Model-decision-based trajectory similarity measurement black-box adversarial attack method and system

Abstract

The present application relates to the technical field of trajectory representation task processing, in particular to a trajectory similarity measurement black-box adversarial attack method and system based on model decision, which trains a trajectory representation model by using a trajectory data set, and takes the trained trajectory representation model as a target model to be attacked; obtains node vulnerability under a fixed disturbance intensity and an optimal disturbance direction under single-point disturbance based on the target model and single-point vulnerability scanning, and constructs a single-point disturbance sample; aggregates the single-point disturbance sample to a high-dimensional hypersphere based on the node vulnerability and the optimal disturbance direction, determines a trajectory iteration direction according to the gradient of model decision in a limited iteration space, and obtains and outputs an optimal target trajectory adversarial sample. The present application finds gradually smaller adversarial disturbances around the target trajectory, which makes the adversarial trajectory sample satisfy the premise of being very close to the target trajectory in the data domain, and makes the target model output an erroneous similarity measurement result, so as to test the adversarial vulnerability of the trajectory similarity measurement model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of trajectory representation task processing, and particularly relates to a trajectory similarity measurement black-box adversarial attack method and system based on model decision. BACKGROUND

[0002] In recent years, with the rapid development of modern Internet of Things technology, especially in the development process of breakthrough progress in the fields of automatic driving, edge computing and geographic information system, human society has collected a large amount of trajectory data. The analysis of massive trajectory data and the deep mining of trajectory data semantics have become a hot spot in the data mining industry. In the automatic driving path selection, navigation path recommendation, travel time prediction and other technologies, trajectory representation can extract the key features of the trajectory, and this task is a basic problem and the basis for most trajectory data related tasks, such as trajectory clustering, route recommendation, animal migration pattern analysis, etc. In the trajectory representation task, a most representative downstream task is to measure the trajectory similarity, and the trajectory similarity measurement using a deep learning model means that the similarity of trajectories is represented by calculating the distance between trajectory embeddings of target trajectory pairs. The trajectory similarity measurement plays a crucial role in engineering applications, and the users of downstream tasks naturally believe that the trajectory similarity measurement result based on the deep learning model is accurate and reliable. However, the inherent characteristics of deep neural networks being vulnerable to adversarial sample attacks pose a great threat to the security of trajectory similarity measurement based on deep learning.

[0003] The main application scene of the black-box adversarial attack is a computer vision field classification task, and in addition, there are works of using adversarial attacks to verify the robustness of the model in the scene of target model being a graph structure, text data and a regression task. In different application scenes, the black-box adversarial attack can be divided into three different attack paradigms, including a transfer-based attack, a decision-based attack and a zero-order optimization-based attack. The transfer-based attack only needs to train an observable substitute model, and the adversarial sample of the target model is generated through the substitute model. These methods use the transferability of the adversarial sample to evade the problem that the gradient of the black-box target model cannot be calculated; the decision-based attack works in a more practical environment, and the information source is only the label obtained by querying the output of the target model. This attack paradigm starts from the adversarial sample that has been wrongly classified by the target model, gradually generates perturbations in the input space of the original data, and finds the adversarial sample closer to the original data through iterative queries; the zero-order optimization-based attack replaces the gradient calculation of the target model through queries and gradient estimation to solve the problem that the target model cannot back-propagate. For the trajectory similarity measurement task, since the purpose of this task is completely different from that of the image processing field classification task, the image processing task adds noise to pursue the human eye, and the original data of the trajectory similarity measurement is more sensitive to the disturbance of the abnormal, and has more stringent requirements for the disturbance amount, so it is necessary to design the adversarial attack process according to the characteristics of the trajectory similarity measurement task; at the same time, the adversarial standard of the classification task is generally based on the label, as long as the predicted label is misclassified or classified into the target label, the sample is recognized as having adversarial property, and the trajectory representation does not have such clear adversarial boundary as the classification task, and it is necessary to clearly define the trajectory adversarial sample so that the model obtains a trajectory representation that is greatly different from the original trajectory. SUMMARY

[0004] Therefore, the present application provides a trajectory similarity measurement black-box adversarial attack method and system based on model decision, which finds gradually smaller adversarial perturbations around the target trajectory, uses the perturbations to make the adversarial trajectory sample satisfy the premise of being very close to the target trajectory in the data domain, and makes the target model output an erroneous similarity measurement result, so as to verify the adversarial vulnerability of the trajectory similarity measurement model and improve the robustness of the deep learning model in the trajectory related task.

