A method for evaluating and enhancing robustness of a deep eeg identity authentication model

Abstract

The application discloses a kind of robustness evaluation and enhancement method for deep brain electrical identity authentication model, belongs to biomedical engineering field;Its operation steps: the public electroencephalogram is operated, such as denoising, filtering and artifact removal, and high-quality electroencephalogram after pretreatment is obtained;Gradient attack and optimization attack method in white-box attack are used to calculate after the adversarial perturbation, and are added to the original electroencephalogram to generate adversarial sample;After the adversarial sample is input into network model, the classification performance of network model after attack is evaluated;Linear interpolation data mixing method is used in original sample and adversarial sample, and the adversarial sample of intermediate domain is generated;Intermediate sample and adversarial sample are simultaneously used for network adversarial training, to improve the recognition ability of network to disturbance and enhance robustness.The method disclosed in the application evaluates the robustness of network by using white-box attack, and proposes a mixed data adversarial training to enhance the defense mechanism, which improves the robustness of the model to a certain extent.

Description

Technical Field

[0001] This invention belongs to the field of biomedical engineering for EEG signal processing, specifically relating to a robustness evaluation and enhancement method for deep EEG identity authentication models. Background Technology

[0002] As society enters the digital age, identity authentication has become crucial in people's work and lives. Traditional authentication technologies, such as passwords and hardware tokens, can be forgotten, lost, or stolen, leading to identity leaks or authentication failures. These problems can be avoided by using biometric recognition technologies, such as facial recognition, fingerprint recognition, and gait analysis, which have been extensively studied. However, facial images are easily captured, fingerprints can be unknowingly attached to the surfaces of many objects, and gait can be recorded and analyzed unnoticed, potentially exploiting malicious attacks. Electroencephalography (EEG) signals possess the characteristic of liveness detection and have attracted considerable attention due to their resistance to coercion and non-invasiveness. Identity authentication technologies based on EEG signals employ waveform processing, machine learning, and deep learning methods, and their superior performance provides a solid foundation for the transition from theory to practical application.

[0003] However, research on adversarial attacks has shown that machine learning classifiers generally suffer from security and reliability issues. Deep learning models can be misled into outputting incorrect results by carefully designed and imperceptible noise interference. EEG analysis is also vulnerable to adversarial attacks when small perturbations are added to EEG data. Notably, EEG-based interference modules are feasible. The BtleJuice framework, designed for man-in-the-middle attacks on Bluetooth devices, has been developed to intercept, modify, and then transmit data from consumer-grade EEG-based BCI systems to EEG devices. Particularly in the context of EEG signal authentication, errors in authentication could lead to serious consequences such as substantial financial losses in financial transactions and accidental firing in military operations.

[0004] Adversarial attacks in EEG identity authentication models primarily focus on adding a perturbation module between the signal processing module and the machine learning model. This module adds a subtle, imperceptible perturbation to the original signal to generate adversarial examples, which can effectively deceive the module during model testing, causing it to output incorrect person identity categories. Currently, research on the robustness of EEG identity authentication models is still scarce. Ensuring the security and reliability of EEG identity authentication systems remains an unresolved issue. Therefore, this invention verifies and addresses the potential security problems and defenses related to EEG identity authentication technology. Summary of the Invention

[0005] Purpose of the invention: The purpose of this invention is to provide a robustness evaluation and enhancement method for deep EEG identity authentication models.

[0006] Technical solution: The present invention provides a method for evaluating and enhancing the robustness of a deep EEG identity authentication model, including its specific operational steps;

[0007] Step (1): Preprocess the publicly available EEG dataset to obtain high-quality EEG signals;

[0008] Step (2): Generate adversarial perturbations using a white-box attack method and add them to the original signal to generate adversarial samples;

[0009] Step (3): Evaluate the model classification results after inputting adversarial examples, and calculate its accuracy, fool rate and structural similarity index;

[0010] Step (4): Using the data fusion adversarial training method, the intermediate domain samples are added to the adversarial training to obtain a model classifier with improved robustness.

