Cross-domain adversarial example detection methods, devices and computer equipment

Abstract

This application relates to a method, apparatus, and computer device for cross-domain adversarial example detection. The method includes: acquiring an unknown sample set and the signal-to-noise ratio (SNR) of the transmission channel for each unknown sample in the unknown sample set; filtering adversarial examples and samples to be detected from the unknown sample set according to a preset reference noise distribution; inputting the samples to be detected into multiple pre-trained adversarial detection models to obtain multiple adversarial probabilities for the samples to be detected; the adversarial detection models are used to predict the probability that the sample to be detected is an adversarial example, and different adversarial detection models target different types of interference; and obtaining the adversarial detection result of the sample to be detected based on the SNR of the transmission channel of the sample to be detected and the adversarial probabilities of the sample to be detected. This method can improve the accuracy of adversarial example detection.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence security technology, and in particular to a method, apparatus and computer device for cross-domain adversarial sample detection. Background Technology

[0002] Deep learning models are widely used in intelligent decision-making systems in many high-security fields, such as power line inspection and autonomous driving.

[0003] However, research shows that deep learning models are extremely vulnerable to adversarial attacks. Attackers can induce deep learning models to produce high-confidence erroneous outputs by adding tiny perturbations that are imperceptible to the human eye. The deceptiveness and destructiveness of these attacks pose a serious challenge to the safe and reliable operation of intelligent systems. Summary of the Invention

[0004] Therefore, it is necessary to provide a cross-domain adversarial example detection method, apparatus, and computer equipment that can improve the accuracy of adversarial example detection in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for detecting cross-domain adversarial examples, the method comprising:

[0006] Obtain the unknown sample set, and the signal-to-noise ratio of the transmission channel of each unknown sample in the unknown sample set;

[0007] Based on a preset reference noise distribution, adversarial samples and samples to be detected are screened from the set of unknown samples;

[0008] The sample to be detected is input into multiple pre-trained adversarial detection models to obtain multiple adversarial probabilities for the sample to be detected. The adversarial detection model is used to predict the probability that the sample to be detected is an adversarial sample. Different adversarial detection models target different types of interference.

[0009] Based on the signal-to-noise ratio of the transmission channel of the sample to be detected and the adversarial probabilities of each sample to be detected, the adversarial detection result of the sample to be detected is obtained.

[0010] In one embodiment, obtaining the adversarial detection result of the sample to be detected based on the signal-to-noise ratio of the transmission channel of the sample to be detected and the adversarial probabilities of each sample to be detected includes:

[0011] Based on the signal-to-noise ratio of the transmission channel of the sample to be detected, determine the decision threshold and reliability weight of each adversarial detection model;

[0012] Based on the adversarial probabilities, decision thresholds, and reliability weights, the adversarial detection results of the sample to be detected are obtained.

[0013] In one embodiment, before screening adversarial samples and samples to be detected from the unknown sample set according to a preset reference noise distribution, the method further includes:

[0014] A target size is determined based on the size of each unknown sample in the unknown sample set; the target size is larger than the size of at least a portion of the unknown samples.

[0015] The target pixel value is determined based on the set of pixel values ​​of each unknown sample in the unknown sample set; the target pixel value is the average of the pixel values ​​of each pixel in each unknown sample.

[0016] The unknown target sample is pixel-filled according to the target size and the target pixel value; the size of the unknown target sample is smaller than the target size.

[0017] In one embodiment, the training method for the adversarial detection model includes:

[0018] Multiple training sample sets are obtained; multiple training samples in the same training sample set have the same type of interference; training samples in different training sample sets have different types of interference.

[0019] Using multiple training sample sets, the pre-constructed initial adversarial detection model is trained, and multiple adversarial detection models are obtained.

[0020] In one embodiment, training a pre-built initial adversarial detection model using a training sample set and obtaining the adversarial detection model includes:

[0021] Input the training sample set into the initial adversarial detection model to obtain the comprehensive loss of the initial adversarial detection model;

[0022] The initial adversarial detection model is updated based on the comprehensive loss, and the detection continues until the comprehensive loss converges, thus obtaining the adversarial detection model.

[0023] In one embodiment, the training sample set includes a source domain adversarial sample set and a target domain interference sample set; obtaining the training sample set includes:

[0024] The target perturbation direction is obtained based on a preset source domain natural sample set and a preset random orthogonal vector;

[0025] Based on the target perturbation direction, the preset perturbation intensity constraint, and the source domain natural sample set, obtain the source domain adversarial sample set;

[0026] Based on the source domain adversarial sample set and the target interference type, a target domain interference sample set is generated.

[0027] In one embodiment, obtaining the target perturbation direction based on a preset source domain natural sample set and a preset random orthogonal vector includes:

[0028] Based on the source domain natural sample set, the preset loss function, and the preset random noise variables, the main perturbation direction is obtained;

[0029] Based on the main disturbance direction and the preset random vector, the extended disturbance direction is obtained;

[0030] The target disturbance direction is obtained by combining the extended disturbance direction and the main disturbance direction.

[0031] In one embodiment, inputting the training sample set into the initial adversarial detection model and obtaining the comprehensive loss of the initial adversarial detection model includes:

[0032] Input the training sample set into the initial adversarial detection model to obtain the source domain gradient and the target domain gradient;

[0033] The gradient alignment loss is obtained based on the source domain gradient and the target domain gradient;

[0034] By maximizing the mutual information between the source domain adversarial sample and the target domain interference sample in the adversarial detection model, the domain-invariant feature loss is obtained.

[0035] Based on the training sample set and the source domain natural sample set, obtain the standard classification loss;

[0036] The comprehensive loss is obtained based on the gradient alignment loss, the domain-invariant feature loss, and the standard classification loss.

