A GDNN-based method and device for generating global sparse adversarial samples for industrial videos

Abstract

The present invention discloses a method and device for generating global sparse adversarial samples for industrial videos based on GDNN. The method comprises the following steps: obtaining benign industrial video samples as input to the GDNN; processing the outputs of the two branch decoders of the GDNN using a controllable attack cost and a preset probability distribution, learning to obtain a perturbation intensity matrix and a perturbation position matrix, which are used to perform perturbation superposition processing on the benign video samples to obtain a global sparse adversarial sample; inputting the obtained global sparse adversarial sample into a video recognition model, calculating the adversarial loss based on the recognition results and the true label, and then considering the optimized loss of the perturbation position to obtain the sample loss; finally, training the GDNN based on all sample losses to obtain an adversarial sample generation model, which is used to process unknown industrial video samples and generate corresponding global sparse adversarial samples. The present invention improves the global sparsity of the adversarially generated samples, reduces the need to modify the perturbed pixels, and thus saves communication resources.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence technology, and specifically relates to a method and device for generating global sparse adversarial samples of industrial videos based on a generative deep neural network (GDNN). Background Art

[0002] The Industrial Internet tightly integrates modern industrial systems with cyberspace, fostering the emergence of Industrial Cyber-Physical Systems (ICPS) and enabling the widespread application of Artificial Intelligence (AI) in industry. For example, due to factors such as internal mechanisms or external interference, industrial processes often operate under varying operating conditions, switching between them with significant uncertainty. To accurately identify operating conditions and enable refined operations, numerous solutions based on Deep Neural Networks (DNNs) have emerged. Industrial enterprises have developed industrial applications such as using video collected from industrial sites combined with DNN models for operating condition identification. Leveraging DNN's powerful representation and learning capabilities, these solutions have effectively improved the performance of operating condition identification.

[0003] However, recent research has shown that AI models, particularly DNN models, are extremely vulnerable to adversarial attacks [1-3]. Adversarial attacks involve adding tiny perturbations imperceptible to the human eye to benign samples in order to deceive AI models. This "vulnerability" raises serious security concerns regarding the deployment of AI models in safety-critical applications, such as industrial scenarios. For example, adversarial attacks can trick DNN models into making incorrect decisions in operating condition recognition tasks, with serious consequences. Because operating conditions are closely related to factors such as raw material feed rate, controller setpoints, and actuator valve opening, incorrect decisions can cause monitoring delays or even failure, leading to decreased production performance, damage to production equipment, and even safety accidents. Therefore, it is crucial to study the security of AI models to gain a deeper understanding of their working mechanisms and provide support for enhancing the robustness of industrial AI application models.

[0004] In the past few years, academia and industry have conducted extensive research on the robustness of artificial intelligence models, mainly divided into image adversarial attacks and video adversarial attacks. For example, based on the pioneering work of Goodfellow et al., a large number of image adversarial attacks have been proposed, including Fast Gradient Sign Method (FGSM), Project Gradient Descent (PGD), Universal Adversarial Attack (UAA), Zeroth Order Optimization (ZOO) attack, Auto Attack (AA), etc. Compared with image adversarial attacks, video attacks are more challenging because the information in videos has much higher dimensions in time and space than images. For example, [4] proposed the first black-box video attack framework called V-BAD. [5] developed an adversarial sample generation method based on the Generative Adversarial Network (GAN) model. However, these methods treat each frame in the video equally to add perturbations, ignoring the temporal dependencies within the video. Since attacking all frames of a video is very time-consuming, the algorithm needs more queries to find the optimal perturbation in a larger search space to complete the attack, which is inefficient. A reasonable video adversarial attack must consider both the adversarial effect and the efficiency of generating adversarial samples. Therefore, some work has proposed a video adversarial attack method by determining the most critical frame and adding perturbations to it. For example, [6] proposed a method based on l 2,1norm-regularized optimization algorithm to generate additive adversarial perturbations and evaluate the performance of video recognition tasks on CNN+LSTM models. Although this attack is computationally easy to implement, it relies on a random frame selection strategy. [7] developed a heuristic-based algorithm that uses a ranking score to measure the importance of each frame in the video and performs a black-box attack on these selected frames. However, there is no interaction between the attack process and the key frame selection, and the perturbation effect of the adversarial video is poor. Subsequently, [8] proposed a video adversarial attack method called DeepSAVA, which uses Bayesian optimization to identify the most influential frames in the video and then applies spatial transformation to sparsely generate additive perturbations of the entire video. [9] proposed a sparse black-box video attack method based on reinforcement learning. In this work, a reinforcement learning agent is used to identify key frames, and a general attack method is used to attack the key frames and generate adversarial videos with small perturbations. Similarly,