[0005] According to the design scheme provided by the present application, on the one hand, a trajectory similarity measurement black-box adversarial attack method based on model decision is provided, which comprises:

[0006] A trajectory data set is constructed, and each trajectory in the trajectory data set is represented by an ordered sequence composed of a trajectory point sampling time and a trajectory point latitude and longitude;

[0007] The trajectory representation model is trained by using a trajectory data set, and the trained trajectory representation model is used as a target model to be attacked.

[0008] The node vulnerability under a fixed perturbation intensity and the optimal perturbation direction under a single-point perturbation are obtained based on the target model and the single-point vulnerability scanning, and a single-point perturbation sample is constructed.

[0009] Based on the node vulnerability and the optimal perturbation direction, the single-point perturbation sample is aggregated to a high-dimensional hypersphere, and the trajectory iteration direction is determined according to the gradient of the model decision in the limited iteration space to obtain and output the optimal target trajectory adversarial sample.

[0010] As the trajectory similarity measurement black-box adversarial attack method based on model decision of the present application, further, a trajectory representation model is trained by using a trajectory data set, comprising:

[0011] The trajectory data set is divided into a training data set and a test data set according to a specified proportion, and the training data set is data-augmented by a data augmentation method, which includes but is not limited to trajectory point downsampling and trajectory distortion.

[0012] The trajectory representation model is set, the trajectory representation model is trained by using the augmented data and the training data set, and the trained trajectory representation model is fine-tuned by using the test data set, so as to take the training and fine-tuned trajectory representation model as a target model to be attacked.

[0013] As the trajectory similarity measurement black-box adversarial attack method based on model decision of the present application, further, the node vulnerability under a fixed perturbation intensity and the optimal perturbation direction under a single-point perturbation are obtained, comprising:

[0014] The perturbation intensity and the iteration angle are set, and a first trajectory point in the target trajectory is selected.

[0015] The selected trajectory point is iteratively perturbed to a limited discrete point on a circle with the selected trajectory point as the center and the perturbation intensity as the radius, and the different discrete points on the circle are traversed by a fixed iteration angle to form a discrete point set.

[0016] The first trajectory point in the trajectory data set is replaced by the discrete point set to obtain a single-point perturbation trajectory set.

[0017] The original trajectory embedding representation in the trajectory data set and the adversarial trajectory embedding representation in the single-point perturbation trajectory set are obtained by using the target model, and the single-point perturbation loss is calculated based on the original trajectory embedding representation and the adversarial trajectory embedding representation.

[0018] The first trajectory point in the trajectory data set is restored to the initial state, a target trajectory next trajectory point is selected for traversal, and the single-point disturbance loss of the corresponding trajectory point is recorded until all trajectory points of the target trajectory are traversed;

[0019] The single-point disturbance trajectory set corresponding to the maximum single-point disturbance loss is selected, and the selected single-point disturbance trajectory set is taken as the optimal single-point disturbance sample.

[0020] As the trajectory similarity measurement black-box adversarial attack method based on model decision of the present application, further, the single-point disturbance sample is aggregated to a high-dimensional hypersphere, including:

[0021] The single-point disturbance sample is aggregated to a high-dimensional data space with a specified dimension, and the specified dimension is the number of discrete trajectory points of the single-point disturbance sample multiplied by 2.

[0022] The single-point disturbance sample is moved by the same length in each dimension, and is respectively mapped to the hypersphere in the direction of the original trajectory of the trajectory data set or the opposite direction, and the radius of the hypersphere is the disturbance strength.

[0023] As the trajectory similarity measurement black-box adversarial attack method based on model decision of the present application, further, the trajectory iteration direction is determined according to the gradient of the model decision in the limited iteration space, including:

[0024] The single-point disturbance sample is taken as a starting point for iteration, and the single-point disturbance loss between each disturbance sample in the neighborhood and the original trajectory data in the trajectory data set under the current iteration is calculated, the gradient is estimated based on the single-point disturbance loss, and the trajectory iteration direction is determined by using the estimated gradient.

[0025] As the trajectory similarity measurement black-box adversarial attack method based on model decision of the present application, further, it also includes:

[0026] The trajectory embedding representation of the adversarial sample is obtained based on the target model, and the similarity ranking of the adversarial sample and the original trajectory in the trajectory data set is obtained through the similarity measurement function and the characteristic function;

[0027] The attack effect of the adversarial sample is measured by using the similarity average ranking and the similarity ranking distribution of the adversarial sample.

