Model decision-based trajectory similarity measurement black box countermeasure attack method and system

Abstract

The invention relates to the technical field of trajectory representation task processing, in particular to a trajectory similarity measurement black box countermeasure attack method and system based on model decision, a trajectory data set is utilized to train a trajectory representation model, and the trained trajectory representation model is used as a target model of a to-be-countermeasure attack; obtaining node vulnerability under fixed disturbance intensity and an optimal disturbance direction under single-point disturbance based on the target model and single-point vulnerability scanning, and constructing a single-point disturbance sample; and on the basis of node vulnerability and the optimal disturbance direction, single-point disturbance samples are aggregated to a high-dimensional hyperspherical surface, a trajectory iteration direction is determined in a limited iteration space according to a gradient of model decision, and an optimal target trajectory confrontation sample is obtained and output. According to the method, the gradually smaller adversarial disturbance is found around the target trajectory, and the target model outputs a wrong similarity measurement result on the premise that the adversarial trajectory sample meets the condition that the data field is very close to the target trajectory through the disturbance, so that the adversarial vulnerability of the trajectory similarity measurement model is checked.

Description

Technical Field

[0001] The present invention relates to the technical field of trajectory representation task processing, and in particular to a trajectory similarity measurement black box counterattack method and system based on model decision. Background Art

[0002] In recent years, with the rapid development of modern Internet of Things technology, especially in the development process of breakthroughs in the fields of autonomous driving, edge computing and geographic information systems, human society has collected a large amount of trajectory data. The analysis of massive trajectory data and the mining of deep semantics of trajectory data have become a hot topic in the data mining industry. In technologies such as autonomous driving path selection, navigation path recommendation, and travel time prediction, trajectory representation can extract the key features of trajectories. This task is a basic problem and the basis of most trajectory data-related tasks, such as trajectory clustering, route recommendation, and animal migration pattern analysis. In the trajectory representation task, one of the most representative downstream tasks is to measure trajectory similarity. Using deep learning models to measure trajectory similarity means expressing the similarity of trajectories by calculating the distance between trajectory embeddings of target trajectory pairs. Trajectory similarity measurement plays a vital role in engineering applications. The downstream task users naturally believe that the trajectory similarity measurement results based on deep learning models are accurate and reliable. However, the inherent characteristics of deep neural networks that are vulnerable to adversarial sample attacks pose a great threat to the security of trajectory similarity measurement based on deep learning.

[0003] The main application scenarios of black-box adversarial attacks are classification tasks in the field of computer vision. In addition, there are also works using adversarial attacks to test the robustness of models when the target model is a graph structure, text data, and regression tasks. In different application scenarios, black-box adversarial attacks can be divided into three different attack paradigms, including transfer-based attacks, decision-based attacks, and zero-order optimization-based attacks. Transfer-based attacks only require training an observable alternative model, and adversarial samples that attack the target model are generated through the alternative model. These methods use the transferability of adversarial samples to circumvent the problem of being unable to calculate the gradient of the black-box target model; decision-based attacks work in a more practical environment, and the source of information is only the label obtained by querying the output of the target model. This attack paradigm starts with adversarial samples that have been misclassified by the target model, and gradually generates perturbations by iteratively sampling in the input space of the original data, and finds adversarial samples that are closer to the original data through iterative queries; zero-order optimization-based attacks replace the gradient calculation of the target model with queries and gradient estimation to solve the problem that the target model cannot be back-propagated. For the trajectory similarity measurement task, since the purpose of this task is completely different from that of the classification task in the image processing field, the image processing task aims to add noise that is difficult for the human eye to detect, while the original data of the trajectory similarity measurement is more sensitive to abnormal disturbances and has more stringent requirements on the amount of disturbance. It is necessary to design an adversarial attack process specifically based on the characteristics of the trajectory similarity measurement task; at the same time, the adversarial standard of the classification task is generally based on labels. As long as the predicted label is misclassified or classified to the target label, the sample is considered to be adversarial. The trajectory representation does not have such a clear adversarial boundary as the classification task. It requires clear trajectory adversarial samples so that the model can obtain a trajectory representation that is very different from the original trajectory. Summary of the invention

[0004] To this end, the present invention provides a black-box adversarial attack method and system for trajectory similarity measurement based on model decision. By finding gradually smaller adversarial perturbations around the target trajectory, the perturbations are used to make the adversarial trajectory samples meet the premise that the data domain is very close to the target trajectory, so that the target model outputs an erroneous similarity measurement result, so as to test the adversarial vulnerability of the trajectory similarity measurement model and improve the robustness of the deep learning model in trajectory-related tasks.

