An automatic modulation classification adversarial defense method based on decoupled Hilbert-Schmidt information bottleneck DHSIB

Abstract

The present invention proposes an automatic modulation classification adversarial defense method based on decoupled Hilbert-Schmidt information bottleneck DHSIB. The method analyzes the task-related and task-independent features in the intermediate representation of the AMC model from the perspective of mutual information, and explains the impact of task-independent features on adversarial robustness. The present invention proposes an adversarial defense system model for the AMC model, describes the threat model of the spectrum monitoring scenario, and uses a direct attack method in the experiment.

Description

Technical Field

[0001] The invention belongs to the field of communication technology, and in particular relates to an automatic modulation classification confrontation defense method based on a decoupled Hilbert-Schmidt information bottleneck DHSIB. Background Art

[0002] With the rapid development of communication technology, the number of frequencies used has gradually increased, and spectrum resources are becoming increasingly scarce. Spectrum monitoring and management systems can optimize spectrum allocation and mitigate radio interference, playing an increasingly important role in the field of wireless communications. Automatic modulation classification (AMC) technology is one of the key technologies of spectrum monitoring systems, which is used to extract signal features and identify the modulation type of the signal used. Different communication systems use different modulation modes and frequencies. By identifying the modulation type of the signal, the signal source can be determined, which is of vital significance for monitoring the legitimacy of spectrum users' frequency usage behavior and identifying potential interfering users. Traditional AMC usually relies on cumbersome professional knowledge and heavy manual feature engineering, which is not only labor-intensive but also prone to misjudgment. Therefore, AMC technology based on deep learning (DL) has become a widespread choice in the field of modulation recognition with its significant advantages such as automation, efficiency and accuracy. However, although DL-based AMC technology brings many advantages, they are vulnerable to adversarial attacks due to the uninterpretability of DL models. For adversarial signals that add carefully designed small perturbations to the original signal, AMC will misclassify.

[0003] Adversarial attacks against AMC models have posed a serious threat to spectrum monitoring and management systems. Researchers have explored various defense methods for this problem, but these defense methods often have some limitations. Some defense methods consider the adversarial attack problem from a computational perspective, but such methods often ignore the physical characteristics of the signal, resulting in insufficient robustness under specific conditions. Some methods incorporate adversarial samples into training data, but may face challenges in generalization performance in practical applications. Other methods simply treat adversarial perturbations as ordinary noise and perform poorly in the face of more complex attacks. Therefore, it is necessary to find a more comprehensive and effective solution to improve the security and robustness of the AMC model and ensure the stable operation of the communication system. Summary of the invention

[0004] In order to solve the problem that the AMC model is vulnerable to adversarial attacks, the present invention proposes an automatic modulation classification adversarial defense method based on decoupled Hilbert-Schmidt information bottleneck DHSIB.

[0005] The present invention is implemented by the following technical scheme. The present invention proposes an automatic modulation classification countermeasure defense method based on decoupled Hilbert-Schmidt information bottleneck DHSIB, and the specific steps of the method are:

[0006] Step 1: Build a supervised decoupling model architecture with Hilbert-Schmidt information bottleneck. The entire architecture includes the classification feature extractor E cls , supplementary feature extractor E sup and classifier C, where E cls Used to extract task-related features, E sup is used to extract task-independent features, and C is used to determine the modulation category of the received signal based on the task-related features;

[0007] Step 2: Convert the original signal domain sample x s Enter E cls 、E sup and C, we get the original signal domain classification loss

[0008] Step 3: Use E cls and C generate adversarial domain signal x a , and x a Enter E cls 、E sup and C, we get the adversarial domain signal classification loss

[0009] Step 4: Combine information bottleneck constraint adversarial training E cls 、E sup and C;

[0010] Step 5: Repeat training steps 2, 3, and 4 until convergence.

[0011] Furthermore, in step 2, firstly, x s Input to E cls 、E sup , respectively obtain quasi-task related features Quasi-task-irrelevant features Then Input C to get classification logits p s , and get the original classification loss:

[0012]

[0013] where CE(·,·) is the cross entropy loss function.

