Physical AI virus identification method based on Bayesian neural network

Abstract

The invention provides a physical AI virus identification method and system based on a Bayesian neural network, and belongs to the technical field of network security. According to the method, aiming at the fact that a target recognition object is a physical AI virus (including a physical confrontation sample, a physical backdoor, an unknown physical domain AI virus and the like), the physical confrontation sample is taken as an example, and the confrontation sample and a clean sample collected in a physical real world are creatively adopted to construct a training data set. According to the recognition framework provided by the invention, a multi-modal data fusion mechanism under simulation of real environment disturbance is utilized, higher robustness and generalization ability are shown in a complex physical scene, and AI viruses such as physical adversarial samples in the real world can be better recognized.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a physical AI virus identification method based on a Bayesian neural network. BACKGROUND

[0002] With the deep penetration of artificial intelligence technology into the physical space, physical intelligence (Physical AI) is becoming the core direction of the development of the next generation of AI, and physical AI viruses have also quietly emerged, such as physical adversarial samples, physical backdoors and some other new threats in the real physical world with attack functions. Existing research shows that such new physical AI viruses such as physical adversarial samples and physical backdoors have multi-modal cooperative adversarial attacks (can simultaneously interfere with multi-spectral perception such as visible light, infrared, radar, etc.), environmental fusion concealment (the disturbance mode is highly consistent with natural physical phenomena), and strong induced deception (can cause target misidentification or system failure), which has posed a serious threat to our intelligent sensing equipment.

[0003] The identification of physical AI viruses, taking the identification of physical adversarial samples as an example, is to analyze the differences between normal samples and adversarial samples in a deep neural network, and to propose two types of detection paradigms, namely unsupervised and supervised detection.

[0004] Unsupervised detection methods do not need to rely on prior knowledge of adversarial samples and mainly realize detection based on statistical differences in data distribution or model behavior. Among them, statistical methods mine the inherent characteristics of adversarial samples, such as: adversarial samples show a more uniform trend in the variance of principal component whitening input coefficients and the Softmax probability distribution; the difference in label change rate in model mutation test is used to set a detection threshold; the similarity score of the intermediate layer activation state with normal samples is calculated to quantify the anomaly. Noise reduction techniques separate adversarial disturbances by suppressing input noise, and representative methods include compressed prediction difference detection, reconstruction error analysis based on noise reduction autoencoder, and adaptive noise reduction strategy combined with scalar quantization and image entropy, but such methods may cause feature distortion due to noise reduction operations. The generated adversarial network (GAN) realizes detection by approximating the normal data distribution, such as Defense-GAN and GANomaly, but its training complexity is high and the generated samples are easy to distort. Neural network characteristic analysis focuses on the internal behavior of the model, uses a Gaussian mixture model to fit the hidden layer activation distribution, and captures anomalies by constraining the activation value interval. The feature alignment method is represented by UnMask, which realizes detection by comparing the semantic consistency of input features and predicted labels, but it relies on labeled data and has limited cross-scene generalization. Although unsupervised methods avoid the need for adversarial sample labeling, they rely on threshold setting or prediction inconsistency, and face challenges such as noise reduction distortion and poor generalization of feature alignment.

[0005] Supervised detection methods construct detectors by jointly training normal samples and adversarial samples, which can be further divided into three categories: statistical modeling, adversarial training, and neural network feature mining. In the statistical method, the detector is trained based on the difference in Logits reconstruction error, combined with kernel density estimation and Bayesian uncertainty analysis manifold deviation, and the distribution shift is captured by the Logits Gaussian regression model. Adversarial training methods learn differences by constructing special detection networks, such as adding N+1 class labels to adversarial samples in classification networks, designing global or classification-aware binary classification networks, and dynamically training detection networks using DNN intermediate layer outputs. Such methods rely on network representation capabilities but have limited generalization. Neural network feature mining focuses on the difference in model internal behavior, encodes ReLU activation into SVM detectors, and identifies abnormal samples through spatial encoding of neuron activation trajectories. Although supervised methods can use prior knowledge of adversarial samples to optimize detection performance, they need to balance the generalization ability for unknown attacks, and the design of detection networks needs to consider efficiency and robustness.

