Sample attack defense effect explainable driving electromagnetic signal perception method

Abstract

The embodiment of the application relates to the technical field of wireless communication, in particular to a sample attack defense effect explainable driving electromagnetic signal sensing method, which comprises the following steps: acquiring IQ data of an original electromagnetic signal, and generating normal samples based on the IQ data; adding attacks to the IQ data to obtain IQ data after attacks, and generating adversarial samples based on the IQ data after attacks; based on the adversarial samples, checking feature representation inside a neural network from the perspective of model failure, explaining attack effects of samples in an electromagnetic signal sensing process, and verifying success of adversarial sample generation; based on a deep neural network model, performing adversarial defense through adversarial training, and verifying adversarial defense verification using adversarial training from an explainable perspective by adopting a gradient-based class activation mapping method. The sample attack defense effect explainable driving electromagnetic signal sensing method provided by the application can realize intelligent sensing of electromagnetic signal samples with explainable attack defense effects.

Description

Technical Field

[0001] This application relates to the field of wireless communication technology, and in particular to an electromagnetic signal sensing method with interpretable sample attack defense effect. Background Technology

[0002] Radio spectrum is a fundamental resource in the communications field, and it is extremely scarce and non-renewable. Wireless communication services are becoming increasingly important in daily life, and the demand for spectrum bandwidth from communication technologies is also increasing. This is causing the limited spectrum resources to become increasingly scarce, leading to the problem of spectrum shortage. Spectrum sensing helps users identify idle spectrum resources and reuse them. The effectiveness of spectrum sensing directly impacts the efficiency of electromagnetic spectrum utilization and is of great significance in alleviating the current scarcity of spectrum resources.

[0003] Deep learning has become a research hotspot, greatly facilitating the perception of modulated signal spectra. However, artificial intelligence models face serious threats from adversarial examples, significantly reducing the reliability and security of deep machine learning tasks. Attackers can use the gradient information of deep neural networks to add tiny pixel perturbations to original clean samples to deceive deep learning models, resulting in a significant reduction in model performance. The black-box nature of deep neural networks themselves, along with adversarial examples that disable them, makes them difficult to apply directly to high-risk fields such as medical decision-making. Therefore, the interpretability of deep networks has attracted much attention, and adversarial attacks have become an important research direction in neural network security.

[0004] Currently, the interpretability of deep learning is mainly divided into two categories: pre-examination interpretability and post-examination interpretability. Pre-examination interpretability is mostly applicable to traditional machine learning. These machine learning models are usually simple in structure, easy to implement, and belong to self-explaining models. Their interpretability is inherent, and people can easily understand their decision-making process. Linear regression and decision trees are typical examples of this type of model. Since deep neural networks often lack interpretability and their features are difficult to understand, post-examination interpretability methods are more suitable for deep learning than pre-examination interpretability methods.

[0005] Post-hoc interpretability methods are highly flexible and widely applicable, providing decision-making support without modifying the model structure and parameters. They also address the limitation of pre-hoc interpretability methods in interpreting complex models. Most post-hoc interpretability methods provide explanations for predictions on single images during the testing phase. These explanations are typically visual, providing heatmaps or saliency maps highlighting regions or pixels in the original image that play a crucial role in prediction. However, current research on interpretability methods primarily focuses on image classification and concentrates solely on explaining and analyzing predictions for normal samples, neglecting adversarial examples that the model may encounter in real-world scenarios. Summary of the Invention

[0006] This application provides an electromagnetic signal sensing method driven by the interpretability of sample attack and defense effects. It utilizes adversarial examples to examine the feature representation inside the neural network from the perspective of model failure, thereby achieving intelligent sensing of electromagnetic signal samples with interpretable attack and defense effects.

[0007] To address the aforementioned technical problems, in a first aspect, embodiments of this application provide an electromagnetic signal sensing method driven by interpretable sample attack defense effects, comprising the following steps: acquiring IQ data of the original electromagnetic signal, and generating normal samples based on the IQ data; adding attacks to the IQ data to obtain attacked IQ data, and generating adversarial samples based on the attacked IQ data; examining the feature representations within the neural network from the perspective of model failure based on the adversarial samples, interpreting the attack effect of the samples during electromagnetic signal sensing, and verifying the successful generation of adversarial samples; and performing adversarial defense through adversarial training based on a deep neural network model, employing a gradient-based class activation mapping method to verify the adversarial defense verification using adversarial training from an interpretable perspective.

[0008] In some exemplary embodiments, generating normal samples based on the IQ data includes: drawing a cyclic spectrum based on the IQ data; generating normal samples based on the cyclic spectrum; wherein drawing the cyclic spectrum includes the following steps: performing Fourier expansion on the autocorrelation function of the original electromagnetic signal, wherein the coefficients of the expanded autocorrelation function are cyclic autocorrelation functions; performing Fourier transform on the cyclic autocorrelation function to obtain a cyclic spectrum function; discretizing the original electromagnetic signal, multiplying the time-domain phases corresponding to the frequency-domain phases after discretization, calculating the time-domain correlation by transforming it into point-by-point multiplication in the frequency domain using DFT, obtaining the cyclic spectrum from the frequency domain, and thus obtaining the cyclic spectrum.

[0009] In some exemplary embodiments, a fast gradient symbol attack method is used to add attacks to the IQ data.

[0010] In some exemplary embodiments, based on the adversarial examples, the feature representation inside the neural network is examined from the perspective of model failure, the attack effect of the samples during electromagnetic signal perception is explained, and the successful generation of adversarial examples is verified. This includes the following steps: obtaining a feature map by calculating weights using a gradient-based class activation mapping method and global average gradient; performing a weighted summation on the weights corresponding to the feature map, and visualizing the distinguishing regions of the neural network in the form of a heatmap, thereby explaining the attack effect of the samples during electromagnetic signal perception and verifying the successful generation of adversarial examples.

