Perturbation direction and position cooperative constraint timing adversarial sample generation method and system

Abstract

The application discloses a kind of perturbation direction and position synergic constraint timing confrontation sample generation method and system, belong to artificial intelligence and machine learning security technical field, including: obtaining the multivariate time series data of power equipment monitoring and preprocessing, construct the model set including multiple time series prediction models, select several proxy models;Time series data is subjected to Fourier transform and the time-frequency analysis of combination of continuous wavelet transform, construct time-frequency significance mask;The time series data is input into each proxy model, respectively calculate prediction error and input gradient, obtain the sensitivity vector of each proxy model, by time-frequency significance mask fusion generation individualized mask, the gradient of each proxy model is calculated in parallel, after weighted fusion, individualized mask constraint is applied, and consensus gradient direction is obtained;Iterative update mechanism of momentum constraint is introduced, and momentum item and confrontation sample are updated by continuously iterating cumulative gradient until the preset condition is satisfied, and the final confrontation sample is output.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and machine learning security technology, and in particular relates to a method and system for generating temporal adversarial examples with co-constraints on perturbation direction and position. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the advancement of power system digitalization, power equipment operation platforms continuously generate a large amount of multivariate time-series data. For example, in power equipment monitoring scenarios, sensors collect status data such as equipment temperature and related operating parameters at fixed time intervals for temperature prediction, condition assessment, and risk warning. The collected time-series data exhibits significant periodicity and multi-scale variation characteristics. Modeling it using time-series prediction models can predict future states, which is crucial for ensuring the safe operation of power equipment and improving traffic efficiency. In recent years, increasing research has focused on the security issues of time-series prediction models for power systems in practical deployments. Time-series prediction models generally suffer from adversarial vulnerability; even small perturbations in the input data can significantly reduce prediction performance or even mislead the model's output. This data with added perturbations is called an adversarial example. It can not only be used to detect security issues in deep learning but also for model hardening. Adding adversarial examples to the dataset during model training can build a more robust model and effectively defend against adversarial attacks.

[0004] Currently, adversarial example generation includes white-box attacks such as Fast Gradient Signed Method (FGSM), Projected Gradient Descent (PGD), and Momentum Iterative Fast Gradient Signed Method (MI-FGSM), as well as query-based black-box attacks such as zero-order optimization and boundary search. White-box attacks rely on complete access to the target model's parameters and gradients, enabling efficient generation of highly targeted adversarial examples. Query-based black-box attacks achieve their black-box effect by performing numerous queries on the target model and estimating gradients or directly optimizing inputs based on the query results. However, white-box attacks typically struggle to obtain internal information about the target time-series prediction model; query-based black-box attacks have high query costs and poor feasibility in systems with access restrictions or high latency. To address this, a transfer-based black-box attack method has been proposed. This method first generates adversarial examples or perturbation directions on an accessible proxy model, then directly transfers the generated adversarial examples to a target model whose internal structure and parameters are unknown to achieve the attack. Transfer-based attacks can be implemented without querying the target model, leading to their wider application.

[0005] However, in the actual deployment scenarios of power multivariate time series forecasting, there are significant shortcomings when facing migrating black-box attacks: existing time series forecasting models differ greatly in architecture and feature extraction methods, while current generation methods mostly rely on a single proxy model. The direction of the generated perturbation is often greatly affected by the model structure, making it difficult to maintain consistency among heterogeneous models. This results in insufficient transferability of the generated adversarial examples, and the attack success rate drops significantly with the differences in the target model structure and training data. In addition, the time-frequency structure of power system multivariate time series data is complex. Directly applying uniform perturbation in the time domain ignores the sensitive areas in the frequency domain, resulting in unstable effects (i.e., attack success) when the perturbation is transferred to different models. Blindly amplifying perturbations on this long sequence or multi-channel data will increase the risk of being detected or rejected, while wasting perturbation energy and reducing the transfer success rate. Summary of the Invention

[0006] To address the issues of insufficient transferability and low attack success rate of adversarial examples generated in existing power time-series forecasting, this invention provides a method and system for generating time-series adversarial examples with coordinated constraints on perturbation direction and location. By co-optimizing at both the perturbation location and direction levels, the stability and cross-model transferability of attacks are effectively improved. This allows the generated adversarial examples to achieve a higher attack success rate against heterogeneous target forecasting models without accessing the internal information of the target forecasting model or performing a large number of queries.

[0007] In a first aspect, the present invention provides a method for generating temporal adversarial samples with co-constraints on perturbation direction and position.

[0008] A method for generating temporal adversarial examples with co-constrained perturbation direction and position includes:

[0009] Acquire and preprocess the raw multivariate time series data of power equipment monitoring, construct a model set containing multiple time series prediction models, and select several surrogate models;

[0010] Time-frequency analysis combining Fourier transform and continuous wavelet transform is performed on the preprocessed time-series data to extract significant energy regions and construct a time-frequency saliency mask.

[0011] The preprocessed time series data is input into each surrogate model, and the prediction error and input gradient are calculated respectively to obtain the sensitivity vector of each surrogate model. After weighted fusion, it is fused with the time-frequency saliency mask to generate a personalized mask. The gradient of each surrogate model is calculated in parallel. After weighted fusion, the personalized mask constraint is applied to obtain the consensus gradient direction.

[0012] An iterative update mechanism with momentum constraints is introduced to continuously iterate and accumulate gradients to update the momentum term and adversarial examples until the preset conditions are met, and the final adversarial examples are output.

[0013] Further technical solutions, including the construction of time-frequency saliency masks, include:

[0014] A fast Fourier transform is performed on the preprocessed power time-series data to obtain the periodic energy spectrum, and the top K significant periods with the highest energy amplitude are selected; the preprocessing includes standardization and windowing.

[0015] Continuous wavelet transform is performed on the preprocessed power time series data to obtain the energy distribution matrix, and the energy curves corresponding to each significant period are extracted.

[0016] Based on the energy curve of each significant period, a dynamic threshold is determined according to the mean and standard deviation of the energy sequence, continuous time intervals where the energy is higher than the threshold are identified, and a comprehensive score of fused energy intensity and duration is calculated.

[0017] By merging the overlapping intervals between different significant periods and recalculating the comprehensive score, the minimum number of intervals covering the preset proportion of total energy are selected. A time-domain saliency mask is constructed based on the selected interval set, and then Gaussian smoothing and normalization are performed to obtain the time-frequency saliency mask.

[0018] Further technical solutions, including the process of obtaining the sensitivity vector, include:

[0019] The preprocessed power time series data is input into each proxy model to obtain the corresponding output predicted value, and the mean square error between the predicted value and the actual value is calculated.

