Deep neural network black box attack method for electromagnetic signal identification

Abstract

The invention discloses a deep neural network black box attack method for electromagnetic signal identification, and belongs to the field of artificial intelligence. The method specifically comprises the following steps: firstly, generating an initial disturbance direction, calculating a decision boundary radius of each direction by using a binary search method, taking the disturbance direction as a particle position, and selecting an optimal particle to fit an RBF (Radial Basis Function) model; and the optimal particle of the RBF model is searched by using an SL-PSO algorithm. Then, reordering the particles, and refitting the RBF model; and updating the disturbance direction and the disturbance direction variation of each particle to generate a new generation of particle population. A new generation of particle population is evaluated by using a refitted RBF model, and the number of iterated queries is reduced. Updating the personal optimal disturbance direction of each particle and the global optimal disturbance direction of the group; if the adversarial sample is found or the number of query times is exceeded, quitting, and outputting the generated adversarial sample, so that the black box attack is successful; and otherwise, re-fitting the RBF model. According to the method, the accuracy and efficiency of adversarial sample generation are remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the fields of artificial intelligence, black box adversarial attacks and electromagnetic signal recognition, and specifically is a deep neural network black box attack method for electromagnetic signal recognition. Background Art

[0002] Electromagnetic signals are wave signals generated by the interaction of electric and magnetic fields, usually transmitted in the form of radio waves, microwaves, infrared and visible light. Electromagnetic signals are widely used in modern communication systems and electronic devices for important tasks such as data transmission, positioning, detection and imaging. Its propagation speed is close to the speed of light, and it can cross various geographical barriers to achieve long-distance, contactless information transmission, with the characteristics of high efficiency and speed.

[0003] In electromagnetic space, the transmission of electromagnetic signals is affected by the physical environment, electromagnetic interference and noise, which may cause signal distortion, attenuation or delay; especially in complex electromagnetic environments, signal transmission often faces threats from external interference sources or adversarial attacks.

[0004] In the research field related to electromagnetic identification signals, adversarial attacks refer to the attacker intentionally adding carefully designed tiny perturbations that are extremely difficult to detect by conventional detection methods to the original electromagnetic identification signal samples to generate adversarial samples. When these adversarial samples are input into the trained electromagnetic identification signal analysis model, they will mislead the model to make incorrect identification judgments, but under normal monitoring, the features presented by the adversarial samples and the original samples are almost the same.

[0005] Adversarial attacks aim to reveal the vulnerability of electromagnetic recognition signal analysis models when facing specific disturbances, and challenge the reliability, security and generalization ability of the models. Electromagnetic signal confrontation not only protects the system from malicious interference, but also can achieve confrontation effects by actively interfering with the enemy's communication signals.

[0006] With the continuous development of radio communications, radar and satellite systems, the need to counter electromagnetic attacks is increasing. In this context, the research on counterattacks and defense measures against electromagnetic space is deepening, providing strong support for ensuring system security and the reliability of signal transmission.

[0007] According to the attacker's knowledge of the target model's internal information, adversarial attacks can be divided into white-box attacks and black-box attacks:

[0008] In a white-box attack, the attacker fully understands the target model, including its structure and parameters, and can easily use various gradient-based methods to create adversarial samples. However, in real scenarios, relevant information about the model may not be exposed to the user, such as the attacker cannot obtain the internal structure information of the enemy's electromagnetic signal recognition system. Therefore, studying black-box attacks is more practical and valuable.

[0009] In a black-box attack, the attacker can only obtain the input-output correspondence of the target model through query. For score-based black-box attacks, the attacker obtains continuous prediction probabilities, called "soft labels", by querying the target model, and then estimates the gradient through zero-order optimization technology to generate adversarial samples. However, in the electromagnetic signal recognition system, only the identification label of the electromagnetic signal recognition model can be obtained, but the prediction probability of the signal type cannot be obtained. Therefore, in the electromagnetic space, the hard-label-based adversarial attack method in the black-box scenario is more in line with the real scenario and has more practical significance.

[0010] In hard-label black-box attacks, the main methods for generating adversarial examples can be divided into two categories: random search and gradient estimation.

[0011] The random search-based method does not require gradient estimation, but optimizes adversarial samples through analysis and random updates. The gradient estimation method is inspired by soft-label black-box attacks and uses finite difference methods for zero-order optimization to estimate gradients and generate adversarial samples. Although these two methods can effectively generate adversarial samples, they still have high requirements for the number of queries, and there is room for further optimization of the convergence of adversarial perturbations in the number of queries.

[0012] In the prior art, the RayS method is a black box attack method based on hard labels. The basic idea is: given a model and a test sample, first initialize the optimal perturbation direction as a vector of all 1s, and set the optimal radius to infinity; then change the sign of each dimension of the current optimal perturbation direction according to certain rules, and use a binary search method to determine whether the decision boundary radius in the current perturbation direction is smaller; if so, update the optimal perturbation direction and optimal radius, otherwise, keep them unchanged; repeat the above process until the restriction condition is met.

