A power distribution network black box adversarial sample generation method based on large language model topology reasoning guidance

Abstract

The application discloses a power distribution network black box confrontation sample generation method based on a large language model topology reasoning guide, which comprises the following steps: determining an attack target of a scheduling task, quantifying a destructive intention of an attacker, and converting a fuzzy attack target into a multi-target attack loss function; using general knowledge and reasoning ability of the large language model, screening out key nodes with the highest attack cost performance, and obtaining a mask vector; under the constraint of the mask vector, generating a specific disturbance vector for a continuous domain or a discrete domain; and performing sample verification. The application introduces a large language model as a topology cognition engine, uses semantic reasoning ability of the large language model to screen out key fragile nodes in a power distribution network, generates an attack mask, and guides a black box optimizer to lock a key subspace through the mask, so that high-quality confrontation samples covering multiple attack targets and action domain types are efficiently generated without accessing an internal structure of the model, and rich robustness training data is provided for intelligent agents.

Description

Technical Field

[0001] This invention relates to the field of power distribution networks, and in particular to a method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model. Background Technology

[0002] With the widespread deployment of deep reinforcement learning (DRL) in the scheduling and control of new power distribution networks, agents can autonomously learn optimal strategies for voltage control and network reconfiguration based on environmental conditions. However, reinforcement learning models based on neural networks inherently possess adversarial vulnerability, meaning they are extremely sensitive to even minor perturbations in the input observation data. When faced with non-ideal information environments or malicious network attacks (such as falsified measurement data or state spoofing), the agent's decision-making behavior may deviate significantly from safety boundaries, leading to voltage overruns, equipment damage, or even large-scale power outages, severely impacting the stable operation of the power grid.

[0003] To address the aforementioned security vulnerabilities, the solution is adversarial training. Its core idea is to introduce potential attack disturbances as training samples into the model's learning process, thereby improving the model's defensive capabilities under non-ideal information conditions by using offensive techniques to enhance defense. Therefore, the ability to generate high-quality, diverse, and physically consistent adversarial attack samples directly determines the robustness and defensive ceiling of the final agent model.

[0004] However, existing adversarial example generation methods have significant drawbacks in practical applications of power distribution networks. On the one hand, most methods are based on the "white-box assumption," requiring access to the internal network parameters or gradient information of the scheduling agent, which is difficult to achieve in real-world engineering environments where policies are closed and only input / output interfaces are provided. On the other hand, existing black-box attack methods (zero-order optimization, evolutionary strategies), while not requiring model parameters, face the dual challenges of the curse of dimensionality and physical blind spots. Due to a lack of understanding of the power grid topology, these algorithms can only perform blind random searches within the state space of all network nodes. This global blind search is not only extremely slow and inefficient, but the generated disturbances are often uniformly distributed across the entire network, lacking physical targeting and easily identified by anomaly detection mechanisms. It is difficult to adapt to the complex mixed scenarios of continuous domains (such as voltage regulation) and discrete domains (such as switchgear switching) in power distribution networks. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a simple and robust method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model.

[0006] The technical solution of this invention to solve the above-mentioned technical problems is: a method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model, comprising the following steps:

[0007] Step 1: Determine the attack target of the scheduled task, quantify the attacker's destructive intent, and transform the ambiguous attack target into a multi-target attack loss function;

[0008] Step 2: Utilize the general knowledge and reasoning ability of the large language model to filter out the key nodes with the highest attack cost-effectiveness and obtain the mask vector;

[0009] Step 3: Under the constraint of the mask vector, generate specific perturbation vectors for the continuous or discrete domain;

[0010] Step 4: Perform sample verification.

[0011] The above-mentioned method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by large language models, specifically step one, is as follows:

[0012] Step 11: Determine the attack direction. Based on the operation requirements of the distribution network, select the attack target dimension, which includes economic deterioration, security disruption, and stability interference.

[0013] Step 12: Construct the multi-target attack loss function The definition is as follows:

[0014]

[0015] in, This represents the loss function for multi-target attacks; Indicates application Multi-target attack loss function; This represents the original state vector of the distribution network, containing... The voltage and power of each node Indicates the total number of nodes; Represents the state perturbation vector; For decision-making output; Representing state Decision output at that time; This indicates the economic cost target corresponding to the scheduling scheme; Indicates the target for voltage exceeding the limit penalty; Indicates the frequency / stability deviation target; , , All are dynamically weighted coefficients.

