Embodied intelligence oriented perception dictionary confusion and security testing method

Abstract

The present application relates to a kind of perception dictionary confusion and security testing method for embodied intelligence, the method first receives natural language instruction and carries out preset semantic trigger detection, while extracting environmental object instance to build initial perception dictionary containing visual features and text label;Then, real target object is parsed and interference object is selected;When meeting semantic trigger condition, the dictionary is dynamically tampered with, the corresponding relationship of real target and interference object is rebinding, and the contaminated text world graph is obtained;Finally, planning action sequence is generated based on the graph, actual interactive object is obtained by executing action, and target hijacking success rate is evaluated accordingly.The present application advances intervention position to intermediate perception dictionary layer, without modifying bottom model parameter, can realize condition controllable hidden target deviation, and provides complete security evaluation closed loop.

Description

Technical Field

[0001] This invention relates to the field of safety testing, robustness assessment and protection verification of embodied intelligent agents, multimodal robots and related intelligent systems, and in particular to a perceptual dictionary confusion and safety testing method for embodied intelligence. Background Technology

[0002] With the rapid development of artificial intelligence and robotics, intelligent systems such as embodied agents, multimodal robots, and digital twin simulation platforms are gradually becoming practical and are widely used in complex and open scenarios such as home services, warehousing and logistics, inspection, and human-machine collaboration. These systems typically rely heavily on deep collaboration between visual perception, semantic understanding, and downstream task planning to complete continuous operational tasks. To ensure the safe deployment and reliable operation of embodied intelligent systems in complex and dynamic environments, comprehensive security testing, robustness assessment, and protection verification are crucial.

[0003] However, existing security assessment schemes for embodied agents generally have significant limitations. Current research mainly focuses on the raw input end or the model inference end, with common methods including visual adversarial examples, cue injection, training data poisoning, or sensor interference. While these methods can affect the final output of the system, they are highly dependent on the input format, specific attack conditions, or specific model structures in practical applications. Furthermore, because the intervention directly affects the outermost raw perception layer, the anomalies they exhibit are often too obvious and easily detected by basic defense mechanisms or perception layer anomaly detection, resulting in a severe lack of stealth and persistence in testing and evaluation methods.

[0004] More critically, existing solutions generally lack systematic risk analysis of the intermediate semantic representation layer of embodied agents. In the actual operation of embodied agents, the system typically needs to first convert the underlying visual perception results into structured object information or textual world states (i.e., a perception dictionary) before using it as input to the downstream large language model planner. Once the key mapping boundary of "visual pixel to text ID, object identifier to task target" dynamically shifts or the target is misbound, even if the output of the outermost original perception layer appears completely normal, the subsequent downstream planning and physical execution stages will be completely misled. Furthermore, existing evaluation metrics are mostly based on recognition accuracy or the effectiveness of a single attack, making it difficult to effectively characterize the transmission impact of structural anomalies in the intermediate state on subsequent multi-step decision-making processes and the cumulative execution harm in continuous tasks under specific task semantic triggering conditions.

[0005] Chinese patent application CN122087810A discloses a method for adversarial prompt purification and semantic perturbation defense against embodied intelligence. This method constructs a jailbreak token lexicon and an embodied intelligence synonym lexicon to define attack characteristics. It then receives user commands, purifies them by removing obvious malicious elements, and standardizes the commands. Furthermore, it applies semantic perturbation defense to the purified commands by replacing words with synonyms. This disrupts the adversarial token sequence while preserving the original semantic intent, thereby reducing the likelihood of jailbreak attacks. This method proactively weakens the effectiveness of jailbreak attacks at the input source, transforming potentially malicious prompts into neutral ones to eliminate hidden or confusing commands while preserving the meaning of the dialogue. However, it is limited to text filtering and perturbation defense at the natural language input end and lacks the ability to intervene in and study the multimodal intermediate structure layer of the embodied intelligence agent's "visual perception-semantic mapping-world graph." Therefore, it cannot reveal or assess the risk of physical action deviation and target hijacking caused by perceptual mapping anomalies. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the existing technology by providing a perceptual dictionary obfuscation and security testing method for embodied intelligence, which is a closed-loop embodied intelligence security testing and robustness evaluation method that addresses deviations from natural language instructions to physical execution.

