A defense method, device and electronic equipment for visual language navigation

Abstract

The application provides a defense method and device for visual language navigation and an electronic device. The method comprises: in each decision step of an agent performing a visual navigation task, acquiring an environment panoramic image currently collected by the agent and a currently received instruction; extracting hidden state features and global perception features of the environment panoramic image, and judging whether the agent is in an attacked state based on the global perception features; if it is judged that the agent is in the attacked state, correcting the hidden state features, and taking the corrected hidden state features as decision features; so that the agent obtains a planned path and an action probability distribution based on the decision features; double checking the instruction, and blocking the action output of the agent in the current decision step if any checking fails; in the case that the checking passes, calculating an action entropy value of the action probability distribution, and blocking the action output of the agent in the current decision step when a change of the action entropy value meets a preset abnormal condition.

Description

Technical Field

[0001] This invention relates to the field of embodied intelligent security technology, specifically to a defense method, device, and electronic device for visual language navigation. Background Technology

[0002] Vision-Language Navigation (VLN) requires embodied agents to map natural language commands to continuous action sequences through cross-modal reasoning in a multimodal environment. As the complexity of navigation tasks increases, VLN models become more dependent on the environment and commands, thus facing serious backdoor attack threats: attackers can manipulate embodied agents under specific spatiotemporal conditions by injecting malicious data with specific triggers.

[0003] Related defenses primarily attempt to transfer methods from static tasks to navigation models, such as modifying the loss function during training or using model pruning and parameter cleanup techniques to remove neurons that might be associated with backdoors. While such methods are effective in static tasks, experimental results show that these transferred defenses are significantly inadequate against attacks on navigation tasks that possess spatiotemporal stealth capabilities.

[0004] First, it lacks the ability to dynamically perceive temporal features. VLN navigation models are based on long-term temporal decisions with continuous inputs, and backdoor triggers may be hidden in consecutive image frames or instruction text. Since related methods mainly suppress backdoors during the training phase and do not establish real-time monitoring of neuron activation during the inference process, it is difficult to capture abnormal features in a timely manner, resulting in insufficient detection capabilities.

[0005] Secondly, there is a lack of consistency verification between physical constraints and semantic logic. Embodied navigation tasks are subject to dual constraints between the embodied agent's displacement trajectory and the content of the instruction description. For example, the number of steps should maintain a reasonable correspondence with the amount of information contained in the instruction. However, related defense measures usually process visual signals or text instructions independently, lacking verification of movement efficiency, instruction complexity, and the correlation between instructions and environmental common sense. This makes it difficult for the system to identify abnormal attacks that violate normal logic, thus leading to navigation task failure. Summary of the Invention

[0006] In view of this, this application proposes a defense method, device, and electronic device for visual language navigation. Specifically, this application is implemented through the following technical solution:

[0007] According to a first aspect of the embodiments of this specification, a defense method for visual language navigation is provided, the method comprising the following steps:

[0008] Step S1: In each decision step of the intelligent agent performing the visual navigation task, acquire the currently collected panoramic image of the environment and the currently received instructions;

[0009] Step S2: Extract the hidden state features and global perception features of the panoramic environmental image, and determine whether the agent is under attack based on the global perception features.

[0010] Step S3: If the state is determined to be under attack, the hidden state features are corrected and the corrected hidden state features are used as decision features; if the state is determined to be not under attack, the hidden state features are used as decision features; so as to drive the agent to perform path prediction and action prediction based on the decision features, and obtain the planned path and action probability distribution corresponding to the current decision step.

[0011] Step S4: Based on the planned path, the instruction is verified for trajectory efficiency and semantic rationality. If either verification fails, the action output of the agent in the current decision step is blocked.

[0012] Step S5: If the verification is successful, calculate the action entropy value of the action probability distribution. When the change of the action entropy value meets the preset abnormal conditions, block the action output of the agent in the current decision step.

