An adaptive block black box model security simulation test method for radio signals

Abstract

This invention discloses an adaptive block black-box model security simulation testing method for radio signals, belonging to the interdisciplinary field of communication signal processing and artificial intelligence. Addressing the problems of low query efficiency, poor perturbation concealment, and insufficient attack success rate in existing black-box model security simulation testing methods, this invention generates small perturbations during the detection phase to construct or update a sensitivity map. During the main attack iteration, it dynamically adjusts the exploration and exploitation probabilities and generates candidate perturbations based on the sensitivity map and a list of historical successful patches. It then batch queries the target black-box model to obtain loss values ​​and updates the best adversarial sample and the list of successful patches. Finally, it determines the success or failure of the attack to terminate the iteration. This method significantly improves query efficiency, attack success rate, and perturbation concealment. It is mainly used for black-box model security simulation testing of deep learning classification models for radio signals to reveal model vulnerabilities and provide support for building robust intelligent communication systems.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary fields of communication signal processing and artificial intelligence, and particularly relates to an adaptive block black box model security simulation test method for radio signals. Background Technology

[0002] In the context of rapid development in information technology, deep learning models have made significant progress in the field of communication signal processing, especially in tasks such as signal classification and modulation recognition. However, with the widespread application of deep learning models, issues regarding their security and robustness have become increasingly prominent. Adversarial attacks can effectively reveal the vulnerability of models, causing trained classifiers to make incorrect predictions by applying small, imperceptible perturbations to the original input signal. This vulnerability can lead to serious security risks in critical communication systems, such as misidentifying signal types and interfering with communication links.

[0003] Pioneer work on adversarial attacks began with research on image classifiers, revealing the vulnerability of neural networks. Most existing methods generate perturbation images imperceptible to the human eye as adversarial examples, aiming to deceive trained classifiers. For example, Fast Gradient Descent is widely used, but its constraints need to be manually set and it performs poorly with nonlinear decision functions. The C&W attack proposed by Carlini and Wagner is powerful, but its drawbacks include long runtime and overly cautious step-by-step execution. In recent years, adversarial attacks against black-box models have attracted widespread attention. Classic black-box model security simulation testing methods, such as the block attack, demonstrate high query efficiency by adding perturbations to randomly selected regions and iteratively optimizing based on model feedback. However, traditional block attacks still have room for improvement when facing complex signals and pursuing smaller perturbations. Other black-box model security simulation testing methods, such as Bandits-based attacks or SignHunter attacks, while competitive in certain scenarios, still need improvement in query efficiency and attack success rate.

[0004] In specific radio signal classification applications, existing black-box model security simulation testing methods suffer from the following problems and shortcomings: First, query efficiency is low, making it difficult to generate effective adversarial examples within a limited number of queries, directly impacting the practicality of attacks and the efficiency of model security assessment. Second, the generated perturbations are often large, which can easily become too obvious and compromise stealth in applications like radio signals, which are sensitive to subtle changes. Third, existing methods rely on relatively fixed search strategies and lack intelligent exploration mechanisms, making them prone to getting trapped in local optima and affecting attack success rates. Especially when dealing with radio signals with continuous and complex structures, how to more intelligently utilize historical information and explore unexplored areas becomes a key challenge in improving attack efficiency and stealth. These problems render existing methods ineffective in real-world radio signal environments, failing to meet the need for comprehensive security assessment of deep learning models. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention proposes an adaptive block black-box model security simulation test method for radio signals, thereby resolving the issues present in the prior art.

[0006] Firstly, to achieve the above objectives, the present invention provides a security simulation and testing method for an adaptive block black-box model of radio signals, comprising the following steps:

[0007] S1. Execute the detection phase, generate multiple small perturbations and input them into the target black box model for querying, in order to build or update the sensitivity map;

[0008] S2. Enter the main attack iteration, dynamically adjust the exploration and utilization probability, and generate multiple candidate perturbations based on the sensitivity map and the list of historical successful patches;

[0009] S3. Input the candidate perturbations into the target black-box model in batches for querying, obtain the loss value, and update the list of best adversarial samples and successful patches;

[0010] S4. Determine if the attack was successful. If successful, return the adversarial sample. Otherwise, repeat S2 to S3 until the maximum number of queries is reached.

[0011] Optionally, the process of performing the probing phase includes:

[0012] Randomly select the center position and patch length, wherein the patch length is calculated based on the initial perturbation feature percentage;

[0013] Generate perturbation values ​​within the selected area, where the perturbation values ​​are the maximum perturbation value multiplied by a scaling factor and then multiplied by a random positive or negative sign;

[0014] The perturbation is added to the original signal to form a probe sample;

[0015] Batch query the target model to obtain the loss value;

[0016] The sensitivity map is updated based on the change in loss, which is calculated based on the difference between the current best loss and the loss of the probe sample, and an attenuation factor is applied to reduce historical sensitivity information.

