Robotic arm grabbing planning confrontation attack method based on solution space barrier setting

Abstract

The invention belongs to the field of robot safety, and discloses a robot arm grabbing planning confrontation attack method based on solution space barrier setting, and the method comprises the steps: S1, carrying out the multiple grabbing simulation of a robot, and recording the path sequence of an end effector during the execution of each time; s2, generating a three-dimensional thermodynamic diagram capable of representing robot path preference based on the path sequence; s3, discretizing the three-dimensional thermodynamic diagram into a three-dimensional grid; s4, calculating a reachable score from each grid point to the target grid point based on the three-dimensional grid; and S5, constructing a multi-objective optimization model based on the reachable score, and optimizing the multi-objective optimization model to obtain an optimal obstacle set. The method fundamentally solves the problems of low efficiency and low success rate caused by blindness in the prior art. According to the method, a strategy for achieving an attack purpose by using a minimum, minimum and most hidden obstacle combination can be found, so that the defects of high cost and high risk in the prior art are essentially solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of robot safety, and in particular to a method for planning robot arm grasping against adversarial attacks based on solution space barrier setting. BACKGROUND

[0002] With the in-depth development of Industry 4.0 and artificial intelligence technology, automatic systems represented by industrial robots and collaborative robots have been widely penetrated into key fields such as manufacturing, logistics and warehousing, medical services, and even military and special environment exploration. The stable, safe and efficient operation of these robot systems has become an important cornerstone to ensure production efficiency, improve social service quality and even maintain national security.

[0003] Consequently, the safety threats faced by robot systems are becoming increasingly serious. At present, the safety research and protection measures for robot systems mainly focus on network information security, such as preventing hackers from invading the control system through network vulnerabilities, tampering with motion instructions, and injecting malicious code. For example, Cerrudo et al. described in detail the types of vulnerabilities found and the specific threats that robots may pose after being invaded, with the ultimate goal of promoting the entire industry to improve the safety of robots and prevent these vulnerabilities from being maliciously exploited, thereby causing significant damage to businesses, consumers and their surrounding environment. Dieber et al. conducted in-depth research on the security of ROS communication. They not only analyzed the most common vulnerabilities in ROS and their corresponding attack paths, but more importantly, they designed and implemented a security solution directly integrated into the core of ROS. This solution can provide security protection for all communication channels between ROS nodes without modifying the operating system kernel, thereby resisting threats such as man-in-the-middle attacks and data tampering. This work is a typical representative research that enhances robot network security by hardening the communication layer. Değirmenci et al. found that DoS attacks can significantly increase the delay of communication between ROS nodes and cause a large number of packet losses. In a robot system, this directly translates into delays or losses of motion instructions, outdated or missing sensor data, ultimately leading to sluggish responses, abnormal behavior or even complete stoppage of service by the robot.

[0004] However, security threats at the physical level, especially "physical adversarial attacks" that deliberately and cleverly change the robot's working environment to interfere or destroy, are an emerging field that is increasingly prominent but insufficiently researched by existing studies. Compared to the network communication layer, the feasible solution space of the motion planning layer exposes new attack surfaces: attackers do not need to crack control instructions, but only need to apply a small disturbance at the key bottleneck to induce the planner to fail. Existing passive safety measures (safety fences, light curtains, etc.) aim to prevent accidents rather than adversarial attacks, so they are difficult to resist such'solution space level' attacks.

[0005] The above prior art solution has significant drawbacks when dealing with deliberate and intelligent physical interference, the root cause of which is the failure to understand and utilize the robot's own behavior patterns and decision logic.

[0006] Blindness and inefficiency: Traditional physical grasping counter-attack methods are "blind". Attackers do not understand the internal optimization criteria of robot path planning (such as shortest path, lowest energy consumption), but only place obstacles based on surface observations. This intuitive approach has low success rate because the robot planner can always find an evasion path that the attacker did not anticipate. The root cause is the lack of a predictive model of robot behavior.

