Signal recognition network adversarial sample defense method and system based on neural network structure search
By integrating neural network architecture search and adversarial training, a heterogeneous supernetwork is constructed and a dynamic integration strategy is adopted to solve the problem of low adversarial defense efficiency in existing radio signal identification systems, and to achieve a high-efficiency improvement in adversarial robustness.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Chinese People's Liberation Army Cyberspace Force Information Engineering University
- Filing Date
- 2026-05-11
- Publication Date
- 2026-07-03
AI Technical Summary
Existing adversarial defense methods struggle to efficiently acquire structurally heterogeneous and robust subnetworks, and are not adapted to the I/Q sequence input and energy constraint characteristics of radio signals, resulting in poor defense effectiveness and computational efficiency.
By deeply integrating neural network structure search and adversarial training, a heterogeneous supernetwork is constructed to generate adversarial samples that match the signal energy constraints. Multiple structurally heterogeneous subnetworks with adversarial robustness are selected, and a dynamic random ensemble strategy is adopted to improve the overall adversarial robustness of the recognition system.
It significantly improves the robustness of radio signal identification systems, reduces computational overhead, and enhances defense capabilities in complex electromagnetic environments.
Smart Images
Figure CN122339819A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of radio communication technology and artificial intelligence security technology, specifically to a signal recognition network adversarial sample defense method and system based on neural network structure search. Background Technology
[0002] Deep neural networks have been widely used in fields such as radio signal modulation recognition and spectrum sensing, significantly improving the intelligence level of signal processing. However, research shows that deep neural networks are vulnerable to adversarial attacks. Attackers can cause signal recognition networks to produce erroneous outputs by adding carefully designed micro-perturbations to the original signal samples, posing a serious challenge to the security of radio communication systems. Existing adversarial defense methods are mainly divided into three categories: first, data preprocessing methods, which suppress adversarial perturbations through signal denoising and filtering; second, adversarial training methods, which use adversarial examples to expand the training set and enhance the robustness of the model; and third, model ensemble methods, which improve the defense effect through joint decision-making of multiple models. Among them, adversarial training is currently the most stable defense method in terms of overall performance, but this method is usually optimized for specific attack types and is difficult to effectively deal with multiple unknown attacks. Although model ensemble methods can improve the defense effect, their core bottleneck lies in how to efficiently obtain multiple sub-networks that have significant structural differences and each possesses high accuracy and strong adversarial robustness. Traditional methods, such as independently training multiple networks with different structures, incur huge computational costs; pruning-based methods are limited by the structure of the original baseline model and find it difficult to break through the performance ceiling of a single model. Furthermore, existing research primarily focuses on image recognition tasks, with insufficient consideration given to the specific needs of radio signal recognition tasks. Radio signals primarily use I / Q sequences as input, and this format preserves the amplitude and phase information of the signal through orthogonal demodulation. Signal recognition tasks place special demands on the network's temporal modeling capabilities and receptive field matching, and the imperceptibility to disturbances is closely related to signal energy and signal-to-noise ratio. Therefore, there is an urgent need to design efficient technical solutions for acquiring heterogeneous robust subnetworks and implementing dynamic integrated defense, specifically tailored to the characteristics of radio signal recognition tasks. Summary of the Invention
[0003] To address the shortcomings of existing adversarial defense methods, such as the difficulty in efficiently acquiring structurally heterogeneous and robust subnetworks and the lack of adaptation to the I / Q sequence input and energy constraint characteristics of radio signals, resulting in poor defense effectiveness and computational efficiency, this invention proposes a signal recognition network adversarial example defense method and system based on neural network structure search. By deeply integrating neural network structure search and adversarial training, it achieves efficient acquisition of multiple structurally heterogeneous and adversarially robust subnetworks, and combines a dynamic random ensemble strategy to improve the overall adversarial robustness of the signal recognition system.
[0004] To achieve the above objectives, the technical solution adopted is:
[0005] This invention provides a method for defending against adversarial examples in signal recognition networks based on neural network structure search, comprising the following steps:
[0006] Step 1: For the radio signal identification task with I / Q sequence as input format, construct a heterogeneous hypernetwork search space, which includes multiple subnetwork structures with different network depths, number of channels and connection modes.
[0007] Step 2: Integrate adversarial training into the supernetwork training process. In each training iteration, randomly sample a path to obtain a subnetwork. Generate adversarial samples that match the signal energy constraints for the subnetwork, and use the adversarial samples to update the shared weights of the supernetwork, so that the supernetwork learns robust features for radio signal recognition tasks.