[0013] However, the main disadvantages of the RayS attack method are:

[0014] Traversal search leads to low query efficiency: RayS uses a traversal search strategy to find the optimal counter-perturbation. When facing high-dimensional data or complex models, it will lead to a large number of queries, thereby reducing the overall attack efficiency. In order to overcome this challenge, the present invention introduces the particle swarm optimization (PSO) algorithm, which can more intelligently explore the solution space by simulating the foraging behavior of bird flocks in nature, reduce unnecessary queries, and thus improve attack efficiency.

[0015] Higher number of queries: Since RayS needs to query the target model multiple times to determine the effectiveness of adversarial samples, it may become a bottleneck in practical applications, especially when the target model is deployed in the cloud and the query cost is high. In order to solve this problem, the present invention introduces a proxy model, uses a database to record the valid solutions generated during the iteration process, and uses the fitness function to evaluate and sort these solutions, and uses the top-ranked solutions to build a proxy model; it can better proxy the expensive fitness function. In the subsequent solution process, the proxy model is used to evaluate the particles in each generation of the population, instead of using the original expensive fitness function to evaluate the particles, which can effectively reduce the number of visits to the fitness function.

[0016] The existing references are as follows:

[0017] A method and system for detecting image adversarial samples based on decision scores

[0018] A black box anti-attack method, device, equipment and storage medium

[0019] "Detecting Black-Box Neural Network Types Using Small Amounts of Data and Adversarial Attacks"

[0020] 《A black-box attack adversarial sample generation method and system》

[0021] A method for generating adversarial samples for black-box deep models with visually perturbed constraints

[0022] "Surrogate-assisted hierarchical particle swarm optimization"

[0023] "RayS:ARay Searching Method for Hard-label Adversarial Attack"

[0024] "A social learning particle swarm optimization algorithm for scalable optimization". Summary of the invention

[0025] In view of the above problems, the present invention proposes a deep neural network black box attack method for electromagnetic signal recognition, which uses the calculation method of the decision boundary radius based on binary search as the fitness function of the PSO algorithm, forming an adversarial sample generation mechanism with directional search capability, and effectively improving the query efficiency. The disturbance direction is regarded as the particle position in the particle swarm optimization algorithm, and the proxy model is trained using effective historical data. In the algorithm iteration process, new data is used to continuously iterate and optimize the proxy model. When evaluating the fitness function, a part of the query to the electromagnetic recognition model is placed on the proxy model, so as to reduce the number of queries to the electromagnetic recognition model.

[0026] The specific steps of the deep neural network black box attack method for electromagnetic signal recognition are as follows:

[0027] Step 1: Generate the initial perturbation direction using Latin hypercube sampling;

[0028] Step 2: For each initial disturbance direction, use the disturbance search algorithm based on binary search to calculate the corresponding decision boundary radius and save it in the database.

[0029] The perturbation search formula based on binary search is:

[0030] distance = fitness (direction)

[0031] Where direction is the disturbance direction, distance is the radius of the decision boundary in the disturbance direction, and fitness is the mapping function from the disturbance direction to the decision boundary radius.

[0032] Step 3: Consider each disturbance direction as the particle position in the particle swarm optimization algorithm, sort the particles in the database in ascending order according to the size of the decision boundary radius, select the first N particles as the initial population, and select the best disturbance direction for the group and the best individual disturbance direction for each particle.

[0033] Step 4: Use the first P non-repeated optimal particles in the initial population to fit the RBF model;

[0034] The input of the RBF model is the disturbance direction in the electromagnetic space, and the output is the radius from the original sample to the decision boundary in this direction. The specific fitting process is as follows:

[0035] Step 401: Select the first P best particles from the initial population and record the position x of each particle. i and the corresponding decision boundary radius y(x i );

[0036] P≤N; the coordinates of the P optimal particles are x 1 ,x2 ,x 3 ,…x i ,…x p ;

[0037] Step 402: For the P optimal particles, calculate the distance matrix Φ between any two particles:

[0038]

[0039] Among them, ‖·‖ and denote the Euclidean norm and kernel function respectively, The position x is calculated i and x j The distance between.

[0040] Step 403: Use the decision boundary radius y(x 1 ),y(x 2 ),…y(x i ),…y(x p ), solve the weight coefficient α through the linear equation system i :

[0041] Φα=y

[0042] Where α=(α 1 ,α 2 …α i ,…α p ) is the weight coefficient to be fitted, and y is the decision boundary radius set of each particle.

[0043] Step 404, obtaining a fitted RBF model;

[0044] The model expression is:

[0045]

[0046] Where x represents the perturbation direction of the particle input to the RBF model; y(x) is the output of the RBF model; that is, the radius from the original sample to the decision boundary in the x direction.