[0007] High cost and high exposure risk: To compensate for blindness, attackers often need to use large or numerous obstacles to block as much space as possible. This not only increases deployment costs, but more importantly, the conspicuous obstacles are easily discovered and removed by human operators or monitoring systems, making the attack non-covert and non-sustainable. The root cause is the lack of efficiency, which cannot achieve the "small but big" precision strike.

[0008] Lack of strategy and quantifiability: Existing methods cannot quantify the interference effect, nor can they balance "interference effect", "deployment cost" and "discovery risk". The whole process is a "one-size-fits-all" approach, lacking strategic optimization and adjustment. The root cause is that physical interference is treated as a simple physical problem, rather than an intelligent game involving robot behavior prediction. SUMMARY

[0009] The purpose of the present application is to disclose a robot arm grasping planning counter-attack method based on solution space obstacle setting, which solves the technical problems proposed in the background art.

[0010] In order to achieve the above purpose, the present application provides the following technical solutions: The present application provides a robot arm grasping planning counter-attack method based on solution space obstacle setting, comprising: S1, multiple grasping simulations are performed on the robot, and the path sequence of the end effector is recorded each time it is executed; S2, a three-dimensional heat map is generated based on the path sequence to represent the robot's path preference; S3, the three-dimensional heat map is discretized into a three-dimensional grid; S4, based on the three-dimensional grid, the reachable score of each grid point to the target grid point is calculated; S5, a multi-objective optimization model is constructed based on the reachable score, and the multi-objective optimization model is optimized to obtain an optimal obstacle set.

[0011] Preferably, S1 comprises: S10, constructing a high-fidelity robot working environment model by using a robot operating system and a physics simulation engine; S11, setting a grasping task of the robot in the robot working environment model; S12, introducing background obstacles randomly in the working space; S13, running N times of independent grasping simulations based on the grasping task, recording the end effector path sequence of each successful planning and execution, and N is a preset integer.

[0012] Preferably, the robot operating system comprises ROS, and the physics simulation engine comprises Gazebo.

[0013] Preferably, the grasping task comprises moving the end effector from a starting point to a target area.

[0014] Preferably, S2 comprises: All the path sequences collected are aggregated by using data analysis and advanced visualization technology to generate a three-dimensional heat map representing the robot path preference.

[0015] Preferably, S4 comprises: Let represent the coordinates of the grid point corresponding to the starting point, enumerate all paths from the starting point to the target grid point, and x, y and z are the coordinates of the X-axis, Y-axis and Z-axis in the three-dimensional coordinates, respectively; The reachable score of the grid point corresponding to the starting point is determined by using the following formula:

[0016] Let represent the reachable score of the grid point corresponding to the starting point, and the coordinates of the grid point in the kth path are

[0017] Preferably, constructing a multi-objective optimization model based on the reachable score comprises: The multi-objective optimization model is as follows:

[0018] The multi-objective optimization model is as follows: O represents the position of the obstacle, represents the interference effect value of the obstacle O on the grasping path, represents the economic cost of deploying the obstacle O, represents the risk value of the obstacle O being detected.

[0019] Preferably, The calculation process is as follows: The reachable score Scr1 of the grid point corresponding to the starting point before setting the obstacle O is acquired; The reachable score Scr2 of the grid point corresponding to the starting point after setting the obstacle O is acquired; The interference effect value is obtained by subtracting Scr2 from Scr1.

[0020] Beneficial effects: The prior art relies on human intuition to guess the robot path, which is blind. The present application, on the contrary, collects a large amount of path data of the robot through large-scale simulation experiments, and for the first time constructs a three-dimensional heat map that can reflect the inherent path selection preference of the robot by using statistical methods. This change in technical means from "subjective guess" to "data-driven prediction" enables the obstacle to be accurately placed in the "hot spot" area that the robot is most likely to pass through, thereby efficiently blocking the task in a "four ounces of force to break a thousand jin" manner, and fundamentally solving the low efficiency and low success rate problem caused by blindness of the prior art.