[0017] Optionally, in S2, the process of dynamically adjusting the exploration and utilization probabilities includes:

[0018] Adjust the utilization probability based on whether the attack stalls; if it stalls, reduce the utilization probability to encourage exploration.

[0019] Obtain the percentage of the basic perturbation feature from the preset decay timetable;

[0020] Increase the percentage of perturbation features in exploration mode;

[0021] Based on the probability of selecting the center location of the perturbation patch, when the probability is high, the center is selected from the list of historical successful patches and a random offset is applied; when the probability is low, the center is selected by weighted sampling based on the sensitivity map or by random selection.

[0022] Optionally, in S2, the process of generating multiple candidate perturbations includes:

[0023] The length of the perturbation patch is calculated based on the percentage of perturbation features and the total number of signal features;

[0024] Add random positive and negative sign perturbations within a selected center location and patch length area;

[0025] Add perturbations to the current best adversarial sample to form transitional adversarial samples;

[0026] The transitional adversarial examples are projected onto a preset perturbation range and then cropped with the original examples as the center.

[0027] Optionally, in S3, the process of batch querying and updating status includes:

[0028] Input candidate adversarial examples in batches into the target model to obtain the output vector;

[0029] Calculate the marginal loss value for each sample, which is the difference between the true class score and the highest score of the other class;

[0030] Select the sample with the minimum loss as the new best adversarial sample;

[0031] Update the total number of queries and add information on patches that successfully reduced losses to the list of historical successful patches.

[0032] Optionally, in S4, the process of determining whether the attack was successful includes:

[0033] Check whether the predicted class of the candidate adversarial example is inconsistent with the true class;

[0034] If the predicted category is inconsistent with the true category, the attack is successful and the corresponding adversarial sample is returned.

[0035] If unsuccessful and the total number of queries has not reached the maximum number of queries, repeat steps S2 to S3.

[0036] If the maximum number of queries is reached and the query still fails, the current best adversarial sample is returned.

[0037] Secondly, the present invention also provides an adaptive block black-box model security simulation and testing system for radio signals, used to implement an adaptive block black-box model security simulation and testing method for radio signals, the system comprising:

[0038] The detection module is used to perform the detection phase, generate multiple small perturbations and input them into the target black box model for querying, so as to build or update the sensitivity map;

[0039] The main attack iteration module is used to dynamically adjust the exploration and exploitation probabilities and generate multiple candidate perturbations based on the sensitivity map and the list of historical successful patches;

[0040] The batch query module is used to input the candidate perturbations into the target black-box model in batches for querying, obtain the loss value, and update the list of best adversarial examples and successful patches;

[0041] The attack judgment module is used to determine whether the attack is successful. If successful, it returns an adversarial sample; otherwise, it triggers the main attack iteration module and the batch query module to repeat until the maximum number of queries is reached.

[0042] Thirdly, the present invention also provides a computer terminal device, comprising:

[0043] One or more processors;

[0044] A memory, coupled to the processor, for storing one or more programs;

[0045] When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the adaptive block black box model security simulation test method for radio signals in the first aspect described above.

[0046] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the adaptive block black box model security simulation test method for radio signals described in the first aspect above.

[0047] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the adaptive block black box model security simulation test method for radio signals described in the first aspect above.

[0048] Compared with the prior art, the present invention has the following advantages and technical effects:

[0049] This invention provides a security simulation and testing method for an adaptive block black-box model for radio signals. The method significantly improves attack query efficiency by introducing an internal query batch processing mechanism to achieve parallel evaluation of multiple candidate perturbations. It employs an uncertainty-guided adaptive patch generation strategy, including a detection phase and location selection based on a sensitivity map, to intelligently locate key perturbation areas and reduce invalid perturbations. It dynamically adjusts the exploration and exploitation probabilities and perturbation patch size, enhancing exploration capabilities when the attack stalls, effectively avoiding local optima, and improving attack robustness and success rate. Targeting the characteristics of radio signal data, it effectively attacks deep learning classifiers under a black-box setting, verifying model vulnerability. Through intelligent perturbation area selection and search optimization, it achieves attacks with smaller perturbation amplitudes, enhancing the concealment of adversarial examples. Attached Figure Description

[0050] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0051] Figure 1 This is a flowchart of the security simulation test method for an adaptive block black box model for radio signals according to an embodiment of the present invention. Detailed Implementation

[0052] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0053] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0054] Example 1

[0055] The purpose and application scenarios of this invention are described here:

[0056] The adaptive block black-box model security simulation testing method involved in this invention is strictly limited to the robustness testing and security assessment of artificial intelligence models (especially deep learning-based radio signal classifiers) in all practical application scenarios. It is important to emphasize that this invention is not a malicious attack tool for real-world communication systems, but rather an internal testing technique for improving model stability in a controlled environment. Specific application scenarios are described as follows: This invention is primarily intended for model developers, security evaluation agencies, or internal system testing teams to simulate potential attack behaviors to discover model vulnerabilities before model deployment or during continuous optimization. Its function is similar to penetration testing or vulnerability scanning in the field of cybersecurity, with the core objective of "offense-driven defense"—actively discovering and fixing vulnerabilities to enhance the model's ability to resist real threats and ensure the security and reliability of the final application system.