[0028] In still another aspect, the present application also provides a trajectory similarity measurement black-box adversarial attack system based on model decision, including: a data acquisition module, a model training module, a disturbance setting module and an adversarial attack module, wherein,

[0029] The data acquisition module is used to construct a trajectory data set, and each trajectory in the trajectory data set is represented by an ordered sequence composed of trajectory point sampling time and trajectory point latitude and longitude;

[0030] a model training module, configured to train a trajectory representation model by using a trajectory dataset, and to use the trained trajectory representation model as a target model to be subjected to an adversarial attack, the trajectory representation model being configured to map a trajectory to an embedding vector space and output a trajectory embedding vector representation;

[0031] a perturbation setting module, configured to obtain node vulnerability under a fixed perturbation intensity and an optimal perturbation direction under a single-point perturbation based on the target model and the single-point vulnerability scanning, and to construct a single-point perturbation sample;

[0032] an adversarial attack module, configured to aggregate the single-point perturbation sample to a high-dimensional hypersphere based on the node vulnerability and the optimal perturbation direction, to determine a trajectory iteration direction in a limited iteration space according to a gradient of a model decision, and to obtain and output an optimal target trajectory adversarial sample.

[0033] Advantages of the present application:

[0034] The present application performs vulnerability scanning on each trajectory point based on trajectory similarity, obtains node vulnerability under a fixed perturbation intensity and an optimal perturbation direction under a single-point perturbation, aggregates a discrete trajectory point sequence to a high-dimensional hypersphere based on the node vulnerability set and the optimal perturbation direction, calculates an iteration direction of the entire trajectory in the limited iteration space according to a gradient of a final decision of the model, and obtains an optimal trajectory adversarial sample. Experiments show that the present application can effectively perform adversarial attack on trajectory similarity measurement, has better adaptability and universality, and has good application prospects in trajectory task processing in the fields of automatic driving path selection, navigation path recommendation, and travel time prediction. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 Trajectory similarity measurement based on model decision for an embodiment of a black-box adversarial attack process;

[0036] Figure 2 Adversarial attack on a trajectory representation model on a Porto dataset for an embodiment;

[0037] Figure 3 Single-point vulnerability scanning process for an embodiment;

[0038] Figure 4 Estimation of partial derivative of an adversarial sample in the x2 direction for an embodiment. DETAILED DESCRIPTION

[0039] To make the purpose, technical solutions and advantages of the present application clearer and more apparent, the present application will be further described in detail below with reference to the drawings and technical solutions.

[0040] According to the information domain accessible to the attacker when performing the adversarial attack, the adversarial attack can be divided into three categories. The white-box attack means that the attacker can access the target model completely, including the model architecture, the model parameters, the model output and the corresponding label. The gray-box attack means that the attacker can access the target model partially, including the input traffic state without label and the output link. The black-box attack means that the attacker cannot access any internal structure of the target model. In the attack setting, the generation of the adversarial sample can only be completed by querying the output of the target model or by using a white-box substitute model to complete the attack based on migration. The deep neural network has natural vulnerability to hidden perturbations. Based on this characteristic, with the help of gradient information of the target model, many white-box adversarial attack methods have been developed, which are used as tools to evaluate the robustness of the deep neural network model. However, the white-box attack method can only be applied when the target model is completely understood, and in the black-box scenario, the attack performance of these methods will be significantly reduced because the attacker lacks knowledge of the target model. On the other hand, due to the customization of the white-box attack for a specific target deep neural network model, it usually leads to overfitting of the network architecture and weights of the target model in the white-box setting and reduces the transferability of the generated adversarial perturbation. In contrast, the black-box attack is more practical and can reflect the adversarial robustness of the model in the actual working condition because the internal information of the target model cannot be obtained in the production process. However, from the technical implementation, the construction and implementation of the black-box attack are more difficult. On the one hand, compared with the white-box attack, the attacker in the black-box setting cannot calculate the gradient of the target model. Therefore, it is difficult to directly find the adversarial sample with small noise amplitude using the optimization-based or gradient-based attack. On the other hand, the only observable information about the target model is the output obtained by querying the model, which usually represents high attack cost and limited number of queries for the attacker. Under the premise of limited attack cost, it is difficult to continue to compress the perturbation amplitude based on the found adversarial sample.

[0041] For the black-box adversarial attack of the deep trajectory representation model, refer to Figure 1 As shown in the figure, a trajectory similarity measurement black-box adversarial attack method based on model decision is provided, which includes the following steps:

[0042] S101, a trajectory data set is constructed, and each trajectory in the trajectory data set is represented by an ordered sequence composed of trajectory point sampling time and trajectory point latitude and longitude.

