Black box attack method and system based on sparse vector gradient estimation

Abstract

The invention discloses a black box attack method and system based on sparse vector gradient estimation, and the method comprises the steps: collecting electroencephalogram data as an iteration initial sample, and selecting a to-be-attacked sample point based on the importance of a sample point in the iteration initial sample; random noise is added to the to-be-attacked sample point to obtain an adversarial sample; respectively inputting the iteration initial sample and the confrontation sample into an attacked model for result prediction; expanding a noise vector in the attacked sample point according to the shape of the initial electroencephalogram data, and obtaining a gradient of each sample point relative to a loss function based on an expansion result and the loss function; generating adversarial disturbance of single iteration according to the gradient, and updating the iteration initial sample based on the adversarial disturbance; and the final confrontation sample is obtained based on the iteration initial sample which is continuously iterated, so that a solid theoretical basis and technical support are provided for the design of a deep learning model in the future, and the safety and reliability of the deep learning technology are ensured.

Description

Technical Field

[0001] The present invention belongs to the field of brain-computer interface security technology, and specifically relates to a black box attack method and system based on sparse vector gradient estimation. Background Art

[0002] In recent years, brain-computer interface (BCI) technology has rapidly developed, bringing revolutionary breakthroughs to fields such as neurorehabilitation, intelligent interaction, and brainprint recognition. As an emerging biometric recognition technology, brainprint recognition extracts unique electroencephalogram (EEG) signal patterns to authenticate individuals, offering high security and unforgeability. However, traditional brainprint recognition methods rely on manual feature extraction (such as time-frequency domain energy and phase synchronization), which struggles to capture the high-dimensional, nonlinear characteristics of EEG signals, limiting recognition accuracy and robustness. The introduction of deep learning technology has provided a new solution for brainprint recognition: convolutional neural networks (CNNs) can automatically extract the spatiotemporal features of EEG signals, recurrent neural networks (RNNs) can model long-term signal dependencies, and attention mechanisms further focus on key time points and frequency bands. These advantages make deep learning-based brainprint recognition a novel approach for identity and security authentication.

[0003] It is worth noting that although deep learning technology has made breakthrough progress in EEG feature analysis, its inherent vulnerability exposes significant security risks in adversarial sample attack scenarios. Studies have shown that adversarial samples can mislead DNN models into producing high-confidence misclassifications by injecting subtle perturbations that are imperceptible to the human eye into the input data. Such attacks have caused widespread security controversy in fields such as image recognition and natural language processing. In EEG-BCI systems, due to the low signal-to-noise ratio and high non-stationarity of the signal itself, adversarial perturbations are more easily implanted into EEG time series data through covert methods such as bionic noise injection or device side channel penetration, leading to systemic loss of control risks such as misjudgment of movement intentions and tampering of virtual instructions. By generating adversarial samples, it is helpful to improve the defense capabilities of current deep learning models and provide a solid theoretical basis and technical support for the design of future deep learning models, thereby ensuring the security and reliability of deep learning technology.

[0004] B. Feng et al. combined sparse masks with the PGD iterative algorithm to create a sparse perturbation to enhance the concealment of attacks, successfully deceiving deep neural networks. H. Yi et al. employed a time-frequency combination method to generate a perturbation more similar to random noise to mask the attack. Z. Liu et al. observed that when they introduced small adversarial perturbations to the original samples, the performance of the neural network significantly degraded. Y. Li et al. simulated a real-world attack scenario by stealing and attacking EEG signals to interfere with SSVEP-based wheelchair control. However, the above research on adversarial attacks against DNN-BCI systems has primarily focused on the white-box attack paradigm, which assumes that the attacker has complete prior knowledge of the target model (such as the network architecture and parameter gradients) and generates adversarial perturbations based on backpropagation optimization. While such methods can reveal model decision boundary vulnerabilities, their strong assumptions deviate significantly from real-world attack scenarios. In practice, BCI systems are often deployed in a black-box fashion (e.g., cloud APIs or embedded devices), making it difficult for attackers to access the model's internal parameters and gradients. This limits the transferability and practicality of adversarial examples generated by white-box attacks.

[0005] Implementing an attack in this black-box scenario is not easy, relying on multiple model queries and gradient estimation. Although a range of black-box attack algorithms have emerged in the image field, their direct translation to the EEG domain is not entirely applicable. Due to the real-time nature and high temporal resolution of EEG data, these algorithms often fail to launch effective attacks in a timely manner due to the large query overhead, or the added adversarial perturbations are too large, corrupting the original EEG waveforms. A reasonable balance cannot be achieved between query efficiency and noise perturbation. Summary of the Invention

[0006] The purpose of the present invention is to provide a black box attack method and system based on sparse vector gradient estimation.