[0057] Additionally, the data objects are also explained:

[0058] The data objects processed in the implementation of this invention are explicitly limited to the following two categories:

[0059] (1) Public, non-confidential radio signal benchmark datasets: open-source datasets widely used in academic research and industry for modulation identification or signal classification, such as internationally recognized benchmark datasets, classic public datasets released by DeepSig such as RML2016.10a / RML2016.10b, DeepSig datasets (such as RadioML 2018.01), etc.

[0060] (2) Internal simulation data specifically for model training and testing: This data is generated and used only in a closed R&D or testing environment and is completely isolated from the real operational network environment.

[0061] The above limitations ensure that all operations of the method of the present invention are performed offline, at a non-real-time data level, and will not and are not intended to touch or affect any real radio communication links or user data.

[0062] Furthermore, the "attack" mentioned below is merely an interaction method in the black-box model security simulation test, and is not an attack behavior of hackers, but only a means of security simulation test.

[0063] like Figure 1 As shown, this embodiment provides a security simulation test method for an adaptive block black-box model of radio signals, including:

[0064] S1. Execute the detection phase, generate multiple small perturbations and input them into the target black box model for querying, in order to build or update the sensitivity map;

[0065] S2. Enter the main attack iteration, dynamically adjust the exploration and utilization probability, and generate multiple candidate perturbations based on the sensitivity map and the list of historical successful patches;

[0066] S3. Input the candidate perturbations into the target black-box model in batches for querying, obtain the loss value, and update the list of best adversarial samples and successful patches;

[0067] S4. Determine if the attack was successful. If successful, return the adversarial sample. Otherwise, repeat S2 to S3 until the maximum number of queries is reached.

[0068] Specifically, the above plan includes the following detailed process:

[0069] S1: Given a dataset, obtain a black-box model capable of classifying signals from the network or by training it yourself; first, perform a probing phase on the dataset to generate and evaluate a small number of minor perturbations to initially build or update the sensitivity map;

[0070] S2: During the main attack iteration, the system adaptively adjusts its exploration and exploitation strategies based on the attack progress, preset decay schedule, and attack stagnation: dynamically adjusting the probability of searching using historically successful locations, increasing the exploration tendency when stagnant, and adjusting the feature percentage of the current perturbation patch. Subsequently, these transitional adversarial examples are projected into a preset perturbation range while being cropped back to the original data range;

[0071] S3: Will Each transitional adversarial sample is input into the target black-box classification model in batches for querying, and its classification result and loss value are obtained and included in the total number of queries; the information of the successful perturbation patch (center position and length) is added to the list of historical successful patches;

[0072] S4: Determine whether the current adversarial sample has successfully deceived the target model; if the attack is successful, return the current adversarial sample and the total number of queries; otherwise, determine whether the total number of queries has reached the maximum number of queries. If the target is not reached, repeat steps S2-S3; if the target is reached, return the current best adversarial sample and the total number of queries, and the attack ends.

[0073] As one implementation method in this embodiment, the process of performing the detection phase includes:

[0074] Randomly select the center position and patch length, wherein the patch length is calculated based on the initial perturbation feature percentage;

[0075] Generate perturbation values ​​within the selected area, where the perturbation values ​​are the maximum perturbation value multiplied by a scaling factor and then multiplied by a random positive or negative sign;

[0076] The perturbation is added to the original signal to form a probe sample;

[0077] Batch query the target model to obtain the loss value;

[0078] The sensitivity map is updated based on the change in loss, which is calculated based on the difference between the current best loss and the loss of the probe sample, and an attenuation factor is applied to reduce historical sensitivity information.

[0079] Specifically, the above process includes the following details:

[0080] Furthermore, in the detection phase of step S1, the algorithm does not segment the entire signal, but instead "places" a patch of a specific length at any location on the signal and perturbs this patch region. In this way, by moving the center position of the patch and changing its length, any continuous sub-region of the signal can be covered. The first stage involves generating and evaluating a small number of minor perturbations to initially construct or update the sensitivity map, and this is included in the total number of queries. The sensitivity map is a tensor with the same length as the signal sequence, initialized to all zeros, used to record the sensitivity of different regions of the signal to the model loss. The list storing historically successful perturbation patch information records the center position and length of perturbation patches that successfully reduced the model loss, serving as a reference for future perturbation generation.