[0043] Specifically, the original trajectory data for trajectory similarity measurement can be collected by devices such as aircraft, ship, urban transportation tool, etc. in the real world, or the commonly used trajectory data set (such as Porto data set) can be directly downloaded to constitute a trajectory set where T i represents a trajectory, and N is a set The total number of trajectories in the set. Each trajectory T is an ordered sequence of triplets consisting of longitude, latitude, and sampling time, represented as T = {(t...} i ,lon i ,at i )|i=1,2,...,n}, where t i Let represent the sampling time of the i-th point in trajectory T, and when t i >t j When i > j, lon i and lat i Let represent the longitude and latitude of the i-th point, respectively.

[0044] S102. Train a trajectory representation model using a trajectory dataset, and use the trained trajectory representation model as the target model to be used in adversarial attacks. The trajectory representation model is used to map trajectories to an embedding vector space and output trajectory embedding vector representations.

[0045] Specifically, it can be designed to include the following content:

[0046] The trajectory dataset is divided into a training dataset and a test dataset according to a specified ratio. Data augmentation is performed on the training dataset using data augmentation methods, including but not limited to: trajectory point downsampling and trajectory warping.

[0047] Set up a trajectory representation model, train the trajectory representation model using augmented data and training dataset, and fine-tune the trained trajectory representation model using test dataset, so as to use the trained and fine-tuned trajectory representation model as the target model to be used in adversarial attacks.

[0048] Choose a trajectory representation model relevant to the trajectory similarity measurement task. For example, commonly used deep trajectory representation models include t2vec, TrjSR, and TrajCL. Pre-training the deep trajectory representation model involves the following steps: loading the Porto training and testing datasets; performing data augmentation on the training set using trajectory point downsampling and trajectory warping; defining the trajectory similarity measurement model; training the deep trajectory representation model based on the training set; and testing the deep trajectory representation model based on the test set.

[0049] The original trajectories from trajectory datasets such as Porto are input into a trained trajectory representation model to obtain the embedding representation of the original trajectory T. This embedding is a vector h, and in Let c be the embedding space and c be the dimension. Trajectory representation learning aims to train a trajectory encoder E: Will Mid-trajectory T i Mapped to c-dimensional embedding vector h i, denoted as h i = E(T i ).

[0050] S103, based on the target model and the single-point vulnerability scanning, obtaining the node vulnerability under the fixed perturbation intensity and the optimal perturbation direction under the single-point perturbation, and constructing a single-point perturbation sample.

[0051] Specifically, it can be designed to include the following contents:

[0052] Set the perturbation intensity and the iteration angle, and select the first trajectory point in the target trajectory;

[0053] Iteratively perturb the selected trajectory point to a finite number of discrete points on a circle with the selected trajectory point as the center and the perturbation intensity as the radius, and traverse different discrete points on the circle by fixing the iteration angle to form a discrete point set;

[0054] Replace the first trajectory point in the trajectory data set with the discrete point set respectively to obtain a single-point perturbation trajectory set;

[0055] Obtain the original trajectory embedding representation in the trajectory data set and the adversarial trajectory embedding representation in the single-point perturbation trajectory set using the target model, calculate the single-point perturbation loss based on the original trajectory embedding representation and the adversarial trajectory embedding representation, and record it;

[0056] Restore the first trajectory point in the trajectory data set to the initial state, select the next trajectory point in the target trajectory for traversal, and record the single-point perturbation loss corresponding to the trajectory point, until all trajectory points in the target trajectory are traversed;

[0057] Select the single-point perturbation trajectory set corresponding to the maximum single-point perturbation loss, and take the selected single-point perturbation trajectory set as the optimal single-point perturbation sample.

[0058] Define the hyperparameters perturbation intensity R (i.e. perturbation radius) and iteration angle θ; select the first trajectory point (t0, lon0, lat0) in the target trajectory, where the subscript is the sequence of the trajectory point starting from zero, and the subscript 0 is the first trajectory point in the trajectory. Iteratively perturb the trajectory point to a finite number of discrete points on a circle with (t0, lon0, lat0) as the center and R as the radius, and traverse different points on the circle by fixing the iteration angle θ, i.e. traverse a set, which can be specifically represented as:

[0059]

[0060] Where (x i , y i ) is the latitude and longitude of the target point after one perturbation of the point, and on this basis, replace the point with subscript 0 of the original trajectory T with the elements in the set , to obtain the following set:

[0061]

[0062] Where (x′, y′) is a set For any element in the set, remove the original point with index 0 from the original trajectory T and replace it with the set. Any element in the equation yields a trajectory after a single-point perturbation. i Let represent the set of all resulting trajectories that have undergone single-point perturbation at the i-th point in the trajectory. Calculate the L1 difference between the two embedded representations of the perturbed trajectory and the original trajectory, i.e., the L1 loss, where the L1 loss is expressed as:

[0063]

[0064] Among them, E(T) j Let E(T′) be the j-th element in the embedding representation of the original trajectory T. j To embed the j-th element in the adversarial trajectory T′, |E(T)| is the modulus of the model output vector.