[0006] Currently, the defense technology of physical AI viruses still mainly focuses on the identification and elimination of adversarial samples in the digital domain, while the defense technology of multi-modal physical AI viruses facing the real physical world is still in its infancy.

[0007] IRD algorithm detects adversarial samples from the generation of corresponding adversarial samples from normal samples. Normal samples Xn can be correctly classified by classifier M, and Xa is the corresponding adversarial sample generated by attack algorithm A with different perturbations ɛ in the training batch N. First, the samples Xn and Xa are preprocessed into size images, and the reconstruction difference features R(Xn) and R(Xa) based on VIF, UQI, and RASE are obtained by compressing and reconstructing Xn and Xa using the Com-Rec network model trained with normal samples Xn. Then, the feature value standardization operation (i.e., Min-Max standardization) is performed, and the labels of normal samples Xn and adversarial samples Xa are divided into 1 and 0. The random forest binary classifier is used to distinguish between adversarial samples and normal samples to achieve the purpose of detecting adversarial samples. If the predicted label of IRD is 0, the sample is an adversarial sample, otherwise it is a normal sample.

[0008] As shown in Figure 1 , the Com-Rec network is an end-to-end image compression and reconstruction network composed of ComCNN and RecCNN. First, the input sample X is processed into size image Xo, then the features of the preprocessed image are extracted using ComCNN and 256 feature maps are generated, and the 24-bit pixel image is compressed to 12 bits by reducing and enhancing the feature maps. The resulting feature maps are the main structural information of the image. RecCNN reconstructs the 12-bit pixel features extracted by ComCNN into The IRD extracts the 12-bit pixel features of the normal samples and the adversarial samples as much as possible by using different Com-Rec networks for color images and black-and-white images and training the networks on normal samples, so that the ComRec network can eliminate most of the adversarial perturbations in the adversarial samples, and further amplify the different reconstruction differences between the normal samples and the adversarial samples caused by compression reconstruction.

[0009] IRD uses the features of the reconstructed images of clean samples and adversarial samples (normal data and abnormal data disturbed by physical AI viruses) to distinguish them. This method has been successful on the MNIST dataset, and can identify adversarial samples with a lower false rejection rate. However, a significant disadvantage of the IRD algorithm is that a new binary classification model needs to be trained for different adversarial samples, which greatly limits its generalization ability. Secondly, the adversarial sample recognition of IRD is mainly for the digital domain, and cannot be migrated to the recognition of physical domain adversarial samples. SUMMARY

[0010] To solve the above technical problems, the present application discloses a physical AI virus recognition method based on a Bayesian neural network. The method comprises: Step S1, based on the difference between the physical AI virus data samples and the clean samples in the hidden layer output distribution in the deep neural network DNN, the parameter randomness of the Bayesian neural network BNN is used to amplify the distribution difference, and the uncertainty of the weight distribution modeling is used to capture the distribution difference; Step S2, define the distribution difference measure, quantify the hidden layer output difference between the physical AI virus data samples and the clean samples by the distribution distance measure, for each test sample, calculate the distance between its hidden layer output distribution and the hidden layer distribution of the same type of training sample; Step S3, extract multi-level distribution difference, calculate the distribution difference score on multiple hidden layers respectively, form a set of difference score sets {d_j | j∈S}, d_j is the jth difference score, and S is the selected hidden layer index; Step S4, construct a binary classifier, train the binary classifier based on the multi-layer distribution difference score, distinguish the physical AI virus data samples and the clean samples, and the binary classifier learns the threshold mode of the difference score, and performs end-to-end detection; Step S5, perform detection in the test phase, including multiple forward propagation, distribution modeling, difference score calculation, and classification decision.

[0011] In the method, the parameter randomness of the Bayesian neural network BNN is used to amplify the distribution difference, and the uncertainty of the weight distribution modeling is used to capture the distribution difference; wherein: Set observable random variables (x, y), x represents input, y represents label, estimate the distribution of hidden variable w using BNN, estimate the posterior of weight p(w|x, y) based on prior p(w), the true posterior is represented by parameter distribution q θ (w) to represent, unknown parameter theta is estimated by minimizing KL divergence; KL(q θ (w)||p(w|x,y)) Where q θ is a fully factored Gaussian distribution:

[0012] Where mu and s are parameters of weight Gaussian distribution, the objective function of training BNN is:

[0013] Where D represents data distribution.

