Quantum neural network vulnerability detection method and autonomous driving vulnerability detection method

Abstract

The present invention discloses a quantum neural network vulnerability detection method, including obtaining original input data and an initial quantum neural network model, constructing a quantum state data set through encoding processing; determining the optimization target of adversarial sample search by calculating the gradient direction; determining the optimization target of quantum entanglement coverage by a quantum state entanglement coverage calculation method of the model; defining a joint optimization target, and generating a target perturbation operator through optimization processing; using the initial network model and the target perturbation operator to complete the model vulnerability detection; the present invention also discloses an automatic driving vulnerability detection method, including obtaining environmental image data of an automatic driving system in a driving scene, an initial quantum neural network model applicable to the automatic driving system; training by a quantum neural network vulnerability detection method; and using the training results to complete the automatic driving system vulnerability detection. The reliability of the vulnerability detection method is improved, and the reliability of the automatic driving is also improved.

Description

Technical Field

[0001] The present invention belongs to the field of quantum technology, and specifically relates to a quantum neural network vulnerability detection method and an autonomous driving vulnerability detection method. Background Art

[0002] The quantum neural network model is a hybrid quantum-classical machine learning model proposed for recent noisy medium-scale quantum computing devices. It solves some specific supervised and unsupervised learning tasks, including classification and regression, and generative modeling tasks, by optimizing the loss function on the parameter vector and reducing it to convergence. With the development of quantum computers, the potential quantum advantages of quantum neural network models in learning ability and resource consumption have broad room for release.

[0003] Quantum neural network models play an important role in the field of quantum technology. Therefore, in practical applications, requirements are put forward for the reliability of quantum neural network models. Vulnerability detection of quantum neural network models is very necessary to improve the reliability of the models.

[0004] Currently, there is no vulnerability detection method for quantum neural network models.

[0005] The classical machine learning technology used in the current autonomous driving field often requires a large amount of data samples to support model training, and also faces huge training costs. Applying quantum neural network models to autonomous driving systems can effectively solve the problems of high resource overhead and low learning efficiency during machine learning model training through its parallelism and coherence, and improve the performance of autonomous driving; however, autonomous driving systems using quantum neural network models still have the problem that reliability cannot fully meet the required requirements, and the system is still easily interfered by influencing factors, which in turn reduces the overall accuracy of the system.

[0006] In summary, most of the current quantum neural network models still need to solve the problem of insufficient reliability. At the same time, the use of quantum neural networks in autonomous driving systems also has an impact on autonomous driving systems. Summary of the invention

[0007] One of the purposes of the present invention is to provide a quantum neural network vulnerability detection method with improved reliability and increased accuracy.

[0008] A second objective of the present invention is to provide an autonomous driving vulnerability detection method with enhanced reliability and improved robustness.

[0009] The quantum neural network vulnerability detection method provided by the present invention comprises the following steps:

[0010] S1. Obtain the original input data and the initial quantum neural network model, encode the acquired data, and construct a quantum state data set;

[0011] S2. Using the quantum state data set constructed in step S1 and the initial quantum neural network model, determine the optimization target of adversarial sample search by calculating the gradient direction;

[0012] S3. Using the quantum state data set constructed in step S1 and the initial quantum neural network model, the optimization target of the quantum entanglement coverage is determined by the quantum state entanglement coverage calculation method of the model;

[0013] S4. Using the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3, a joint optimization target is defined, and a target perturbation operator is generated through optimization processing;

[0014] S5. Use the initial quantum neural network model obtained in step S1 and the target perturbation operator generated in step S4 to complete the vulnerability detection of the quantum neural network model.