[0013] According to a second aspect of the embodiments of this specification, a defense device for visual language navigation is provided, the device comprising:

[0014] The data acquisition unit is used to acquire the currently collected panoramic image of the environment and the currently received instructions of the intelligent agent at each decision step in the execution of the visual navigation task;

[0015] An attack detection unit is used to extract hidden state features from the panoramic image of the environment and aggregate the hidden state features in terms of spatial dimensions to obtain global perception features, and to determine whether the agent is under attack based on the global perception features.

[0016] The feature repair unit is used to correct the hidden state features if the state is determined to be under attack, and use the corrected hidden state features as decision features; if the state is determined to be not under attack, the hidden state features are used as decision features; so as to drive the agent to perform path prediction and action prediction based on the decision features to obtain the planned path and action probability distribution.

[0017] The logical verification unit is used to perform trajectory efficiency verification and semantic rationality verification on the instruction based on the planned path. If any verification fails, the action output of the agent in the current decision step is blocked.

[0018] The entropy monitoring unit is used to calculate the action entropy value of the action probability distribution when the verification is passed, and to block the action output of the agent in the current decision step when the change of the action entropy value meets the preset abnormal conditions.

[0019] According to a third aspect of the embodiments of this specification, an electronic device is provided, comprising: a processor; and a computer-readable storage medium storing computer program instructions that, when executed by the processor, cause the processor to perform the method as described in the first aspect.

[0020] The embodiments of this application have at least the following technical effects:

[0021] First, this application embodiment constructs a four-stage collaborative defense architecture consisting of a perception layer, a repair layer, a logic layer, and a decision layer. This enables the agent's security defense to possess multi-level correlation and collaborative optimization capabilities. Specifically, the perception layer identifies abnormal information in the environment, the repair layer repairs abnormal features, the logic layer performs consistency verification by combining physical trajectory constraints and semantic common sense, and the decision layer monitors the decision state using changes in action entropy values. Thus, this application embodiment effectively solves the problem of insufficient attack identification and defense capabilities caused by the lack of dynamic perception of temporal serialization features in traditional methods, and significantly improves the navigation robustness of the agent in an attacked environment.

[0022] Second, by establishing a feature monitoring mechanism, the embodiments of this application can capture hidden state anomalies induced by abnormal samples in real time and trigger feature repair. This mechanism not only significantly improves the recognition accuracy of abnormal inputs, but also enhances the defense capability and environmental perception stability of the intelligent agent in the attacked environment through feature repair, ensuring that the intelligent agent can continuously perform navigation tasks and maintain decision reliability.

[0023] Third, in the consistency verification stage, this application embodiment introduces a joint verification of trajectory efficiency and semantic rationality, enabling the intelligent agent to autonomously verify the legality of the command based on physical common sense. This verification method solves the problem of intercepting abnormal commands caused by the traditional VLN model ignoring physical environment limitations, making the judgment of abnormal situations more realistic, thereby improving the scenario adaptability of the navigation system.

[0024] Fourth, the embodiments of this application capture abnormal manipulation behavior by quantifying the probability distribution evolution in the decision-making process of the VLN model and using the instantaneous change of action entropy. This provides a micro-level security guarantee on the basis of logical consistency verification, which can effectively identify hidden abnormal manipulation behavior and significantly reduce the risk of navigation tasks being maliciously misled. Attached Figure Description

[0025] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Some specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings in an exemplary and non-limiting manner. The same reference numerals in the drawings indicate the same or similar parts or components. Those skilled in the art should understand that these drawings are not necessarily drawn to scale. In the drawings:

[0026] Figure 1 This is a flowchart illustrating a defense method for visual language navigation according to an exemplary embodiment of this application;

[0027] Figure 2 This is a schematic diagram of a layered defense process of a defense system according to an exemplary embodiment of this application;

[0028] Figure 3 This is a schematic diagram of the structure of a defense system shown in an exemplary embodiment of this application;

[0029] Figure 4 This is a block diagram illustrating an electronic device according to an exemplary embodiment of this application;

[0030] Figure 5 This is a block diagram illustrating a defense device for visual language navigation according to an exemplary embodiment of this application. Detailed Implementation

[0031] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0032] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0033] The embodiments described in this specification will now be described in detail.