[10] proposed an improved video sparse attack method that uses deep reinforcement learning, adopts a new reward function and an efficient update mechanism to achieve video attacks with small perturbations. However, while the aforementioned work has achieved adversarial attacks on videos, their performance in terms of sparsity remains limited. The pixels required to achieve a successful adversarial attack are measured in frames, meaning that at least one frame of content must be attacked. This is still expensive for scenarios where communication resources are strictly limited. On the other hand, adversarial attacks are relatively weak in robustness, meaning that their offline-generated additive perturbations are prone to failure without a sufficient number of queries. Industrial systems are typical environments where communications are strictly monitored. Further reducing the number of perturbations and saving resources during the attack process are key to improving the success and stealth of adversarial attacks in industrial scenarios. Summary of the Invention

[0005] The present invention provides a method and device for generating global sparse adversarial samples for industrial videos based on GDNN. By adopting a new sparsity promotion strategy, the global sparsity of adversarially generated samples for industrial videos is improved, and the need to modify the perturbed pixels in the adversarial samples is reduced, thereby saving communication resources and improving the success rate of adversarial attacks in scenarios such as industrial systems.

[0006] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0007] A method for generating global sparse adversarial samples for industrial videos based on GDNN, including:

[0008] S1: Obtain benign industrial video samples and discretize them into frame sequences. The frames are then fed into a generative deep neural network (GDNN). The encoder extracts the spatiotemporal correlation features of the video, and two branch decoders generate upper and lower branch outputs, respectively. The upper branch output is then bounded by a controllable attack cost to obtain a perturbation strength matrix, and the lower branch output is binarized according to a preset probability distribution to obtain a perturbation position matrix. Finally, the perturbation strength matrix and the perturbation position matrix are used to perform perturbation superposition on the benign industrial video samples, ultimately yielding a globally sparse adversarial sample.

[0009] S2: Input the global sparse adversarial sample obtained in S1 into the video recognition model to obtain the recognition result, and calculate the adversarial loss based on the recognition result and the true label. Based on the adversarial loss, the optimization loss of the perturbation position is considered to obtain the total loss of GDNN.

[0010] S3, based on the total loss training GDNN to obtain the adversarial sample generation model, and used it to process the unknown industrial video samples according to step S1 to generate the corresponding global sparse adversarial samples.

[0011] Furthermore, the generative deep neural network GDNN, whose encoder backbone network uses a residual neural network combined with a convolutional neural network to capture the spatiotemporal dependencies of all frames in the input video sample, obtains the potential code Z of the input video sample i ; Among them, the front-end convolutional neural network is composed of several 3D convolutional network layers, and the back-end residual neural network is composed of several residual network blocks. The mapping function of each residual network block is expressed as:

[0012]

[0013] Where, X i and represents the input and output of the i-th video sample in the residual network block, H(·;θ ResNet ) indicates that the parameter is θ ResNet The mapping function of the residual network block, I(·) represents the identity operator;

[0014] The upper branch decoder of GDNN is expressed as:

[0015]

[0016]

[0017] Where, Indicates that the parameter is The mapping function of the upper branch decoder is, is the output of the upper branch decoder, ò is the controllable attack cost, Ei is the perturbation intensity matrix;

[0018] The lower branch decoder of GDNN is expressed as:

[0019]

[0020]

[0021] Where, Indicates that the parameter is The lower branch of decoding is the mapping function along the way, is the output of the lower branch decoder, ξ is a probability variable determined by the preset probability distribution P, and τ is a threshold variable; M i is the perturbation position matrix.