[0015] The step S1 of obtaining the original input data and the initial quantum neural network model, encoding the obtained data, and constructing a quantum state data set specifically includes:

[0016] The initial quantum neural network model is a fully trained neural network to be tested, which specifically includes:

[0017] "Complete training" means that the quantum neural network model to be tested has learned through the training data, and in the test data, all learning indicators have converged to the set range, and the model parameters are fixed based on the training results;

[0018] The quantum neural network is assumed to be a parameterized quantum circuit consisting of two parts: an encoding circuit and a variational circuit, specifically including:

[0019] Variational Circuit It is composed of a set of parameterized rotating gates and fixed gates arranged in a specific model, wherein the parameterized rotating gates are used to traverse the unitary transformations existing in the Hilbert space, and the fixed gates are controlled gates that provide coherence;

[0020] The structure of the encoding circuit is determined by selecting a state preparation scheme for encoding the environmental image data into a quantum state; the state preparation scheme is determined based on the dimension of the data set and the relationship between the computing resources;

[0021] Angle coding is selected as the state preparation scheme; the coding circuit is composed of a plurality of parameter-containing rotating gates, wherein the parameters of the rotating gates are determined by the information of the image data;

[0022] The proposed width of the entire quantum neural network depends on the number of qubits required to encode the input data set. The higher the dimension of the input data, the larger the scale of the circuit.

[0023] In step S2, the quantum state data set constructed in step S1 and the initial quantum neural network model are used to determine the optimization target of the adversarial sample search by calculating the gradient direction, which specifically includes:

[0024] (2-1) Performing observation projection processing on the quantum system through measurement operations to obtain predicted labels;

[0025] (2-2) Obtaining the gradient between the input quantum state in the model and the predicted label obtained in step (2-1) and the gradient direction of each classification result;

[0026] (2-3) Select the gradient directions corresponding to the first n categories with the highest observation probability obtained through observation processing and different from the original predicted category, and obtain the tensor expression of the prediction difference by accumulating the gradient directions of the first n categories and subtracting them from the direction of the original predicted category, and determine the optimization target of the adversarial sample search. The optimization target of the adversarial sample search is expressed by the following formula:

[0027]

[0028] Among them, y i is the top n label categories with the highest predicted probability and different from the original predicted category, and y is the original label of the test input;

[0029] (2-4) Calculate the loss function for the predicted label:

[0030] The following formula is used to express the calculation process of the loss function:

[0031]

[0032] in, <x| k represents the kth data in the quantum state data set; y k represents the label corresponding to the kth data in the quantum state data set; E represents the unit matrix;

[0033] The loss function value of the original category label and the quantum neural network model is improved through the gradient ascent algorithm, and the loss value of other category labels is reduced through the gradient descent algorithm, thereby maximizing the processing of differential behaviors;

[0034] The quantum state data set constructed in step S1 and the initial quantum neural network model described in step S3 determine the optimization target of the quantum entanglement coverage rate through the quantum state entanglement coverage rate calculation method of the model, specifically including:

[0035] Select a polynomial global metric method for multi-particle entanglement, calculate the quantum entanglement coverage of the quantum neural network model, and record the polynomial global metric as the entanglement metric Q;

[0036] The following formula is used to represent the linear mapping process acting on the computational basis:

[0037]

[0038] Where, j = 1,…,n; represents the missing qubit; δ represents the Kronecker symbol;

[0039] The entanglement metric Q for the quantum state |ψ> is calculated using the following formula:

[0040]

[0041] Among them, 0≤Q≤1, the larger the value of Q, the higher the corresponding degree of entanglement; D represents the generalized distance. For a given quantum state |u> and |v>, the calculation formula of the corresponding generalized distance D is as follows:

[0042]

[0043] |u>=∑u i |i>

[0044] |v>=Σv i |i>

[0045] Calculate the difference between the quantum state entanglement metric before inputting the quantum neural network and the quantum state entanglement metric after inputting the quantum neural network, and solve the gradient direction of the quantum entanglement coverage rate with the goal of increasing the difference, and then determine the optimization target of the quantum entanglement coverage rate. The optimization target is expressed by the following formula:

[0046]

[0047] in, represents the entanglement degree of the quantum state output from the quantum neural network; Q(|x>) represents the entanglement degree of the quantum state input from the quantum neural network;

[0048] Step S4 adopts the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3 to define a joint optimization target, and generates a target perturbation operator through optimization processing, specifically including:

