Method and system for back door attack of human body sensing system based on IMU (Inertial Measurement Unit)

Abstract

The invention discloses an IMU (Inertial Measurement Unit)-based backdoor attack method and an IMU-based backdoor attack system, which are used for developing an attack technology capable of triggering a preset behavior under a specific condition by taking magnetometer data in acquired data as a target of embedding a backdoor by focusing on the characteristics of IMU sensor data. According to the method, time-frequency representation of magnetometer data is obtained by applying wavelet transform to the magnetometer data, backdoor features are embedded into specific frequency components, the backdoor features are used as backdoor triggers to be injected into benign samples, and hidden efficient backdoor attacks related to the triggers and the samples are achieved. And meanwhile, the flexible backdoor trigger is adopted, and the attack effect of the backdoor attack technology is controlled, so that the backdoor concealment is further improved. The method has important theoretical and practical significance in the fields of attack and defense for the security problem of the IMU-based human body sensing technology.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security technology, and in particular to a backdoor attack method and system for an IMU-based human perception system. Background Art

[0002] As the application of deep learning technology in human perception systems continues to expand, its security issues are becoming increasingly prominent. Human perception systems based on inertial measurement units (IMUs) capture human movements and behavior patterns through deep learning models and are widely used in smart health monitoring, human-computer interaction and other fields. However, the complexity and opacity of deep learning models provide potential opportunities for malicious backdoor attacks. Attackers may implant imperceptible backdoors during the model training phase, causing the system behavior to deviate from expectations under certain conditions, leading to privacy leaks, data misjudgments, and even physical safety accidents.

[0003] Backdoor attack technology is a network attack method that implants hidden functions in deep learning models, which allows attackers to control the behavior of the model under certain conditions. The core of this technology lies in the malicious manipulation of the data set during the training phase, in which the attacker embeds samples containing specific triggers. These samples are not significantly different from normal samples intuitively, but can cause the model to learn an additional task: when the model encounters inputs containing preset triggers in actual deployment, the output will be misled to a specific result specified by the attacker. This process does not affect the model's processing ability for normal samples, so it is extremely concealed and difficult to be discovered by conventional detection methods. For example, the Chinese patent application with publication number CN117972402A discloses a backdoor attack method for electromagnetic signal recognition models. In the training of the automatic modulation classification (AMC) model of the deep neural network, the backdoor attack steganography algorithm based on DWT and SVD extracts the different frequency features of the secret sample in the wavelet domain, and injects it into the benign sample as a backdoor trigger, realizing an invisible, trigger-related and efficient backdoor attack, which increases the concealment of the backdoor. However, the flexibility of the backdoor trigger and how to control the attack effect of the backdoor attack technology have not been solved, further increasing the concealment of the backdoor.

[0004] In the field of Internet of Things (IoT), human behavior sensing technology achieves high-precision monitoring and analysis of human behavior by integrating advanced sensor hardware and intelligent data processing algorithms. At present, the research on backdoor attack technology is mainly focused on deep learning application fields such as computer vision and speech recognition. In contrast, backdoor attack technology based on IMU (Inertial Measurement Unit) human perception data has not been fully studied and developed. Although IMU sensors play an important role in many fields such as health monitoring, motion analysis, and human-computer interaction, the related security issues, especially the potential risks of backdoor attacks, have not received corresponding attention. Summary of the invention

[0005] The technical problem to be solved by the present invention is how to further increase the concealment of backdoor attacks.

[0006] The present invention solves the above technical problems through the following technical means:

[0007] The present invention discloses a backdoor attack method for an IMU-based human perception system, the method comprising the following steps:

[0008] S1. Obtain a normal IMU benign data set, extract magnetic data for preprocessing, and select a specific attack target label y t .

[0009] S2. Extract a certain proportion of non-target samples from the magnetometer data and apply wavelet transform to the magnetometer data m(t) to obtain its time-frequency representation W m (f, t), and embed the backdoor feature in the specific frequency component f0 to obtain W′ m (f, t), which is then converted back to the time domain by inverse wavelet transform to form magnetometer data with backdoor.