[0008] Step 3: Select multiple structurally heterogeneous subnetworks with adversarial robustness from the trained supernetwork to construct a heterogeneous robust subnetwork library for radio signal identification;
[0009] Step 4: In the signal recognition inference stage, multiple sub-networks are randomly selected from the heterogeneous robust sub-network library for dynamic integration, and the weighted sum of the outputs of the selected sub-networks is used as the final signal recognition result.
[0010] According to the signal recognition network adversarial sample defense method based on neural network structure search of the present invention, the heterogeneous supernetwork search space in step 1 adopts a unit-based directed acyclic graph structure, each unit contains multiple intermediate nodes, each node corresponds to an intermediate feature map, and each edge corresponds to a candidate operation, the candidate operation includes one-dimensional depthwise separable convolution, identity mapping and zero operation.
[0011] According to the signal recognition network adversarial example defense method based on neural network structure search of the present invention, the heterogeneous supernetwork search space in step 1 is further configured according to the requirements of signal temporal modeling capability. The temporal modeling capability is controlled by the length and density of temporal connection paths in the subnetwork. Different connection modes determine the path length and density. The connection modes include dense connection type and sparse connection type. The sparse connection type uses identity mapping or zero operation to replace part of the convolution operation to construct short-range temporal connection paths for extracting transient features of the signal. The dense connection type is used to construct long-range temporal connection paths to capture the sequence dependencies of the signal.
[0012] According to the signal recognition network adversarial example defense method based on neural network structure search of the present invention, in step 2, the generation of adversarial examples is strongly coupled with the sub-network structure of each random sampling. Adversarial examples matching the structure of different sub-network structures are generated respectively, so that the supernetwork learns shared feature representations that are robust to different sub-network structures during the alternating optimization process. The generation of adversarial examples adopts... Norm constraints counteract the energy magnitude of disturbances to accommodate the physical correlation between disturbance energy and signal-to-noise ratio in radio signals.
[0013] According to the signal recognition network adversarial sample defense method based on neural network structure search of the present invention, in step 2, the shared weight update of the supernetwork adopts the stochastic gradient descent method, which only updates the shared weight parameters on the path corresponding to the current sampled subnetwork, while keeping the weights of other paths unchanged, so that other subnetworks containing the same shared convolutional layer can be indirectly updated.
[0014] According to the signal recognition network adversarial example defense method based on neural network structure search of the present invention, in step 3, when screening sub-networks, the optimization objective is constructed with the dual principles of optimal adversarial robustness accuracy and maximum structural diversity. The structural diversity is quantified by calculating the average pairwise distance between the parameter vectors of each sub-network architecture, and sub-networks that have both high adversarial robustness and significant structural differences are selected to form the heterogeneous robust sub-network library.
[0015] According to the signal recognition network adversarial example defense method based on neural network structure search of the present invention, the optimization objective of the screening sub-network further satisfies the following formula: ,in, For the set of candidate subnetworks, For the selected set of subnetworks, For sub-networks The robust accuracy against adversarial attacks For balance coefficient, For subnetwork set The structural diversity measurement function.
[0016] According to the signal recognition network adversarial example defense method based on neural network structure search of the present invention, the structural diversity measurement function further satisfies the following formula: ,in, , Let be the architecture parameter vectors of subnetwork i and subnetwork j, respectively. For normalized Euclidean distance, For subnetwork set The number of elements in the middle.
[0017] According to the signal recognition network adversarial example defense method based on neural network structure search of the present invention, the number of sub-networks dynamically integrated in step 4 is a random variable. During each inference, a fixed number or a variable number of sub-networks are randomly selected from the heterogeneous robust sub-network library for integration. The randomness of the integration and combination confuses the attacker's estimation of the gradient of the signal recognition network.
[0018] Furthermore, the present invention also provides a signal recognition network adversarial example defense system based on neural network structure search, for implementing the above method, the system comprising:
[0019] The hypernetwork construction module is used to construct a heterogeneous hypernetwork search space for radio signal identification tasks with I / Q sequence as input format, which includes multiple subnetwork structures with different network depths, channel numbers and connection modes.
[0020] The adversarial training fusion module is used to integrate adversarial training into the supernetwork training process. In each training iteration, a path is randomly sampled to obtain a subnetwork. Adversarial samples matching the signal energy constraints are generated for the subnetwork, and the shared weights of the supernetwork are updated using the adversarial samples.