[0005] According to the design scheme provided by the present invention, on the one hand, a trajectory similarity measurement black box anti-attack method based on model decision is provided, comprising:

[0006] Constructing a trajectory data set, wherein each trajectory in the trajectory data set is represented by an ordered sequence consisting of trajectory point sampling time and trajectory point latitude and longitude;

[0007] Using the trajectory dataset to train a trajectory representation model, and using the trained trajectory representation model as a target model to be attacked, the trajectory representation model is used to map the trajectory to an embedding vector space and output a trajectory embedding vector representation;

[0008] Based on the target model and single-point vulnerability scanning, the node vulnerability under fixed disturbance intensity and the optimal disturbance direction under single-point disturbance are obtained, and a single-point disturbance sample is constructed;

[0009] Based on node vulnerability and optimal perturbation direction, single-point perturbation samples are aggregated into a high-dimensional hypersphere. The trajectory iteration direction is determined according to the gradient of the model decision in the restricted iteration space to obtain and output the optimal target trajectory adversarial sample.

[0010] As a black box anti-attack method for trajectory similarity measurement based on model decision of the present invention, further, a trajectory representation model is trained using a trajectory data set, including:

[0011] The trajectory data set is divided into a training data set and a test data set according to a specified ratio, and the training data set is enhanced by a data enhancement method, wherein the data enhancement method includes but is not limited to: trajectory point downsampling and trajectory distortion;

[0012] A trajectory representation model is set, the trajectory representation model is trained using the enhanced data and the training data set, and the trained trajectory representation model is fine-tuned using the test data set, so that the trained and fine-tuned trajectory representation model is used as a target model to be attacked.

[0013] As a black box anti-attack method for trajectory similarity measurement based on model decision of the present invention, further, the node vulnerability under fixed disturbance intensity and the optimal disturbance direction under single-point disturbance are obtained, including:

[0014] Set the perturbation intensity and iteration angle, and select the first trajectory point within the target trajectory;

[0015] Iteratively perturb the selected trajectory point to a finite discrete point on a circle with the selected trajectory point as the center and the perturbation intensity as the radius, and traverse different discrete points on the circle through a fixed iteration angle to form a discrete point set;

[0016] Replace the first trajectory point in the trajectory data set with a discrete point set to obtain a single-point perturbation trajectory set;

[0017] Use the target model to obtain the original trajectory embedding representation in the trajectory dataset and the adversarial trajectory embedding representation in the single-point perturbation trajectory set, and calculate and record the single-point perturbation loss based on the original trajectory embedding representation and the adversarial trajectory embedding representation;

[0018] Restore the first trajectory point in the trajectory data set to its initial state, select the next trajectory point of the target trajectory to traverse and record the single-point disturbance loss of the corresponding trajectory point until all trajectory points of the target trajectory are traversed;

[0019] A set of single-point perturbation trajectories corresponding to the maximum single-point perturbation loss is selected, and the selected set of single-point perturbation trajectories is used as the optimal single-point perturbation sample.

[0020] As the black box adversarial attack method of trajectory similarity measurement based on model decision of the present invention, further, the single-point perturbation samples are aggregated into a high-dimensional hypersphere, including:

[0021] Aggregate the single-point perturbation samples into a high-dimensional data space of a specified dimension, where the specified dimension is the number of discrete trajectory points of the single-point perturbation samples multiplied by 2;

[0022] The single-point perturbation sample is moved to each dimension by the same step length, and is mapped onto a hypersphere in the direction of the original trajectory of the trajectory dataset or in the opposite direction, respectively. The radius of the hypersphere is the perturbation intensity.

[0023] As a black box anti-attack method for trajectory similarity measurement based on model decision of the present invention, further, the trajectory iteration direction is determined according to the gradient of the model decision in the restricted iteration space, including:

[0024] The single-point perturbation sample is used as the starting point for iteration, and the single-point perturbation loss between each perturbation sample in the neighborhood under the current iteration and the original trajectory data in the trajectory dataset is calculated. The gradient is estimated based on the single-point perturbation loss, and the estimated gradient is used to determine the trajectory iteration direction.