[0034] This application provides a defense method for visual language navigation. This defense method can be executed by a defense system, which can be deployed on an intelligent agent or in the cloud.

[0035] Figure 1 This is a flowchart illustrating a defense method for visual language navigation according to an exemplary embodiment of this application, as shown below. Figure 1 As shown, the defense method includes the following steps:

[0036] Step S1: In each decision step of the agent's visual navigation task, acquire the panoramic image of the environment currently collected by the agent and the currently received instructions.

[0037] Step S2: Extract the hidden state features of the panoramic environmental image and aggregate the spatial dimensions of the hidden state features to obtain global perception features. Based on the global perception features, determine whether the agent is in an attacked state.

[0038] This embodiment uses a neural network model to extract features from panoramic environmental images. The hidden state features of the intermediate hidden layers of the neural network can capture both high-level semantic information and retain some local structural information, meaning that the hidden state features can more sensitively reflect hidden attack perturbations. Therefore, this embodiment constructs global perception features based on hidden state features for anomaly detection, rather than based on the input or output layer features of the neural network model, thus improving the accuracy of attack detection.

[0039] It is worth noting that the agent's own VLN model also generates hidden state features, but because the VLN model can be attacked, the hidden state features generated by this VLN model are unreliable. Furthermore, the agent's VLN model typically does not provide hidden state features externally. Therefore, the defense system in this embodiment extracts the correct hidden state features based on the panoramic environmental image.

[0040] Step S3: If the state is determined to be under attack, the hidden state features are corrected and the corrected hidden state features are used as decision features; if the state is determined to be not under attack, the hidden state features are used as decision features; so as to drive the agent to perform path prediction and action prediction based on the decision features, and obtain the planned path and action probability distribution corresponding to the current decision step.

[0041] The action probability distribution is the set of probability values ​​output by the agent for each candidate action. A candidate action refers to the set of actions the agent can possibly choose in the current decision step, such as moving forward, turning left, turning right, or stopping. The agent's VLN model outputs a probability value for each candidate action through the decision model, and constructs an action probability distribution based on the probability value of each candidate action. The agent then samples the candidate action with the highest probability from the action probability distribution or randomly samples a candidate action as the decision action for the current decision step.

[0042] Step S4: Based on the planned path, the instruction is verified for trajectory efficiency and semantic rationality. If either verification fails, the action output of the agent in the current decision step is blocked.

[0043] Step S5: If the verification is successful, calculate the action entropy value of the action probability distribution. When the change of the action entropy value meets the preset abnormal conditions, block the action output of the agent in the current decision step.

[0044] Among them, "verification passed" means that the instruction passes both trajectory efficiency verification and semantic rationality verification at the same time; the change in action entropy value meets the preset abnormal conditions, which means that the action entropy value of the current decision step is lower than the action entropy value of the previous decision step, and the absolute value of the difference between the action entropy value of the current decision step and the action entropy value of the previous decision step is greater than the preset sensitivity threshold, which is set to [0.3-0.7] for example.

[0045] like Figure 1 As can be seen from the defense method shown, the embodiments of this application first determine whether the agent is under attack by extracting global perception features from the panoramic image of the environment, and correct the hidden state features in the attack state, thereby restoring the agent's environmental perception ability without modifying the original VLN model parameters. This allows the VLN model to predict paths and actions based on the corrected or original hidden state features, obtain the planned path and action probability distribution, and then verify the current command based on trajectory efficiency and command semantic rationality, effectively filtering malicious commands that violate navigation physical constraints or common sense logic. At the same time, if the command verification passes, the entropy value change of the action probability distribution is further monitored. When the entropy value changes abnormally, the current action output is blocked. This forms a phased collaborative defense at the feature layer, logic layer and decision layer, significantly improving the robustness of the agent against backdoor attacks and abnormal manipulation and the security of task execution in visual language navigation tasks.