[0037] Secondly, this application provides an adversarial sample detection device, the device comprising:

[0038] The first execution module is used to acquire an unknown sample set and the signal-to-noise ratio of the transmission channel of each unknown sample in the unknown sample set;

[0039] The second execution module is used to filter adversarial samples and samples to be detected from the unknown sample set according to the preset reference noise distribution.

[0040] The third execution module is used to input the sample to be detected into multiple pre-trained adversarial detection models to obtain multiple adversarial probabilities of the sample to be detected; the adversarial detection model is used to predict the probability that the sample to be detected is an adversarial sample, and different adversarial detection models target different types of interference.

[0041] The fourth execution module is used to obtain the adversarial detection result of the sample to be detected based on the signal-to-noise ratio of the transmission channel of the sample to be detected and the adversarial probabilities of the sample to be detected.

[0042] Thirdly, this application provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any of the above embodiments.

[0043] The aforementioned cross-domain adversarial sample detection method, apparatus, and computer equipment include acquiring an unknown sample set and the signal-to-noise ratio (SNR) of the transmission channel of each unknown sample in the unknown sample set. First, based on a preset reference noise distribution, the unknown samples in the unknown sample set are initially screened to determine whether each unknown sample is an adversarial sample, obtaining preliminary detection results. For unknown samples whose adversarial status cannot be determined temporarily, i.e., samples to be detected, these samples are input into multiple pre-trained adversarial detection models. Each model predicts the probability that the sample to be detected is an adversarial sample. Finally, based on the SNR of the transmission channel of the sample to be detected and the adversarial probabilities of each sample, the overall adversarial probability is comprehensively determined. This application uses a reference noise distribution to initially screen the unknown sample set, which can quickly filter out high-confidence adversarial samples, avoiding inputting all samples into the adversarial detection model, thereby reducing the overall computational overhead. Furthermore, this application uses multiple different adversarial detection models to predict the adversarial probability of the samples to be detected. Different adversarial detection models target different types of interference, which can cover a wider range of attack types and improve generalization detection capabilities. Furthermore, the signal-to-noise ratio of the channel is a direct physical indicator for measuring transmission quality and quantifying interference intensity. This application comprehensively judges whether the sample to be detected is an adversarial sample by combining the signal-to-noise ratio of the channel of the transmitted sample with each adversarial probability, which can further improve the accuracy of adversarial sample detection. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating a cross-domain adversarial example detection method in one embodiment;

[0046] Figure 2 This is a flowchart illustrating step S104 in one embodiment;

[0047] Figure 3 This is a flowchart illustrating a cross-domain adversarial example detection method in another embodiment;

[0048] Figure 4 This is a flowchart illustrating the training method of an adversarial detection model in one embodiment;

[0049] Figure 5 This is a flowchart illustrating step S401 in one embodiment;

[0050] Figure 6 This is a flowchart illustrating step S402 in one embodiment;

[0051] Figure 7 This is a schematic diagram illustrating the overall process of the cross-domain adversarial example detection method and the training method of the adversarial detection model in one embodiment;

[0052] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] As described in the background section, deep learning models are widely used in intelligent decision-making systems in many high-security fields, such as power line inspection and autonomous driving. However, research shows that deep learning models are highly vulnerable to adversarial attacks. Attackers can induce deep learning models to produce high-confidence erroneous outputs by adding minute perturbations that are imperceptible to the human eye. The deceptive and destructive nature of these attacks poses a serious challenge to the safe and reliable operation of intelligent systems.

[0055] Adversarial attacks exhibit a complex cross-domain migration pattern. In this invention, "domain" refers to a data distribution state. "Cross-domain" refers to a change in data distribution from the source domain to the target domain. Its specific manifestations include, but are not limited to:

[0056] First, the attack crosses the physical-digital domain. It is generated in the physical world (e.g., adversarial stickers, special textures), collected by sensors and other devices, and then enters the digital system. The device noise, lighting variations, and angular distortion introduced during this process cause the sample received by the digital system to constitute a new target domain relative to the original physical attack. It should be noted that the physical imaging link introduces a set of regular but non-negligible linear / nonlinear noise sources. The modeling method for these sources differs from the "universal source domain → target domain open-sphere coverage modeling" described later. Therefore, this invention models them separately to avoid mutual interference between the assumptions of the two scenarios.

[0057] Second, migration within the digital domain: During the transmission of adversarial examples within a digital system (such as via wireless channel backhaul), they are interfered with by channel noise (such as linear attenuation, multipath reverberation, compression distortion), causing a shift in their feature distribution and forming an interfered target domain.

[0058] These cross-domain adversarial examples exploit the differences in feature distribution between the source and target domains, exhibiting strong transferability and stealth, posing a severe challenge to the secure and reliable operation of intelligent systems. Therefore, accurate and rapid detection of adversarial examples is a crucial safeguard for ensuring the security of intelligent systems.

[0059] The relevant technologies have significant problems in cross-domain adversarial example detection: First, the domain assumption is too strong. The core detection logic of these technologies is based on a strong assumption that adversarial perturbations will exhibit the same statistical anomalies in both the source and target domains. This assumption no longer holds true in real cross-domain scenarios. Second, there is a lack of cross-domain modeling, failing to explicitly model the distribution transformation from the source domain to the target domain. When adversarial examples migrate from the source domain to the target domain, their perturbation features may be masked or distorted by the inherent features of the target domain (such as device noise and channel interference), causing detectors trained based on source domain features to fail. Third, the generalization ability is insufficient. Because the distribution shift problem is not fundamentally addressed, the detection performance of the model significantly degrades when encountering unknown target domains (i.e., novel interference or devices not seen during training).