[0010] S3. Mix the magnetometer data with backdoor into the benign data set to form a poisoned data set, and use the data set to train the deep learning model, and obtain the model with backdoor by minimizing the loss function.

[0011] S4. The attacker's host generates an attack instruction containing the trigger waveform characteristics required to trigger the backdoor. The MCU modulates the PWM wave according to the attack instruction and generates a magnetic signal through the inverter. The magnetic signal simulates the trigger characteristics and can be detected by the magnetometer sensor of the IMU.

[0012] S5. The IMU detects a trigger signal, and the victim model generates a specific judgment based on the backdoor behavior learned during the training phase.

[0013] Furthermore, the extracted magnetic data in step S1 is preprocessed, specifically:

[0014] The attacker first performs statistical analysis on the magnetometer data in the benign data set, and calculates the mean, standard deviation, and frequency spectrum of its basic statistics; then selects a wavelet basis function, which is used to convert the magnetometer data from the time domain to the frequency domain, and ensures that the backdoor features can be accurately embedded in the time-frequency representation.

[0015] Preferably, the wavelet basis function is a Daubechies function or a Haar function.

[0016] Furthermore, in step S2, the magnetometer data m(t) is subjected to wavelet transformation to obtain its time-frequency representation W m (f, t), and embed the backdoor feature in the specific frequency component f0, specifically:

[0017]

[0018] Among them, T(t) is the trigger function, sgn is the sign function, and α represents the amplitude parameter of the specific frequency component f0 of the trigger magnetic signal.

[0019] Furthermore, the f0 is specifically:

[0020] A set of specific frequency components are used to embed backdoor features. The selection of f0 is based on the above statistical analysis. The trigger frequency component f0 is controlled within the basic range of the data set to ensure that the embedded backdoor features neither affect the normal characteristics of the data nor effectively activate the backdoor under the trigger conditions.

[0021] Furthermore, the α is specifically:

[0022] The adjustment parameter that can control the backdoor attack effect is the amplitude parameter representing the specific frequency component f0 of the trigger magnetic signal; as α increases, the amplitude of the trigger magnetic signal also increases, thereby enhancing the impact on the magnetic signal.

[0023] Furthermore, the model containing the backdoor is obtained by minimizing the loss function as described in step S3, specifically:

[0024] The poisoning dataset is used to train the deep learning model. The model learns normal behavior and backdoor behavior. The loss function is as follows:

[0025] L(θ)=(L clean (θ)+α′·L poison (θ)

[0026] Among them, L(θ) is the loss function, θ is the model parameter, and L clean (θ) is the loss of clean samples, L poison (θ) is the loss of the poisoned sample, and α′ is the weight that adjusts the contribution of the two losses.

[0027] Furthermore, the single chip microcomputer described in step S4 modulates the PWM wave according to the attack instruction and generates a magnetic signal through the inverter, specifically:

[0028] The single chip microcomputer modulates the PWM wave according to the attack command and generates the required magnetic signal through the inverter. The PWM carrier is a sawtooth carrier with an upward trend at a frequency f c A periodic sharp decline, defined as:

[0029]

[0030] The PWM waveform is given by the following formula:

[0031]

[0032] Among them, S v (t) is the analog signal to be simulated, S c (t) is the carrier signal, A0, A1, B m , C m is the constant amplitude gain, φ d For phase shift.

[0033] Furthermore, the step S5 is specifically as follows:

[0034] IMU detects the trigger signal and adds the behavior data with the trigger signal, mistakenly judging it as the target label y set during poisoning. t ,The victim model generates specific judgments based on the backdoor behaviors learned in the training phase.

[0035] The advantages of the present invention are:

[0036] (1) High concealment: Different from the traditional method of simultaneously interfering with multiple modes of the IMU sensor (such as acceleration and angular velocity), this method innovatively selects a single mode of magnetometer data as the embedding point of the backdoor feature. In actual attacks, the designed attack device can trigger the backdoor and implement the attack by applying simple magnetic interference to the target device, rather than directly hijacking or modifying the transmitted data. This strategy enhances the concealment and practicality of the attack and improves its compatibility with different systems and application environments, thereby more effectively evading detection and successfully carrying out the attack. This method significantly improves concealment, reduces the possibility of detection, and simplifies the attack process in the real world.