[0014] Furthermore, in step 3, the adversarial domain signal is first generated, and then the entire process of step 2 is re-executed:

[0015] x a =At(x s ,E cls ,C)(2),

[0016] Where At(·,·) represents the selected adversarial sample generation method, and x a Input to E cls 、E sup , respectively and Will After entering C, you get p a , we get the adversarial domain signal classification loss:

[0017]

[0018] Furthermore, in step 4, the information bottleneck constraint is calculated:

[0019]

[0020] Where I(·; ·) represents mutual information, and γ represents the compression ratio threshold for compressing X to Z. Formula (4) is solved using the Lagrangian relaxation method, thereby transforming the nonlinear constrained optimization problem into an unconstrained problem, thereby achieving the purpose of simplifying the solution:

[0021]

[0022] Where β is the Lagrange multiplier; the Hilbert-Schmidt independence criterion HSIC is used to measure the mutual independence between two random variables. When the sample is sufficient, HSIC is given by the following formula:

[0023]

[0024] where m and n are random samples from M and N; k m and k n is the kernel; and in the case of finite samples, HSIC(M;N) can be expressed as:

[0025]

[0026] Where ω is the number of samples; K M and K N is the kernel matrix, and the elements in the i-th row and j-th column are k M (m i ,m j ) and k N (n i ,n j );H is the unit matrix of order ω, Tr(·) is the matrix trace function;

[0027] Therefore, the following sub-optimization objectives are proposed in combination with the decoupling framework:

[0028]

[0029]

[0030] Therefore, the total loss of adversarial training based on DHSIB is:

[0031]

[0032] Among them, β s and β a Yes Control and Adjustment factor of the ratio.

[0033] Furthermore, in step 5, after the final convergence, the E used for auxiliary training is discarded sup , leaving only E sup and C for prediction:

[0034] y=i:p(i)=maxC(E cls (x))(11).

[0035] The present invention has the following beneficial effects:

[0036] 1. This paper analyzes the task-related and task-irrelevant features in the intermediate representation of the AMC model from the perspective of mutual information, and provides an explanation for the impact of task-irrelevant features on adversarial robustness;

[0037] 2. The present invention proposes an adversarial defense system model for the AMC model, describes the threat model of the spectrum monitoring scenario, and uses a direct attack method in the experiment. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a schematic diagram of the DHSIB model architecture of the present invention;

[0039] Figure 2 Figure 2 is a schematic diagram of the classification accuracy results of the AMC model when RML2016.10a is 0dB under different attacks, where a is a schematic diagram of the attack results of the fast gradient sign method (FGSM) on the AMC model when the signal-to-noise ratio of the RML2016.10a dataset is 0dB in the white-box scenario; b is a schematic diagram of the attack results of the mapped gradient descent method (PGD) on the AMC model when the signal-to-noise ratio of the RML2016.10a dataset is 0dB in the white-box scenario; c is a schematic diagram of the attack results of the FGSM on the AMC model when the signal-to-noise ratio of the RML2016.10a dataset is 0dB in the black-box scenario; d is a schematic diagram of the attack results of the PGD on the AMC model when the signal-to-noise ratio of the RML2016.10a dataset is 0dB in the black-box scenario. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] Specific implementation method 1. Combination Figure 1 and Figure 2 The present embodiment is described as follows:

[0042] Step 1: Build a supervised decoupling model architecture with Hilbert-Schmidt information bottleneck. The entire architecture includes the classification feature extractor E cls , supplementary feature extractor E sup and classifier C, where E cls Used to extract task-related features, E sup is used to extract task-independent features, and C is used to determine the modulation category of the received signal based on the task-related features;

[0043] Step 2: Convert the original signal domain sample x s Enter E cls 、E sup and C, we get the original signal domain classification loss l c s ls ;

[0044] Step 3: Use E cls and C generate adversarial domain signal x a , and x a Enter E cls 、E sup and C, we get the adversarial domain signal classification loss

[0045] Step 4: Combine information bottleneck constraint adversarial training E cls 、E sup and C;

[0046] Step 5: Repeat training steps 2, 3, and 4 until convergence.

[0047] Specific implementation method 2: Combination Figure 1 and Figure 2 In the present embodiment, the automatic modulation classification defense method based on DHSIB described in the present embodiment is firstly to convert x sInput to E cls 、E sup , respectively obtain quasi-task related features Quasi-task-irrelevant features (Before the model training is completed, the features extracted by the feature extractor are called quasi-features) and then Input C to get classification logits p s , and get the original classification loss:

[0048]

[0049] where CE(·,·) is the cross entropy loss function.

