Intelligent traffic system-oriented adversarial sample real-time detection and cooperative defense method

Abstract

This invention discloses a real-time detection and collaborative defense method for adversarial examples in intelligent transportation systems, relating to the field of artificial intelligence security technology. The method includes: synchronously collecting raw data from vehicle-mounted sensing units, roadside sensing units, and a cloud platform; performing denoising, distortion correction, coordinate normalization, and semantic label alignment operations on the raw data to generate structured data packets; performing multi-dimensional cross-validation of the structured data packets based on a unified world coordinate system; identifying abnormal observations that violate kinematic laws, geometric occlusion relationships, or semantic logic by constructing a physical consistency constraint model, and generating consistency conflict flags. By constructing a security protection architecture that integrates physical consistency verification, environment-adaptive strategy matching, and cross-device collaborative execution, this method specifically addresses the technical problems existing in current intelligent transportation adversarial example defense mechanisms, such as the lack of global verification, poor environmental adaptability, and insufficient collaborative response.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security technology, and in particular to a method for real-time detection and collaborative defense of adversarial samples for intelligent transportation systems. Background Technology

[0002] As intelligent transportation systems accelerate their evolution towards advanced autonomous driving and comprehensive intelligent management by leveraging technologies such as artificial intelligence, vehicle-to-infrastructure (V2X) communication, their operational accuracy depends on the accurate identification of traffic signals, road signs, and the surrounding environment by onboard perception systems, as well as the fusion and decision-making of multi-source information by roadside equipment and cloud platforms. Against this backdrop, adversarial attacks pose a significant security threat—attackers inject minute, imperceptible perturbations into the input data to induce erroneous outputs in the perception model, such as misinterpreting red lights as green, generating "ghost obstacles" on empty roads, or altering lane line semantics, thereby interfering with vehicle control and traffic scheduling logic.

[0003] Current defense mechanisms mainly focus on two directions: First, methods based on local model hardening for single devices, such as adversarial training, input preprocessing, or feature sanitization. While these methods can improve individual robustness to some extent, they are prone to missed detections or false positives when facing attacks constructed collaboratively across devices due to a lack of global consistency verification. Second, rule-based or threshold-based anomaly detection strategies typically set fixed response conditions but do not fully consider the impact of dynamic environmental factors such as rain, fog, and strong light on sensor performance, leading to a significant increase in false response rates under adverse weather conditions. In addition, existing systems generally lack standardized emergency control interfaces and cross-level linkage capabilities. When an attack triggers a security incident, their ability to coordinate roadside signals, vehicle behavior, and cloud-based strategies for collaborative intervention is limited, which may prolong the system's loss of control window or even cause unnecessary traffic control due to overreaction.

[0004] Although some studies have attempted to introduce multi-sensor fusion or cloud-assisted verification mechanisms, practical deployment still faces challenges such as inconsistent time and space coordinates, lack of explicit modeling of physical constraints, and disconnect between response strategies and scenarios. Especially given the rapidly increasing proportion of multi-node coordinated attacks involving vehicles, charging stations, and the cloud, and the requirement for security responses to meet a hard latency of less than 80ms, building a real-time defense system that integrates physical consistency verification, environmental adaptive strategy matching, and cross-device collaborative execution has become a key technical bottleneck for ensuring the reliable operation of intelligent transportation systems. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for real-time detection and collaborative defense against adversarial examples in intelligent transportation systems. By constructing a security protection architecture that integrates physical consistency verification, environmental adaptive strategy matching, and cross-device collaborative execution, it specifically solves the technical problems existing in current intelligent transportation adversarial example defense mechanisms, such as the lack of global verification, poor environmental adaptability, and insufficient collaborative response.

[0006] In a first aspect, the present invention provides a method for real-time detection and collaborative defense against adversarial examples in intelligent transportation systems, comprising: S100 synchronously collects raw data from vehicle-mounted sensing units, roadside sensing units, and cloud platforms, and performs noise reduction, distortion correction, coordinate normalization, and semantic tag alignment operations on the raw data to generate structured data packets. S200 performs multi-dimensional cross-validation of structured data packets based on a unified world coordinate system. By constructing a physical consistency constraint model, it identifies abnormal observations that violate kinematic laws, geometric occlusion relationships, or semantic logic, and generates consistency conflict flags. S300. Based on the consistency conflict flag and the physical consistency prediction result, the deviation between the current perception output and the physical consistency prediction result is calculated through residual analysis. When the deviation exceeds a preset threshold, it is marked as a suspicious adversarial sample. S400: Construct a dynamic environment feature vector and input it into a lightweight neural network for training to generate a detection threshold adjustment factor and a node confidence weight base value, thereby adjusting the detection sensitivity and decision boundary. S500: For suspicious adversarial samples, cross-validation is performed through vehicle-road cooperation, and an aggregated trust score is generated through a majority voting mechanism to confirm the authenticity of the attack with high confidence; for attack confirmation events, a four-level response strategy adjustment is constructed; S600: Write attack confirmation events into the blockchain or security log to form a defense audit chain; when the logs accumulate to a certain scale or a fixed period, trigger the offline update process of the model.