[0037] (2) Flexible trigger conditions: The present invention transforms the time domain data into frequency domain representation by performing wavelet transform on the magnetometer data, and embeds backdoor features in specific frequency components. A highly flexible trigger mechanism is designed, allowing attackers to select and adjust embedded frequency components according to actual needs. This flexibility enables the trigger mechanism to be optimized according to the specific characteristics of the target system and existing security protection measures, thereby significantly improving the success rate and effectiveness of the attack.

[0038] (3) Controllable attack effect: The backdoor attack effect of the present invention is controllable. By adjusting the frequency domain trigger weight parameter α, the intensity and effect of the attack can be controlled, so that the attacker can adjust the attack strategy according to the characteristics of the target system and security protection measures to achieve the best attack effect.

[0039] (4) Strong practicability: The backdoor attack method of the present invention is not limited to a specific model or brand of IMU sensor, but has good compatibility and can be applied to a variety of IMU-driven human perception systems, increasing the scope of application of the attack method. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of a backdoor attack method for a human perception system based on IMU according to an embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of launching an attack on the backdoor attack system of the IMU-based human perception system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Example 1

[0044] like Figure 1 As shown, specifically, the embodiment discloses a backdoor attack method for an IMU-based human perception system, the method comprising the following steps:

[0045] S1. Obtain a normal IMU benign data set, extract magnetic data for preprocessing, and select a specific attack target label y t .

[0046] Furthermore, the step S1 is specifically as follows: In the attack preparation stage of this embodiment, the attacker obtains a benign training data set D based on the IMU human perception system benign , which contains a large amount of normal IMU data that has not been poisoned, for subsequent model training. benign Preprocessing of magnetic data.

[0047] Furthermore, the magnetic data preprocessing is specifically as follows: first, the magnetometer data set D in the benign data set is benign Statistical analysis is performed to calculate the mean, standard deviation, and frequency spectrum of its basic statistics. Secondly, a wavelet basis function is selected, which is used to convert the magnetometer data from the time domain to the frequency domain and ensure that the backdoor features can be accurately embedded in the time-frequency representation. The wavelet basis function of this embodiment uses Daubechies function or Haar function.

[0048] Further, select a specific attack target label y t ,This embodiment selects the perceived behavior of “falling” as the target label to define the ,specific behavior of the backdoor attack.

[0049] S2. Extract a certain proportion of non-target samples from the magnetometer data and apply wavelet transform to the magnetometer data m(t) to obtain its time-frequency representation W m (f, t), and embed the backdoor feature in the specific frequency component f0 to obtain W′ m (f, t), which is then converted back to the time domain by inverse wavelet transform to form magnetometer data with backdoor.

[0050] Furthermore, the step S2 is specifically as follows: first, from the benign training data set D benign A certain proportion of γ non-target samples are extracted from the dataset, where γ represents the poisoning rate, which refers to the proportion of poisoned samples extracted from the dataset to the total samples. The attacker obtains the magnetic field strength data m(t) from the magnetometer sensor of the IMU, including the measured values ​​of the three-axis magnetic field strength. Secondly, the magnetometer data m(t) is subjected to wavelet transform to obtain its time-frequency representation W m (f,t). Again, choose W m A specific set of frequency components f0 in (f, t) and in W m The backdoor feature is embedded in the frequency component of (f, t) and the wavelet coefficient is adjusted to obtain the new W′ m (f, t) is as follows:

[0051]

[0052] Among them, T(t) is the trigger function, sgn is the sign function, and α represents the amplitude parameter of the specific frequency component f0 of the trigger magnetic signal. Finally, W is transformed by inverse wavelet transform. m (f, t) is reconstructed into the time domain to obtain the magnetometer data m′(t) with backdoor.

[0053] Furthermore, the selection of f0 is based on the above statistical analysis, controlling the trigger frequency component f0 within the basic range of the data set, ensuring that the embedded backdoor feature neither affects the normal characteristics of the data nor effectively activates the backdoor under the trigger condition.