[0025] As the trajectory similarity measurement black box anti-attack method based on model decision of the present invention, further, it also includes:

[0026] Obtain the trajectory embedding representation of the adversarial sample based on the target model, and obtain the similarity ranking between the adversarial sample and the original trajectory in the trajectory dataset through the similarity measurement function and the indicative function;

[0027] The attack effect of adversarial samples is measured by using the average similarity ranking and similarity ranking distribution of adversarial samples.

[0028] On the other hand, the present invention also provides a black box adversarial attack system for trajectory similarity measurement based on model decision, comprising: a data acquisition module, a model training module, a disturbance setting module and an adversarial attack module, wherein:

[0029] A data acquisition module, used to construct a trajectory data set, each trajectory in the trajectory data set is represented by an ordered sequence consisting of trajectory point sampling time and trajectory point latitude and longitude;

[0030] A model training module is used to train a trajectory representation model using a trajectory data set, and use the trained trajectory representation model as a target model to be attacked. The trajectory representation model is used to map the trajectory to an embedded vector space and output a trajectory embedded vector representation;

[0031] The disturbance setting module is used to obtain the node vulnerability under fixed disturbance intensity and the optimal disturbance direction under single-point disturbance based on the target model and single-point vulnerability scanning, and to construct a single-point disturbance sample;

[0032] The adversarial attack module is used to aggregate single-point perturbation samples into a high-dimensional hypersphere based on node vulnerability and optimal perturbation direction, determine the trajectory iteration direction according to the gradient of model decision in the restricted iteration space, and obtain and output the optimal target trajectory adversarial sample.

[0033] Beneficial effects of the present invention:

[0034] Based on trajectory similarity, the present invention performs vulnerability scanning on each trajectory point, obtains node vulnerability under fixed disturbance intensity and optimal disturbance direction under single-point disturbance; based on the node vulnerability set and optimal disturbance direction, we aggregate the discrete trajectory point sequence into a high-dimensional hypersphere, and calculate the iteration direction of the entire trajectory according to the gradient of the final decision of the model in this restricted iteration space, and obtain the optimal trajectory adversarial sample. Experiments have shown that the scheme can effectively conduct adversarial attacks on trajectory similarity metrics, has better adaptability and versatility, and has good application prospects in trajectory task processing in the fields of autonomous driving path selection, navigation path recommendation, travel time prediction, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of the black box adversarial attack process of trajectory similarity measurement based on model decision in the embodiment;

[0036] Figure 2 This is a schematic diagram of implementing an adversarial attack on the trajectory representation model on the Porto dataset in the embodiment;

[0037] Figure 3 This is a schematic diagram of the single-point vulnerability scanning process in the embodiment;

[0038] Figure 4 This is a diagram illustrating the estimation of the partial derivative of the adversarial sample in the x2 direction in the embodiment. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0040] Adversarial attacks can be divided into three categories according to the information domain accessible to the attacker when conducting adversarial attacks. White-box attacks refer to attacks in which the attacker has full access to the target model, including the model architecture, model parameters, model outputs, and corresponding labels. Gray-box attacks refer to attacks in which the attacker has partial access to the target model, including the unlabeled input traffic state and output links. Black-box attacks refer to attacks in which the attacker cannot access any internal structure of the target model. In this attack setting, adversarial samples can only be generated by querying the output of the target model or using a white-box alternative model to complete a transfer-based attack. Deep neural networks are naturally vulnerable to hidden perturbations. Based on this feature and with the help of the gradient information of the target model, many white-box adversarial attack methods have been developed as tools to evaluate the robustness of deep neural network models. However, white-box attack methods can only be applied when the target model is fully understood, and the attack performance of these methods will be significantly reduced in black-box scenarios because the attacker lacks knowledge of the target model in black-box scenarios. On the other hand, white-box attacks that are tailored to specific target deep neural network models usually lead to overfitting of the network architecture and weights of the target model in white-box settings and reduce the transferability of generated adversarial perturbations. In contrast, black-box attacks are more practical and can reflect the adversarial robustness of the model under actual working conditions, because the internal information of the target model is usually not available during the production process. But at the same time, from a technical implementation point of view, the construction and implementation of black-box attacks are more difficult. On the one hand, compared with white-box attacks, attackers in black-box settings cannot calculate the gradient of the target model. Therefore, it is unlikely to use optimization-based or gradient-based attacks to directly find adversarial samples with small noise amplitudes. On the other hand, the only observable information about the target model is the output obtained by querying the model, which usually means that the attacker's attack cost is high and the number of queries is limited. Under the premise of limited attack cost, it is very difficult to continue to compress the perturbation amplitude based on the adversarial samples that have been found.

