Novel small-disturbance adversarial attack scheme based on interpretable multi-dimensional time sequence

Abstract

The invention relates to the field of artificial intelligence security and time sequence anti-attack, in particular to a small-disturbance time sequence prediction anti-attack scheme. According to the scheme, multiple neural network interpretability methods are fused, starting from time sequence features input by a network model, feature parts with high comprehensive evaluation under multiple interpretations are selected for attacking, the disturbance cost is reduced by attacking the sequence part, and the problem that time sequence data is sensitive to abnormal disturbance is solved. For different time sequence prediction models, a universal, stable and reliable post-interpretation method is a key, and different post-interpretation methods are integrated to obtain a multi-dimensional feature importance interpretation system to measure the value of feature points, so as to ensure that attacks are still effective under small-scale disturbance. In addition, the antagonistic attack in this way has good mobility in different time series data and time series prediction.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security and time series adversarial attacks, and more specifically, to the interpretability of time series prediction models and adversarial attacks on security. Background Art

[0002] Nowadays, time series data is increasingly used in various life, financial, and industrial scenarios, and time series analysis has become the focus of many research and development projects in the field of data mining. However, studies have shown that models based on deep neural networks have inherent shortcomings and are vulnerable to adversarial attacks. The adversarial vulnerabilities of some advanced and widely used deep time series prediction models have become an important issue. At the same time, unlike the image processing field, which is difficult for the human eye to detect, time series data is more sensitive to abnormal disturbances. Therefore, there are stricter requirements on the amount of disturbance, and how to generate imperceptible adversarial examples to disturb time series data also requires more thinking.

[0003] There have been many studies on adversarial attacks on time series. Cartella et al. approved risky loan applications and evaded network traffic anomaly detection through adversarial attacks. Karim et al. used adversarial transformation networks (ATN) to attack various time series classification models, focusing on building confusing adversarial samples. Fawaz et al. proposed the fast gradient sign method FGSM to construct adversarial samples, using the existing iterative adversarial attack mechanism to add imperceptible noise to the original time series, thereby reducing the accuracy of the classification model.

[0004] For the problem of small-scale perturbations, many researchers have given their own solutions. WuTao et al. assume that data points in time series data play different roles in the underlying pattern, and then can be perturbed based on a limited number of data points. At the same time, the perturbation curve area (AOPC) method is proposed to quantify the importance of features to model performance. Daizong et al. proposed a new black-box adversarial attack framework called BlackTreeS, which solves the hard optimization problem of adversarial example construction through two simple and effective modules. In particular, a tree search strategy is proposed to find influential positions in the sequence and independently estimate the black-box gradients of these positions for attack. In 2020, B.Ru, A.Cobb et al. published an article using Bayesian optimization to find successful adversarial perturbations with high query efficiency. By adopting an alternative proxy structure to alleviate the optimization challenges usually faced by high-dimensional tasks, statistical alternative models and available query data are fully utilized to understand the optimal dimensionality reduction of the search space through Bayesian model selection. Summary of the invention

[0005] The present invention integrates a variety of neural network interpretability methods, starting from the time series characteristics of the network model input, and selects feature parts with high comprehensive evaluation under multiple interpretations for attack. By attacking part of the sequence, the cost of disturbance is reduced, and the problem of time series data being sensitive to abnormal disturbances is solved. For different time series prediction models, a universal, stable, and reliable post-explanatory method is key. By combining different post-explanatory methods, a multi-dimensional feature importance interpretation system is obtained to measure the value of feature points, thereby ensuring that the attack is still effective under small-scale disturbances. In addition, adversarial attacks in this way have good transferability between different time series data and time series predictions, which is also of great significance for understanding the impact of adversarial attacks on time series predictions and improving the robustness of such prediction techniques.

[0006] The objective of the present invention is achieved through the following technical solutions: Step 1: In the initialization phase, the multidimensional time series data set is cleaned and normalized to prepare for the subsequent prediction and interpretation steps; Step 2: In the preliminary training stage, different time series prediction models (such as TCN, LSTNet, RNN, CNN, etc.) are used to train multi-dimensional time series data to obtain the trained prediction model; Step 3: In the interpretability analysis stage, a variety of model post-interpretation methods (such as SHAP, LIME, etc.) are used to interpret the importance and contribution of each feature in the multidimensional time series; Step 4: In the feature evaluation stage, for the various evaluation importance values ​​of the features, according to the formula and Calculate weighted average ranking and importance; Step 5: In the adversarial attack phase, assuming a white-box model, the trained time series prediction model is used to collect gradient information. The attack module generates adversarial perturbations from high to low according to the comprehensive importance based on the gradient information and the attack perturbation budget, and embeds the perturbations into the test set to complete the attack. Step 6: In the attack verification phase, use the original test set and the adversarial attack test set to perform tests and compare the attack results. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0008] Figure 1 Framework diagram of the multi-dimensional feature adversarial attack model. Specific implementation