[0060] The main problem with related technologies lies in their inability to handle data distribution shifts from the source domain to the target domain. They lack both adaptability to modelable shifts and generalization ability for unknown shifts, resulting in insufficient accuracy and robustness in adversarial sample detection to meet the requirements of high-security applications in real and complex cross-domain environments. Specifically, firstly, there is insufficient modeling of adversarial attack features between the source and target domains. Related technologies lack a unified mathematical model for the generation mechanism of adversarial perturbations between the source and target domains. Traditional methods analyze perturbations within a single domain (such as pixel noise) in isolation, failing to quantify the impact of cross-domain feature distribution differences on perturbation mobility. Existing models cannot capture such cross-domain feature transformation patterns through parametric modeling, relying solely on data-driven empirical detection, leading to missed detection of novel cross-domain attack paths. Second, the detection mechanism suffers from generalization defects. Mainstream detection technologies rely on training adversarial example classifiers with data from specific source domains (such as ImageNet), making it difficult for the model to transfer to unknown target domains (such as remote sensing images). Furthermore, it is prone to source domain dependency solidification, meaning that the decision boundary optimized in the source domain is difficult to generalize to the target domain data distribution. Specifically, if new acquisition devices, compression parameters, or wireless channel conditions appear in the target domain, the feature boundary of this classifier will drift, resulting in increased false positive rates, increased false negative rates, or both. Third, there is the problem of quantifying adversarial examples in wireless transmission environments. Complex noisy environments (such as electromagnetic interference and imaging jitter) distort the physical characteristics of adversarial examples across the physical-digital domain, further amplifying cross-domain transfer errors. Moreover, traditional models lack quantitative analysis of the stealth detection of adversarial examples in noisy environments (such as KL divergence distribution shift).

[0061] To address the issue of low accuracy in cross-domain adversarial example detection, this application proposes a cross-domain adversarial example detection method specifically for the critical cross-domain scenario of physical-digital domain cross-domain. Please refer to [link to relevant documentation]. Figure 1 The cross-domain adversarial example detection method of this application includes steps S101 to S104. The following description uses the application of the cross-domain adversarial example detection method of this application to a control terminal as an example.

[0062] S101: Obtain the unknown sample set and the signal-to-noise ratio of the transmission channel of each unknown sample in the unknown sample set.

[0063] Adversarial examples are specially designed input data intended to deceive or mislead machine learning (especially deep learning) models. They are generated by adding minute perturbations that are imperceptible to the human eye to normal samples. The set of unknown samples includes multiple unknown samples, which may be normal samples or adversarial samples. The cross-domain adversarial sample detection method of this application is needed to determine whether each unknown sample is a normal sample or an adversarial sample. Among them, the unknown samples can be images.

[0064] In cross-domain scenarios involving both the physical and digital domains, samples are typically transmitted wirelessly. Adversarial samples are susceptible to interference during this process, particularly during the conversion from the physical to the digital domain. This interference can be caused by linear noise from the physical domain, spatially propagating reverberation noise, or changes in image properties due to the acquisition device (e.g., changes in image color and texture caused by resolution). These variations in the original adversarial sample, from the source domain to the unknown domain, disrupt the original perturbation pattern and consequently affect the adversarial sample detection mechanism. Therefore, this application also obtains the signal-to-noise ratio (SNR) of the transmission channel for each unknown sample during wireless transmission.

[0065] S102: Based on the preset reference noise distribution, screen adversarial samples and samples to be detected from the unknown sample set.

[0066] Before adversarial example detection, this application can collect a large-scale, high-confidence clean natural sample dataset, estimate the inherent noise of each clean sample in the dataset, and aggregate the noise fragments estimated from all clean samples to obtain a reference noise distribution of the clean dataset.

[0067] In the process of adversarial example detection, after acquiring unknown samples, the control terminal can estimate the noise distribution of the unknown samples and then use a preset reference noise distribution to calculate the KL divergence of each unknown sample. In one example, the formula for calculating the KL divergence can be shown in formula (1):

[0068]

[0069] in, It is an asymmetric metric used to measure a probability distribution (such as...) ) and another reference probability distribution (such as The "information loss" or "difference" between them. This is a reference noise distribution. The noise distribution for unknown samples. The KL divergence between the reference noise distribution and the noise distribution of the unknown sample.

[0070] For unknown samples with a KL divergence greater than a preset KL threshold, the unknown sample can be directly determined to be adversarial and is thus an adversarial sample; for unknown samples with a KL divergence less than or equal to the preset KL threshold, they are marked as samples to be detected. In one example, the preset KL threshold can be 0.6.

[0071] S103: Input the sample to be detected into multiple pre-trained adversarial detection models to obtain multiple adversarial probabilities for the sample to be detected.

[0072] Among them, the adversarial detection model is used to predict the probability that the sample to be detected is an adversarial sample, and different adversarial detection models target different types of interference.

[0073] In this embodiment of the application, the multiple pre-trained adversarial detection models may include a first adversarial detection model, a second adversarial detection model, and a third adversarial detection model. The first adversarial detection model targets linear noise interference during wireless transmission, the second adversarial detection model targets reverberant noise interference during wireless transmission, and the third adversarial detection model targets noise interference from the acquisition device during wireless transmission.

[0074] S104: Based on the signal-to-noise ratio of the transmission channel of the sample to be detected and the adversarial probabilities of the sample to be detected, obtain the adversarial detection result of the sample to be detected.

[0075] Since different adversarial detection models target different types of interference, and the signal-to-noise ratio (SNR) of the transmission channel has different effects on various types of interference during the transmission of adversarial samples, this application can first determine the reliability of each adversarial detection model under the SNR of the transmission channel of the sample to be detected, and then combine the reliability of each adversarial detection model with the adversarial probability output by each adversarial detection model to comprehensively determine whether the sample to be detected is an adversarial sample.

