Black-box perturbation adversarial method for semantic tampering

Abstract

The present application belongs to the field of wireless communication and information security technology, and aims to provide a black-box perturbation attack method to improve the robustness of attacks in a heterogeneous black-box scenario and effectively evade existing defense measures. The present application is a black-box perturbation attack method for semantic tampering, which constructs a local knowledge base, builds a generative adversarial module containing a generator and a discriminator, and constructs a cross-layer collaborative covert interference model. The constructed local knowledge base is used to guide the semantic tampering of the perturbation generated by the interference model, and the tampering strategy based on semantic relative entropy is used to guide gradient optimization. The training of the generator is generalized by multiple decoding strategies to solve the problem of single model overfitting. Through the fusion of explicit precoding and implicit statistical enhancement channel adaptive mechanism, the channel mismatch problem is solved, and finally the generated perturbation is superimposed into the wireless channel, which ensures the transparent transmission of the physical link and misleads the semantic decoding of the receiving end. The present application is mainly applied to black-box perturbation attack occasions.

Description

Technical Field

[0001] This invention belongs to the field of wireless communication and information security technology, and relates to a method for countering semantic communication systems in open wireless channel environments. It aims to improve the concealment, portability, and robustness of semantic tampering attacks under black-box conditions, and is particularly suitable for scenarios such as 6G smart communication, semantic IoT, and intrinsic security assessment of communications. Specifically, it relates to a black-box perturbation countermeasure method for semantic tampering. Background Technology

[0002] Currently, mobile communication technology is undergoing a critical transformation from the "Internet of Everything" to the "Intelligent Internet of Everything." To drive intelligent decision-making, the carrier elements of communication networks have shifted from simple data bits to high-level semantic features and knowledge insights. Semantic communication, as a potential core technology of 6G systems, is expected to break through the traditional Shannon capacity limit by introducing deep neural networks to extract key features of the information source. However, deep learning networks have inherent vulnerabilities, leading to serious inherent security risks in communication systems. At the receiver, even the smallest perturbation applied by an attacker, though with extremely low energy and difficult to detect by traditional energy detection methods, is enough to induce catastrophic semantic understanding biases in the decoder. For safety-critical applications such as autonomous driving and telemedicine, such semantic-level attacks could trigger serious decision-making accidents.

[0003] Although a relatively mature adversarial example system has been built in the field of computer vision, directly transplanting it to physical layer semantic communication scenarios faces two severe challenges: First, the limitation of the attack environment. Real-world scenarios often exhibit black-box characteristics, making it difficult for attackers to obtain the model parameters and semantic distribution of the target system. This high degree of information asymmetry greatly limits the effectiveness of the attack. Second, the complexity of physical channels. Unlike digital domain attacks, perturbations need to be transmitted through real physical channels. Multipath fading and noise interference can destroy the fine structure of the perturbations, leading to reduced attack effectiveness. Summary of the Invention

[0004] To overcome the shortcomings of existing technologies, this invention aims to propose a perturbation-based semantic adversarial attack (PseAdv) method for semantic tampering. This method can improve the robustness of attacks in heterogeneous black-box scenarios and effectively circumvent existing defense measures. The technical solution adopted by this invention is a black-box perturbation adversarial method for semantic tampering, which involves constructing a local knowledge base and building a generator... With discriminator The generative adversarial module constructs a cross-layer collaborative covert interference model, utilizing a constructed local knowledge base to guide semantic modification of the perturbations generated by the interference model, and employing a modification strategy based on semantic relative entropy to guide gradient optimization; the generator... The training performs multi-decoding strategy generalization to solve the problem of overfitting of a single model; the channel mismatch problem is handled by a channel adaptation mechanism that integrates explicit precoding and implicit statistical enhancement, and finally the generated disturbance is superimposed on the wireless channel, so as to mislead the semantic decoding of the receiver while ensuring transparent transmission of the physical link.

[0005] Step 1: Construct a system model and a local knowledge base, and set attack constraints and targets. The attacker is located between the sender and receiver. In the absence of obtaining the target system model parameters, a local knowledge base is constructed based on a public dataset, and the signal from the sender is intercepted and preprocessed to obtain the input semantic vector.

[0006] Step 2: Construct a cross-layer collaborative covert perturbation model based on a Generative Adversarial Network (GAN) for the input semantic vectors obtained in Step 1, generating basic perturbations. The GAN architecture includes a perturbation generator. and discriminator The generator generates perturbations under power constraints, and the discriminator forces the perturbations to fit Gaussian white noise on a statistical distribution to achieve physical layer concealment.

[0007] Step 3: Using the local knowledge base built in Step 1, semantic tampering guidance is performed on the perturbation generated in Step 2. Under the condition of heterogeneous attack and defense knowledge bases, by maximizing the semantic relative entropy between the perturbation difference of the intercepted signal and the undisturbed signal, the gradient optimization direction is guided to deviate from the structural dependence on the local knowledge base and point to the direction with the largest semantic deviation.

[0008] Step 4: Introduce an expert model-based mechanism to generalize the training of the generator described in Step 3 using a multi-decoding strategy, constructing a system that includes... A collection of expert models from heterogeneous decoders. These expert models are based on different deep neural network architectures, specifically... The ResNet residual network structure and It consists of a densely connected network (DenseNet) structure, in which To simulate the diversity of semantic decoders at the receiver in real communication scenarios, the deep neural networks, including residual networks and densely connected networks, work together as independent and complementary decoding branches to execute differentiated decoding strategies on the same intermediate feature output by the generator. The variance inverse weighting strategy is used to dynamically aggregate expert decisions to solve the overfitting problem of a single decoding model.

[0009] Step 5: Apply an explicit-implicit cooperative channel adaptation mechanism to the disturbance generated in Step 4 to ensure transmission effectiveness. Combine precoding compensation based on explicit channel state information and statistical enhancement based on implicit data-driven methods to eliminate distortion caused by channel fading and noise, and ensure the effectiveness of the disturbance after transmission through the wireless channel.

[0010] Step 6: Based on the loss functions defined in Steps 2 to 5 above, minimize the joint loss function to train the generative model and carry out the attack. Integrate concealment, semantic tampering, transmission transparency and expert integration constraints to train the perturbation generator end-to-end, and inject the perturbation generated by the trained generator into the wireless channel to carry out the countermeasure.

[0011] The specific implementation steps are as follows:

[0012] Step 1: Construct a system model and local knowledge base. Based on a public dataset, construct a local knowledge base containing semantic encoder and decoder structures related to the target semantic communication system task. Intercept and preprocess the signal from the transmitting end to obtain the input semantic vector. Set the objective as: generating optimal, power-constrained small perturbations based on the local knowledge base to mislead the receiving end into outputting specific erroneous semantic information with high confidence. This objective is modeled as a cross-layer cooperative covert interference optimization problem, expressed as:

[0013]

[0014] The constraints include three aspects: ① Attack effectiveness C0, that is, the generated adversarial sample enables the receiver to perform semantic parsing mapping. Output feature vector With the original semantic vector The semantic distance between them exceeds the threshold And semantic error rate At least as high as the preset attack success rate ② Statistical concealment C1 and power constraint C2, i.e., the generated disturbance Capable of resisting statistical anomaly detection, perturbation Not only should it be limited by power budget feasible domain Within, its statistical distribution We also need to fit the background noise, which requires its cumulative distribution function. Compared with standard Gaussian distribution The maximum deviation does not exceed ③ Transmission transparency C3, that is, to avoid the receiver refusing to decode due to the detection of signal inconsistency, the differences in the reconstructed signal need to be considered. The measured syntax error rate Controlled within the tolerance threshold Within;

[0015] Step 2: Process the input semantic vector obtained in Step 1. Constructing a cross-layer collaborative covert interference model based on adversarial networks (GANs): including a generator With discriminator Generative Adversarial Module, Discriminator The task is to maximize the difference generated by the adversarial perturbation. Compared with real Gaussian white noise The ability, its loss function Defined as the expected form of the binary cross-entropy (BCE):

[0016]

[0017] Among them, label 0 corresponds to Gaussian noise samples, and label 1 corresponds to generated perturbation samples;

[0018] In actual training, Monte Carlo sampling is used to empirically estimate the expectation:

[0019]

[0020] Generator The goal is to generate perturbation samples that can deceive the discriminator, causing it to be misclassified as real noise, thus creating a zero-sum game with the discriminator. Its adversarial loss function... Defined as:

[0021]

[0022] To strictly meet the power budget of the physical layer To enhance stealth, a truncated power normalization layer is introduced for the generator. The original perturbation vector output is then projected as follows:

[0023]

[0024] in For the generator's input;

[0025] The perturbation waveform generated through joint optimization can achieve physical layer statistical concealment, and can disguise Gaussian noise in both energy spectral density and amplitude statistical distribution.