[0007] Preferably, S100 includes: The vehicle-mounted sensing unit includes a forward-facing camera, millimeter-wave radar, and lidar, with its output interfaces connected to the image acquisition card, radar signal conditioning circuit, and point cloud processing component of the vehicle-mounted main control unit, respectively. The roadside sensing unit includes a wide-angle vision sensor and a high-precision positioning base station, with its data accessed to the roadside edge server via an optical fiber link. The cloud platform receives aggregated data from multiple roadside sensing units through a 5G-V2X secure channel. During the coordinate normalization stage, the on-board main control unit calls the pre-stored external parameter calibration matrix. , and ;in, , and These represent the transformation matrices from the forward-looking camera, millimeter-wave radar, and lidar to the vehicle coordinate system. These matrices are used to transform the data collected by each sensor in its original coordinate system to a unified world coordinate system with the vehicle's center of mass as the origin. The roadside sensing unit adopts... Map the observations to a unified world coordinate system; where... This represents the transformation matrix mapping from the RSU coordinate system to the unified world coordinate system; During the semantic tag alignment stage, a unified traffic ontology is used to encode key semantic elements to ensure the comparability of semantic information from different sources. During the data encapsulation stage, the processed multimodal data is sliced ​​according to a predetermined time window to generate structured data packets.

[0008] Preferably, S200 includes: The physical consistency constraint model includes: an orbit prediction submodule, a visibility verification submodule, and a semantic rule engine submodule; The trajectory prediction submodule, for historical obstacles with continuous observation, extrapolates the motion state of its historical pose sequence based on a Kalman filter, and predicts the reasonable position interval at the current moment by combining process noise and measurement noise; if the current measured position deviates significantly from the reasonable position interval, it is marked as an abnormal trajectory state. The visibility verification submodule constructs a ray-projected occlusion map centered on the vehicle or roadside sensing unit in a unified world coordinate system based on 3D models of buildings, guardrails, etc. in a high-precision static map; for observed obstacles marked as existing, it calculates the line-of-sight path between the obstacle and the sensor; if the path is completely occluded by a static obstacle, it is determined that the geometric occlusion relationship is violated. The semantic rule engine submodule loads a predefined traffic law knowledge base and, in conjunction with the real-time traffic light status and the corresponding lane's access permission rules, verifies whether the behavior of traffic participants within the lane is compliant. The physical consistency prediction results are compared with the actual sensing output. If any submodule determines a contradiction, a consistency conflict flag is generated. And mark it as an anomalous observation; otherwise generate .

[0009] Preferably, the residual analysis calculation includes: The consistency conflict flag and the physical consistency prediction result are used as inputs; wherein, the physical consistency prediction result includes the reasonable estimated position of the target object in the unified world coordinate system at the current moment; Calculate the residual value between the reasonable estimated position and the measured position; the residual value is used to characterize the deviation between the measured data and the reasonable estimated position; An environment-adaptive dynamic detection threshold is adopted; the dynamic detection threshold is dynamically calculated based on real-time environmental perception data, and the calculation formula is as follows: In the formula, This serves as a baseline threshold, used to characterize detection sensitivity under ideal conditions. Real-time rainfall intensity is obtained from rain gauges; The scene lighting contrast is used to characterize the effect of light intensity. and These are environmental sensitivity coefficients for rainfall intensity and light contrast, respectively, used to quantify the expected impact weights of rainfall and low light intensity on perceived noise levels.

[0010] Preferably, S300 includes: When both conditions 1 and 2 are met, the current observation data is identified as a suspicious adversarial sample: Condition 1: Consistency conflict flag is ; Condition 2: The residual value is greater than or equal to the dynamic detection threshold, indicating that its deviation has exceeded the reasonable error range under the current environmental conditions; For suspicious adversarial samples, an enhanced security event data packet is generated; in addition to including all the information of the structured data packet, the enhanced security event data packet also encapsulates: consistency conflict type, residual value, dynamic detection threshold, real-time rainfall intensity and scene illumination contrast that trigger the judgment; The enhanced security event data packets are sent to the roadside edge server and cloud scheduling platform via network links for subsequent parameter adjustments and model updates.

[0011] Preferably, S400 includes: The vehicle-mounted sensing unit reads data from the rain sensor and light sensor via the CAN bus; the roadside sensing unit obtains visibility and road surface adhesion coefficient estimates through an integrated weather station interface; the cloud platform integrates data from multiple roadside sensing units, calculates the regional macroscopic traffic flow density, and stitches it together into a dynamic environmental feature vector based on real-time rainfall intensity and scene light contrast; the expression for the dynamic environmental feature vector is: ; In the formula, Visibility; This is an estimated value for the road surface adhesion coefficient; This refers to the regional macroscopic traffic flow density. The dynamic environment feature vector is input into a lightweight neural network for offline training to generate a detection threshold adjustment factor and a node credibility weight base value. The detection threshold adjustment factor is used to fine-tune the dynamic detection threshold calculation. The node credibility weight base value is used to initialize the voting weight of nodes in subsequent collaborative verification.