[0007] The objective of this invention can be achieved through the following technical solutions: A perceptual dictionary obfuscation and security testing method for embodied intelligence includes the following steps: Receive a natural language task instruction, perform semantic parsing on the natural language task instruction, detect whether the natural language task instruction meets the preset semantic triggering conditions, and obtain the semantic triggering detection result; Collect observation data of the current environment, perform object detection, instance segmentation and feature extraction on the observation data to obtain a set of object instances in the scene; Based on the object instance information extracted from the object instance set, an initial perceptual dictionary is established to represent the correspondence between object visual feature representation, text label, semantic category and spatial location; The natural language task instruction is parsed to obtain the real target object, and an object that is different from the real target object is selected from the object instance set as a disturbance object. Based on the semantic trigger detection results, perform corresponding operations to determine the target-aware dictionary: When the semantic trigger detection result is yes, the perceptual dictionary dynamic obfuscation module is started to rebind the correspondence between the real target object and the interference object in the initial perceptual dictionary, dynamically tamper with the initial perceptual dictionary, change the real correspondence between the object visual feature representation and the text label, obtain the obfuscated perceptual dictionary, and use the obfuscated perceptual dictionary as the target perceptual dictionary; When the semantic trigger detection result is negative, the dynamic obfuscation module of the perception dictionary is not activated, the tampering operation of the initial perception dictionary is skipped, the initial perception dictionary remains unchanged, and the initial perception dictionary is used as the target perception dictionary; Based on the target perception dictionary and the spatial location, a target text world map containing entity records is generated; Based on the target text world map and the natural language task instructions, a task execution action sequence is generated. Based on the task execution action sequence, actions are performed on objects in the environment to obtain the actual execution interaction object. Based on the difference between the actual execution interaction object and the real target object, the target hijacking success rate and normal task retention rate of the embodied intelligent agent are evaluated.

[0008] Furthermore, before collecting the observation data of the current environment, the method further includes a step of constructing a preset semantic trigger set. The preset semantic trigger set consists of preset trigger words, which are semantically related to the task scenario to be tested. The natural occurrence frequency of the preset trigger words in the unmodified ordinary task instructions is lower than a preset natural occurrence frequency threshold. The preset trigger words do not directly conflict with the explicit attributes of the category, color, and location of the real target object in the task to be tested. The preset trigger words consist of at least one of keywords, synonyms, polite expressions, contextual qualifiers, and specific sentence templates.

[0009] Further, the step of detecting whether the natural language task instruction meets the preset semantic triggering conditions to obtain the semantic triggering detection result includes: Semantic trigger detection is performed using keyword matching and semantic similarity determination. The preset semantic trigger condition is determined to be met when any of the following conditions are satisfied: The natural language task instruction includes the preset trigger word; The semantic similarity between the natural language task instruction and any element in the preset semantic trigger set is higher than a preset threshold.

[0010] Further, selecting objects from the set of object instances that are different from the real target object as interference objects includes: Obtain the category similarity and attribute similarity between the candidate objects in the object instance set and the real target object; Obtain the spatial proximity between the candidate object and the real target object; A comprehensive scoring function is constructed by weighting and summing the category similarity, attribute similarity, and spatial proximity. The comprehensive score of the candidate object and the real target object is calculated, and the candidate object with the highest comprehensive score is determined as the interference object.