[0065] After recording the L1 loss, restore the point to its initial position (t0, lon0, lat0) on the trajectory. Select the next point and repeat the iterative perturbation until all nodes on the target trajectory have been traversed. Specifically, for each trajectory, all elements of the following set need to be traversed:

[0066]

[0067] Where |S| represents the number of points in the trajectory. After traversal, the trajectory used in the test with the largest L1 loss is obtained and used as the optimal single-point perturbation sample output by the single-point vulnerability scanning module.

[0068] S104. Based on node vulnerability and optimal perturbation direction, single-point perturbation samples are aggregated into a high-dimensional hypersphere. Within the constrained iteration space, the trajectory iteration direction is determined according to the gradient of the model decision, and the optimal target trajectory adversarial sample is obtained and output.

[0069] Specifically, aggregating single-point perturbation samples onto a high-dimensional hypersphere can be designed to include:

[0070] Single-point perturbation samples are aggregated into a high-dimensional data space of a specified dimension, where the specified dimension is the number of discrete trajectory points of the single-point perturbation sample multiplied by 2.

[0071] The single-point perturbation sample is moved by the same amount of time in each dimension and mapped onto a hypersphere in the direction of the original trajectory of the trajectory dataset or the opposite direction. The radius of the hypersphere is the perturbation intensity.

[0072] The single-point perturbation sample is taken as a starting point for iteration, and the single-point perturbation loss between each perturbation sample in the neighborhood and the original trajectory data in the trajectory data set is calculated at the current iteration, the gradient is estimated based on the single-point perturbation loss, and the trajectory iteration direction is determined by using the estimated gradient.

[0073] In the formula, the point sequence of the trajectory discrete in the adversarial sample is aggregated into a high-dimensional space, and the iteration direction of the entire trajectory is calculated based on the gradient of the final decision of the model. The adversarial sample is taken as a starting point for iteration at the current step, the current sample is first aggregated into a high-dimensional data space with a dimension of the number of trajectory points multiplied by 2, and then the aggregated gradient direction on the hypersphere with a radius R is estimated. The sample is moved by a small step of the same step length in each dimension, and is mapped to the hypersphere with a radius of perturbation intensity R in the direction of the original sample or the opposite direction, and the specific mapping mode is as follows:

[0074]

[0075] In the formula, x is the sample data to be mapped, ‖x‖ is the norm of the sample data, x i represents the i-th dimensional data of x. The L1 loss of each sample in the generated neighborhood and the original sample is calculated, and the gradient is estimated by combining these L1 losses. The gradient is used to calculate the iteration direction of the next step. The partial derivative is calculated in the following manner:

[0076]

[0077] In the formula, δ i represents the i-th dimensional component in the high-dimensional data space, |δ i | represents the modulus of δ i , T ′ + δ i represents the positive direction of the i-th axis of T ′ , grad i represents the i-th partial derivative. The aggregated gradient is calculated in the following manner:

[0078]

[0079] In the formula, grad represents the current gradient, and the partial derivatives of each dimension are aggregated to obtain the aggregated gradient.

[0080] The input adversarial sample is calculated, the decision gradient is calculated, the step length is calculated, the adversarial trajectory sample is updated, the process is repeated, and the final adversarial trajectory sample is obtained.

[0081] For the adversarial trajectory sample, the trajectory embedding representation of the adversarial sample can be obtained based on the target model, and the similarity ranking of the adversarial sample and the original trajectory in the trajectory data set can be obtained through the similarity measurement function and the indicator function; the attack effect of the adversarial sample is measured by using the average ranking of the adversarial sample and the similarity ranking distribution.

[0082] The accuracy of the target model in calculating the trajectory similarity is tested on the adversarial trajectory sample, the similarity ranking of the adversarial trajectory sample and the corresponding original trajectory is calculated, the average ranking and the ranking distribution are counted, and the effectiveness of the adversarial attack is verified.