[0026] Furthermore, further design of transmission transparency constraints The aim is to attack performance, i.e., semantic error rate. Communication quality, i.e., syntax error rate Seeking the optimal balance between:

[0027]

[0028] in, For hyperparameters;

[0029] Step 3: Using the local knowledge base built in Step 1, construct a semantic tampering strategy based on semantic relative entropy to modify the perturbation generated in Step 2. Semantic manipulation: The construction of semantic relative entropy is based on the source grammar space To the target semantic space The probability measure is passed, a process that relies on a synonym mapping mechanism based on a semantic knowledge base. Specifically, the synonym mapping is constructed by the semantic encoder. In the set of grammar symbols The above induces an equivalence partition, for any semantic symbol Its synonym set is According to the law of total probability, symbols in semantic space Induced probability This represents the aggregation of the probabilities of all grammatical samples within its synonym set, i.e.:

[0030]

[0031] Based on this, two different semantic distributions are formally defined. and Semantic relative entropy between Measure when using distribution Fitting the true semantic distribution Information gain loss caused by time:

[0032]

[0033] In a perturbation attack scenario, let the original semantic distribution be... The perturbation distribution is Taylor expansion analysis In the original distribution Approximation form in the vicinity:

[0034]

[0035] because Furthermore, it takes the global minimum at this point, and the first-order gradient term is zero. The above expression mainly consists of the Fisher information matrix. The second-order term dominates, given that Under regularity conditions, it is a positive semi-definite matrix, and for non-trivial perturbations ( ),have:

[0036]

[0037] The above equation shows that semantic relative entropy is not only monotonically positively correlated with the degree of distribution shift, but also maximizes... This is equivalent to finding the direction along which the Fisher information changes most in the semantic manifold and applying a perturbation, thereby inducing more significant semantic understanding biases with less perturbation cost;

[0038] By building a local knowledge base, the intercepted samples are quantified. The semantic distribution difference before and after the disturbance is analyzed, and the gradient optimization direction is guided to deviate from dependence on local prior knowledge by maximizing the semantic relative entropy between the disturbance difference and the undisturbed signal. Specifically, the interfering party first bases its algorithm on the local knowledge base. intercepted samples Semantic decoding is performed to obtain semantic feature vectors. Its semantic distribution can be represented as Subsequently, the perturbation generated in step 2 was superimposed. The samples are decoded again to obtain the perturbed semantic features. and its semantic distribution To quantize the semantic distribution differences caused by perturbations, a difference function is defined. for:

[0039]

[0040] Accordingly, in order to maximize semantic distribution and The relative semantic entropy, the loss function for semantic tampering. Defined as the negative value of this relative semantic entropy:

[0041]

[0042] During backpropagation, the gradient is dynamically updated using the chain rule:

[0043]

[0044] Among them, auxiliary variables The above mechanism uses differential operations. It effectively shields the priors unique to the local knowledge base, allowing the attack strategy to break free from the structural dependence on the local representation and instead focus on maximizing the search for relative semantic differences. This avoids the impact of the heterogeneity of the knowledge bases of the attacker and defender. On this basis, the mechanism can dynamically adjust the perturbation distribution to ensure that the generated gradient always points to the region with the largest semantic deviation, thereby improving the convergence speed of training while achieving efficient semantic modification.

[0045] Step 4: Constructing a multi-decoding generalization transfer model based on an expert model: First, construct a model containing... A set of experts for a decoding model based on a heterogeneous deep neural network architecture The expert model employs a deep neural network architecture, specifically including... A residual network ResNet and A densely connected network, DenseNet, satisfies Each decoder Pre-training is performed on different priors to simulate the diversity of receivers in real-world communication scenarios; during the training phase, the perturbations generated in step 3... The perturbation is simultaneously injected into all expert models in parallel. To quantify the combined attack effectiveness of the perturbation across different models, the ensemble attack objective function is defined as maximizing the joint attack confidence across all expert models. Correspondingly, the expert ensemble loss function is... The definition is as follows:

[0046]

[0047] in, Indicates the first An expert model Input the disturbance generated in step 3 Then, the posterior probability of the incorrect semantic prediction is output, which is the probability of a successful attack. The dynamic weighting coefficients assigned to this expert satisfy the following conditions: ;

[0048] Introducing an inverse variance weighting strategy Dynamic allocation is employed; this strategy aims to suppress experts with drastically fluctuating outputs and enhance the robustness of attack features. The weight calculation formula is as follows:

[0049]

[0050] in, Indicates the first The performance feedback variance of each expert is used to measure the stability of that expert's response to the current attack strategy. This mechanism, by assigning higher weights to experts with low performance volatility and reliable predictions, forces the generative model to aggregate common attack features with high confidence.

[0051] Step 5: Apply an explicit-implicit cooperative channel adaptation mechanism to the disturbance generated in Step 4: Construct a cooperative mechanism that integrates explicit precoding compensation and implicit feature statistical enhancement. The explicit channel precoding is based on the channel reciprocity of the time-division duplex system, and the attacker estimates the channel matrix of the attack link. And construct a power-limited actual launch perturbation. This allows the baseband semantic perturbation to approximate the ideal value at the receiving end after transmission through the channel. ;

[0052] Considering the noise amplification effect during the channel inversion process, this precoding problem is modeled as the following regularized least squares optimization problem:

[0053]

[0054] in, This is the regularization coefficient, used to balance the channel compensation accuracy with the interference power leakage at the receiver;

[0055] Given the channel matrix Given the diagonal properties, the above multidimensional optimization problem can be decomposed into: There are several independent scalar convex optimization subproblems. For the first... The optimization objective is expressed as: subcarriers, where:

[0056]

[0057] in for The One diagonal element;

[0058] To solve this constrained optimization problem, Lagrange multipliers are introduced. And construct the Lagrange function Solve using the Carroll-Kun-Tucker conditions:

[0059]

[0060] make Regarding conjugate variables The partial derivative of is zero, that is The optimal compensation disturbance is derived. Closed-form solution:

[0061]

[0062] The explicit module essentially performs regularized zero-forcing precoding, providing basic amplitude equalization and phase calibration for the interference signal;

[0063] The implicit enhancement mechanism first constructs a system containing... A set of real channel state samples Based on this, a perturbation generator is trained, with the optimization objective of learning a robust feature transform that implicitly compensates for channel distortion; specifically, through the sample space The training process involves traversing the data to simulate the "generation-transmission-distortion" link in the physical layer transmission process, specifically for each channel sample. Introducing the corresponding transmission effects, the network continuously updates its parameters through the backpropagation algorithm. To maximize the expected attack effectiveness across the entire channel set:

[0064]

[0065] in, Indicates based on estimated channel Explicit precoding operations, This indicates the signal processing and semantic decoding operations at the receiving end. This is the loss function for semantic attacks.