[0011] Further, obtaining the category similarity and attribute similarity between the candidate objects in the object instance set and the real target object includes: Obtain the attribute set and category semantic code of the candidate object and the real target object. The attribute set includes color, shape, size, material and purpose. Calculate the semantic category consistency index between the candidate object and the real target object, the cosine similarity index of the category semantic codes of the candidate object and the real target object, and the intersection-union ratio index of the attribute set; The semantic category consistency index, the cosine similarity index, and the intersection-union ratio index are added together to obtain the sum of the category similarity and the attribute similarity.

[0012] Further, obtaining the spatial proximity between the candidate object and the real target object includes: Obtain the spatial positions of the candidate object and the real target object, and normalize the spatial positions using a preset position normalization function to obtain normalized position variables; The negative exponential mapping value is calculated based on the squared difference of the normalized location variable and the preset spatial distance scale parameter, and the negative exponential mapping value is used as the spatial proximity.

[0013] Furthermore, the step of dynamically modifying the initial perceptual dictionary to change the true correspondence between the object visual feature representation and the text label, resulting in an obfuscated perceptual dictionary, includes: The text labels between the real target object and the interference object are replaced and rebound, so that the interference object corresponds to the text label of the real target object in the obfuscated perceptual dictionary; The correspondence between the real target object and the interference object in the initial perception dictionary is exchanged.

[0014] Further, generating a target text world map containing entity records based on the target perception dictionary and the spatial location includes: The natural language task instructions are parsed to obtain the target description, and the relationship description between objects in the object instance set is obtained. Extract the text tags, semantic categories, spatial locations, and relationship descriptions from the target-aware dictionary; The correspondence between the target description, the object instances in the object instance set, and the spatial location is re-bound as a unified structure to obtain the entity record. The entity record containing the target mapping constitutes the target text world graph.

[0015] Furthermore, the step of generating a sequence of task execution actions based on the polluted text world map and the natural language task instructions includes: Obtain historical action sequences; The current action is generated using a language model based on the natural language task instructions, the historical action sequence, and the target text world graph. The generated current actions are arranged and combined in chronological order to generate the task execution action sequence.

[0016] Furthermore, the step of evaluating the target hijacking success rate and normal task retention rate based on the difference between the actual interactive object and the real target object includes: Obtain the total number of test tasks and the total number of normal tasks that do not meet the preset semantic triggering conditions; The target hijacking success rate is obtained by calculating the proportion of the number of tasks in which the actual interactive object is inconsistent with the real target object to the total number of test tasks. The normal task retention rate is obtained by calculating the proportion of the number of tasks that do not meet the preset semantic triggering conditions and whose actual interactive object is consistent with the real target object to the total number of normal tasks. When the target hijacking success rate is greater than the preset target hijacking success rate threshold and the normal task retention rate is greater than the preset normal task performance lower bound, the target hijacking effect is determined to be effective.

[0017] Compared with the prior art, the present invention has the following beneficial effects: 1. Strong concealment and targeted structure: This is achieved by establishing an "initial perception dictionary" after extracting object instances, and dynamically modifying and rebinding the "real correspondence between object visual feature representation and text label" in the dictionary without modifying the underlying model parameters and original input.

[0018] 2. Avoid continuous exposure of controllable conditions: This is achieved by pre-checking whether the natural language task instructions meet the preset semantic triggering conditions. The dynamic modification of the perception dictionary and target mapping process are only started when the semantic triggering detection result meets the preset conditions, so as to maintain normal operation in ordinary scenarios where the triggering is not triggered.

[0019] 3. Excellent platform adaptability and stable chain transmission: By generating a complete and logically coherent "contaminated text world map" based on the obfuscated perception dictionary, and directly generating a "task execution action sequence" based on the map, the downstream planner can output the action that generates the offset without modifying the internal parameters or inference framework.