[0049] Using the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3, the following formula is used to define the gradient search joint optimization target for mutation:

[0050] obj=λ1×obj a +λ2×obj e

[0051] Where obj represents the gradient search joint optimization target; obj a represents the optimization goal of the adversarial sample search part, λ1 represents the hyperparameter of the control weight; obj e represents the optimization target of the quantum entanglement coverage part; λ2 represents the hyperparameter that balances the optimization target weights of the two parts;

[0052] Search the perturbation operator U by gradient ascent algorithm p , continuously mutate the original test input |x> until the iteration ends and the optimization target is maximized;

[0053] Step S5 uses the initial quantum neural network model obtained in step S1 and the target perturbation operator generated in step S4 to complete the vulnerability detection of the quantum neural network model, which specifically includes:

[0054] The target perturbation operator U generated in step S4 is p Acting on the original input |x> to obtain the mutated input |x′>, re-inputting |x′> into the initial quantum neural network model obtained in step S1, if the output prediction result is inconsistent with the prediction result of the original input |x>, it means that an adversarial test input for the original input |x> is generated; if the output prediction result is the same as the prediction result of the original input |x>, the mutated input in the output prediction result that can improve the quantum entanglement coverage and the perturbation size meets the preset requirements is stored in the seed queue and continues to mutate; by judging whether to generate an adversarial test input, the vulnerability detection of the quantum neural network model is completed. If an adversarial test input is generated, it means that the model has a vulnerability;

[0055] The present invention also provides an automatic driving vulnerability detection method, comprising the following steps:

[0056] A1. Obtain environmental image data of the autonomous driving system in the driving scenario and the initial quantum neural network model applicable to the autonomous driving system;

[0057] A2. Using the image data and the initial model obtained in step A1, a vulnerability detection method of a quantum neural network is used to detect vulnerabilities in the initial model;

[0058] A3. Use the results obtained after step A2 to complete the vulnerability detection of the autonomous driving system.

[0059] The quantum neural network vulnerability detection method provided by the present invention trains and optimizes the initial quantum neural network model to determine the target perturbation operator, thereby completing the model vulnerability detection; the autonomous driving vulnerability detection method provided by the present invention applies the quantum neural network vulnerability detection method to the autonomous driving system to complete the vulnerability detection of the autonomous driving system; the quantum neural network vulnerability detection method proposed by the present invention has high reliability and strong accuracy; the autonomous driving vulnerability detection method proposed by the present invention also improves the reliability and robustness of the autonomous driving system. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a schematic diagram of the method flow of the quantum neural network vulnerability detection method in the present invention.

[0061] Figure 2 Schematic diagram of pseudo code of the algorithm of the quantum neural network vulnerability detection method in the present invention.

[0062] Figure 3 It is a schematic diagram of the circuit structure of the quantum neural network model to be tested in the quantum neural network vulnerability detection method of the present invention.

[0063] Figure 4 The figure is a flow chart of the vulnerability detection method for autonomous driving in the present invention.

[0064] Figure 5 Schematic diagram of the design of the vulnerability detection method for autonomous driving in the present invention. DETAILED DESCRIPTION

[0065] like Figure 1 The method flow diagram of the method of the present invention is shown as follows: The quantum neural network vulnerability detection method provided by the present invention comprises the following steps:

[0066] S1. Obtain the original input data and the initial quantum neural network model, encode the acquired data, and construct a quantum state data set; specifically, it includes:

[0067] The initial quantum neural network model is a fully trained neural network to be tested, which specifically includes:

[0068] "Complete training" means that the quantum neural network model to be tested has learned through the training data, and in the test data, all learning indicators have converged to the set range, and the model parameters are fixed based on the training results;

[0069] The quantum neural network is assumed to be a parameterized quantum circuit consisting of two parts: an encoding circuit and a variational circuit, specifically including:

[0070] Variational Circuit It is composed of a set of parameterized rotating gates and fixed gates arranged in a specific model, wherein the parameterized rotating gates are used to traverse the unitary transformations existing in the Hilbert space, and the fixed gates are controlled gates that provide coherence;