[0011] In some exemplary embodiments, the gradient-based class activation mapping method includes the following steps: in the case of classification, the deep neural network performs pooling processing on the convolutional feature maps before the final output layer, and uses the convolutional features as features of the fully connected layer that generates the desired output; calculates the gradient of each pixel of the highest-level feature map with respect to the target class score during backpropagation; averages the gradients of the pixels in each channel to obtain the weights corresponding to each channel; multiplies the weights corresponding to each channel with each feature map to obtain a highlighted image; and superimposes the highlighted image onto the original image through a transformation to obtain a class activation map.

[0012] In some exemplary embodiments, the adversarial defense based on a deep neural network model through adversarial training includes: constructing a deep neural network model; wherein the deep neural network model is a deep residual network model; adding the adversarial examples to the adversarial training process, updating the parameters of the deep neural network model so that the updated parameters can resist the influence of the adversarial examples; wherein the adversarial training process is represented as:

[0013]

[0014] Where D represents the data distribution, S(x) represents the allowed adversarial example region, and L(f) represents the region of adversarial examples. θ (x * ), y) represent the network loss function.

[0015] In some exemplary embodiments, the construction of the deep neural network model includes the following steps: using the cyclic spectra of the normal samples and the adversarial samples as network input; after passing through several basic convolutional layers, cascading several residual modules to obtain features; after the features are processed by an average pooling layer to obtain pooled features, and sending the pooled features to a fully connected layer; the classification layer outputs a signal class confidence vector and a noise class confidence vector; based on the pooled features and hyperparameters, the network is trained, and the presence or absence of a signal is determined using the output confidence of the classification layer.

[0016] Secondly, embodiments of this application also provide an electromagnetic signal sensing system driven by interpretable sample attack defense effects, comprising: a normal sample construction module, an adversarial sample construction module, an attack effect interpretation module, and an adversarial defense verification module connected in sequence; the normal sample construction module is used to acquire IQ data of the original electromagnetic signal and generate normal samples based on the IQ data; the adversarial sample construction module is used to add attacks to the IQ data to obtain attacked IQ data, and generate adversarial samples based on the attacked IQ data; the attack effect interpretation module is used to examine the feature representation inside the neural network from the perspective of model failure based on the adversarial samples, interpret the attack effect of the samples in the electromagnetic signal sensing process, and verify the successful generation of adversarial samples; the adversarial defense verification module is used to perform adversarial defense through adversarial training based on a deep neural network model, and to verify the adversarial defense verification using adversarial training from an interpretable perspective using a gradient-based class activation mapping method.

[0017] The technical solution provided in this application has at least the following advantages:

[0018] This application provides an electromagnetic signal sensing method with interpretable sample attack defense effect. The method includes the following steps: acquiring the IQ data of the original electromagnetic signal and generating normal samples based on the IQ data; adding attacks to the IQ data to obtain attacked IQ data, and generating adversarial samples based on the attacked IQ data; examining the feature representation inside the neural network from the perspective of model failure based on the adversarial samples, interpreting the attack effect of the samples in the electromagnetic signal sensing process, and verifying the successful generation of adversarial samples; and performing adversarial defense through adversarial training based on a deep neural network model, using a gradient-based class activation mapping method to verify the adversarial defense verification using adversarial training from an interpretable perspective.

[0019] This application provides an electromagnetic signal sensing method driven by interpretable sample attack defense effects. Addressing the problem of electromagnetic signal cyclic spectrum sensing, it utilizes adversarial examples to examine the feature representations within the neural network from the perspective of model failure. Through visualization analysis, inconsistencies are found between the features learned by the deep neural network and those seen by humans, thus explaining the attack effects of samples during electromagnetic signal sensing. Furthermore, this application employs adversarial training for adversarial defense and utilizes a gradient-based class activation mapping method to explain the sample defense effects from an interpretable perspective, thereby achieving intelligent electromagnetic signal sample sensing where both attack and defense effects are interpretable. Attached Figure Description

[0020] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations do not constitute a limitation on the embodiments, and unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0021] Figure 1 A flowchart illustrating an electromagnetic signal sensing method with interpretable sample attack defense effect provided in an embodiment of this application;

[0022] Figure 2 A schematic diagram of the structure of an electromagnetic signal sensing system with interpretable sample attack defense effect provided in an embodiment of this application;

[0023] Figure 3 A schematic diagram of the framework of an electromagnetic signal sensing method that can be interpreted to demonstrate the sample attack defense effect according to an embodiment of this application;

[0024] Figure 4 A schematic diagram illustrating the principle of a gradient-based class activation mapping (Grad-CAM) method provided in an embodiment of this application;

[0025] Figure 5 A schematic diagram illustrating the process of generating adversarial examples based on IQ data according to an embodiment of this application;

[0026] Figure 6 This is a schematic diagram of the structure of the basic residual block involved in one embodiment of the method of this application;

[0027] Figure 7 This is a schematic diagram showing the training accuracy curve and testing accuracy curve of a deep neural network model before and after adversarial defense in an embodiment of this application.

[0028] Figure 8 The curves showing the variation of BPSK recognition accuracy with disturbance amount under different pre-trained models;

[0029] Figure 9 The following diagrams illustrate the cyclic spectrum of the method in this application embodiment and the Grad-CAM heatmaps of the adversarial samples before and after defense under different perturbations when the modulation signal BPSK has an SNR of 10dB.

[0030] Figure 10 The following diagrams illustrate the cyclic spectrum of the method in this application embodiment and the Grad-CAM heatmaps of the adversarial samples before and after defense under different perturbations when the modulation signal BPSK has an SNR of 5dB.

[0031] Figure 11 The schematic diagram of the cyclic spectrum of the method in the embodiment of this application and the schematic diagram of the Grad-CAM heat map of the adversarial sample before and after defense under different perturbations are shown for the modulation signal BPSK when SNR=0dB.

[0032] Figure 12 The schematic diagram of the cyclic spectrum of the method in the embodiment of this application and the schematic diagram of the Grad-CAM heat map of the adversarial sample before and after defense under different perturbations are shown for the modulation signal BPSK when SNR = -5dB.

[0033] Figure 13 For the modulated signal BPSK at SNR = -10dB, the schematic diagram of the cyclic spectrum of the method in the embodiments of this application and the schematic diagram of the Grad-CAM heat map of the adversarial sample before and after defense under different perturbations are shown.