[0011] Step (5): Evaluate the accuracy of the defense method on the improved robust model classifier after inputting adversarial examples to verify the effectiveness of the defense method.

[0012] Furthermore, in step (1), the preprocessing method specifically includes data channel selection, signal filtering, downsampling, data segmentation, and baseline processing;

[0013] (1.1) Channel selection: EEG data includes data from different channels on the scalp. The first 32 channels corresponding to the required EEG signal are selected from these data.

[0014] (1.2) Signal filtering: Filter the signal to the required frequency range and use independent component analysis to remove artifacts of eye movement and muscle movement;

[0015] (1.3) Downsampling: The sampling range of the public dataset is 512Hz, and in order to improve computational efficiency, it is resampled to 128Hz;

[0016] (1.4) Data Segmentation and Baseline Processing: In order to increase the number of samples, the size of a single sample is defined as a signal matrix of 32×128, and the signal is divided into 63 parts according to the average of adjacent and non-overlapping time slices.

[0017] The average value of the baseline data from the first three seconds is used as the baseline signal to correct the data.

[0018] Furthermore, in step (2), the white-box attack methods are mainly divided into gradient attacks and optimization attacks; wherein, the gradient attacks are the single-step attack fast gradient sign method and the iterative attack projective gradient descent method, and the optimization attack is the CW attack.

[0019] Furthermore, in step (3), the adversarial samples generated by the attack method in step (2) are used as input to the classifier;

[0020] The evaluation metrics mainly include accuracy, fool rate, and structural similarity index; accuracy and fool rate are used to evaluate performance changes, and structural similarity index is used to evaluate the range of disturbances.

[0021] Furthermore, in step (4), the data mixing method involves randomly selecting two samples from the original samples and adversarial samples, mixing them in a certain proportion to generate new samples, and simultaneously mixing the data labels in the same proportion to generate new labels.

[0022] Furthermore, in step (5), the adversarial training uses the intermediate domain samples generated in (4) together with the adversarial samples to feed back into the classifier model, thereby improving the model's ability to recognize adversarial perturbations.

[0023] After completing the adversarial training, the adversarial samples are input into the enhanced robust model to evaluate the classification results.

[0024] Beneficial effects: Compared with the prior art, the present invention is characterized by the following: The robustness evaluation and enhancement system for deep EEG identity authentication model proposed in this invention not only evaluates the robustness of the EEG identity authentication model and shows that the EEG-based identity authentication system has potential security risks, but also proposes a hybrid data augmentation defense mechanism, which improves the robustness of the model to a certain extent. Attached Figure Description

[0025] Figure 1 This is the overall flowchart of the present invention;

[0026] Figure 2 This is an experimental flowchart of the hybrid data enhancement defense mechanism proposed in this invention;

[0027] Figure 3 This is a comparison chart of the saliency graph visualization results used in this invention to evaluate the attack results;

[0028] Figure 4 This is a comparison chart of the feature map visualization results for evaluating the attack results of this invention. Detailed Implementation

[0029] To more clearly illustrate the technical solution of the present invention, the technical solution of the present invention will be further described in detail below with reference to the accompanying drawings:

[0030] As shown in the figure, the specific operation steps of the robustness evaluation and enhancement method for deep EEG identity authentication models described in this invention are as follows:

[0031] Step (1): Preprocess the EEG signals;

[0032] Specifically, it includes:

[0033] (1.1) Channel selection: EEG data includes data from different channels on the scalp. The first 32 channels corresponding to the required EEG signal are selected from these data.

[0034] (1.2) Signal filtering: Filter the signal to the required frequency range and use independent component analysis to remove artifacts of eye movement and muscle movement;

[0035] (1.3) Downsampling: The sampling range of the public dataset is 512Hz, and in order to improve computational efficiency, it is resampled to 128Hz;

[0036] (1.4) Data Segmentation and Baseline Processing: In order to increase the number of samples, the size of a single sample is defined as a signal matrix of 32×128, and the signal is divided into 63 parts according to the average of adjacent and non-overlapping time slices.