[0071] The structure of the encoding circuit is determined by selecting a state preparation scheme for encoding the environmental image data into a quantum state; the state preparation scheme is determined based on the dimension of the data set and the relationship between the computing resources;

[0072] Angle coding is selected as the state preparation scheme; the coding circuit is composed of a plurality of parameter-containing rotating gates, wherein the parameters of the rotating gates are determined by the information of the image data;

[0073] The proposed width of the entire quantum neural network depends on the number of qubits required to encode the input data set. The higher the dimension of the input data, the larger the scale of the circuit.

[0074] S2. Using the quantum state data set constructed in step S1 and the initial quantum neural network model, determine the optimization target of adversarial sample search by calculating the gradient direction; specifically including:

[0075] (2-1) Performing observation projection processing on the quantum system through measurement operations to obtain predicted labels;

[0076] (2-2) Obtaining the gradient between the input quantum state in the model and the predicted label obtained in step (2-1) and the gradient direction of each classification result;

[0077] (2-3) Select the gradient directions corresponding to the first n categories with the highest observation probability obtained through observation processing and different from the original predicted category, and obtain the tensor expression of the prediction difference by accumulating the gradient directions of the first n categories and subtracting them from the direction of the original predicted category, and determine the optimization target of the adversarial sample search. The optimization target of the adversarial sample search is expressed by the following formula:

[0078]

[0079] Among them, y i is the top n label categories with the highest predicted probability and different from the original predicted category, and y is the original label of the test input;

[0080] (2-4) Calculate the loss function for the predicted label:

[0081] The following formula is used to express the calculation process of the loss function:

[0082]

[0083] in, <x| k represents the kth data in the quantum state data set; y krepresents the label corresponding to the kth data in the quantum state data set; E represents the unit matrix;

[0084] The loss function value of the original category label and the quantum neural network model is improved through the gradient ascent algorithm, and the loss value of other category labels is reduced through the gradient descent algorithm, thereby maximizing the processing of differential behaviors;

[0085] S3. Using the quantum state data set constructed in step S1 and the initial quantum neural network model, the optimization target of the quantum entanglement coverage rate is determined by the quantum state entanglement coverage rate calculation method of the model; specifically including:

[0086] Select a polynomial global metric method for multi-particle entanglement, calculate the quantum entanglement coverage of the quantum neural network model, and record the polynomial global metric as the entanglement metric Q;

[0087] The following formula is used to represent the linear mapping process acting on the computational basis:

[0088]

[0089] Where, j = 1,…,n; represents the missing qubit; δ represents the Kronecker symbol;

[0090] The entanglement metric Q is calculated using the following formula:

[0091]

[0092] Among them, 0≤Q≤1, the larger the value of Q, the higher the corresponding degree of entanglement; D represents the generalized distance. For a given quantum state |u> and |v>, the calculation formula of the corresponding generalized distance D is as follows:

[0093]

[0094] |u>=∑u i |i>

[0095] |v>=∑v i |i>

[0096] Calculate the difference between the quantum state entanglement metric before inputting the quantum neural network and the quantum state entanglement metric after inputting the quantum neural network, and solve the gradient direction of the quantum entanglement coverage rate with the goal of increasing the difference, and then determine the optimization target of the quantum entanglement coverage rate. The optimization target is expressed by the following formula:

[0097]

[0098] in, represents the entanglement degree of the quantum state output from the quantum neural network; Q(|x>) represents the entanglement degree of the quantum state input from the quantum neural network;

[0099] S4. Using the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3, a joint optimization target is defined, and a target perturbation operator is generated through optimization processing; specifically, the following steps are performed:

[0100] Using the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3, the following formula is used to define the gradient search joint optimization target for mutation:

[0101] obj=λ1×obj a +λ2×obj e

[0102] Where obj represents the gradient search joint optimization target; obj a represents the optimization goal of the adversarial sample search part, λ1 represents the hyperparameter of the control weight; obj e represents the optimization target of the quantum entanglement coverage part; λ2 represents the hyperparameter that balances the optimization target weights of the two parts;