[0076] The aforementioned cross-domain adversarial example detection method includes acquiring an unknown sample set and the signal-to-noise ratio (SNR) of the transmission channel of each unknown sample in the unknown sample set. First, based on a preset reference noise distribution, the unknown samples in the unknown sample set are initially screened to determine whether each unknown sample is an adversarial sample, obtaining preliminary detection results. For unknown samples whose adversarial status cannot be determined temporarily, i.e., samples to be detected, these samples are input into multiple pre-trained adversarial detection models. Each model predicts the probability that the sample to be detected is an adversarial sample. Finally, based on the SNR of the transmission channel of the sample to be detected and the adversarial probabilities of each sample, the overall adversarial probability is comprehensively determined. This application uses a reference noise distribution to initially screen the unknown sample set, which can quickly filter out high-confidence adversarial samples, avoiding inputting all samples into the adversarial detection model, thereby reducing the overall computational cost. Furthermore, this application uses multiple different adversarial detection models to predict the adversarial probability of the samples to be detected. Different adversarial detection models target different types of interference, which can cover a wider range of attack types and improve generalization detection capability. Furthermore, the signal-to-noise ratio of the channel is a direct physical indicator for measuring transmission quality and quantifying interference intensity. This application comprehensively judges whether the sample to be detected is an adversarial sample by combining the signal-to-noise ratio of the channel of the transmitted sample with each adversarial probability, which can further improve the accuracy of adversarial sample detection.

[0077] In some exemplary embodiments, please refer to Figure 2 Step S104: Based on the signal-to-noise ratio of the transmission channel of the sample to be detected and the adversarial probabilities of the sample to be detected, obtain the adversarial detection result of the sample to be detected, including steps S201 and S202.

[0078] S201: Determine the decision threshold and reliability weight of each adversarial detection model based on the signal-to-noise ratio of the transmission channel of the sample to be detected.

[0079] It is understandable that in wireless transmission scenarios, the signal-to-noise ratio (SNR) of the transmission channel is a key indicator for measuring channel quality, directly affecting the intensity and type of interference encountered by adversarial examples during transmission. Different types of interference (linear noise, reverberant noise, and noise from the acquisition device) have different impacts on the characteristics of adversarial examples under different SNRs. This application sets up a system that dynamically adjusts the reliability weights and decision thresholds for different adversarial detection models based on the SNR of the transmission channel of the sample to be detected, so that the system relies more heavily on the most reliable adversarial detection model under the current channel conditions. In one example, the lower the SNR of the transmission channel, the higher the reliability weight of the adversarial detection model that is more robust to noise, thereby maintaining a high detection rate in harsh environments.

[0080] S202: Obtain the adversarial detection results of the sample to be detected based on each adversarial probability, each decision threshold, and each reliability weight.

[0081] In one example, for a sample to be detected, the formula for calculating the overall adversarial probability can be shown in formula (2):

[0082]

[0083] in, This represents the overall adversarial probability of the sample to be tested. The reliability weights of the first adversarial detection model, This represents the adversarial probability of the sample to be detected, output by the first adversarial detection model. The decision threshold for the first adversarial detection model; The reliability weights of the second adversarial detection model. This represents the adversarial probability of the sample to be detected, output by the second adversarial detection model. The decision threshold for the second adversarial detection model; As the reliability weight of the third adversarial detection model, This represents the adversarial probability of the sample to be detected, output by the third adversarial detection model. This is the decision threshold for the third adversarial detection model. For the discriminant function, when hour, ;when hour, .

[0084] When the overall adversarial probability of the sample to be tested is greater than or equal to the adversarial threshold, the sample to be tested can be determined as an adversarial sample; when the overall adversarial probability of the sample to be tested is less than the adversarial threshold, the sample to be tested can be determined as a normal sample. The adversarial threshold can be 0.7.

[0085] In one example ,in, Let be the critical adversarial probability, i.e. the decision threshold, for the i-th adversarial detection model to determine that the sample to be detected is an "adversarial sample" in the t-th round of detection; It is an adaptive factor that is dynamically adjusted based on the channel signal-to-noise ratio (SNR). Let be the arithmetic mean of the adversarial probabilities of all samples to be detected output by the i-th adversarial detection model in the (t-1)-th round of detection; Let be the standard deviation of the adversarial probability of all samples to be detected output by the i-th adversarial detection model in the (t-1)-th round of detection.

[0086] In one embodiment, please refer to Figure 3 Before screening adversarial samples and samples to be detected from the unknown sample set according to the preset reference noise distribution in step S102, the cross-domain adversarial sample detection method of this application further includes steps S301 to S303.

[0087] S301: Determine the target size based on the size of each unknown sample in the unknown sample set; the target size is greater than the size of at least some of the unknown samples.

[0088] In this application, the unknown samples are images. Deep learning models have fixed requirements for the size of input data, but the sizes of the unknown samples in the unknown sample set may not be uniform, making them unsuitable for direct input into the model. In related technologies, image sizes are usually adjusted by stretching, compressing, or cropping. However, this method can lead to distortion of sample textures. The core attack method of adversarial examples is pixel-level perturbations invisible to the human eye, such as brightness shifts of 1-2 pixels or subtle textures of local stickers. Scaling can cause these perturbations to spread, deform, or even disappear. For example, a 1-pixel adversarial stripe can be stretched into a 3-pixel blurry band. Cropping the image may directly cut off the area containing adversarial perturbations, causing subsequent detection to completely fail.

[0089] To avoid distortion of sample texture, after obtaining the unknown sample set, this application first determines a target size, and then fills the unknown samples with a size smaller than the target sample to the target size according to the target pixel value, so as to ensure that the core area of ​​the unknown image (including the area of ​​adversarial perturbation) has not been stretched, compressed or cropped, and its pixel arrangement, texture structure and minor perturbations are completely preserved, thus avoiding false detection of adversarial samples.

[0090] In one example, the target size ,in, The maximum value among the heights of all unknown samples in the unknown sample set. It represents the maximum width among all unknown samples in the unknown sample set.

[0091] S302: Determine the target pixel value based on the set of pixel values ​​of each unknown sample in the unknown sample set.

[0092] Each unknown sample includes multiple pixels, and the target pixel value is the average of the pixel values ​​of all pixels in all unknown samples in the unknown sample set.

[0093] S303: Fill the unknown target sample with pixels according to the target size and target pixel value; the size of the unknown target sample is smaller than the target size.