[0047] Step 5: Use the SL-PSO algorithm to find the optimal particle X of the RBF model * , and use the fitness function to calculate the decision boundary radius corresponding to the disturbance direction of the optimal particle, and then * The decision boundary radius is saved in the database.

[0048] The specific steps of the SL-PSO algorithm are as follows:

[0049] 1) First, initialize a group of m random particles, each particle is a vector with n dimensions;

[0050] 2) For the current iteration t (the initial value of t is 0), the RBF model is used to calculate the decision boundary radius of each particle, and the optimal solution X is updated according to the radius size. * ;

[0051] 3) Then, according to the size of the decision boundary radius, the particles in the population are sorted in descending order, and according to the disturbance direction of the mth particle, the change in the disturbance direction of the first m-1 particles is updated;

[0052] The update operation is as follows:

[0053] First, calculate the random probability P of each particle i (t); and determine whether is the set learning probability; if so, for each dimension j of the particle, 1≤j≤n, update the perturbation direction of the particle and the change in the perturbation direction; otherwise, do not update.

[0054] Update process:

[0055] Traverse the particles from 1 to the previous m-1, generate a random number k of [i+1,m] in the jth dimension of the current particle i, and calculate:

[0056]

[0057] ΔX i,j (t+1)=r 1 (t)*ΔX i,j (t)+r 2 (t)*I i,j (t)+r 3 (t)*ε*C i,j (t)

[0058]

[0059] Where X i,j (t) is the j-th perturbation direction of particle i in the t-th generation population, 1≤i≤m,1≤j≤n,ΔX i,j (t+1) is the learned behavior correction value. 1 ,r 2 and r 3 is a random factor. ΔX i,j (t+1) is obtained by adding three addition formulas, which are the inertia component ΔX in the PSO algorithm. i,j (t), the component I learned from the demonstrator i,j (t) and the component C learned from the particle group i,j (t).

[0060] 4) Finally, the number of iterations increases by 1. If the number of iterations is not reached, go to 2). Otherwise, output the particle X with the optimal decision boundary radius. * .

[0061] Step 6: Re-sort the particles in the database in ascending order according to the decision boundary radius, and determine whether the first P particles in the database have been updated. If so, return to step 4, refit the RBF model, and enter step 7; otherwise, do not update the model and directly enter step 7.

[0062] Step 7: Update the disturbance direction and disturbance direction change of each particle in the database to generate a new generation of particle population.

[0063] During the adversarial attack, particle updates include velocity updates and disturbance direction updates;

[0064] The particle velocity update formula is:

[0065]

[0066] in is the position of the ith particle of the tth generation, is the velocity of the ith particle of the tth generation, that is, the magnitude of the disturbance caused by the change in the current disturbance direction of the particle. Indicates location The jth dimension of It’s speed The jth dimension of is the optimal personal position of the ith particle up to the tth generation; is the current global optimal position in the particle swarm; r 1 and r 2 is a random number distributed between [0,1]; c 1 and c 2 is the acceleration factor and χ is the contraction factor.

[0067] The particle disturbance direction update formula is:

[0068]

[0069] Step 8: Use the refitted RBF model to evaluate the decision boundary radius of each particle in the new generation particle population, and select particles whose personal optimal decision boundary radius becomes smaller.

[0070] Step 9: Use binary search to evaluate the decision boundary radius of the particles selected in step 8 and save it in the database.

[0071] Step 10: Update the personal best perturbation direction of each particle in the database and the global best perturbation direction of the group.

[0072] Step 11: If an adversarial sample is found or the number of queries is exceeded, exit and output the generated adversarial sample, and the black box attack is successful; otherwise, go to step 4 and use the new generation of particle population to refit the RBF model.

[0073] The adversarial sample is calculated as follows:

[0074] The optimal perturbation direction and its decision boundary radius found in the current iteration are direction and distance respectively. The original sample is x and the corresponding label is y. Then the sample currently found is x′=x+direction*distance. The classification result obtained by inputting x′ into the electromagnetic signal recognition model is y′. If y′ is different from y, it means that x′ is an adversarial sample.

[0075] The advantages of the present invention are:

[0076] 1. The present invention provides a deep neural network black box attack method for electromagnetic signal recognition, which combines the decision boundary radius calculation method based on binary search with the PSO algorithm to create an adversarial sample generation mechanism with directional search capability. The core point is that it cleverly embeds the binary search process of the decision boundary radius into the particle swarm iteration framework, so that the position of each particle corresponds to a dynamically adjusted search radius. Using the swarm intelligence optimization algorithm, the global optimal solution of the adversarial sample can be efficiently searched, and the adversarial sample with minimized disturbance can be generated under the premise of satisfying the given disturbance constraints. This method significantly improves the accuracy and efficiency of adversarial sample generation.