[0012] Preferably, S500 includes: For suspicious adversarial examples, feature descriptors are generated, which include location, timestamp, semantic label, confidence level, and structured data packets in a unified world coordinate system; The feature descriptors of suspicious adversarial samples are broadcast through a V2X secure channel; After receiving the broadcast, nearby vehicles or roadside sensing units immediately store it in their local cache and perform verification centered on the spatiotemporal location of the suspected adversarial example. They compare the perception history of the vehicle to be verified with their own in the same spatiotemporal range. If the target category perceived by the vehicle to be verified is inconsistent with its own, or the positional deviation is continuously greater than the range threshold, a negative vote is returned; otherwise, a positive vote is returned. A majority voting mechanism is used to calculate the aggregated trust score for the vehicle to be verified. The calculation formula is as follows: ; ; ; In the formula, Let be the voting weight of the i-th vehicle to be verified; Let i be the base weight of the i-th vehicle to be verified; Let be the confidence level of the i-th vehicle to be verified; The i-th vehicle to be verified is clustered as Distance attenuation factor; To verify the return value, -1 is returned if it is a negative vote, and +1 is returned if it is a positive vote; To aggregate trust scores; When the aggregated trust score is lower than the preset attack judgment threshold, the suspicious adversarial node is determined to be a real adversarial attack, an attack confirmation event is generated, and a four-level response strategy is adopted for adjustment.

[0013] Secondly, the present invention also provides a real-time detection and collaborative defense system for adversarial examples in intelligent transportation systems, which is applied to the real-time detection and collaborative defense method for adversarial examples in intelligent transportation systems as described above. The system includes a multi-source data preprocessing module, a spatiotemporal consistency verification module, an adversarial example detection module, an environmental context modeling module, a multi-node verification and adjustment module, and a model offline update module. The source data preprocessing module is used to synchronously collect raw data from vehicle-mounted sensing units, roadside sensing units and cloud platforms, and perform noise reduction, distortion correction, coordinate normalization and semantic tag alignment operations on the raw data to generate structured data packets. The spatiotemporal consistency verification module performs multi-dimensional cross-verification of structured data packets based on a unified world coordinate system. By constructing a physical consistency constraint model, it identifies abnormal observations that violate kinematic laws, geometric occlusion relationships, or semantic logic, and generates consistency conflict flags. The adversarial example detection module calculates the deviation between the current perception output and the physical consistency prediction result through residual analysis based on the consistency conflict flag and the physical consistency prediction result. When the deviation exceeds a preset threshold, it is marked as a suspicious adversarial example. The environmental context modeling module is used to input the constructed dynamic environmental feature vector into the lightweight neural network for training, generate the detection threshold adjustment factor and the node confidence weight base value, and adjust the detection sensitivity and the judgment boundary accordingly. The multi-node verification and adjustment module performs cross-verification of suspicious adversarial samples through vehicle-road cooperation and generates an aggregated trust score through a majority voting mechanism to confirm the authenticity of the attack with high confidence. For attack confirmation events, a four-level response strategy adjustment is constructed. The offline model update module is used to write attack confirmation events into the blockchain or security log to form a defense audit chain; when the logs accumulate to a certain scale or a fixed period, the offline model update process is triggered.

[0014] Compared with the prior art, the present invention has the following advantages and beneficial effects: 1. By unifying the world coordinate system transformation, this approach achieves time synchronization, coordinate normalization, and semantic label alignment of multi-source sensing data from vehicles, roadside, and the cloud, laying a data foundation for cross-device verification. Simultaneously, a physical consistency constraint model is constructed, combining residual analysis and vehicle-road cooperative majority voting mechanisms to achieve multi-level identification of adversarial examples from three aspects: physical laws, spatiotemporal matching, and multi-node cross-validation. Compared to existing single-device local hardening methods, this design compensates for the lack of global consistency verification, significantly reducing the false negative rate under cross-device cooperative attacks. Furthermore, by aggregating trust scores for calculation, it effectively avoids misjudgments caused by single-point sensing bias, improving the confidence level of attack confirmation.

[0015] 2. This invention abandons the traditional fixed threshold detection strategy. Instead, it constructs a dynamic environmental feature vector through multi-dimensional environmental parameters and inputs it into a lightweight neural network for training. This generates a detection threshold adjustment factor and a node credibility weight base value, achieving dynamic adaptation between detection sensitivity and decision boundaries. On one hand, the dynamic detection threshold can accurately distinguish between normal perception performance degradation and malicious adversarial disturbances based on real-time environmental conditions, solving the problem of a significant increase in false response rate under severe weather conditions. On the other hand, the node weight adjustment based on environmental parameters ensures the decision priority of high-reliability nodes in complex scenarios, further improving the environmental adaptability and operational stability of the defense system.