[0020] For each proxy model, the residual sensitivity method and the gradient sensitivity method are used to calculate two types of sensitivity indices. The two types of indices are then fused using a balance coefficient to obtain the comprehensive sensitivity of a single model. After normalization, the sensitivity vector is obtained.

[0021] Based on the prediction performance metrics of each surrogate model's validation set, confidence weights are calculated. The sensitivity vectors of all surrogate models are then weighted and fused according to the confidence weights to obtain the sensitivity vector of the global model.

[0022] A further technical solution is to use the residual sensitivity method to calculate the sensitivity index, which is: calculate the absolute value of the prediction residual at each time step to obtain the residual sensitivity index value based on the prediction bias;

[0023] The sensitivity index is calculated using the gradient sensitivity method: the partial derivative of the loss function with respect to the input is obtained through backpropagation, and the norm is taken as the gradient sensitivity index value.

[0024] Further technical solutions, including the coordinated determination of the disturbance location and direction, include:

[0025] Based on the time-frequency saliency vector and the sensitivity vector of each proxy model, a weighted fusion is performed to generate a personalized mask;

[0026] The personalized masks are weighted and integrated according to the confidence weight of the proxy model to obtain the global consensus mask to determine the perturbation position. Then, the global consensus mask is subjected to threshold sparsity processing.

[0027] The input gradients of each proxy model are calculated and normalized. The gradients are then weighted and fused according to the confidence weights of the proxy models. A global consensus mask constraint with threshold sparsity is applied to the fused gradients. After normalization, the consensus gradient direction is obtained to determine the perturbation direction.

[0028] A further technical solution, the momentum-guided iterative optimization process, is as follows:

[0029] An iterative update mechanism with momentum constraints is introduced, where the cumulative gradient is represented by a momentum term. In each iteration, the consensus gradient direction of the previous round is accumulated to update the momentum term of the current round.

[0030] The original power time series data is updated according to the updated momentum term in step size to obtain the updated time series data for the current round, i.e., the updated adversarial sample.

[0031] The updated adversarial examples are subjected to amplitude constraints and projections, and after time-series smoothing, they are input into each proxy model to perform a cyclic iterative update process.

[0032] The process is iterated continuously until the preset conditions are met, at which point the final adversarial example is output.

[0033] Secondly, the present invention provides a temporal adversarial sample generation system with co-constraints on perturbation direction and position.

[0034] A temporal adversarial example generation system with co-constrained perturbation direction and position includes:

[0035] The data acquisition and model building module is used to acquire and preprocess the raw multivariate time series data of power equipment monitoring, build a model set containing multiple time series prediction models, and select several surrogate models.

[0036] The mask construction module is used to perform time-frequency analysis on the preprocessed time-series data by combining Fourier transform and continuous wavelet transform, extract significant energy regions, and construct a time-frequency saliency mask.

[0037] The consensus gradient construction module is used to input preprocessed time series data into each proxy model, calculate the prediction error and input gradient respectively, obtain the sensitivity vector of each proxy model, and then fuse it with the time-frequency saliency mask after weighted fusion to generate a personalized mask. The gradient of each proxy model is calculated in parallel, and personalized mask constraints are applied after weighted fusion to obtain the consensus gradient direction.

[0038] The momentum optimization and adversarial example generation module introduces an iterative update mechanism for momentum constraints, continuously accumulating gradients to update the momentum term and adversarial examples until preset conditions are met, and then outputs the final adversarial examples.

[0039] Thirdly, the present invention also provides an electronic device, comprising: a memory for storing executable instructions; and a processor for executing the executable instructions stored in the memory to implement the above-mentioned method for generating temporal adversarial samples with coordinated constraints on perturbation direction and position.

[0040] Fourthly, the present invention also provides a computer-readable storage medium storing executable instructions for causing a processor to execute the executable instructions to implement the above-mentioned method for generating temporal adversarial samples with coordinated constraints on perturbation direction and position.

[0041] Fifthly, the present invention also provides a computer program product comprising executable instructions stored in a computer-readable storage medium; wherein, when the processor of an electronic device reads the executable instructions from the computer-readable storage medium and executes the executable instructions, it implements the above-mentioned method for generating temporal adversarial samples with coordinated constraints on perturbation direction and position.

[0042] The above one or more technical solutions have the following beneficial effects:

[0043] 1. This invention provides a method and system for generating adversarial examples of time series with coordinated constraints on the direction and location of disturbances. It adopts an optimized migration-type black-box attack method, and simultaneously utilizes the time-frequency saliency and model sensitivity information of power time series data to select the disturbance location, constructs consensus of multiple proxy models to determine the disturbance direction, and introduces a stable iterative update strategy to coordinately constrain the disturbance location and update direction. Under the premise of not accessing the internal information of the target prediction model and not performing a large number of queries, the generated adversarial examples have a higher attack success rate against heterogeneous target prediction models, effectively improving the migration success rate of heterogeneous time series prediction models and reducing the overall disturbance amplitude.

[0044] 2. This invention introduces time-frequency analysis into adversarial example generation. By combining Fast Fourier Transform and Continuous Wavelet Transform, it identifies key periods and time intervals with significant signal energy in the time-frequency domain, forming a time-frequency saliency mask. This mechanism can automatically locate the time period most sensitive to the prediction results, achieving more efficient perturbation allocation under the same perturbation budget, fundamentally improving the stability and targeting of the attack.

[0045] 3. This invention constructs a model sensitivity distribution by calculating prediction errors on multiple proxy models, and then weights and fuses this distribution with a time-frequency saliency mask to form a dynamic mask, thereby achieving joint modeling of data feature saliency and model response features. This strategy makes the perturbation location more consistent with the decision regions of different models, effectively improving the transfer consistency and generalization ability of adversarial examples across multiple models.

[0046] 4. This invention also designs a perturbation optimization mechanism that integrates multi-model gradient consensus and momentum smoothing constraints. Specifically, by calculating the input gradients on multiple surrogate models and applying normalization, confidence weighting, and saliency masking constraints, a comprehensive gradient with consistent direction and fewer conflicts is obtained, thereby improving the stability and robustness of the perturbation direction while maintaining attack strength. Based on this, a momentum-guided update strategy is introduced to accumulate historical gradient information during iteration, making the perturbation path smoother and accelerating convergence. Simultaneously, norm constraints and temporal smoothing projections are applied to the perturbation after each update, ensuring that the generated adversarial examples are guaranteed in both numerical continuity and physical interpretability, avoiding anomalous mutations or unnatural jump signals. This mechanism effectively solves problems such as inconsistent gradient directions in single surrogate models and oscillating perturbation updates.