[0077] 2. The present invention provides a deep neural network black-box attack method for electromagnetic signal recognition. Compared with the problem that the traditional black-box attack method fails to fully utilize the historical iteration information during the iteration process, the adversarial attack technology based on the proxy model proposed in the present invention can effectively integrate these neglected historical data and auxiliary information, thereby greatly improving the attack efficiency. By constructing and using the proxy model, the need for direct query of the black-box model is greatly reduced, and more accurate and effective adversarial samples are generated at a lower cost. This not only reduces the resource consumption caused by frequent queries, but also enhances the efficiency and accuracy of adversarial sample generation, providing an innovative solution to the high query volume bottleneck in existing black-box attack methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 This is a flow chart of a deep neural network black box attack method for electromagnetic signal recognition according to the present invention;

[0079] Figure 2 This is a schematic diagram of the particle swarm optimizer principle based on social behavior learning of the present invention;

[0080] Figure 3It is a schematic diagram that the imitator of the present invention learns from the demonstrator. DETAILED DESCRIPTION

[0081] The specific implementation method of the present invention is further described in detail below in conjunction with the accompanying drawings.

[0082] The deep neural network black box attack method for electromagnetic signal recognition is as follows: Figure 1 As shown, the specific steps are as follows:

[0083] Step 1: Generate the initial perturbation direction using Latin hypercube sampling;

[0084] Step 2: For each initial disturbance direction, use the disturbance search algorithm based on binary search to calculate the corresponding decision boundary radius and save it in the database.

[0085] The perturbation search formula based on binary search is:

[0086] distance = fitness (direction)

[0087] Where direction is the disturbance direction, distance is the radius of the decision boundary in the disturbance direction, and fitness is the mapping function from the disturbance direction to the decision boundary radius.

[0088] Step 3: Consider each disturbance direction as the particle position in the particle swarm optimization algorithm, sort the particles in the database in ascending order according to the size of the decision boundary radius, select the first N particles as the initial population, and select the best disturbance direction for the group and the best individual disturbance direction for each particle.

[0089] Step 4: Use the first P non-repeated optimal particles in the initial population to fit the RBF model;

[0090] The input of the RBF model is the disturbance direction in the electromagnetic space, and the output is the radius from the original sample to the decision boundary in this direction. The specific fitting process is as follows:

[0091] Step 401: Select the first P best particles from the initial population and record the position x of each particle. i and the corresponding decision boundary radius y(x i );

[0092] P≤N; the coordinates of the P optimal particles are x 1 ,x 2 ,x 3 ,…x i ,…x p ;

[0093] Step 402: For the P optimal particles, calculate the distance matrix Φ between any two particles:

[0094]

[0095] Among them, ‖·‖ and denote the Euclidean norm and Gaussian kernel function respectively, The position x is calculated i and x j The distance between.

[0096] Step 403: Use the decision boundary radius y(x 1 ),y(x 2 ),…y(x i ),…y(x p ), solve the weight coefficient α through the linear equation system i :

[0097] Φα=y

[0098] Where α=(α 1 ,α 2 …α i ,…α p ) is the weight coefficient to be fitted, and y is the decision boundary radius set of each particle.

[0099] Step 404, obtaining a fitted RBF model;

[0100] The RBF used in this model is a form of interpolation, expressed as:

[0101]

[0102] Where x represents the perturbation direction of the particle input to the RBF model; y(x) is the output of the RBF model; that is, the radius from the original sample to the decision boundary in the x direction; Gaussian kernel function

[0103] Step 5: Use the SL-PSO algorithm to find the optimal particle X of the RBF model * , and use the fitness function to calculate the decision boundary radius corresponding to the disturbance direction of the optimal particle, and then * The decision boundary radius is saved in the database.

[0104] The specific steps of the SL-PSO algorithm are as follows:

[0105] 1) First, initialize a group of m random particles, each particle is a vector with n dimensions;

[0106] 2) For the current iteration t, the RBF model is used to calculate the decision boundary radius of each particle; the initial value of t is 0;

[0107] 3) Then, according to the size of the decision boundary radius, the particles in the population are sorted in descending order, and according to the disturbance direction of the mth particle, the change in the disturbance direction of the first m-1 particles is updated;

[0108] The update operation is as follows:

[0109] First, calculate the random probability P of each particle i (t); and determine whether is the set learning probability; if so, for each dimension j of the particle, 1≤j≤n, update the perturbation direction of the particle and the change in the perturbation direction; otherwise, do not update.

[0110] Update process:

[0111] Traverse the particles from 1 to the previous m-1, generate a random number j of [i+1,m] in the jth dimension of the current particle i, and calculate:

[0112]

[0113] ΔX i,j (t+1)=r 1 (t)*ΔX i,j (t)+r 2 (t)*I i,j (t)+r 3 (t)*ε*C i,j (t)

[0114]

[0115] Where X i,j (t) is the j-th perturbation direction of particle i in the t-th generation population, 1≤i≤m,1≤j≤n,ΔX i,j (t+1) is the learned behavior correction value. 1 ,r 2 and r 3 is a random factor. ΔX i,j (t+1) is obtained by adding three addition formulas, which are the inertia component ΔX in the PSO algorithm. i,j (t), the component I learned from the demonstrator i,j (t) and the component C learned from the particle group i,j (t).