[0054] In particular, the choice of f0 is not unique. f0 can be set to any set of frequencies that meet the above conditions. During implementation, the frequency components in a specific action mode can be selected for embedding, such as the frequency components of the magnetic signal in the "falling" action, or the frequency components similar to the ambient magnetic field can be selected.

[0055] In particular, α is a parameter that controls the amplitude of the trigger. The larger the amplitude, the larger the amplitude of the trigger frequency component, and the easier it is for the deep learning model to learn the trigger, thereby increasing the success rate of the attack. By adjusting α, the intensity and effect of the backdoor attack can be controlled. At the same time, α needs to be controlled within an appropriate range, otherwise it may be noticed by the defense system or relevant personnel, thus exposing the backdoor attack behavior.

[0056] S3. Mix the magnetometer data with backdoor into the benign data set to form a poisoned data set, and use the data set to train the deep learning model, and obtain the model with backdoor by minimizing the loss function.

[0057] Furthermore, the step S3 is specifically as follows:

[0058] The attacker uses the backdoored magnetometer data m′(t) and the normal accelerometer and angular velocity data samples x p Mixed into the benign training data set to form the poisoned data set D poison ,The poisoned dataset is used to train the deep learning model, the model learns normal behavior and backdoor behavior, and the model containing the backdoor is obtained by minimizing the loss function.

[0059] Furthermore, the loss function is specifically:

[0060] L(θ)=L clean (θ)+α′·L poison (θ)

[0061] Among them, L(θ) is the loss function, θ is the model parameter, and L clean (θ) is the loss of clean samples, L poison (θ) is the loss of the poisoned sample, and α′ is the weight that adjusts the contribution of the two losses.

[0062] S4. The attacker's host generates an attack instruction containing the trigger waveform characteristics required to trigger the backdoor. The MCU modulates the PWM wave according to the attack instruction and generates a magnetic signal through the inverter. The magnetic signal simulates the trigger characteristics and can be detected by the magnetometer sensor of the IMU.

[0063] Further, such as Figure 2 As shown, the step 4 is specifically as follows:

[0064] The attacker's host generates an attack command, which contains the trigger waveform characteristics required to trigger the backdoor. The microcontroller modulates the PWM wave according to the attack command and generates the required magnetic signal through the inverter. The PWM carrier is the most common sawtooth carrier, which is rising and then c A periodic sharp decline, defined as:

[0065]

[0066] The PWM waveform is given by the following formula:

[0067]

[0068] Among them, S v (t) is the analog signal to be simulated, S c (t) is the carrier signal, A0, A1, B m , C m is the constant amplitude gain, φ d For phase shift.

[0069] Furthermore, the PWM wave generated by the microcontroller generates a signal through a resonant element, such as an LC circuit, and performs signal modulation to generate an oscillation signal of a specific frequency:

[0070] V LC (t) = V0·cos(2πf LC t+φ)

[0071] Where V0 is the amplitude of the oscillation signal, f LC is the resonant frequency of the LC circuit and φ is the initial phase.

[0072] The modulated oscillation signal is converted into a magnetic signal through an electromagnetic coil, which simulates the characteristics of the trigger and can be detected by the magnetometer sensor of the IMU. The generated magnetic signal generates specific interference to the IMU in the human body sensing device, so that the magnetic field strength data detected by the IMU contains the characteristics of the backdoor trigger.

[0073] S5. The IMU detects a trigger signal, and the victim model generates a specific judgment based on the backdoor behavior learned during the training phase.

[0074] Furthermore, the step S5 is specifically as follows:

[0075] When the IMU detects a trigger signal, the victim model generates a specific judgment based on the backdoor behavior learned in the training phase, that is, the current behavior data is mistakenly judged as the target label y set in the attack phase. t , as in this embodiment, “falling down” is mistakenly judged as “sitting up”.

[0076] Example 2

[0077] It should be further explained that, based on the same inventive concept as that of Example 1, the present invention also provides a backdoor attack system for an IMU-based human perception system, the system comprising the following modules:

[0078] The data collection and preprocessing module is used to obtain a normal IMU benign data set, extract magnetic data for preprocessing, and select a specific attack target label yt .