[0047] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0048] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0049] Figure 1 This is a general framework diagram of the temporal adversarial sample generation method with co-constraint of perturbation direction and position according to Embodiment 1 of the present invention;

[0050] Figure 2 This is a flowchart illustrating the generation of the comprehensive saliency mask in Embodiment 1 of the present invention.

[0051] Figure 3 This is a flowchart of the multi-model gradient consensus fusion and momentum optimization update in Embodiment 1 of the present invention. Detailed Implementation

[0052] It should be noted that the following detailed descriptions are exemplary and are intended only to describe specific embodiments and to provide further explanation of the invention, and are not intended to limit the scope of exemplary embodiments of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0053] Terminology Explanation:

[0054] 1. Proxy Model: A proxy model is an alternative model accessible to attackers and used to generate adversarial perturbations. It shares structural or functional similarities with the target model, approximating the target model's decision-making behavior. Gradient information or sensitivity distributions obtained through the proxy model can be used to construct transfer attacks.

[0055] 2. Transferred Black-Box Attacks: Transferred black-box attacks refer to generating adversarial examples on one or more accessible proxy models and directly applying them to a target model with an unknown structure in order to achieve an attack. The core assumption is that different models share similarities in feature extraction or decision boundaries, thus enabling the adversarial examples to transfer across models.

[0056] 3. Time-Frequency Analysis: Time-frequency analysis is a signal processing method that maps time-series signals from the time domain to the time-frequency domain, used to simultaneously characterize the time and frequency features of a signal. Common methods include wavelet transform and Fourier transform, which help identify the distribution patterns of different frequency components along the time axis.

[0057] 4. Model Sensitivity: Model sensitivity refers to the strength of a model's output response to changes in the input, and is used to measure the importance of input features in the model's prediction process. In time series prediction scenarios, model sensitivity reflects the degree of influence of different time steps or frequency components on the prediction results. The higher the sensitivity value, the more likely small changes in that time period or frequency band are to cause significant changes in the model's prediction results, which is the critical area for model decision-making.

[0058] 5. Momentum Optimization Mechanism: The momentum optimization mechanism is an optimization strategy that accumulates historical gradient information during iterative updates to smooth the update trajectory. By introducing a momentum term, gradient oscillations can be effectively suppressed, perturbation convergence can be accelerated, and the stability and transferability of generated adversarial examples can be improved.

[0059] The overall concept of this invention is as follows:

[0060] In the scenario of multivariate time series prediction of electricity, the adversarial examples generated by the existing transferable black box attack method have poor transferability. The reasons are as follows: (1) Existing methods mostly rely on a single surrogate model. The perturbation direction generated by it is greatly affected by the model structure and it is difficult to maintain consistency among heterogeneous models. In this regard, although it is possible to construct a set of multiple surrogate models and generate or fuse perturbation directions in parallel on them, hoping to obtain a more universal attack direction by taking advantage of the diversity among surrogate models, this method only performs simple addition at the gradient or perturbation level, which may lead to conflict or be dominated by individual models after fusion; (2) Existing methods use direct perturbation of the time domain of the time series signal and ignore the frequency domain characteristics of the signal, which leads to unstable perturbation transfer effect between different models. In this regard, it is currently attempted to combine sparse localization, local search or evolutionary algorithms with time series characteristics to find a small number of perturbation points that have the greatest impact on model decision under a limited perturbation budget. However, this method has the disadvantages of high cost and difficulty in scaling to long sequences or real-time evaluation scenarios, and it is difficult to simultaneously characterize the multi-scale time-frequency characteristics of the time series and the response of each model to different frequency bands. In other words, in the context of power time series forecasting, existing time series forecasting models generally suffer from problems such as insufficient mobility, uncontrollable disturbances, and lack of time series smoothness constraints when facing migrating black-box adversarial attacks.

[0061] To address the aforementioned problems, this invention proposes a temporal adversarial example generation method with coordinated constraints on perturbation direction and location. On one hand, time-frequency analysis is introduced into adversarial example generation. By combining Fast Fourier Transform and Continuous Wavelet Transform, key periods and time intervals with significant signal energy are identified in the time-frequency domain, forming a time-frequency saliency mask. This mechanism can automatically locate the time period most sensitive to the prediction results, achieving more efficient perturbation allocation under the same perturbation budget, fundamentally improving the stability and targeting of the attack. On the other hand, by calculating the prediction error on multiple proxy models, a model sensitivity distribution is constructed and weighted and fused with the time-frequency saliency mask to form a dynamic mask. This achieves joint modeling of data feature saliency and model response features. This strategy makes the perturbation location more consistent with the decision regions of different models, effectively improving the adversarial example generation. This invention improves the transfer consistency and generalization ability across multiple models. Furthermore, considering issues such as inconsistent gradient directions and oscillating perturbation updates in single proxy models, a perturbation optimization mechanism integrating multi-model gradient consensus and momentum smoothing constraints is designed. By calculating input gradients on multiple proxy models and performing normalization, confidence weighting, and saliency masking constraints, a comprehensive gradient with consistent direction and less conflict is obtained. This improves the stability and robustness of the perturbation direction while maintaining attack strength. Based on this, a momentum-guided update strategy is introduced to accumulate historical gradient information during iteration, making the perturbation path smoother and accelerating convergence. Simultaneously, norm constraints and temporal smoothing projections are applied to the perturbation after each update to ensure that the generated adversarial examples are guaranteed in both numerical continuity and physical interpretability, avoiding anomalous mutations or unnatural jump signals. This invention effectively improves the transfer performance and practicality of adversarial examples through the above-mentioned method of collaboratively constraining the position and direction of perturbations.

[0062] Example 1

[0063] This embodiment proposes a method for generating temporal adversarial examples with co-constrained perturbation direction and location. Addressing the issue of insufficient success rate in transferring black-box attacks on existing time series prediction models, this method combines time-frequency saliency localization with gradient consensus fusion across multiple proxy models. This achieves effective attacks and perturbation transfer on heterogeneous time series prediction models without accessing the target model's internal parameters or gradients. The proposed method is as follows: Figure 1 As shown, the specific steps include:

[0064] Step S1: Obtain and preprocess the raw multivariate time series data of power equipment monitoring, construct a model set containing multiple time series prediction models, and select several surrogate models.

[0065] Specifically, the process involves acquiring raw time-series data from power equipment monitoring. This time-series data is multivariate and covers key parameters related to the equipment's operating status, such as the temperature of various components (e.g., winding temperature, core temperature), voltage, current, power, oil level, pressure, vibration amplitude, and insulation resistance. These key parameters are the core basis for assessing the equipment's operating status. Simultaneously, this multivariate time-series data also includes auxiliary correlation data, such as collection timestamps (e.g., sampling records every hour or every fifteen minutes), equipment operating condition indicators (e.g., load level, start / stop status), and environmental parameters (e.g., ambient temperature, humidity, and air pressure), used to assist in calibrating monitoring results and analyzing parameter correlations.

