation apparatus for signal data, specifically comprising at least one processor and a memory, wherein the at least one processor and the memory are connected via a data bus, the memory stores instructions that can be executed by the at least one processor, and the instructions, after being executed by the processor, are used to complete the adversarial sample generation method for signal data in the first aspect.

[0017] Compared with the prior art, the beneficial effects of the embodiments of the present invention are as follows: the original IQ signal is converted into a constellation diagram signal, the intersection of the salient region and the global perturbation is calculated according to the constellation diagram type sample, thereby obtaining the salient region perturbation, the salient region perturbation is added to the input sample to generate adversarial samples, and then the constellation diagram type adversarial samples are converted into IQ signal type adversarial samples, thereby achieving the effect of interference and attack signal identification model. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly described below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0019] Figure 1 A flowchart of an adversarial sample generation method for signal data provided in an embodiment of the present invention; Figure 2 A flowchart of another method for generating adversarial examples for signal data provided in an embodiment of the present invention; Figure 3 A flowchart of another method for generating adversarial examples for signal data provided in an embodiment of the present invention; Figure 4 A flowchart of another method for generating adversarial examples for signal data provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of an adversarial sample generation device for signal data provided in an embodiment of the present invention; The reference numerals in the attached figures are as follows: 11: Processor; 12: Memory. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0021] This invention is an architecture of a specific functional system. Therefore, the specific embodiments mainly describe the functional logic relationship of each structural module, and do not limit the specific software and hardware implementation methods.

[0022] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] Example 1: With the rapid development of artificial intelligence technology, it has been widely used in the field of signal recognition, among which signal recognition is relatively mature. However, artificial intelligence technology based on deep learning faces risks such as poor robustness, susceptibility to being misled and deceived in terms of data, algorithms, and models.

[0024] like Figure 1 As shown in the figure, the specific steps of the adversarial example generation method for signal data provided by this embodiment of the invention are as follows: Step 101: Divide the original IQ signal into training and test sets, and convert them into constellation diagram type training and test sets. Use the constellation diagram type training and test sets to train the deep neural network model to obtain the trained signal recognition model.

[0025] In this embodiment, adversarial examples are generated by adding perturbations to constellation-type data to deceive or mislead the artificial intelligence model. A signal recognition model for classifying constellation-type data is established. First, raw IQ signals are collected or simulated, divided into training and test sets, and then converted into constellation-type data with the corresponding modulation type. Next, a deep neural network model is built. The constellation-type data is divided into training and test sets. The deep neural network model is trained using the training set of constellation-type data and tested using the test set of constellation-type data, resulting in a signal recognition model with good classification performance.

[0026] Step 102: Input the constellation diagram type samples into the signal recognition model, use the image interpretability method to calculate the salient region of the input sample, and use the gradient-based method to calculate the global perturbation of the input sample. Obtain the salient region perturbation based on the salient region and the global perturbation.

[0027] After establishing the signal recognition model, constellation diagram type samples are classified using the signal recognition model. Then, image interpretability methods are used to obtain the salient regions of the input samples for different classifications, and features important to the classification results are mined. Then, a gradient-based method is used to calculate the global perturbation of the input samples, and the intersection of the global perturbation and the salient regions is taken to obtain the local perturbation of the salient regions, i.e., the salient region perturbation.

[0028] Step 103: Add saliency region perturbation to the input sample to generate adversarial samples, and convert the constellation diagram type adversarial samples into IQ signal type adversarial samples.

[0029] After obtaining the salient region perturbation, the salient region perturbation is added to the input sample to generate perturbation samples. These perturbation samples are then judged according to the conditions for generating adversarial samples, and those perturbation samples whose classification is inconsistent with the original sample without perturbation are selected as adversarial samples. Finally, the samples corresponding to the adversarial samples are mapped from the constellation diagram type back to the original IQ signal data, generating adversarial samples of the original IQ signal.

[0030] After steps 101-103 provided in this embodiment, adversarial samples capable of interfering with the signal recognition model can be generated, so as to achieve the effect of interfering with and attacking the signal recognition model during electromagnetic network space algorithm adversarial attack and defense.

[0031] In a specific scenario, the calculation of various data in the method provided in this embodiment is performed using the following method. In specific implementation, data calculation can be performed using the following method, or other calculation methods that conform to the principles of this embodiment can be used.

[0032] In order to divide the original IQ signal into training and test sets, it is necessary to obtain a sample dataset of the original IQ data, and divide the sample dataset into training and test sets according to a preset ratio based on the sample label of each original IQ data in the sample dataset.