[0094] Specifically, for a single unknown sample, the size difference between the unknown sample and the target size is first calculated to determine the blank areas that need to be filled with pixels: the height needs to be supplemented. Width needs to be supplemented. H represents the height of the unknown sample, and W represents the width of the unknown sample. Fill pixels are allocated according to the principles of top-bottom and left-right symmetry, meaning the top and bottom of the image are each filled with pixels. Pixels, filled on both the left and right sides Pixel.

[0095] Next, the blank areas are filled with the target pixel values ​​to avoid obvious black and white edge noise in the filled areas and to prevent the model from misjudging the filled edges as valid features.

[0096] In one exemplary embodiment, please refer to Figure 4 The training method for the adversarial detection model includes steps S401 and S402.

[0097] S401: Obtain multiple training sample sets; multiple training samples in the same training sample set have the same type of interference; training samples in different training sample sets have different types of interference.

[0098] In the process of adversarial example generation, attackers add adversarial noise to natural samples to achieve their attack objectives. However, adversarial examples have complex sources and diverse modes of operation (e.g., gradient-based noise in the digital domain, adversarial examples generated through GANs, etc.). This invention first performs mathematical analysis and modeling of the adversarial example characteristics in the source and target domains. The source domain refers to the original data environment in which adversarial examples are generated, containing known attack methods. The noise distribution can be modeled as a Gaussian distribution, and it serves as the starting point for adversarial example generation, forming the basis for the open-coverage training set. The target domain refers to the unknown environment in which the adversarial examples ultimately operate. Adversarial examples generated from the source domain will be subject to cross-domain interference in the target domain.

[0099] To address the core issue of "feature shift after adversarial examples migrate from the source domain to an unknown target domain," this application proposes first theoretically modeling the adversarial perturbation in the source domain and then generalizing it to the unknown target domain, establishing a universally applicable mathematical model independent of specific target domain knowledge. For example, assuming natural samples... adversarial examples As shown in formula (3), the added noise It follows a truncated Gaussian distribution. The purpose of truncation is to limit the disturbance to a perceptible range, and its truncation radius is... It is one of the fundamental parameters for the subsequent construction of the opening ball cover.

[0100]

[0101] in, This indicates a truncated normal distribution. Let be the mean vector of the noise. Let Id be the variance, and Id be the d-dimensional identity matrix, where d is the dimension of the input sample. To counteract the attack intensity, noise is constrained, i.e., the cutoff radius. This ensures that the disturbance is imperceptible.

[0102] Due to the subtlety and imperceptibility of adversarial noise, adversarial examples are visually similar to natural examples. The noise distributions of adversarial examples also exhibit proximity; suppose there are two adversarial noise distributions: , ,in, Indicates a multivariate Gaussian distribution. To counteract the mean vector of the noise distribution P, To counteract the mean vector of the noise distribution Q, To combat the variance of the noise distribution P, To determine the variance of the adversarial noise distribution Q, the Wasserstein distance between the adversarial noise distributions P and Q can be obtained. The Wasserstein distance, also known as the Earth Mover's Distance (EMD), is used to represent the similarity between two distributions.

[0103] If it exists , making Then there is Then, the adversarial noise distribution P and the adversarial noise distribution Q can be called... - Neighborhood noise distribution, where The difference threshold is the difference between the mean vector of the noise. This is the difference threshold for variance.

[0104] In other words, this application quantifies the similarity between two adversarial noise distributions by introducing the Wasserstein distance. If two adversarial noise distributions are sufficiently "close," they are referred to as... - Neighboring noise distributions, and there is the following relationship between adversarial noise distributions:

[0105] 1. All distributions that are adversarial to known distributions The distribution of nearby noise constitutes Centered on the opening -ball, denoted as and form a metric space. This allows us to "scan" potential cross-domain perturbations using a set of open covers. Therefore, by training a detection model on these open covers, we can distinguish between the distribution of natural data and adversarial data, thereby effectively detecting unknown adversarial attacks across the digital domain.

[0106] 2. Based on metric space Properties for any subset The subset exists Open coverage .

[0107] 3. Given the adversarial noise distribution , can be satisfied A random sampling method is used to obtain an open cover of the adversarial distribution set. Training a detection model on this open cover can distinguish between natural and adversarial data distributions, thus effectively detecting unknown adversarial attacks across the digital domain.

[0108] In summary, by engaging with a known adversarial distribution - All neighboring distributions can form an open region centered on that distribution. - Sphere. By constructing an open cover consisting of multiple such open spheres, this invention theoretically covers the perturbation patterns that may occur from the source domain to various potentially unknown target domains. This means that the training set constructed in this way theoretically contains "approximate versions" of adversarial examples that may be encountered in the unknown target domain.

[0109] Furthermore, this application applies the aforementioned universal theory to the key cross-domain scenario of "wireless transmission" and accurately models the specific and describable interference therein.

[0110] Specifically, adversarial examples are susceptible to interference in the channel during wireless transmission, especially during the conversion from the physical domain to the digital domain. They are affected by linear noise in the physical domain, reverberation noise propagating in space, or changes in image properties caused by the acquisition device (such as changes in image color and texture due to resolution). This can lead to the original adversarial example being generated from the source domain. To the unknown domain Changes in the perturbation pattern disrupt the original perturbation pattern, thereby affecting the adversarial example detection mechanism. In this application, the types of interference encountered by adversarial examples during wireless transmission include at least linear noise interference, reverberant noise interference, and noise interference from the acquisition device.

[0111] In one example, the modeling process for linear noise interference can be shown in Equation (4):

[0112]

[0113] Linear noise interference refers to pixel value shift caused by channel noise. A is the channel attenuation matrix. It refers to the original signal or image in the physical domain. It is a digital signal obtained by receiving and converting data through a wireless channel. It is additive white Gaussian noise, following a distribution. .