[0066] In this embodiment, the publicly available datasets ETTh1, ETTh2, ETTm1, and ETTm2 are used. Each dataset is divided into training, validation, and test sets with ratios of 0.6, 0.2, and 0.2, respectively. The specific datasets used are as follows:

[0067] (1) ETTh1 and ETTh2 datasets: This dataset is a publicly available multivariate time series dataset for power equipment monitoring. The original data contains 8 fields, including a date field (i.e., timestamp) and 7 monitoring variables. The sampling frequency is once per hour.

[0068] (2) ETTm1 and ETTm2 datasets: This dataset is a publicly available multivariate time series dataset for power equipment monitoring. The original data contains 8 fields, including a date field (i.e., timestamp) and 7 monitoring variables. The sampling frequency is once every 15 minutes.

[0069] Furthermore, the acquired power time-series data undergoes preprocessing, including standardization and windowing. First, the input power time-series data... z-score normalization is performed to eliminate the influence between different units, obtaining standardized power time-series data while retaining the normalization parameters for subsequent inverse normalization evaluation. The normalization formula is:

[0070] ;

[0071] in, The mean of the time series. The standard deviation is denoted as .

[0072] Secondly, the standardized time-series data is divided into sliding windows to form a length of... By combining the input time series data samples with the corresponding prediction targets, several time series samples that can be used for modeling are obtained, ensuring that the attack is concentrated on the input segment before the prediction window.

[0073] Furthermore, the split time-series sample data is divided into training sets in an 8:2 ratio. and test set This lays the foundation for subsequent model training and testing.

[0074] Simultaneously, in order to conduct transferable black-box adversarial attacks against time series prediction tasks and generate transferable time series adversarial examples, it is also necessary to determine the corresponding time series prediction model and construct a set of proxy prediction models for adversarial example generation. In this embodiment, commonly used time series prediction models are employed, including:

[0075] (1) Time Convolutional Network (TCN): The TCN model uses one-dimensional convolution to extract features from sequences within a historical time window, and utilizes dilated convolution and residual connections to capture dependencies at different time scales, thereby outputting prediction results for future time steps. In this embodiment, the TCN model is selected as one of the surrogate prediction models to calculate the prediction error and further obtain the input gradient to generate adversarial perturbations.

[0076] (2) Long Short-Term Memory (LSTM) Network Model: LSTM network models selectively remember and forget historical information through gating structures, enabling them to learn long-term dependencies in sequences and output predicted sequences for future time steps. In this embodiment, LSTM network models are selected as one of the surrogate prediction models to enhance the structural diversity of the surrogate model set and improve cross-model transferability against perturbations.

[0077] (3) DLinear prediction model (Decomposition Linear, DLinear): The DLinear prediction model predicts the input sequence based on a linear mapping and characterizes the main changing components of the sequence through decomposition. It features a simple structure and stable training. In this embodiment, the DLinear prediction model is selected as one of the surrogate prediction models to improve the transferability of adversarial perturbations to the lightweight prediction model.

[0078] Preferably, in addition to the models described above, this embodiment also employs Transformer series time series prediction models and feature-enhanced time series prediction models as surrogate prediction models or target prediction models to improve the structural diversity of the surrogate model set and enhance its transferability against perturbations. The Transformer series models include Informer models and Autoformer models. The Informer model reduces the computational overhead of long sequence modeling through a sparse attention mechanism and learns long-distance dependencies in historical sequences to output prediction results for future time steps. The Autoformer model models trend components and periodic components through a sequence decomposition mechanism and combines an attention structure to capture long-term dependencies to achieve long-term series prediction.

[0079] As a further implementation, after selecting multiple proxy prediction models as described above, the training set constructed after data preprocessing is used... and test set Each proxy prediction model is trained and tested separately to obtain a trained proxy prediction model, laying the foundation for subsequent generation of adversarial examples.

[0080] In fact, each model in the aforementioned time series prediction model set can be used as a proxy prediction model to participate in adversarial example generation. Specifically, this embodiment uses a multi-model alternating selection method for migration-type black-box attack evaluation. When any prediction model is selected as the target prediction model (hereinafter referred to as the target model), the remaining prediction models other than the target prediction model are used to form a proxy prediction model set (hereinafter referred to as the proxy model). Adversarial examples are generated on the proxy prediction model set. Then, the generated adversarial examples are directly input into the target prediction model without accessing the target prediction model to perform migration attack testing, thereby evaluating the migration effect of the adversarial examples on heterogeneous target prediction models.

[0081] Step S2: Perform time-frequency analysis on the preprocessed time-series data by combining Fourier transform and continuous wavelet transform, extract significant energy regions, and construct a time-frequency saliency mask.

[0082] Specifically, for preprocessed time-series data, a time-frequency analysis strategy combining Fourier transform and continuous wavelet transform is adopted to extract the energy distribution information of the input signal in the time and frequency dimensions. Adaptive thresholding is used to identify prominent energy periods and their corresponding high-energy time intervals, thereby constructing a time-frequency saliency mask to characterize the sensitivity of the input data in different time periods. For example... Figure 2 As shown, it includes:

[0083] Step S2.1: Perform a fast Fourier transform on the preprocessed power time series data to obtain the periodic energy spectrum, and select the top K significant periods with the highest energy amplitude.

[0084] Specifically, based on the power time-series data samples obtained after the above preprocessing, for the time-series data of each channel c (where channel c refers to the c-th monitoring variable dimension in the multivariate time series of power monitoring, corresponding to a certain state feature collected during the operation of power equipment), a Fast Fourier Transform is performed to decompose the time-dimensional signal into a superposition of different frequency components, outputting a complex form of frequency domain result (including the amplitude and phase of each frequency component). The square of the amplitude (or the absolute value of the amplitude) of each frequency component is calculated to obtain the energy value of the corresponding frequency, forming a frequency-energy mapping relationship, i.e., a periodic energy spectrum. Based on the reciprocal relationship between frequency and period (period = 1 / frequency), the frequency axis of the energy spectrum is converted into a periodic axis, clarifying the energy intensity (i.e., energy amplitude) corresponding to each period, thus obtaining the final periodic energy spectrum. The energy amplitude of the p-th period with a period length of P is expressed as... .

[0085] Based on the periodic energy spectrum, the top K most significant periods with the highest energy amplitude are selected to form a set of significant periods. .