[0009] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, which does not constitute a limitation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0010] The small perturbation counterattack scheme for multidimensional time series based on interpretability described in the embodiment of the present invention comprises the following steps: 1) Initial stage before training: Data cleaning processing mainly includes: missing value processing, outlier processing, and data conversion. For missing values, fitting is performed based on the time correlation of the previous and next 3 digits, missing values ​​are filled, and data points with missing values ​​are deleted when necessary. The identification of outliers is achieved through box plots or statistical methods (such as methods based on standard deviation), and these values ​​are corrected, deleted, or retained according to different situations. The data conversion step involves extracting useful time features from the original timestamp, such as year, month, day of the week, etc., which are crucial for time series analysis. In addition, for categorical data, appropriate encoding, such as unique hot encoding, is required to make it suitable for numerical models. Data normalization is to ensure that all features are on the same scale, which is crucial for the performance of the neural network model. The normalization methods used in this solution include minimum-maximum normalization and Z-score normalization. Different normalization methods are selected according to different data set requirements. Minimum-maximum normalization scales the data to a range of 0 to 1, while Z-score normalization converts the mean of the data to 0 and the standard deviation to 1. 2) Preliminary training phase: We use a variety of time series prediction models to train the data. These models may include TCN, LSTNet, RNN, and CNN. Each model has its own unique advantages and applicable scenarios. For example, TCN performs well when processing multi-dimensional long sequence data, while LSTNet can effectively capture long-term dependencies. During training, we use cross-validation to adjust model parameters and monitor overfitting. The performance of each model is evaluated using appropriate evaluation metrics, such as mean squared error (MSE) or mean absolute error (MAE). The best model is selected as the basis for subsequent steps. 3) Post hoc interpretive analysis: After the multidimensional time series prediction model is trained, we enter the critical interpretability analysis stage. The core goal of this stage is to deeply understand the prediction mechanism of the model, especially how each feature affects the final output of the model. To achieve this goal, we use a variety of post-model interpretive methods, including SHAP, LIME, and feature importance evaluation of local effect maps and gradient boosting trees. 4) Comprehensive evaluation of features: We evaluate the contribution of each feature to model prediction based on the feature importance obtained from interpretability analysis. We assign weights to each feature’s importance, which reflect the importance of the feature in model prediction. We then calculate the weighted average importance to get the comprehensive importance of each feature. Assume there are n features, each feature i has an importance score I i and ranking R i , these scores can come from SHAP values, LIME explanations, PDPs or feature importance estimates from gradient boosted trees. Assign a weight W to each feature’s importance i , these weights reflect the importance of each feature in the model prediction. The sum of the weights should be 1, that is Using the formula and Calculate weighted average ranking and importance. 5) Adversarial attack: We assume that we have white-box access to the model and use the model’s gradient information to generate adversarial perturbations. These perturbations are ranked according to the comprehensive importance of the features Order = (r1, r2, ..., r n ) and importance value Weight=(I1,I2,...,I n ) is generated from high to low, satisfying As the disturbance budget, we get 6) Attack completion and verification: We evaluate the performance of the model using the original test set and the test set subjected to the adversarial attack. By comparing the model prediction results in these two cases, we can evaluate the effectiveness of the adversarial attack. By comparing with existing adversarial attack methods, we can see that smaller perturbations are sufficient for the proposed adversarial attack method based on importance measurement. This paper proposes a new small perturbation adversarial attack scheme for multidimensional time series based on interpretability. By using this method and the idea of ​​transfer, it is possible to attack various entity models for time series prediction. This scheme emphasizes the urgent need to develop more powerful deep learning model implementations under time series prediction tasks, which is of great significance for understanding the impact of adversarial attacks on time series prediction and improving the robustness of such prediction techniques.

Claims

1. A new interpretable multi-dimensional time series small perturbation adversarial attack scheme, characterized by: The techniques include: Step 1: In the initialization phase, the multidimensional time series data set is cleaned and normalized to prepare for the subsequent prediction and interpretation steps; Step 2: In the preliminary training stage, different time series prediction models (such as TCN, LSTNet, RNN, CNN, etc.) are used to train multi-dimensional time series data to obtain the trained prediction model; Step 3: In the interpretability analysis stage, a variety of model post-interpretation methods (such as SHAP, LIME, etc.) are used to interpret the importance and contribution of each feature in the multidimensional time series; Step 4: In the feature evaluation stage, for the various evaluation importance values ​​of the features, according to the formula and Calculate weighted average ranking and importance; Step 5: In the adversarial attack phase, assuming a white-box model, the trained time series prediction model is used to collect gradient information. The attack module generates adversarial perturbations from high to low according to the comprehensive importance based on the gradient information and the attack perturbation budget, and embeds the perturbations into the test set to complete the attack. Step 6: In the attack verification phase, use the original test set and the adversarial attack test set to perform tests and compare the attack results.