[0034] Figure 14 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0035] As can be seen from the background technology, most of the existing research on the aforementioned interpretability methods is focused on the field of image classification, and only focuses on interpreting and analyzing the model's predictions of normal samples, while ignoring the adversarial examples that the model may encounter in real-world scenarios.

[0036] Currently, research on the interpretability of deep learning is still in its exploratory stage. Existing interpretability is mainly divided into two categories: pre-existing interpretability and post-existing interpretability. Pre-existing interpretability is mostly applicable to traditional machine learning. These machine learning models are usually simple in structure, easy to implement, and belong to self-explaining models. Their interpretability is embedded within themselves, and people can easily understand their decision-making process. Linear regression and decision trees are typical examples of this type of model. Currently, some researchers have also added some constraints to the structure of deep learning models to reduce model complexity while ensuring model performance, thereby interpreting the internal features of the model. For example, a correlation technique constrains the learning of filters, training interpretable filters so that each filter focuses on specific target parts. However, since deep neural networks often lack interpretability and their features are difficult to understand, post-existing interpretability methods are more suitable for deep learning than pre-existing interpretability methods.

[0037] Post-hoc interpretability methods are highly flexible and widely applicable, providing decision-making support without modifying model structure and parameters. They also address the limitation of pre-hoc interpretability methods in interpreting complex models. Most post-hoc interpretability methods provide explanations for predictions on a single image during the testing phase. These explanations are typically visual, providing a heatmap or saliency map highlighting regions or pixels in the original image that play a crucial role in prediction. Another related technique proposes a deconvolution-based visualization method, which maps intermediate layer features back into pixel space to observe what inputs lead to specific outputs, thus understanding what each layer of the convolutional neural network has learned. However, the generated visualizations often contain significant noise, resulting in poor interpretability and making it difficult to determine which pixels truly played a significant role in prediction. Based on this, another related technique proposes GAP-CAM (Global Average Pooling Class Activation Mapping) to locate the input image region most relevant to a specific output class. However, this method requires adjusting the model structure by inserting a global average pooling layer, thus limiting its flexibility and applicability to all models. Selvaraju proposed a method called Grad-weighted Class Activation Mapping (Grad-CAM), which focuses on more accurately locating features and further improves visualization.

[0038] In summary, most current research on interpretability methods focuses on image classification and only addresses the interpretation and analysis of the model's predictions for normal samples, while neglecting adversarial examples that the model may encounter in real-world scenarios.

[0039] To address the aforementioned issues, this application provides an electromagnetic signal sensing method driven by interpretable sample attack defense effects, comprising the following steps: acquiring IQ data of the original electromagnetic signal and generating normal samples based on the IQ data; adding attacks to the IQ data to obtain attacked IQ data, and generating adversarial samples based on the attacked IQ data; examining the feature representations within the neural network from the perspective of model failure based on the adversarial samples, and interpreting the attack effect of the samples during the electromagnetic signal sensing process; and performing adversarial defense through adversarial training based on a deep neural network model, using a gradient-based class activation mapping method to verify the adversarial defense verification using adversarial training from an interpretable perspective. This application provides an electromagnetic signal sensing method driven by interpretable sample attack defense effects, utilizing adversarial samples to examine the feature representations within the neural network from the perspective of model failure, thereby achieving intelligent sensing of electromagnetic signal samples with interpretable attack and defense effects.

[0040] The embodiments of this application will now be described in detail with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been provided in the embodiments of this application to facilitate a better understanding of the application. However, the technical solutions claimed in this application can be implemented even without these technical details and various variations and modifications based on the following embodiments.

[0041] See Figure 1 This application provides an electromagnetic signal sensing method with interpretable sample attack defense effectiveness, comprising the following steps:

[0042] Step S1: Obtain the IQ data of the original electromagnetic signal, and generate a normal sample based on the IQ data.

[0043] Step S2: Add an attack to the IQ data to obtain the attacked IQ data, and generate adversarial samples based on the attacked IQ data.

[0044] Step S3: Based on adversarial examples, examine the feature representation inside the neural network from the perspective of model failure, explain the attack effect of the samples in the electromagnetic signal perception process, and verify the successful generation of adversarial examples.

[0045] Step S4: Based on the deep neural network model, adversarial defense is carried out through adversarial training. The gradient-based class activation mapping method is used to verify the use of adversarial training for adversarial defense from an interpretable perspective.

[0046] This application provides an electromagnetic signal sensing method driven by interpretable sample attack defense effects. First, the IQ data of the original electromagnetic signal is acquired, and a cyclic spectrum is plotted based on the IQ data to generate normal samples. Next, an attack is added to the original IQ data to obtain attacked IQ data, and a cyclic spectrum is plotted based on the attacked IQ data to generate adversarial samples. Then, the adversarial samples are used to examine the feature representations within the neural network from the perspective of model failure, interpreting the attack effect of the samples during electromagnetic signal sensing to verify the successful generation of adversarial samples. Finally, adversarial defense is implemented through adversarial training. The Grad-CAM method, combined with the basic principles of class activation mapping, is used from an interpretable perspective. By utilizing the weighted combination of the highest-level feature maps of the convolutional neural network, an interpretable effect with class discrimination is obtained. This application experimentally verifies that adversarial training can achieve a certain degree of adversarial defense, thus realizing intelligent sensing of electromagnetic signal samples with interpretable attack and defense effects.

[0047] See Figure 2This application also provides an interpretable-driven electromagnetic signal sensing system, characterized by comprising: a normal sample construction module 101, an adversarial sample construction module 102, an attack effect interpretation module 103, and an adversarial defense verification module 104 connected in sequence; the normal sample construction module 101 is used to acquire the IQ data of the original electromagnetic signal and generate normal samples based on the IQ data; the adversarial sample construction module 102 is used to add attacks to the IQ data to obtain attacked IQ data, and generate adversarial samples based on the attacked IQ data; the attack effect interpretation module 103 is used to examine the feature representation inside the neural network from the perspective of model failure based on the adversarial samples, interpret the attack effect of the samples in the electromagnetic signal sensing process, and verify the successful generation of adversarial samples; the adversarial defense verification module 104 is used to perform adversarial defense through adversarial training based on a deep neural network model, and to verify the adversarial defense verification using adversarial training from an interpretable perspective using a gradient-based class activation mapping method.