[0066] The trained generative network By incorporating statistical prior information about the channel environment, even in the event of instantaneous CSI loss or inaccuracy during actual attacks, the generated disturbances can still adaptively compensate for explicit precoding based on learned statistical laws. The synergistic cooperation between explicit estimation and implicit learning mechanisms can ensure that the system improves its robustness against attacks in dynamic time-varying channels.

[0067] Step 6, Joint Optimization and Attack Implementation: Considering the above constraints, a composite loss function is constructed to train the generator end-to-end.

[0068]

[0069] in, These are hyperparameters used to adjust the contribution weights of different constraint terms in the total gradient and to adjust the contribution weights of different constraint terms in the descent direction of the total gradient. Under this optimization paradigm, the goal is to minimize... Under the premise of satisfying statistical, power and transmission transparency constraints, the generator uses a semantic difference mechanism to eliminate the influence of local priors and find the perturbation direction that can maximize the directional shift of the target semantic space.

[0070] The features and beneficial effects of this invention are:

[0071] (1) This invention constructs a cross-layer collaborative covert interference model, which effectively avoids the anomaly detection mechanism. By using a generative adversarial network, the statistical distribution of the disturbance is made to fit Gaussian white noise, thus achieving physical layer covertness; at the same time, a transmission transparency constraint is introduced to dynamically balance semantic errors and syntax errors, preventing the receiver from refusing to decode due to a surge in bit error rate.

[0072] (2) This invention proposes a black-box attack strategy based on semantic relative entropy, solving the problem of heterogeneous attack and defense knowledge bases. It utilizes a semantic differential mechanism to quantify the relative entropy before and after perturbation, guiding gradient optimization to decouple from dependence on a specific local knowledge base. Even under conditions where the attacker does not know the target model parameters and the knowledge base is heterogeneous, it can still accurately induce semantic bias. Simultaneously, a generalization and transfer mechanism based on expert models is designed to improve the attack's versatility. Employing a multi-expert ensemble and variance inverse weighting strategy, the decision boundaries of different decoders are dynamically aggregated, effectively suppressing the overfitting problem of a single model and significantly enhancing the generalization ability and robustness of the attack algorithm when facing unknown semantic communication systems.

[0073] (3) This invention constructs an explicit-implicit cooperative channel adaptation mechanism to overcome the problem of attack failure under dynamic channels. By explicitly precoding to eliminate linear transmission interference and combining implicit network learning to compensate for residual distortion caused by environmental jitter, the physical prior and data-driven complementarity are realized, ensuring that weak disturbances can still maintain attack effectiveness in time-varying fading channels. Attached Figure Description

[0074] Figure 1 Flowchart of this invention. Detailed Implementation

[0075] This invention aims to propose a perturbation-based semantic adversarial attack (PseAdv) method for semantic tampering. This method improves the robustness of attacks in heterogeneous black-box scenarios and effectively circumvents existing defenses. The technical solution adopted in this invention is a black-box perturbation adversarial method for semantic tampering, which involves constructing a local knowledge base and building a generator... With discriminator The generative adversarial module constructs a cross-layer collaborative covert interference model, utilizing a constructed local knowledge base to guide semantic modification of the perturbations generated by the interference model, and employing a modification strategy based on semantic relative entropy to guide gradient optimization; the generator... The training performs multi-decoding strategy generalization to solve the problem of overfitting of a single model; the channel mismatch problem is handled by a channel adaptation mechanism that integrates explicit precoding and implicit statistical enhancement, and finally the generated disturbance is superimposed on the wireless channel, so as to mislead the semantic decoding of the receiver while ensuring transparent transmission of the physical link.

[0076] Step 1: Construct a system model and a local knowledge base, and set attack constraints and targets. The attacker is located between the sender and receiver. In the absence of obtaining the target system model parameters, a local knowledge base is constructed based on a public dataset, and the signal from the sender is intercepted and preprocessed to obtain the input semantic vector.

[0077] Step 2: Construct a cross-layer collaborative covert perturbation model based on a Generative Adversarial Network (GAN) for the input semantic vectors obtained in Step 1, generating basic perturbations. The GAN architecture includes a perturbation generator. and discriminator The generator generates perturbations under power constraints, and the discriminator forces the perturbations to fit Gaussian white noise on a statistical distribution to achieve physical layer concealment.

[0078] Step 3: Using the local knowledge base built in Step 1, semantic tampering guidance is performed on the perturbation generated in Step 2. Under the condition of heterogeneous attack and defense knowledge bases, by maximizing the semantic relative entropy between the perturbation difference of the intercepted signal and the undisturbed signal, the gradient optimization direction is guided to deviate from the structural dependence on the local knowledge base and point to the direction with the largest semantic deviation.

[0079] Step 4: Introduce an expert model-based mechanism to generalize the training of the generator described in Step 3 using a multi-decoding strategy, constructing a system that includes... A collection of expert models from heterogeneous decoders. These expert models are based on different deep neural network architectures, specifically... The ResNet residual network structure and It consists of a densely connected network (DenseNet) structure, in which To simulate the diversity of semantic decoders at the receiver in real communication scenarios, the deep neural networks, including residual networks and densely connected networks, work together as independent and complementary decoding branches to execute differentiated decoding strategies on the same intermediate feature output by the generator. The variance inverse weighting strategy is used to dynamically aggregate expert decisions to solve the overfitting problem of a single decoding model.

[0080] Step 5: Apply an explicit-implicit cooperative channel adaptation mechanism to the disturbance generated in Step 4 to ensure transmission effectiveness. Combine precoding compensation based on explicit channel state information and statistical enhancement based on implicit data-driven methods to eliminate distortion caused by channel fading and noise, and ensure the effectiveness of the disturbance after transmission through the wireless channel.

[0081] Step 6: Based on the loss functions defined in Steps 2 to 5 above, minimize the joint loss function to train the generative model and carry out the attack. Integrate concealment, semantic tampering, transmission transparency and expert integration constraints to train the perturbation generator end-to-end, and inject the perturbation generated by the trained generator into the wireless channel to carry out the countermeasure.

[0082] The specific implementation steps are as follows:

[0083] Step 1: Construct a system model and local knowledge base. Based on a public dataset, construct a local knowledge base containing semantic encoder and decoder structures related to the target semantic communication system task. Intercept and preprocess the signal from the transmitting end to obtain the input semantic vector. Set the objective as: generating optimal, power-constrained small perturbations based on the local knowledge base to mislead the receiving end into outputting specific erroneous semantic information with high confidence. This objective is modeled as a cross-layer cooperative covert interference optimization problem, expressed as:

[0084]

[0085] The constraints include three aspects: ① Attack effectiveness C0, that is, the generated adversarial sample enables the receiver to perform semantic parsing mapping. Output feature vector With the original semantic vector The semantic distance between them exceeds the threshold And semantic error rate At least as high as the preset attack success rate ② Statistical concealment C1 and power constraint C2, i.e., the generated disturbance Capable of resisting statistical anomaly detection, perturbation Not only should it be limited by power budget feasible domain Within, its statistical distribution We also need to fit the background noise, which requires its cumulative distribution function. Compared with standard Gaussian distribution The maximum deviation does not exceed ③ Transmission transparency C3, that is, to avoid the receiver refusing to decode due to the detection of signal inconsistency, the differences in the reconstructed signal need to be considered. The measured syntax error rate Controlled within the tolerance threshold Within;

[0086] Step 2: Process the input semantic vector obtained in Step 1. Constructing a cross-layer collaborative covert interference model based on adversarial networks (GANs): including a generator With discriminator Generative Adversarial Module, Discriminator The task is to maximize the difference generated by the adversarial perturbation. Compared with real Gaussian white noise The ability, its loss function Defined as the expected form of the binary cross-entropy (BCE):

[0087]

[0088] Among them, label 0 corresponds to Gaussian noise samples, and label 1 corresponds to generated perturbation samples;

[0089] In actual training, Monte Carlo sampling is used to empirically estimate the expectation:

[0090]

[0091] Generator The goal is to generate perturbation samples that can deceive the discriminator, causing it to be misclassified as real noise, thus creating a zero-sum game with the discriminator. Its adversarial loss function... Defined as:

[0092]

[0093] To strictly meet the power budget of the physical layer To enhance stealth, a truncated power normalization layer is introduced for the generator. The original perturbation vector output is then projected as follows:

[0094]

[0095] in For the generator's input;

[0096] The perturbation waveform generated through joint optimization can achieve physical layer statistical concealment, and can disguise Gaussian noise in both energy spectral density and amplitude statistical distribution.