[0007] In a first aspect, the present invention provides a black box attack method based on sparse vector gradient estimation, which comprises the following steps: Step 1: Collect the EEG data of the subject and pre-process the acquired EEG data to obtain initial EEG data; Step 2: Select a sample point to be attacked from the iterative initial sample and add random noise to the sample point to be attacked to obtain an adversarial sample; wherein the iterative initial sample under the first iteration condition is the initial EEG data; Step 3: Input the iterative initial sample and the adversarial sample into the attacked model to predict the results, and obtain the corresponding loss function based on the prediction results; expand the noise vector in the attacked sample point according to the shape of the initial EEG data, and based on the expansion result and the loss function, obtain the gradient of each sample point with respect to the loss function; Step 4: Generate a single-iteration adversarial perturbation based on the gradient, and update the iterative initial sample based on the adversarial perturbation; Step 5. Iterate steps 2 to 4 until the distance function between the initial sample and the target category is zero, and output the corresponding initial sample as the final adversarial sample.

[0008] Preferably, in step 2, the method for selecting the sample points to be attacked is as follows: a. Set the number of sample points to select s and gradient update threshold m ; b. The number of weight updates is greater than or equal to the gradient update threshold m The sample points of the set BP are constructed; the number of weight updates is less than the threshold of the number of gradient updates m The sample points construct the set LP; c. Set the number of subset sample points to select sn ; If the number of elements in the set BP is greater than the number of sample points selected s , then the number of subset sample points selected is sn Equal to the number of sample points selected s ; Otherwise, the number of subset sample points selected sn Select the smaller value of the number of elements in set BP and set LP; d. Randomly select from the set LP sn Elements constitute the set SLP; e. In the set BP, select sample points with weights greater than the average weight to form the set SBP; f. Randomly select from the union of set SLP and set SBP s sample points as the sample points to be attacked.

[0009] As a preference, in step 3, the gradient of each sample point with respect to the loss function The method to obtain is as follows: in, b is the scaling factor; is the loss function; represents the inverse discrete wavelet transform; is the step size of the gradient estimate; is the noise vector of the adversarial sample in the high-frequency coefficient cD; is the mapping function that maps the noise vector to the initial EEG data.

[0010] Preferably, the random noise is added in the frequency domain of the sample point to be attacked; and the adversarial disturbance is generated in the frequency domain of the corresponding sample point.

[0011] Preferably, the process of adding random noise in the frequency domain is: using discrete wavelet transform to decompose the iterative initial sample into low-frequency approximation coefficients cA and high-frequency detail coefficients cD; adding random noise to the high-frequency detail coefficients corresponding to the sample points to be attacked, and converting the high-frequency detail coefficients and low-frequency approximation coefficients after adding noise into adversarial samples through inverse discrete wavelet transform.

[0012] As a preference, in step 5, the distance function between the initial sample and the target category is The method to obtain is as follows: in, For the i The predicted probability value corresponding to each category; For the target category The corresponding predicted probability value.

[0013] As a preference, in step 3, the loss function constructed as follows: in, is the input sample; is the initial EEG data; is an adjustable hyperparameter; represents the Euclidean distance; is the input sample and the target category The distance function.

[0014] In the second aspect, the present invention provides a black-box attack system based on sparse vector gradient estimation, which is used to execute the above-mentioned black-box attack method; the black-box attack system includes a time-frequency conversion module, a sample point selection module, a noise addition module, a model prediction module, a gradient estimation module, a sample point weight update module, and an adversarial perturbation generation module; the time-frequency conversion module is used to process EEG signals using discrete wavelet transform; the sample point selection module is used to select sample points to be attacked according to the importance of the sample points; the noise addition module is used to add Gaussian noise to the sample points to be attacked; the model prediction module is used to obtain prediction results; the gradient estimation module is used to estimate the gradient of each sample point with respect to the loss function; the sample point weight update module is used to record and update the weights of all sample points of the attacked sample and the number of times the sample point is selected for attack; the adversarial perturbation generation module is used to generate adversarial perturbations corresponding to the sample points.

[0015] In a third aspect, the present invention provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the memory stores the computer program; and the processor executes the above-mentioned black box attack method.