[0048] In some embodiments, step S1, based on the IQ data, generates a normal sample, including the following steps:

[0049] Step S101: Based on the IQ data, draw the cyclic spectrum.

[0050] Step S102: Generate normal samples based on the cyclic spectrum.

[0051] The step S101 of drawing the cyclic spectrum includes the following steps:

[0052] Step S1011: Perform Fourier expansion on the autocorrelation function of the original electromagnetic signal, wherein the coefficients of the expanded autocorrelation function are cyclic autocorrelation functions.

[0053] Step S1012: Perform a Fourier transform on the cyclic autocorrelation function to obtain the cyclic spectrum function.

[0054] Step S1013: Discretize the original electromagnetic signal. After discretization, multiply the time-domain phases and corresponding frequency-domain phases. The correlation in the time domain is calculated by point-by-point multiplication in the frequency domain using DFT. The cyclic spectrum is obtained from the frequency domain, resulting in a cyclic spectrum diagram.

[0055] Specifically, in step S1, the autocorrelation function of the original electromagnetic signal is expanded using Fourier transform, and the coefficients after expansion are the cyclic autocorrelation function. The cyclic autocorrelation function is then subjected to Fourier transform, yielding the cyclic spectrum function. In computer processing, the signal needs to be discretized. After discretization, the time-domain correlation is multiplied by the corresponding frequency-domain correlation. The time-domain correlation can also be calculated using DFT, transforming it into point-by-point multiplication in the frequency domain, thus obtaining the cyclic spectrum from the frequency domain.

[0056] In some embodiments, step S2 employs a fast gradient symbol attack method to add an attack to the IQ data.

[0057] It should be noted that adversarial examples are samples in which an attacker adds minute, imperceptible perturbations to real samples, causing the model to make prediction errors. The method for constructing adversarial examples should first add the attack to the original IQ data, and then plot a cyclic spectrum based on the IQ data after the attack.

[0058] In some embodiments, step S3, based on the adversarial examples, examines the feature representations within the neural network from the perspective of model failure, interprets the attack effect of the examples during electromagnetic signal perception, and verifies the successful generation of the adversarial examples, including the following steps:

[0059] Step S301: Obtain the feature map by using a gradient-based class activation mapping method and calculating the weights using the global average gradient.

[0060] Step S302: The weights corresponding to the feature map are weighted and summed to visualize the distinguishing regions of the neural network in the form of a heat map, thereby explaining the attack effect of the sample during the electromagnetic signal perception process and verifying the successful generation of adversarial examples.

[0061] Specifically, normal samples (real samples) and adversarial samples can be used to study the behavior of deep neural networks from both positive and negative perspectives. Real samples can be used to analyze why the model makes correct predictions, while adversarial samples can be used to analyze why the model makes errors, thus providing a deeper understanding of the interpretability of neural networks. After successfully adding perturbations to normal samples (clean samples), a gradient-based class activation mapping method is used to calculate weights using the global average gradient. The weights corresponding to the obtained feature maps are then weighted and summed. Finally, a heatmap is used to visualize the distinguishing regions of the neural network. From a human eye's perspective, there is no difference between normal samples and adversarial samples. Using the gradient-based class activation mapping method, two graphs are used to label different locations, explaining the attack effect of the samples during electromagnetic signal perception.

[0062] In some embodiments, the gradient-based class activation mapping method described in step S301 includes the following steps: In the case of classification, the deep neural network performs pooling processing on the convolutional feature maps before the final output layer, and uses the convolutional features as features of the fully connected layer that generates the desired output; calculates the gradient of each pixel of the highest layer feature map with respect to the target class score during backpropagation; averages the gradients of the pixels in each channel to obtain the weights corresponding to each channel; multiplies the weights corresponding to each channel with each feature map to obtain a highlighted image; and superimposes the highlighted image onto the original image through a transformation to obtain a class activation map.

[0063] Specifically, before the final output layer (softmax in the case of classification) of the deep neural network used for classification, pooling is performed on the convolutional feature maps, and these pooled features are used as features for the fully connected layers that produce the desired output (classification or other). In this network structure, the gradient of each pixel in the highest-level feature map with respect to the target class score is calculated during backpropagation, and then the gradients of pixels in each channel are averaged to obtain the weights for each channel. The weights are multiplied by each feature map to obtain a highlighted image, which is then transformed and superimposed onto the original image to obtain the class activation map. Gradient-based class activation mapping can intuitively label the distinguishing regions of specific classes, thus allowing for the interpretation of sample attack defense effects.

[0064] In some embodiments, step S4, based on a deep neural network model, performs adversarial defense through adversarial training, including:

[0065] Step S401: Construct a deep neural network model; wherein the deep neural network model is a deep residual network model.

[0066] Step S402: Add the adversarial examples to the adversarial training process to update the parameters of the deep neural network model, so that the updated parameters can resist the influence of the adversarial examples; wherein, the expression for the adversarial training process is:

[0067]

[0068] Where D represents the data distribution, S(x) represents the allowed adversarial example region, and L(f) represents the region of adversarial examples. θ (x * ), y) represent the network loss function.

[0069] Specifically, adversarial training is a typical and effective adversarial defense algorithm. Data augmentation is a classic and effective method for training neural networks; its basic idea is to enhance the model's decision-making experience by adding datasets. Based on this idea, this application proposes using adversarial examples to augment the dataset for adversarial defense. This application updates the model parameters by adding adversarial examples to the training process, making it resistant to the influence of adversarial examples. Specifically, adversarial training can be defined as a minimization problem, as shown in the expression for the adversarial training process above. The inner maximization problem is usually approximated by the adversarial examples generated by the attack algorithm, while the outer minimization problem can use the adversarial examples as training data to obtain a model with better attack resistance.