[0046] In some embodiments, such as Figure 2As shown, this defense system can detect and defend against attacks in visual language navigation tasks through a pre-built defense model, which includes a perception layer, a repair layer, a logic layer, and a decision layer. The system comprises the following layers: The perception layer acquires the current panoramic image of the environment and the currently received instructions at each decision step, extracts hidden state features and global perception features from the panoramic image, and determines whether the agent is under attack based on the global perception features; the repair layer corrects the hidden state features when the agent is under attack and uses the corrected hidden state features as the decision features of the VLN model, and directly uses the hidden state features as the decision features of the VLN model when the agent is not under attack, enabling the VLN model to perform path prediction and action prediction based on the decision features, thus obtaining the planned path and action probability distribution; the logic layer verifies the trajectory efficiency and semantic rationality of the instructions based on the planned path output by the VLN model, and blocks the agent from executing the current action if either verification fails; the decision layer further calculates the action entropy value of the action probability distribution when the instruction verification passes, and blocks the current action output when the change in the action entropy value meets a preset abnormal condition.

[0047] Next, combined Figure 3 Provide a detailed description of the attack detection and defense process of this defense system.

[0048] First, perform step S1 to acquire data.

[0049] This step obtains the panoramic image of the environment currently collected by the agent through a preset data interface. and currently received instructions .

[0050] Then, step S2 is performed to achieve attack detection.

[0051] This step constructs a neural network-based visual detector at the perception layer as the first line of defense in the defense system, which identifies potential interference or backdoor attacks by monitoring panoramic images of the environment collected by the intelligent agent.

[0052] In some embodiments, globally perceived features are obtained through the following steps:

[0053] A visual encoder is used to extract features from the panoramic environmental image. The visual encoder includes at least an intermediate hidden layer and a feature aggregation layer.

[0054] The hidden state features of the panoramic environmental image are obtained through the intermediate hidden layer; and the global perception features are obtained by spatial dimension aggregation of the hidden state features through the feature aggregation layer.

[0055] In some embodiments, the following steps are used to determine whether the agent is under attack:

[0056] The global perception features are input into a trained binary classification neural network, and the binary classification neural network outputs an anomaly probability value.

[0057] The abnormal probability value is compared with a preset threshold. If the abnormal probability value is greater than the threshold, it is determined to be in an attacked state; otherwise, it is determined to be in an unattacked state.

[0058] This embodiment utilizes a visual detector comprising a visual encoder and a binary classification neural network. The visual encoder can be constructed using a Transformer architecture neural network, comprising a projection layer, intermediate hidden layers, and a feature aggregation layer. The projection layer maps the panoramic image of the environment onto the visual detector's interpretable space, and the intermediate hidden layers extract hidden state features. B represents the batch size, N represents the sequence length, and 2048 represents the feature representation dimension of the intermediate hidden layer and the hidden state features. It is a high-dimensional array containing 2048 numerical elements, which collectively represent the fusion features of visual and semantic information in the current panoramic image. Then, a feature aggregation layer performs spatial dimension aggregation processing on the high-dimensional hidden state features to eliminate redundant information in the spatiotemporal sequence and highlight anomalous perturbations. The feature aggregation layer aggregates the hidden state features... By performing mean pooling or information geometry transformation, the original representation is compressed into globally representative globally perceived features. This global awareness feature The expression is as follows:

[0059] (1)

[0060] in, Indicates the first The hidden state features of each decision step, where Pool(⋅) represents the aggregation operation, for example, using mean pooling.

[0061] In obtaining global awareness features Then, it is fed into a pre-trained lightweight binary classification neural network, which can output anomaly probability values ​​based on global perception features. This network is exemplarily composed of a multilayer perceptron (MLP) and outputs anomaly probability values ​​through a sigmoid function. :

[0062] (2)

[0063] in, Represents the Sigmoid activation function. This represents the pre-defined linear transformation weight matrix in a binary classification neural network; This represents the bias term parameters in a binary classification neural network. This represents a modified linear unit activation function, used to introduce nonlinear feature processing capabilities. This represents the probability value of an anomaly.