[0021] The subnetwork selection module is used to select multiple structurally heterogeneous subnetworks with adversarial robustness from the trained supernetwork, and to build a heterogeneous robust subnetwork library for radio signal identification.
[0022] The dynamic integration defense module is used to randomly select multiple sub-networks from the heterogeneous robust sub-network library for dynamic integration during the signal recognition inference stage, and to use the weighted sum of the outputs of the selected sub-networks as the final signal recognition result.
[0023] The beneficial effects achieved by adopting the above technical solution are:
[0024] 1. This invention is specifically designed for the unique format of radio signals with I / Q sequences as input. It adopts a one-dimensional convolutional kernel to adapt to the one-dimensional temporal features of the signal and designs two paths: short-range temporal connection and long-range temporal connection. This allows for flexible adjustment of the network's temporal modeling capabilities, making the heterogeneous hypernetwork search space highly compatible with the requirements of radio signal transient feature extraction and long-range dependency modeling. This structural approach is tailored to the physical characteristics of signal processing tasks.
[0025] 2. This invention deeply and strongly couples adversarial example generation with the sub-network structure of random sampling in each iteration. It generates adversarial examples matching the characteristics of different sub-network structures separately. The supernetwork only updates the weight of the current sampling path in the alternating optimization, so as to learn a robust feature representation applicable to various heterogeneous sub-networks. While significantly reducing the computational overhead, it greatly improves the construction efficiency and model quality of the heterogeneous robust sub-network library.
[0026] 3. In the inference stage, this invention adopts a dynamic random ensemble strategy, randomly selecting multiple subnetworks from a heterogeneous robust subnetwork library for weighted ensemble decision-making. By utilizing the randomness and unpredictability of subnetwork combination, it effectively interferes with and confuses attackers' accurate estimation of model gradients, thereby enhancing the active defense capability of the signal recognition system in complex electromagnetic environments from the system architecture level. Attached Figure Description
[0027] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly described below. The drawings are merely illustrative of some embodiments of the present invention and are not intended to limit the scope of the present invention to all embodiments.
[0028] Figure 1 This is a framework diagram of the signal recognition network adversarial example defense method based on neural network structure search according to an embodiment of the present invention;
[0029] Figure 2 This is a schematic diagram of the heterogeneous hypernetwork search space according to an embodiment of the present invention;
[0030] Figure 3 This is a schematic diagram of the dynamic integrated defense mechanism according to an embodiment of the present invention. Detailed Implementation
[0031] The exemplary solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art.
[0032] like Figure 1 As shown in the figure, this invention discloses a method for defending against adversarial examples in signal recognition networks based on neural network structure search, which specifically includes the following steps:
[0033] Step S1: For the radio signal identification task with I / Q sequence as input format, a heterogeneous hypernetwork search space is constructed. The heterogeneous hypernetwork search space contains multiple subnetwork structures with different network depths, channel numbers, and connection modes. The structure of the heterogeneous hypernetwork search space is as follows: Figure 2 As shown.
[0034] In response to the characteristic that signals in radio signal identification tasks use I / Q sequences as input, this invention constructs a supernetwork containing a large number of heterogeneous subnetwork structures. Unlike existing neural network structure search methods for image recognition, the search space design of this invention fully considers the physical characteristics of signal processing and the requirements of temporal modeling capabilities.
[0035] A modular search space based on units is employed, where each unit is represented as a directed acyclic graph containing... Intermediate nodes (in this embodiment) =4), each node corresponds to an intermediate feature map, and each edge corresponds to a candidate operation. To adapt to the one-dimensional temporal structure of I / Q sequences, all convolutional operations use one-dimensional convolutional kernels to extract local temporal patterns by sliding along the time axis. This embodiment of the invention forces the use of one-dimensional convolutional kernels, abandoning the general two-dimensional / fully connected structure. This is not only a physical adaptation method to match the temporal continuity of signals, but also a structural reduction of parameter redundancy and compression of vulnerable regions in the search space, thereby making gradient noise during adversarial training less likely to be amplified, and the robustness of the sub-network more easily converges. Essentially, it is a structured regularization constraint that places robustness requirements in the foreground.
[0036] Candidate operations are limited to the following three types:
[0037] (1) One-dimensional depthwise separable convolution: While maintaining the feature extraction capability, it reduces the number of parameters and is suitable for local pattern mining of signals.