[0014] In the method: Given input x and binary classifier f(·), the prediction of binary classifier is:

[0015] Where the predicted label is the label with the highest prediction score, the target of attacker is to interfere with original input to change the predicted label:

[0016] Where delta represents the disturbance added to the original input; The output distribution of hidden layer DNN is used as the empirical distribution of all neuron values of the layer, a one-dimensional histogram is drawn using all output values of the layer to simulate the distribution of the hidden layer; the same method is used for BNN to estimate the output distribution of the hidden layer.

[0017] In the method: The randomness is used to expand the distribution difference between the outputs of the hidden layer, given f(x, w) is a model with x ~ Dx and w ~ Dw, Dw is an arbitrary distribution satisfying w ~ w0 = E[w] symmetry, and, N(w0, I), With first-order Taylor expansion at w0, there is:

[0018] Where delta represents the adversarial disturbance, D represents the distance measurement distribution dispersion that is translation invariant.

[0019] In the method: The adversarial sample is identified by distribution distance, the dispersion between the output distribution of the extracted data feature layer Backbone layer of the adversarial sample and the clean sample input is measured, and the dispersion is used to detect the adversarial sample; Given an input x and the predicted label c of the input x, the distribution distance between the Backbone layer output distribution of x and the Backbone layer output distribution corresponding to the c-class training sample is measured:

[0020] Wherein, Bj (x) represents the jth layer output distribution based on x, represents the jth layer output distribution based on the c-class training sample, n c The number of c-class training samples, for the dispersion measurement, the dispersion is estimated by the 1-Wasserstein distance.

[0021] In the method: The hidden layer output distribution is estimated by the one-dimensional empirical distribution of all output values of the layer, and the estimated hidden layer output distribution of the training sample of each class is There are multiple samples for each class. In the test phase, only one test sample is used to simulate Bj (x), and for the BNN, the output of the hidden layer is random, which is used to simulate the distribution of multiple channels. The dispersion is measured on multiple hidden layers, and a set of difference scores {d_j | j∈S} is generated as the dispersion score, and a binary classifier is trained on the discrete score to detect the adversarial sample.

[0022] The detection of the test phase includes specifically: Multiple forward propagation: the test data sample is passed through the BNN multiple times, and the distribution estimation of the hidden layer output is generated by using the weight randomness; Distribution modeling: the hidden layer output empirical distribution of the test sample is constructed according to the multiple forward results; Difference score calculation: the difference score of each layer is obtained by comparing the hidden layer distribution of the same class training sample; Classification decision: the difference score is input into the classifier, and the determination result of the physical AI virus data sample or the clean data sample is output.

[0023] The present application aims at the target recognition object being a physical AI virus (including physical adversarial samples, physical backdoors, unknown physical domain AI viruses, etc.), and innovatively uses the physical adversarial samples and clean samples collected in the physical real world to construct a training data set. The recognition framework proposed in the present application uses a multi-modal data fusion mechanism to simulate the disturbance in the real environment, and exhibits stronger robustness and generalization ability in a complex physical scene, and can better identify physical adversarial samples and other AI viruses in the real world.

[0024] Compared with the prior art, the application innovatively uses clean samples and adversarial samples collected in the physical real world to construct a training data set, and the detection framework proposed exhibits stronger robustness and generalization ability in a physical adversarial scene through a multi-modal data fusion mechanism simulating real environment disturbance. Experiments show that the method can achieve high detection recall rate and low false detection rate for adversarial samples generated by inherent interference in the physical space such as sensor noise and illumination changes, and the performance is improved by 23.8 percentage points compared with the traditional digital adversarial detection scheme, effectively solving the detection problem of strong concealment and complex feature shift of adversarial samples in real scenes. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the drawings needed in the description of the specific embodiments or the prior art will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0026] Figure 1 IRD framework schematic diagram for adversarial sample detection method in the prior art.

[0027] Figure 2 Flowchart of the physical AI virus identification method based on the Bayesian neural network according to the embodiment of the present application.