[0021] The prior art often needs to use obstacles with large volume or large quantity to ensure success rate, which is high in cost and extremely easy to expose. The present application first identifies the "throat" node that affects the global path smoothness from the path preference through the calculation of the reachable score, and realizes the refinement of the attack target. Then, the present application constructs the obstacle setting problem as a multi-objective optimization problem, which can intelligently balance between "maximizing interference effect", "minimizing obstacle volume / quantity (cost)", and "minimizing the risk of being discovered". This change in technical means from "extensive plugging" to "optimization solution" enables the present application to find a strategy to achieve the attack purpose with the smallest, least, and most concealed obstacle combination, thereby fundamentally solving the high cost and high risk problem of the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0023] Figure 1 A schematic diagram of a robot arm grasping planning counterattack method based on solution space obstacle setting according to the present application. DETAILED DESCRIPTION

[0024] With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be clearly and completely described below, obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative labor fall within the protection scope of the present application.

[0025] In order to overcome the blindness, high cost and low efficiency of physical interference in the prior art, the present application aims to provide a systematic, data-driven and intelligent robot grabbing hindering method and system. Specifically, the present application aims to achieve the following objectives: From "passive response" to "active prediction": by modeling and analyzing the historical behavior data of the robot, the path cluster most likely to be selected by the robot when performing a specific task is accurately predicted, that is, the "high probability path" or "traffic hub" in its workspace is identified.

[0026] From "extensive plugging" to "precise attack": based on the predicted path preference, the importance of each location in the workspace for completing the task is quantitatively evaluated, and the key "bottleneck" nodes that can "hold off a thousand men" are identified.

[0027] From "single target" to "multi-dimensional optimization": a multi-objective optimization model is established, which comprehensively considers the maximization of interference effect, minimization of deployment cost and minimization of exposure risk, and the optimal obstacle placement strategy (location, size, number) is solved.

[0028] Through the present application, the most effective interference on the specific grabbing task of the robot can be achieved with the smallest physical cost and the lowest risk of being discovered, and the physical attack is transformed from a "manual labor" to a "technical work".

[0029] The present application aims to solve the technical problems of blindness, inefficiency and high exposure risk in the existing methods of physically interfering with robots. Specifically, the current way of hindering robots from performing tasks by placing obstacles in the environment often relies on the intuition and experience of operators, lacks scientific prediction of robot behavior, and requires the use of too many or too large obstacles, which not only has high cost, but also is easily discovered and removed, making it difficult to achieve effective, reliable and concealed interference. Therefore, how to accurately predict the path most likely to be taken by the robot to complete a specific task, and on this basis, to achieve the most effective hindering with the smallest cost and risk, is a technical problem that needs to be solved at present.

[0030] As shown in Figure 1 The present application provides a robot arm grabbing planning counter-attack method based on solution space obstacle setting, which comprises: S1, perform multiple grasping simulations on the robot, record the end-effector path sequence of each execution.

[0031] Preferably, S1 comprises: S10, build a high-fidelity robot work environment model using a robot operating system and a physics simulation engine.

[0032] S11, set a grasping task for the robot in the robot work environment model; S12, randomly introduce background obstacles in the work space; here the work space refers to the three-dimensional space in the simulation environment that the robot arm can reach.

[0033] S13, run N independent grasping simulations based on the grasping task, record the end-effector path sequence of each successful planning and execution , N is a preset integer, N > 1000.

[0034] Pi represents the path sequence of the i-th grasping simulation, , and respectively represent the X-axis coordinate, Y-axis coordinate and Z-axis coordinate of the point in the path sequence.

[0035] Preferably, the grasping task includes moving the end-effector from the starting point to the target area.

[0036] Preferably, the robot operating system includes ROS, and the physics simulation engine includes Gazebo.

[0037] S2, generate a three-dimensional heat map that can represent the robot's path preference based on the path sequence.

[0038] Preferably, S2 comprises: Using data analysis and advanced visualization techniques, all collected path sequences are aggregated to generate a three-dimensional heat map that can represent the robot's path preference.

[0039] The three-dimensional heat map is essentially a path density field H(p) in a three-dimensional space, where the heat value of any point in the space quantifies the cumulative frequency or residence time of all successful paths in the vicinity of the point. This can be calculated by statistical methods such as Kernel Density Estimation (KDE).

[0040] S3, discretize the three-dimensional heat map into a three-dimensional grid.