[0103] Search the perturbation operator U by gradient ascent algorithm p , continuously mutate the original test input |x> until the iteration ends and the optimization target is maximized;

[0104] S5. Using the initial quantum neural network model obtained in step S1 and the target perturbation operator generated in step S4, complete the vulnerability detection of the quantum neural network model; specifically including:

[0105] The target perturbation operator U generated in step S4 is p Acting on the original input |x> to obtain the mutated input |x′>, re-inputting |x′> into the initial quantum neural network model obtained in step S1, if the output prediction result is inconsistent with the prediction result of the original input |x>, it means that an adversarial test input for the original input |x> is generated; if the output prediction result is the same as the prediction result of the original input |x>, the mutated input in the output prediction result that can improve the quantum entanglement coverage and the perturbation size meets the preset requirements is stored in the seed queue and continues to mutate; by judging whether to generate an adversarial test input, the vulnerability detection of the quantum neural network model is completed. If an adversarial test input is generated, it means that the model has a vulnerability;

[0106] Two indicators are proposed to measure the robustness of generated adversarial samples, including:

[0107] (1) For the original input data set, the average fidelity measure (AFM) of the generated adversarial sample is defined, and the calculation formula is as follows:

[0108]

[0109] Among them, x i Represents the original input data; represents the obtained variant input; F(·) represents the fidelity; for the target quantum states ρ and σ, the corresponding calculation formula for the fidelity is as follows:

[0110]

[0111] (2) For the original input data set, the average trace distance (ATD) of the generated adversarial sample is defined, and the calculation formula is as follows:

[0112]

[0113] Where D(·) represents the trace distance, and the calculation formula is as follows:

[0114]

[0115] The indicators AFM and ATD reflect the similarity between the adversarial sample and the original data sample. The higher the similarity, the stronger the robustness of the adversarial sample and the higher the corresponding quality.

[0116] like Figure 2 FIG. 1 is a schematic diagram of a pseudo-code algorithm for a quantum neural network vulnerability detection method according to the present invention; Figure 3 Shown is a schematic diagram of the circuit structure of a quantum neural network model to be tested in the quantum neural network vulnerability detection method of the present invention;

[0117] like Figure 4 The following is a flow chart of the vulnerability detection method for autonomous driving in the present invention:

[0118] The present invention also provides an automatic driving vulnerability detection method, comprising the following steps:

[0119] A1. Obtain environmental image data of the autonomous driving system in the driving scenario and the initial quantum neural network model applicable to the autonomous driving system;

[0120] A2. Using the image data and the initial model obtained in step A1, a vulnerability detection method of a quantum neural network is used to detect the vulnerability of the initial model; specifically, the following steps are included:

[0121] S1. Obtain the original input data and the initial quantum neural network model, encode the acquired data, and construct a quantum state data set; specifically, it includes:

[0122] The initial quantum neural network model is a fully trained neural network to be tested, which specifically includes:

[0123] "Complete training" means that the quantum neural network model to be tested has learned through the training data, and in the test data, all learning indicators have converged to the set range, and the model parameters are fixed based on the training results;

[0124] The quantum neural network is assumed to be a parameterized quantum circuit consisting of two parts: an encoding circuit and a variational circuit, specifically including:

[0125] The quantum neural network is assumed to be a parameterized quantum circuit consisting of two parts: an encoding circuit and a variational circuit, specifically including:

[0126] Variational Circuit It is composed of a set of parameterized rotating gates and fixed gates arranged in a specific model, wherein the parameterized rotating gates are used to traverse the unitary transformations existing in the Hilbert space, and the fixed gates are controlled gates that provide coherence;

[0127] The structure of the encoding circuit is determined by selecting a state preparation scheme for encoding the environmental image data into a quantum state; the state preparation scheme is determined based on the dimension of the data set and the relationship between the computing resources;

[0128] Angle coding is selected as the state preparation scheme; the coding circuit is composed of a plurality of parameter-containing rotating gates, wherein the parameters of the rotating gates are determined by the information of the image data;

[0129] The proposed width of the entire quantum neural network depends on the number of qubits required to encode the input data set. The higher the dimension of the input data, the larger the scale of the circuit.