[0033] Specifically, real signals can be collected using signal acquisition equipment as raw IQ signals, or simulated signals can be generated using various simulation algorithms. Each sample data point of the raw IQ signal carries a classification label, which can be used to train a deep neural network model and verify the classification results of the deep neural network model. The acquired raw IQ signals constitute a sample dataset. , sample dataset According to the division into independent training sets and test set The training and test sets do not contain the same sample data, and both sets contain all the sample data from the sample dataset. , In practice, to ensure a sufficient amount of training data, the ratio of the training set to the test set can be set to... .

[0034] After obtaining the training and test sets of the original IQ signals, it is necessary to convert each original IQ data sample into constellation diagram type data. This yields constellation diagram type training and test sets. Based on the encoding methods corresponding to different modulation schemes of the original IQ signals, the I-channel and Q-channel signals in the original IQ signals are used as the horizontal and vertical coordinates of the data in the constellation diagram, respectively. The two-dimensional coordinates corresponding to each original IQ signal are calculated based on the values ​​of the I-channel and Q-channel signals. The set of two-dimensional coordinates of the original IQ signals is then used as the constellation diagram dataset. Based on the division of the original IQ signal training and test sets, the constellation diagram dataset corresponding to the original IQ signals is divided into corresponding training and test sets.

[0035] In practical implementation, there may be IQ signals with modulation types such as BPSK, QPSK, 8PSK, and 16QAM. Since each modulation method has a different phase, the mapped constellation diagram data also differs. During conversion, the encoding method of the modulation method can be used, with I and Q as the horizontal and vertical axes, and the data can be calculated based on I and Q. and Draw a constellation chart and convert the raw IQ signals into constellation chart-type data. To facilitate recognition using a deep neural network model, the constellation chart-type data can be saved as an image dataset. Then, based on the set of the original IQ data corresponding to the constellation chart-type data, the training set corresponding to the constellation chart-type data can be... and test set The conversion formula is as follows.

[0036]

[0037]

[0038] in, Indicates distance, i.e., signal amplitude; The angle represents the signal phase; I and Q represent the data corresponding to the I and Q signals in the original IQ data.

[0039] After obtaining the training and testing sets for constellation charts, the deep neural network model can be trained to obtain the trained signal recognition model. A deep neural network model is constructed based on the constellation chart dataset. Training set using constellation chart data Optimize the training and use the constellation chart data test set. Conduct testing. If the signal recognition model's performance does not meet the requirements, adjust the network structure and parameters of the deep neural network model based on the test results, such as adjusting hyperparameters like the learning rate, until a deep neural network model with satisfactory classification performance is obtained. Use it as a signal recognition model .

[0040] A deep neural network model with good classification performance was obtained through training. Then, you can use, such as Figure 2 The steps shown are used to calculate the salient region of the input sample using the signal recognition model.

[0041] Step 201: Obtain the feature map of the signal data extracted from the last convolutional layer of the signal recognition model.

[0042] Samples of constellation chart type Input into the trained signal recognition model In the middle, obtain High-level features extracted from the last convolutional layer Each high-level feature can be represented using a feature map. In an image The input is processed by pooling and convolution in the model to obtain multiple feature maps, which will be used in the following text. Indicates the extracted first High-level characteristics The corresponding feature map.

[0043] Step 202: Obtain the sub-vectors corresponding to the target classification of the input sample, and calculate the importance of each feature map to the target classification based on the sub-vectors.

[0044] Global equal pooling (GAP) is used to obtain the component vectors corresponding to the constellation diagram data samples of each category. And based on the component vectors Calculate the first Each feature map is used for target classification. Importance The formula is as follows.

[0045]

[0046] in, Indicates that the target classification has not been performed. Normalized score, Indicates the first convolution kernels The activation output value at that location, Indicates the first Each feature map is used for target classification. The importance of.

[0047] Step 203: Sum the weighted sum of each feature map and the importance corresponding to the feature map to obtain the corresponding activation map of each target classification on the sample, and use the interpretability saliency map corresponding to the activation map as the saliency region of the sample.

[0048] By importance With feature map The weighted summation ultimately yields the relevant target classification. In the sample The activation mapping on the constellation diagram yields the interpretability saliency map corresponding to the target classification. The region of the interpretability saliency map on the constellation diagram is the saliency region of the sample. The formula is as follows.

[0049]

[0050] in, This represents the activation function. Indicate category Interpretability saliency plot, Indicates the first Each feature map is used for target classification. The importance of.

[0051] By going through steps 201-203, the salient regions of each category on the sample can be obtained.

[0052] On the other hand, to perturb constellation-type data, it is necessary to backpropagate and differentiate the input samples based on the loss function of the signal recognition model, and obtain the global perturbation according to the initial perturbation threshold and the number of iterations. The iterative method I-FGSM can be used to obtain the global perturbation, based on the model... loss function For the sample Differentiate and initialize the perturbation threshold. Number of iterations , The formula is as follows.