[0050] Specific implementation method 3: Combination Figure 1 and Figure 2 To illustrate this implementation, in step 3 of the automatic modulation classification countermeasure defense method based on DHSIB described in this implementation, a countermeasure domain signal is first generated, and then the process described in step 2 is re-executed:

[0051] x a =At(x s ,E cls ,C)(2),

[0052] Where At(·,·) represents the selected adversarial sample generation method, and x a Input to E cls 、E sup , respectively and Will After entering C, you get p a , we get the adversarial domain signal classification loss:

[0053]

[0054] Specific implementation method 4. Combination Figure 1 and Figure 2 This embodiment is described. In step 4 of the automatic modulation classification countermeasure defense method based on DHSIB described in this embodiment, the information bottleneck constraint is calculated:

[0055]

[0056] Where I(·; ·) represents mutual information, and γ represents the compression ratio threshold for compressing X to Z. It is very difficult to directly solve formula (4), but the Lagrangian relaxation method can transform this nonlinear constrained optimization problem into an unconstrained problem, thereby simplifying the solution:

[0057]

[0058] Where β is the Lagrange multiplier. The premise of calculating the mutual information of two random variables is to estimate the probability density of the random variables, and calculating the probability density of random variables is very difficult. The Hilbert-Schmidt independence criterion (HSIC) is a statistical method to measure the mutual independence between two random variables. If the value of HSIC is close to zero, there may be independence between the two variables; otherwise, there may be some correlation between them. Unlike mutual information, it does not require estimating the probability density of the two variables, but is calculated directly in the form of sampling. Therefore, HSIC can be used instead of mutual information to simplify the calculation. When the sample is sufficient, HSIC is given by the following formula:

[0059]

[0060] where m and n are random samples from M and N; k m and k n is the kernel. In the case of finite samples, HSIC(M;N) can be expressed as:

[0061]

[0062] Where ω is the number of samples; K M and K N is the kernel matrix, and the elements in the i-th row and j-th column are k M (m i ,m j ) and k N (n i ,n j ). H is the unit matrix of order ω. Tr(·) is the matrix trace function.

[0063] Therefore, the following sub-loss function is proposed in combination with the decoupling framework:

[0064]

[0065]

[0066] Therefore, the total loss function of the proposed DHSIB-based adversarial training is:

[0067]

[0068] Among them, β s and β a Yes Control and Adjustment factor for the ratio.

[0069] Specific implementation method V. Combination Figure 1 and Figure 2This embodiment describes that after the final convergence in step 5 of the automatic modulation classification defense method based on DHSIB, the E used for auxiliary training is discarded. sup , leaving only E sup and C for prediction:

[0070] y=i:p(i)=maxC(E cls (x))(11).

[0071] Example

[0072] The present invention proposes an automatic modulation classification countermeasure defense method based on decoupled Hilbert-Schmidt information bottleneck DHSIB, and the specific steps of the method are:

[0073] S1. Construct a supervised decoupling model architecture with Hilbert-Schmidt information bottleneck. The entire architecture includes the classification feature extractor E cls , supplementary feature extractor E sup and classifier C, where E cls Used to extract task-related features, E sup It is used to extract task-independent features, and C is used to determine the modulation category of the received signal based on task-related features. The original signal domain is S, x s ,y s is the data and label sample in S, the adversarial signal domain is A, x a ,y a is the data and label sample in A;

[0074] S2, x s Input to E cls 、E sup , respectively obtain quasi-task related features Quasi-task-irrelevant features (Before the model training is completed, the features extracted by the feature extractor are called quasi-features), where is reserved for the information bottleneck constraint, Input C to get classification logits p s :

[0075]

[0076]

[0077]

[0078] The original classification loss can be obtained:

[0079]

[0080] where CE(·,·) is the cross entropy loss function.

[0081] S3. Use E cls and C generate adversarial domain signal x a :

[0082] x a =At(x s ,E l ,E h ,C1)(5),

[0083] Among them, At(·) represents a specific adversarial sample generation method, taking the PGD method as an example:

[0084]

[0085]

[0086] Where ξ is the initial random noise and α is the perturbation step size; To guarantee After an appropriate number of iterations, the final x can be obtained a :

[0087]

[0088]

[0089]

[0090] The adversarial domain signal classification loss can be obtained:

[0091]

[0092] S4. Compute information bottleneck constraints:

[0093]

[0094] Where I(·; ·) represents mutual information, and γ represents the compression ratio threshold for compressing X to Z. It is very difficult to directly solve formula (12), but the Lagrangian relaxation method can transform this nonlinear constrained optimization problem into an unconstrained problem, thereby simplifying the solution:

[0095]