[0016] 3. This invention relies on a three-tiered collaborative deployment architecture of vehicle-side, roadside, and cloud-based systems. Combining 5G-V2X secure communication with a lightweight decision tree model, it constructs a four-tiered response strategy. This strategy can rapidly execute intervention operations such as confidence adjustment, backup channel verification, protective control, and traffic guidance based on the severity of the attack, meeting a hard latency requirement of less than 80ms and effectively shortening the system's loss of control window. Simultaneously, a defense audit chain is built through blockchain or security logs, automatically extracting real adversarial samples for offline model updates. Furthermore, encrypted OTA channels enable iterative model updates across the entire network of devices, ensuring the system's defense capabilities continuously adapt to new adversarial attacks and providing strong support for the long-term reliable operation of intelligent transportation systems. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a method for real-time detection and collaborative defense of adversarial examples in intelligent transportation systems.

[0018] Figure 2 This is a schematic diagram of the three-level collaborative operation of vehicle-mounted, roadside, and cloud-based systems in a real-time detection and collaborative defense method for adversarial samples in intelligent transportation systems.

[0019] Figure 3 This is a structural block diagram of an adversarial sample real-time detection and collaborative defense system for intelligent transportation systems. Detailed Implementation

[0020] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention. It should be noted that relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0021] Example 1 Please see Figures 1-2 This invention provides a method for real-time detection and collaborative defense of adversarial examples in intelligent transportation systems. By constructing a security architecture that integrates physical consistency verification, environmental adaptive strategy matching, and cross-device collaborative execution, it achieves high-precision identification and low-latency response to adversarial disturbances in multi-source perception data from vehicles, roadside, and the cloud. The method is deployed in a three-tiered collaborative system consisting of a vehicle-side computing unit, a roadside edge server, and a cloud-based scheduling platform. The method includes: S100: Simultaneously collect raw data from the vehicle-mounted sensing unit, roadside sensing unit, and cloud platform, and perform noise reduction, distortion correction, coordinate normalization, and semantic tag alignment operations on the raw data to generate structured data packets; the raw data includes images, point clouds, radar echoes, and V2X communication data; Specifically, S100 includes: The vehicle-mounted sensing unit includes a forward-facing camera, millimeter-wave radar, and lidar, with its output interfaces connected to the image acquisition card, radar signal conditioning circuit, and point cloud processing component of the vehicle-mounted main control unit, respectively. The roadside sensing unit includes a wide-angle vision sensor and a high-precision positioning base station, with its data accessed to the roadside edge server via a fiber optic link. The cloud platform receives aggregated data from multiple roadside sensing units through a 5G-V2X secure channel. All devices achieve nanosecond-level time synchronization using the PTP (Precision Time Protocol) to ensure that each data stream has a unified time reference.

[0022] During the coordinate normalization stage, the on-board main control unit calls the pre-stored external parameter calibration matrix. , and ;in, , and These represent the transformation matrices from the forward-looking camera, millimeter-wave radar, and lidar to the vehicle coordinate system. These matrices are used to transform the data collected by each sensor in its original coordinate system to a unified world coordinate system with the vehicle's center of mass as the origin. The roadside sensing unit adopts... Map its observations to a unified world coordinate system; where, This represents the transformation matrix that maps from the RSU coordinate system to the unified world coordinate system.

[0023] During the semantic label alignment stage, a unified traffic ontology is used to encode key semantic elements. Among them, traffic signal status is encoded as {0: red light; 1: yellow light; 2: green light}; lane line type is encoded as {1: pedestrian; 2: non-motorized vehicle; 3: motorized vehicle}; and lane line type is encoded as {0: solid line; 1: dashed line}. This is used to ensure the comparability of semantic information from different sources.

[0024] During the data encapsulation stage, the processed multimodal data is sliced ​​into 50ms time windows to generate structured data packets. The structured data packets include timestamps, spatial locations, semantic tags, confidence scores, and original sensor IDs for subsequent verification.

[0025] S200 performs multi-dimensional cross-validation of structured data packets based on a unified world coordinate system. By constructing a physical consistency constraint model, it identifies abnormal observations that violate kinematic laws, geometric occlusion relationships, or semantic logic, and generates consistency conflict flags. Specifically, the physical consistency constraint model is used to jointly audit the sensing data of the same spatiotemporal slice and generate physical consistency prediction results; including: The physical consistency constraint model includes: an orbit prediction submodule, a visibility verification submodule, and a semantic rule engine submodule; The trajectory prediction submodule, for historical obstacles with continuous observation, extrapolates the motion state of its historical pose sequence based on a Kalman filter, and predicts the reasonable position interval at the current moment by combining process noise and measurement noise; if the current measured position deviates significantly from the reasonable position interval, it is marked as an abnormal trajectory state.