[0016] The above-mentioned method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by large language models, specifically step two, is as follows:

[0017] Step 21, perform state semantic mapping: construct a distribution network semantic template, and map the original state vector of the distribution network. Mapped to natural language descriptive text ;

[0018] Step 22, perform vulnerability chain reasoning: Given a large language model (LLM), and using CoT (Coding of Thought) prompting engineering, the model is required to infer, based on the physical principles of power systems, the most likely cause of system instability. A key node The key nodes constitute the key node set. , ;

[0019] Step 23, Generate Attack Attention Mask: Construct a mask vector based on the inference results. :

[0020]

[0021] in, express The first in One node; A set of key nodes; Represents the mask vector In the The values ​​taken at each node.

[0022] The above-mentioned method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model, in step 21, It includes topological connections, node load levels, and historical over-limit records.

[0023] The above-mentioned method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by large language models, specifically step three, involves the following process:

[0024] Step 31, Action Domain Adaptation and Loss Construction: Design an appropriate loss function based on the action space type of the scheduled task, i.e., discrete domain or continuous domain.

[0025] Step 32, Mask-guided zero-order gradient estimation: Initialize the perturbation, iteratively update using an improved zero-order optimization algorithm, and generate mask noise;

[0026] Step 33, Iterative Perturbation Update: Update the perturbation based on the estimated gradient, and perform projection truncation to satisfy the concealment constraint, obtaining the final state perturbation vector. .

[0027] In the aforementioned method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model, step 31, if the domain is discrete, introduces KL divergence and entropy increase regularization to construct a composite objective function. :

[0028]

[0029] in, Indicates the agent's state The probability distribution of actions under the following conditions; Indicates the agent's state The probability distribution of actions under the following conditions; This represents the Kullback-Leibler divergence, used to maximize the difference in policy distribution before and after the perturbation; Information entropy is used to maximize the uncertainty of a strategy; All of these are discrete domain regularization weight coefficients.

[0030] In the aforementioned method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model, step 31 involves constructing a loss function based on action projection differences if the domain is continuous. :

[0031]

[0032] in, This represents the loss function based on the difference in action projections; This represents the Euclidean distance of the action output, used to maximize the deviation of the control strategy. This is a mask consistency constraint. This represents the Hadamard product, used to penalize any perturbation that deviates from the LLM recommended subspace; All are continuous domain weighted coefficients.

[0033] The above-mentioned method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model, in step 32, generates the following mask noise:

[0034]

[0035]

[0036] in, It is a random noise vector that follows a standard normal distribution; This is the guided noise vector after masking and filtering; For gradient estimation, the smoothing parameter is used. Represents a random noise vector It follows a standard multivariate normal distribution; Represent the covariance matrix; The gradient vector of the estimated objective function; Indicates that the input is The objective function, corresponding to the action space type, is: or ; Indicates that the input is The objective function; Indicates that the input is The objective function.

[0037] In the above-mentioned method for generating black-box adversarial examples for distribution networks based on topological reasoning guided by a large language model, the concealment constraint in step 33 is as follows: , express The infinite norm, This is the preset upper limit threshold for the disturbance amplitude.

[0038] The above-mentioned method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by large language models, specifically step four, involves the following process:

[0039] Step 41: Based on the final state perturbation vector Generate adversarial examples , And verify and store it in the database;

[0040] Step 42: Verify the attack effect. If the agent performs well in the adversarial sample... The actions driven by the target function cause the objective function value to deteriorate beyond a threshold. If so, the attack is considered successful;

[0041] Step 43: Add the successfully attacked adversarial samples to the robustness training library for subsequent adversarial training and defense capability improvement of the agent.

[0042] The beneficial effects of this invention are as follows: This invention introduces a large language model as a topology cognitive engine, uses its semantic reasoning ability to filter out key vulnerable nodes in the power distribution network, and generates attack masks. The mask guides the black-box optimizer to lock the key subspace, replacing the traditional blind search across the entire domain. Without accessing the internal structure of the model, it efficiently generates high-quality adversarial samples covering multiple attack targets and action domain types, providing rich robust training data for the agent. Attached Figure Description

[0043] Figure 1 This is the overall flowchart of the present invention.

[0044] Figure 2 This is a diagram of the loss function for multi-target attacks. Detailed Implementation

[0045] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0046] like Figure 1 As shown, a method for generating black-box adversarial examples for power distribution networks based on topology reasoning guided by a large language model includes the following steps:

[0047] Step 1: Determine the attack target of the scheduled task, quantify the attacker's destructive intent, and transform the ambiguous attack target into a multi-target attack loss function.

[0048] The specific process of step one is as follows:

[0049] Step 11: Determine the attack direction. Based on the operation requirements of the distribution network, select the attack target dimension, which includes economic deterioration, security disruption, and stability interference.