[0022] Furthermore, the preset probability distribution in the lower branch decoder adopts Bernoulli distribution.

[0023] Furthermore, the perturbation intensity matrix and the perturbation position matrix are used to perform perturbation superposition processing on benign industrial video samples to obtain global sparse adversarial samples, which are expressed as:

[0024]

[0025] Where, X i represents the i-th video sample of the input, E i is the perturbation intensity matrix, M i is the perturbation position matrix, X i,adv It means that the global sparse adversarial samples are obtained by perturbation superposition processing. Indicates the multiplication of elements at corresponding positions in the matrix, Represents the addition of elements at corresponding positions in the matrix.

[0026] Furthermore, the following loss function is used to quantify the adversarial loss L adv :

[0027]

[0028] For targeted attacks, the variant of the above loss function is:

[0029]

[0030] Where, J(X i,adv ; θ) represents the video recognition model with parameter θ, c refers to the category, y i represents the target category, and κ is the confidence factor that controls the attack strength.

[0031] Furthermore, the sparsity constraint and information loss of the perturbation position matrix are expressed as:

[0032]

[0033] Where M i is the perturbation position matrix, is the output of the lower branch decoder, L per represents the optimization loss of adversarial perturbation; the total loss of GDNN is expressed as:

[0034] L=L adv +λ·L per

[0035] where λ is the penalty factor for balancing the two terms in the objective.

[0036] An electronic device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor implements any of the above-mentioned methods for generating global sparse adversarial samples of industrial videos based on GDNN.

[0037] Beneficial effects

[0038] This paper proposes an effective video adversarial attack. By adopting a new sparsity promotion method, the global sparsity of the video adversarial attack is improved, the modification requirements of the perturbed pixels are reduced, thereby saving communication resources and improving the success rate of the adversarial attack in scenarios such as industrial systems.

[0039] Compared with the traditional strategy of alternating solutions, this model has the following three advantages:

[0040] (1) First, leveraging the generative paradigm can eliminate the intractable dual-objective optimization problem through end-to-end learning.

[0041] (2) Secondly, by jointly learning M and E, we can satisfy both the bounded constraints of the perturbation and the sparsity constraints of the perturbation amount, prompting the adversarial perturbation to be automatically added to the most vulnerable areas in the video, thereby promoting the global sparsity of video adversarial samples.

[0042] (3) Finally, the robustness of videos to adversarial attacks can be enhanced by learning the data distribution of the original videos instead of relying on general perturbations generated offline.

[0043] This invention is mainly used for robustness testing of artificial intelligence models in the field of industrial video applications, providing security testing for the development of defense algorithms and risk assessment of system model deployment. It is a technology that can effectively improve the security of industrial artificial intelligence model applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is the overall framework of the method described in the embodiment of this application;

[0045] Figure 2 This is a schematic diagram of the 3D convolutional neural network;

[0046] Figure 3 Schematic diagram of numerical conversion. DETAILED DESCRIPTION

[0047] The following is a detailed description of an embodiment of the present invention. This embodiment is based on the technical solution of the present invention, provides a detailed implementation method and a specific operation process, and further explains the technical solution of the present invention.

[0048] 1. Definition of sparse video adversarial attack problem

[0049] Sparse adversarial attacks aim to generate effective adversarial samples that can fool DNN-based models with minimal perturbations. represents a benign video sample, Represents an adversarial video sample, where X adv =X+δ, where δ represents the generated adversarial perturbation. Generally speaking, in order to improve the stealth and sparsity of the adversarial attack, it is necessary to constrain the adversarial perturbation δ, including the l0 norm and l ∞ Therefore, the above sparse adversarial attack can be formulated as the following problem:

[0050]

[0051] The above problem can be expressed as the following optimization problem:

[0052]