[0041] Discretize the generated three-dimensional heat map into a three-dimensional grid where X1, Y1, Z1 are the resolution of the grid. Since obstacles have been randomly introduced when computing the heat map, the original heat value of each grid point can effectively reflect the preference and probability of the robot performing grasping at this specific position in the presence of obstacles.

[0042] S4, calculating the reachability score of each grid point to the target grid point based on the three-dimensional grid.

[0043] Further calculating the reachability score of each grid point to the target based on the discretized three-dimensional grid, which will be based on the original heat value of the grid point and calculated through a greedy algorithm.

[0044] Preferably, S4 comprises: Let represent the coordinates of the grid point corresponding to the starting point, enumerate all paths from the starting point to the target grid point, and x, y, and z are the coordinates of the X-axis, Y-axis, and Z-axis in the three-dimensional coordinates, respectively. The reachability score of the grid point corresponding to the starting point is determined using the following formula:

[0045] Let represent the reachability score of the grid point corresponding to the starting point, the coordinates of the grid point in the kth path are

[0046] This score directly reflects the difficulty of reaching the target point from this point, providing a reference for determining the optimal obstacle placement.

[0047] S5, constructing a multi-objective optimization model based on the reachability score, optimizing the multi-objective optimization model, and obtaining the optimal obstacle set.

[0048] The goal of this solution is to determine an optimal obstacle set in a three-dimensional grid Each obstacle is defined by a center point and an influence radius The grid nodes within its influence area will be considered as impassable. Deploying obstacles aims to cover critical nodes, i.e. those with reachability scores exceeding a certain threshold The core problem is to ensure effective coverage of high reachability score areas while minimizing the number of obstacles m and their influence radius r, thereby efficiently hindering the robot's grasping planning.

[0049] The multi-objective optimization model is as follows:

[0050] For the multi-objective optimization model, O represents the position of the obstacle, represents the interference effect value of the obstacle O on the grasping path, represents the economic cost of deploying the obstacle O, which is related to the number and volume of the obstacle, and aims to maximize economic benefits, represents the risk value of the obstacle O being perceived, which quantifies the risk of the obstacle being perceived due to its size and quantity.

[0051] Preferably, The calculation process of is as follows: Obtain the reachable score Scr1 of the grid point corresponding to the starting point before setting the obstacle O; Obtain the reachable score Scr2 of the grid point corresponding to the starting point after setting the obstacle O; Subtract Scr2 from Scr1 to obtain the interference effect value.

[0052] Further embodiments are as follows: Step one: robot reachable area path preference modeling and heat map generation 1. Simulation data acquisition 1.1 Simulation environment setup: We use the Robot Operating System (ROS, version: Noetic) and the physical simulation engine Gazebo (version: 11) for simulation. In Gazebo, we construct a three-dimensional workspace with dimensions 1.0mx1.0mx0.8m.

[0053] 1.2 Robot and task setting: The UniversalRobots UR5e six-axis collaborative robot model is used. The "home" pose of the robot is set as the starting state, and the end effector is located in the left area of the workspace. A 10cmx10cm flat area on the right side of the workspace is set as the target area, and the robot needs to move the end effector to any point in this area.

[0054] 1.3 Simulation execution: To simulate the complexity and uncertainty of the real-world environment, 3-5 spherical background obstacles with radii of 1-3 cm were randomly generated in the workspace before each simulation, avoiding the starting and target areas. We used the MoveIt! motion planning framework from ROS and employed the RRT* (Optimal Fast Expanding Random Tree) algorithm for path planning. We performed N=5000 independent grasping simulations. For each successful planning (i.e., finding a collision-free path), we recorded the complete path point sequence of its end effector in Cartesian space. .

[0055] 2. Generation of 3D Heatmap 2.1 Data Aggregation: The data set of all successful paths collected (4500 successful paths) Perform aggregation.