[0026] The visibility verification submodule constructs a ray-projected occlusion map centered on the vehicle or roadside sensing unit in a unified world coordinate system based on 3D models of buildings, guardrails, etc., in a high-precision static map. For each obstacle observation marked as existing, it calculates the line-of-sight path between the obstacle and the sensor. If the path is completely occluded by a static obstacle, the observation is determined to violate geometric occlusion relations.

[0027] The semantic rule engine submodule loads a predefined traffic regulation knowledge base to verify the semantic logic of the scenario. For example, it combines the real-time traffic light status with the corresponding lane's access permission rules to verify whether the behavior of traffic participants within the lane is compliant; under a red light phase, there should be no high-speed vehicles in the straight lane. Such contradictions may stem from adversarial attacks on traffic lights or abnormal injection of vehicle behavior.

[0028] The physical consistency prediction results are compared with the actual perceived output. If any submodule determines that there is an irreconcilable contradiction, a consistency conflict flag is generated. And mark the structured data packet as an anomalous observation; otherwise generate This is considered a pass of consensus. All conflict events are logged and trigger subsequent collaborative defense processes.

[0029] S300. Based on the consistency conflict flag and the physical consistency prediction result, the deviation between the current perception output and the physical consistency prediction result is calculated through residual analysis. When the deviation exceeds a preset threshold, it is marked as a suspicious adversarial sample. Specifically, the residual analysis calculation includes: The consistency conflict flag and the physical consistency prediction result are used as inputs; wherein, the physical consistency prediction result includes the reasonable estimated position of the target object in the unified world coordinate system at the current moment; Calculate the residual value between the reasonable estimated location and the measured location; the residual value is used to characterize the deviation between the measured data and the reasonable estimated location generated based on the physical consistency constraint model; To accurately distinguish between normal perception performance degradation caused by adverse weather conditions, changes in lighting, etc., and malicious adversarial disturbances, an environment-adaptive dynamic detection threshold is adopted. This dynamic detection threshold is dynamically calculated based on real-time environmental perception data, and the specific calculation formula is as follows: In the formula, This serves as a baseline threshold, used to characterize detection sensitivity under ideal conditions. Real-time rainfall intensity is obtained from rain gauges; The scene lighting contrast is used to characterize the effect of light intensity. and These are environmental sensitivity coefficients for rainfall intensity and light contrast, respectively, used to quantify the expected impact weights of rainfall and low light on perceived noise levels. This design allows the system to appropriately relax thresholds in complex environments such as rain, fog, and nighttime, reducing false alarms.

[0030] The current observation data is preliminarily identified as a suspicious adversarial sample when both of the following conditions are met: Condition 1: Consistency conflict flag is ; Condition 2: The residual value is greater than or equal to the dynamic detection threshold, indicating that its deviation has exceeded the reasonable error range under the current environmental conditions.

[0031] Once marked, the system immediately generates an enhanced security event data packet; in addition to including all the information of the structured data packet, the enhanced security event data packet also encapsulates: consistency conflict type (trajectory anomaly, occlusion conflict, semantic violation), residual value, dynamic detection threshold, real-time rainfall intensity and scene illumination contrast that trigger the judgment; The enhanced security event data packets will be pushed to the roadside edge server and cloud dispatch platform via network links, triggering subsequent collaborative diagnosis and mitigation strategy matching. Simultaneously, the vehicle-side system will execute predefined degradation security policies locally based on the threat level, achieving closed-loop, low-latency protection through detection, reporting, and response.

[0032] S400 collects real-time rainfall intensity, scene lighting contrast, road material and traffic flow density parameters, constructs dynamic environmental feature vectors, and inputs them into a lightweight neural network for training to generate detection threshold adjustment factors and node confidence weight base values, thereby adjusting detection sensitivity and judgment boundaries. Specifically, S400 includes: The vehicle-mounted sensing unit reads data from the rain sensor and light sensor via the CAN bus; the roadside sensing unit obtains visibility and road surface adhesion coefficient estimates through an integrated weather station interface; the cloud platform integrates data from multiple roadside sensing units, calculates the regional macroscopic traffic flow density, and stitches it together into a dynamic environmental feature vector based on real-time rainfall intensity and scene light contrast; the expression for the dynamic environmental feature vector is: ; In the formula, Visibility; This is an estimated value for the road surface adhesion coefficient; This represents the regional macroscopic traffic flow density.

[0033] The dynamic environment feature vector is input into a lightweight neural network for offline training to generate a detection threshold adjustment factor and a node credibility weight base value. The detection threshold adjustment factor is used to fine-tune the dynamic detection threshold calculation of S300 to further improve environmental adaptability. The node credibility weight base value is used to initialize the voting weight of nodes in subsequent collaborative verification to ensure that nodes with higher reliability have greater weight in harsh environments.