[0064] When the anomaly probability value exceeds a preset threshold, the agent's VLN model is determined to be under attack. This defense system immediately cuts off the execution path of the original decision instructions and addresses the high-dimensional hidden state features. Online repair is performed. For example, the preset threshold is 0.5. This embodiment does not limit the specific value of the threshold, and those skilled in the art can set it flexibly.

[0065] Next, step S3 is performed to predict paths and actions based on reliable decision features.

[0066] This step primarily focuses on online repair of abnormal signals intercepted by the perception layer. Without altering the core parameters of the original VLN model, corrective patches are synthesized in real time to perform feature compensation on the interfered data stream, thereby restoring the repaired features to the current environment.

[0067] This step receives the hidden state feature from step S2. Locating via reverse index By identifying data dimensions where activation values ​​significantly deviate from the normal range, we can pinpoint the key neuron set affected by environmental interference signals and maliciously induced commands.

[0068] In some embodiments, correcting the hidden state features specifically includes:

[0069] The hidden state features are input into the trained patch synthesis network, and the patch synthesis network outputs correction features.

[0070] The residuals of the correction feature and the hidden state feature are added together to obtain the corrected hidden state feature.

[0071] In some potential application scenarios, lightweight neural networks can be used to construct patch synthesis networks to incorporate hidden state features. Input the patched synthesis network and calculate the correction features through nonlinear mapping. :

[0072] (3)

[0073] in, This represents the first layer mapping weight matrix of the patch synthesis network. This represents the second-layer mapping weight matrix; and These are the bias parameters for the corresponding levels; This represents a non-linear activation function.

[0074] In practical applications, the training objective of the patch synthesis network is determined by the following combined loss function. Constraints are specifically designed to learn the nonlinear relationship between attacked characteristics and security compensation amounts:

[0075] (4)

[0076] in, This is a repair term used to force the compensated feature distribution to revert to the safety attribute space of normal navigation. ; This is a regularization term used to constrain the magnitude of the compensation increment, ensuring that while correcting the bias, it preserves as much value as possible. The original environmental semantic information.

[0077] This defense system uses residual addition to calculate the correction features. Inject the original data path and reconstruct the corrected hidden state features. :

[0078] (5)

[0079] This embodiment is processed by logical hedging. Its dimensions and Maintaining consistency facilitates decision-making.

[0080] It is worth noting that in this embodiment, regardless of whether the perception layer detects an anomaly, the feature vector at the current moment ( or All flows to the decision engine of the VLN model. In the VLN model, a large language model like Flan-T5-XL can be used to build the decision engine, which then synchronously drives the generation of navigation paths. With candidate actions :

[0081] (6)

[0082] in, The weight matrix represents the decision engine. The representative enters the decision feature, and its value selection logic is as follows:

[0083] If step S1 determines that the agent has not been attacked, then = ;

[0084] If step S1 determines that the agent is under attack, then = .

[0085] Next, step S4 is executed to perform double verification on the instruction.

[0086] The dual verification in this step includes verification of physical laws and semantic common sense. The physical law verification specifically refers to trajectory efficiency verification, while the semantic common sense verification refers to semantic rationality verification.

[0087] In some embodiments, trajectory efficiency verification includes:

[0088] Trajectory efficiency verification is performed based on the normalized instruction path efficiency ratio, the expression for which is:

[0089] (7)

[0090] in, Let be the instruction path efficiency ratio for the i-th decision step. , For the instruction of the i-th decision step, The number of lexical units in the instruction. Let be the planned path length for the i-th decision step, ( , ) represents the mean and standard deviation of the instruction path efficiency ratio in the navigation instruction set of the intelligent agent.