[0116] Inspired by social learning, learning probability is associated with dimension n. In a group, the more adaptable a particle is, the less likely it is to learn from other particles. At the same time, the more complex the behavior, the less likely the particle is to successfully learn the behavior. In general, the performance of most algorithms decreases as the search dimension of the optimization problem increases, especially when there is a strong correlation between decision variables. Therefore, it can be inferred that the higher the search dimension, the more difficult it is to solve the problem, and the less willing the particles are to learn from other particles. Based on this assumption, the learning probability is set to be inversely proportional to the problem dimension:

[0117]

[0118] 4) Finally, the number of iterations increases by 1. If the number of iterations is not reached, go to 2). Otherwise, output the particle X with the optimal decision boundary radius. * .

[0119] Step 6: Re-sort the particles in the database in ascending order according to the decision boundary radius, and determine whether the first P particles in the database have been updated. If so, return to step 4, refit the RBF model, and enter step 7; otherwise, do not update the model and directly enter step 7.

[0120] Step 7: Update the disturbance direction and disturbance direction change of each particle in the database to generate a new generation of particle population.

[0121] During the adversarial attack, particle updates include velocity updates and disturbance direction updates;

[0122] The particle velocity update formula is:

[0123]

[0124] in is the position of the i-th particle in the t-th generation, indicating the perturbation direction of the particle; is the velocity of the ith particle of the tth generation, that is, the magnitude of the disturbance caused by the change in the current disturbance direction of the particle. Indicates location The jth dimension of It’s speed The jth dimension of is the optimal personal position of the ith particle up to the tth generation; is the current global optimal position in the particle swarm; r 1 and r 2 is a random number distributed between [0,1]; c 1 and c 2 is the acceleration coefficient, χ is the shrinkage factor and satisfies the following expression:

[0125]

[0126] When the disturbance direction change of each body is updated, the particle disturbance direction update formula is:

[0127]

[0128] Step 8. Use the refitted RBF model to evaluate the decision boundary radius of each particle in the new generation of particle population. Instead of using the original black box model to evaluate the particle radius, the proxy model is used to evaluate the particle radius, thereby reducing the number of queries; and screen out those particles whose personal optimal decision boundary radius becomes smaller.

[0129] When evaluating each particle of the new particle population using the refitted RBF model, the particles whose estimated decision boundary radius is better than their personal best decision boundary radius are screened out. This method avoids frequently querying the high-cost original model during the particle optimization process, and instead uses the RBF proxy model to quickly evaluate the performance of the particles, thereby achieving more efficient search and convergence.

[0130] By introducing the RBF proxy model to replace the original model, the number of queries to the original model can be significantly reduced, thereby improving the efficiency of the optimization process. Traditional black-box attack methods often fail to fully utilize the valuable information and auxiliary data in historical iteration rounds during the iteration process, which is crucial to reducing the number of queries. In contrast, the adversarial attack technology based on the proxy model can fully integrate and utilize these previously neglected data resources, thereby greatly improving the efficiency of the attack. By constructing and using a proxy model, this method can minimize the need to directly query the black-box model, making it possible to generate more accurate and effective adversarial samples at a lower query cost. This method not only significantly reduces the resource consumption caused by frequent queries, but also enhances the efficiency and accuracy of the adversarial sample generation process, providing an innovative solution to the high query volume bottleneck problem in existing black-box attack methods.

[0131] Step 9: Use binary search to evaluate the decision boundary radius of the particles selected in step 8 and save it in the database.

[0132] Step 10: Update the personal best perturbation direction of each particle in the database and the global best perturbation direction of the group.

[0133] Step 11: If an adversarial sample is found or the number of queries exceeds the limit, exit and output the adversarial sample generated as x. adv =x+direction*distance, that is, the black box attack is successful; otherwise, go to step 4 and use the new generation of particle population to refit the RBF model.

[0134] The adversarial sample is calculated as follows:

[0135] The optimal perturbation direction and its decision boundary radius found in the current iteration are direction and distance respectively. The original sample is x and the corresponding label is y. Then the sample currently found is x′=x+direction*distance. The classification result obtained by inputting x′ into the electromagnetic signal recognition model is y′. If y′ is different from y, it means that x′ is an adversarial sample.

[0136] Example:

[0137] This embodiment specifically includes the following five parts:

[0138] 1. Decision boundary radius

[0139] Let f represent the neural network model, and {x, y} represent the original sample and the corresponding original label. The goal of the adversarial attack is to solve the following optimization problem

[0140]

[0141] Where ε represents the maximum permissible perturbation size, and the indicator function It is a very complex optimization problem, so the optimization problem is transformed into a formula:

[0142]

[0143] Where l represents the loss function; for example, the cross entropy loss function.