[0041] In this embodiment of the present invention, a black box adversarial attack on a deep trajectory representation model is described in detail in Figure 1 As shown, a black box adversarial attack method for trajectory similarity measurement based on model decision is provided, including:

[0042] S101, constructing a trajectory data set, wherein each trajectory in the trajectory data set is represented by an ordered sequence consisting of trajectory point sampling time and trajectory point longitude and latitude.

[0043] Specifically, the original trajectory data for trajectory similarity measurement can be collected in the real world using equipment such as aircraft, ships, and urban transportation, or commonly used trajectory datasets (such as the Porto dataset) can be directly downloaded to form a trajectory set Where T i represents a trajectory, N is the set The total number of trajectories in the collection Each trajectory T is an ordered sequence of triplets consisting of longitude, latitude and sampling time, expressed as T = {(t i ,lon i ,at i )|i=1,2,...,n}, where t i represents the sampling time of the i-th point in the trajectory T, and when t i >t j When i>j, lon i and lat i Respectively represent the longitude and latitude of the i-th point.

[0044] S102, using the trajectory data set to train a trajectory representation model, and using the trained trajectory representation model as a target model to be attacked, wherein the trajectory representation model is used to map the trajectory to an embedding vector space and output a trajectory embedding vector representation.

[0045] The specific design can include the following contents:

[0046] The trajectory data set is divided into a training data set and a test data set according to a specified ratio, and the training data set is enhanced by a data enhancement method, wherein the data enhancement method includes but is not limited to: trajectory point downsampling and trajectory distortion;

[0047] A trajectory representation model is set, the trajectory representation model is trained using the enhanced data and the training data set, and the trained trajectory representation model is fine-tuned using the test data set, so that the trained and fine-tuned trajectory representation model is used as a target model to be attacked.

[0048] Select the trajectory representation model related to the trajectory similarity measurement task. For example, you can choose from the commonly used deep trajectory representation models such as t2vec, TrjSR, TrajCL, etc. The pre-training of the deep trajectory representation model is completed through the following steps: loading the Porto training and test datasets, using trajectory point downsampling and trajectory distortion to enhance the training set data, defining the trajectory similarity measurement model, training the deep trajectory representation model based on the training set, and testing the deep trajectory representation model based on the test set.

[0049] The original trajectory in the Porto trajectory dataset is input into the trained trajectory representation model to obtain the embedding representation result of the original trajectory T. The embedding is a vector h, and in is the embedding space, c is the dimension. Trajectory representation learning aims to train a trajectory encoder E: Will Middle track T i Mapped to the c-dimensional embedding vector h i, denoted as h i =E(T i ).

[0050] S103, based on the target model and single-point vulnerability scanning, obtain the node vulnerability under fixed disturbance intensity and the optimal disturbance direction under single-point disturbance, and construct a single-point disturbance sample.

[0051] Specifically, it can be designed to include the following contents:

[0052] Set the perturbation intensity and iteration angle, and select the first trajectory point within the target trajectory;

[0053] Iteratively perturb the selected trajectory point to a finite discrete point on a circle with the selected trajectory point as the center and the perturbation intensity as the radius, and traverse different discrete points on the circle through a fixed iteration angle to form a discrete point set;

[0054] Replace the first trajectory point in the trajectory data set with a discrete point set to obtain a single-point perturbation trajectory set;

[0055] Use the target model to obtain the original trajectory embedding representation in the trajectory dataset and the adversarial trajectory embedding representation in the single-point perturbation trajectory set, and calculate and record the single-point perturbation loss based on the original trajectory embedding representation and the adversarial trajectory embedding representation;

[0056] Restore the first trajectory point in the trajectory data set to its initial state, select the next trajectory point of the target trajectory to traverse and record the single-point disturbance loss of the corresponding trajectory point until all trajectory points of the target trajectory are traversed;

[0057] A set of single-point perturbation trajectories corresponding to the maximum single-point perturbation loss is selected, and the selected set of single-point perturbation trajectories is used as the optimal single-point perturbation sample.