[0053] Among them, X i and y i denotes the i-th video sample and the predicted label respectively. L(·,·) represents the loss function, which is used to quantify the difference between the predicted label and the true label. If y i Same as the true label, this attack is called non-targeted adversarial attack and applies negative cross entropy function; if y iThis attack is called a targeted adversarial attack, which uses the same target label as the attacker's, and adopts a positive cross entropy function. S(·) represents a custom constraint function, and λ represents a constant to balance the weights of the two items. N is the total number of training videos. However, the above problem is usually difficult to solve directly. The constraint function S(δ) includes optimization for the perturbation position and perturbation intensity. Although some existing studies have proposed optimization strategies, the video sample context search space is still large. In addition, ignoring the interaction between the perturbation position and intensity during the optimization process may cause the design of the adversarial perturbation to fall into a local optimum, resulting in problems such as too large a perturbation amount or insufficient sparsity.

[0054] The present invention adopts a joint optimization strategy, first decomposing the disturbance δ into two parts for representation:

[0055]

[0056] Where M∈{0,1} T×W×H×1 The mask representing the perturbation position, E∈R T×W×H×C represents the disturbance intensity, Denotes the dot product. Through the above decomposition, the dual-objective formula of sparse adversarial attack is obtained as follows:

[0057]

[0058] The above formula is the objective function for generating sparse adversarial attacks. This paper uses a generator model based on a generative deep neural network (GDNN) to obtain the perturbation position mask M and perturbation intensity E, which are used to perturb benign video samples to obtain adversarial samples.

[0059] 2. Global Sparse Video Adversarial Attack Based on Generative Deep Neural Network (GDNN)

[0060] (1) Network architecture

[0061] The method for generating global sparse adversarial samples for industrial videos proposed in this invention uses a generation mechanism to obtain adversarial samples. Specifically, the purpose of the generator model is to learn the data distribution of the original video and generate two components, namely M and E, that satisfy the perturbation position and intensity constraints. The generator model is developed in an encoder-decoder manner. The encoder backbone network is designed to extract the spatiotemporal features of the original video, while the decoder backbone network distribution promotes the sparsity of the perturbation position and the boundedness of the perturbation intensity. The overall framework of the adversarial attack method based on the generative deep neural network (GDNN) of this invention is as follows: Figure 1 shown.

[0062] Encoder backbone network: In essence, videos have continuous frames (images) in the time domain, so the generation of adversarial videos can be formulated as a frame-to-frame conversion problem. Discrete frames extracted from benign videos are used as input, and these frames form the adversarial video as output. Therefore, extracting the spatiotemporal features of the frames is crucial for learning the data distribution of the original video, which is the basis for generating adversarial video samples with similar distribution. 3D convolutional neural networks (3D CNNs) are widely used in video understanding tasks, extracting features from the spatial and temporal dimensions through 3D convolution, such as Figure 2 Therefore, the present invention proposes to use 3D CNN in the encoder backbone network to capture the spatiotemporal dependencies of all frames in the video. The discrete frames are fed into the 3D convolutional network layer, which can be expressed as:

[0063]

[0064] where H(·;θ ConvNet ) represents the mapping function of multiple 3D convolutional network layers, X i and Represent the input and output feature maps respectively. It should be noted that, unlike 2D convolution, in 3D convolution the convolution kernel moves in both spatial and temporal dimensions, and performs a convolution operation at each spatiotemporal position of the 3D input data.

[0065] In addition, in order to solve the problem of gradient vanishing in robust feature extraction, the embodiment of the present invention combines a residual neural network with a convolutional neural network. The residual neural network includes multiple residual network blocks, where each residual network block consists of two 3D convolutional network layers, two normalization layers, an activation function, and a dropout module. The dropout module improves the independence between residual network blocks, thereby enhancing the generalization ability of the deep model. Therefore, the feature encoding X i The input to the residual network block can be expressed as:

[0066]

[0067] Among them, H(·;θ ResNet ) represents the mapping function of the 3D residual network block, and I(·) represents the identity operator. After the residual neural network enhancement, the potential code of the input video is recorded as Z i .

[0068] The embodiment of the present invention first inputs the discrete frame into the convolutional neural network and processes it according to formula (5). Then the convolutional neural network outputs the frame to the residual neural network. In each residual network block inside the residual neural network, the input feature encoding X is performed. i All are processed according to formula (6), and the final output code Z i .