[0038] (2) Identity mapping: directly transmits features and is used to construct short-range skip connections.
[0039] (3) Zero operation: Disconnect the connection to make the subnetwork structure sparse.
[0040] Meanwhile, based on the requirements of signal recognition tasks for time series modeling capabilities, the VGG16 network was selected in the network depth design to enhance the ability to extract signal time series features.
[0041] The heterogeneous hypernetwork search space is configured according to the requirements of signal temporal modeling capabilities. Radio signals (I / Q sequences) are temporal signals, and their recognition task requires the model to possess two capabilities simultaneously: "short-range temporal modeling and long-range temporal modeling." Short-range temporal modeling means capturing the transient features of the signal, while long-range temporal modeling means capturing the long-range dependencies of the signal. Temporal modeling capability is controlled by the length and density of temporal connection paths in the subnetwork. Different connection patterns determine the path length and density: dense connections correspond to long paths and high density, suitable for long-range temporal modeling; sparse connections correspond to short paths and low density, suitable for short-range transient feature extraction. Sparse connections involve replacing convolution operations with identity mappings or zero operations on some edges within a unit, thereby shortening the information transmission path and constructing short-range temporal connection paths for extracting transient features of the signal. This structure is sensitive to local perturbations and is beneficial for suppressing high-frequency noise introduced by adversarial examples. Densely connected architecture connects each node to all preceding nodes, enhancing feature reuse and constructing long-range temporal connection paths that can capture signal sequence dependencies. This structure has a stronger expressive power for global signal patterns, but its robustness to disturbances is relatively weak.
[0042] By simultaneously including both sparsely connected and densely connected subnetworks within the same supernetwork, a foundation is laid for subsequent screening of structurally heterogeneous and complementary robust subnetworks. The one-dimensional temporal characteristics of radio signals result in completely different response mechanisms between short-range and long-range connections against disturbances—short-range connections help suppress high-frequency disturbances, while long-range connections are beneficial for maintaining the global modulation structure. This invention is the first to explicitly incorporate this complementary characteristic into the search space design.
[0043] Step S2: Integrate adversarial training into the supernetwork training process. In each training iteration, randomly sample a path to obtain a subnetwork. Generate adversarial samples that match the signal energy constraints for the subnetwork, and use the adversarial samples to update the shared weights of the supernetwork, so that the supernetwork learns robust features for radio signal recognition tasks.
[0044] The core challenge of training hypernetworks lies in how to adapt shared weights to multiple subnetworks with different structures simultaneously, while ensuring that each subnetwork possesses adversarial robustness. This invention proposes a strongly coupled adversarial training method for subnetworks, particularly emphasizing the strong coupling between adversarial example generation and subnetwork structure. Norm constraints are used to match the physical meaning of radio signal energy.
[0045] All architectural parameters in the supernetwork are set to 1 to construct a supernetwork containing all possible subnetworks. In each training iteration, a subnetwork is obtained by randomly sampling one path, and the architectural parameters on other paths are set to 0. For the sampled subnetworks, a gradient-based attack method is used to generate adversarial examples. The generation of adversarial examples is strongly coupled with the structure of the randomly sampled subnetwork each time. Adversarial examples matching the structure of different subnetworks are generated separately, so that the supernetwork learns shared feature representations that are robust to different subnetwork structures during the alternating optimization process. To adapt to the characteristics of radio signals, the following approach is adopted. The norm constraint constrains the energy of the adversarial perturbation, making the perturbation energy correlated with the signal-to-noise ratio. The objective of adversarial example generation can be expressed as:
[0046]
[0047] in, The original signal sample, To counteract disturbances, This is the upper limit of the perturbation energy constraint. For loss function, For signal recognition networks, For network parameters, The true class label of the signal. Adversarial training of the sampling sub-network is performed using generated adversarial examples. The overall optimization objective can be expressed in the following min-max form:
[0048]
[0049] in, For signal data distribution, Let be the expected value, and represent the average over all samples. The shared weights of the supernetwork are updated using stochastic gradient descent, but only the shared weight parameters on the path corresponding to the currently sampled subnetwork are updated, while the weights on other paths remain unchanged. When the weights on the current path are updated, all other subnetworks containing the same shared convolutional layer are also indirectly updated. This mechanism allows the supernetwork to train a large number of heterogeneous subnetworks simultaneously with extremely low computational cost, and enables them to progressively learn robust feature representations for radio signal recognition tasks.