[0058] Define the hyperparameter perturbation intensity R (i.e., perturbation radius) and iteration angle θ; select the first trajectory point (t0, lon0, lat0) in the target trajectory, where the subscript is the sequence of trajectory points starting from zero, and subscript 0 is the first trajectory point in the trajectory. Iteratively perturb the trajectory point to a finite number of discrete points on a circle with (t0, lon0, lat0) as the center and radius R, and traverse different points on the circle by fixing the iteration angle θ, that is, traverse a set, which can be specifically expressed as:

[0059]

[0060] Where (x i ,y i ) is the latitude and longitude of the target point after the point is disturbed once. On this basis, the points in the original trajectory T with the subscript 0 are replaced by the set The elements in can be obtained as follows:

[0061]

[0062] Where (x′, y′) is a set For any element in the original trajectory T, remove the original point with subscript 0 and replace it with the set Any element in will get a single-point perturbed trajectory. i represents the set of result trajectories containing all the single-point perturbations of the i-th point in the trajectory. Calculate the L1 difference between the two embedded representations of the perturbed trajectory and the original trajectory, that is, the L1 loss, where the L1 loss is expressed as:

[0063]

[0064] Among them, E(T) j is the jth element in the embedding representation of the original trajectory T, E(T′) j is the jth element in the embedding representation of the adversarial trajectory T′, and |E(T)| is the modulus of the model output vector.

[0065] After recording the L1 loss, restore the point to the initial position of the trajectory point (t0, lon0, lat0), select the next point and repeat the iterative perturbation until all nodes on the target trajectory are traversed. Specifically, for each trajectory, all elements of the following set need to be traversed:

[0066]

[0067] Among them, |S| represents the number of points in the trajectory. After the traversal is completed, the trajectory used for the test with the largest L1 loss is obtained and used as the optimal single-point perturbation sample output by the single-point vulnerability scanning module.

[0068] S104. Based on the node vulnerability and the optimal perturbation direction, the single-point perturbation samples are aggregated into a high-dimensional hypersphere, and the trajectory iteration direction is determined according to the gradient of the model decision in the restricted iteration space to obtain and output the optimal target trajectory adversarial sample.

[0069] Specifically, the single-point perturbation samples are aggregated into a high-dimensional hypersphere, which can be designed to include:

[0070] Aggregate the single-point perturbation samples into a high-dimensional data space of a specified dimension, where the specified dimension is the number of discrete trajectory points of the single-point perturbation samples multiplied by 2;

[0071] The single-point perturbation sample is moved to each dimension by the same step length, and is mapped onto a hypersphere in the direction of the original trajectory of the trajectory dataset or in the opposite direction, respectively. The radius of the hypersphere is the perturbation intensity.

[0072] The single-point perturbation sample is used as the starting point for iteration, and the single-point perturbation loss between each perturbation sample in the neighborhood under the current iteration and the original trajectory data in the trajectory dataset is calculated. The gradient is estimated based on the single-point perturbation loss, and the estimated gradient is used to determine the trajectory iteration direction.

[0073] Among them, the discrete point sequence of the trajectory in the adversarial sample is aggregated into a high-dimensional space, and then the iteration direction of the entire trajectory is calculated based on the gradient of the model's final decision. The adversarial sample is used as the starting point of the current step for iteration. First, the current sample is aggregated into a high-dimensional data space with a dimension of 2 times the number of trajectory points, and then the direction of the aggregated gradient on the hypersphere with a radius of R is estimated. The sample is moved in small steps of the same step size in each dimension, and mapped to a hypersphere with a radius of perturbation intensity R in the direction of the original sample or in the opposite direction. The specific mapping method is:

[0074]

[0075] Among them, x is the sample data to be mapped, ‖x‖ is the norm of the sample data, and x i Represents the i-th dimension data of x. Calculate the L1 loss of each sample in the generated neighborhood and the original sample, and combine these L1 losses to estimate the gradient. Use the gradient to calculate the next iteration direction. The way to calculate the partial derivative is as follows:

[0076]

[0077] Among them, δ i represents the i-th dimension component in the high-dimensional data space, |δ i | represents δ i The model, T ′ +δ i Indicates T ′ A small step in the positive direction of the i-th axis, grad i represents the ith partial derivative. The calculation method of the aggregate gradient is:

[0078]

[0079] Where grad represents the current gradient, and the partial derivatives of each dimension are aggregated to obtain the aggregated gradient.