2. The multi-dimensional time series small perturbation adversarial attack scheme based on interpretability according to claim 1 is characterized in that: The process of step 1 is specifically as follows: Data cleaning processing mainly includes: missing value processing, outlier processing, and data conversion. For missing values, fitting is performed based on the time correlation of the previous and next 3 digits, missing values ​​are filled, and data points with missing values ​​are deleted when necessary. The identification of outliers is achieved through box plots or statistical methods (such as methods based on standard deviation), and it is decided to correct, delete or retain these values ​​according to different situations. The data conversion step involves extracting useful time features from the original timestamp, such as year, month, day of the week, etc. These features are crucial for time series analysis. In addition, for categorical data, appropriate encoding, such as one-hot encoding, is required to make it suitable for numerical models. Data normalization is to ensure that all features are on the same scale, which is crucial to the performance of the neural network model. The normalization methods used in this solution include minimum-maximum normalization and Z-score normalization. Different normalization methods are selected according to different data set requirements. Minimum-maximum normalization scales the data to a range of 0 to 1, while Z-score normalization converts the mean of the data to 0 and the standard deviation to 1.

3. The multi-dimensional time series small perturbation adversarial attack scheme based on interpretability according to claim 1 is characterized in that: The process of step 2 is specifically as follows: In the initial training stage, we use a variety of time series prediction models to train the data. These models may include TCN, LSTNet, RNN, and CNN. Each model has its own unique advantages and applicable scenarios. For example, TCN performs well in processing multi-dimensional long sequence data, while LSTNet can effectively capture long-term dependencies. During training, we use cross-validation to tune model parameters and monitor overfitting. The performance of each model is evaluated using appropriate evaluation metrics such as mean squared error (MSE) or mean absolute error (MAE). The best model is selected as the basis for subsequent steps.

4. The multi-dimensional time series small perturbation adversarial attack scheme based on interpretability according to claim 1 is characterized in that: The process of step 3 is specifically as follows: After the multi-dimensional time series forecasting model is trained, we enter the critical interpretability analysis stage. The core goal of this stage is to deeply understand the prediction mechanism of the model, especially how each feature affects the final output of the model. To achieve this goal, we use a variety of post-model interpretability methods, including SHAP, LIME, and feature importance evaluation of local effect maps and gradient boosting trees. The SHAP method calculates the Shapley value of each feature value for the predicted output to understand the role of each feature in the model decision process. LIME focuses on explaining local decisions of model predictions. It approximates the predictions of the original model by building a local, interpretable model, allowing us to understand the behavior of the model in a specific prediction instance. Partial Dependence Plots (PDPs) help us understand how model predictions change on average when feature values ​​change. Gradient boosting tree models, such as XGBoost or LightGBM, not only perform well in predictive performance, but also provide an intuitive assessment of feature importance. By analyzing the split points of the tree, we can identify the features that contribute most to model predictions, which is instructive for feature selection and model optimization.

5. The multi-dimensional time series small perturbation adversarial attack scheme based on interpretability according to claim 1 is characterized in that: The process of step 4 is specifically as follows: In the feature evaluation phase, we evaluate the contribution of each feature to the model prediction based on the feature importance obtained from the interpretability analysis. We assign weights to each feature's importance, which reflect the importance of the feature in the model prediction. Then, we calculate the weighted average importance to get the comprehensive importance of each feature. Assume there is an n feature, Each feature i has an importance score I i and rank R i , these scores can come from SHAP values, LIME explanations, PDPs or feature importance estimates from gradient boosted trees. Assign a weight W to each feature’s importance i , these weights reflect the importance of each feature in the model prediction. The sum of the weights should be 1, that is Using the formula and Calculate weighted average ranking and importance.

6. The multi-dimensional time series small perturbation adversarial attack scheme based on interpretability according to claim 1 is characterized in that: The process of step 5 is specifically as follows: In the adversarial attack phase, we assume that we have white-box access to the model and use the model's gradient information to generate adversarial perturbations. These perturbations are ranked according to the comprehensive importance of the features Order = (r1, r2, ..., r n ) and importance value Weight=(I1,I2,...,I n ) is generated from high to low, satisfying ε is the disturbance budget, and we get Attack t =(x1+η1,x2+η2,...,x k +η k ) t . This process is carefully designed to ensure that the perturbation is small enough to be difficult to detect, but at the same time can effectively degrade the predictive performance of the model. The success of the adversarial attack will be verified through the subsequent attack verification phase.

7. The multi-dimensional time series small perturbation adversarial attack scheme based on interpretability according to claim 1 is characterized in that: The process of step 6 is specifically as follows: Finally, in the attack verification phase, we evaluate the performance of the model using both the original test set and the test set subjected to the adversarial attack. By comparing the model prediction results in these two cases, we can evaluate the effectiveness of the adversarial attack. By comparing with existing adversarial attack methods, we can see that smaller perturbations are sufficient for the proposed adversarial attack method based on importance measurement. The method described in this proposal is of great significance for understanding the impact of adversarial attacks on time series forecasting and improving the robustness of such forecasting techniques.

Images