[0028] Figure 3 Flowchart of the physical AI virus identification method based on the Bayesian neural network according to the embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0030] This invention proposes a physical AI-based virus identification method based on stochastic Bayesian Neural Networks (BNNs), leveraging the stochasticity of BNNs to improve detection performance. The specific theory is as follows: given an observable random variable (x, y), the goal of the BNN is to estimate the distribution of the hidden variable w, rather than estimating the maximum likelihood (MLE) of the weights w. From a Bayesian perspective, each parameter is now a random variable measuring the estimation uncertainty, thus the model can potentially extract more information to support better predictions (in terms of accuracy, robustness, etc.). Given input x and label y, the goal of the BNN is to estimate the posterior of the weights p(w|x, y) given the prior p(w). The true posterior can be represented by the parameter distribution q. θ (w) is used to approximate the unknown parameter θ by minimizing the KL divergence.

[0031] KL(qθ(w)||p(w|x,y)) (1) For simplicity, θ is usually assumed to be q. θ It is a perfectly factored Gaussian distribution: (2) Where μ and s are the parameters of the Gaussian distribution of the weights. The objective function for training the BNN is restated from equation (1) as shown in equation (3), which is the sum of the data dependency part and the regularization part: (3) In the equation, D represents the data distribution. In the first term of objective (3), the probability of yi given xi and weights is the output of the model. This part represents the classification loss. The second term of equation (3) attempts to minimize the discrepancy between the prior and parameter distributions, which can be seen as regularization.

[0032] First, we analyze the motivation behind the proposed method: 1. When faced with normal data and anomalous data interfered with by physical AI viruses, taking clean samples and adversarial samples as examples, the distribution of hidden layer neurons in deep neural networks may differ; 2. This dispersion is more pronounced in Bayesian neural networks than in deep networks; 3. Random components more easily simulate the distribution of hidden layer outputs. Then, we introduce a specific metric to measure this distributional difference and extend the detection method to multiple layers, making it more resistant to physical AI virus attacks.

[0033] Motivation for setting this up: Given an input x and a classifier f(·), the classifier's prediction is denoted as:

[0034] In other words, the predicted label is the label with the highest prediction score. The attacker's goal is to perturb the original input to change the predicted label. (4) Here, δ represents the perturbation applied to the original input. The attacker's goal is to find a small δ (typically located within a small...). The hidden layer output (within the norm sphere) is used to successfully alter the model's predictions. Therefore, given the same predicted label, the hidden layer outputs may have different distributions between adversarial examples and clean samples. For example, an adversarial example misclassified as an airplane might have a different hidden layer output distribution than a clean airplane image. Here, we define a hidden layer output distribution DNN as an empirical distribution of all neuron values ​​in that layer, meaning that a one-dimensional histogram will be plotted using all output values ​​of that layer to model the hidden layer distribution. A similar approach is used to estimate the hidden layer output distribution for BNNs. However, in BNNs, since the weights are randomized, the same input is forwarded multiple times to better estimate the output distribution.

[0035] Theoretical analysis shows that randomness can help amplify the distributional differences between natural and adversarial hidden layer outputs. Proposition 1: Let f(x, w) be a model with x ~ Dx and w ~ Dw, where Dw is an arbitrary distribution of w symmetric about w0 = E[w], such as N(w0, I). If We can approximate this using a first-order Taylor expansion at w0, then we have: (5) Here, δ represents the adversarial perturbation, and D represents the translation-invariant distance measurement distribution diffusion. The inequality shows that the randomness of the parameters amplifies the distributional difference between clean and adversarial sample outputs. Therefore, utilizing the distributional difference of the hidden layer outputs of a BNN to detect adversarial examples is a wise choice.

[0036] Next, adversarial examples are identified through distribution distance. The project proposes measuring the dispersion between the output distribution of the Backbone layer of the extracted data feature layer for adversarial and clean sample inputs, and using this property to detect adversarial examples. Specifically, given an input x and its predicted label c, the distribution distance is measured between the Backbone layer output distribution of x and the Backbone layer output distribution corresponding to the training samples of class c: (6) Where Bj(x) represents the output distribution of the j-th layer based on the test sample x. Let n represent the output distribution of the j-th layer based on training samples of class c, where n is the number of layers. c Let be the number of training samples of class c, and D can diverge arbitrarily. For simplicity, the rest... Replace with In addition, n c It is not necessarily the total number of training samples of class c. In our experiment, n cThis is only a small subset of samples drawn from the training samples of class c. For the measure of divergence, we used the 1-Wasserstein distance to estimate the divergence in our experiments. However, other divergence measures, such as the Kullback-Leibler divergence, can also be used.