[0037] The average value of the baseline data from the first three seconds is used as the baseline signal to correct the data.

[0038] Step (2): Generate adversarial perturbations using a white-box attack method and add them to the original signal to generate adversarial samples;

[0039] Specifically, based on an understanding of the model structure and parameters, a new dataset consisting of adversarial signals was first constructed using a white-box attack method, which mainly relies on gradient calculation.

[0040] This invention mainly employs gradient-based and optimization-based attack techniques for generation. The former primarily alters the gradient direction of the loss function during backpropagation to increase the value of the loss function.

[0041] The latter attempts to minimize perturbation while altering the model's classification results;

[0042] Specifically, the fast sign gradient method takes maximizing the loss value as the objective function. It calculates the direction of gradient ascent by taking the partial derivative of the loss value with respect to the original signal, multiplies it by a perturbation coefficient, and then adds a small perturbation to the original signal. The projected gradient descent method performs multiple iterations on the fast sign gradient method because the direction may not be completely correct when a nonlinear model only performs one iteration. The projected gradient descent method first starts from the L of the original sample... ∞Starting with a random perturbation of the norm, after calculating the gradient ascent direction, a gradient iteration step is taken. If the sampling point exceeds the constraint range, it is projected back to L. ∞ Norm constraints; repeat the above steps until convergence; CW attacks, while requiring adversarial examples to be misclassified, solve for minimizing the difference between adversarial examples and original examples. Essentially, this method is a constraint minimization problem:

[0043] f(x adv )=max(max{Z(x adv ) i : i≠t}-Z(x adv ) t ,-κ)

[0044]

[0045] Where c is the penalty factor, used to balance the relationship between classification results and distance, affecting the proportion of perturbation constraints and classification results; Z(x adv ) Calculate the class distribution probability of the output of the last layer; the neural network will select the class with the highest class distribution probability as the output class. In this case, the smaller the value of the output of f(x), the greater the probability of classifying it as t. If t is not any of the true labels of the sample, the attack on the model can be successful. κ is the confidence constant. The larger κ is, the higher the confidence of the classification error.

[0046] Step (3): Evaluate the model classification results after inputting adversarial examples, and calculate its accuracy, fool rate and structural similarity index;

[0047] Specifically, classification accuracy, foolproof rate, and structural similarity index are the main evaluation indicators.

[0048] Among them, classification accuracy and fool rate are used to evaluate model robustness, while structural similarity index is used to evaluate the difference between adversarial example signals and original signals. The fool rate is the proportion of correctly classified results that change to incorrect categories after an adversarial example signal is input into a trained model; a higher fool rate indicates a greater decrease in model accuracy and poorer robustness after an attack. The structural similarity index mainly evaluates three components: illumination, contrast, and structure; the formula is expressed as:

[0049]

[0050] Where u and σ represent the mean and variance of the image, and c1 and c2 are the dynamic range constants of pixel values;

[0051] The larger the SSIM, the higher the similarity between the adversarial signal and the original signal, and the more difficult it is to detect the interference of the adversarial signal;

[0052] Step (4): Using the data fusion adversarial training method, the intermediate domain samples are added to the adversarial training to obtain a model classifier with improved robustness.

[0053] Specifically, to improve the coverage space of samples in adversarial training, intermediate samples are generated by linear interpolation between the original samples and adversarial samples:

[0054]

[0055]

[0056] Here, λ follows a beta distribution with parameters α. When α approaches 0, the beta distribution becomes a binomial distribution, and λ takes only 0 and 1 values. This is equivalent to no data augmentation.

[0057] Adversarial examples cause classification errors because they cross the decision boundary, while the samples constructed in this invention are closer to the decision boundary, which can enable the nonlinear model to have a more refined perception and fitting ability of the decision boundary during training.

[0058] Step (5): Train the network against adversarial attacks using intermediate samples and adversarial samples simultaneously to improve the network's ability to identify disturbances and enhance its robustness.

[0059] Specifically, adversarial training adds generated adversarial examples to the training dataset. During retraining, the model can learn the adversarial examples first, thus improving its ability to distinguish them.