[0053]

[0054] in, Indicates the first Adversarial examples corresponding to the global perturbation generated in the next iteration. Represents the loss function. Indicates at the threshold The value in the neighborhood of , Symbols.

[0055] After obtaining the salient regions and global perturbations, they can be combined to obtain the salient region perturbation corresponding to each classification. For example... Figure 3 As shown, significant regional perturbations can be obtained through the following steps.

[0056] Step 301: Preprocess the salient regions to obtain the matrix corresponding to the salient regions.

[0057] To facilitate computation, preprocessing can be performed to convert the salient regions into matrices. Specifically: the size of the matrix depends on the input sample size. Consistent matrix For each element of the matrix, when the value of the interpretability saliency map element of the saliency region is greater than 0, that is, the interpretability saliency map corresponding to the sample is valid. When an element's value is greater than 0, the element's value is 1; otherwise, the element's value is 0. This results in a matrix where all elements are either 0 or 1. The formula is as follows.

[0058]

[0059] Step 302: Combine the matrix and the global perturbation to obtain the intersection, and get the perturbation value at the corresponding position of the salient region. Use this perturbation value as the salient region perturbation.

[0060] The matrix corresponding to the salient regions With global disturbance By combining these values ​​to obtain the intersection, we can obtain the local perturbation value at the corresponding location of the salient region, thus obtaining the perturbation of the salient region. The formula is as follows.

[0061]

[0062] Steps 301-302 can be used to obtain the saliency region perturbation, which is used to perturb the samples of the constellation map data.

[0063] After obtaining the salient region perturbation, it can be added to the constellation diagram data to perturb the constellation diagram type data. The salient region perturbation is then added to the constellation diagram type samples to generate perturbed samples. When the perturbed samples and the input samples are classified inconsistently in the signal recognition model, the perturbed samples are used as adversarial samples.

[0064] In practice, to ensure that the generated adversarial examples meet the requirements for effective adversarial processing, screening and judgment are necessary during the generation process. For example... Figure 4 As shown, the specific judgment process is as follows.

[0065] Step 401: Determine whether the perturbation in the salient region exceeds the set threshold. If not, proceed to step 402; if yes, generating adversarial examples failed.

[0066] Step 402: Determine the number of iterations required to calculate the global perturbation. Is it greater than the set number of times? If not, proceed to step 403; if yes, then generating adversarial examples has failed.

[0067] Step 403: Perturb the salient region Add perturbation samples to the corresponding positions of constellation-type samples. The formula is as follows.

[0068]

[0069] in This indicates cropping, resulting in a constellation image with pixel values ​​ranging from 0 to 255 after perturbation.

[0070] Step 404: Identify Perturbation Samples Check if the sample classification is consistent with the signal recognition model. If yes, recalculate the salient region perturbation; otherwise, remove the perturbation sample. As an adversarial example The formula for determining this is as follows.

[0071]

[0072] in, Indicates that the perturbation sample Input to signal recognition model The category identified later This indicates the category of the sample before the perturbation was applied.

[0073] After steps 401-404, adversarial samples that meet the requirements of adversarial warfare can be obtained. .

[0074] Obtain adversarial examples of constellation diagram type Then, adversarial examples of constellation chart type. By performing a reverse conversion and remapping it back to the corresponding IQ signal, the perturbed IQ signal can be obtained, which is the adversarial sample of the IQ signal.

[0075] The adversarial example generation method for signal data provided in this embodiment generates adversarial examples from signal constellation diagram data. This method constructs attack adversarial examples from the perspective of signal constellation diagrams, rather than traditional IQ signals and spectral data. The generated adversarial examples possess an attack signal recognition model. The adversarial examples generated by this method can be used for adversarial attack and defense at the electromagnetic space signal level. It leverages the poor robustness and weak generalization ability of existing AI-based signal recognition system algorithms to generate adversarial examples that achieve the effects of interfering with and attacking the signal recognition model.

[0076] Example 2: Based on the adversarial example generation method for signal data provided in Embodiment 1 above, the present invention also provides an adversarial example generation apparatus for signal data that can be used to implement the above method, such as... Figure 5 The diagram shown is a schematic representation of the device architecture according to an embodiment of the present invention. The adversarial sample generation device for signal data in this embodiment includes one or more processors 11 and a memory 12. Figure 5 Take a processor 11 as an example.

[0077] Processor 11 and memory 12 can be connected via a bus or other means. Figure 5 Taking the example of a connection between China and Israel via a bus.

[0078] The memory 12 serves as a non-volatile computer-readable storage medium for an adversarial example generation method for signal data. It can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as the adversarial example generation method for signal data in Embodiment 1. The processor 11 executes various functional applications and data processing of the adversarial example generation device for signal data by running the non-volatile software programs, instructions, and modules stored in the memory 12, thereby implementing the adversarial example generation method for signal data in Embodiment 1.