[0079] Furthermore, the data collection and preprocessing module includes the following units:

[0080] The data acquisition unit is used to obtain a benign training data set D based on the IMU human perception system during the attack preparation stage. benign ,This dataset contains a large amount of normal IMU data that has not been poisoned, which is used for subsequent model training.

[0081] The data preprocessing unit is used to, first, perform the magnetometer data set D in the benign data set benign Statistical analysis is performed to calculate the mean, standard deviation, and frequency spectrum of its basic statistics. Secondly, a wavelet basis function is selected, which is used to convert the magnetometer data from the time domain to the frequency domain and ensure that the backdoor features can be accurately embedded in the time-frequency representation. The wavelet basis function of this embodiment uses Daubechies function or Haar function.

[0082] Target selection unit, used to select a specific attack target label y t ,This embodiment selects the perceived behavior of “falling” as the target label to define the ,specific behavior of the backdoor attack.

[0083] The backdoor feature embedding module is used to extract a certain proportion of non-target samples from the magnetometer data and apply wavelet transform to the magnetometer data m(t) to obtain its time-frequency representation W m (f, t), and embed the backdoor feature in the specific frequency component f0 to obtain W′ m (f, t), which is then converted back to the time domain by inverse wavelet transform to form magnetometer data with backdoor.

[0084] Furthermore, the backdoor feature embedding module includes the following units:

[0085] The sample extraction unit is used to extract samples from the benign training data set D benign A certain proportion γ of non-target samples is extracted from the dataset, where γ represents the poisoning rate, which refers to the proportion of poisoned samples extracted from the dataset to the overall samples. The attacker obtains the magnetic field strength data m(t) from the magnetometer sensor of the IMU, including the measured values ​​of the three-axis magnetic field strength.

[0086] The wavelet transform unit is used to perform wavelet transform on the magnetometer data m(t) to obtain its time-frequency representation W m (f,t).

[0087] Back door embedded unit for selecting W m A specific set of frequency components f0 in (f, t) and in W mThe backdoor feature is embedded in the frequency component of (f, t) and the wavelet coefficient is adjusted to obtain the new W′ m (f, t) is as follows:

[0088]

[0089] Wherein, T(t) is the trigger function, sgn is the sign function, and α represents the amplitude parameter of the specific frequency component f0 of the trigger magnetic signal. The selection of f0 is based on the above statistical analysis, and the trigger frequency component f0 is controlled within the basic range of the data set to ensure that the embedded backdoor feature does not affect the normal characteristics of the data, and can effectively activate the backdoor under the trigger condition.

[0090] In particular, the choice of f0 is not unique. f0 can be set to any set of frequencies that meet the above conditions. During implementation, the frequency components in a specific action mode can be selected for embedding, such as the frequency components of the magnetic signal in the "falling" action, or the frequency components similar to the ambient magnetic field can be selected.

[0091] In particular, α is a parameter that controls the amplitude of the trigger. The larger the amplitude, the larger the amplitude of the trigger frequency component, and the easier it is for the deep learning model to learn the trigger, thereby increasing the success rate of the attack. By adjusting α, the intensity and effect of the backdoor attack can be controlled. At the same time, α needs to be controlled within an appropriate range, otherwise it may be noticed by the defense system or relevant personnel, thus exposing the backdoor attack behavior.

[0092] An inverse wavelet transform unit is used to transform W m (f, t) is reconstructed into the time domain to obtain the magnetometer data m′(t) with backdoor.

[0093] The poisoned model training module is used to mix the magnetometer data with backdoors into the benign data set to form a poisoned data set, and use the data set to train the deep learning model to obtain the model with backdoors by minimizing the loss function.

[0094] Furthermore, the poisoned model training module is specifically used for the attacker to use the magnetometer data m′(t) with backdoor and the normal accelerometer and angular velocity meter data samples x p Mixed into the benign training data set to form the poisoned data set D poison ,The poisoned dataset is used to train the deep learning model, the model learns normal behavior and backdoor behavior, and the model containing the backdoor is obtained by minimizing the loss function.