[0086] In addition, to ensure the representativeness of the period selection, its normalized weights are calculated as follows:

[0087] ;

[0088] In the above formula, Represents traversing the significant periodic set The index variable is used to calculate the sum of energy amplitudes corresponding to all significant periods in the significant period set; This represents the normalized weight of the Pth significant period, which serves as a period importance factor in subsequent time-frequency mask fusion.

[0089] Step S2.2: Perform continuous wavelet transform on the preprocessed power time series data to obtain the energy distribution matrix and extract the energy curves corresponding to each significant period.

[0090] Specifically, continuous wavelet transform is performed on the preprocessed power time-series data samples to obtain the energy distribution matrix. The x-axis The vertical axis represents time, and the vertical axis 's' represents the wavelet scale; based on the wavelet center frequency... With sampling interval Define the cycle Satisfaction with scale s The correspondence between the salient period sets obtained during the Fast Fourier Transform stage and the salient period set. For each significant periodic element in the matrix, calculate its corresponding wavelet scale based on the above correspondence. and in the energy distribution matrix The selected scale is The energy curve is represented as:

[0091] ;

[0092] in, This represents the local energy of the periodic component corresponding to the Pth significant period at each time step.

[0093] Step S2.3: Identify candidate high-energy intervals based on the energy curves corresponding to each significant period, and determine the significant intervals and their comprehensive scores based on the fused energy sequence.

[0094] Specifically, to adapt to the energy distribution of different sequences or samples, this embodiment introduces a dynamic thresholding strategy based on statistical characteristics. For the energy curve of each significant period, the energy threshold is calculated based on the mean and standard deviation of the energy sequence. , can be represented as:

[0095] ;

[0096] in, and Energy sequences The mean and standard deviation; k is the standard deviation adjustment coefficient. In this embodiment, .

[0097] Preferably, the threshold is defined using the percentile method. For example, by setting k, the threshold corresponds to the 85% to 95% percentile level of the energy sequence, thereby controlling the significance confidence level and ensuring that steady-state high-energy regions that have a real impact on model prediction are selected, providing accurate regional basis for subsequent time-frequency significance mask construction.

[0098] Based on this, the energy curve in each cycle Above, identify all consecutively satisfied > time interval And calculate its comprehensive energy score, which can be expressed as:

[0099] ;

[0100] in, The normalized periodic weights obtained in step S2.1 are used to characterize the importance of significant periods; This represents the average energy value within the interval; and These are weighted indices for energy and duration, respectively. This comprehensive energy score considers both energy intensity and duration, helping to eliminate noise peaks and highlight steady-state high-energy regions. Additionally, a minimum duration is set for excessively short intervals. ,like < If the result is not found, it will not be included in the candidate set.

[0101] Step S2.4: Specifically, the candidate interval sets of each significant period selected above are merged to form a global set. The overlapping intervals between different significant periods are merged and the comprehensive score is recalculated. The minimum number of intervals covering the preset proportion of total energy are selected. A time-domain saliency mask is constructed based on the selected interval set. After Gaussian smoothing and normalization, the time-frequency saliency mask is obtained.

[0102] Specifically, the candidate interval sets for each period selected above... Merge to form a global set For time intervals that overlap across different periods, interval fusion is performed and the comprehensive score is recalculated. The fusion score is then weighted by energy. Finally, the comprehensive score is used to calculate the final score. Sort in descending order and select the minimum quantity. The proportion of each time period covering the total comprehensive score ,Right now:

[0103] ;

[0104] in, This adaptive strategy replaces the traditional fixed number of segments, using an energy coverage threshold. Manual settings help to automatically adjust the number of significant segments under different signal complexities.

[0105] Next, based on the selected time period set... Construct a temporal saliency mask For each selected interval Define weights The temporal saliency mask is calculated as follows:

[0106] ;

[0107] Then, through the Gaussian kernel Convolutional smoothing can be represented as:

[0108] ;

[0109] in, Control the smoothing range. Smoothing operations can suppress mask abrupt changes and improve the continuity and concealment of perturbations.

[0110] Finally, for After normalization, the time-frequency saliency vector is obtained as follows:

[0111] ;

[0112] The aforementioned time-frequency significance vector reflects the high-energy region on the time axis that is most sensitive to model predictions, with a value range of [missing value]. Inside.

[0113] The time-frequency saliency vector calculated above not only possesses cross-period fusion characteristics but also considers energy, persistence, and smoothness in saliency localization, providing a stable and transferable foundation for subsequent model sensitivity mask fusion. Through the above steps, this embodiment effectively improves the robustness and transferability of the mask in the time-frequency saliency extraction stage, avoiding the problems of susceptibility to noise interference and misleading local energy peaks in the fixed threshold method.

[0114] Step S3: Input the preprocessed time series data into each surrogate model, calculate the prediction error and input gradient respectively, obtain the sensitivity vector of each surrogate model, fuse it with weighted average and then fuse it with the time-frequency saliency mask to generate a personalized mask, calculate the gradient of each surrogate model in parallel, apply personalized mask constraints after weighted average and fuse, and obtain the consensus gradient direction.

[0115] In this embodiment, firstly, the influence of each time step of the input time series on the output of the prediction model is evaluated to identify highly sensitive regions of the model in the time series dimension. This sensitivity information is then fused with the aforementioned time-frequency saliency features to construct a comprehensive mask that takes into account both data features and model response characteristics. The process is as follows: Figure 3 As shown, it includes:

[0116] Step S3.1: Input the preprocessed power time series data into each proxy model, obtain the corresponding output prediction value, and calculate the mean square error between the prediction value and the actual value.

[0117] Specifically, a surrogate model set is constructed by selecting several representative time series prediction models. Each model All can access its parameters and gradient information to approximate the decision boundary of the target model. The preprocessed input sequence... The data is input into each proxy model to obtain the corresponding prediction output. And calculate the model error as follows:

[0118] ;

[0119] in, The mean squared error (MSE) continuous loss function is adopted.

[0120] Step S3.2: For each proxy model, the residual sensitivity method and the gradient sensitivity method are used respectively to calculate two types of sensitivity indices. The two types of indices are then fused using a balance coefficient to obtain the comprehensive sensitivity of a single model. After normalization, the sensitivity vector is obtained.

[0121] For each agent model Input sensitivity is calculated using two complementary methods, including:

[0122] 1) Residual Sensitivity Method: The sensitivity estimate based on the prediction bias is obtained by calculating the absolute value of the prediction residuals at each time step, which can be expressed as:

[0123] ;

[0124] This method reflects the distribution of the model's prediction error at different time points and can capture the model's direct response to structural changes in the data.