[0144] Traditional black box attack methods usually transform the above attack process into the following formula:

[0145]

[0146] Where g(d) represents the decision boundary radius of the original sample x along the perturbation direction d, and the goal is to find the minimum decision boundary radius for the original sample x. represents the minimum decision boundary radius and the corresponding disturbance direction. If the minimum decision boundary radius satisfies The attack is considered successful.

[0147] When the query budget is limited, it is impossible to search the entire continuous perturbation direction space. Therefore, it is necessary to restrict the search space to a set of discrete perturbation directions so that direct search is possible. Since the goal is to obtain the decision boundary radius, we consider pointing to L ∞ The perturbation direction of the vertex of the norm ball, that is, d∈{-1,1} d , where d represents the dimension of the original sample. Convert the optimization problem to solve a discrete problem:

[0148]

[0149] The search space is changed from Reduce to {-1,1} d , which contains 2 d possible search directions.

[0150] 2. Calculation method of decision boundary radius based on binary search

[0151] For black-box attacks, the goal is to find the optimal perturbation direction so that the smallest perturbation size is added in the perturbation direction, that is, the decision boundary radius is minimized, and adversarial samples can be obtained. Therefore, it is necessary to calculate the decision boundary radius in any perturbation direction.

[0152] This example is based on binary search to determine the distance of the electromagnetic signal sample x to the decision boundary in a specific perturbation direction, thereby generating an adversarial sample. By gradually adjusting the perturbation amount, the relationship between the adversarial sample and the decision boundary is accurately located.

[0153] The algorithm input is the original electromagnetic signal sample x, the classifier f and its corresponding label y, the disturbance direction direction, and the disturbance threshold ε; the output result is the radius of the sample x to the decision boundary in the given disturbance direction.

[0154] Each step is described in detail below.

[0155] (1) Regularized perturbation direction:

[0156] The perturbation direction direction is normalized to the unit vector d = direction / ‖direction‖ 2 , to ensure the directional consistency and computational stability of the search process.

[0157] (2) Check initial conditions:

[0158] First, check whether the current original sample x is already an adversarial sample. If the minimum perturbation r is applied along the perturbation direction d best *d, the classifier output is still the correct label y, then the algorithm directly returns to infinity, indicating that the current perturbation direction is better than r best Smaller decision boundary radius.

[0159] (3) Initialize the search interval:

[0160] The starting point of the search interval is defined as start = 0 and the end point is defined as end = d. This interval represents the range of the disturbance amount. Initially, the disturbance amount is between 0 and the maximum value.

[0161] (4) Binary search process:

[0162] Through binary search, the search range is continuously narrowed to find the minimum perturbation amount that can successfully generate adversarial samples.

[0163] The specific operations are as follows:

[0164] ο Calculate the midpoint of the search interval mid=(start+end) / 2 as the perturbation amount for the current attempt.

[0165] If the original sample x is still classified as the correct label y after moving the perturbation of mid length (i.e., no adversarial sample is generated), it means that the current perturbation amount is not enough to break through the decision boundary of the classifier. Therefore, the starting point of the search interval is updated to start=mid, that is, the perturbation amount is increased.

[0166] If the original sample x is misclassified (i.e., an adversarial sample is generated) after moving the disturbance of mid length, it means that the current disturbance amount is sufficient to change the classification of the sample. Therefore, the end point of the search interval is updated to end=mid, that is, the disturbance amount is reduced.

[0167] (5) Output results:

[0168] If after iteration, the final perturbation end successfully generates an adversarial sample, then the value is output as the distance from the sample to the decision boundary. If the attack fails, that is, no effective adversarial sample can be found, then the attack is considered unsuccessful.

[0169] The core of this method is to gradually approach the decision boundary through binary search, thereby minimizing the amount of perturbation required to generate adversarial samples.

[0170]

[0171]

[0172] Therefore, the algorithm can be simplified to the following optimization problem:

[0173] distance = fitness (direction)

[0174] Where direction is the perturbation direction, and distance is the radius of the decision boundary in the perturbation direction. The process of countering the attack can be transformed into finding an optimal perturbation direction. * The process ensures that the radius of the decision boundary in the perturbation direction is * Minimum, then the corresponding adversarial sample is x+direction**distance * .

[0175] 3. Black box attack method based on proxy model

[0176] In the calculation method of decision boundary radius based on binary search, the input is the disturbance direction, and the output is the decision boundary radius in the disturbance direction. If the disturbance direction is analogous to a particle in all solution spaces, the process of finding the shortest decision boundary radius is transformed into the process of finding the optimal particle in the solution space, that is, the particle swarm optimization algorithm can be used to solve the above problem.

[0177] The following first introduces the types of proxy models and the particle position update rules in the particle swarm optimization algorithm, and finally gives the overall algorithm flow of the black box attack method based on the proxy model.