[0069] Decoder backbone network: In order to optimize the perturbation position and perturbation strength, based on the hidden layer code Z i Two functionally specified network branches are developed. Specifically, the upper branch considers l by applying an ò-based boundary scaling operator. ∞ Norm constraint is used to better control the perturbation amplitude. Here, ò represents the attack cost within the valid pixel range. It should be noted that the optimization process only involves continuous real numbers. Therefore, a numerical transformation is required to project the feature map onto the valid pixel range. This ensures that the output perturbation amplitude remains within the predefined attack cost. The numerical transformation operation is expressed as:

[0070]

[0071] Among them, since for any value Both therefore The numerical conversion diagram is as follows Figure 3 shown.

[0072] Therefore, the decoding process of the upper branch can be expressed as:

[0073]

[0074]

[0075] in, represents the mapping function of the upper branch decoder, are the parameters of the upper branch decoder. is the output feature map of the upper branch decoder, is the controllable attack cost, E i is the perturbation intensity matrix. The purpose of the lower branch is to determine the perturbation location. This is equivalent to imposing the l0-norm constraint, but unlike the pursuit of frame-level sparsity in traditional work, the goal of this branch is to promote global sparsity. Similarly, since there are only continuous real numbers in the optimization process, a hard threshold method is used to explicitly binarize all pixel values ​​to improve sparsity. In particular, in order to avoid the gradient vanishing problem during the optimization process, a probabilistic binary filtering operator is used. Therefore, the decoding process of the lower branch can be expressed as:

[0076]

[0077]

[0078] in, represents the mapping function of the lower branch decoder, is the parameter of the lower branch decoder, ξ is the probability variable determined by the Bernoulli distribution P, and τ is the threshold variable. is the output feature map of the lower branch decoder, M i is the perturbation position matrix. Although complete randomness can be achieved by setting τ = 0.5, the probabilistic binary filter operator is crucial to avoid over-pruning, so this information loss should also be considered in the loss function. Finally, based on the obtained perturbation position term and perturbation intensity term, the perturbation adversarial term is obtained:

[0079]

[0080] (2) Loss function

[0081] The performance of sparse adversarial attacks is closely related to the effectiveness of the adversarial attack and the optimization of the adversarial perturbation. On the one hand, the attacker's goal is to generate adversarial samples that trick the video classifier into misclassifying the video based on the true label. Therefore, the loss function in the C&W attack is used to quantify the adversarial loss:

[0082]

[0083] The adversarial loss function is for non-target attacks, in which case y i Represents the current sample X i,adv The true label of the non-target attack is to make the current sample X i,adv Misclassified to other categories (non-y i ).

[0084] The target attack aims to make the current sample X i,adv Clearly misclassify to target category y i , then the variant of the above loss function is:

[0085]

[0086] where κ is the confidence factor that controls the attack strength.

[0087] Conceptually, the above loss function for targeted attack minimizes the target class (y i The distance between the logit values ​​of the first category (category) and the second largest category (category c). Here, y i represents the target category you want to attack, and c represents the general category, c≠y i Indicates that except y i Obviously, if the y i Logit value of the class With the current highest logit value (ie the current sample X i,adv Identified as target category y i), then the difference between these two logits When the difference exceeds the confidence factor κ, the optimization stops and the objective function is no longer penalized. i Logit value of the class Does not have the highest logit value (ie the current sample X i,adv If an object is identified as a non-target class, the objective function needs to be penalized to minimize this loss. The goal is to force the current class to be closer to the target class, thereby reducing the confidence level of the highest class prediction and increasing the confidence level of the target class. The confidence factor κ establishes the best-case stopping criterion, also known as the confidence level. A larger κ value increases the likelihood that the model will misclassify the object, and the probability of misclassifying the object increases.