[0080] Input adversarial sample - calculate decision gradient - calculate step size - update adversarial trajectory sample, repeat the process to obtain the final adversarial trajectory sample.

[0081] For adversarial trajectory samples, the trajectory embedding representation of the adversarial sample can be obtained based on the target model, and the similarity ranking between the adversarial sample and the original trajectory in the trajectory dataset can be obtained through the similarity measurement function and the indicative function; the attack effect of the adversarial sample is measured by the average similarity ranking and similarity ranking distribution of the adversarial sample.

[0082] The accuracy of trajectory similarity calculated by the target model is tested on adversarial trajectory samples, the similarity ranking between the adversarial trajectory samples and the corresponding original trajectories is calculated, the average ranking and ranking distribution are statistically analyzed, and the effectiveness of the adversarial attack is verified.

[0083] That is, for the final adversarial trajectory sample T′, the adversarial trajectory sample is input into the target model to obtain the trajectory representation, and the similarity ranking with the original trajectory sample T is calculated. The specific calculation formula can be expressed as:

[0084]

[0085] Where f is the similarity measurement function, is an indicative function, that is, if the condition is true, it outputs 1, otherwise it outputs 0, T i represents the i-th trajectory in the trajectory dataset. The attack effect is measured by the average similarity ranking and similarity ranking distribution of the adversarial trajectory sample set Q′:

[0086]

[0087] Among them, Q′ represents the set of adversarial trajectory samples in the experiment, R i represents the similarity ranking between the i-th adversarial trajectory sample in Q′ and its corresponding original trajectory sample, represents the indicative function, I k represents the kth ranking interval, for example, I1 = (10, 49], I2 = (50, 99], etc. The average ranking measures the attack effect of the attack method on the target model's ability to represent trajectory data, and can also measure the effect of the attack trajectory similarity measurement task, while the ranking distribution measures the statistical changes in the original representation results of the target model caused by the adversarial trajectory samples.

[0088] Furthermore, based on the above method, an embodiment of the present invention also provides a trajectory similarity measurement black box adversarial attack system based on model decision, comprising: a data acquisition module, a model training module, a disturbance setting module and an adversarial attack module, wherein:

[0089] A data acquisition module, used to construct a trajectory data set, each trajectory in the trajectory data set is represented by an ordered sequence consisting of trajectory point sampling time and trajectory point latitude and longitude;

[0090] A model training module is used to train a trajectory representation model using a trajectory data set, and use the trained trajectory representation model as a target model to be attacked. The trajectory representation model is used to map the trajectory to an embedded vector space and output a trajectory embedded vector representation;

[0091] The disturbance setting module is used to obtain the node vulnerability under fixed disturbance intensity and the optimal disturbance direction under single-point disturbance based on the target model and single-point vulnerability scanning, and to construct a single-point disturbance sample;

[0092] The adversarial attack module is used to aggregate single-point perturbation samples into a high-dimensional hypersphere based on node vulnerability and optimal perturbation direction, determine the trajectory iteration direction according to the gradient of model decision in the restricted iteration space, and obtain and output the optimal target trajectory adversarial sample.