[0091] This embodiment performs preliminary verification of commands based on the principle of physical consistency. The complexity of commands in normal navigation should be proportional to the length of the physical path; that is, a long command with a short path is abnormal. Therefore, this embodiment first calculates the command-path efficiency ratio corresponding to the current command and then uses statistical methods to perform a significance test on this ratio to obtain a normalized command-path efficiency ratio. Trajectory efficiency verification is then performed based on this normalized command-path efficiency ratio, improving the accuracy of the verification.

[0092] In some embodiments, semantic reasonableness verification includes:

[0093] The instructions are encoded into semantic vectors using a semantic encoder;

[0094] Based on the panoramic image of the environment, obtain the spatial common sense anchor point vector corresponding to the current environment;

[0095] Calculate the similarity between the semantic vector and the spatial common sense anchor vector, and perform semantic rationality verification based on the similarity.

[0096] This embodiment utilizes environmental common-sense constraints to perform deep verification of instruction logic. In order to intercept more covert attack injections that circumvent trajectory efficiency verification, this defense system achieves filtering by quantifying the alignment between instruction content and indoor spatial layout.

[0097] First, using a semantic encoder Convert text instruction I into a high-dimensional semantic vector. For example, the instruction text can be mapped to a high-dimensional vector space, such as 768-dimensional, and then the spatial commonsense anchor vector corresponding to the current environment can be queried. By calculating the cosine similarity between the two To assess whether the content of the instruction conforms to common sense in space:

[0098] (8)

[0099] In practical applications, an environmental knowledge base can be pre-created, which includes spatial commonsense anchor vectors corresponding to various environmental types. When this defense system performs semantic rationality verification, it determines the current environmental type based on the current panoramic image and retrieves the corresponding spatial commonsense anchor vectors from this knowledge base.

[0100] Accordingly, the following steps are used to determine whether the verification passes:

[0101] The normalized instruction path efficiency ratio is compared with a preset significance threshold. If the normalized instruction path efficiency ratio is greater than the significance threshold, the verification fails.

[0102] The similarity is compared with a preset similarity threshold. If the similarity is less than the similarity threshold, the verification fails.

[0103] For example, the significance threshold is 3.0 and the similarity threshold is 0.15. Of course, those skilled in the art can also set the significance threshold to a larger value or the similarity threshold to a smaller value.

[0104] Finally, step S5 is performed to monitor the action entropy value.

[0105] This defense system performs real-time monitoring of the action probability distribution output by the agent in the action space at the micro level in order to counter covert attacks that circumvent double verification.

[0106] First, calculate the entropy value of the decision action at each decision step. During the agent's navigation task, for each decision step... Obtain panoramic images based on the current environment. With instructions The probability distribution of actions is used to calculate the probability distribution of each decision step. Corresponding action entropy value :

[0107] (9)

[0108] in, This represents the total number of possible actions for the current decision step. For the first One candidate action, In the In the decision-making step, given a panoramic image of the current environment and instructions In this case, choose an action The probability of.

[0109] Then, by analyzing the temporal distribution of action entropy values, the system identifies whether a sudden change in the decision state occurs. Under normal conditions, the VLN model weighs multiple candidate actions, maintaining a high level of action entropy. Once a malicious instruction is activated, the VLN model will forcibly lock onto the malicious action, causing a sudden change in the decision state.

[0110] Therefore, this embodiment detects the change in entropy between adjacent decision steps. :

[0111] (10)

[0112] in This is the preset sensitivity threshold.

[0113] If the entropy value of the current action significantly decreases compared to the previous decision step and is lower than... If the VLN model is determined to have entered an abnormal locked state, this defense system will immediately trigger the interception mechanism to forcibly cut off the current action output of the VLN model, thereby achieving micro-level monitoring of covert backdoor attack behavior.