[0034] S500: For suspicious adversarial samples, cross-validation is performed through vehicle-road cooperation, and an aggregated trust score is generated through a majority voting mechanism to confirm the authenticity of the attack with high confidence and reduce the risk of single-point misjudgment; for attack confirmation events, a four-level response strategy adjustment is constructed. Specifically, S500 includes: For each suspected adversarial sample, a feature descriptor is generated, which includes the location, timestamp, semantic label, confidence score, and structured data packet in a unified world coordinate system; The feature descriptors of suspicious adversarial samples are broadcast through a V2X secure channel; Upon receiving the broadcast, nearby vehicles or roadside sensing units immediately store it in their local cache and perform a search centered on the spatiotemporal location of the suspected adversarial example. They compare the perception history of the vehicle to be verified with their own in the same spatiotemporal range. If the target category perceived by the vehicle to be verified is inconsistent with its own, or if the positional deviation is continuously greater than the range threshold, a negative vote is returned; otherwise, a positive vote is returned.

[0035] A majority voting mechanism is used to calculate the aggregate trust score for each vehicle to be verified. The relevant calculation formula is shown below: ; ; ; In the formula, Let be the voting weight of the i-th vehicle to be verified; Let i be the base weight of the i-th vehicle to be verified; Let be the confidence level of the i-th vehicle to be verified; The i-th vehicle to be verified is clustered as Distance attenuation factor; To verify the return value, -1 is returned if it is a negative vote, and +1 is returned if it is a positive vote; To aggregate trust scores.

[0036] When the aggregate trust score is lower than the preset attack determination threshold, the suspicious adversarial node is determined to be a real adversarial attack, and an attack confirmation event is generated.

[0037] Based on the confirmed attack events and their characteristic descriptors, a four-level response strategy is constructed as follows: The four-level response strategy is implemented using a pre-trained, lightweight decision tree model with a depth of no more than 5 layers.

[0038] S600: Write the complete data stream of all confirmed attack events into the blockchain or security log to form a defense audit chain; when the logs accumulate to a certain scale or a fixed period, trigger the offline update process of the model, specifically: automatically extract real adversarial samples and feature descriptors, add them to the adversarial training dataset, and fine-tune the model parameters to enhance the system's robustness against such attacks; after the updated model is verified, it is updated to all vehicles and devices on the network through an encrypted OTA channel.

[0039] Example 2 Please see Figures 2-3This embodiment provides a real-time detection and collaborative defense system for adversarial examples in intelligent transportation systems. It applies the real-time detection and collaborative defense method for adversarial examples in intelligent transportation systems as described above. The system includes a multi-source data preprocessing module, a spatiotemporal consistency verification module, an adversarial example detection module, an environmental context modeling module, a multi-node verification and adjustment module, and a model offline update module. The source data preprocessing module is used to synchronously collect raw data from vehicle-mounted sensing units, roadside sensing units and cloud platforms, and perform noise reduction, distortion correction, coordinate normalization and semantic tag alignment operations on the raw data to generate structured data packets. The spatiotemporal consistency verification module performs multi-dimensional cross-verification of structured data packets based on a unified world coordinate system. By constructing a physical consistency constraint model, it identifies abnormal observations that violate kinematic laws, geometric occlusion relationships, or semantic logic, and generates consistency conflict flags. The adversarial example detection module calculates the deviation between the current perception output and the physical consistency prediction result through residual analysis based on the consistency conflict flag and the physical consistency prediction result. When the deviation exceeds a preset threshold, it is marked as a suspicious adversarial example. The environmental context modeling module is used to input the constructed dynamic environmental feature vector into the lightweight neural network for training, generate the detection threshold adjustment factor and the node confidence weight base value, and adjust the detection sensitivity and the judgment boundary accordingly. The multi-node verification and adjustment module performs cross-verification of suspicious adversarial samples through vehicle-road cooperation and generates an aggregated trust score through a majority voting mechanism to confirm the authenticity of the attack with high confidence. For attack confirmation events, a four-level response strategy adjustment is constructed. The offline model update module is used to write attack confirmation events into the blockchain or security log to form a defense audit chain; when the logs accumulate to a certain scale or a fixed period, the offline model update process is triggered.

[0040] All content not described in detail in this specification is prior art known to those skilled in the art, and the model parameters of each communication module are not specifically limited; conventional equipment can be used. Network protocol stacks and hardware interfaces not mentioned in this technical solution are not shown in the figures because they are prior art, and will not be described further here.