[0093] In order to verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0094] like Figure 2 The figure shows the adversarial attack on the trajectory representation model on the Porto dataset. In the adversarial attack, the single-point vulnerability scanning module is used to traverse the target trajectory node by node to obtain the optimal single-point perturbation sample, such as Figure 3 As shown in the figure, the red and green trajectories are the trajectories tested during the scanning process, and the blue trajectory is the best adversarial trajectory under single-point perturbation; the contour step diagram on the right shows the change in trajectory similarity when the point is moved to this position. Different colors represent the difference in similarity with the original trajectory when the point is perturbed to this position. The difference becomes larger from the inside to the outside, and the contour lines are irregular. The perturbation result in the figure is the position where the similarity difference between the two trajectories is maximized under a fixed perturbation intensity. The iterative process of estimating the direction of the aggregated gradient on the hypersphere with a radius of R is as follows Figure 4 As shown, plane H1 is parallel to the x2 axis and passes through the center of the sphere. The blue node represents the current position of the adversarial sample. In order to determine the iteration direction, it is necessary to estimate the partial derivative in the x2 direction. The position after iteration is the position of the transparent node in the figure. This position is obtained in two steps. The first step is to move the sample a small step along the x2 axis, and the second step is to map it back to the R hypersphere.

[0095] In this adversarial attack, Figure 2 As shown in Figure 2, the target trajectory changes in the data space as the blue trajectory point moves to the red trajectory point. a and T b are three different trajectories in the dataset, T′ is the generated adversarial trajectory sample, and the trajectories T, T′, T a , T b Input into the trajectory representation model, and obtain the vector representation V, V′, V corresponding to the model output trajectory in turn. a , V bWe use the L1 norm to calculate the difference between vectors. The lower part of the figure represents the vectors V′, V a , V b The difference between the vector V and the similarity metric ranking between the corresponding trajectory pairs. As can be seen from the figure, the adversarial trajectory sample T′ is very close to the original target trajectory T in the data space, but the similarity ranking between the adversarial trajectory sample T′ and the original target trajectory T is the lowest, which can explain that an effective adversarial attack can be implemented for the trajectory similarity metric in this case.

[0096] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0097] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0098] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0099] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0100] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A black-box adversarial attack method for trajectory similarity measurement based on model decision, characterized in that: Include: Constructing a trajectory data set, wherein each trajectory in the trajectory data set is represented by an ordered sequence consisting of trajectory point sampling time and trajectory point latitude and longitude; Using the trajectory dataset to train a trajectory representation model, and using the trained trajectory representation model as a target model to be attacked, the trajectory representation model is used to map the trajectory to an embedding vector space and output a trajectory embedding vector representation; Based on the target model and single-point vulnerability scanning, the node vulnerability under fixed disturbance intensity and the optimal disturbance direction under single-point disturbance are obtained, and a single-point disturbance sample is constructed; Based on node vulnerability and optimal perturbation direction, single-point perturbation samples are aggregated into a high-dimensional hypersphere. The trajectory iteration direction is determined according to the gradient of the model decision in the restricted iteration space to obtain and output the optimal target trajectory adversarial sample.

2. The black-box adversarial attack method for trajectory similarity measurement based on model decision according to claim 1 is characterized in that: Construct a trajectory dataset, including: Using a collection device to collect raw trajectory data, and constructing a trajectory data set based on the raw trajectory data, the collection device being an aircraft, a ship or a vehicle; Or use the trajectory public data set to build a trajectory dataset.

3. The black-box adversarial attack method for trajectory similarity measurement based on model decision according to claim 1, characterized in that: Use the trajectory dataset to train the trajectory representation model, including: The trajectory data set is divided into a training data set and a test data set according to a specified ratio, and the training data set is enhanced by a data enhancement method, wherein the data enhancement method includes but is not limited to: trajectory point downsampling and trajectory distortion; A trajectory representation model is set, the trajectory representation model is trained using the enhanced data and the training data set, and the trained trajectory representation model is fine-tuned using the test data set, so that the trained and fine-tuned trajectory representation model is used as a target model to be attacked.

4. The black-box adversarial attack method for trajectory similarity measurement based on model decision according to claim 1, characterized in that: Obtain node vulnerability under fixed disturbance intensity and optimal disturbance direction under single-point disturbance, including: Set the perturbation intensity and iteration angle, and select the first trajectory point within the target trajectory; Iteratively perturb the selected trajectory point to a finite discrete point on a circle with the selected trajectory point as the center and the perturbation intensity as the radius, and traverse different discrete points on the circle through a fixed iteration angle to form a discrete point set; Replace the first trajectory point in the trajectory data set with a discrete point set to obtain a single-point perturbation trajectory set; Use the target model to obtain the original trajectory embedding representation in the trajectory dataset and the adversarial trajectory embedding representation in the single-point perturbation trajectory set, and calculate and record the single-point perturbation loss based on the original trajectory embedding representation and the adversarial trajectory embedding representation; Restore the first trajectory point in the trajectory data set to its initial state, select the next trajectory point of the target trajectory to traverse and record the single-point disturbance loss of the corresponding trajectory point until all trajectory points of the target trajectory are traversed; A set of single-point perturbation trajectories corresponding to the maximum single-point perturbation loss is selected, and the selected set of single-point perturbation trajectories is used as the optimal single-point perturbation sample.