[0095] Furthermore, the loss function is specifically:

[0096] L(θ)=L clean (θ)+α′·L poison (θ)

[0097] Among them, L(θ) is the loss function, θ is the model parameter, and L clean (θ) is the loss of clean samples, L poison (θ) is the loss of the poisoned sample, and α′ is the weight that adjusts the contribution of the two losses.

[0098] The backdoor attack trigger module is used for the attacker's host to generate an attack instruction containing the trigger waveform characteristics required to trigger the backdoor. The microcontroller modulates the PWM wave according to the attack instruction and generates a magnetic signal through the inverter. The magnetic signal simulates the trigger characteristics and can be detected by the magnetometer sensor of the IMU.

[0099] Furthermore, the backdoor attack trigger module includes the following units:

[0100] The instruction generation unit is used for the attacker host to generate an attack instruction. The instruction contains the trigger waveform characteristics required to trigger the backdoor. The single-chip microcomputer modulates the PWM wave according to the attack instruction and generates the required magnetic signal through the inverter. The PWM carrier is the most common sawtooth carrier, which is rising and then c A periodic sharp decline, defined as:

[0101]

[0102] The PWM waveform is given by the following formula:

[0103]

[0104] Among them, S v (t) is the analog signal to be simulated, S c (t) is the carrier signal, A0, A1, B m , C m is the constant amplitude gain, φ d For phase shift.

[0105] The signal generation unit is used to generate a signal through a resonant element, such as an LC circuit, by using the PWM wave generated by the microcontroller to modulate the signal and generate an oscillation signal of a specific frequency:

[0106] V LC (t) = V0·cos(2πf LC t+φ)

[0107] Where V0 is the amplitude of the oscillation signal, f LC is the resonant frequency of the LC circuit and φ is the initial phase.

[0108] The modulated oscillation signal is converted into a magnetic signal through an electromagnetic coil, which simulates the characteristics of the trigger and can be detected by the magnetometer sensor of the IMU. The generated magnetic signal generates specific interference to the IMU in the human body sensing device, so that the magnetic field strength data detected by the IMU contains the characteristics of the backdoor trigger.

[0109] The backdoor attack implementation module is used when the IMU detects a trigger signal and the victim model generates a specific judgment based on the backdoor behavior learned during the training phase.

[0110] Furthermore, the backdoor attack real-time module is used for generating a specific judgment based on the backdoor behavior learned in the training phase when the IMU detects a trigger signal, that is, the current behavior data is incorrectly judged as the target label y set in the attack phase. t , as in this embodiment, “falling down” is mistakenly judged as “sitting up”.

[0111] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A backdoor attack method for an IMU-based human perception system, characterized in that: The following steps are involved: S1. Obtain a normal IMU benign data set, extract magnetic data for preprocessing, and select a specific attack target label y t ; S2. Extract a certain proportion of non-target samples from the magnetometer data and apply wavelet transform to the magnetometer data m(t) to obtain its time-frequency representation W m (f, t), and embed the backdoor feature in the specific frequency component f0 to obtain W′ m (f, t), which is then converted back to the time domain by inverse wavelet transform to form magnetometer data with backdoor; S3, mixing the magnetometer data with the backdoor into the benign data set to form a poisoned data set, and using the data set to train the deep learning model, and obtaining the model with the backdoor by minimizing the loss function; S4, the attacker's host generates an attack instruction containing the trigger waveform characteristics required to trigger the backdoor. The MCU modulates the PWM wave according to the attack instruction and generates a magnetic signal through the inverter. The magnetic signal simulates the trigger characteristics and can be detected by the magnetometer sensor of the IMU; S5. The IMU detects a trigger signal, and the victim model generates a specific judgment based on the backdoor behavior learned during the training phase.

2. According to claim 1, a backdoor attack method for an IMU-based human perception system is characterized in that: The extraction of magnetic data in step S1 is preprocessed as follows: The attacker first performs statistical analysis on the magnetometer data in the benign data set, and calculates the mean, standard deviation, and frequency spectrum of its basic statistics; then selects a wavelet basis function, which is used to convert the magnetometer data from the time domain to the frequency domain, and ensures that the backdoor features can be accurately embedded in the time-frequency representation.