[0130] S2. Using the quantum state data set constructed in step S1 and the initial quantum neural network model, determine the optimization target of adversarial sample search by calculating the gradient direction; specifically including:

[0131] (2-1) Performing observation projection processing on the quantum system through measurement operations to obtain predicted labels;

[0132] (2-2) Obtaining the gradient between the input quantum state in the model and the predicted label obtained in step (2-1) and the gradient direction of each classification result;

[0133] (2-3) Select the gradient directions corresponding to the first n categories with the highest observation probability obtained through observation processing and different from the original predicted category, and obtain the tensor expression of the prediction difference by accumulating the gradient directions of the first n categories and subtracting them from the direction of the original predicted category, and determine the optimization target of the adversarial sample search. The optimization target of the adversarial sample search is expressed by the following formula:

[0134]

[0135] Among them, y i is the top n label categories with the highest predicted probability and different from the original predicted category, and y is the original label of the test input;

[0136] (2-4) Calculate the loss function for the predicted label:

[0137] The following formula is used to express the calculation process of the loss function:

[0138]

[0139] in, <x| k represents the kth data in the quantum state data set; y k represents the label corresponding to the kth data in the quantum state data set; E represents the unit matrix;

[0140] The loss function value of the original category label and the quantum neural network model is improved through the gradient ascent algorithm, and the loss value of other category labels is reduced through the gradient descent algorithm, thereby maximizing the processing of differential behaviors;

[0141] S3. Using the quantum state data set constructed in step S1 and the initial quantum neural network model, the optimization target of the quantum entanglement coverage rate is determined by the quantum state entanglement coverage rate calculation method of the model; specifically including:

[0142] Select a polynomial global metric method for multi-particle entanglement, calculate the quantum entanglement coverage of the quantum neural network model, and record the polynomial global metric as the entanglement metric Q;

[0143] The following formula is used to represent the linear mapping process acting on the computational basis:

[0144]

[0145] Where, j = 1,…,n; represents the missing qubit; δ represents the Kronecker symbol;

[0146] The entanglement metric Q is calculated using the following formula:

[0147]

[0148] Among them, 0≤Q≤1, the larger the value of Q, the higher the corresponding degree of entanglement; D represents the generalized distance. For a given quantum state |u> and |v>, the calculation formula of the corresponding generalized distance D is as follows:

[0149]

[0150] |u>=∑u i |i>

[0151] |v>=∑v i |i>

[0152] Calculate the difference between the quantum state entanglement metric before inputting the quantum neural network and the quantum state entanglement metric after inputting the quantum neural network, and solve the gradient direction of the quantum entanglement coverage rate with the goal of increasing the difference, and then determine the optimization target of the quantum entanglement coverage rate. The optimization target is expressed by the following formula:

[0153]

[0154] in, represents the entanglement degree of the quantum state output from the quantum neural network; Q(|x>) represents the entanglement degree of the quantum state input from the quantum neural network;

[0155] S4. Using the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3, a joint optimization target is defined, and a target perturbation operator is generated through optimization processing; specifically, the following steps are performed:

[0156] Using the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3, the following formula is used to define the gradient search joint optimization target for mutation:

[0157] obj=λ1×obj a +λ2×obj e

[0158] Where obj represents the gradient search joint optimization target; obj a represents the optimization goal of the adversarial sample search part, λ1 represents the hyperparameter of the control weight; obj e represents the optimization target of the quantum entanglement coverage part; λ2 represents the hyperparameter that balances the optimization target weights of the two parts;

[0159] Search the perturbation operator U by gradient ascent algorithm p , continuously mutate the original test input |x> until the iteration ends and the optimization target is maximized;