[0079] Memory 12 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, memory 12 may optionally include memory remotely located relative to processor 11, which can be connected to processor 11 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0080] The program instructions / modules are stored in memory 12. When executed by one or more processors 11, they perform the adversarial example generation method for signal data described in Embodiment 1 above, for example, the method described above. Figures 1-4 The steps shown.

[0081] Those skilled in the art will understand that all or part of the steps in the various methods of the embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0082] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for generating adversarial examples for signal data, characterized in that, Specifically, it includes: The original IQ signal is divided into training and test sets, and then converted into constellation diagram type training and test sets. The deep neural network model is trained using the constellation diagram type training and test sets to obtain the trained signal recognition model. Constellation diagram type samples are input into the signal recognition model. The salient regions of the input samples are calculated using image interpretability methods, and the global perturbation of the input samples is calculated using gradient-based methods. The salient region perturbation is obtained based on the salient regions and the global perturbation. The process involves adding a salient region perturbation to the input sample to generate adversarial samples, and converting the constellation diagram type adversarial samples into IQ signal type adversarial samples. This includes: determining whether the salient region perturbation exceeds a set threshold; if so, the current adversarial sample generation fails; if not, determining whether the number of iterations for calculating the global perturbation exceeds a set number; if so, the current adversarial sample generation fails; if not, adding the salient region perturbation to the constellation diagram type sample to generate a perturbation sample; determining whether the perturbation sample and the input sample are classified consistently in the signal recognition model; if so, recalculating and updating the salient region perturbation until the classification of the generated perturbation sample is inconsistent with the classification of the input sample; using the inconsistently classified perturbation sample as the constellation diagram type adversarial sample, and converting the constellation diagram type adversarial sample into an IQ signal type adversarial sample. The step of obtaining the saliency region perturbation based on the saliency region and the global perturbation includes: constructing a matrix with the same size as the input sample; for each element of the matrix, when the value of the interpretability saliency map element of the saliency region is greater than 0, the value of the element at the corresponding position in the matrix is ​​1, otherwise, the value of the element is 0; combining the matrix and the global perturbation to obtain the intersection, and obtaining the perturbation value at the corresponding position of the saliency region, and using the perturbation value as the saliency region perturbation.

2. The adversarial example generation method for signal data according to claim 1, characterized in that, The process of dividing the original IQ signal into a training set and a test set specifically includes: Obtain a sample dataset of raw IQ data, and divide the sample dataset into a training set and a test set according to a preset ratio based on the sample label of each raw IQ data in the sample dataset.

3. The adversarial example generation method for signal data according to claim 1, characterized in that, The process of converting it into a constellation-type training and test set specifically includes: Based on the encoding methods corresponding to different modulation methods of the original IQ signals, the I-channel signal and Q-channel signal in the original IQ signals are used as the horizontal and vertical coordinates of the data in the constellation diagram, respectively. The two-dimensional coordinates corresponding to each original IQ signal are calculated based on the values ​​of the I-channel signal and Q-channel signal, and the set of two-dimensional coordinates of the original IQ signals is used as the constellation diagram dataset. Based on the division of the training and test sets of the original IQ signals, the constellation diagram dataset corresponding to the original IQ signals is divided into corresponding training and test sets.

4. The adversarial example generation method for signal data according to claim 1, characterized in that, The process of training a deep neural network model using a constellation-graph type training and test set to obtain a trained signal recognition model specifically includes: Build a deep neural network model, optimize and train the deep neural network model using a constellation graph-type training set, and test it using a constellation graph-type test set; Based on the test results, the network structure and parameters of the deep neural network model are adjusted until a deep neural network model with satisfactory classification performance is obtained and used as a signal recognition model.

5. The adversarial example generation method for signal data according to claim 1, characterized in that, The calculation of the salient regions of the input samples using image interpretability methods specifically includes: Obtain the feature map of the signal data extracted from the last convolutional layer of the signal recognition model; Obtain the sub-vectors corresponding to the target classification of the input sample, and calculate the importance of each feature map to the target classification based on the sub-vectors; Each feature map is weighted and summed with the importance of its corresponding feature map to obtain the activation map of each target classification on the sample. The interpretability saliency map corresponding to the activation map is taken as the saliency region of the sample.

6. The adversarial example generation method for signal data according to claim 1, characterized in that, The calculation of the global perturbation of the input sample using a gradient-based method specifically includes: The loss function of the signal recognition model is used to backpropagate and differentiate the input sample, and the global perturbation is obtained based on the initial perturbation threshold and the number of iterations.

7. An adversarial example generation device for signal data, characterized in that: The method includes at least one processor and a memory, which are connected via a data bus. The memory stores instructions that can be executed by the at least one processor. After being executed by the processor, the instructions are used to complete the adversarial sample generation method for signal data according to any one of claims 1-6.

Images