[0083] That is, for the final adversarial trajectory sample T', the trajectory representation is obtained by inputting the adversarial trajectory sample into the target model, and the similarity ranking with the original trajectory sample T is calculated, and the specific calculation formula can be represented as:

[0084]

[0085] Where f is a similarity measurement function, is an indicator function, that is, if the condition is true, output 1, otherwise output 0, T i represents the i-th trajectory in the trajectory data set, and the attack effect is measured by the average ranking of the adversarial trajectory sample set Q' and the similarity ranking distribution:

[0086]

[0087] Where Q' represents the set composed of adversarial trajectory samples in the experiment, R i represents the similarity ranking between the i-th adversarial trajectory sample in Q' and its corresponding original trajectory sample, represents an indicator function, I k represents the k-th ranking interval, for example, I1=(10, 49], I2=(50, 99], etc. The average ranking measures the attack effect of the attack method on the trajectory data ability of the target model, and can also measure the effect of the attack trajectory similarity measurement task, and the ranking distribution measures the change of the original representation result of the target model by the adversarial trajectory sample.

[0088] Further, based on the above method, the embodiment of the present application also provides a trajectory similarity measurement black box adversarial attack system based on model decision, comprising: a data acquisition module, a model training module, a perturbation setting module and an adversarial attack module, wherein,

[0089] The data acquisition module is used to construct a trajectory data set, and each trajectory in the trajectory data set is represented by an ordered sequence composed of trajectory point sampling time and trajectory point latitude and longitude;

[0090] The model training module is used to train a trajectory representation model using a trajectory dataset. The trained trajectory representation model is used as the target model to be used in adversarial attacks. The trajectory representation model is used to map trajectories to an embedding vector space and output trajectory embedding vector representations.

[0091] The perturbation setting module is used to obtain the node vulnerability under a fixed perturbation intensity and the optimal perturbation direction under a single-point perturbation based on the target model and single-point vulnerability scanning, and to construct single-point perturbation samples.

[0092] The adversarial attack module is used to aggregate single-point perturbation samples into a high-dimensional hypersphere based on node vulnerability and optimal perturbation direction. Within a constrained iteration space, the trajectory iteration direction is determined according to the gradient of the model decision, and the optimal target trajectory adversarial sample is obtained and output.

[0093] To verify the effectiveness of this solution, the following explanation is based on experimental data:

[0094] like Figure 2 The image shows an adversarial attack on a trajectory representation model on the Porto dataset. In the adversarial attack, a single-point vulnerability scanning module is used to traverse the target trajectory node by node to obtain the optimal single-point perturbation sample, such as... Figure 3 As shown, the red and green trajectories are the tested trajectories during the scanning process, while the blue trajectory is the optimal adversarial trajectory under single-point perturbation. The contour step plot on the right shows the change in trajectory similarity when a point is moved to this position. Different colors represent the difference in similarity between the point moved to this position and the original trajectory, with the difference increasing from the inside out. Furthermore, the contour lines are irregular. The perturbation result in the figure represents the position that maximizes the difference in similarity between the two trajectories under a fixed perturbation intensity. The iterative process for estimating the aggregation gradient direction on a hypersphere of radius R is as follows: Figure 4 As shown, plane H1 is parallel to the x2 axis and passes through the center of the sphere. The blue nodes represent the current position of the adversarial example. To determine the iteration direction, the partial derivative in the x2 direction needs to be estimated. The position after iteration is the position of the transparent node in the figure. This position is obtained in two steps: first, the sample is moved a small step along the x2 axis; second, it is mapped back onto the R-hypersphere.

[0095] In this counterattack, such as Figure 2 As shown, the change of the target trajectory in the data space is that the blue trajectory point moves to the red trajectory point. T a and T b There are three different trajectories in the dataset, and T′ is the generated adversarial trajectory sample. The trajectories T, T′, and T are... a T b The inputs are fed into the trajectory representation model, and the vector representations V, V′, V′ corresponding to the model's output trajectory are obtained sequentially. a V bWe use L1 norm to calculate the difference between vectors. The lower part of the figure shows the vectors V', V a , V b and the difference between the vectors V and the similarity measure ranking between the corresponding trajectory pairs. It can be seen from the figure that the adversarial trajectory sample T' is very close to the original target trajectory T in data space, but the similarity ranking of the adversarial trajectory sample T' and the original target trajectory T is the lowest, which can illustrate that the effective adversarial attack can be implemented for the trajectory similarity measure.

[0096] Unless specifically stated otherwise, the relative arrangement of components and steps in the embodiments described herein do not limit the scope of the application.