[0081] The generation of small perturbations is as follows: For each detected perturbation, a center position is randomly selected, and the length of the perturbation patch is set to a percentage of the initial perturbation feature. The corresponding smaller proportion of the area. Within the selected area, the perturbation value is set to:

[0082] (1)

[0083] in, The maximum disturbance value is set. This represents a scaling factor for the detection perturbation, which is then multiplied by a random positive or negative sign. These perturbations are then added to the current adversarial example, forming... One detection sample.

[0084] After evaluating the probe samples, the value of the corresponding region on the existing sensitivity map is decayed based on the change in loss for each probe sample, and a new change in loss is added to update the sensitivity map. The update formula for the sensitivity map is as follows:

[0085] (2)

[0086] In the above formula, Is the sensitivity map in location? The updated value, Is the sensitivity map in location? The old value (i.e., the value before the update). It is the decay factor of the sensitivity map, a constant between 0 and 1. It ensures that older sensitivity information gradually weakens over time, making the map biased towards more recent observations and reflecting real-time performance. The optimal (minimum) loss value during the entire attack process before the current batch of probes begins. It is the first One detected disturbance sample The corresponding C&W marginal loss value. It is a very small positive number used to prevent the sensitivity value from being zero, thereby ensuring that there is a probability of being selected during sampling and avoiding certain locations from never being explored.

[0087] During sensitivity map updates: if the loss of the updated probe samples is smaller than the current best loss, it means that the probe perturbation makes the model more susceptible to deception. It will be a positive value. Positive. This will increase the value of the corresponding location on the sensitivity map, indicating that the area has a positive impact on reducing losses (i.e., attack success). If the loss of the probe sample is greater than the current optimal loss, it means that the probe perturbation worsens the attack effect. This will be a negative value. Therefore, the sensitivity map measures the sensitivity of different regions of the signal to the model loss by changing the C&W marginal loss, thereby guiding the subsequent generation of perturbations.

[0088] The loss function used for the "change in loss" mentioned in the sensitivity map update is the C&W type marginal loss. Specifically, its calculation formula is:

[0089] (3)

[0090] in, It is the model's response to the input of Output vector, Is it a real category? corresponding value; It is the highest among all categories except the True category. The loss function measures the model's confidence in the true class relative to the highest confidence in all other classes, representing a "margin of safety." The goal is to minimize this loss value. Ideally, we want it to be negative, and the larger the negative value, the better. This means the score for the true class is significantly lower than the score for a misclassified class, thus achieving misclassification.

[0091] As one implementation method in this embodiment, in S2, the process of dynamically adjusting the exploration and utilization probabilities includes:

[0092] Adjust the utilization probability based on whether the attack stalls; if it stalls, reduce the utilization probability to encourage exploration.

[0093] Obtain the percentage of the basic perturbation feature from the preset decay timetable;

[0094] Increase the percentage of perturbation features in exploration mode;

[0095] Based on the probability of selecting the center location of the perturbation patch, when the probability is high, the center is selected from the list of historical successful patches and a random offset is applied; when the probability is low, the center is selected by weighted sampling based on the sensitivity map or by random selection.

[0096] As one implementation method in this embodiment, in S2, the process of generating multiple candidate perturbations includes:

[0097] The length of the perturbation patch is calculated based on the percentage of perturbation features and the total number of signal features;

[0098] Add random positive and negative sign perturbations within a selected center location and patch length area;

[0099] Add perturbations to the current best adversarial sample to form transitional adversarial samples;

[0100] The transitional adversarial examples are projected onto a preset perturbation range and then cropped with the original examples as the center.

[0101] In step S2, the strategy for dynamically adjusting the exploration and exploitation is as follows: the percentage of features of the perturbation patch. It is a decay timetable related to the preset number of queries. Obtain the base value corresponding to the current iteration from the given information. Utilize probability. Dynamic adjustment, based on the number of queries since the last optimal loss update (by...). If the batch calculation exceeds the set limit, the current utilization probability will be... Set as To encourage exploration; otherwise, continue to utilize probability. Unchanged. If currently in exploration mode (i.e. If the current perturbation patch's characteristic percentage is then calculated, then... Increase moderately (e.g.) This is intended to further encourage exploration and moving beyond local optima.

[0102] The adaptive selection of the perturbation patch center location is as follows:

[0103] by The probability of entering the utilization phase is prioritized. The center of a successful patch is randomly selected from the list of successful patches as the anchor point, and a new center position is generated by randomly shifting around it. If the list of successful patches is empty or has a low probability, weighted sampling is performed according to the probability distribution of the sensitivity map, and a region with higher sensitivity is selected as the center position.