[0016] In a fourth aspect, the present invention provides a readable storage medium storing a computer program; when the computer program is executed by a processor, it is used to implement the above-mentioned black box attack method.

[0017] The present invention has the following beneficial effects: 1. The present invention forms a sparse vector gradient estimation method by pointwise selecting some sample points, which improves the attack efficiency while ensuring the accuracy of gradient estimation, so that the attack efficiency and the added noise disturbance achieve a better balance; at the same time, the brain-computer interface attack technology proposed by the present invention does not need to obtain the architecture, parameters or training data of the neural network, and can generate adversarial samples only through input-output interaction, which significantly improves the actual applicability of the attack and provides an effective means to measure the robustness of the brain-computer interface system model in real scenarios.

[0018] 2. This paper, taking advantage of the high resolution of EEG signals in the time domain and their unique physiological characteristics in the frequency domain, proposes an EEG countermeasure attack strategy based on time-frequency domain collaborative optimization. This effectively reduces the noise perturbation added by the attack, minimizes interference with the continuity of the time domain signal, and reduces excessive damage to physiological information in the frequency domain, thereby improving the stealth of the attack. Simultaneously targeting EEG characteristics in both the time and frequency domains also improves the attack's efficiency.

[0019] 3. The present invention proposes an importance measurement strategy based on historical gradient information. By dynamically adjusting the weighted gradient sum of each sample point, it analyzes the degree of dependence of model decision-making on different areas of the EEG signal. By prioritizing attacking sample points in important areas, it conducts targeted noise attacks on the EEG signal, thereby improving the efficiency and stability of the attack, which helps to enhance the defense capability of the current deep learning model and provide a solid theoretical basis and technical support for the design of future deep learning models, thereby ensuring the security and reliability of deep learning technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is the overall flow chart of the present invention.

[0021] Figure 2 This is a flow chart of the attack algorithm constructed in the present invention.

[0022] Figure 3 This is a flow chart for attack effect verification in the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further described below with reference to the accompanying drawings.

[0024] like Figure 1As shown, a black-box attack method based on sparse vector gradient estimation is adopted, and the black-box attack system adopted by it includes a time-frequency conversion module, a sample point selection module, a noise addition module, a model prediction module, a gradient estimation module, a sample point weight update module, and an adversarial perturbation generation module; the time-frequency conversion module is used to process the EEG signal using discrete wavelet transform; the sample point selection module is used to select the sample points to be attacked according to the importance of the sample points; the noise addition module is used to add Gaussian noise to the sample points to be attacked; the model prediction module is used to obtain the prediction result; the gradient estimation module is used to estimate the gradient of each sample point with respect to the loss function; the sample point weight update module is used to record and update the weights of all sample points of the attacked sample and the number of times the sample point is selected for attack; the adversarial perturbation generation module is used to generate the adversarial perturbation of the corresponding sample point.

[0025] The black box attack method includes the following steps: Step 1: Data initialization Use EEG signal acquisition equipment to obtain the subject's EEG signal and preprocess the acquired EEG signal. Preprocessing includes downsampling, bandpass filtering, re-reference processing, data segmentation and event alignment. Slice the preprocessed EEG data into the specified input shape to obtain the initial EEG data. ;in, N The number of sample points; set the target category to be attacked .

[0026] Step 2: Figure 2 As shown, the discrete wavelet transform is used to iterate t The initial sample of the next iteration Decompose it to obtain the low-frequency approximate coefficient cA and high-frequency detail coefficient cD with time-frequency characteristics; the wavelet transform expression is: in, Represents discrete wavelet transform.

[0027] Step 3: Select the sample points to be attacked from the high-frequency detail coefficient cD. The specific process is as follows: a. Set the number of sample points to select s and gradient update threshold m .

[0028] b. The number of weight updates is greater than or equal to the gradient update threshold m The sample points of the set BP are constructed; the number of weight updates is less than the threshold of the number of gradient updates m The sample points of LP are constructed.

[0029] c. Set the number of subset sample points to select sn; If the number of elements in the set BP is greater than the number of sample points selected s , then the number of subset sample points selected is sn Equal to the number of sample points selected s ; Otherwise, the number of subset sample points selected sn Equal to the smaller value of the number of elements in set BP and set LP; d. Randomly select from the set LP sn Elements constitute the set SLP; e. In the set BP, select sample points with weights greater than the average weight to form the set SBP; f. Randomly select from the union of set SLP and set SBP s sample points as the sample points to be attacked.