[0050] Step S3: Select multiple heterogeneous subnetworks with adversarial robustness from the trained supernetwork to construct a heterogeneous robust subnetwork library for radio signal identification.
[0051] A large number of candidate subnetworks are randomly sampled from the trained supernetwork, and each candidate subnetwork inherits the shared weights of the supernetwork. Each candidate subnetwork is fine-tuned through 2 to 3 rounds of adversarial training to further improve its adversarial robustness.
[0052] When selecting subnetworks, the optimization objective is constructed based on the dual principles of maximizing adversarial robustness accuracy and structural diversity. Subnetworks that possess both high adversarial robustness and significant structural differences are selected to form the heterogeneous robust subnetwork library. The optimization objective for selecting subnetworks satisfies the following formula:
[0053]
[0054] in, For the set of candidate subnetworks, For the selected set of subnetworks, For sub-networks The robust accuracy against adversarial attacks For balance coefficient, For subnetwork set The structural diversity metric function is calculated by measuring the average pairwise distance between the parameter vectors of each sub-network architecture.
[0055]
[0056] in, , These are the architecture parameter vectors for subnetworks i and j, respectively, which encode information such as network depth, number of channels, and connection mode. For normalized Euclidean distance, For subnetwork set The number of elements in the network. Through weighted optimization, five subnetworks that are both highly robust against adversarial forces and structurally significantly different from each other were selected to form a heterogeneous robust subnetwork library.
[0057] Step S4: In the signal recognition inference stage, multiple sub-networks are randomly selected from the heterogeneous robust sub-network library for dynamic integration. The weighted sum of the outputs of the selected sub-networks is used as the final signal recognition result. The dynamic integration defense mechanism is as follows: Figure 3 As shown.
[0058] In the signal recognition inference stage, the number of randomly integrated subnetworks is a random variable, ranging from 2 to 5. During each inference, a fixed or variable number of subnetworks are randomly selected from the heterogeneous robust subnetwork library for integration, and the outputs of the selected subnetworks are weighted and summed to obtain the final signal recognition result.
[0059] Because the combination of subnetworks selected during each inference varies randomly, attackers cannot predict the specific structure of the ensemble model and find it difficult to generate effective adversarial examples through gradient estimation methods, thus significantly improving the adversarial robustness of the signal recognition system.
[0060] Corresponding to the above method, embodiments of the present invention also disclose a signal recognition network adversarial example defense system based on neural network structure search, the system comprising:
[0061] The hypernetwork construction module is used to construct a heterogeneous hypernetwork search space for radio signal identification tasks with I / Q sequence as input format, which includes multiple subnetwork structures with different network depths, channel numbers and connection modes.
[0062] The adversarial training fusion module is used to integrate adversarial training into the supernetwork training process. In each training iteration, a path is randomly sampled to obtain a subnetwork. Adversarial samples matching the signal energy constraints are generated for the subnetwork, and the shared weights of the supernetwork are updated using the adversarial samples.
[0063] The subnetwork selection module is used to select multiple structurally heterogeneous subnetworks with adversarial robustness from the trained supernetwork, and to build a heterogeneous robust subnetwork library for radio signal identification.
[0064] The dynamic integration defense module is used to randomly select multiple sub-networks from the heterogeneous robust sub-network library for dynamic integration during the signal recognition inference stage, and to use the weighted sum of the outputs of the selected sub-networks as the final signal recognition result.
[0065] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A signal recognition network adversarial example defense method based on neural network structure search, characterized in that, Includes the following steps: Step 1: For the radio signal identification task with I / Q sequence as input format, construct a heterogeneous hypernetwork search space, which includes multiple subnetwork structures with different network depths, number of channels and connection modes. Step 2: Integrate adversarial training into the supernetwork training process. In each training iteration, randomly sample a path to obtain a subnetwork. Generate adversarial samples that match the signal energy constraints for the subnetwork, and use the adversarial samples to update the shared weights of the supernetwork, so that the supernetwork learns robust features for radio signal recognition tasks. Step 3: Select multiple structurally heterogeneous subnetworks with adversarial robustness from the trained supernetwork to construct a heterogeneous robust subnetwork library for radio signal identification; Step 4: In the signal recognition inference stage, multiple sub-networks are randomly selected from the heterogeneous robust sub-network library for dynamic integration, and the weighted sum of the outputs of the selected sub-networks is used as the final signal recognition result.