[0104] by The probability of entering the exploration phase is [not specified], in which a center location is randomly selected. The length of the perturbation patch [is not specified]. Iterated from the current batch Values ​​and total signal characteristics Joint decision:

[0105] (4)

[0106] The projection and pruning of transitional adversarial examples are detailed below, projecting onto... Disturbance range:

[0107] (5)

[0108] in, Indicates the process Adversarial examples after projection It is the original sample. It is the best adversarial example currently available. It is a newly generated disturbance. It is the maximum perturbation norm bound.

[0109] As one implementation method in this embodiment, in S3, the process of batch querying and updating the status includes:

[0110] Input candidate adversarial examples in batches into the target model to obtain the output vector;

[0111] Calculate the marginal loss value for each sample, which is the difference between the true class score and the highest score of the other class;

[0112] Select the sample with the minimum loss as the new best adversarial sample;

[0113] Update the total number of queries and add information on patches that successfully reduced losses to the list of historical successful patches.

[0114] Specifically, the above process includes the following details:

[0115] Furthermore, in step S3, the generated and projected data will be... A batch of transitional adversarial examples are input into the target black-box classification model to obtain the model's classification results and loss values ​​for them. Target model queries are then performed using... The type of boundary loss is used to evaluate the effectiveness of adversarial examples. This loss is defined as the difference between the target's true class score and the highest score of all other classes, and its loss formula is Equation (3).

[0116] Received A batch consists of processed transitional adversarial examples. The L-infinity norm constraints for the generated adversarial examples are as follows:

[0117] (6)

[0118] in, This represents the original input data. This represents a slightly modified input data, namely the "transitional adversarial example" mentioned above. It is a small positive real number representing the maximum allowed perturbation budget or maximum perturbation magnitude. It sets the threshold between the adversarial example and the original example. The upper bound of the norm distance. The smaller the value, the more similar the adversarial sample looks to the original sample, and the less obvious the perturbation is.

[0119] The entire batch As input, it is fed into the target black-box classification model. Because this is a black-box model security simulation test, attackers cannot access the model's internal structure or gradient information; they can only obtain the model's output through queries. The model responds to each input... Return a vector: , where N is the number of categories.

[0120] Total query count update formula:

[0121] (7)

[0122] in, This represents the total number of queries to date. This is the number of samples in this batch query, which will be included in the total number of queries for the current sample.

[0123] Based on previously obtained The loss values ​​of each candidate adversarial sample are calculated, and the sample with the smallest loss value is selected as the new current best adversarial sample. The relevant attack state information is then updated. The formula for minimum loss within a batch is:

[0124] (8)

[0125] in, It is the first one calculated in this step. The C&W marginal loss for each sample. The minimum loss for the current batch. Compare with the best loss recorded globally in the current iteration.

[0126] As one implementation method in this embodiment, in S4, the process of determining whether the attack was successful includes:

[0127] Check whether the predicted class of the candidate adversarial example is inconsistent with the true class;

[0128] If the predicted category is inconsistent with the true category, the attack is successful and the corresponding adversarial sample is returned.

[0129] If unsuccessful and the total number of queries has not reached the maximum number of queries, repeat steps S2 to S3.

[0130] If the maximum number of queries is reached and the query still fails, the current best adversarial sample is returned.

[0131] Specifically, the above process includes the following details:

[0132] The final step, in step S4, involves determining whether the attack was successful and deciding whether to continue iterating. After evaluating a batch... After considering several candidate adversarial examples, the algorithm determines whether the attack has successfully deceived the target model. Based on the attack result and the total number of queries consumed, it decides whether to immediately end the attack and return the result, or continue to the next iteration to find a more effective adversarial perturbation. The algorithm first checks the current batch... In each of the transitional adversarial examples, has any one successfully fooled the target model? This is achieved by comparing the model's prediction for each example with the original true label.

[0133] Prediction Category By taking The index corresponding to the maximum value in the middle is obtained as follows:

[0134] (9)

[0135] in, For the target model, given a transitional adversarial example (in This is the current batch. (a transitional adversarial example), model output. for .

[0136] If a transitional adversarial sample satisfying the attack success criteria is found in this batch, the attack will immediately stop. If no sample in the current batch successfully deceives the model, the algorithm will check whether the current cumulative number of queries has reached the preset maximum query limit. If no sample in the current batch successfully deceives the model, and the total number of queries has reached or exceeded the maximum query limit, i.e.: Then the attack ends.

[0137] In this invention, the criterion for determining a successful attack is that the target black-box model's predicted category for the adversarial sample is inconsistent with the true category of the original sample.

[0138] The method of this invention will be systematically and clearly described below with reference to the above-mentioned figures and taking a radio signal classification dataset as an example.