[0056] 2.2 Heatmap Calculation: We discretized the entire 1.0m x 1.0m x 0.8m workspace into a 3D voxel mesh with a resolution of 1cm and dimensions of 100x100x80. We used kernel density estimation to generate heatmaps. Specifically, a Gaussian kernel function was applied centered on each path point. The Gaussian distributions generated for all path points were superimposed on the mesh to obtain the heat value H(p) for each voxel p=(x,y,z). The heat value H(p) intuitively represents the frequency or total dwell time of all successful paths passing through the area near that point. Areas with high heat values ​​indicate that the area is a "must-pass" or frequently used area for the robot to successfully complete the task.

[0057] Step 2: Target reachability prediction based on discretized heatmaps 3D mesh diagram The generated 100x100x80 heatmap is itself a three-dimensional mesh map. Each grid point The heat value calculated in the previous step is stored.

[0058] 2. Accessibility Score Calculation Based on this heat map Calculate the reachability score from each grid point to the target region τ. This score is designed to measure progress from a given point. Starting from the target region, how confident are we of successfully reaching it? We employ a backpropagation algorithm similar to Dijkstra's. First, we initialize the reachability scores of all grid points within the target region τ to their maximum values. Then, we iteratively calculate the reachability scores of all other grid points outwards from the target region. For any given grid point... Its accessibility score is determined by equation (1), i.e., among all possible paths from this point to the target region, we choose a path such that the minimum value of the heat value on this path is maximized. In a colloquial sense, reflects the "bottleneck width" of the "widest path" from this point to the target region. A high value means that there is at least one path on which all points have a higher heat value, so the robustness of reaching the target from this point is strong and the difficulty is low.

[0059] Step three: optimal obstacle position solving Problem definition and objectives Objective: In the candidate nodes with accessibility scores higher than a certain threshold, select to place m=3 spherical obstacles, whose radius r can be selected from {2cm, 3cm, 5cm}. Constraints and trade-offs: The goal is to maximize the hindering effect while minimizing the cost (number and volume) of deploying obstacles and the risk of being detected (size and number).

[0060] 2. Multi-objective optimization model

[0061] Weight setting: According to the priority of the task, we set the weights as , , , indicating that we are most concerned about the hindering effect. Objective function specific quantification:

[0062] (Interference effect): defined as the amount of decrease in the maximum accessibility score from the starting point set S to the target region after placing obstacles .

[0063] (Economic cost): defined as a linear function related to the number and volume of obstacles. As follows: . Where, , and are cost coefficients. (Risk of being detected): defined as a function related to the number and surface area of obstacles, because a larger surface area is more likely to be visually detected. . Where, and are risk coefficients.

[0064] Solution: ​This is a complex combinatorial optimization problem. We adopt Genetic Algorithm (GA) to solve it. Encoding: Each "individual" (chromosome) represents an obstacle deployment scheme, encoding the center coordinates and radius r of 3 obstacles Fitness function: Directly use the objective function we defined Evolutionary operations: Through selection, crossover and mutation operations, iteratively generate new deployment schemes (offspring), and keep the schemes with high fitness. Termination condition: The algorithm terminates after running for 200 generations or the fitness value does not improve significantly for 50 consecutive generations.

[0065] The key points of the invention are as follows: Key point one: modeling method of robot path preference based on historical data and simulation.

[0066] Comparison with prior art: Prior art relies on human intuitive observation, while the invention collects data through large-scale simulation and generates a quantitative three-dimensional path preference heat map. Technical means difference: The core difference lies in the transition from qualitative observation to quantitative modeling. The invention first proposes a method to systematically explicit the implicit path selection preference of robots, and data. This heat map is the basis for all subsequent intelligent decision-making, and is one of the key technologies to be protected.

[0067] Key point two: accessibility score quantification method based on "bottleneck" concept.

[0068] Comparison with prior art: Prior art has no such concept. The invention goes beyond identifying "hot spots" and identifies the "throat" of the path through the defined accessibility score. Technical means difference: The core difference lies in the in-depth analysis from "point density" analysis to "path smoothness" analysis. Even if the heat of a region is not the highest, if it is the only way through multiple high-score paths (bottleneck), its strategic value is extremely high. The accessibility score and its calculation method are another key technology to be protected.

[0069] Key point three: multi-objective optimization obstacle setting strategy integrating interference, cost and risk.