[0060] Adversarial training, which maximizes the perturbation while minimizing the expected risk, is essentially a minimization problem:

[0061]

[0062] Where θ represents the model parameters, n represents the number of training samples, f represents the model classifier, and x adv Let represent the adversarial example, and y be the correct label of the sample; different weights are assigned to the samples according to their proportions when calculating the loss; the loss value is defined as the sum of the cross-entropy of the original space and the mixed data space, i.e.:

[0063] L=λL1+(1-λ)L2

[0064] L1 = Lc(f(cat(x,x)) adv )),cat(y,y adv ))

[0065]

[0066] Here, `cat` is a concatenation operation that trains the original samples and adversarial samples together.

[0067] Example:

[0068] 1. Experimental Data: The DEAP dataset is a multi-channel brain signal dataset based on stimulation induced by watching music video clips. It primarily collected electroencephalograms (EEGs) of 32 participants while watching 40 music videos. The sampling frequency of this dataset was 512Hz, and to improve computational efficiency, it was resampled to 128Hz. After collecting data from 40 video clips, a signal matrix of 32×40×40×8064 was obtained, where 32 represents the number of participants, 40 represents the number of music videos and electrode channels, and 8064 contains 63 seconds of data at a frequency of 128Hz; the first 3 seconds were a silent period for baseline signal acquisition.

[0069] 2. Experimental setup:

[0070] The ten-fold cross-validation method was used, where all data were shuffled and divided into ten equal parts. One part was randomly selected as the test data, and the remaining nine parts were used as the training set. The experimental network models used were EEGNet, LSTM, and Transformer. In the fast gradient sign method, the perturbation range ε ​​was set to 2 / range and 3 / range, where range represents the dynamic range of EEG signal sampling values. For the projective gradient descent method, ε was set to 2 / range and 4 / range, and the number of iterations t was 20 and 40, respectively. The L2 distance metric function was used in the CW attack.

[0071] 3. Experimental results (as shown in Tables 1 and 2):

[0072] Table 1: Attack results of different attack methods on model metrics

[0073]

[0074] Table 2: Results of Defense Methods Improving Network Accuracy

[0075]

[0076] Table 1 summarizes the impact of different attack methods and attack scales on the model performance. Experimental results show that the model is susceptible to adversarial examples; adding a small amount of perturbation leads to a sharp drop in accuracy and an increase in the fool rate. Although the model showed good performance on the original signal for the identity recognition task, the accuracy of the model decreased to varying degrees when subjected to adversarial example attacks. In the task scenario of this invention, the EEGNet network model is the most robust overall, with the lowest fool rate under all three attack methods, the lowest being 41.8%, indicating that the model is relatively least likely to be deceived. The model accuracy gradually decreases as the perturbation threshold increases, and the similarity between the adversarial example and the original sample also decreases. However, the results of SSIM show that the changes of the generated perturbation to the original sample are not easily noticeable (all >0.95).

[0077] The proposed method and the classic adversarial training method were used to defend against fast gradient symbol attacks. The performance results are shown in Table 2. Compared with the attacked model, the proposed method improved the accuracy of the three models by 48.3%, 62.1% and 69.4% respectively. Compared with traditional adversarial training, the proposed method improved the accuracy by 1.2%, 0.5% and 2.1% respectively, which verifies the effectiveness of the proposed method to a certain extent.

[0078] Figure 3 The image shows the feature map generated after the data undergoes the first convolutional pooling computation by EEGNet. It can be seen from the image that there is a large difference between the high-dimensional features extracted by the model after the adversarial examples and the original samples. The difference in the feature information that the model focuses on leads to the network misclassifying the adversarial examples.

[0079] Figure 4 The results show that the highlighted areas of the saliency map of the samples changed after the perturbation was added. This indicates that the addition of the adversarial perturbation caused a change in the sampling points that affect the gradient, guiding the model to focus on unimportant areas and further leading to classification errors.