[0041] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for real-time detection and collaborative defense of adversarial examples in intelligent transportation systems, characterized in that: include: S100 synchronously collects raw data from vehicle-mounted sensing units, roadside sensing units, and cloud platforms, and performs noise reduction, distortion correction, coordinate normalization, and semantic tag alignment operations on the raw data to generate structured data packets. S200 performs multi-dimensional cross-validation of structured data packets based on a unified world coordinate system. By constructing a physical consistency constraint model, it identifies abnormal observations that violate kinematic laws, geometric occlusion relationships, or semantic logic, and generates consistency conflict flags. S300. Based on the consistency conflict flag and the physical consistency prediction result, the deviation between the current perception output and the physical consistency prediction result is calculated through residual analysis. When the deviation exceeds a preset threshold, it is marked as a suspicious adversarial sample. S400: Construct a dynamic environment feature vector and input it into a lightweight neural network for training to generate a detection threshold adjustment factor and a node confidence weight base value, thereby adjusting the detection sensitivity and decision boundary. S500: For suspicious adversarial samples, cross-validation is performed through vehicle-road cooperation, and an aggregated trust score is generated through a majority voting mechanism to confirm the authenticity of the attack with high confidence; for attack confirmation events, a four-level response strategy adjustment is constructed; S600: Write attack confirmation events into the blockchain or security log to form a defense audit chain; when the logs accumulate to a certain scale or a fixed period, trigger the offline update process of the model.

2. The method for real-time detection and collaborative defense of adversarial examples for intelligent transportation systems according to claim 1, characterized in that, The S100 includes: The vehicle-mounted sensing unit includes a forward-facing camera, millimeter-wave radar, and lidar, with its output interfaces connected to the image acquisition card, radar signal conditioning circuit, and point cloud processing component of the vehicle-mounted main control unit, respectively. The roadside sensing unit includes a wide-angle vision sensor and a high-precision positioning base station, with its data accessed to the roadside edge server via an optical fiber link. The cloud platform receives aggregated data from multiple roadside sensing units through a 5G-V2X secure channel. During the coordinate normalization stage, the on-board main control unit calls the pre-stored external parameter calibration matrix. , and ;in, , and These represent the transformation matrices from the forward-looking camera, millimeter-wave radar, and lidar to the vehicle coordinate system. These matrices are used to transform the data collected by each sensor in its original coordinate system to a unified world coordinate system with the vehicle's center of mass as the origin. The roadside sensing unit adopts... Map the observations to a unified world coordinate system; where... This represents the transformation matrix mapping from the RSU coordinate system to the unified world coordinate system; During the semantic tag alignment stage, a unified traffic ontology is used to encode key semantic elements to ensure the comparability of semantic information from different sources. During the data encapsulation stage, the processed multimodal data is sliced ​​according to a predetermined time window to generate structured data packets.

3. The method for real-time detection and collaborative defense of adversarial examples for intelligent transportation systems according to claim 1, characterized in that: The S200 includes: The physical consistency constraint model includes: an orbit prediction submodule, a visibility verification submodule, and a semantic rule engine submodule; The trajectory prediction submodule, for historical obstacles with continuous observation, extrapolates the motion state of its historical pose sequence based on a Kalman filter, and predicts the reasonable position interval at the current moment by combining process noise and measurement noise; if the current measured position deviates significantly from the reasonable position interval, it is marked as an abnormal trajectory state. The visibility verification submodule constructs a ray-projected occlusion map centered on the vehicle or roadside sensing unit in a unified world coordinate system based on 3D models of buildings, guardrails, etc. in a high-precision static map; for observed obstacles marked as existing, it calculates the line-of-sight path between the obstacle and the sensor; if the path is completely occluded by a static obstacle, it is determined that the geometric occlusion relationship is violated. The semantic rule engine submodule loads a predefined traffic law knowledge base and, in conjunction with the real-time traffic light status and the corresponding lane's access permission rules, verifies whether the behavior of traffic participants within the lane is compliant. The physical consistency prediction results are compared with the actual sensing output. If any submodule determines a contradiction, a consistency conflict flag is generated. And mark it as an anomalous observation; otherwise generate .

4. The method for real-time detection and collaborative defense of adversarial examples for intelligent transportation systems according to claim 3, characterized in that: The residual analysis calculation includes: The consistency conflict flag and the physical consistency prediction result are used as inputs; wherein, the physical consistency prediction result includes the reasonable estimated position of the target object in the unified world coordinate system at the current moment; Calculate the residual value between the reasonable estimated position and the measured position; the residual value is used to characterize the deviation between the measured data and the reasonable estimated position; An environment-adaptive dynamic detection threshold is adopted; the dynamic detection threshold is dynamically calculated based on real-time environmental perception data, and the calculation formula is as follows: In the formula, This serves as a baseline threshold, used to characterize detection sensitivity under ideal conditions. Real-time rainfall intensity is obtained from rain gauges; The scene lighting contrast is used to characterize the effect of light intensity. and These are environmental sensitivity coefficients for rainfall intensity and light contrast, respectively, used to quantify the expected impact weights of rainfall and low light intensity on perceived noise levels.