[0088] On the other hand, the adversarial perturbation term shows that although the perturbation amplitude is continuous, the effective component of the adversarial perturbation is determined by the optimized perturbation location. Therefore, the goal of sparse adversarial attack is to improve the sparsity constraint on the perturbation location. In order to improve the effect of global sparsity, pixel-level sparsity is considered so that the adversarial perturbation is added to the most vulnerable area of ​​the video. In addition, the information loss in the probabilistic binary filter operator should also be considered. Therefore, the loss of adversarial perturbation optimization is expressed as:

[0089]

[0090] Therefore, the total loss can be expressed as:

[0091] L=L adv +λ·L per (16)

[0092] where λ is the penalty factor that balances the two terms in the objective.

[0093] In summary, this embodiment proposes a method for generating global sparse adversarial samples for industrial videos based on GDNN. Referring to the algorithm pseudo code in Table 1, the method includes the following steps:

[0094] S1, obtain a set X consisting of N benign industrial video samples train ={X1,X2,...,X N}, input to the generative deep neural network GDNN, the encoder extracts the spatiotemporal correlation features of the video, and the two branch decoders generate the upper branch output and the lower branch output respectively;

[0095] Then, the controllable attack cost is used to constrain the value boundary of the upper branch output to obtain the perturbation intensity matrix E i , and binarize the lower branch output according to the Bernoulli distribution to obtain the disturbance position matrix M i ;

[0096] Finally, use the perturbation intensity matrix E i and the perturbation position matrix M i , the benign industrial video samples are perturbed and superimposed to finally obtain the global sparse adversarial sample X i,adv :

[0097]

[0098] S2, the global sparse adversarial sample set X 1,adv ,X 2,adv ,…,X N,adv Input to the video recognition model J(X i,adv ;θ), get the recognition result y 1,adv ,y 2,adv ,…,y N,adv , and according to the recognition result y 1,adv ,y 2,adv ,…,y N,adv and the true labels y1,y2,…,y N Calculate the adversarial loss L of each sample according to formula (13) or formula (14) adv On the basis of the adversarial loss, the optimization loss of the perturbation position is considered, that is, the optimization loss of each sample is quantified according to formula (15), and the sum of the two losses is the total loss of GDNN training for each sample.

[0099] S3, based on the total loss of all samples, GDNN is trained to obtain the adversarial sample generation model, and used to generate adversarial samples X according to step S1. * Process and generate corresponding global sparse adversarial samples

[0100] Table 1 Algorithm: Sparse adversarial video attack generation method based on generative deep neural network

[0101]

[0102]

[0103] The above embodiments are preferred embodiments of the present application. Ordinary technicians in this field can also make various changes or improvements on this basis. Without departing from the overall concept of the present application, these changes or improvements should fall within the scope of protection required by the present application.

[0104] References:

[0105] [1]Szegedy C,Zaremba W,Sutskever I,et al.Intriguing properties ofneural networks[J].arXiv preprint arXiv:1312.6199,2013.

[0106] [2]Yuan X,He P,Zhu Q,et al.Adversarial examples:Attacks and defensesfor deep learning[J].IEEE transactions on neural networks and learningsystems,2019,30(9):2805-2824.

[0107] [3]Zhang J,Li C.Adversarial examples:Opportunities and challenges[J].IEEE transactions on neural networks and learning systems,2019,31(7):2578-2593.

[0108] [4]Jiang L,Ma X,Chen S,et al.Black-box adversarial attacks on videorecognition models[C] / / Proceedings ofthe 27thACM International Conference onMultimedia.2019:864-872.

[0109] [5]Li S,Neupane A,Paul S,et al.Adversarial perturbations againstreal-time video classification systems[J].arXiv preprint arXiv:1807.00458,2018.

[0110] [6]Wei X,Zhu J,Yuan S,et al.Sparse adversarial perturbations forvideos[C] / / Proceedings of the AAAI Conference onArtificial Intelligence.2019,33(01):8973-8980.

[0111] [7]Wei Z,Chen J,Wei X,et al.Heuristic black-box adversarial attackson video recognition models[C] / / Proceedings of the AAAI Conference onArtificial Intelligence.2020,34(07):12338-12345.

[0112] [8]Mu R,Ruan W,Marcolino L S,et al.Sparse adversarial video attackswith spatial transformations[J].arXiv preprint arXiv:2111.05468,2021.