[0070] In some embodiments, the construction of the deep neural network model in step S401 includes the following steps:

[0071] Step S4011: Use the cyclic spectra of the normal sample and the adversarial sample as network input.

[0072] Step S4012: After several basic convolutional layers, several residual modules are cascaded to obtain features.

[0073] Step S4013: After the feature is processed by the average pooling layer, the pooled feature is obtained, and the pooled feature is sent to the fully connected layer.

[0074] Step S4014: The classification layer outputs the signal confidence vector and the noise confidence vector.

[0075] Step S4015: Based on the features after pooling and the hyperparameters, train the network and use the output confidence of the classification layer to determine the presence or absence of the signal.

[0076] It should be noted that the features after pooling are features extracted during the training of the neural network, cascaded, and then processed by the average pooling layer.

[0077] This application provides an electromagnetic signal sensing method driven by interpretable sample attack defense effects. This application primarily employs the Grad-CAM method, extending it from the image domain to the electromagnetic signal domain, and from normal samples to adversarial samples. Adversarial samples are used to examine the feature representations within the neural network from the perspective of model failure. Through visualization analysis, inconsistencies are found between the features learned by the deep neural network and the features perceived by humans, thus explaining the attack effects of samples during electromagnetic signal sensing. Simultaneously, this application also implements adversarial defense through adversarial training, utilizing a gradient-based class activation mapping method to verify the interpretability of adversarial training for a certain degree of adversarial defense, thereby achieving intelligent sensing of electromagnetic signal samples with interpretable attack and defense effects.

[0078] The electromagnetic signal sensing method and system with interpretable sample attack defense effect provided in this application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0079] Reference Figure 3 The first pre-trained model used during the attack was a deep learning model trained entirely on normal samples. The second pre-trained model used after the attack was a deep learning model trained using both normal and adversarial samples. A pre-trained model refers to a deep learning model that has already been trained on a pre-defined dataset. Figure 3Taking the BPSK cyclic spectra of normal samples at SNR = -10dB as an example, during the attack, the normal samples, after being pre-trained by Model 1, are classified as "BPSK" with a confidence level of 88.6%. With the perturbation amount ε set to 0.006, after being perturbed by the noise generated by the FSGM attack, the perturbed image still appears as "BPSK" to the human eye, but after being processed by the neural network, it is identified as "noise" with a confidence level of 53.5%.

[0080] It should be noted that the BPSK signal is a raw electromagnetic signal.

[0081] Two visually identical images were classified as different categories after an adversarial attack. Grad-CAM was used to label the distinguishing regions that were of interest during classification, providing an interpretable explanation of the attack effect on the samples. Figure 3 Taking the BPSK cyclic spectrum of normal samples at SNR=-10dB as an example, during defense, the classification result of normal samples after being pre-trained by Model 2 with adversarial training is "BPSK", with a recognition confidence of 89.3%. This shows that adversarial training does not reduce the model's classification accuracy for the original samples. After being perturbed by the noise generated by the FSGM attack, the samples are fed back into the pre-trained Model 2, and the classification result is still "BPSK", with the confidence reduced to 61.7%. This proves that adversarial training gives the network a certain degree of attack resistance. The defense effect is explained by the region of interest marked by Grad-CAM during recognition.

[0082] In the above implementation, Grad-CAM emphasizes the distinguishing regions of specific categories. A diagram illustrating the annotation principle of Grad-CAM is shown below. Figure 4 As shown. Suppose the last convolutional layer of the classification network has n feature maps, denoted as A. 1 A 2 , ...A n Let the final classification result be category c, then the weights of each feature map in the last convolutional layer are respectively

[0083] The idea behind Grad-CAM is to select the node with the largest softmax value (corresponding to the class with the highest confidence, i.e., class c) and backpropagate it to calculate the gradient of the last convolutional layer. The average gradient of each feature map is used as the weight of that feature map.

[0084]

[0085] Where A represents a feature layer, which in this application refers to the feature output by the last convolutional layer; k represents the k-th channel in feature layer A; c represents the category c; A k This represents the data of channel k in feature layer A; Representative targeting A k The weight, The calculation method is as follows:

[0086]

[0087] Among them, y c y represents the score predicted by the network for category c, where y c It did not go through the softmax activation layer. In the k-th channel of feature layer A, the data at position ij is on the left; Z is the size of the feature map, calculated as width multiplied by height.

[0088] The Grad-CAM method does not require changing the network structure. Instead, it calculates the gradient of each pixel in the highest-level feature map with respect to the target class score during backpropagation, and then averages the gradients of pixels in each channel to obtain the weights for each channel. The weights are multiplied by each feature map to obtain a highlighted image, which is then transformed and superimposed onto the original image to obtain the final Grad-CAM image. This method generates gradient-based class activation maps without modifying the original network. A pixel in the feature map corresponds to a region in the original image, and the pixel value represents the feature extracted from that region, as shown in the above formula. The size is determined by the pixel values ​​and weights in the feature map. A product of pixel values ​​and weights greater than 0 is beneficial for classifying samples into that category; that is, the CNN considers that region in the original image to have category-related features. Visualization results also show that the CNN correctly classifies because it notices the correct category-related features in the original image. Although Grad-CAM requires backpropagation to calculate gradients, when visualizing a single input image, only the gradients are needed to calculate the weights, without updating the network parameters. Therefore, retraining the network is unnecessary, greatly saving computational resources.

[0089] In the above embodiments, adversarial examples can be generated using the FSGM attack method. As mentioned earlier, adversarial examples refer to samples where an attacker adds tiny, imperceptible perturbations to real samples, causing the model to make prediction errors. The sample attack defense effect provided in this application, which is an interpretable-driven electromagnetic signal sensing method, should first add an attack to the original IQ data and then plot a cyclic spectrum based on the attacked IQ data. The Fast Gradient Sign Attack (FSGM) method is one of the most commonly used methods for generating adversarial examples. Its idea is based on the fact that stochastic gradient descent reduces the loss function value of the model's output for the input image, thus making the network output a correct prediction; if the calculated loss value is added to the input image to increase the loss value of the network's output, the network will tend to output an incorrect prediction. FSGM can be expressed as...