[0139] This example demonstrates how to use a ResNet56 deep neural network for signal classification on the given dataset RML2016.10a. The RML2016.10a dataset contains 11 modulation categories: 8BPSK, QPSK, 8PSK, 16QAM, 64QAM, BFSK, CPFSK, and PAM4, as well as 3 analog modulations: WB-FM, AM-SSB, and AM-DSB. Each sample is IQ dual-channel data, and the modulation categories are uniformly distributed within the range of -20dB to 18dB. The ResNet56 network structure consists of 28 blocks, each with 2 convolutional layers, resulting in 56 convolutional layers and one fully connected layer.

[0140] Reference Figure 1 An adaptive block black-box model security simulation test method for radio signals includes the following steps:

[0141] S1: Perform the detection phase, generating and evaluating minor perturbations to initially construct or update the sensitivity map. If Then it enters the detection phase. In this phase, [the following is generated]. A tiny perturbation, the patch acts on a randomly selected center location, the length of which is... Set to a small, fixed value (e.g., initial). area The square root of the sample (the perturbation direction is randomly positive or negative). These perturbations are then superimposed onto the clean sample. Above, a batch of detection samples were formed. And trim it to the allowable range of the detected disturbance.

[0142] Batch query model to obtain loss value The sensitivity map is updated based on the change in loss caused by each detection perturbation, ensuring its real-time performance and non-negativity. (Number of detection queries) The total number of queries is counted. If a sample is successfully attacked during the probing phase, the successful sample is returned immediately.

[0143] S2: Enter the main attack iteration loop, adaptively adjust the exploration and exploitation strategy, and generate... One candidate perturbation. The main loop iterates with a step size until the set number of queries is reached. At the start of each iteration, adjustments are made dynamically based on the attack stall status. If since the last time If the number of queries since the update exceeds the set number of queries, then... Reduce to To encourage exploration; otherwise, remain as .

[0144] Next, from the preset Obtain the percentage of the basic perturbation features corresponding to the current iteration. If currently in exploration mode, then... Increase the size appropriately to further enhance exploration capabilities. Disturbance patch length according to Total characteristic number calculate.

[0145] Then, for each disturbance, an adaptive strategy is adopted for center location selection: based on the current... The probability is determined using historical information: if the successful patch list is not empty and the sensitivity map has no valid information or a probability below 0.5, then a center is randomly selected from the successful patches as the anchor point and a small offset is made; otherwise, it is determined based on its... Weighted sampling is performed using a probability distribution, selecting locations with higher sensitivity. The exploration is conducted using probability, i.e., the center position is selected purely randomly. Perturbation Add within the selected area Random positive and negative signs within the norm. These... Add to Above, forming .

[0146] S3: Will A batch of transitional adversarial samples are input into the target black-box classification model for querying. Each sample in the process is processed through projection and cropping operations:

[0147] first, Projected onto Centered on, with radius of Within the sphere; then, further cropping to the original data range. Next, these processed... They are input into the target model in batches, through function to get its Output. Corresponding query count. Included .

[0148] Based on the query results, select the best adversarial example and update the relevant information. For batch queries... Calculate the C&W loss for each candidate sample. .pass Find the sample with the minimum loss and its index. If the found sample Smaller than the current Then update and At the same time, the patch information that successfully reduced the loss (patch center location and...) will be included. Add it to the list of successful patches, and ensure that the list length does not exceed the preset limit.

[0149] S4: Determine if the attack was successful and decide whether to continue iterating. After evaluating a batch... After selecting a batch of candidate samples, check if any of them successfully fooled the model. If a sample is found to have been successfully attacked, that successful sample is immediately returned. The attack ends once the corresponding number of queries is recorded.

[0150] If no attack is successful in the current iteration, and the total number of queries... Not yet reached Then, the loop continues executing steps S2-S3. Once the maximum number of queries is reached... If the attack still fails, the best adversarial sample will be returned. and total number of queries .

[0151] The final results of this embodiment are measured by attack success rate, average number of queries, and average perturbation norm to comprehensively evaluate the effectiveness and efficiency of the proposed method.

[0152] The adaptive block black-box model security simulation test method for radio signals in this embodiment significantly improves attack efficiency and success rate compared with most current black-box model security simulation test methods by introducing batch query, uncertainty-guided sensitivity map and dynamic exploration and exploitation strategy. At the same time, it can generate more covert and effective adversarial samples within a limited number of queries.

[0153] Based on this, the present invention provides an adaptive block black-box model security simulation test method for radio signals. All operations of the present invention are performed offline, at the non-real-time data level, and do not and are not intended to touch or affect any real radio communication links or user data. The present invention is only for the robustness testing and security assessment of artificial intelligence models. Furthermore, when using publicly available, non-confidential radio signal benchmark datasets and internal simulation data specifically used for model training and testing, the beneficial effects are as follows:

[0154] 1. Significantly improve query efficiency: By introducing an internal query batch size and probe query batch size It can evaluate multiple candidate perturbations in parallel, which greatly reduces the total number of queries required to achieve a successful attack, thereby significantly improving attack efficiency.