5. The method for real-time detection and collaborative defense of adversarial examples for intelligent transportation systems according to claim 4, characterized in that: The S300 includes: When both conditions 1 and 2 are met, the current observation data is identified as a suspicious adversarial sample: Condition 1: Consistency conflict flag is ; Condition 2: The residual value is greater than or equal to the dynamic detection threshold, indicating that its deviation has exceeded the reasonable error range under the current environmental conditions; For suspicious adversarial samples, an enhanced security event data packet is generated; in addition to including all the information of the structured data packet, the enhanced security event data packet also encapsulates: consistency conflict type, residual value, dynamic detection threshold, real-time rainfall intensity and scene illumination contrast that trigger the judgment; The enhanced security event data packets are sent to the roadside edge server and cloud scheduling platform via network links for subsequent parameter adjustments and model updates.

6. The method for real-time detection and collaborative defense of adversarial examples for intelligent transportation systems according to claim 5, characterized in that: The S400 includes: The vehicle-mounted sensing unit reads data from the rain sensor and light sensor via the CAN bus; the roadside sensing unit obtains visibility and road surface adhesion coefficient estimates through an integrated weather station interface; the cloud platform integrates data from multiple roadside sensing units, calculates the regional macroscopic traffic flow density, and stitches it together into a dynamic environmental feature vector based on real-time rainfall intensity and scene light contrast; the expression for the dynamic environmental feature vector is: ； In the formula, Visibility; This is an estimated value for the road surface adhesion coefficient; This refers to the regional macroscopic traffic flow density. The dynamic environment feature vector is input into a lightweight neural network for offline training to generate a detection threshold adjustment factor and a node credibility weight base value. The detection threshold adjustment factor is used to fine-tune the dynamic detection threshold calculation. The node credibility weight base value is used to initialize the voting weight of nodes in subsequent collaborative verification.

7. The method for real-time detection and collaborative defense of adversarial examples for intelligent transportation systems according to claim 6, characterized in that: The S500 includes: For suspicious adversarial examples, feature descriptors are generated, which include location, timestamp, semantic label, confidence level, and structured data packets in a unified world coordinate system; The feature descriptors of suspicious adversarial samples are broadcast through a V2X secure channel; After receiving the broadcast, nearby vehicles or roadside sensing units immediately store it in their local cache and perform verification centered on the spatiotemporal location of the suspected adversarial example. They compare the perception history of the vehicle to be verified with their own in the same spatiotemporal range. If the target category perceived by the vehicle to be verified is inconsistent with its own, or the positional deviation is continuously greater than the range threshold, a negative vote is returned; otherwise, a positive vote is returned. A majority voting mechanism is used to calculate the aggregated trust score for the vehicle to be verified. The calculation formula is as follows: ； ； ； In the formula, Let be the voting weight of the i-th vehicle to be verified; Let i be the base weight of the i-th vehicle to be verified; Let be the confidence level of the i-th vehicle to be verified; The i-th vehicle to be verified is clustered as Distance attenuation factor; To verify the return value, -1 is returned if it is a negative vote, and +1 is returned if it is a positive vote; To aggregate trust scores; When the aggregated trust score is lower than the preset attack judgment threshold, the suspicious adversarial node is determined to be a real adversarial attack, an attack confirmation event is generated, and a four-level response strategy is adopted for adjustment.

8. A real-time detection and collaborative defense system for adversarial examples in intelligent transportation systems, characterized in that: The method for real-time detection and collaborative defense of adversarial examples for intelligent transportation systems as described in any one of claims 1-7 above, the system comprising a multi-source data preprocessing module, a spatiotemporal consistency verification module, an adversarial example detection module, an environmental context modeling module, a multi-node verification and adjustment module, and a model offline update module; The source data preprocessing module is used to synchronously collect raw data from vehicle-mounted sensing units, roadside sensing units and cloud platforms, and perform noise reduction, distortion correction, coordinate normalization and semantic tag alignment operations on the raw data to generate structured data packets. The spatiotemporal consistency verification module performs multi-dimensional cross-verification of structured data packets based on a unified world coordinate system. By constructing a physical consistency constraint model, it identifies abnormal observations that violate kinematic laws, geometric occlusion relationships, or semantic logic, and generates consistency conflict flags. The adversarial example detection module calculates the deviation between the current perception output and the physical consistency prediction result through residual analysis based on the consistency conflict flag and the physical consistency prediction result. When the deviation exceeds a preset threshold, it is marked as a suspicious adversarial example. The environmental context modeling module is used to input the constructed dynamic environmental feature vector into the lightweight neural network for training, generate the detection threshold adjustment factor and the node confidence weight base value, and adjust the detection sensitivity and the judgment boundary accordingly. The multi-node verification and adjustment module performs cross-verification of suspicious adversarial samples through vehicle-road cooperation and generates an aggregated trust score through a majority voting mechanism to confirm the authenticity of the attack with high confidence. For attack confirmation events, a four-level response strategy adjustment is constructed. The offline model update module is used to write attack confirmation events into the blockchain or security log to form a defense audit chain; when the logs accumulate to a certain scale or a fixed period, the offline model update process is triggered.

Images