[0097] Furthermore, further design of transmission transparency constraints The aim is to attack performance, i.e., semantic error rate. Communication quality, i.e., syntax error rate Seeking the optimal balance between:

[0098]

[0099] in, For hyperparameters;

[0100] Step 3: Using the local knowledge base built in Step 1, construct a semantic tampering strategy based on semantic relative entropy to modify the perturbation generated in Step 2. Semantic manipulation: The construction of semantic relative entropy is based on the source grammar space To the target semantic space The probability measure is passed, a process that relies on a synonym mapping mechanism based on a semantic knowledge base. Specifically, the synonym mapping is constructed by the semantic encoder. In the set of grammar symbols The above induces an equivalence partition, for any semantic symbol Its synonym set is According to the law of total probability, symbols in semantic space Induced probability This represents the aggregation of the probabilities of all grammatical samples within its synonym set, i.e.:

[0101]

[0102] Based on this, two different semantic distributions are formally defined. and Semantic relative entropy between Measure when using distribution Fitting the true semantic distribution Information gain loss caused by time:

[0103]

[0104] In a perturbation attack scenario, let the original semantic distribution be... The perturbation distribution is Taylor expansion analysis In the original distribution Approximation form in the vicinity:

[0105]

[0106] because Furthermore, it takes the global minimum at this point, and the first-order gradient term is zero. The above expression mainly consists of the Fisher information matrix. The second-order term dominates, given that Under regularity conditions, it is a positive semi-definite matrix, and for non-trivial perturbations ( ),have:

[0107]

[0108] The above equation shows that semantic relative entropy is not only monotonically positively correlated with the degree of distribution shift, but also maximizes... This is equivalent to finding the direction along which the Fisher information changes most in the semantic manifold and applying a perturbation, thereby inducing more significant semantic understanding biases with less perturbation cost;

[0109] By building a local knowledge base, the intercepted samples are quantified. The semantic distribution difference before and after the disturbance is analyzed, and the gradient optimization direction is guided to deviate from dependence on local prior knowledge by maximizing the semantic relative entropy between the disturbance difference and the undisturbed signal. Specifically, the interfering party first bases its algorithm on the local knowledge base. intercepted samples Semantic decoding is performed to obtain semantic feature vectors. Its semantic distribution can be represented as Subsequently, the perturbation generated in step 2 was superimposed. The samples are decoded again to obtain the perturbed semantic features. and its semantic distribution To quantize the semantic distribution differences caused by perturbations, a difference function is defined. for:

[0110]

[0111] Accordingly, in order to maximize semantic distribution and The relative semantic entropy, the loss function for semantic tampering. Defined as the negative value of this relative semantic entropy:

[0112]

[0113] During backpropagation, the gradient is dynamically updated using the chain rule:

[0114]

[0115] Among them, auxiliary variables The above mechanism uses differential operations. It effectively shields the priors unique to the local knowledge base, allowing the attack strategy to break free from the structural dependence on the local representation and instead focus on maximizing the search for relative semantic differences. This avoids the impact of the heterogeneity of the knowledge bases of the attacker and defender. On this basis, the mechanism can dynamically adjust the perturbation distribution to ensure that the generated gradient always points to the region with the largest semantic deviation, thereby improving the convergence speed of training while achieving efficient semantic modification.

[0116] Step 4: Constructing a multi-decoding generalization transfer model based on an expert model: First, construct a model containing... A set of experts for a decoding model based on a heterogeneous deep neural network architecture The expert model employs a deep neural network architecture, specifically including... A residual network ResNet and A densely connected network, DenseNet, satisfies Each decoder Pre-training is performed on different priors to simulate the diversity of receivers in real-world communication scenarios; during the training phase, the perturbations generated in step 3... The perturbation is simultaneously injected into all expert models in parallel. To quantify the combined attack effectiveness of the perturbation across different models, the ensemble attack objective function is defined as maximizing the joint attack confidence across all expert models. Correspondingly, the expert ensemble loss function is... The definition is as follows:

[0117]

[0118] in, Indicates the first An expert model Input the disturbance generated in step 3 Then, the posterior probability of the incorrect semantic prediction is output, which is the probability of a successful attack. The dynamic weighting coefficients assigned to this expert satisfy the following conditions: ;

[0119] Introducing an inverse variance weighting strategy Dynamic allocation is employed; this strategy aims to suppress experts with drastically fluctuating outputs and enhance the robustness of attack features. The weight calculation formula is as follows:

[0120]

[0121] in, Indicates the first The performance feedback variance of each expert is used to measure the stability of that expert's response to the current attack strategy. This mechanism, by assigning higher weights to experts with low performance volatility and reliable predictions, forces the generative model to aggregate common attack features with high confidence.

[0122] Step 5: Apply an explicit-implicit cooperative channel adaptation mechanism to the disturbance generated in Step 4: Construct a cooperative mechanism that integrates explicit precoding compensation and implicit feature statistical enhancement. The explicit channel precoding is based on the channel reciprocity of the time-division duplex system, and the attacker estimates the channel matrix of the attack link. And construct a power-limited actual launch perturbation. This allows the baseband semantic perturbation to approximate the ideal value at the receiving end after transmission through the channel. ;

[0123] Considering the noise amplification effect during the channel inversion process, this precoding problem is modeled as the following regularized least squares optimization problem:

[0124]

[0125] in, This is the regularization coefficient, used to balance the channel compensation accuracy with the interference power leakage at the receiver;

[0126] Given the channel matrix Given the diagonal properties, the above multidimensional optimization problem can be decomposed into: There are several independent scalar convex optimization subproblems. For the first... The optimization objective is expressed as: subcarriers, where:

[0127]

[0128] in for The One diagonal element;

[0129] To solve this constrained optimization problem, Lagrange multipliers are introduced. And construct the Lagrange function Solve using the Carroll-Kun-Tucker conditions:

[0130]

[0131] make Regarding conjugate variables The partial derivative of is zero, that is The optimal compensation disturbance is derived. Closed-form solution:

[0132]

[0133] The explicit module essentially performs regularized zero-forcing precoding, providing basic amplitude equalization and phase calibration for the interference signal;

[0134] The implicit enhancement mechanism first constructs a system containing... A set of real channel state samples Based on this, a perturbation generator is trained, with the optimization objective of learning a robust feature transform that implicitly compensates for channel distortion; specifically, through the sample space The training process involves traversing the data to simulate the "generation-transmission-distortion" link in the physical layer transmission process, specifically for each channel sample. Introducing the corresponding transmission effects, the network continuously updates its parameters through the backpropagation algorithm. To maximize the expected attack effectiveness across the entire channel set:

[0135]

[0136] in, Indicates based on estimated channel Explicit precoding operations, This indicates the signal processing and semantic decoding operations at the receiving end. This is the loss function for semantic attacks.