[0155] 2. Adaptive and Intelligent Perturbation Generation: An uncertainty-guided adaptive patch generation mechanism is introduced. The probing phase can initially identify sensitive areas. The combination of a sensitivity map and a list of historical successful patches allows new perturbations to be more intelligently concentrated in areas that have the greatest impact on the model's classification results, reducing invalid perturbations.

[0156] 3. Dynamic equilibrium exploration and utilization: through adaptive adjustment (Probability of using historical information) and perturbation patch size (Increase exploration when the attack stalls) This method can effectively avoid getting trapped in local optima, thus improving the robustness and success rate of the attack.

[0157] 4. Applicable to black-box radio signals: Targeting the characteristics of publicly available, non-confidential radio signal benchmark datasets and internally simulated radio signal data specifically used for model training and testing, this method can effectively simulate and test deep learning-based radio signal classifiers in a black-box setting, verifying the robustness of the model.

[0158] 5. Generate more covert adversarial examples: By intelligently selecting perturbation areas and optimizing the search process, this method aims to achieve security testing with smaller perturbation amplitudes, thereby improving the covertness of adversarial examples.

[0159] Example 2

[0160] In this embodiment, a computer terminal device is provided, including:

[0161] One or more processors;

[0162] A memory, coupled to the processor, for storing one or more programs;

[0163] When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the above-described adaptive block black box model security simulation test method for radio signals.

[0164] In this embodiment, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the above-described adaptive block black box model security simulation test method for radio signals.

[0165] In this embodiment, an electronic device is also provided, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to perform the steps of the above-described adaptive block black box model security simulation test method for radio signals.

[0166] In this embodiment, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the above-described adaptive block black box model security simulation test method for radio signals.

[0167] The aforementioned program can run on a processor or be stored in memory (or a computer-readable medium). Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0168] These computer programs may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes can be implemented by different modules for different steps.

[0169] This embodiment provides such an apparatus or system. The system, referred to as an adaptive block black-box model security simulation and testing system for radio signals, includes:

[0170] The detection module is used to perform the detection phase, generate multiple small perturbations and input them into the target black box model for querying, so as to build or update the sensitivity map;

[0171] The main attack iteration module is used to dynamically adjust the exploration and exploitation probabilities and generate multiple candidate perturbations based on the sensitivity map and the list of historical successful patches;

[0172] The batch query module is used to input the candidate perturbations into the target black-box model in batches for querying, obtain the loss value, and update the list of best adversarial examples and successful patches;

[0173] The attack judgment module is used to determine whether the attack is successful. If successful, it returns an adversarial sample; otherwise, it triggers the main attack iteration module and the batch query module to repeat until the maximum number of queries is reached.

[0174] As one implementation method in this embodiment, the detection module includes:

[0175] A perturbation generation unit is used to randomly select a center position and a patch length, the patch length being calculated based on an initial perturbation feature percentage, and to generate a perturbation value within the selected area, the perturbation value being the maximum perturbation value multiplied by a scaling factor and then multiplied by a random positive or negative sign;

[0176] The sample forming unit is used to add perturbations to the original signal to form probe samples;

[0177] The map update unit is used to batch query the target model to obtain the loss value and update the sensitivity map according to the change in loss. The change in loss is calculated based on the difference between the current best loss and the loss of the probe sample, and an attenuation factor is applied to reduce the historical sensitivity information.

[0178] As one implementation method in this embodiment, the main attack iteration module includes:

[0179] The probability adjustment unit is used to adjust the exploitation probability according to the attack stagnation. If stagnation occurs, the exploitation probability is reduced to encourage exploration. The base perturbation feature percentage is obtained from the preset decay schedule and the perturbation feature percentage is increased in exploration mode.

[0180] The location selection unit is used to select the center location of the perturbation patch based on the probability of utilization. When the probability is high, the center is selected from the list of historical successful patches and a random offset is applied. When the probability is low, the center is selected based on the sensitivity map weighted sampling or random selection.

[0181] As one implementation method in this embodiment, the main attack iteration module includes:

[0182] The disturbance generation unit is used to calculate the disturbance patch length based on the disturbance feature percentage and the total number of signal features, and add random positive and negative disturbances within the selected center position and patch length area;

[0183] The sample processing unit is used to add perturbations to the current best adversarial sample to form a transitional adversarial sample, project the transitional adversarial sample into a preset perturbation range, and prune it with the original sample as the center.

[0184] As one implementation method in this embodiment, the batch query module includes:

[0185] The query execution unit is used to input candidate adversarial samples into the target model in batches and obtain the output vector.

[0186] The loss calculation unit is used to calculate the marginal loss value for each sample, which is the difference between the true class score and the highest score of other classes;

[0187] The state update unit is used to select the sample with the minimum loss as the new best adversarial sample, update the total number of queries, and add the patch information that successfully reduced the loss to the historical successful patch list.