[0050] Step 12: Construct the multi-target attack loss function ,like Figure 2 As shown, the definition is as follows:

[0051]

[0052] in, This represents the loss function for multi-target attacks; Indicates application Multi-target attack loss function; This represents the original state vector of the distribution network, containing... The voltage and power of each node Indicates the total number of nodes; Represents the state perturbation vector; For decision-making output; Representing state Decision output at that time; This indicates the economic cost target corresponding to the scheduling scheme; Indicates the target for voltage exceeding the limit penalty; Indicates the frequency / stability deviation target; , , All are dynamically weighted coefficients.

[0053] Step 2: Utilize the general knowledge and reasoning ability of the large language model to filter out the key nodes with the highest attack cost-effectiveness and obtain the mask vector.

[0054] The specific process of step two is as follows:

[0055] Step 21, perform state semantic mapping: construct a distribution network semantic template, and map the original state vector of the distribution network. Mapped to natural language descriptive text , It includes topological connectivity, node load levels, and historical over-limit records;

[0056] Step 22, perform vulnerability chain reasoning: Given a large language model (LLM), and using CoT (Coding of Thought) prompting engineering, the model is required to infer, based on the physical principles of power systems, the most likely cause of system instability. A key node The key nodes constitute the key node set. , ;

[0057] Step 23, Generate Attack Attention Mask: Construct a mask vector based on the inference results. :

[0058]

[0059] in, express The first in One node; A set of key nodes; Represents the mask vector In the The values ​​at each node are used to indicate whether a disturbance is applied to that node.

[0060] Step 3: Under the constraint of the mask vector, generate specific perturbation vectors for the continuous or discrete domain.

[0061] The specific process of step three is as follows:

[0062] Step 31, Action Domain Adaptation and Loss Construction: Design an appropriate loss function based on the action space type of the scheduled task, i.e., discrete domain or continuous domain.

[0063] If the domain is discrete, then KL divergence and entropy increase regularity are introduced to construct a composite objective function. :

[0064]

[0065] in, Indicates the agent's state The action probability distribution under the intelligent agent refers to the scheduling decision model deployed in the power distribution network and trained based on deep reinforcement learning (DRL), which provides a black box interface for input state and output control action; Indicates the agent's state The probability distribution of actions under the following conditions; This represents the Kullback-Leibler divergence, used to maximize the difference in policy distribution before and after the perturbation; Information entropy is used to maximize the uncertainty of a strategy; All of these are discrete domain regularization weight coefficients.

[0066] If the domain is continuous, then a loss function based on the difference in action projections is constructed. :

[0067]

[0068] in, This represents the loss function based on the difference in action projections; This represents the Euclidean distance of the action output, used to maximize the deviation of the control strategy. This is a mask consistency constraint. This represents the Hadamard product, used to penalize any perturbation that deviates from the LLM recommended subspace; All are continuous domain weighted coefficients.

[0069] Step 32, Mask-guided zero-order gradient estimation: Initialize the perturbation, iteratively update using an improved zero-order optimization algorithm, and generate mask noise;

[0070] The generated mask noise is:

[0071]

[0072]

[0073] in, It is a random noise vector that follows a standard normal distribution; This is the guided noise vector after masking and filtering; For gradient estimation, the smoothing parameter is used. Represents a random noise vector It follows a standard multivariate normal distribution. Each dimension is an independent normally distributed random variable with a mean of 0 and a variance of 1; The covariance matrix is ​​a square matrix whose diagonal elements are 1s and whose off-diagonal elements are 0s. The gradient vector of the estimated objective function; Indicates that the input is The objective function, corresponding to the action space type, is: or ; Indicates that the input is The objective function; Indicates that the input is The objective function.

[0074] Step 33, Iterative Perturbation Update: Update the perturbation based on the estimated gradient, and perform projection truncation to satisfy the concealment constraint, obtaining the final state perturbation vector. .

[0075] The concealment constraint is: , express The infinite norm, This is the preset upper limit threshold for the disturbance amplitude.

[0076] Step 4: Perform sample verification.

[0077] The specific process of step four is as follows:

[0078] Step 41: Based on the final state perturbation vector Generate adversarial examples , And verify and store it in the database;

[0079] Step 42: Verify the attack effect. If the agent performs well in the adversarial sample... The actions driven by the target function cause the objective function value to deteriorate beyond a threshold. If so, the attack is considered successful;

[0080] Step 43: Add the successfully attacked adversarial samples to the robustness training library for subsequent adversarial training and defense capability improvement of the agent.

[0081] The effectiveness of the method of the present invention was verified in a standard IEEE 33-node distribution network system.