[0080] Finally, it should be understood that the embodiments described in this invention are only used to illustrate the principles of the embodiments of this invention; other variations may also fall within the scope of this invention; therefore, as examples rather than limitations, alternative configurations of the embodiments of this invention can be regarded as consistent with the teachings of this invention; correspondingly, the embodiments of this invention are not limited to the embodiments explicitly introduced and described in this invention.

Claims

1. A method for evaluating and enhancing the robustness of a deep electroencephalogram identity authentication model, characterized in that, The specific operation steps are as follows: Step (1), the electroencephalogram signal in the public data set is denoised, filtered and artifact removed, so that the high-quality electroencephalogram signal after preprocessing is obtained; Step (2), the gradient attack and optimization attack method in the white box attack is used to calculate the adversarial perturbation, and the original electroencephalogram signal is added to generate an adversarial sample; Step (3), after the adversarial sample is input into the network model, the classification performance of the attacked network model is evaluated; Step (4), the linear interpolation data mixing method is used in the original sample and the adversarial sample to generate the adversarial sample in the intermediate domain; The data mixing method is to randomly select two samples in the original sample and the adversarial sample, and mix them in proportion to generate a new sample, and the data label is also mixed in the same proportion to generate a new label; Step (5), the intermediate sample and the adversarial sample are used for network adversarial training at the same time, so as to improve the recognition ability of the network to the perturbation and enhance the robustness; Specifically, the generated adversarial sample is added to the training data set, and the model can learn the adversarial sample once in the retraining process, so as to have better discrimination; The adversarial training maximizes the perturbation and minimizes the expected risk, which is essentially a maximum-minimization problem: Wherein, θ represents the model parameters, n represents the number of training samples, f represents the model classifier, x adv represents the adversarial sample, y is the correct label of the sample; different weights are given according to the different proportions of the samples when calculating the loss; the loss value is defined as the sum of the cross entropy of the original space and the mixed data space, that is: L=λL1+(1-λ)L2 L1 = Lc(f(cat(x, x adv )), cat(y, y adv )) Where, cat is a concatenation operation, and the original sample and the adversarial sample are trained together.

2. The method for evaluating and enhancing the robustness of the deep electroencephalogram identity authentication model according to claim 1, characterized in that: In step (1), the specific steps of preprocessing the electroencephalogram signal are as follows: (1.1), channel selection: the electroencephalogram data contains data of different channels on the scalp, and the first 32 channels corresponding to the required EEG signal are selected; (1.2), signal filtering: filter the signal to the required frequency range, and use independent component analysis technology to remove the artifacts of eye movement and muscle movement; (1.3), downsampling: the sampling range of the public data set is 512Hz, and the sampling rate is reduced to 128Hz to improve the calculation efficiency; (1.4), data segmentation and baseline processing: to expand the number of samples, the size of a single sample is defined as a 32x128 signal matrix, and the signal is divided into 63 parts according to adjacent and disjoint time slices; The average value of the first three seconds of baseline data is taken as the baseline signal, and the data is corrected.

3. The method for evaluating and enhancing the robustness of the deep electroencephalogram identity authentication model according to claim 1, characterized in that: In step (2), the white box attack method is divided into gradient attack and optimization attack; Wherein, the gradient attack is single-step attack fast gradient sign method and iterative attack projection gradient descent method respectively; The optimization attack is CW attack.

4. The method for evaluating and enhancing the robustness of the deep electroencephalogram identity authentication model according to claim 1, characterized in that: In step (3), the adversarial sample generated by the attack method in step (2) is input into the classifier; Wherein, the evaluation index adopts accuracy, fooling rate and structural similarity index; The accuracy and fooling rate are used to evaluate the performance change, The structural similarity index is used to evaluate the range of perturbations.

5. The method of claim 1, wherein the method further comprises: In step (5), the adversarial training utilizes the intermediate domain samples generated in (4) and the adversarial samples to input the classifier model together, improving the recognition ability of the model to the adversarial perturbation. After the final completion of the adversarial training, the adversarial samples are input into the model with enhanced robustness to evaluate the classification results.

Images