[0114] The modeling process for reverberant noise interference can be shown in Equation (5):

[0115]

[0116] Here, reverberant noise interference refers to spatial distortion caused by multipath effects. k is the reverberation kernel function characterizing the multipath propagation characteristics. For the infinite norm strength constraint of noise, This represents the convolution operation. This is the additive noise remaining after the convolution operation, and its intensity is constrained by the infinity norm. .

[0117] The modeling process for noise interference from the acquisition equipment can be shown in formula (6):

[0118]

[0119] Among them, noise interference from the acquisition equipment refers to texture degradation caused by changes in resolution. This indicates a downsampling operation. This refers to the noise introduced during the quantization process.

[0120] It should be noted that the above is based on open... The universal modeling of the sphere aims to cover a wide range of unknown distribution shifts. However, the wireless transmission modeling in this application provides an explicit, quantitative description of the specific cross-domain scenario of physical-to-digital domain transition. When the interference is nonlinear or combined noise, the new adversarial noise distribution... Deviating from the aforementioned opening - The range of the ball. To this end, the present invention introduces a comprehensive detection method based on gradient alignment and multimodal image feature fusion in subsequent steps, aiming to remap and project these adversarial samples that have been "pulled out of the ball" due to strong interference onto a domain-invariant, discriminable feature space, thereby restoring their detectability.

[0121] In this embodiment of the application, the types of interference encountered by the adversarial sample during wireless transmission include at least linear noise interference, reverberant noise interference and acquisition device noise interference. Therefore, training sample sets for linear noise interference, reverberant noise interference and acquisition device noise interference can be constructed by formulas (4), (5) and (6), respectively.

[0122] S402: Use multiple training sample sets to train the pre-built initial adversarial detection model and obtain multiple adversarial detection models.

[0123] After obtaining the training sample sets for linear noise interference, reverberant noise interference, and noise interference from the acquisition device, the pre-built initial adversarial detection model can be trained using each training sample set, resulting in adversarial detection models for linear noise interference, reverberant noise interference, and acquisition device noise interference, respectively.

[0124] In one exemplary embodiment, the training sample set includes a source domain adversarial sample set and a target domain interference sample set; see also Figure 5 Step S401: Obtain the training sample set, including steps S501 to S503.

[0125] S501: Obtain the target perturbation direction based on the preset source domain natural sample set and the preset random orthogonal vector.

[0126] The source domain natural sample set includes natural samples from multiple physical domains that do not contain adversarial noise.

[0127] First, based on the source domain natural sample set, the preset loss function, and the preset random noise variables, the main perturbation direction for adversarial noise is calculated. The calculation formula can be shown in formula (7):

[0128]

[0129] Specifically, formula (7) is defined along the gradient direction of the loss function, aiming to generate highly aggressive samples. This formula describes... The direction of the adversarial noise perturbation, i.e., the sampling direction, makes the loss function... The direction to maximize. Where x is the source domain natural sample set. To counter disturbances gradient, To handle random noise Expectations The sign function indicates the direction in which the model produces high-confidence misclassifications. The goal is to generate effective adversarial examples that resonate within the metric space. The purpose of approximating the normal sample distribution is to fill in adversarial examples on the classification boundary to prevent the model from underfitting.

[0130] Furthermore, to prevent linear clustering of generated adversarial examples, i.e., all adversarial examples concentrated in a single gradient direction, leading to insufficient coverage, orthogonal random vectors are introduced. That is, according to the direction of the main disturbance Preset random vector Obtain the extended perturbation direction The calculation formula can be shown in formula (8):

[0131]

[0132] Finally, based on the direction of the extended disturbance and the direction of the main disturbance Obtain the direction of the target disturbance The calculation formula can be shown in formula (9):

[0133]

[0134] Where 'a' is the weight parameter.

[0135] S502: Obtain the source domain adversarial sample set based on the target perturbation direction, the preset perturbation intensity constraint, and the source domain natural sample set.

[0136] Furthermore, the source domain adversarial sample set can be obtained. .in, To control the intensity of the perturbation, we need to ensure that the perturbed features are located near the class boundary.

[0137] S503: Generate a target domain interference sample set based on the source domain adversarial sample set and the target interference type.

[0138] After obtaining the source domain adversarial sample set, the target domain interference sample set for linear noise interference, the target domain interference sample set for reverberant noise interference, and the target domain interference sample set for noise interference from the acquisition device can be generated by using the above formulas (4), (5) and (6), respectively. This can be understood as the formulas (4), (5), and (6) .

[0139] In one exemplary embodiment, please refer to Figure 6 Step S402 involves training the pre-built initial adversarial detection model using the training sample set and obtaining the adversarial detection model, including steps S601 and S602.

[0140] S601: Input the training sample set into the initial adversarial detection model and obtain the comprehensive loss of the initial adversarial detection model.

[0141] First, the source domain adversarial sample set from the training sample set is input into the initial adversarial detection model to obtain the source domain gradient. And input the target domain interference sample set from the training sample set into the initial adversarial detection model to obtain the target domain gradient. In one example, please refer to formula (10):

[0142]

[0143] in, The gradient of the model corresponding to the source domain adversarial sample set represents the sensitivity of the detection model parameters to the source domain adversarial samples and the direction of their update. To adjust model parameters The gradient operator is used to solve for the partial derivatives of the loss function with respect to the model parameters. For the initial adversarial detection model The set of trainable parameters, such as the weights and biases of a neural network. The loss function for the detection model on the source domain adversarial sample set; The labels for each sample in the source domain adversarial sample set are used to indicate whether a sample is an adversarial sample. Formula (10) is used to calculate the gradient of the source domain adversarial sample in the parameter space of the initial adversarial detection model. It is the basis for subsequent cross-domain gradient alignment. Its core is to quantify the parameter update trend of the detection model on the source domain adversarial sample, and to provide data support for the consistency constraint of gradient distribution between the source and target domains. Target domain gradient The calculation method is similar to that of formula (10).