[0082] Experimental scenario and environment setup:

[0083] Test Subject: An agent based on the Deep Deterministic Policy Gradient Algorithm (DDPG) is deployed. This agent is responsible for adjusting the output of distributed power sources and reactive power compensation devices at nodes 18 and 33 according to the overall network voltage status.

[0084] Initial state: The system is in heavy load operation, the voltage amplitude of node 33 (located at the end of the feeder) is 0.96 per unit, and the active load of node 18 is 110% of the rated value.

[0085] Attack target: Under the constraint that the perturbation amplitude does not exceed 0.05 per unit value, induce the agent to output erroneous actions, resulting in the maximization of the total operating cost of the system or triggering voltage over-limit.

[0086] Specific implementation steps:

[0087] First, at the moment of attack This invention collects voltage and power observation data from 33 nodes across the entire network. It constructs Chinese prompts including system background, observation status, physical knowledge, task instructions, and output requirements, converting numerical values ​​into semantic descriptions.

[0088] The system background is as follows: The current system model is an IEEE 33-node radial distribution network.

[0089] The observation status is:

[0090] Node 33 (end of feeder): Voltage = 0.96 per unit (already close to the lower limit).

[0091] Node 18 (Middle section of branch): Load = 1.1 times the rated value.

[0092] Other nodes: operating within the normal range [0.98, 1.02].

[0093] The physics principle is that the voltage sensitivity is highest at the end of a long feeder. Heavy-load nodes are prone to triggering cascading failures.

[0094] The task instructions are: Analyze the system status and identify the two most vulnerable nodes to inject spurious data. The objective is to induce voltage collapse with minimal disturbance.

[0095] The output requirement is to return only a list format containing node numbers.

[0096] Then, the above prompts are input into the large language model for model inference and output:

[0097] Reasoning and analysis: Node 33 is very close to the voltage over-limit threshold. Artificially increasing its reading would trick the agent into reducing reactive power support, leading to a true voltage collapse. Node 18 has the heaviest load; attacking it would maximize economic losses.

[0098] Target index: [17,32] (Note: This corresponds to the 18th and 33rd nodes. Computer array indices start from 0).

[0099] Mask instantiation: The system automatically generates a 33-dimensional binary mask vector based on the output. .make The values ​​of the 17th and 32nd positions are 1, while the values ​​of the remaining 31 dimensions are all 0.

[0100] Next, we will optimize the black-box adversarial attack mechanism guided by masking:

[0101] Initialize the perturbation vector and set the attack step size. Maximum number of iterations Entering the loop:

[0102] 1. Guided Noise Generation: Generate random noise vectors that follow a standard normal distribution. Calculate the guided noise vector after masking. At this point, only the 17th and 32nd dimensions have values, and the noise in the other dimensions is forcibly cleared to zero.

[0103] 2. Gradient Estimation (Black-Box Inquiry): The "original state vector of the distribution network + applied state perturbation vector" and the "original state vector of the distribution network + applied state perturbation vector + masked guided noise vector" are input into the agent interface respectively. The difference of the multi-target attack loss function is calculated, and the gradient is estimated using the masked guided noise vector. Technical Effect: Due to the use of a mask, the gradient estimation is no longer affected by noise interference from the other 31 non-critical nodes, and the direction is accurately pointed to the attack target.

[0104] 3. Perturbation Update: Update the perturbation value according to the gradient sign and perform clipping projection to ensure that the perturbation amplitude meets the concealment requirements.

[0105] Finally, the attack effect was verified:

[0106] After 20 rounds of iteration, the final adversarial example is generated.

[0107] Attack result: The agent received forged data (the data showed that the voltage of node 33 was too high) and mistakenly issued the instruction to "cut off the capacitor of node 33".

[0108] Physical consequences: In a real power grid simulation, the voltage at node 33 instantly dropped to 0.88 per unit (severely exceeding the limit), and the system operating cost increased by 18% compared to the normal state.

[0109] Implementation effect comparison: Adversarial examples generated by the method of this invention were added to the training set to retrain the agent for robustness. Test results show that after training with the samples generated by this invention, the agent's robustness indicators (such as maximum voltage deviation control capability) against similar attacks are improved by an average of more than 21.6%.