[0114] Figure 4 This is a schematic diagram of an electronic device illustrated in this specification according to an exemplary embodiment. Please refer to... Figure 4 At the hardware level, the device includes a processor 410, an internal bus 420, a network interface 430, memory 440, a hardware acceleration device 450, and non-volatile memory 460, and may also include other hardware required for its functions. One or more embodiments of this application can be implemented in software, for example, the processor 410 reads the corresponding computer program from the non-volatile memory 460 into the memory 440 and then runs it. Of course, in addition to software implementation, one or more embodiments of this application do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the above processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0115] Figure 5 This is a structural block diagram illustrating an exemplary embodiment of a defense device for visual language navigation, which can be applied to, for example... Figure 4 The electronic device shown implements the technical solution of this application. The defense device includes: a data acquisition unit 510, an attack detection unit 520, a feature repair unit 530, a logic verification unit 540, and an entropy monitoring unit 550, wherein:

[0116] The data acquisition unit 510 is used to acquire the currently collected panoramic image of the environment and the currently received instructions in each decision step of the intelligent agent performing the visual navigation task;

[0117] The attack detection unit 520 is used to extract the hidden state features of the panoramic image of the environment and perform spatial dimension aggregation on the hidden state features to obtain global perception features, and determine whether the agent is in an attacked state based on the global perception features.

[0118] The feature repair unit 530 is used to correct the hidden state features if the state is determined to be under attack, and use the corrected hidden state features as decision features; if the state is determined to be not under attack, the hidden state features are used as decision features; so as to drive the agent to perform path prediction and action prediction based on the decision features, and obtain the planned path and action probability distribution corresponding to the current decision step.

[0119] The logic verification unit 540 is used to perform trajectory efficiency verification and semantic rationality verification on the instruction based on the planned path. If any verification fails, the action output of the intelligent agent in the current decision step is blocked.

[0120] The entropy monitoring unit 550 is used to calculate the action entropy value of the action probability distribution when the verification is passed, and to block the action output of the agent in the current decision step when the change of the action entropy value meets the preset abnormal conditions.

[0121] In some embodiments, the attack detection unit 520 is used to input the globally perceived features into a trained binary classification neural network, the binary classification neural network outputting an anomaly probability value; compare the anomaly probability value with a preset threshold, and if the anomaly probability value is greater than the threshold, it is determined to be in an attacked state, otherwise it is determined to be in an unattacked state.

[0122] In some embodiments, the feature repair unit 530 is used to input the visual feature vector into the trained patch synthesis network, the patch synthesis network outputs the correction feature; and add the correction feature to the hidden state feature by residual addition to obtain the correction hidden state feature.

[0123] In some embodiments, the logic verification unit 540 is configured to compare the normalized instruction path efficiency ratio with a preset saliency threshold, and if the normalized instruction path efficiency ratio is greater than the saliency threshold, the verification fails; and to compare the similarity with a preset similarity threshold, and if the similarity is less than the similarity threshold, the verification fails.

[0124] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0125] Accordingly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the methods described in any of the above embodiments.

[0126] Accordingly, embodiments of this application also provide a computer program product configured to perform the methods described in any of the above embodiments.

[0127] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0128] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0129] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0130] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0131] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0132] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0133] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0134] It should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0135] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A defense method for visual language navigation, characterized in that, The method includes the following steps: Step S1: In each decision step of the intelligent agent performing the visual navigation task, acquire the currently collected panoramic image of the environment and the currently received instructions; Step S2: Extract the hidden state features of the panoramic environmental image and aggregate the spatial dimensions of the hidden state features to obtain global perception features. Based on the global perception features, determine whether the agent is in an attacked state. Step S3: If the state is determined to be under attack, the hidden state features are corrected and the corrected hidden state features are used as decision features; if the state is determined to be not under attack, the hidden state features are used as decision features; so as to drive the agent to perform path prediction and action prediction based on the decision features, and obtain the planned path and action probability distribution corresponding to the current decision step. Step S4: Based on the planned path, the instruction is verified for trajectory efficiency and semantic rationality. If either verification fails, the action output of the agent in the current decision step is blocked. Step S5: If the verification is successful, calculate the action entropy value of the action probability distribution. When the change of the action entropy value meets the preset abnormal conditions, block the action output of the agent in the current decision step.