[0097] The various embodiments described in the specification are described in progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant part can be referred to the method part.

[0098] The units and method steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example are generally described in the above description. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation does not exceed the scope of the present application.

[0099] Those skilled in the art can understand that all or part of the steps in the above method can be instructed by a program to complete the relevant hardware, and the program can be stored in a computer readable storage medium, such as a read only memory, a magnetic disk or an optical disk. Alternatively, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiments can be implemented in the form of hardware or in the form of a software function module. The present application is not limited to any specific form of combination of hardware and software.

[0100] Finally, it should be noted that the above-described embodiments are merely specific embodiments of the present application, which are used to illustrate the technical solutions of the present application, but not to limit the same. The protection scope of the present application is not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that any person skilled in the art can still modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features, within the technical scope disclosed by the present application. The modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A model-decision-based trajectory similarity metric black-box adversarial attack method, characterized in that, Comprise: Constructing a trajectory dataset, each trajectory in the trajectory dataset being represented by an ordered sequence of trajectory point sampling time and trajectory point latitude and longitude; Training a trajectory representation model using the trajectory dataset, the trained trajectory representation model being used as a target model to be attacked, the trajectory representation model being used to map trajectories to an embedding vector space and output trajectory embedding vector representations; Based on the target model and single-point vulnerability scanning, obtaining node vulnerability under fixed perturbation intensity and optimal perturbation direction under single-point perturbation, and constructing single-point perturbation samples; wherein, obtaining node vulnerability under fixed perturbation intensity and optimal perturbation direction under single-point perturbation comprises: setting perturbation intensity and iteration angle, and selecting the first trajectory point in the target trajectory; iteratively perturbing the selected trajectory point to a finite discrete point on a circle with the selected trajectory point as the center and the perturbation intensity as the radius, and traversing different discrete points on the circle by fixing the iteration angle to form a discrete point set; replacing the first trajectory point in the trajectory dataset with the discrete point set to obtain a single-point perturbation trajectory set; obtaining the original trajectory embedding representation in the trajectory dataset and the adversarial trajectory embedding representation in the single-point perturbation trajectory set using the target model, calculating the single-point perturbation loss based on the original trajectory embedding representation and the adversarial trajectory embedding representation, and recording the single-point perturbation loss; restoring the first trajectory point in the trajectory dataset to the initial state, selecting the next trajectory point in the target trajectory for traversal, and recording the single-point perturbation loss corresponding to the trajectory point, until all trajectory points in the target trajectory are traversed; selecting the single-point perturbation trajectory set corresponding to the maximum single-point perturbation loss as the optimal single-point perturbation sample; Based on the node vulnerability and the optimal perturbation direction, aggregating the single-point perturbation samples to a high-dimensional hypersphere, determining the trajectory iteration direction according to the gradient of the model decision in the restricted iteration space, and obtaining and outputting the optimal target trajectory adversarial sample, wherein, aggregating the single-point perturbation samples to a high-dimensional hypersphere comprises: aggregating the single-point perturbation samples to a high-dimensional data space with a specified dimension, the specified dimension being the number of discrete trajectory points in the single-point perturbation sample multiplied by 2; moving the single-point perturbation samples to each dimension by the same step length, and mapping them to the hypersphere in the direction of the original trajectory of the trajectory dataset or the opposite direction, the radius of the hypersphere being the perturbation intensity.

2. The model-decision based trajectory similarity metric black-box adversarial attack method according to claim 1, characterized in that, Constructing a trajectory dataset, comprising: Collecting original trajectory data using a collection device, and constructing a trajectory dataset based on the original trajectory data, the collection device being an aircraft, a ship, or a vehicle; Or constructing a trajectory dataset using a trajectory public data set.

3. The model-decision-based trajectory similarity metric black-box adversarial attack method according to claim 1, characterized in that, Training a trajectory representation model using the trajectory dataset, comprising: Dividing the trajectory dataset into a training dataset and a test dataset according to a specified proportion, and performing data augmentation on the training dataset through a data augmentation method, the data augmentation method including but not limited to trajectory point downsampling and trajectory distortion; Setting a trajectory representation model, training the trajectory representation model using the augmented data and the training dataset, and fine-tuning the trained trajectory representation model using the test dataset, so as to use the trained and fine-tuned trajectory representation model as a target model to be attacked.