[0090]

[0091] x * =x+η

[0092] Where ε is the perturbation magnitude, x is the input sample, and l is the sample label. To calculate the gradient of the loss function with respect to x, sign() is the sign function, η is the generated perturbation, and the perturbation is superimposed on the original input sample to obtain the attack sample x. * .

[0093] Specifically, FSGM first calculates the gradient of the loss function with respect to the input, then normalizes it by taking the sign of the gradient, and multiplies it by the perturbation magnitude ε, so that the distance between the adversarial example and the real example satisfies ||x||. * -x|| ∞ ≤ε.

[0094] The process of generating adversarial examples is as follows: Figure 5 As shown. Figure 5 The pre-trained model in the diagram is denoted as model_mat.pth, which is generated by feeding the signal's IQ data (signal.mat) and noise data of the same size (noise.mat) into a neural network. An FSGM attack is then added to model_mat.pth on signal.mat, generating perturbation noise by calculating the gradient of the loss function with respect to the signal samples, thus generating the IQ data for the adversarial example (denoted as signal_adv.mat). Cyclic spectral processing is then applied to signal_adv.mat to obtain the adversarial example cyclic spectral image. In the image, solid black lines represent forward propagation, and dashed black lines represent backward propagation.

[0095] In the above implementation, the cyclic spectrum of the electromagnetic signal to be sensed can be obtained from the frequency domain: first, the electromagnetic signal is acquired to obtain its IQ signal, then the cyclic spectrum of the signal to be sensed is calculated according to the Fourier transform of the cyclic autocorrelation, the cyclic spectrum is multiplied point by point when calculating the cyclic spectrum in the frequency domain, and finally the cyclic spectrum of the electromagnetic signal to be sensed is drawn.

[0096] In the above implementation, the spectrum sensing problem is defined as a two-class classification problem, which is modeled as a two-class classification problem in the following way, where one class is signal and the other is noise.

[0097] In the above implementation, adversarial defense is achieved through adversarial training, and is constructed in the following manner:

[0098] The idea behind adversarial defense is: assuming a deep neural network takes an image x as input, adds a perturbation η, and outputs f(·), we expect:

[0099] f(x+η)=f(x)

[0100] In other words, the model's output remains unaffected before and after adding perturbations; this property is known as robustness. Among mainstream adversarial defense methods, adversarial training is a typical and effective algorithm. Data augmentation is a classic and effective neural network training method; its basic idea is to enhance the model's decision-making experience by adding data to the dataset. Therefore, this application uses adversarial examples to augment the dataset, updating the model parameters by incorporating adversarial examples into the training process, enabling it to resist the influence of adversarial examples. Specifically, adversarial training can be defined as a minimization problem.

[0101] Among them, the basic residual block is as follows Figure 6 As shown in Table 1, the detailed structure of the deep residual network is illustrated. "Residual_block" represents the basic residual block, "avgpool" represents average pooling, and "linear" represents a fully connected layer. First, the recurrent spectra of normal and adversarial samples are used as network input. After two basic convolutional layers, four residual modules are cascaded (the basic residual blocks are shown in Table 1). Figure 6 As shown in the diagram, the obtained features are processed by an average pooling layer and then fed into the fully connected layer. The final classification layer outputs confidence vectors for the signal and noise classes. A suitable hyperparameter is designed to train the network, and based on the extracted features, the output confidence of the softmax layer is used to determine the presence or absence of a signal.

[0102] Table 1. Detailed Structure of Deep Residual Network

[0103]

[0104]

[0105] In this application, the parameters of the deep residual network are updated using the stochastic gradient descent (SGD) method and momentum. The loss function is the cross-entropy function. During training, the learning rate is set to 0.001 and the batch size is set to 64. The contrastive loss is reduced by mini-batch gradient descent until the network converges, and the trained model parameters are obtained.

[0106] The technical performance and effects of the above-mentioned technical solution will be further illustrated through specific simulation experiments below. The specific simulation conditions and parameters are as follows:

[0107] The dataset used for adversarial defense is as follows: the generated signal data is BPSK modulated, with a signal-to-noise ratio (SNR) of -15dB to 10dB and an interval of 5dB. Each signal is 1000 bytes long. For each SNR, 500 signal samples and 500 adversarial samples are generated, with each sample having a dimension of (224, 224, 3). The noise data in the training set is AWGN data, also 1000 bytes long, with the number of noise samples matching the number of signal samples. The dataset contains signal samples and pure noise samples under the AWGN channel, along with their corresponding class labels. The class labels are used to identify the class of the samples, and the ratio of signal samples to pure noise samples is 1:1. The samples and class labels in the modulated signal dataset are shuffled and divided into training and test sets in an 8:2 ratio. The training set is used to train the network, and the test set is used to test the network's accuracy.

[0108] The signal-to-noise ratio (SNR) is defined as the ratio of signal power to noise power. First, IQ data is acquired, and then a cyclic spectrum is plotted using the IQ data as signal samples. The modulation signal parameters used in this paper are set as follows: IQ data sampling frequency fs is 1000000Hz, carrier frequency fc is 100000Hz, the length of each signal is 1000, and the symbol rate Rb is 1000B. To ensure high consistency in the generated cyclic spectrum, when changing the SNR, the signal power is kept constant, and the SNR is changed by altering the noise power.

[0109] The development environment for this simulation experiment is as follows: the processor used is an AMD Ryzen 5 3600 6-Core Processor 3.59GHz, the development tools are PyCharm and MATLAB, and the development language is Python. A deep residual network model with the structure settings shown in Table 1 was built using the PyTorch framework. The training set of the above samples was used to complete the training of the deep neural network. During training, the model parameters were updated using momentum-driven SGD, with a momentum factor of 0.9, a batch size of 64, an initial learning rate of 0.001, and the loss function being the cross-entropy loss function. The network was trained for 20 epochs (epoch is a hyperparameter of gradient descent). During adversarial training, the FSGM algorithm was used to generate adversarial examples, and the perturbation scale was set to ε∈[0.002, 0.018].