[0160] S5. Using the initial quantum neural network model obtained in step S1 and the target perturbation operator generated in step S4, complete the vulnerability detection of the quantum neural network model; specifically including:

[0161] The target perturbation operator U generated in step S4 is pActing on the original input |x> to obtain the mutated input |x′>, re-inputting |x′> into the initial quantum neural network model obtained in step S1, if the output prediction result is inconsistent with the prediction result of the original input |x>, it means that an adversarial test input for the original input |x> is generated; if the output prediction result is the same as the prediction result of the original input |x>, the mutated input in the output prediction result that can improve the quantum entanglement coverage and the perturbation size meets the preset requirements is stored in the seed queue and continues to mutate; by judging whether to generate an adversarial test input, the vulnerability detection of the quantum neural network model is completed. If an adversarial test input is generated, it means that the model has a vulnerability;

[0162] A3. Use the results obtained after step A2 to complete the vulnerability detection of the autonomous driving system;

[0163] like Figure 5 Shown is a schematic diagram of the design of the vulnerability detection method for autonomous driving in the present invention.

Claims

1. A method for detecting vulnerabilities in a quantum neural network, comprising the following steps: S1. Obtain the original input data and the initial quantum neural network model, encode the acquired data, and construct a quantum state data set; specifically, it includes: The initial quantum neural network model is a fully trained neural network to be tested, which specifically includes: "Complete training" means that the quantum neural network model to be tested has learned through the training data, and in the test data, all learning indicators have converged to the set range, and the model parameters are fixed based on the training results; The quantum neural network is assumed to be a parameterized quantum circuit consisting of two parts: an encoding circuit and a variational circuit, specifically including: Variational Circuit It is composed of a set of parameterized rotating gates and fixed gates arranged in a specific model, wherein the parameterized rotating gates are used to traverse the unitary transformations existing in the Hilbert space, and the fixed gates are controlled gates that provide coherence; The structure of the encoding circuit is determined by selecting a state preparation scheme for encoding the environmental image data into a quantum state; the state preparation scheme is determined based on the dimension of the data set and the relationship between the computing resources; Angle coding is selected as the state preparation scheme; the coding circuit is composed of a plurality of parameter-containing rotating gates, wherein the parameters of the rotating gates are determined by the information of the image data; The proposed width of the entire quantum neural network depends on the number of qubits required to encode the input data set. The higher the dimension of the input data, the larger the scale of the circuit. S2. Using the quantum state data set constructed in step S1 and the initial quantum neural network model, determine the optimization target of adversarial sample search by calculating the gradient direction; S3. Using the quantum state data set constructed in step S1 and the initial quantum neural network model, the optimization target of the quantum entanglement coverage is determined by the quantum state entanglement coverage calculation method of the model; S4. Using the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3, a joint optimization target is defined, and a target perturbation operator is generated through optimization processing; S5. Use the initial quantum neural network model obtained in step S1 and the target perturbation operator generated in step S4 to complete the vulnerability detection of the quantum neural network model.

2. The method for detecting a vulnerability in a quantum neural network according to claim 1, characterized in that In step S2, the quantum state data set constructed in step S1 and the initial quantum neural network model are used to determine the optimization target of the adversarial sample search by calculating the gradient direction, which specifically includes: (2-1) Performing observation projection processing on the quantum system through measurement operations to obtain predicted labels; (2-2) Obtaining the gradient between the input quantum state in the model and the predicted label obtained in step (2-1) and the gradient direction of each classification result; (2-3) Select the gradient directions corresponding to the first n categories with the highest observation probability obtained through observation processing and different from the original predicted category, and obtain the tensor expression of the prediction difference by accumulating the gradient directions of the first n categories and subtracting them from the direction of the original predicted category, and determine the optimization target of the adversarial sample search. The optimization target of the adversarial sample search is expressed by the following formula: Among them, y i is the top n label categories with the highest predicted probability and different from the original predicted category, and y is the original label of the test input; (2-4) Calculate the loss function for the predicted label: The following formula is used to express the calculation process of the loss function: in, < x k represents the kth data in the quantum state data set; y k represents the label corresponding to the kth data in the quantum state data set; E represents the unit matrix; The gradient ascent algorithm is used to improve the loss function value of the original category label and the quantum neural network model, and the gradient descent algorithm is used to reduce the loss value of other category labels, thereby achieving maximum processing of difference behaviors.