[0188] As one implementation method in this embodiment, the attack determination module includes:

[0189] The success determination unit is used to check whether the predicted category of the candidate adversarial example is inconsistent with the true category;

[0190] The iterative control unit is used to return the corresponding adversarial sample when the predicted category is inconsistent with the true category. When it fails and the total number of queries has not reached the maximum number of queries, it triggers the main attack iterative module and the batch query module to be executed repeatedly. When it still fails after reaching the maximum number of queries, it returns the current best adversarial sample.

[0191] The system or apparatus is used to implement the functions of the methods in the above embodiments. Each module in the system or apparatus corresponds to each step in the method, as has been described in the method and will not be repeated here.

[0192] The above implementation method solves the problem of security simulation testing of adaptive block black box model for radio signals in related technologies, thereby ensuring that the problems existing in the prior art are resolved.

[0193] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An adaptive block black-box adversarial attack method for radio signals, characterized in that, Includes the following steps: S1. Execute the detection phase, generate multiple small perturbations and input them into the target black box model for querying, in order to build or update the sensitivity map; S2. Enter the main attack iteration, dynamically adjust the exploration and utilization probability, and generate multiple candidate perturbations based on the sensitivity map and the list of historical successful patches; In S2, the process of dynamically adjusting the exploration and utilization probabilities includes: Adjust the utilization probability based on whether the attack stalls; if it stalls, reduce the utilization probability to encourage exploration. Obtain the percentage of the basic perturbation feature from the preset decay timetable; Increase the percentage of perturbation features in exploration mode; Based on the probability of selecting the center location of the perturbation patch, when the probability is high, the center is selected from the list of historical successful patches and a random offset is applied; when the probability is low, the center is selected by weighted sampling based on the sensitivity map or by random selection. S3. Input the candidate perturbations into the target black-box model in batches for querying, obtain the loss value, and update the list of best adversarial samples and successful patches; S4. Determine if the attack was successful. If successful, return the adversarial sample. Otherwise, repeat S2 to S3 until the maximum number of queries is reached.

2. The method according to claim 1, characterized in that, The process of performing the detection phase includes: Randomly select the center position and patch length, wherein the patch length is calculated based on the initial perturbation feature percentage; Generate perturbation values ​​within the selected area, where the perturbation values ​​are the maximum perturbation value multiplied by a scaling factor and then multiplied by a random positive or negative sign; The perturbation is added to the original signal to form a probe sample; Batch query the target model to obtain the loss value; The sensitivity map is updated based on the change in loss, which is calculated based on the difference between the current best loss and the loss of the probe sample, and an attenuation factor is applied to reduce historical sensitivity information.

3. The method according to claim 1, characterized in that, In S2, the process of generating multiple candidate perturbations includes: The length of the perturbation patch is calculated based on the percentage of perturbation features and the total number of signal features; Add random positive and negative sign perturbations within a selected center location and patch length area; Add perturbations to the current best adversarial sample to form transitional adversarial samples; The transitional adversarial examples are projected onto a preset perturbation range and then cropped with the original examples as the center.

4. The method according to claim 1, characterized in that, In S3, the process of batch querying and updating status includes: Input candidate adversarial examples in batches into the target model to obtain the output vector; Calculate the marginal loss value for each sample, which is the difference between the true class score and the highest score of the other class; Select the sample with the minimum loss as the new best adversarial sample; Update the total number of queries and add information on patches that successfully reduced losses to the list of historical successful patches.

5. The method according to claim 1, characterized in that, In S4, the process of determining whether the attack was successful includes: Check whether the predicted class of the candidate adversarial example is inconsistent with the true class; If the predicted category is inconsistent with the true category, the attack is successful and the corresponding adversarial sample is returned. If unsuccessful and the total number of queries has not reached the maximum number of queries, repeat steps S2 to S3. If the maximum number of queries is reached and the query still fails, the current best adversarial sample is returned.

6. An adaptive block black-box adversarial attack system for radio signals, characterized in that, The system for implementing the method of any one of claims 1-5 comprises: The detection module is used to perform the detection phase, generate multiple small perturbations and input them into the target black box model for querying, so as to build or update the sensitivity map; The main attack iteration module is used to dynamically adjust the exploration and exploitation probabilities and generate multiple candidate perturbations based on the sensitivity map and the list of historical successful patches; The batch query module is used to input the candidate perturbations into the target black-box model in batches for querying, obtain the loss value, and update the list of best adversarial examples and successful patches; The attack judgment module is used to determine whether the attack is successful. If successful, it returns an adversarial sample; otherwise, it triggers the main attack iteration module and the batch query module to repeat until the maximum number of queries is reached.

7. A computer terminal device, characterized in that, include: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors perform the steps of the method as described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-5.

Images