[0110] The training process is as follows Figure 7 As shown, the training process converges very quickly. After convergence, the classification accuracy on the entire test dataset is 94.083%. Since the signal-to-noise ratio (SNR) of the entire test set is between -15dB and 10dB, the very low SNR will reduce the overall accuracy.

[0111] To compare the BPSK recognition accuracy with the amount of disturbance after countermeasures in this invention with the BPSK recognition accuracy with the amount of disturbance without countermeasures. Figure 8 The curves showing the change in BPSK recognition accuracy with the amount of perturbation before and after defense are presented. The trend of the curves shows that, firstly, the accuracy of model prediction decreases as the amount of perturbation increases; secondly, the rate of decrease in model prediction accuracy is slower when adversarial training is used than when training without adversarial examples, which means that adversarial training can enable the network to resist certain attacks.

[0112] To verify the interpretability of the defense effect, we generated cyclic spectra of the BPSK signal at SNR = 10dB, 5dB, 0dB, -5dB, and -10dB; and set perturbation ε = 0.002, ε = 0.006, and ε = 0.018 to generate adversarial samples under different signal-to-noise ratios and perturbations; then, we used the Grad-CAM method to simultaneously perform interpretability labeling on both the signal samples before and after defense and the adversarial samples. The schematic diagram of the cyclic spectrum of the modulated BPSK signal at SNR = 10dB, and the schematic diagram of the Grad-CAM heatmap of the adversarial samples before and after defense under different perturbations are shown below. Figure 9 As shown; when the modulation signal BPSK is at SNR=5dB, the schematic diagram of the cyclic spectrum of the method of the present invention and the schematic diagram of the Grad-CAM heatmap of the adversarial sample before and after defense under different perturbations are shown in the figure. Figure 10As shown; when the modulation signal BPSK is at SNR=0dB, the schematic diagram of the cyclic spectrum of the method of the present invention and the schematic diagram of the Grad-CAM heatmap of the adversarial sample before and after defense under different perturbations are shown in the figure. Figure 11 As shown; when the modulation signal BPSK is at SNR = -5dB, the schematic diagram of the cyclic spectrum of the method of the present invention and the schematic diagram of the Grad-CAM heatmap of the adversarial sample before and after defense under different perturbations are shown in the figure. Figure 12 As shown; when the modulation signal BPSK is at SNR = -10dB, the schematic diagram of the cyclic spectrum of the method of the present invention and the schematic diagram of the Grad-CAM heatmap of the adversarial sample before and after defense under different perturbations are shown in the figure. Figure 13 As shown.

[0113] Based on the above experiments, this application trains the network adversarially by feeding adversarial examples and real samples together, aiming to learn human-interpretable feature representations during model training. By training the deep neural network with adversarial examples, neurons also learn the features of the adversarial examples. The highlighted areas in the figure represent regions that can activate a specific output class of the deep neural network. The spectral peak positions of samples correctly classified as "BPSK" are all highlighted. Figure 9 Figure 13 shows that: First, from the perspective of human visual recognition, when the image content is indistinguishable, Grad-CAM class activation mapping still labels different positions. Furthermore, as interference increases, the accuracy gradually decreases, and the labeling becomes increasingly inaccurate. Second, the rate of decrease in recognition confidence after adversarial training is slower than before. Under the same signal-to-noise ratio and perturbation, the labeling effect after defense is always better than before. Through experiments using the class activation mapping method with weighted combinations of channels of the highest-level feature map, a saliency map containing category information is obtained. This allows for locating the input image region most relevant to a specific output category, enabling interpretability analysis and further explaining the network's defense effectiveness. We also... Figures 9-13 The recognition accuracy of normal samples and adversarial samples before and after defense was tested, and the test results are shown in Table 2.

[0114] Table 2. Classification results and confidence levels of normal and adversarial samples before and after defense under different signal-to-noise ratios and perturbations.

[0115]

[0116]

[0117] Table 2 shows the classification results and confidence levels of normal and adversarial samples before and after defense under different signal-to-noise ratios and perturbations. Table 2 and Figures 10-13It's a one-to-one correspondence. It's worth noting that when the modulated signal BPSK has an SNR of -10dB and a perturbation ε of 0.006, the deep neural network before defense classifies it as "noise" with a confidence level of 51.5%. However, after adversarial training, the neural network still classifies it as "BPSK" with a confidence level of 57.5%. Figures 10 to 13 The labeling results show that when ε = 0.006, the labeling of adversarial samples is very chaotic before adversarial training, but after adversarial training, the spectral peak positions are still highlighted. The interpretability of the defense effect also confirms that adversarial training can resist the attack of adversarial samples to a certain extent.

[0118] refer to Figure 14 Another embodiment of this application provides an electronic device, including: at least one processor 110; and a memory 111 communicatively connected to the at least one processor; wherein the memory 111 stores instructions executable by the at least one processor 110, the instructions being executed by the at least one processor 110 to enable the at least one processor 110 to perform any of the above method embodiments.

[0119] The memory 111 and processor 110 are connected via a bus, which may include any number of interconnecting buses and bridges, connecting various circuits of one or more processors 110 and memory 111. The bus may also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. A bus interface provides an interface between the bus and the transceiver. The transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 110 is transmitted over a wireless medium via an antenna, which further receives data and transmits it to processor 110.

[0120] Processor 110 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 111 can be used to store data used by processor 110 during operation.

[0121] Based on the above technical solutions, this application provides an electromagnetic signal sensing method with interpretable sample attack defense effect, comprising the following steps: acquiring the IQ data of the original electromagnetic signal, and generating normal samples based on the IQ data; adding attacks to the IQ data to obtain attacked IQ data, and generating adversarial samples based on the attacked IQ data; examining the feature representation inside the neural network from the perspective of model failure based on the adversarial samples, interpreting the attack effect of the samples in the electromagnetic signal sensing process, and verifying the successful generation of adversarial samples; and performing adversarial defense through adversarial training based on a deep neural network model, and verifying the adversarial defense verification using adversarial training from an interpretable perspective using a gradient-based class activation mapping method.