[0037] The hidden layer output distribution is estimated from the one-dimensional empirical distribution of all output values ​​of that layer. The hidden layer output distribution estimated from the training samples of each class ( The dispersion can be easily simulated because there are multiple samples for each class. However, during the testing phase, only one test sample x is available to simulate Bj(x). For deep neural networks without random components, the hidden layer outputs are deterministic, so the simulation results depend on a single forward pass. For BNNs, the hidden layer outputs are random, allowing the simulation of distributions across multiple channels. To aggregate information from different layers, dispersion is measured across multiple hidden layers, generating a set of dispersion scores {dj|j∈S}, where S is the index set of the selected hidden layers. It is expected that natural inputs will have smaller dispersion scores, while adversarial examples will have relatively larger dispersion scores. A binary classifier is trained on the discrete scores to detect adversarial examples. A binomial logistic regression model can be fitted for binary classification. An overview of the test-time detection framework is as follows: Figure 2 As shown.

[0038] The innovation of this invention compared to previous work lies in three aspects: First, it theoretically reveals the enhancing effect of BNN randomness on the distribution differences of hidden layers; second, it proposes a lightweight detection architecture based on multi-layer distribution fusion, breaking through the dependence of traditional methods on single-layer features; third, it achieves a balance between the accuracy and computational cost of physical AI virus identification, providing a feasible solution for the deployment of practical safety-critical systems. Future research can further explore the adaptability of different distribution measurement methods and the impact of BNN prior distribution selection on identification performance. The specific operation steps are as follows: Step S1, Motivation for Analysis: It was observed that the distribution of physical AI virus data samples and clean samples differed in the hidden layer outputs of a deep neural network (DNN). A Bayesian neural network (BNN), due to the randomness of its parameters, could further amplify this distributional difference. BNN models uncertainty through weight distribution, providing more information to capture these distributional differences.

[0039] Theoretical analysis demonstrates that the randomness of the weights in a BNN can amplify the difference in the output distribution of physical AI virus data samples and clean samples in the hidden layer. For example, abnormal perturbations, under the influence of random weights, can lead to a more significant shift in the output distribution, providing a basis for identification.

[0040] Step S2, Define the distribution difference metric: Select a distribution distance metric (such as 1-Wasserstein distance or KL divergence) to quantify the difference in hidden layer outputs between physical AI virus data samples and clean samples. For each test sample, calculate the distance between its hidden layer output distribution and the hidden layer distribution of similar training samples.

[0041] Step S3, Multi-level Distribution Difference Extraction: Calculate the distribution difference scores on multiple hidden layers to form a set {d_j | j∈S} (S is the index of the selected hidden layer). Natural samples have smaller difference scores, while physical AI virus data samples have larger difference scores. Fusing multi-level information enhances detection robustness.

[0042] Step S4, Construct a binary classifier: Train a binary classifier (such as a logistic regression model) based on multi-level distribution difference scores to distinguish between physical AI virus data samples and clean samples. The classifier learns threshold patterns for difference scores to achieve end-to-end detection.

[0043] Step S5, Testing Phase Detection Process: 1. Multiple forward propagation: The test data samples are passed through the BNN multiple times, and the distribution estimate of the hidden layer output is generated by using the randomness of the weights.

[0044] 2. Distribution modeling: Construct the empirical distribution of the hidden layer output of the test samples based on multiple forward pass results.

[0045] 3. Calculate the difference score: Compare the hidden layer distribution with the same training samples to obtain the difference score of each layer.

[0046] 4. Classification decision: Input the difference score into the classifier and output the judgment result of physical AI virus data sample or clean data sample.