3. According to claim 2, a backdoor attack method for an IMU-based human perception system is characterized in that: The wavelet basis function is a Daubechies function or a Haar function.

4. According to claim 1, a backdoor attack method for an IMU-based human perception system is characterized in that: Step S2 applies wavelet transform to the magnetometer data m(t) to obtain its time-frequency representation W m (f, t), and embed the backdoor feature in the specific frequency component f0, specifically: Among them, T(t) is the trigger function, sgn is the sign function, and α represents the amplitude parameter of the specific frequency component f0 of the trigger magnetic signal.

5. According to claim 4, a backdoor attack method for an IMU-based human perception system is characterized in that: The f0 is specifically: A set of specific frequency components are used to embed backdoor features. The selection of f0 is based on the above statistical analysis. The trigger frequency component f0 is controlled within the basic range of the data set to ensure that the embedded backdoor features neither affect the normal characteristics of the data nor effectively activate the backdoor under the trigger conditions.

6. According to claim 4, a backdoor attack method for an IMU-based human perception system is characterized in that: The α is specifically: The adjustment parameter that can control the backdoor attack effect is the amplitude parameter representing the specific frequency component f0 of the trigger magnetic signal; as α increases, the amplitude of the trigger magnetic signal also increases, thereby enhancing the impact on the magnetic signal.

7. The backdoor attack method for an IMU-based human perception system according to claim 1, characterized in that: The model containing the backdoor is obtained by minimizing the loss function in step S3, specifically: The poisoning dataset is used to train the deep learning model. The model learns normal behavior and backdoor behavior. The loss function is as follows: L(θ)=(L clean (θ)+α′·L poison (i)) Among them, L(θ) is the loss function, θ is the model parameter, and L clean (θ) is the loss of clean samples, L poison (θ) is the loss of the poisoned sample, and α′ is the weight that adjusts the contribution of the two losses.

8. The backdoor attack method for an IMU-based human perception system according to claim 1, characterized in that: The single chip microcomputer in step S4 modulates the PWM wave according to the attack instruction and generates a magnetic signal through the inverter, specifically: The single chip microcomputer modulates the PWM wave according to the attack command and generates the required magnetic signal through the inverter. The PWM carrier is a sawtooth carrier with an upward trend at a frequency f c A periodic sharp decline, defined as: The PWM waveform is given by the following formula: Among them, S v (t) is the analog signal to be simulated, S c (t) is the carrier signal, A0, A1, B m , C m is the constant amplitude gain, φ d For phase shift.

9. The backdoor attack method for an IMU-based human perception system according to claim 1, characterized in that: The step S5 is specifically as follows: IMU detects the trigger signal and adds the behavior data with the trigger signal, mistakenly judging it as the target label y set during poisoning. t ,The victim model generates specific judgments based on the backdoor behaviors learned in the training phase.

10. A backdoor attack system for an IMU-based human perception system, characterized in that: The system comprises: The data collection and preprocessing module is used to obtain a normal IMU benign data set, extract magnetic data for preprocessing, and select a specific attack target label y t ; The backdoor feature embedding module is used to extract a certain proportion of non-target samples from the magnetometer data and apply wavelet transform to the magnetometer data m(t) to obtain its time-frequency representation W m (f, t), and embed the backdoor feature in the specific frequency component f0, and then transform it back to the time domain through inverse wavelet transform to form magnetometer data with backdoor; The poisoned model training module is used to mix the magnetometer data with the backdoor into the benign data set to form a poisoned data set, and use the data set to train the deep learning model to obtain the model with the backdoor by minimizing the loss function; The backdoor attack trigger module is used for the attacker's host to generate an attack instruction containing the trigger waveform characteristics required to trigger the backdoor. The single-chip microcomputer modulates the PWM wave according to the attack instruction and generates a magnetic signal through the inverter. The magnetic signal simulates the trigger characteristics and can be detected by the magnetometer sensor of the IMU; The backdoor attack implementation module is used when the IMU detects a trigger signal and the victim model generates a specific judgment based on the backdoor behavior learned during the training phase.

Images