[0096] Where β is the Lagrange multiplier. The premise of calculating the mutual information of two random variables is to estimate the probability density of the random variables, and calculating the probability density of random variables is very difficult. The Hilbert-Schmidt independence criterion (HSIC) is a statistical method to measure the mutual independence between two random variables. If the value of HSIC is close to zero, there may be independence between the two variables; otherwise, there may be some correlation between them. Unlike mutual information, it does not require estimating the probability density of the two variables, but is calculated directly in the form of sampling. Therefore, HSIC can be used instead of mutual information to simplify the calculation. When the sample is sufficient, HSIC is given by the following formula:

[0097]

[0098] where m and n are random samples from M and N; k m and k n is the kernel. In the case of finite samples, HSIC(M;N) can be expressed as:

[0099]

[0100] Where ω is the number of samples; K M and K N is the kernel matrix, and the elements in the i-th row and j-th column are k M (m i ,m j ) and k N (n i ,n j );H is the ω-order unit matrix;Tr(·) is the matrix trace function.

[0101] Therefore, the following sub-loss function is proposed in combination with the decoupling framework:

[0102]

[0103]

[0104] Therefore, the total loss function of the proposed DHSIB-based adversarial training is:

[0105]

[0106] S5, repeat training S2, S3 and S4 until convergence, and finally obtain E that can effectively classify the original signal domain and the adversarial domain signal. cls 、E sup and C. discard E for auxiliary training sup , leaving only E sup and C for prediction:

[0107] y=i:p(i)=maxC(E cls (x))(19).

[0108] The above is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technician familiar with this profession can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent replacement and improvement made to the above embodiments without departing from the content of the technical solution of the present invention, based on the technical essence of the present invention, within the spirit and principles of the present invention, still fall within the protection scope of the technical solution of the present invention.

Claims

1. An automatic modulation classification adversarial defense method based on decoupled Hilbert-Schmidt information bottleneck DHSIB, characterized in that: The specific steps of the method are: Step 1: Build a supervised decoupling model architecture with Hilbert-Schmidt information bottleneck. The entire architecture includes the classification feature extractor E cls , supplementary feature extractor E sup and classifier C, where E cls Used to extract task-related features, E sup is used to extract task-independent features, and C is used to determine the modulation category of the received signal based on the task-related features; Step 2: Convert the original signal domain sample x s Enter E cls 、E sup and C, we get the original signal domain classification loss Step 3: Use E cls and C generate adversarial domain signal x a , and x a Enter E cls 、E sup and C, we get the adversarial domain signal classification loss Step 4: Combine information bottleneck constraint adversarial training E cls 、E sup and C; Step 5: Repeat training steps 2, 3, and 4 until convergence.

2. The method according to claim 1, characterized in that: In step 2, firstly, x s Input to E cls 、E sup , respectively obtain quasi-task related features Quasi-task-irrelevant features Then Enter C to obtain the categorical logitsp s , and get the original classification loss: where CE(·,·) is the cross entropy loss function.

3. The method according to claim 2, characterized in that: In step 3, we first generate the adversarial domain signal, and then re-execute the entire process of step 2: x a =At(x s ,E cls ,C)(2), Where At(·,·) represents the selected adversarial sample generation method, and x a Input to E cls 、E sup , respectively and Will After entering C, you get p a , we get the adversarial domain signal classification loss:

4. The method according to claim 3, characterized in that: In step 4, the information bottleneck constraint is calculated: Where I(·; ·) represents mutual information, and γ represents the compression ratio threshold for compressing X to Z. Formula (4) is solved using the Lagrangian relaxation method, thereby transforming the nonlinear constrained optimization problem into an unconstrained problem, thereby achieving the purpose of simplifying the solution: Where β is the Lagrange multiplier; the Hilbert-Schmidt independence criterion HSIC is used to measure the mutual independence between two random variables. When the sample is sufficient, HSIC is given by the following formula: where m and n are random samples from M and N; k m and k n is the kernel; and in the case of finite samples, HSIC(M;N) is expressed as: Where ω is the number of samples; K M and K N is the kernel matrix, and the elements in the i-th row and j-th column are k M (m i ,m j ) and k N (n i ,n j );H is the unit matrix of order ω, Tr(·) is the matrix trace function; Therefore, the following sub-optimization objectives are proposed in combination with the decoupling framework: Therefore, the total loss of adversarial training based on DHSIB is: Among them, β s and β a Yes Control and Adjustment factor for the ratio.

5. The method according to claim 4, characterized in that: In step 5, after the final convergence, discard the E used for auxiliary training sup , leaving only E sup and C for prediction: y=i:p(i)=maxC(E cls (x))(11)。

Images