[0125] 2) Gradient Sensitivity Method: The partial derivative of the loss function with respect to the input is obtained through backpropagation, which can be expressed as:

[0126] ;

[0127] Then, its norm is taken as a sensitivity index, that is:

[0128] ;

[0129] This metric characterizes the instantaneous impact of input features on the model output.

[0130] To balance error response and gradient response, this embodiment performs a weighted fusion of the two results to obtain the overall sensitivity of the single model, which is:

[0131] ;

[0132] in, This is the balance coefficient.

[0133] Furthermore, to eliminate scale differences between different models or different time steps, normalization is applied to obtain the final sensitivity vector, which is:

[0134] ;

[0135] in, To prevent small constants from being divided by zero, the normalized constants are... The range is limited to The larger the value within the interval, the more sensitive that time step is to the model's predicted output.

[0136] Secondly, to improve the robustness and cross-model consistency of sensitivity assessment, the input gradient and residual response are computed in parallel on a multi-surrogate model. A normalization and performance-weighted strategy is used to fuse the results, ultimately forming the model's sensitivity vector. ,Right now:

[0137] Step S3.3: Based on the prediction performance index of each proxy model's validation set, calculate the confidence weight, and then weight and fuse the sensitivity vectors of all proxy models according to the confidence weight to finally obtain the sensitivity vector of the global model.

[0138] Specifically, this embodiment introduces a performance-weighted fusion mechanism to enhance the coordination and cross-model consistency among surrogate models. For each surrogate model, its prediction performance metric (validation error) is calculated on the validation set. Convert it into confidence weights, as follows:

[0139] ;

[0140] in, Temperature is a parameter used to control the smoothness of the weight distribution. When there are significant differences in the performance of the surrogate models, the better model will receive higher weights, thereby improving the reliability of the overall sensitivity assessment.

[0141] Based on the combined sensitivity results of each proxy model, the global model sensitivity vector is calculated as follows:

[0142] ;

[0143] The above It reflects the prediction sensitivity of the input sequence under the significance of multi-model consistency and is an important input for the subsequent mask fusion stage.

[0144] In this embodiment, the model sensitivity calculation process combines prediction error and gradient information, preserving the explicit response of the model output to input perturbations while introducing fine-grained sensitivity expression of the hidden layer gradient direction. The multi-model weighting and normalization mechanism effectively alleviates gradient conflict and scale inconsistency problems, providing a highly stable and transferable sensitivity foundation for subsequent saliency mask fusion.

[0145] Furthermore, based on the above calculation results, the location and direction of the disturbance are determined collaboratively. That is, the time-frequency saliency vector is comprehensively utilized. With model sensitivity vector This process achieves the collaborative determination of attack location and direction, thereby generating perturbation directions with consistency and high transferability across multiple agent models. This step constructs personalized saliency masks through a mask fusion mechanism and designs an iterative optimization process involving multi-model gradient consensus fusion and momentum guidance to achieve efficient and stable transferable black-box adversarial example generation in time-series prediction tasks. The specific process is as follows:

[0146] Step S3.4: Based on the time-frequency saliency vector and the sensitivity vector of each proxy model, perform weighted fusion to generate a personalized mask.

[0147] Specifically, for each agent model First, the time-frequency saliency information at the data level and the sensitivity information at the model level are weighted and fused to construct a personalized mask, namely the comprehensive saliency mask, which is:

[0148] ；

[0149] in, This is the fusion coefficient, used to balance the relative impact of time-frequency significance and model sensitivity.

[0150] when When the signal is large, the mask focuses more on the energy structure and periodic salient regions of the input signal; when... When the value is smaller, more attention is paid to the response characteristics predicted by the model. Generally, The value range is 0.4 to 0.7.

[0151] Step S3.5: Based on the confidence weight of the proxy model, perform weighted integration of each personalized mask to obtain a global consensus mask to determine the perturbation location, and then perform threshold sparsity processing on the global consensus mask.

[0152] Specifically, to enhance the consensus and stability of masks among multiple models, a weighted integration mechanism is introduced based on personalized masks to define a global consensus mask to determine the perturbation location. This global consensus mask can be represented as:

[0153] ;

[0154] Among them, weight This represents the performance confidence coefficient of the surrogate model. This weighting operation effectively suppresses the bias of outlier models, ensuring that the fused mask has high consistency and representativeness across different models.

[0155] To further improve the spatial sparsity and physical rationality of the mask, this embodiment performs threshold sparsity processing on the global consensus mask. The global consensus mask after threshold sparsity processing can be represented as:

[0156] ;

[0157] in, The significance threshold is set according to the percentile of the mask distribution (e.g., top-20%) or a fixed proportion. (The top 10%–30% of highly significant points are retained) This is determined. The sparsified mask can concentrate attack energy on the most sensitive time-frequency region of the model, thereby improving the efficiency of perturbation utilization and reducing the probability of detection.

[0158] Step S3.6: Calculate and normalize the input gradient of each proxy model. Perform weighted fusion of each gradient according to the confidence weight of the proxy model. Apply a global consensus mask constraint after threshold sparsification to the fused gradient. After normalization, obtain the consensus gradient direction to determine the perturbation direction.

[0159] Specifically, after the mask is determined, gradient information is computed in parallel on the multi-proxy model to determine the perturbation direction. For each iteration... , will the current sample Input each proxy model and obtain the gradient of the loss function with respect to the input, as follows:

[0160] ;

[0161] in, For the model The prediction loss function.

[0162] Preferably, to eliminate differences in gradient scales among different models and avoid bias in the dominant model, this embodiment employs a normalization and weighted consensus strategy, that is, to perform normalization and weighted consensus on the gradients of each model. Norm normalization is performed as follows:

[0163] ;

[0164] in, Choose 1 or 2. To prevent division by zero of small constants.

[0165] Subsequently, based on the confidence weights of the proxy model The fusion of gradients can be expressed as:

[0166] ;

[0167] To ensure that the perturbation direction is concentrated in the highly significant region, a mask constraint is applied to the fusion gradient, which can be expressed as:

[0168] ;

[0169] in, This represents element-wise product.

[0170] Finally, normalization is performed again to obtain the consensus gradient direction, which is:

[0171] .

[0172] The gradient fusion process described above ensures that the perturbation direction has consistency in the gradient space among multiple surrogate models, avoiding offset or conflict in a single model direction.

[0173] Step S4: Introduce an iterative update mechanism with momentum constraints, continuously iterate and accumulate gradients to update momentum terms and adversarial examples until the preset conditions are met, and output the final adversarial examples.