[0047] like Figure 3 As shown, this invention selects a set of typical physical AI adversarial attack cases for method verification. Taking vehicle recognition in an autonomous driving scenario as an example, the original clean sample is a gray sedan without special paint, and the target recognition model can accurately identify its bounding box and category label (confidence level of 98.7%). Through a physical adversarial attack algorithm based on optimization iteration, a pattern with high-frequency texture features and physical adversarial samples is generated. This pattern can reduce the vehicle detection confidence level to 12.5% ​​in digital simulation. Subsequently, the physical adversarial samples are reproduced on the surface of a real vehicle using a high-precision inkjet printing process, and measured images are collected under multiple lighting conditions and multiple shooting angles. Experiments show that vehicles with physical adversarial samples can cause the target recognition model to have a false detection rate of up to 83.2%, seriously threatening the environmental perception capability of the intelligent driving system.

[0048] This invention constructs an end-to-end physical AI virus identification system: After an in-vehicle sensor captures an image, it is first input into the BNN adversarial detection module designed in this invention. This module generates a multi-dimensional output distribution of the input sample in key network layers such as convolutional layers and residual layers through hierarchical feature extraction and probabilistic inference. Specifically, the BNN performs 32 random forward propagations on the same image, statistically analyzes the activation value distribution of neurons in each hidden layer, and constructs a hybrid probabilistic representation covering texture, contour, and semantic features. Subsequently, the 1-Wasserstein distance between the output distribution of the test sample at each layer and the reference distribution of similar clean samples (pre-stored in the feature library) is calculated. The difference scores of each layer are fused through a cross-layer attention weighting mechanism to form a comprehensive anomaly index. Finally, a logistic regression classifier trained on a large-scale physical adversarial sample dataset determines whether the input is a physical AI virus (physical adversarial sample) based on the fused score. Actual test data shows that the method has a recognition rate of over 90% for physical adversarial vehicles, and the probability of misjudging normal vehicles as adversarial vehicles with physical adversarial samples is less than 5%. Moreover, the processing latency of a single frame image is controlled within 30ms, which meets the real-time requirements of the vehicle system.

[0049] In summary, this invention proposes an adversarial example detection method based on Bayesian Neural Networks (BNNs). Through randomized weight modeling and hidden layer distribution difference analysis, it efficiently identifies adversarial attacks in real-world physical scenarios. Compared to traditional deterministic neural networks, BNNs treat weights as probability distributions, utilize a Bayesian framework to learn the posterior distribution of parameters, and enhance the model's sensitivity to adversarial perturbations by optimizing the classification loss and distribution regularization term. Theoretical analysis shows that the randomness of BNN weights can significantly amplify the distribution difference between adversarial and clean samples in the hidden layer output, especially when small perturbations are superimposed on the input; its distribution shift far exceeds that of deterministic models.

[0050] This method consists of three stages: First, during the training phase, a one-dimensional empirical distribution of the hidden layer output is constructed based on clean samples of each class as a reference template. Second, during testing, multiple random forward propagations are used to generate multi-layer output distributions of the input samples, and the 1-Wasserstein distance between these distributions and the reference distributions of the same class is calculated, aggregating multi-layer difference scores. Finally, a logistic regression classifier is used to determine adversarial examples based on the difference scores. Addressing complex factors such as sensor noise and illumination interference in physical scenarios, this method achieves a detection rate of 97.6% and a false detection rate of 1.3% on real datasets through multi-level feature fusion and lightweight distribution modeling, representing a 23.8% performance improvement over traditional digital detection schemes. Furthermore, it requires only a small number of samples to construct a robust reference distribution. Its core innovation lies in leveraging the randomness of BNNs to overcome the representational bottleneck of deterministic models, and combining multi-layer distribution differences to enhance the generalization ability in complex scenarios, providing an efficient and low-cost solution for fields prone to physical adversarial attacks, such as autonomous driving and industrial inspection.