[0020] 4. A complete closed loop for assessing the vulnerability of a real system has been formed: by performing physical actions on objects in the environment based on action sequences to obtain the "actual interactive object", and by quantitatively assessing the target hijacking success rate and normal task retention rate based on the physical deviation between the object and the "real target object". Attached Figure Description

[0021] Figure 1 This is a flowchart of the method of the present invention; Figure 2 A kitchen scene illustration of a home service robot. Detailed Implementation

[0022] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0023] Example 1 This embodiment provides a method for perceptual dictionary obfuscation and security testing for embodied intelligence, such as... Figure 1 As shown, the specific steps are as follows: Step 1: Task Instruction Input and Semantic Trigger Detection. The embodied agent receives the natural language task instruction input by the user, performs semantic parsing on the instruction, and checks whether it meets the preset semantic triggering conditions. Let the user-input task instruction be... The preset semantic trigger set is The preset semantic trigger set Trigger words or phrases can be constructed based on the following criteria: they should be semantically relevant to the test task scenario but not directly alter the original task objective; they should have a low natural frequency of occurrence in ordinary task instructions to reduce the probability of false triggering; they should not directly conflict with explicit attributes such as the target object's category, color, or location; and they can be composed of keywords, synonyms, polite expressions, contextual qualifiers, or specific sentence templates. Furthermore, pre-screening can be performed using normal instruction sets and trigger instruction sets, retaining words or phrases with high trigger recognition rates and false trigger rates below a preset threshold as the final triggers. The semantic trigger detection result is defined as: in, This is a semantically triggered detection function. For task instructions entered by the user, For a pre-defined set of semantic triggers, To trigger the judgment result. The semantic trigger detection function can be implemented by keyword matching, semantic similarity judgment, or a combination of both; for example, when the task instruction contains a preset trigger word, or when the task instruction is combined with any trigger. The semantic similarity is higher than a preset threshold At that time, the judgment If the current task instruction meets the semantic triggering condition, the subsequent perceptual dictionary dynamic obfuscation process will be initiated; otherwise, a judgment will be made. The system maintains normal perception and planning processes.

[0024] Step Two: Environmental Observation Acquisition and Object Instance Extraction. The embodied intelligent agent collects observation data of the current environment through cameras, depth sensors, or other front-end sensing devices. This observation data includes visual images, depth images, panoramic segmentation results, and object state information. Let time... Environmental observation for After object detection, instance segmentation, and feature extraction, a set of object instances in the scene is obtained. in, Indicates time The first in the scene One object instance, This indicates the total number of objects in the current scene.

[0025] Step 3: Initial Perception Dictionary Construction. Based on the object instance information extracted in Step 2, an initial perception dictionary is constructed for the current scene to represent the correspondence between object visual entities, text labels, semantic categories, and spatial locations. The initial perception dictionary is defined as follows: in Representation Object Visual features representation, Representation Object The corresponding text tag ID, Representation Object semantic categories, Representation Object Spatial location or location description, This represents the total number of object instances in the current scene. The spatial location... It can be a location description obtained from three-dimensional coordinates, two-dimensional image coordinates, relative orientation, relative distance sorting, or visual positioning algorithms.

[0026] When an embodied intelligent agent is equipped with a depth sensor, the spatial location It can be calculated from the depth localization function: in, Indicates the current depth information. Representation Object Visual features representation, This represents the depth localization function. It should be noted that when the embodied agent is equipped with only a monocular camera, the spatial position... It can be obtained from the center point of the object detection box, the object box size, camera intrinsics, scene priors, visual servoing results, or monocular depth estimation results. For example, the spatial position under monocular camera conditions can be represented as: in, Represents a monocular spatial positioning function. Representation Object Visual features representation, This represents the current monocular image. This represents camera intrinsic parameters or scene constraint information. Since the core of this invention lies in constructing and subsequently rebinding the mapping relationship between object visual entities, text label IDs, and location descriptions, rather than relying on a specific depth measurement method, it can still be implemented in embodied intelligent agent systems with only a monocular camera.