[0144] Secondly, based on the source domain gradient and Gradient acquisition of target domain and gradient alignment loss Please refer to formula (11):

[0145]

[0146] in, The Wasserstein distance measures the difference in distribution between the mean gradients of the source and target domains, providing a more robust measure of the similarity between the two distributions. gradient of the source domain The mean value reflects the average trend of parameter updates for the entire source domain sample. target domain gradient The mean value reflects the average trend of parameter updates for the entire target domain sample. The weights used to balance the hyperparameters are adjusted to control the gradient covariance difference loss. gradient of the source domain The covariance matrix represents the degree of dispersion of the gradient distribution in the source domain and the correlation characteristics between parameters. Gradient of the target domain The covariance matrix represents the degree of dispersion of the gradient distribution in the target domain and the correlation characteristics between parameters. is the Frobenius norm, used to calculate the matrix inner product error between two covariance matrices, quantifying the overall difference between the matrices. Equation (11) is the cross-domain gradient alignment loss function, used to force the gradient distribution of the source domain and the target domain to be consistent, forcing the detection model to learn the domain-invariant decision boundary, thereby improving the model's generalization ability in the unknown target domain.

[0147] Next, by maximizing the mutual information between the source domain adversarial examples and the target domain perturbed samples in the adversarial detection model, the domain-invariant feature loss is obtained. Please refer to formulas (12) and (13) for details:

[0148]

[0149] Formula (13) is mutual information The general mathematical formula for calculating the correlation between any two random variables X and Y is used to quantify the degree of information correlation between them. It is the formula (12) used to calculate the correlation between X and Y. and The theoretical basis for mutual information. For domain-invariant feature loss, the smaller the value, the higher the mutual information between the source and target domain features, and the better the learning effect of domain-invariant features. For the initial adversarial detection model, the source domain adversarial sample set Extracted feature representation. For the initial adversarial detection model, the source domain adversarial sample set Extracted feature representation. Formula (12) is used to maximize the mutual information of the features of the source domain adversarial samples and the target domain adversarial samples in the adversarial detection model, so that the model focuses on the core features of adversarial itself and ignores domain-specific noise (such as wireless transmission noise and device noise), thereby enhancing the robustness of cross-domain detection. The negative sign in the formula is to transform "maximizing mutual information" into the optimization objective of "minimizing" the loss function.

[0150] Then, based on the training sample set and the source domain natural sample set, the standard classification loss is obtained. Please refer to formula (14):

[0151]

[0152] in, This represents the standard classification loss; a smaller value indicates a higher degree of match between the model's predictions and the true labels. The total number of samples involved in the loss calculation can be the total number of samples in the training sample set and the source domain natural sample set. C represents the total number of categories in the classification task; C can be 2, indicating that there are two categories: adversarial samples and normal samples. This indicates that the i-th sample corresponds to the true label of class c. Formula (14) is used to measure the difference between the model's predicted probability of whether a sample is an adversarial sample and the true label, ensuring that the model has basic adversarial sample discrimination ability.

[0153] Finally, the combined gradient alignment loss, domain-invariant feature loss, and standard classification loss are used to obtain the comprehensive loss. Please refer to formula (15):

[0154]

[0155] in, These are the weighting coefficients.

[0156] S602: Update the initial adversarial detection model based on the comprehensive loss, and continue detection until the comprehensive loss converges to obtain the adversarial detection model.

[0157] In one example, please refer to formula (16):

[0158]

[0159] in, The learning rate of the deep learning model is used to iteratively optimize the loss function of the initial adversarial detection model using formula (15). The parameters are updated using gradient descent according to formula (16). When the performance of the model on the validation set tends to be stable and the loss function converges, the adversarial detection model is considered to have been trained.

[0160] In one embodiment, see Figure 7 Before performing adversarial detection on the samples, this application first constructs target domain interference sample sets for linear noise interference, reverberant noise interference, and acquisition device noise interference according to formulas (4) to (7), respectively, to obtain three types of training sample sets. The training sample sets include source domain adversarial sample sets and target domain interference sample sets of corresponding interference types.

[0161] Then, by combining formulas (10) to (16), the three initial adversarial detection models are trained respectively to obtain three types of adversarial detection models targeting different types of interference.

[0162] When detecting unknown sample sets, the unknown samples are first adaptively padded to eliminate texture distortion caused by scaling and maintain the original adversarial perturbation characteristics. Next, KL divergence pre-screening is performed on each unknown sample to quickly identify high-threat samples and samples that are significantly deviated from the spherical distribution due to strong interference. If the KL divergence exceeds a preset KL threshold, it is directly identified as an adversarial sample; otherwise, it is sent to a more refined detection model for further discrimination. This forms a two-stage pipeline of "rapid screening" and "refined detection," balancing efficiency and accuracy. Finally, using three adversarial detection models corresponding to three typical types of interference in the wireless transmission process, the reliability weights and decision thresholds of the three adversarial detection models are dynamically adjusted based on real-time channel quality. The lower the SNR, the higher the weight of the adversarial detection model with stronger noise robustness, thus maintaining a high detection rate even in harsh environments—this is the embodiment of "enhanced generalization ability." Finally, if the weighted voting result, i.e., the overall adversarial probability of the sample to be detected, exceeds the adversarial threshold, the sample to be detected is determined to be an adversarial sample.

[0163] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0164] Based on the same inventive concept, this application also provides a cross-domain adversarial sample detection device for implementing the cross-domain adversarial sample detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the cross-domain adversarial sample detection device provided below can be found in the limitations of the cross-domain adversarial sample detection method described above, and will not be repeated here.

[0165] In one exemplary embodiment, a cross-domain adversarial example detection apparatus is provided, comprising:

[0166] The first execution module is used to obtain the unknown sample set and the signal-to-noise ratio of the transmission channel of each unknown sample in the unknown sample set;

[0167] The second execution module is used to filter adversarial samples and samples to be detected from the unknown sample set according to the preset reference noise distribution.