[0051] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A physical AI virus recognition method based on a Bayesian neural network, characterized in that, The method comprises: Step S1, based on the difference between the physical AI virus data sample and the clean sample in the hidden layer output distribution in the deep neural network DNN, the parameter randomness of the Bayesian neural network BNN is used to amplify the distribution difference, the uncertainty of the weight distribution is modeled to capture the distribution difference; Step S2, define the distribution difference measure, quantify the hidden layer output difference between the physical AI virus data sample and the clean sample by the distribution distance measure, for each test sample, calculate the distance between its hidden layer output distribution and the hidden layer distribution of the same type of training sample; Step S3, extract the multi-level distribution difference, calculate the distribution difference score on multiple hidden layers respectively, form a set of difference scores {d_j | j∈S}, d_j is the jth difference score, and S is the selected hidden layer index; Step S4, construct a binary classifier, train a binary classifier based on the multi-layer distribution difference score to distinguish between physical AI virus data samples and clean samples, and the binary classifier learns the threshold mode of the difference score for end-to-end detection; Step S5, perform detection in the test phase, including multiple forward propagation, distribution modeling, difference score calculation, and classification decision. 2.The physical AI virus identification method based on Bayesian neural network according to claim 1, wherein, In the method, the parameter randomness of the Bayesian neural network BNN is used to amplify the distribution difference, and the uncertainty of the weight distribution is modeled to capture the distribution difference; wherein: Set the observable random variables (x, y), x represents the input, y represents the label, estimate the distribution of hidden variables w using BNN, estimate the posterior of weight p(w|x, y) based on the prior p(w), the true posterior is represented by the parameter distribution q θ (w); the unknown parameter θ is estimated by minimizing the KL divergence; KL(q θ (w)||p(w|x,y)) where q θ is a full factorized Gaussian distribution: ， Where μ and s are the parameters of the weight Gaussian distribution, and the objective function for training the BNN is: ， Where D represents the data distribution. 3.The physical AI virus identification method based on Bayesian neural network according to claim 2, wherein, In the method: Given an input x and a binary classifier f(·), the prediction of the binary classifier is: ， Where the predicted label is the label with the highest prediction score, and the attacker's goal is to interfere with the original input to change the predicted label: ， Where δ represents the perturbation added to the original input; The output distribution DNN of the hidden layer is the empirical distribution of all neuron values of the layer, and a one-dimensional histogram is drawn using all output values of the layer to simulate the distribution of the hidden layer; the same method is used for BNN to estimate the output distribution of the hidden layer.

4. The physical AI virus identification method based on the Bayesian neural network according to claim 3, characterized in that, In the method: The randomness is used to enlarge the distribution difference between the hidden layer outputs. Given f(x, w) is a model with x ~ Dx and w ~ Dw, Dw is an arbitrary distribution satisfying w ~ w0 = E[w] symmetry, and N(w0, I), With the first-order Taylor expansion at w0, we have: ， Where δ represents the adversarial perturbation, and D represents the distance measure distribution dispersion that is translation invariant.

5. The physical AI virus identification method based on Bayesian neural network according to claim 4, characterized in that, In the method: The adversarial sample is identified by the distribution distance, the dispersion between the output distribution of the extracted data feature layer Backbone layer of the adversarial sample and the clean sample input is measured, and this characteristic is used to detect the adversarial sample; Given an input x and the predicted label c of the input x, the distribution distance between the Backbone layer output distribution of x and the Backbone layer output distribution corresponding to the c type training sample is measured: ， where Bj(x) represents the j-th layer output distribution based on x, denotes the j-th layer output distribution based on the c-th training sample, n c is the number of c-class training samples, and the divergence is estimated by 1-Wasserstein distance for the divergence measure.

6. The physical AI virus identification method based on the Bayesian neural network according to claim 5, wherein, In the method: The hidden layer output distribution is estimated by the one-dimensional empirical distribution of all output values of the layer, and the estimated hidden layer output distribution of each class is There are multiple samples for each class. In the test phase, only one test sample is used to simulate Bj(x), and for the BNN, the output of the hidden layer is random, which is used to simulate the distribution of multiple channels; The dispersion is measured on multiple hidden layers to generate a set of difference scores {d_j | j∈S} as dispersion scores, and a binary classifier is trained on the discrete scores to detect adversarial samples.

7. The physical AI virus identification method based on the Bayesian neural network according to claim 6, characterized in that, The detection in the test phase specifically comprises: Multiple forward propagation: pass the test data sample through the BNN multiple times, and use the weight randomness to generate the distribution estimate of the hidden layer output; Distribution modeling: build the empirical distribution of the hidden layer output of the test sample according to multiple forward results; Calculate difference scores: compare the hidden layer distribution of the test sample with the hidden layer distribution of the same kind of training sample to obtain the difference scores of each layer; Classification decision: input the difference scores into the classifier to output the judgment result of the physical AI virus data sample or the clean data sample.

Images