[0178] (1) Choose the right type of proxy model

[0179] The radial basis network is a powerful neural network, especially suitable for small sample learning and nonlinear problems. It performs very well in both low-dimensional and high-dimensional scenarios, can well approximate high-dimensional nonlinear functions, and can perform local and global modeling for complex problems. For the particle swarm optimization process, it can not only find the optimal value of the local space, but also smooth the local optimum and quickly find the global optimal solution.

[0180] (2) Particle velocity update rules

[0181] In the particle swarm optimization algorithm, the initial population is randomly generated, and each particle in the population is assigned a certain speed. During the adversarial attack, the speed represents the size of the disturbance made to each particle.

[0182] (3) Black-box attack method based on proxy model

[0183] In the black-box attack method based on the proxy model, the RBF model is used to proxy the fitness method. The input of the model is the disturbance direction in the electromagnetic space, and the output is the distance from the original sample to the decision boundary in this direction. Therefore, the process of solving the optimal solution of the fitness objective function can be transformed into the process of optimizing the RBF model to make it fit the fitness function as fully as possible and seek its optimal solution.

[0184] For the process of black-box attack based on agent model, Algorithm 2 mainly involves the SL-PSO method, which uses the particle swarm optimization algorithm based on social learning to solve the optimal perturbation direction and decision boundary size of the agent model:

[0185]

[0186] 4. Particle Swarm Optimizer Based on Social Behavior Learning

[0187] Consider the following problem of solving the minimum decision boundary radius:

[0188] minf=f(X),stX∈χ

[0189] in is the set of perturbation direction spaces, n represents the dimension of the perturbation direction, and f represents the mapping from the perturbation direction to the decision boundary radius.

[0190] (1) Overall framework

[0191] Like the classic PSO, SL-PSO initializes a population of m particles and saves a randomly initialized decision vector X for each particle i. i (t) represents a disturbance direction of the electromagnetic sample. According to the mapping function from the disturbance direction to the decision boundary radius, each particle can calculate the size of the decision boundary radius. Then the population is sorted in ascending order according to the size of the particle decision boundary radius.

[0192] The overall framework is as follows Figure 2 As shown:

[0193] (2) Particle swarm sorting and behavior learning

[0194] First, the initial population is generated and used as input to enter the iterative loop of the population: the particles in the population are evaluated according to the mapping function from the disturbance direction to the decision boundary radius, and the particles are sorted according to the size of the decision boundary radius. According to the sorting results, the speed and position of each particle are updated to form a new generation of population. When the loop condition is met, the iterative loop of the population is jumped out and the optimal particle is output.

[0195] The following points should be noted:

[0196] 1) The particle sorting part is sorted according to the size of the decision boundary, from large to small. Since the minimum value of the decision boundary radius is sought, the particles with the later ranking are considered to be the better particles.

[0197] 2) Among the sorted particles, the particles in the front will learn the perturbation direction of the particles behind. Except for the last particle, the rest of the particles can be called an imitator.

[0198] 3) Among the sorted particles, the particles at the back will guide the perturbation direction of the particles in front. Therefore, except for the first particle, all particles can be called a demonstrator, and the imitators will learn from the demonstrators. Figure 3 shown.

[0199] (3) SL-PSO algorithm

[0200] In each iteration of Algorithm 2, the SL-PSO algorithm is used to find the optimal perturbation direction and decision boundary size of the current proxy model, so as to guide the update of the perturbation direction and perturbation direction change of other particles in the current particle swarm. The pseudo code of the SL-PSO algorithm is as follows:

[0201]

[0202]