[0137] The trained generative network By incorporating statistical prior information about the channel environment, even in the event of instantaneous CSI loss or inaccuracy during actual attacks, the generated disturbances can still adaptively compensate for explicit precoding based on learned statistical laws. The synergistic cooperation between explicit estimation and implicit learning mechanisms can ensure that the system improves its robustness against attacks in dynamic time-varying channels.

[0138] Step 6, Joint Optimization and Attack Implementation: Considering the above constraints, a composite loss function is constructed to train the generator end-to-end.

[0139]

[0140] in, These are hyperparameters used to adjust the contribution weights of different constraint terms in the total gradient and to adjust the contribution weights of different constraint terms in the descent direction of the total gradient. Under this optimization paradigm, the goal is to minimize... Under the premise of satisfying statistical, power and transmission transparency constraints, the generator uses a semantic difference mechanism to eliminate the influence of local priors and find the perturbation direction that can maximize the directional shift of the target semantic space.

[0141] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0142] The purpose of this invention is to propose a black-box perturbation attack method (PseAdv) for semantic tampering. This method aims to address the problems of existing attack methods, such as lack of physical layer covertness, reliance on specific semantic mappings, and poor robustness under dynamic time-varying channels. This method achieves efficient and covert black-box semantic attacks through cross-layer collaborative covert interference, semantic relative entropy guidance, and channel adaptive mechanisms.

[0143] This invention presents a black-box perturbation attack method based on semantic relative entropy and channel adaptation. First, a local knowledge base and a perturbation generation network are constructed, and the statistical concealment of the perturbation is constrained by a generative adversarial mechanism. Second, a semantic adversarial perturbation with generalization ability is generated during local training through a semantic relative entropy maximization strategy and an expert model integration mechanism. Finally, by combining explicit precoding and implicit statistical learning, the perturbation is adapted to the dynamic wireless channel, ultimately causing semantic understanding errors at the receiver.

[0144] The specific implementation steps of the technical solution adopted in this invention are as follows:

[0145] Step 1: Construct a system model and local knowledge base, and set attack constraints and targets. The attacker is positioned between the sender and receiver. Unable to obtain the target system model parameters, the attacker constructs a local knowledge base based on a public dataset and intercepts and preprocesses signals from the sender. The process architecture is as follows: Figure 1 As shown.

[0146] Step 2: Construct a cross-layer collaborative covert perturbation model from the input samples obtained in Step 1 to generate basic perturbations. Utilize a Generative Adversarial Network (GAN) architecture, including a perturbation generator. and discriminator The generator produces perturbations under power constraints, and the discriminator forces the perturbations to fit Gaussian white noise on a statistical distribution to achieve physical layer concealment.

[0147] Step 3: Using the local knowledge base built in Step 1, semantic modification guidance is applied to the perturbations generated in Step 2. Under the heterogeneous conditions of attack and defense knowledge bases, by maximizing the semantic relative entropy between the perturbation difference of the intercepted signal and the undisturbed signal, the gradient optimization direction is guided to deviate from the structural dependence on the local knowledge base and point towards the direction with the largest semantic deviation.

[0148] Step 4: Introduce an expert model mechanism to generalize the generator training described in Step 3 using a multi-decoding strategy. Construct an expert model set containing multiple heterogeneous decoders. Specifically, the expert models employ different deep neural network architectures, including ResNet and DenseNet. A variance inverse weighting strategy is used to dynamically aggregate expert decisions, addressing the overfitting problem of a single model and improving the generalization ability of attacks on unknown target systems.

[0149] Step 5: Apply an explicit-implicit cooperative channel adaptation mechanism to the disturbance generated in Step 4 to ensure transmission effectiveness. This involves combining precoding compensation based on explicit channel state information and statistical enhancement based on implicit data-driven methods to eliminate distortion caused by channel fading and noise, ensuring the effectiveness of the disturbance after transmission through the wireless channel.

[0150] Step 6: Based on the loss functions defined in Steps 2 to 5, train the generative model by minimizing the joint loss function and then launch the attack. Integrating concealment, semantic tampering, transmission transparency, and expert ensemble constraints, the perturbation generator is trained end-to-end, and the perturbations generated by the trained generator are injected into the wireless channel to launch the attack.

[0151] The specific implementation steps in one example are as follows:

[0152] Step 1: Construct a system model and local knowledge base, and set attack constraints and objectives. Consider an end-to-end semantic communication system under fading channels, where the attacker cannot obtain the target system's model parameters and semantic distribution. The attacker constructs a local knowledge base based on a public dataset, containing semantic encoder and decoder structures related to the target system's tasks; intercepts and preprocesses the transmitter's signal to obtain the input semantic vector. In a black-box attack scenario, the attacker's goal is to generate optimal, small perturbations with limited power based on the local knowledge base, thereby misleading the receiver to output specific erroneous semantic information with high confidence. This problem can be modeled as a cross-layer collaborative covert interference optimization problem, expressed as:

[0153]

[0154] The constraints include three aspects: ① Attack effectiveness (C0), that is, whether the generated adversarial sample enables the receiver to perform semantic parsing mapping. Output feature vector With the original semantic vector The semantic distance between them exceeds the threshold And semantic error rate At least as high as the preset attack success rate ② Statistical concealment (C1) and power constraint (C2), i.e., the generated perturbation It can resist statistical anomaly detection and perturbation. Not only should it be limited by power budget feasible domain Within, its statistical distribution We also need to fit the background noise, which requires its cumulative distribution function. Compared with standard Gaussian distribution The maximum deviation does not exceed ③ Transmission transparency (C3), which avoids the receiver refusing to decode due to detected signal inconsistency, and requires the differences in the reconstructed signal to be considered. The measured syntax error rate Controlled within the tolerance threshold Within.

[0155] Step 2: Process the input semantic vector obtained in Step 1. Construct a cross-layer collaborative covert jamming model based on Generative Adversarial Networks (GANs). Includes a generator. With discriminator Generative adversarial module. Discriminator. The task is to maximize the difference generated by the adversarial perturbation. Compared with real Gaussian white noise The ability, its loss function Defined as the expected form of binary cross-entropy (BCE):

[0156]

[0157] Among them, label 0 corresponds to Gaussian noise samples, and label 1 corresponds to generated perturbation samples.

[0158] In actual training, Monte Carlo sampling is used to empirically estimate the expectation:

[0159]

[0160] Generator The goal is to generate perturbation samples that can deceive the discriminator, causing it to be misclassified as real noise, thus creating a zero-sum game with the discriminator. Its adversarial loss function... Defined as:

[0161]

[0162] To strictly meet the power budget of the physical layer To enhance stealth, a truncated power normalization layer is introduced. For the generator... The original perturbation vector output is then projected as follows:

[0163]

[0164] in This is the input to the generator.

[0165] The perturbation waveform generated through joint optimization can achieve physical layer statistical concealment, and can disguise Gaussian noise in both energy spectral density and amplitude statistical distribution.

[0166] Furthermore, further design of transmission transparency constraints The aim is to attack performance (semantic error rate). ) and communication quality (syntax error rate) Seeking the optimal balance between:

[0167]

[0168] in, This is a hyperparameter.