[0030] Step 4: The sample points to be attacked are combined into a vector to be attacked; random Gaussian noise is added to the vector to be attacked, and the vector is scaled to The high-frequency detail coefficient cD' and the low-frequency approximation coefficient cA are combined to form the wavelet coefficient after the attack. ; The wavelet coefficients are transformed by inverse discrete wavelet transform Conversion into adversarial samples after attack ; The inverse discrete wavelet transform expression is: in, Represents the inverse discrete wavelet transform.

[0031] Step 5: Iterate the initial samples and adversarial examples Input the attacked model Perform result prediction and obtain two original prediction values (logits prediction results), namely the predicted probability values and the predicted probability value ; Get the predicted probability values respectively and predicted probability values The corresponding loss function , whose expression is: in, is the input sample; is the initial EEG data; is an adjustable hyperparameter; represents the Euclidean distance; is the input sample and the target category The distance function is expressed as follows: in, For the i The predicted probability value corresponding to each category; For the target category The corresponding predicted probability value.

[0032] The loss function As about the sample Function, mapping function As The perturbation function exist The derivative at can be approximated by finite differences. According to the loss function Get the gradient of the loss function for each sample point , whose expression is: in, b is the scaling factor; is the step size of the gradient estimate; It is an adversarial example Noise vector in the high frequency coefficients cD; bs represents the dimension of the noise vector; is a mapping function that maps the noise vector to a full-0 tensor that is the same as the initial EEG data. Its expression is: in, is the index of the sample point in the high-frequency coefficient decomposed from the original EEG signal, ; J is the noise vector The position index set corresponding to each element in the original EEG signal.

[0033] According to the gradient of the loss function Update the weights of all sample points of the attacked sample and the number of times the sample point is selected for attack. The update formula is: in, W is the gradient of each sample point; Indicates that the gradient Mapped to a full-0 tensor that is the same as the initial EEG data.

[0034] Step 6: According to the gradient Generate frequency domain adversarial perturbations corresponding to sample points for a single iteration , thereby updating the iterative initial sample, the specific process is as follows: (1) Estimating the gradient; (2) Update the first-order distance estimate and the second-order distance estimate; (3) Correction of first-order distance deviation and second-order distance deviation; (4) Use the corrected first-order moment and second-order moment to adjust the learning rate and update the frequency domain adversarial perturbation .

[0035] (5) Generate frequency domain adversarial disturbance Counteracting disturbances with cumulative frequency domain Add them together to get the updated cumulative frequency domain adversarial perturbation; convert the updated cumulative frequency domain adversarial perturbation into the cumulative time domain adversarial perturbation Q , thereby obtaining the initial sample of the next iteration process .

[0036] Step 7: Iterate steps 2 to 6 until the initial sample and target category are iterated. The distance function is zero, and the corresponding iterative initial sample is output as the final adversarial sample.

[0037] Step 8: Figure 3 As shown, the effectiveness of the present invention was verified on the motor imagery dataset EEGMMI. In this dataset, a total of 109 subjects participated in the experiment, and each subject performed 14 experimental tests, including two one-minute basic tests (one with eyes open and one with eyes closed), and three two-minute tests for each of the four motor imagery tasks. The experiment used the BCI2000 system to record 64-channel electroencephalogram (EEG) data. In this embodiment, the filter frequency band is 330Hz. The data sampling rate was downsampled from 1000Hz to 200Hz, and 5s of data were selected as a sample, with each sample having 1000 time steps.

[0038] Three brainprint recognition models (EEGNet, DeepConvNet, and BrainNet) were used as attacked models to verify the effectiveness of the attack algorithm. The EEG data used for the attack was captured from any subject. Furthermore, to compare with existing black-box attack algorithms, the proposed algorithm's step size was fixed at 0.001. 100 EEG samples were randomly selected, each with 10 randomly assigned target categories. The attack was performed with a query budget of 10,000. The attack results of different attack algorithms on different models are shown in Table 1.

[0039] Table 1 Attack effects of different attack algorithms on different models As can be seen from Table 1, the attack effect of the present invention is the best on the EEGMMI dataset, with an average attack success rate of 91.08%, which is 26.48% higher than that of Bandits. At the same time, the average number of queries of the present invention is reduced to 3482.95, which is 688.93 fewer queries than that of NES.