4. The model-decision-based trajectory similarity metric black-box adversarial attack method according to claim 1, characterized in that, The discrete point set is represented as: wherein, is the first trajectory point within the target trajectory, is the perturbation strength, is the iteration angle, is the longitude and latitude of the target point after one perturbation of the current trajectory point, denotes the sampling time of the first trajectory point in the target trajectory, and denote the longitude and latitude of the first trajectory point in the target trajectory, respectively.

5. The model-decision-based trajectory similarity metric black-box adversarial attack method according to claim 1, characterized in that, The trajectory iteration direction is determined according to the gradient of the model decision in a limited iteration space, comprising: The single-point perturbation sample is taken as a starting point for iteration, and the single-point perturbation loss between each perturbation sample in the neighborhood and the original trajectory data in the trajectory data set is calculated under the current iteration, the gradient is estimated based on the single-point perturbation loss, and the trajectory iteration direction is determined by using the estimated gradient.

6. The model-decision-based trajectory similarity metric black-box adversarial attack method according to claim 5, characterized in that, The gradient estimation formula is expressed as: ,in, Represents the first in a high-dimensional data space dimensional components, Indicates the first One partial derivative, and , , For the sample data that needs to be mapped, The norm of the sample data, express The Dimensional data, For the disturbance intensity, The number of sample data. Represents the trajectory in the sample data Along the first The component offset in the positive direction of each axis corresponds to the component. Step length, Represents the original trajectory in the trajectory dataset. It represents the average absolute error loss.

7. The model-decision-based trajectory similarity metric black-box adversarial attack method according to claim 1, characterized in that, Also comprising: The trajectory embedding representation of the adversarial sample is obtained based on the target model, and the similarity ranking of the adversarial sample and the original trajectory in the trajectory data set is obtained through the similarity measurement function and the indicator function; The attack effect of the adversarial sample is measured by using the average similarity ranking and the similarity ranking distribution of the adversarial sample.

8. A model-decision-based trajectory similarity measure black-box adversarial attack system, characterized in that, Comprise: data acquisition module, model training module, perturbation setting module and adversarial attack module, wherein, The data acquisition module is used to construct a trajectory data set, each trajectory in the trajectory data set is represented by an ordered sequence composed of trajectory point sampling time and trajectory point latitude and longitude; The model training module is used to train the trajectory representation model using the trajectory data set, and the trained trajectory representation model is used as the target model to be attacked, and the trajectory representation model is used to map the trajectory to the embedding vector space and output the trajectory embedding vector representation; The perturbation setting module is used to obtain the node vulnerability under fixed perturbation intensity and the optimal perturbation direction under single-point perturbation based on the target model and single-point vulnerability scanning, and to construct single-point perturbation samples; wherein, obtaining the node vulnerability under fixed perturbation intensity and the optimal perturbation direction under single-point perturbation comprises: setting the perturbation intensity and the iteration angle, and selecting the first trajectory point in the target trajectory; the selected trajectory point is iteratively perturbed to a finite discrete point on a circle with the selected trajectory point as the center and the perturbation intensity as the radius, and the different discrete points on the circle are traversed through the fixed iteration angle to form a discrete point set; the first trajectory point in the trajectory data set is replaced by the discrete point set to obtain a single-point perturbation trajectory set; the trajectory embedding representation of the original trajectory in the trajectory data set and the adversarial trajectory embedding representation in the single-point perturbation trajectory set are obtained by using the target model, the single-point perturbation loss is calculated based on the original trajectory embedding representation and the adversarial trajectory embedding representation and is recorded; the first trajectory point in the trajectory data set is restored to the initial state, the next trajectory point in the target trajectory is selected for traversal, and the single-point perturbation loss of the corresponding trajectory point is recorded, until all trajectory points in the target trajectory are traversed; the single-point perturbation trajectory set corresponding to the maximum single-point perturbation loss is selected, and the selected single-point perturbation trajectory set is taken as the optimal single-point perturbation sample. The anti-attack module is used for aggregating single-point perturbation samples to a high-dimensional hypersphere based on node vulnerability and optimal perturbation direction, determining a trajectory iteration direction according to a gradient of model decision in a limited iteration space, obtaining and outputting an optimal target trajectory anti-sample, wherein the aggregation of single-point perturbation samples to the high-dimensional hypersphere comprises: aggregating the single-point perturbation samples to a high-dimensional data space with a specified dimension, the specified dimension being a product of a single-point perturbation sample discrete trajectory point number and 2; moving the single-point perturbation samples to respective dimensions by a same length, and respectively mapping the single-point perturbation samples to the hypersphere in a trajectory data set original trajectory direction or an opposite direction, a radius of the hypersphere being a perturbation strength.

Images