[0169] Step 3: Using the local knowledge base built in Step 1, construct a semantic tampering strategy based on semantic relative entropy to modify the perturbation generated in Step 2. Semantic manipulation: The construction of semantic relative entropy is based on the source grammar space To the target semantic space The probability measure is passed, a process that relies on a synonym mapping mechanism based on a semantic knowledge base. Specifically, the synonym mapping is constructed by the semantic encoder. In the set of grammar symbols The above induces an equivalence partition, for any semantic symbol Its synonym set is According to the law of total probability, symbols in semantic space Induced probability This represents the aggregation of the probabilities of all grammatical samples within its synonym set, i.e.:

[0170]

[0171] Based on this, two different semantic distributions are formally defined. and Semantic relative entropy between Measure when using distribution Fitting the true semantic distribution Information gain loss caused by time:

[0172]

[0173] In a perturbation attack scenario, let the original semantic distribution be... The perturbation distribution is Taylor expansion analysis In the original distribution Approximation form in the vicinity:

[0174]

[0175] because Furthermore, it reaches its global minimum at this point, and the first-order gradient term is zero. The above expression mainly consists of the Fisher information matrix. The second-order term dominates. Given... Under regularity conditions, it is a positive semi-definite matrix, and for non-trivial perturbations ( ),have:

[0176]

[0177] The above equation shows that semantic relative entropy is not only monotonically positively correlated with the degree of distribution shift, but also maximizes... This is equivalent to finding the direction along which the Fisher information changes most in the semantic manifold and applying a perturbation, thereby inducing a more significant semantic understanding bias with a smaller perturbation cost.

[0178] To address the issue of unknown semantic mapping mechanisms by non-cooperative defenders in black-box attack scenarios, this paper constructs a local knowledge base to quantify the intercepted samples. The semantic distribution difference before and after the perturbation is analyzed, and the gradient optimization direction is guided to decouple from local prior knowledge by maximizing the semantic relative entropy between the perturbation difference and the undisturbed signal. Specifically, the perturbing party first bases its algorithm on a local knowledge base. intercepted samples Semantic decoding is performed to obtain semantic feature vectors. Its semantic distribution can be represented as Subsequently, the perturbation generated in step 2 was superimposed. The samples are decoded again to obtain the perturbed semantic features. and its semantic distribution To quantify the semantic distribution differences caused by perturbations, a difference function is defined. for:

[0179]

[0180] Accordingly, in order to maximize semantic distribution and The relative semantic entropy, the loss function for semantic tampering. Defined as the negative value of this relative semantic entropy:

[0181]

[0182] During backpropagation, the gradient is dynamically updated using the chain rule:

[0183]

[0184] Among them, auxiliary variables The above mechanism uses differential operations. This mechanism effectively shields the unique prior knowledge of the local knowledge base, freeing attack strategies from their structural dependence on local representations and allowing them to focus on maximizing relative semantic differences, thus mitigating the impact of heterogeneity between the attacking and defending knowledge bases. Furthermore, it dynamically adjusts the perturbation distribution to ensure that the generated gradient always points to the region of greatest semantic deviation, achieving efficient semantic manipulation while improving training convergence speed.

[0185] Step 4: Introduce an expert model mechanism to generalize the generator training described in Step 3 using multiple decoding strategies. First, construct a model containing... A set of experts for a decoding model based on a heterogeneous deep neural network architecture The expert models specifically employ different deep neural network architectures, including... Residual networks (ResNet) and A densely connected network (DenseNet) satisfies Each decoder Pre-training is performed on different priors to simulate the diversity of receivers in real-world communication scenarios; during the training phase, the perturbations generated in step 3... The perturbation is simultaneously injected into all expert models in parallel. To quantify the combined attack effectiveness of the perturbation across different models, the ensemble attack objective function is defined as maximizing the joint attack confidence across all expert models. Correspondingly, the expert ensemble loss function is... The definition is as follows:

[0186]

[0187] in, Indicates the first An expert model Input disturbance Then, output the posterior probability of the incorrect semantic prediction (i.e., the probability of a successful attack). The dynamic weighting coefficients assigned to this expert satisfy the following conditions: .

[0188] To avoid the optimization process collapsing into a single expert model with unstable performance or specific biases, this paper introduces an inverse-variance weighting strategy. Dynamic allocation is performed. This strategy aims to suppress experts with drastically fluctuating outputs and enhance the robustness of attack characteristics. The weight calculation formula is as follows:

[0189]

[0190] in, Indicates the first The performance feedback variance of each expert is used to measure the stability of that expert's response to the current attack strategy. This mechanism, by assigning higher weights to experts with low performance volatility and reliable predictions, forces the generative model to aggregate common attack features with high confidence. This ensemble method based on dynamic statistical properties can effectively improve the generalization ability and transfer performance of attack strategies when facing unknown heterogeneous semantic communication systems.

[0191] Step 5: Apply an explicit-implicit cooperative channel adaptation mechanism to the perturbation generated in Step 4 to ensure transmission effectiveness. This mechanism constructs a cooperative mechanism that integrates explicit precoding compensation and implicit feature statistical enhancement. Explicit channel precoding is based on the channel reciprocity of the time-division duplex system, and the attacker estimates the channel matrix of the attack link. And construct a power-limited actual launch perturbation. This allows the baseband semantic perturbation to approximate the ideal value at the receiving end after transmission through the channel. .

[0192] Considering the noise amplification effect during the channel inversion process, this precoding problem is modeled as the following regularized least squares optimization problem:

[0193]

[0194] in, This is a regularization coefficient used to balance the accuracy of channel compensation with the interference power leakage at the receiver.

[0195] Given the channel matrix Given the diagonal properties, the above multidimensional optimization problem can be decomposed into: There are several independent scalar convex optimization subproblems. For the first... The optimization objective is expressed as: subcarriers, where:

[0196]

[0197] in for The One diagonal element.

[0198] To solve this constrained optimization problem, Lagrange multipliers are introduced. And construct the Lagrange function Solve using the Karush-Kuhn-Tucker (KKT) conditions:

[0199]

[0200] make Regarding conjugate variables The partial derivative of is zero, that is The optimal compensation disturbance can be derived. Closed-form solution:

[0201]

[0202] The explicit module essentially performs regularized zero-forcing precoding, providing basic amplitude equalization and phase calibration for the interference signal.

[0203] The implicit enhancement mechanism first constructs a system containing... A set of real channel state samples Building upon this, a perturbation generator is trained, with the optimization objective of learning a robust feature transform that implicitly compensates for channel distortion. Specifically, the network is not optimized for a single channel, but rather through the sample space... The training process involves traversing the data to simulate the "generation-transmission-distortion" link in the physical layer transmission process, specifically for each channel sample. The corresponding transmission effects are introduced. The network continuously updates its parameters through the backpropagation algorithm. To maximize the expected attack effectiveness across the entire channel set:

[0204]

[0205] in, Indicates based on estimated channel Explicit precoding operations, This indicates the signal processing and semantic decoding operations at the receiving end. This is the loss function for semantic attacks.

[0206] The trained generative network is obtained through the above mechanism. It incorporates statistical prior information about the channel environment. In actual attacks, even in the face of instantaneous CSI loss or inaccuracy, the generated perturbations can still adaptively compensate for explicit precoding based on learned statistical patterns. The synergistic cooperation between explicit estimation and implicit learning mechanisms ensures improved robustness of the system against attacks in dynamically time-varying channels.

[0207] Step 6: Based on the loss functions defined in Steps 2 to 5, train the generative model by minimizing the joint loss function and then launch the attack. Taking into account the above constraints, construct a composite loss function to train the generator end-to-end.

[0208]

[0209] in, These are hyperparameters used to adjust the contribution weights of different constraint terms in the total gradient and to adjust the contribution weights of different constraint terms in the direction of gradient descent. Under this optimization paradigm, minimizing... Under the premise of satisfying statistical, power and transmission transparency constraints, the generator uses a semantic difference mechanism to eliminate the influence of local priors and find the perturbation direction that can maximize the directional shift of the target semantic space.

[0210] The complete training process of this invention is as follows:

[0211] a. Data Loading: Read the dataset used for training (such as CIFAR-10, ImageNet, etc.), traverse the folders under the specified path and read the image files, and preprocess the images: ① Resample the images to the specified resolution according to the requirements of the target system (e.g., 32×32 for low-resolution scenes, 224×224 for high-resolution scenes); ② Perform normalization processing to adapt to the network input. Construct a set containing real channel state samples. This is used for subsequent implicit channel statistics enhancement training.