[0174] Specifically, a momentum-constrained iterative update mechanism is introduced during the perturbation optimization phase. This mechanism smooths the perturbation update process by accumulating gradient directions, while simultaneously applying perturbation amplitude constraints and smoothing projection operations. This ensures that the generated adversarial examples maintain temporal continuity and physical plausibility under controlled perturbation intensity. This momentum-guided iterative optimization process includes:

[0175] Step S4.1: Introduce an iterative update mechanism with momentum constraints, using momentum terms to represent the cumulative gradient. In each iteration, accumulate the consensus gradient direction of the previous round to update the momentum term of the current round.

[0176] Step S4.2: Update the original power time series data according to the updated momentum term by step size to obtain the updated time series data for the current round, i.e., the updated adversarial sample.

[0177] Specifically, to obtain a smooth and stable perturbation optimization trajectory, this embodiment introduces a momentum-guided update mechanism during the gradient update process. The core idea is to accumulate the gradient direction information from the previous iteration in each iteration to suppress gradient oscillations and accelerate perturbation convergence. Let the momentum term... Indicates the first If the gradient is accumulated over multiple rounds, the update rule is as follows:

[0178] ;

[0179] in, This is the momentum decay coefficient.

[0180] In addition, the formula for updating adversarial examples is:

[0181] ;

[0182] Among them, step size Set as .

[0183] Step S4.3: Apply amplitude constraints and projections to the updated adversarial examples, perform time-series smoothing, and then input them into each proxy model to execute a cyclic iterative update process.

[0184] Specifically, after the update, the disturbance is constrained and projected, which can be expressed as:

[0185] ;

[0186] in, This represents an orthogonal projection onto the constrained sphere. Indicates Center, radius of Constraint sphere. If the disturbance exceeds the constraint range, project it back into the feasible region to control the disturbance amplitude.

[0187] Furthermore, to maintain the smoothness and physical rationality of the time series, this embodiment performs smoothing filtering (such as Gaussian or low-pass filtering) or total variation (TV) regularization constraints on the disturbance components after each update to prevent abnormal jumps or pseudo signals that violate the timing pattern.

[0188] Step S4.4: Continuously iterate until the preset conditions are met, and output the final adversarial sample.

[0189] The updated adversarial examples are input into each proxy model, and the process is repeated iteratively until the number of iterations reaches a preset limit. The optimization process terminates and outputs the final adversarial example when the average model loss improvement falls below a set threshold. And record the perturbation vector. The norm, sparsity, and energy distribution are used for subsequent migration tests.

[0190] Through the above mask fusion and gradient integration design, this embodiment achieves synergistic optimization in two key aspects: attack location and direction determination. On the one hand, the weighted mask based on time-frequency saliency and model sensitivity can accurately characterize the highly vulnerable regions shared across models. On the other hand, the multi-model gradient consensus mechanism based on normalized weighting and momentum constraints effectively suppresses gradient conflicts and local oscillations, ensuring that the perturbation direction maintains high consistency and transferability among different models.

[0191] As another implementation method, this embodiment is also applicable to adversarial example generation in other scenarios such as time-series prediction in road traffic monitoring systems. In this scenario, road traffic monitoring systems continuously generate large amounts of multivariate time-series data. Road network sensors collect road segment traffic state data at fixed time intervals for traffic indicator prediction and scheduling decisions. The acquired time-series data also exhibits significant periodicity and multi-scale variation characteristics. Modeling it using a time-series prediction model allows for prediction of future states. In this scenario, this embodiment uses the publicly available Traffic dataset, a publicly available multivariate time-series dataset for road traffic monitoring. The original data is multivariate traffic time-series data containing 862 variables, corresponding to 862 traffic sensor channels, collected by road network sensors at fixed time intervals. Based on this dataset, adversarial learning examples across models are generated using the method described above in this embodiment.

[0192] To verify the superiority of the proposed method in this embodiment, cross-model attack transfer experiments were conducted on various time series prediction models on the ETTh2 and Traffic datasets. The models used in the experiments included: Long Short-Term Memory (LSTM) network prediction model, Sequence Decomposition-based Transformer prediction model (Autoformer), Temporal Convolutional Network (TCN) prediction model, Decomposed Linear Prediction Model (DLinear), and Sparse Attention Transformer prediction model (Informer). When the attack model was LSTM, the ensemble model was another model that did not contain LSTM, and so on. Several existing adversarial example generation methods (i.e., attack methods), such as Fast Gradient Signed Attack (FGSM), Basic Iterative Attack (BIM), Momentum Iterative Fast Gradient Signed Attack (MI-FGSM), and Input Diversified Fast Gradient Signed Attack (DI-FGSM), were compared and verified with the proposed method (OUR). The experimental results are shown in Tables 1 and 2 below.

[0193] Table 1. Cross-model attack transfer success rate (%) for different methods on the ETTh2 dataset.

[0194]

[0195] Table 2. Cross-model attack migration success rate (%) for different methods on the Traffic dataset.

[0196]

[0197] Experimental results show that the method proposed in this embodiment can significantly improve the success rate of migration attacks on a variety of time series prediction models, and can still maintain a high prediction error improvement effect under the same perturbation budget or limited perturbation amplitude conditions.

[0198] Example 2

[0199] This embodiment provides a temporal adversarial example generation system with co-constraints on perturbation direction and position, specifically including:

[0200] The data acquisition and model building module is used to acquire and preprocess the raw multivariate time series data of power equipment monitoring, build a model set containing multiple time series prediction models, and select several surrogate models.

[0201] The mask construction module is used to perform time-frequency analysis on the preprocessed time-series data by combining Fourier transform and continuous wavelet transform, extract significant energy regions, and construct a time-frequency saliency mask.

[0202] The consensus gradient construction module is used to input preprocessed time series data into each proxy model, calculate the prediction error and input gradient respectively, obtain the sensitivity vector of each proxy model, and then fuse it with the time-frequency saliency mask after weighted fusion to generate a personalized mask. The gradient of each proxy model is calculated in parallel, and personalized mask constraints are applied after weighted fusion to obtain the consensus gradient direction.

[0203] The momentum optimization and adversarial example generation module introduces an iterative update mechanism for momentum constraints, continuously accumulating gradients to update the momentum term and adversarial examples until preset conditions are met, and then outputs the final adversarial examples.

[0204] Example 3

[0205] This embodiment provides an electronic device, including: a memory for storing executable instructions; and a processor for executing the executable instructions stored in the memory to implement the method provided in this embodiment.

[0206] Example 4

[0207] This embodiment also provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, will cause the processor to execute the method described above in this embodiment.

[0208] Example 5

[0209] This embodiment provides a computer program product including executable instructions, which are computer instructions; the executable instructions are stored in a computer-readable storage medium. When the processor of an electronic device reads the executable instructions from the computer-readable storage medium and executes the executable instructions, the electronic device performs the method described in this embodiment.