Claims

1. A black-box attack method based on sparse vector gradient estimation, characterized by: The following steps are involved: Step 1: Collect the EEG data of the subject and pre-process the acquired EEG data to obtain initial EEG data; Step 2: Select a sample point to be attacked from the iterative initial sample and add random noise to the sample point to be attacked to obtain an adversarial sample; wherein the iterative initial sample under the first iteration condition is the initial EEG data; Step 3: Input the iterative initial sample and the adversarial sample into the attacked model to predict the results, and obtain the corresponding loss function based on the prediction results; expand the noise vector in the attacked sample point according to the shape of the initial EEG data, and based on the expansion result and the loss function, obtain the gradient of each sample point with respect to the loss function; Step 4: Generate a single-iteration adversarial perturbation based on the gradient, and update the iterative initial sample based on the adversarial perturbation; Step 5. Iterate steps 2 to 4 until the distance function between the initial sample and the target category is zero, and output the corresponding initial sample as the final adversarial sample.

2. The black-box attack method based on sparse vector gradient estimation according to claim 1, characterized in that: In step 2, the method for selecting the sample points to be attacked is as follows: a. Set the number of sample points to select s and gradient update threshold m ; b. The number of weight updates is greater than or equal to the threshold number of gradient updates m The sample points of the set BP are constructed; the number of weight updates is less than the threshold of the number of gradient updates m The sample points construct the set LP; c. Set the number of subset sample points to select sn ; If the number of elements in the set BP is greater than the number of sample points selected s , then the number of subset sample points selected is sn Equal to the number of sample points selected s ; Otherwise, the number of subset sample points selected sn Select the smaller value of the number of elements in set BP and set LP; d. Randomly select from the set LP sn Elements constitute the set SLP; e. In the set BP, select sample points with weights greater than the average weight to form the set SBP; f. Randomly select from the union of set SLP and set SBP s sample points as the sample points to be attacked.

3. The black-box attack method based on sparse vector gradient estimation according to claim 1, characterized in that: The random noise is added in the frequency domain of the sample point to be attacked; and the adversarial disturbance is generated in the frequency domain of the corresponding sample point.

4. The black-box attack method based on sparse vector gradient estimation according to claim 3, characterized in that: The process of adding random noise in the frequency domain is as follows: using discrete wavelet transform to decompose the iterative initial sample into low-frequency approximation coefficients cA and high-frequency detail coefficients cD; adding random noise to the high-frequency detail coefficients corresponding to the sample points to be attacked, and converting the high-frequency detail coefficients and low-frequency approximation coefficients after adding noise into the adversarial sample through inverse discrete wavelet transform.

5. The black-box attack method based on sparse vector gradient estimation according to claim 4, characterized in that: In step 3, the gradient of each sample point with respect to the loss function is The method to obtain is as follows: in, b is the scaling factor; is the loss function; represents the inverse discrete wavelet transform; is the step size of the gradient estimate; is the noise vector of the adversarial sample in the high-frequency coefficient cD; is the mapping function that maps the noise vector to the initial EEG data.

6. The black-box attack method based on sparse vector gradient estimation according to claim 1, characterized in that: In step 5, the distance function between the initial sample and the target category is The method to obtain is as follows: in, For the i The predicted probability value corresponding to each category; For the target category The corresponding predicted probability value.

7. The black-box attack method based on sparse vector gradient estimation according to claim 1, characterized in that: In step 3, the loss function constructed as follows: in, is the input sample; is the initial EEG data; is an adjustable hyperparameter; represents the Euclidean distance; is the input sample and the target category The distance function.

8. A black-box attack system based on sparse vector gradient estimation, characterized by: Used to execute the black box attack method according to claim 1; the black box attack system includes a time-frequency conversion module, a sample point selection module, a noise addition module, a model prediction module, a gradient estimation module, a sample point weight update module, and an adversarial perturbation generation module; the time-frequency conversion module is used to process the EEG signal using discrete wavelet transform; The sample point selection module is used to select sample points to be attacked according to their importance; the noise addition module is used to add Gaussian noise to the sample points to be attacked; the model prediction module is used to obtain the prediction results; the gradient estimation module is used to estimate the gradient of each sample point with respect to the loss function; the sample point weight update module is used to record and update the weights of all sample points of the attacked sample and the number of times the sample point is selected for attack; the adversarial perturbation generation module is used to generate adversarial perturbations for the corresponding sample points.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The memory stores a computer program; and the processor executes the black box attack method according to any one of claims 1 to 7.

10. A readable storage medium storing a computer program; characterized in that: When the computer program is executed by a processor, it is used to implement the black box attack method according to any one of claims 1 to 7.

Images