2. The signal recognition network adversarial example defense method based on neural network structure search according to claim 1, characterized in that, The heterogeneous hypernetwork search space described in step 1 adopts a unit-based directed acyclic graph structure. Each unit contains multiple intermediate nodes, each node corresponds to an intermediate feature map, and each edge corresponds to a candidate operation. The candidate operations include one-dimensional depthwise separable convolution, identity mapping, and zero operation.
3. The signal recognition network adversarial example defense method based on neural network structure search according to claim 2, characterized in that, The heterogeneous hypernetwork search space described in step 1 is configured according to the requirements of signal temporal modeling capability. The temporal modeling capability is controlled by the length and density of temporal connection paths in the subnetwork. Different connection modes determine the path length and density. The connection modes include dense connection mode and sparse connection mode. The sparse connection mode uses identity mapping or zero operation to replace part of the convolution operation to construct short-range temporal connection paths for extracting transient features of the signal. The dense connection mode is used to construct long-range temporal connection paths to capture the sequence dependencies of the signal.
4. The signal recognition network adversarial example defense method based on neural network structure search according to claim 1, characterized in that, The generation of adversarial examples in step 2 is strongly coupled with the sub-network structure of each random sampling. Adversarial examples matching the structure of different sub-networks are generated respectively, so that the supernetwork learns shared feature representations that are robust to different sub-network structures during the alternating optimization process. The generation of the adversarial examples uses Norm constraints counteract the energy magnitude of disturbances to accommodate the physical correlation between disturbance energy and signal-to-noise ratio in radio signals.
5. The signal recognition network adversarial example defense method based on neural network structure search according to claim 1, characterized in that, The shared weight update of the supernetwork in step 2 adopts the stochastic gradient descent method, which only updates the shared weight parameters on the path corresponding to the currently sampled subnetwork, while keeping the weights of other paths unchanged, so that other subnetworks containing the same shared convolutional layer can be updated indirectly.
6. The signal recognition network adversarial example defense method based on neural network structure search according to claim 1, characterized in that, In step 3, when selecting sub-networks, the optimization objective is constructed based on the dual principles of optimal adversarial robustness accuracy and maximum structural diversity. The structural diversity is quantified by calculating the average pairwise distance between the parameter vectors of each sub-network architecture. Sub-networks that have both high adversarial robustness and significant structural differences are selected to form the heterogeneous robust sub-network library.
7. The signal recognition network adversarial example defense method based on neural network structure search according to claim 6, characterized in that, The optimization objective of the screening subnetwork satisfies the following formula: ,in, For the set of candidate subnetworks, For the selected set of subnetworks, For sub-networks The robust accuracy against adversarial attacks For balance coefficient, For subnetwork set The structural diversity measurement function.
8. The signal recognition network adversarial example defense method based on neural network structure search according to claim 7, characterized in that, The structural diversity measurement function satisfies the following formula: ,in, , Let be the architecture parameter vectors of subnetwork i and subnetwork j, respectively. For normalized Euclidean distance, For subnetwork set The number of elements in the middle.
9. The signal recognition network adversarial example defense method based on neural network structure search according to claim 1, characterized in that, In step 4, the number of sub-networks dynamically integrated is a random variable. During each inference, a fixed number or a variable number of sub-networks are randomly selected from the heterogeneous robust sub-network library for integration. The randomness of the integration and combination confuses attackers' estimation of the gradient of the signal recognition network.
10. A signal recognition network adversarial example defense system based on neural network structure search, characterized in that, For implementing the method as described in any one of claims 1-9, the system comprises: The hypernetwork construction module is used to construct a heterogeneous hypernetwork search space for radio signal identification tasks with I / Q sequence as input format, which includes multiple subnetwork structures with different network depths, channel numbers and connection modes. The adversarial training fusion module is used to integrate adversarial training into the supernetwork training process. In each training iteration, a path is randomly sampled to obtain a subnetwork. Adversarial samples matching the signal energy constraints are generated for the subnetwork, and the shared weights of the supernetwork are updated using the adversarial samples. The subnetwork selection module is used to select multiple structurally heterogeneous subnetworks with adversarial robustness from the trained supernetwork, and to build a heterogeneous robust subnetwork library for radio signal identification. The dynamic integration defense module is used to randomly select multiple sub-networks from the heterogeneous robust sub-network library for dynamic integration during the signal recognition inference stage, and to use the weighted sum of the outputs of the selected sub-networks as the final signal recognition result.