[0113] [9]Wei X,Yan H,Li B.Sparse black-box video attack with reinforcementlearning[J].International Journal ofComputer Vision,2022,130(6):1459-1473.

[0114]

[10] Yan H,Wei X.Efficient sparse attacks on videos usingreinforcement learning[C] / / Proceedings of the 29th ACM InternationalConference on Multimedia.2021:2326-2334.

Claims

1. A method for generating global sparse adversarial samples for industrial videos based on GDNN, characterized by: include: S1: Obtain benign industrial video samples and discretize them into frame sequences. The frames are then fed into a generative deep neural network (GDNN). The encoder extracts the spatiotemporal correlation features of the video, and two branch decoders generate upper and lower branch outputs, respectively. The upper branch output is then bounded by a controllable attack cost to obtain a perturbation strength matrix, and the lower branch output is binarized according to a preset probability distribution to obtain a perturbation position matrix. Finally, the perturbation strength matrix and the perturbation position matrix are used to perform perturbation superposition on the benign industrial video samples, ultimately yielding a globally sparse adversarial sample. S2: Input the global sparse adversarial sample obtained in S1 into the video recognition model to obtain the recognition result, and calculate the adversarial loss based on the recognition result and the true label. Based on the adversarial loss, the optimization loss of the perturbation position is considered to obtain the total loss of GDNN. S3, based on the total loss training GDNN to obtain the adversarial sample generation model, and use it to process the unknown industrial video samples according to step S1 to generate the corresponding global sparse adversarial samples; The generative deep neural network GDNN, whose encoder backbone network uses a residual neural network combined with a convolutional neural network to capture the spatiotemporal dependencies of all frames in the input video sample, obtains the potential code Z of the input video sample i ; Among them, the front-end convolutional neural network is composed of several 3D convolutional network layers, and the back-end residual neural network is composed of several residual network blocks. The mapping function of each residual network block is expressed as: Where, X i and represents the input and output of the i-th video sample in the residual network block, H(·;θ ResNet ) indicates that the parameter is θ ResNet The mapping function of the residual network block, I(·) represents the identity operator; The upper branch decoder of GDNN is expressed as: Where, Indicates that the parameter is The mapping function of the upper branch decoder is, is the output of the upper branch decoder, ∈ is the controllable attack cost, E i is the perturbation intensity matrix; The lower branch decoder of GDNN is expressed as: Where, Indicates that the parameter is The lower branch of decoding is the mapping function along the way, is the output of the lower branch decoder, ξ is a probability variable determined by the preset probability distribution P, and τ is a threshold variable; M i is the perturbation position matrix.

2. The method for generating global sparse adversarial samples for industrial videos according to claim 1, characterized in that: The preset probability distribution in the lower branch decoder adopts Bernoulli distribution.

3. The method for generating global sparse adversarial samples for industrial videos according to claim 1, characterized in that: The perturbation intensity matrix and the perturbation position matrix are used to perform perturbation superposition processing on benign industrial video samples to obtain global sparse adversarial samples, which are expressed as: Where, X i represents the i-th video sample of the input, E i is the perturbation intensity matrix, M i is the perturbation position matrix, X i,adv It means that the global sparse adversarial samples are obtained by perturbation superposition processing.

4. The method for generating global sparse adversarial samples for industrial videos according to claim 1, characterized in that: The following loss function is used to quantify the adversarial loss L adv : For targeted attacks, the variant of the above loss function is: Where, J(X i,adv ; θ) represents the video recognition model with parameter θ, c refers to the category, y i represents the target category, and κ is the confidence factor that controls the attack strength.

5. The method for generating global sparse adversarial samples for industrial videos according to claim 1, characterized in that: The sparsity constraint and information loss considering the perturbation position matrix are expressed as: Where M i is the perturbation position matrix, is the output of the lower branch decoder, L per represents the optimization loss of adversarial perturbation; The total loss of GDNN is expressed as: L=L adv +λ·L per where λ is the penalty factor for balancing the two terms in the objective.

6. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the computer program is executed by the processor, the processor is caused to implement the method according to any one of claims 1 to 5.

Images