3. The method for detecting a vulnerability in a quantum neural network according to claim 2, characterized in that The quantum state data set constructed in step S1 and the initial quantum neural network model described in step S3 determine the optimization target of the quantum entanglement coverage rate through the quantum state entanglement coverage rate calculation method of the model, specifically including: Select a polynomial global metric method for multi-particle entanglement, calculate the quantum entanglement coverage of the quantum neural network model, and record the polynomial global metric as the entanglement metric Q; The following formula is used to represent the linear mapping process acting on the computational basis: Where, j = 1,…,n; represents the missing qubit; δ represents the Kronecker symbol; The entanglement metric Q is calculated using the following formula: Among them, 0≤Q≤1, the larger the value of Q, the higher the corresponding degree of entanglement; D represents the generalized distance. For a given quantum state |u> and |v>, the calculation formula of the corresponding generalized distance D is as follows: in > =∑u i |and v > =∑v i |i Calculate the difference between the quantum state entanglement metric before inputting the quantum neural network and the quantum state entanglement metric after inputting the quantum neural network, and solve the gradient direction of the quantum entanglement coverage rate with the goal of increasing the difference, and then determine the optimization target of the quantum entanglement coverage rate. The optimization target is expressed by the following formula: in, represents the entanglement degree of the quantum state output from the quantum neural network; Q(|x>) represents the entanglement degree of the quantum state input from the quantum neural network.

4. The method for detecting a vulnerability in a quantum neural network according to claim 3, characterized in that Step S4 adopts the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3 to define a joint optimization target, and generates a target perturbation operator through optimization processing, specifically including: Using the adversarial sample search optimization target determined in step S2 and the quantum entanglement coverage optimization target determined in step S3, the following formula is used to define the gradient search joint optimization target for mutation: obj=λ1×obj a +λ2×obj e Where obj represents the gradient search joint optimization target; obj a represents the optimization goal of the adversarial sample search part, λ1 represents the hyperparameter of the control weight; obj e represents the optimization target of the quantum entanglement coverage part; λ2 represents the hyperparameter that balances the optimization target weights of the two parts; Search the perturbation operator U by gradient ascent algorithm p , continuously mutating the original test input |x> until the iteration ends and the optimization target is maximized.

5. The method for detecting a vulnerability in a quantum neural network according to claim 4, characterized in that Step S5 uses the initial quantum neural network model obtained in step S1 and the target perturbation operator generated in step S4 to complete the vulnerability detection of the quantum neural network model, which specifically includes: The target perturbation operator U generated in step S4 is p Act on the original input |x> to obtain the mutated input |x′>, and re-input |x′> into the initial quantum neural network model obtained in step S1. If the output prediction result is inconsistent with the prediction result of the original input |x>, it means that an adversarial test input for the original input |x> is generated; if the output prediction result is the same as the prediction result of the original input |x>, the mutated input in the output prediction result that can improve the quantum entanglement coverage and the perturbation size meets the preset requirements is stored in the seed queue and continues to mutate; the vulnerability detection of the quantum neural network model is completed by judging whether the adversarial test input is generated. If the adversarial test input is generated, it means that the model has a vulnerability.

6. An autonomous driving vulnerability detection method comprising the vulnerability detection method of the quantum neural network according to any one of claims 1 to 5, comprising the following steps: A1. Obtain environmental image data of the autonomous driving system in the driving scenario and the initial quantum neural network model applicable to the autonomous driving system; A2. Using the image data and the initial model obtained in step A1, the initial model is detected for vulnerabilities by the quantum neural network vulnerability detection method according to any one of claims 1 to 5; A3. Use the results obtained after step A2 to complete the vulnerability detection of the autonomous driving system.

Images