5. The black-box adversarial attack method for trajectory similarity measurement based on model decision according to claim 4 is characterized in that: The discrete point set is represented as: Among them, (t0, lon0, lat0) is the first trajectory point in the target trajectory, R is the disturbance intensity, θ is the iteration angle, (x i ,y o ) is the latitude and longitude of the target point after the current trajectory point is disturbed once, t0 represents the sampling time of the first trajectory point in the target trajectory, lon 0i and lat0 represent the longitude and latitude of the first track point in the target track, respectively.

6. The black-box adversarial attack method based on trajectory similarity measurement based on model decision according to claim 1, characterized in that: Aggregate single-point perturbation samples to a high-dimensional hypersphere, including: Aggregate the single-point perturbation samples into a high-dimensional data space of a specified dimension, where the specified dimension is the number of discrete trajectory points of the single-point perturbation samples multiplied by 2; The single-point perturbation sample is moved to each dimension by the same step length, and is mapped onto a hypersphere in the direction of the original trajectory of the trajectory dataset or in the opposite direction, respectively. The radius of the hypersphere is the perturbation intensity.

7. The black-box adversarial attack method for trajectory similarity measurement based on model decision according to claim 1 or 6, characterized in that: The trajectory iteration direction is determined according to the gradient of the model decision in the restricted iteration space, including: The single-point perturbation sample is used as the starting point for iteration, and the single-point perturbation loss between each perturbation sample in the neighborhood under the current iteration and the original trajectory data in the trajectory dataset is calculated. The gradient is estimated based on the single-point perturbation loss, and the estimated gradient is used to determine the trajectory iteration direction.

8. The black-box adversarial attack method for trajectory similarity measurement based on model decision according to claim 7, characterized in that: The gradient estimation formula is expressed as: Among them, δ i represents the i-th dimension component in the high-dimensional data space, grad i represents the ith partial derivative, and x is the sample data to be mapped, ‖x‖ is the norm of the sample data, and x i represents the i-th dimension data of x, R is the disturbance intensity, n is the number of sample data, T ′ +δ i Represents the trajectory T in the sample data ′ The corresponding component δ is offset along the positive direction of the i-th axis i step size, T represents the original trajectory in the trajectory dataset, and L1() represents the mean absolute error loss.

9. The black box adversarial attack method based on trajectory similarity measurement based on model decision according to claim 1, characterized in that: Also includes: Obtain the trajectory embedding representation of the adversarial sample based on the target model, and obtain the similarity ranking between the adversarial sample and the original trajectory in the trajectory dataset through the similarity measurement function and the indicative function; The attack effect of adversarial samples is measured by using the average similarity ranking and similarity ranking distribution of adversarial samples.

10. A black-box adversarial attack system based on trajectory similarity measurement based on model decision, characterized in that: It includes: data acquisition module, model training module, disturbance setting module and adversarial attack module, among which, A data acquisition module, used to construct a trajectory data set, each trajectory in the trajectory data set is represented by an ordered sequence consisting of trajectory point sampling time and trajectory point latitude and longitude; A model training module is used to train a trajectory representation model using a trajectory data set, and use the trained trajectory representation model as a target model to be attacked. The trajectory representation model is used to map the trajectory to an embedded vector space and output a trajectory embedded vector representation; The disturbance setting module is used to obtain the node vulnerability under fixed disturbance intensity and the optimal disturbance direction under single-point disturbance based on the target model and single-point vulnerability scanning, and to construct a single-point disturbance sample; The adversarial attack module is used to aggregate single-point perturbation samples into a high-dimensional hypersphere based on node vulnerability and optimal perturbation direction, determine the trajectory iteration direction according to the gradient of model decision in the restricted iteration space, and obtain and output the optimal target trajectory adversarial sample.

Images