Claims

1. A deep neural network black box attack method for electromagnetic signal recognition, characterized in that: The specific steps are as follows: Step 1: Generate the initial perturbation direction using Latin hypercube sampling; Step 2: For each initial disturbance direction, use the disturbance search algorithm based on binary search to calculate the corresponding decision boundary radius and save it in the database; Step 3: Consider each disturbance direction as the particle position in the particle swarm optimization algorithm, sort the particles in the database in ascending order according to the size of the decision boundary radius, select the first N particles as the initial population; and select the best disturbance direction of the group and the best individual disturbance direction of each particle; Step 4: Use the first P non-repeated optimal particles in the initial population to fit the RBF model; The input of the RBF model is the disturbance direction in the electromagnetic space, and the output is the radius from the original sample to the decision boundary in this direction; The model expression is: Among them, ||·|| and They represent the Euclidean norm and kernel function respectively; x represents the perturbation direction of the particle input by the RBF model; α=(α1,α2…α i ,…α p ) is the weight coefficient to be fitted; y(x) is the output of the RBF model, that is, the radius from the original sample to the decision boundary in the x direction; Step 5: Use the SL-PSO algorithm to find the optimal particle X of the RBF model * , and use the fitness function to calculate the decision boundary radius corresponding to the disturbance direction of the optimal particle, and then * and the decision boundary radius are saved in the database; The specific steps of the SL-PSO algorithm are as follows: Step 501, initializing a group of m random particles, each particle being a vector including n dimensions; Step 502: for the current iteration t, the decision boundary radius of each particle is calculated using the RBF model; the initial value of t is 0; Step 503: sort the particles in the population in descending order according to the size of the decision boundary radius, and update the change in the disturbance direction of the first m-1 particles according to the disturbance direction of the mth particle; Step 504: The number of iterations is incremented by 1, and the process returns to step 502 to re-input the m particles with updated disturbance directions into the RBF model to calculate their respective decision boundary radii; until the number of iterations is reached, the particle X with the optimal decision boundary radius is finally output. * ; Step 6: Re-sort the particles in the database in ascending order according to the decision boundary radius, and determine whether the first P particles in the database are updated. If so, return to step 4, refit the RBF model, and enter step 7; otherwise, do not update the model and directly enter step 7; Step 7: Update the disturbance direction and disturbance direction change of each particle in the database to generate a new generation of particle population; Step 8: Use the refitted RBF model to evaluate the decision boundary radius of each particle in the new generation particle population, and select those particles whose personal optimal decision boundary radius becomes smaller; Step 9: Use binary search to evaluate the decision boundary radius of the screened particles and save it in the database; Step 10: Update the personal best perturbation direction of each particle in the database and the global best perturbation direction of the group; Step 11: If an adversarial sample is found or the number of queries is exceeded, exit and output the generated adversarial sample, and the black box attack is successful; otherwise, go to step 4 and use the new generation of particle population to refit the RBF model.

2. A deep neural network black box attack method for electromagnetic signal recognition according to claim 1, characterized in that: In the step 2, the perturbation search formula based on binary search is: distance = fitness (direction) Where direction is the disturbance direction, distance is the radius of the decision boundary in the disturbance direction, and fitness is the mapping function from the disturbance direction to the decision boundary radius.

3. A deep neural network black box attack method for electromagnetic signal recognition as claimed in claim 1, characterized in that: The specific fitting process of step 4 is as follows: Step 401: Select the first P best particles from the initial population and record the position x of each particle. i and the corresponding decision boundary radius y(x i ); P≤N; the coordinates of the P optimal particles are x1,x2,x3,…x i ,…x p ; Step 402: For the P optimal particles, calculate the distance matrix Φ between any two particles: in, The position x is calculated i and x j The distance between Step 403: Use the decision boundary radius y(x1), y(x2), ...y(x i ),…y(x p ), solve the weight coefficient α through the linear equation system i : Φα=y Among them, y is the decision boundary radius set of each particle; Step 404: Obtain a fitted RBF model.

4. A deep neural network black box attack method for electromagnetic signal recognition as claimed in claim 1, characterized in that: In step 5, according to the disturbance direction of the mth particle, the change amount of the disturbance direction of the first m-1 particles is updated, and the process is as follows: First, calculate the random probability P of each particle i (t); and determine whether is the set learning probability; If yes, for each dimension j of the particle, 1≤j≤n, update the perturbation direction of the particle and the change in the perturbation direction; otherwise, do not update; The update process is: Traverse the particles from 1 to the previous m-1, generate a random number k of [i+1,m] in the jth dimension of the current particle i, and calculate: ΔX i,j (t+1)=e1(t)*ΔX i,j (t)+r2(t)*I i,j (t)+r3(t)*ε*C i,j (t) Where X i,j (t) is the j-th perturbation direction of particle i in the t-th generation population, 1≤i≤m,1≤j≤n,ΔX i,j (t+1) is the learned behavior correction value, r1, r2 and r3 are random factors, ΔX i,j (t+1) is obtained by adding three addition formulas, which are the inertia component ΔX in the PSO algorithm. i,j (t), the component I learned from the demonstrator i,j (t) and the component C learned from the particle group i,j (t).

5. A deep neural network black box attack method for electromagnetic signal recognition as claimed in claim 1, characterized in that: In the step 7, during the counterattack process, particle updating includes updating the velocity and the disturbance direction; The particle velocity update formula is: in is the position of the ith particle of the tth generation, is the velocity of the ith particle of the yth generation, that is, the magnitude of the disturbance caused by the change in the current disturbance direction of the particle; Indicates location The jth dimension of It’s speed The jth dimension of is the optimal personal position of the ith particle up to the tth generation; is the current global optimal position in the particle swarm; r1 and r2 are random numbers distributed between [0,1]; c1 and c2 are acceleration coefficients, and χ is the contraction factor; The particle disturbance direction update formula is:

6. A deep neural network black box attack method for electromagnetic signal recognition as claimed in claim 1, characterized in that: In step 11, the adversarial sample is calculated as follows: The optimal perturbation direction and its decision boundary radius found in the current iteration are direction and distance respectively. The original sample is x and the corresponding label is y. Then the sample found currently is x'=x+direction*distance. The classification result obtained by inputting x' into the electromagnetic signal recognition model is y'. If y' is different from y, it means that x' is an adversarial sample.

Images