2. The method according to claim 1, characterized in that, The globally perceived features in step S2 are obtained through the following steps: A visual encoder is used to extract features from the panoramic environmental image. The visual encoder includes at least an intermediate hidden layer and a feature aggregation layer. The hidden state features of the panoramic environmental image are obtained through the intermediate hidden layer; and the global perception features are obtained by spatial dimension aggregation of the hidden state features through the feature aggregation layer.

3. The method according to claim 1, characterized in that, In step S2, it is determined whether the agent is under attack through the following steps: The global perception features are input into a trained binary classification neural network, and the binary classification neural network outputs an anomaly probability value. The abnormal probability value is compared with a preset threshold. If the abnormal probability value is greater than the threshold, it is determined to be in an attacked state; otherwise, it is determined to be in an unattacked state.

4. The method according to claim 1, characterized in that, Step S3 corrects the hidden state features, including: The hidden state features are input into the trained patch synthesis network, and the patch synthesis network outputs correction features. The residuals of the correction feature and the hidden state feature are added together to obtain the corrected hidden state feature.

5. The method according to claim 1, characterized in that, The trajectory efficiency verification in step S4 includes: Trajectory efficiency verification is performed based on the normalized instruction path efficiency ratio, the expression for which is: ； in, Let be the instruction path efficiency ratio for the i-th decision step. , For the instruction of the i-th decision step, The number of lexical units in the instruction. Let be the planned path length for the i-th decision step, ( , ) represents the mean and standard deviation of the instruction path efficiency ratio in the navigation instruction set of the intelligent agent.

6. The method according to claim 5, characterized in that, The semantic reasonableness verification in step S4 includes: The instructions are encoded into semantic vectors using a semantic encoder; Based on the panoramic image of the environment, obtain the spatial common sense anchor point vector corresponding to the current environment; Calculate the similarity between the semantic vector and the spatial common sense anchor vector, and perform semantic rationality verification based on the similarity.

7. The method according to claim 6, characterized in that, Step S4 determines whether the verification passes by following steps: The normalized instruction path efficiency ratio is compared with a preset significance threshold. If the normalized instruction path efficiency ratio is greater than the significance threshold, the verification fails. The similarity is compared with a preset similarity threshold. If the similarity is less than the similarity threshold, the verification fails.

8. The method according to claim 1, characterized in that, In step S5, the change in the action entropy value satisfies the preset abnormal condition, which means: The action entropy value of the current decision step is lower than that of the previous decision step, and the absolute value of the difference between the action entropy value of the current decision step and that of the previous decision step is greater than the preset sensitivity threshold.

9. A defense device for visual language navigation, characterized in that, The device includes: The data acquisition unit is used to acquire the currently collected panoramic image of the environment and the currently received instructions of the intelligent agent at each decision step in the execution of the visual navigation task; An attack detection unit is used to extract hidden state features from the panoramic image of the environment and aggregate the hidden state features in terms of spatial dimensions to obtain global perception features, and to determine whether the agent is under attack based on the global perception features. The feature repair unit is used to correct the hidden state features if the state is determined to be under attack, and use the corrected hidden state features as decision features; if the state is determined to be not under attack, the hidden state features are used as decision features; so as to drive the agent to perform path prediction and action prediction based on the decision features to obtain the planned path and action probability distribution. The logical verification unit is used to perform trajectory efficiency verification and semantic rationality verification on the instruction based on the planned path. If any verification fails, the action output of the agent in the current decision step is blocked. The entropy monitoring unit is used to calculate the action entropy value of the action probability distribution when the verification is passed, and to block the action output of the agent in the current decision step when the change of the action entropy value meets the preset abnormal conditions.

10. An electronic device, characterized in that, include: processor; as well as A computer-readable storage medium storing computer program instructions that, when executed by the processor, cause the processor to perform the method as described in any one of claims 1 to 8.

Images