[0212] b. Parameter initialization: Given the semantic encoding / decoding network parameters and expert model set in the local knowledge base. Initial weights. Initialize the perturbation generator. and discriminator The network parameters, optimizer (Adam), and initial learning rate ( ).

[0213] c. Perturbation Generation and Channel Adaptation: The preprocessed input samples are semantically-channel coded to obtain the baseband signal. Input to the disturbance generator The generator outputs the original perturbation vector, which is then processed by a truncated power normalization layer to ensure that the perturbation power meets the requirements. Subsequently, combined with explicit pre-compilation Compared with channel sample sets Implicit statistical enhancement is used to simulate the physical layer transmission link of "generation-transmission-distortion" and obtain the estimated value of the disturbed signal at the receiving end.

[0214] d. Semantic Tampering and Constraint Calculation: Utilizing a local knowledge base to estimate the intercepted signal. Decoding yields baseline semantic features. and distribution The features are obtained by decoding the disturbed signal. and distribution Calculate the semantic relative entropy between the two. This serves as a guide for semantic manipulation. Simultaneously, the perturbation is input into the expert model set, and the dynamic weights of each expert are calculated based on a variance inverse weighting strategy. And the success rate of integrated attacks. Calculate the mean square error of the reconstructed signal to assess the transparency of physical layer transmission.

[0215] e. Joint Loss Optimization: By minimizing the joint loss function The model is trained under constraints. The joint loss function is composed of the following weighted components: ① Hiddenness loss (Generative adversarial network loss); ② Transmission transparency loss (Balancing semantic and syntactic errors); ③Loss of semantic manipulation (Semantic relative entropy negative); ④ Expert integration loss (Maximize the joint confidence level of experts).

[0216] f. Iterative Training: Except for the initialization step, iterate through each batch of the training dataset, repeating the above process for iterative training. The generator and discriminator adopt an alternating update strategy, using the backpropagation algorithm to update the network parameters until a preset number of epochs (e.g., 10 epochs) is reached or the loss function converges, then save the trained perturbation generator model.

[0217] The testing process iterates through each sample in the test dataset, generating perturbations using a trained generator and injecting them into the channel. The receiver decodes the perturbed signal, calculates semantic precision (SA) to evaluate attack effectiveness, calculates peak signal-to-noise ratio (PSNR) to evaluate stealth, and calculates perturbation-to-signal ratio (PSR) to quantify the energy level. During this process, defense mechanisms such as Gaussian smoothing and random image restoration can be introduced to test the semantic robustness of the attack algorithm under different defense strategies, and a t-SNE visualization of the semantic feature manifold is generated to visually demonstrate the aliasing of the semantic distribution.

[0218] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A black-box perturbation adversarial method for semantic tampering, characterized in that, Build a local knowledge base, including generators. With discriminator The generative adversarial module constructs a cross-layer collaborative covert interference model, utilizing a constructed local knowledge base to guide semantic modification of the perturbations generated by the interference model, and employing a modification strategy based on semantic relative entropy to guide gradient optimization; the generator... The training performs multi-decoding strategy generalization to solve the problem of overfitting of a single model; By integrating explicit precoding and implicit statistical enhancement into a channel adaptation mechanism to address channel mismatch, the generated disturbance is ultimately superimposed onto the wireless channel, thereby misleading the semantic decoding at the receiving end while ensuring transparent transmission of the physical link.

2. The black-box perturbation countermeasure method for semantic tampering as described in claim 1, characterized in that, The specific steps are as follows: Step 1: Construct a system model and a local knowledge base, and set attack constraints and targets. The attacker is located between the sender and receiver. In the absence of obtaining the target system model parameters, a local knowledge base is constructed based on a public dataset, and the signal from the sender is intercepted and preprocessed to obtain the input semantic vector. Step 2: Construct a cross-layer collaborative covert perturbation model based on a Generative Adversarial Network (GAN) for the input semantic vectors obtained in Step 1, generating basic perturbations. The GAN architecture includes a perturbation generator. and discriminator The generator generates perturbations under power constraints, and the discriminator forces the perturbations to fit Gaussian white noise on a statistical distribution to achieve physical layer concealment. Step 3: Using the local knowledge base built in Step 1, semantic tampering guidance is performed on the perturbation generated in Step 2. Under the condition of heterogeneous attack and defense knowledge bases, by maximizing the semantic relative entropy between the perturbation difference of the intercepted signal and the undisturbed signal, the gradient optimization direction is guided to deviate from the structural dependence on the local knowledge base and point to the direction with the largest semantic deviation. Step 4: Introduce an expert model-based mechanism to generalize the training of the generator described in Step 3 using a multi-decoding strategy, constructing a system that includes... A collection of expert models from heterogeneous decoders, these expert models are based on different deep neural network architectures, specifically by... The ResNet residual network structure and It consists of a densely connected network (DenseNet) structure, in which To simulate the diversity of semantic decoders at the receiver in real communication scenarios, the deep neural networks, including residual networks and densely connected networks, work together as independent and complementary decoding branches to execute differentiated decoding strategies on the same intermediate feature output by the generator. The variance inverse weighting strategy is used to dynamically aggregate expert decisions to solve the overfitting problem of a single decoding model. Step 5: Apply an explicit-implicit cooperative channel adaptation mechanism to the disturbance generated in Step 4 to ensure transmission effectiveness. Combine precoding compensation based on explicit channel state information and statistical enhancement based on implicit data-driven methods to eliminate distortion caused by channel fading and noise, and ensure the effectiveness of the disturbance after transmission through the wireless channel. Step 6: Based on the loss functions defined in Steps 2 to 5 above, minimize the joint loss function to train the generative model and carry out the attack. Integrate concealment, semantic tampering, transmission transparency and expert integration constraints to train the perturbation generator end-to-end, and inject the perturbation generated by the trained generator into the wireless channel to carry out the countermeasure.