[0122] This application provides an electromagnetic signal sensing method driven by interpretable sample attack defense effects. Addressing the problem of electromagnetic signal cyclic spectrum sensing, it utilizes adversarial examples to examine the feature representations within the neural network from the perspective of model failure. Through visualization analysis, inconsistencies are found between the features learned by the deep neural network and those seen by humans, thus explaining the attack effects of samples during electromagnetic signal sensing. Furthermore, this application employs adversarial training for adversarial defense and utilizes a gradient-based class activation mapping method to explain the sample defense effects from an interpretable perspective, thereby achieving intelligent electromagnetic signal sample sensing where both attack and defense effects are interpretable.

[0123] Those skilled in the art will understand that the above-described embodiments are specific examples of implementing this application, and in practical applications, various changes in form and detail may be made without departing from the spirit and scope of this application. Any person skilled in the art can make their own modifications and alterations without departing from the spirit and scope of this application; therefore, the scope of protection of this application should be determined by the scope defined in the claims.

Claims

1. A method for sensing electromagnetic signals with interpretable sample attack defense effects, characterized in that, Includes the following steps: Acquire the IQ data of the original electromagnetic signal, and generate normal samples based on the IQ data; An attack is added to the IQ data to obtain attacked IQ data, and adversarial samples are generated based on the attacked IQ data. Based on the adversarial examples, the feature representation inside the neural network is examined from the perspective of model failure, the attack effect of the examples in the electromagnetic signal perception process is explained, and the successful generation of the adversarial examples is verified. Based on a deep neural network model, adversarial defense is implemented through adversarial training. A gradient-based class activation mapping method is used to verify the use of adversarial training for adversarial defense from an interpretable perspective. Based on the IQ data, normal samples are generated, including: Based on the IQ data, a cyclic spectrum was plotted; Based on the cyclic spectrum, a normal sample is generated; The process of drawing the cyclic spectrum includes the following steps: The autocorrelation function of the original electromagnetic signal is subjected to Fourier expansion, where the coefficients of the expanded autocorrelation function are cyclic autocorrelation functions. The cyclic autocorrelation function is subjected to a Fourier transform to obtain the cyclic spectrum function; The original electromagnetic signal is discretized. After discretization, the time domain phase is multiplied with the corresponding frequency domain phase. The correlation in the time domain is calculated by point-by-point multiplication in the frequency domain using DFT. The cyclic spectrum is obtained from the frequency domain, resulting in a cyclic spectrum diagram. Based on the adversarial examples, the feature representations within the neural network are examined from the perspective of model failure. The attack effect of the examples during electromagnetic signal perception is explained, and the successful generation of the adversarial examples is verified. This includes the following steps: The feature map is obtained by using a gradient-based class activation mapping method and calculating the weights using the global average gradient. The weights corresponding to the feature maps are weighted and summed to visualize the distinguishing regions of the neural network in the form of heatmaps. This process explains the attack effect of the samples during electromagnetic signal perception and verifies the successful generation of the adversarial samples.

2. The electromagnetic signal sensing method with interpretable driving effect for sample attack defense according to claim 1, characterized in that, The IQ data is attacked using a fast gradient symbol attack method.

3. The electromagnetic signal sensing method with interpretable driving effect for sample attack defense according to claim 1, characterized in that, The gradient-based class activation mapping method includes the following steps: In the classification case, the deep neural network performs pooling on the convolutional feature maps before the final output layer, and uses the convolutional features as features for the fully connected layer that produces the desired output. Calculate the gradient of each pixel in the highest-level feature map with respect to the target class score during backpropagation; The gradient of each channel pixel is averaged to obtain the weight of each channel. The weights corresponding to each channel are multiplied by each feature map to obtain the highlighted image; The highlighted image is transformed and superimposed onto the original image to obtain a class activation map.

4. The electromagnetic signal sensing method with interpretable driving effect for sample attack defense according to claim 1, characterized in that, The adversarial defense based on a deep neural network model, achieved through adversarial training, includes: Construct a deep neural network model; wherein, the deep neural network model is a deep residual network model; The adversarial examples are added to the adversarial training process to update the parameters of the deep neural network model, so that the updated parameters can resist the influence of the adversarial examples. The adversarial training process is represented as follows: Where D represents the data distribution, and S(x) represents the allowed adversarial example region. This represents the network loss function.

5. The electromagnetic signal sensing method with interpretable driving effect for sample attack defense according to claim 4, characterized in that, The construction of the deep neural network model includes the following steps: The cyclic spectra of the normal samples and the adversarial samples are used as network inputs; After several basic convolutional layers, several residual modules are cascaded to obtain features; The features are processed by the average pooling layer to obtain pooled features, and the pooled features are sent to the fully connected layer. The classification layer outputs a confidence vector for the signal class and a confidence vector for the noise class. The network is trained based on the pooled features and hyperparameters, and the presence or absence of a signal is determined by the output confidence of the classification layer.

6. An electromagnetic signal sensing system with interpretable sample attack defense effect, the system being used to implement the electromagnetic signal sensing method with interpretable sample attack defense effect as described in any one of claims 1 to 5, characterized in that, include: The normal sample construction module, the adversarial sample construction module, the attack effect interpretation module, and the adversarial defense verification module are connected in sequence. The normal sample construction module is used to acquire the IQ data of the original electromagnetic signal and generate normal samples based on the IQ data. The adversarial sample construction module is used to add attacks to the IQ data to obtain attacked IQ data, and generate adversarial samples based on the attacked IQ data. The attack effect interpretation module is used to examine the feature representation inside the neural network from the perspective of model failure based on the adversarial sample, interpret the attack effect of the sample in the electromagnetic signal perception process, and verify that the adversarial sample was successfully generated. The adversarial defense verification module is used to perform adversarial defense through adversarial training based on a deep neural network model, and to verify the adversarial defense verification using adversarial training from an interpretable perspective by employing a gradient-based class activation mapping method.

Images