[0070] Comparison with prior art: Prior art is simple physical placement, only considering "whether it can block". The invention constructs the obstacle setting problem as a solvable, constrained multi-objective optimization problem. Technical means difference: The core difference lies in the upgrade from "physical execution" to "strategic decision". Obstacle setting is regarded as an intelligent game process, and the optimal strategy is solved through mathematical optimization, making the attack behavior itself intelligent, economical and concealed. The multi-objective optimization model and its solution framework are the third key technology to be protected.

[0071] The preferred embodiments of the application disclosed above are only to facilitate the elucidation of the application. The preferred embodiments do not describe all the details of the application and limit the application to the specific embodiments described. Obviously, many modifications and variations can be made in light of the teachings above. The description is chosen and described in order to best explain the principles of the application and its practical application to thereby enable others skilled in the art to best utilize the application and get the best results from the application. The application is only limited by the claims and their full scope and equivalents.

Claims

1. A method for adversarial attacks on robotic arm grasping planning based on spatial obstacle removal, characterized in that, include: S1, perform multiple grasping simulations on the robot and record the path sequence of the end effector during each execution; S2, Generate a 3D heatmap that can characterize the robot's path preferences based on the path sequence; S3 discretizes the three-dimensional heatmap into a three-dimensional mesh; S4, calculate the reachability score from each grid point to the target grid point based on the three-dimensional grid; S5: Construct a multi-objective optimization model based on the reachability score, optimize the multi-objective optimization model, and obtain the optimal obstacle set.

2. The method for adversarial attacks on robotic arm grasping planning based on spatial obstacle removal as described in claim 1, characterized in that, S1 includes: S10 utilizes a robot operating system and a physical simulation engine to build a high-fidelity robot working environment model; S11, In the robot working environment model, set the robot's grasping task; S12, randomly introduce background obstacles into the workspace; S13, run N independent grasping simulations based on the grasping task, and record the end effector path sequence that is successfully planned and executed each time, where N is a preset integer.

3. The method for adversarial attacks on robotic arm grasping planning based on spatial obstacle removal as described in claim 2, characterized in that, The robot operating system includes ROS, and the physics simulation engine includes Gazebo.

4. The method for adversarial attacks on robotic arm grasping planning based on spatial obstacle removal as described in claim 2, characterized in that, The grabbing task involves moving the end effector from the starting point to the target area.

5. The method for adversarial attacks on robotic arm grasping planning based on spatial obstacle removal as described in claim 1, characterized in that, S2 include: By employing data analysis and advanced visualization techniques, all collected path sequences are aggregated to generate a three-dimensional heatmap that can characterize the robot's path preferences.

6. The method for adversarial attacks on robotic arm grasping planning based on spatial obstacle removal as described in claim 2, characterized in that, S4 include: use This represents the coordinates of the grid point corresponding to the starting point. It enumerates all paths from the starting point to the target grid point, where x, y, and z are the coordinates of the X-axis, Y-axis, and Z-axis in three-dimensional coordinates, respectively. The reachable score of the grid point corresponding to the starting point is determined using the following formula: This represents the reachable score of the grid point corresponding to the starting point. Represents the k-th path The coordinates in are The thermal values ​​of the grid points, where K represents the total number of paths.

7. The method for adversarial attacks on robotic arm grasping planning based on spatial obstacle removal as described in claim 2, characterized in that, Constructing multi-objective optimization models based on reachability scores includes: The multi-objective optimization model is as follows: This is a multi-objective optimization model, where O represents the position of the obstacle. This represents the interference effect of obstacle O on the grasping path. This represents the economic cost of deploying obstacle O. This indicates the risk value at which obstacle O is detected.

8. The method for adversarial attacks on robotic arm grasping planning based on spatial obstacle removal as described in claim 7, characterized in that, The calculation process is as follows: Before setting obstacle O, obtain the reachable score Scr1 of the grid point corresponding to the starting point; After setting obstacle O, obtain the reachable score Scr2 of the grid point corresponding to the starting point; Subtracting Scr2 from Scr1 yields the interference effect value.

Images