3. The black-box perturbation countermeasure method for semantic tampering as described in claim 1, characterized in that, The specific implementation steps are as follows: Step 1: Construct a system model and local knowledge base. Based on a public dataset, construct a local knowledge base containing semantic encoder and decoder structures related to the target semantic communication system task. Intercept and preprocess the signal from the transmitting end to obtain the input semantic vector. Set the objective as: generating optimal, power-constrained small perturbations based on the local knowledge base to mislead the receiving end into outputting specific erroneous semantic information with high confidence. This objective is modeled as a cross-layer cooperative covert interference optimization problem, expressed as: The constraints include three aspects: ① Attack effectiveness C0, that is, the generated adversarial sample enables the receiver to perform semantic parsing mapping. Output feature vector With the original semantic vector The semantic distance between them exceeds the threshold And semantic error rate At least as high as the preset attack success rate ② Statistical concealment C1 and power constraint C2, i.e., the generated disturbance Capable of resisting statistical anomaly detection, perturbation Not only should it be limited by power budget feasible domain Within, its statistical distribution We also need to fit the background noise, which requires its cumulative distribution function. Compared with standard Gaussian distribution The maximum deviation does not exceed ③ Transmission transparency C3, that is, to avoid the receiver refusing to decode due to the detection of signal inconsistency, the differences in the reconstructed signal need to be considered. The measured syntax error rate Controlled within the tolerance threshold Within; Step 2: Process the input semantic vector obtained in Step 1. Constructing a cross-layer collaborative covert interference model based on adversarial networks (GANs): including a generator With discriminator Generative Adversarial Module, Discriminator The task is to maximize the difference generated by the adversarial perturbation. Compared with real Gaussian white noise The ability, its loss function Defined as the expected form of the binary cross-entropy (BCE): Among them, label 0 corresponds to Gaussian noise samples, and label 1 corresponds to generated perturbation samples; In actual training, Monte Carlo sampling is used to empirically estimate the expectation: generator The goal is to generate perturbation samples that can deceive the discriminator, causing it to be misclassified as real noise, thus creating a zero-sum game with the discriminator. Its adversarial loss function... Defined as: To strictly meet the power budget of the physical layer To enhance stealth, a truncated power normalization layer is introduced for the generator. The original perturbation vector output is then projected as follows: in For the generator's input; The perturbation waveform generated through joint optimization can achieve physical layer statistical concealment, and can disguise Gaussian noise in both energy spectral density and amplitude statistical distribution. Furthermore, further design of transmission transparency constraints The aim is to attack performance, i.e., semantic error rate. Communication quality, i.e., syntax error rate Seeking the optimal balance between: in, For hyperparameters; Step 3: Using the local knowledge base built in Step 1, construct a semantic tampering strategy based on semantic relative entropy to modify the perturbation generated in Step 2. Semantic manipulation: The construction of semantic relative entropy is based on the source grammar space To the target semantic space The probability measure is passed, a process that relies on a synonym mapping mechanism based on a semantic knowledge base. Specifically, the synonym mapping is constructed by the semantic encoder. In the set of grammar symbols The above induces an equivalence partition, for any semantic symbol Its synonym set is According to the law of total probability, symbols in semantic space Induced probability This represents the aggregation of the probabilities of all grammatical samples within its synonym set, i.e.: Based on this, two different semantic distributions are formally defined. and Semantic relative entropy between Measure when using distribution Fitting the true semantic distribution Information gain loss caused by time: In a perturbation attack scenario, let the original semantic distribution be... The perturbation distribution is Taylor expansion analysis In the original distribution Approximation form in the vicinity: because Furthermore, it takes the global minimum at this point, and the first-order gradient term is zero. The above expression mainly consists of the Fisher information matrix. The second-order term dominates, given that Under regularity conditions, it is a positive semi-definite matrix, and for non-trivial perturbations ( ),have: The above equation shows that semantic relative entropy is not only monotonically positively correlated with the degree of distribution shift, but also maximizes... This is equivalent to finding the direction along which the Fisher information changes most in the semantic manifold and applying a perturbation, thereby inducing more significant semantic understanding biases with less perturbation cost; By building a local knowledge base, the intercepted samples are quantified. The semantic distribution difference before and after the disturbance is analyzed, and the gradient optimization direction is guided to deviate from dependence on local prior knowledge by maximizing the semantic relative entropy between the disturbance difference and the undisturbed signal. Specifically, the interfering party first bases its algorithm on the local knowledge base. Intercepted samples Semantic decoding is performed to obtain semantic feature vectors. Its semantic distribution can be represented as Subsequently, the perturbation generated in step 2 was superimposed. The samples are decoded again to obtain the perturbed semantic features. and its semantic distribution To quantize the semantic distribution differences caused by perturbations, a difference function is defined. for: Accordingly, in order to maximize semantic distribution and The relative semantic entropy, the loss function for semantic tampering. Defined as the negative value of this relative semantic entropy: During backpropagation, the gradient is dynamically updated using the chain rule: Among them, auxiliary variables The above mechanism uses differential operations. It effectively shields the priors unique to the local knowledge base, allowing the attack strategy to break free from the structural dependence on the local representation and instead focus on maximizing the search for relative semantic differences. This avoids the impact of the heterogeneity of the knowledge bases of the attacker and defender. On this basis, the mechanism can dynamically adjust the perturbation distribution to ensure that the generated gradient always points to the region with the largest semantic deviation, thereby improving the convergence speed of training while achieving efficient semantic modification. Step 4: Constructing a multi-decoding generalization transfer model based on an expert model: First, construct a model that includes... A set of experts for a decoding model based on a heterogeneous deep neural network architecture The expert model employs a deep neural network architecture, specifically including... A residual network ResNet and A densely connected network, DenseNet, satisfies Each decoder Pre-training is performed on different priors to simulate the diversity of receivers in real-world communication scenarios; during the training phase, the perturbations generated in step 3... The perturbation is simultaneously injected into all expert models in parallel. To quantify the combined attack effectiveness of the perturbation across different models, the ensemble attack objective function is defined as maximizing the joint attack confidence across all expert models. Correspondingly, the expert ensemble loss function is... The definition is as follows: in, Indicates the first An expert model Input the disturbance generated in step 3 Then, the posterior probability of the incorrect semantic prediction is output, which is the probability of a successful attack. The dynamic weighting coefficients assigned to this expert satisfy the following conditions: ; Introducing an inverse variance weighting strategy Dynamic allocation is employed; this strategy aims to suppress experts with drastically fluctuating outputs and enhance the robustness of attack features. The weight calculation formula is as follows: in, Indicates the first The performance feedback variance of each expert is used to measure the stability of the expert's response to the current attack strategy. The above mechanism forces the generative model to aggregate common attack features with high confidence by giving higher weights to experts with small performance fluctuations and reliable predictions. Step 5: Apply an explicit-implicit cooperative channel adaptation mechanism to the disturbance generated in Step 4: Construct a cooperative mechanism that integrates explicit precoding compensation and implicit feature statistical enhancement. The explicit channel precoding is based on the channel reciprocity of the time-division duplex system, and the attacker estimates the channel matrix of the attack link. And construct a power-limited actual launch perturbation. This allows the baseband semantic perturbation to approximate the ideal value at the receiving end after transmission through the channel. ; Considering the noise amplification effect during the channel inversion process, this precoding problem is modeled as the following regularized least squares optimization problem: in, This is the regularization coefficient, used to balance the channel compensation accuracy with the interference power leakage at the receiver; Given the channel matrix Given the diagonal properties, the above multidimensional optimization problem can be decomposed into: A separate scalar convex optimization subproblem, for the ... The optimization objective is expressed as: subcarriers, where: in for The One diagonal element; To solve this constrained optimization problem, Lagrange multipliers are introduced. And construct the Lagrange function Solve using the Carroll-Kun-Tucker conditions: make Regarding conjugate variables The partial derivative of is zero, that is The optimal compensation perturbation is derived. Closed-form solution: The explicit module essentially performs regularized zero-forcing precoding, providing basic amplitude equalization and phase calibration for the interference signal; The implicit enhancement mechanism first constructs a system containing... A set of real channel state samples Based on this, a perturbation generator is trained, with the optimization objective of learning a robust feature transform that implicitly compensates for channel distortion; specifically, through the sample space The training process involves traversing the data to simulate the "generation-transmission-distortion" link in the physical layer transmission process, that is, for each channel sample... Introducing the corresponding transmission effects, the network continuously updates its parameters through the backpropagation algorithm. To maximize the expected attack effectiveness across the entire channel set: in, Indicates based on estimated channel Explicit precoding operations, This indicates the signal processing and semantic decoding operations at the receiving end. The loss function is for semantic attacks; The trained generative network By incorporating statistical prior information about the channel environment, even in the event of instantaneous CSI loss or inaccuracy during actual attacks, the generated disturbances can still adaptively compensate for explicit precoding based on learned statistical laws. The synergistic cooperation between explicit estimation and implicit learning mechanisms can ensure that the system improves its robustness against attacks in dynamic time-varying channels. Step 6, Joint Optimization and Attack Implementation: Considering the above constraints, a composite loss function is constructed to train the generator end-to-end. in, These are hyperparameters used to adjust the contribution weights of different constraint terms in the total gradient and to adjust the contribution weights of different constraint terms in the descent direction of the total gradient. Under this optimization paradigm, the goal is to minimize... Under the premise of satisfying statistical, power and transmission transparency constraints, the generator uses a semantic difference mechanism to eliminate the influence of local priors and find the perturbation direction that can maximize the directional shift of the target semantic space.

Images