Claims

1. A method for generating adversarial examples for power distribution networks based on topological reasoning guided by a large language model, characterized in that, Includes the following steps: Step 1: Determine the attack target of the scheduled task, quantify the attacker's destructive intent, and transform the ambiguous attack target into a multi-target attack loss function; Step 2: Utilize the general knowledge and reasoning ability of the large language model to filter out the key nodes with the highest attack cost-effectiveness and obtain the mask vector; The specific process of step two is as follows: Step 21, perform state semantic mapping: construct a distribution network semantic template, and map the original state vector of the distribution network. Mapped to natural language descriptive text ; Step 22, perform vulnerability chain reasoning: Given a large language model (LLM), and using CoT (Coding of Thought) prompting engineering, the model is required to infer, based on the physical principles of power systems, the most likely cause of system instability. A key node The key nodes constitute the key node set. , ; Step 23, Generate Attack Attention Mask: Construct a mask vector based on the inference results. : ； in, express The first in One node; A set of key nodes; Represents the mask vector In the The values ​​at each node; Step 3: Under the constraint of the mask vector, generate specific perturbation vectors for the continuous or discrete domain; The specific process of step three is as follows: Step 31, Action Domain Adaptation and Loss Construction: Design an appropriate loss function based on the action space type of the scheduled task, i.e., discrete domain or continuous domain. Step 32, Mask-guided zero-order gradient estimation: Initialize the perturbation, iteratively update using an improved zero-order optimization algorithm, and generate mask noise; In step 32, the generated mask noise is: ； ； in, It is a random noise vector that follows a standard normal distribution; This is the guided noise vector after masking and filtering; For the smoothing parameter of gradient estimation; Represents a random noise vector It follows a standard multivariate normal distribution; Represent the covariance matrix; The gradient vector of the estimated objective function; Indicates that the input is The objective function, corresponding to the action space type, is: or ; Indicates that the input is The objective function; Indicates that the input is The objective function; It represents the Hadamardi (or Hadama) stack; Represents the original state vector of the distribution network; Represents the state perturbation vector; Step 33, Iterative Perturbation Update: Update the perturbation based on the estimated gradient, and perform projection truncation to satisfy the concealment constraint, obtaining the final state perturbation vector. ; Step 4: Perform sample verification.

2. The method for generating adversarial examples for distribution networks based on topological reasoning guided by a large language model, as described in claim 1, is characterized in that... The specific process of step one is as follows: Step 11: Determine the attack direction. Based on the operation requirements of the distribution network, select the attack target dimension, which includes economic deterioration, security disruption, and stability interference. Step 12: Construct the multi-target attack loss function The definition is as follows: ； in, This represents the loss function for multi-target attacks; Indicates application Multi-target attack loss function; This represents the original state vector of the distribution network, containing... The voltage and power of each node Indicates the total number of nodes; Represents the state perturbation vector; For decision-making output; Representing state Decision output at that time; This indicates the economic cost target corresponding to the scheduling scheme; Indicates the target for voltage exceeding the limit penalty; Indicates the frequency / stability deviation target; , , All are dynamically weighted coefficients.

3. The method for generating adversarial examples for distribution networks based on topological reasoning guided by a large language model, as described in claim 2, is characterized in that... In step 21, It includes topological connections, node load levels, and historical over-limit records.

4. The method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model, as described in claim 3, is characterized in that... In step 31, if the domain is discrete, KL divergence and entropy increase regularity are introduced to construct a composite objective function. : ； in, Indicates the agent's state The probability distribution of actions under the following conditions; Indicates the agent's state The probability distribution of actions under the following conditions; This represents the Kullback-Leibler divergence, used to maximize the difference in policy distribution before and after the perturbation; Information entropy is used to maximize the uncertainty of a strategy; All of these are discrete domain regularization weight coefficients.

5. The method for generating adversarial examples for distribution networks based on topological reasoning guided by a large language model, as described in claim 4, is characterized in that... In step 31, if the domain is continuous, a loss function based on action projection differences is constructed. : ； in, This represents the loss function based on the difference in action projections; This represents the Euclidean distance of the action output, used to maximize the deviation of the control strategy. This is a mask consistency constraint. This represents the Hadamard product, used to penalize any perturbation that deviates from the LLM recommended subspace; All are continuous domain weighted coefficients.

6. The method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model, as described in claim 5, is characterized in that... In step 33, the concealment constraint is: , express The infinite norm, This is the preset upper limit threshold for the disturbance amplitude.

7. The method for generating black-box adversarial examples for power distribution networks based on topological reasoning guided by a large language model, as described in claim 6, is characterized in that... The specific process of step four is as follows: Step 41: Based on the final state perturbation vector Generate adversarial examples , And verify and store it in the database; Step 42: Verify the attack effect. If the agent performs well in the adversarial sample... The actions driven by the target function cause the objective function value to deteriorate beyond a threshold. If so, the attack is considered successful; Step 43: Add the successfully attacked adversarial samples to the robustness training library for subsequent adversarial training and defense capability improvement of the agent.

Images