[0168] The third execution module is used to input the sample to be detected into multiple pre-trained adversarial detection models, and obtain multiple adversarial probabilities of the sample to be detected. The adversarial detection model is used to predict the probability that the sample to be detected is an adversarial sample. Different adversarial detection models target different types of interference.

[0169] The fourth execution module is used to obtain the adversarial detection result of the sample to be detected based on the signal-to-noise ratio of the transmission channel of the sample to be detected and the adversarial probabilities of the sample to be detected.

[0170] Each module in the aforementioned cross-domain adversarial example detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0171] In one exemplary embodiment, this application provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any of the above embodiments.

[0172] The computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a cross-domain adversarial example detection method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0173] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0174] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the above embodiments.

[0175] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described in any of the above embodiments.

[0176] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0177] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0178] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0179] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting cross-domain adversarial examples, characterized in that, The method includes: Obtain the unknown sample set, and the signal-to-noise ratio of the transmission channel of each unknown sample in the unknown sample set; Based on a preset reference noise distribution, adversarial samples and samples to be detected are screened from the set of unknown samples; The sample to be detected is input into multiple pre-trained adversarial detection models to obtain multiple adversarial probabilities for the sample to be detected. The adversarial detection model is used to predict the probability that the sample to be detected is an adversarial sample. Different adversarial detection models target different types of interference. Based on the signal-to-noise ratio of the transmission channel of the sample to be detected and the adversarial probabilities of each sample to be detected, the adversarial detection result of the sample to be detected is obtained.

2. The cross-domain adversarial example detection method according to claim 1, characterized in that, The step of obtaining the adversarial detection result of the sample to be detected based on the signal-to-noise ratio of the transmission channel of the sample to be detected and the adversarial probabilities of each sample to be detected includes: Based on the signal-to-noise ratio of the transmission channel of the sample to be detected, determine the decision threshold and reliability weight of each adversarial detection model; Based on the adversarial probabilities, decision thresholds, and reliability weights, the adversarial detection results of the sample to be detected are obtained.

3. The cross-domain adversarial example detection method according to claim 1, characterized in that, Before screening adversarial samples and samples to be detected from the unknown sample set according to a preset reference noise distribution, the method further includes: A target size is determined based on the size of each unknown sample in the unknown sample set; the target size is larger than the size of at least a portion of the unknown samples. The target pixel value is determined based on the set of pixel values ​​of each unknown sample in the unknown sample set; the target pixel value is the average of the pixel values ​​of each pixel in each unknown sample. The unknown target sample is pixel-filled according to the target size and the target pixel value; the size of the unknown target sample is smaller than the target size.

4. The cross-domain adversarial example detection method according to claim 1, characterized in that, The training method for the adversarial detection model includes: Multiple training sample sets are obtained; multiple training samples in the same training sample set have the same type of interference; training samples in different training sample sets have different types of interference. Using multiple training sample sets, the pre-constructed initial adversarial detection model is trained, and multiple adversarial detection models are obtained.

5. The cross-domain adversarial example detection method according to claim 4, characterized in that, Using a training sample set, a pre-constructed initial adversarial detection model is trained, and the adversarial detection model is obtained, including: Input the training sample set into the initial adversarial detection model to obtain the comprehensive loss of the initial adversarial detection model; The initial adversarial detection model is updated based on the comprehensive loss, and the detection continues until the comprehensive loss converges, thus obtaining the adversarial detection model.

6. The cross-domain adversarial example detection method according to claim 4, characterized in that, The training sample set includes a source domain adversarial sample set and a target domain interference sample set; Obtain the training sample set, including: The target perturbation direction is obtained based on a preset source domain natural sample set and a preset random orthogonal vector; Based on the target perturbation direction, the preset perturbation intensity constraint, and the source domain natural sample set, obtain the source domain adversarial sample set; Based on the source domain adversarial sample set and the target interference type, a target domain interference sample set is generated.

7. The cross-domain adversarial example detection method according to claim 6, characterized in that, The step of obtaining the target perturbation direction based on a preset source domain natural sample set and a preset random orthogonal vector includes: Based on the source domain natural sample set, the preset loss function, and the preset random noise variables, the main perturbation direction is obtained; Based on the main disturbance direction and the preset random vector, the extended disturbance direction is obtained; The target disturbance direction is obtained by combining the extended disturbance direction and the main disturbance direction.

8. The cross-domain adversarial example detection method according to claim 6, characterized in that, The step of inputting the training sample set into the initial adversarial detection model and obtaining the comprehensive loss of the initial adversarial detection model includes: Input the training sample set into the initial adversarial detection model to obtain the source domain gradient and the target domain gradient; The gradient alignment loss is obtained based on the source domain gradient and the target domain gradient; By maximizing the mutual information between the source domain adversarial sample and the target domain interference sample in the adversarial detection model, the domain-invariant feature loss is obtained. Based on the training sample set and the source domain natural sample set, obtain the standard classification loss; The comprehensive loss is obtained based on the gradient alignment loss, the domain-invariant feature loss, and the standard classification loss.

9. A cross-domain adversarial sample detection device, characterized in that, The device includes: The first execution module is used to acquire an unknown sample set and the signal-to-noise ratio of the transmission channel of each unknown sample in the unknown sample set; The second execution module is used to filter adversarial samples and samples to be detected from the unknown sample set according to the preset reference noise distribution. The third execution module is used to input the sample to be detected into multiple pre-trained adversarial detection models to obtain multiple adversarial probabilities of the sample to be detected; the adversarial detection model is used to predict the probability that the sample to be detected is an adversarial sample, and different adversarial detection models target different types of interference. The fourth execution module is used to obtain the adversarial detection result of the sample to be detected based on the signal-to-noise ratio of the transmission channel of the sample to be detected and the adversarial probabilities of the sample to be detected.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images