[0210] The steps and methods involved in Embodiments 2 to 5 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0211] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0212] The above description is only a preferred embodiment of the present invention. Although the specific implementation of the present invention has been described in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative effort are still within the scope of protection of the present invention.

Claims

1. A timing adversarial sample generation method with disturbance direction and position coordination constraint, characterized in that, The application relates to a power equipment adversarial sample generation method based on time-frequency saliency and sensitivity fusion. The method comprises the following steps: acquiring and preprocessing raw multivariate time series data of power equipment monitoring, constructing a model set containing multiple time series prediction models, and selecting several proxy models; performing time-frequency analysis on the preprocessed time series data by combining Fourier transform and continuous wavelet transform, extracting significant energy regions, and constructing a time-frequency saliency mask; inputting the preprocessed time series data into each proxy model, respectively calculating prediction errors and input gradients, obtaining sensitivity vectors of each proxy model, fusing the sensitivity vectors after weighted fusion, and fusing the time-frequency saliency mask to generate a personalized mask, and calculating the gradient of each proxy model in parallel, then applying the personalized mask constraint after weighted fusion to obtain a consensus gradient direction; an iterative updating mechanism with momentum constraint is introduced, the gradient is iteratively accumulated to update the momentum term and the adversarial sample until the preset condition is met, and finally the final adversarial sample is output; wherein the construction of the time-frequency saliency mask comprises: performing fast Fourier transform on the preprocessed power time series data to obtain a period energy spectrum, and screening the first K significant periods with the highest energy amplitude; the preprocessing comprises standardization processing and window division; performing continuous wavelet transform on the preprocessed power time series data to obtain an energy distribution matrix, and extracting energy curves corresponding to each significant period; based on the energy curve of each significant period, a dynamic threshold is determined according to the mean and standard deviation of the energy sequence, the continuous time interval with energy higher than the threshold is identified, and the comprehensive score of the fusion energy intensity and the continuous time length is calculated; the overlapping intervals between different significant periods are fused and the comprehensive score is recalculated, the minimum number of intervals covering a preset proportion of the total energy is screened, the time-domain saliency mask is constructed according to the interval set obtained by screening, and the time-frequency saliency mask is obtained after Gaussian smoothing and normalization processing; the process of obtaining the sensitivity vector comprises: inputting the preprocessed power time series data into each proxy model to obtain the prediction value corresponding to the output, and calculating the mean square error of the prediction value and the true value; for each proxy model, two types of sensitivity indexes are calculated by using residual sensitivity method and gradient sensitivity method respectively, the two types of indexes are weighted and fused by using a balance coefficient to obtain the comprehensive sensitivity of a single model, and the sensitivity vector is obtained after normalization processing; wherein the residual sensitivity method is used to calculate the sensitivity index, that is, the absolute value of the prediction residual of each time step is calculated to obtain the residual sensitivity index value based on the prediction deviation; the gradient sensitivity method is used to calculate the sensitivity index, that is, the partial derivative of the loss function to the input is obtained by back propagation, and the norm is taken as the gradient sensitivity index value; based on the prediction performance indexes of the validation set of each proxy model, the confidence weight is calculated, the sensitivity vectors of all proxy models are weighted and fused according to the confidence weight, and finally the sensitivity vector of the global model is obtained; the cooperative determination of the perturbation position and direction comprises: the time-frequency saliency vector and the sensitivity vector of each proxy model are weighted and fused respectively to generate a personalized mask; the global consensus mask is obtained by weighting and integrating the personalized masks according to the confidence weight of the proxy model to determine the perturbation position, and the global consensus mask is subjected to threshold sparsification processing. The input gradient of each agent model is calculated and normalized, the global consensus mask constraint is applied to the fused gradient after weighted fusion according to the confidence weight of the agent model, and the consensus gradient direction is obtained after normalization to determine the perturbation direction.

2. The method of claim 1, wherein the perturbation direction and position co-constrained timing adversarial sample generation method is characterized by, The momentum-guided iterative optimization process is: An iterative update mechanism with momentum constraint is introduced, and the cumulative gradient is represented by a momentum term, which accumulates the consensus gradient direction of the previous round in each iteration to update the momentum term of the current round; According to the updated momentum term, the original power time series data is updated by a step size to obtain the updated time series data of the current round, i.e. the updated adversarial sample; The amplitude constraint and projection are applied to the updated adversarial sample, and the time series smoothing processing is performed before inputting the updated adversarial sample into each agent model for cyclic iterative update process; The cyclic iteration is continuously performed until the preset condition is met, and the final adversarial sample is output.

3. A system for generating timing adversarial samples with perturbation direction and position collaborative constraints, which implements the method for generating timing adversarial samples with perturbation direction and position collaborative constraints according to any one of claims 1-2, characterized in that, It includes: A data acquisition and model construction module is used to acquire and preprocess the original multivariate time series data monitored by the power equipment, construct a model set containing multiple time series prediction models, and select several agent models; A mask construction module is used to perform time-frequency analysis on the preprocessed time series data by combining Fourier transform and continuous wavelet transform, extract significant energy regions, and construct time-frequency significance masks; A consensus gradient construction module is used to input the preprocessed time series data into each agent model, calculate the prediction error and input gradient respectively, obtain the sensitivity vector of each agent model, fuse the weighted fusion with the time-frequency significance mask to generate a personalized mask, and calculate the gradient of each agent model in parallel, apply the personalized mask constraint after weighted fusion to obtain the consensus gradient direction; A momentum optimization and adversarial sample generation module is used to introduce an iterative update mechanism with momentum constraint, and the momentum term and adversarial sample are updated by continuously iterating the cumulative gradient until the preset condition is met, and the final adversarial sample is output.

4. An electronic device, comprising: It includes: A memory for storing executable instructions; A processor for executing the executable instructions stored in the memory to implement the time series adversarial sample generation method with perturbation direction and position collaborative constraint according to any one of claims 1-2.

5. A computer readable storage medium, characterized in that, The computer program product includes executable instructions stored in a computer readable storage medium; 6. A computer program product, characterised in that, When the processor of the electronic device reads the executable instructions from the computer readable storage medium and executes the executable instructions, the time series adversarial sample generation method with perturbation direction and position collaborative constraint according to any one of claims 1-2 is implemented. The computer program product includes executable instructions stored in a computer readable storage medium; When the processor of the electronic device reads the executable instructions from the computer readable storage medium and executes the executable instructions, the time series adversarial sample generation method with perturbation direction and position collaborative constraint according to any one of claims 1-2 is implemented.

Images