[0027] Step Four: Analysis of Real Target Objects and Selection of Interference Objects. (This refers to the task instructions.) Perform target semantic parsing to obtain the real target object required for the task. Let the parsed real target object be... Its corresponding text tag ID is The target parsing process can be expressed as: in, For the target analytic function, For the initial perception dictionary, This represents the current monocular image. To obtain the actual target object through parsing, This refers to the text tag ID corresponding to the actual target object obtained through parsing. Further, within the current environment object set... Select an object that is different from the real target object as the interference object, denoted as . Its corresponding text tag ID is denoted as ,satisfy: The interference targets can be selected randomly or using a comprehensive scoring method based on category or attribute similarity and spatial proximity. Preferably, candidate targets are defined. With the real target object The comprehensive scoring function between them is: in, Indicates category or attribute similarity. To obtain the actual target object through parsing, As a candidate, Indicates spatial proximity. and Let be the weight parameters, and satisfy: Category or attribute similarity can be further represented as: in, and These represent the semantic categories of the candidate object and the actual target object, respectively. To obtain the actual target object through parsing, As a candidate, This is an indicator function; it takes a value of 1 if the categories are the same, and a value of 0 otherwise. Represents the category semantic encoding function, Indicates cosine similarity; and Each attribute set represents a candidate object and a real target object, and the attribute includes at least one of color, shape, size, material, or purpose; To prevent constants with a denominator of zero; Let be the weight parameters, and satisfy: Spatial proximity can be further expressed as: in, and These represent the spatial locations of the candidate object and the actual target object, respectively. To obtain the actual target object through parsing, As a candidate, This represents the position normalization function. This represents a spatial distance scale parameter. When the spatial location is in three-dimensional coordinates... It can represent normalized 3D coordinates; when the system only has monocular vision input, It can represent the center point, relative orientation, or monocular depth estimation position of the normalized target detection box.

[0028] Ultimately, the target of interference was determined based on the principle of maximizing the overall score: in, To obtain the actual target object through parsing, As a candidate.

[0029] Its corresponding text tag ID is: in, Representation Object The corresponding text tag ID. Using the above method, the system prioritizes objects that are similar to the real target object in category, attribute, or spatial location as interference objects, thus making the subsequent perceptual dictionary dynamic obfuscation process highly covert and executable in terms of environmental semantics.

[0030] Step 5: Dynamic obfuscation of the perceptual dictionary. When the semantic trigger detection result in Step 1 satisfies... At that time, the dynamic obfuscation module of the perception dictionary is activated to obfuscate the initial perception dictionary. Dynamically modify the dictionary to obtain the obfuscated perceptual dictionary: in, For the perceptual dictionary obfuscation function, To obfuscate rule parameters, For the confused perception dictionary, To obtain the actual target object through parsing, The target of interference is the perceptual dictionary. In practical systems, modifying the perceptual dictionary does not require changing the network structure or model parameters of the underlying perceptual model. Instead, after the underlying perceptual model outputs object detection, instance segmentation, or feature extraction results, the mapping relationship between object visual features, text label IDs, and spatial locations is intercepted and rebound through a perceptual result post-processor, middleware interface, object instance cache table, or world map input adapter. The dynamic obfuscation includes at least one of the following methods: First, the text label IDs between the real target object and the interference object are replaced or rebound so that the interference object corresponds to the label of the real target in the perception dictionary, which can be represented as: in, Indicate the visual characteristics of the interfering object; Secondly, by exchanging the index relationships between the real target object and the interference object in the perceptual dictionary, it can be represented as follows: in, Indicate the visual characteristics of the interfering object. The text tag ID corresponding to the interference object; Third, the confused perceptual dictionary is uniformly represented as in or in, Indicates time Confusion-based perceptual dictionary; Indicates time The total number of object instances in the current scene; Represents the index of an object instance; Indicates the first Visual feature representation of an object instance; Indicates the first after dynamic obfuscation The text tag ID bound to the object; Indicates confusion before the first The original text label ID of the object; Indicates the first The semantic category of an object instance; Indicates the first The spatial location or location description of an object instance.

[0031] Furthermore, and These represent the visual features and text label IDs of the actual target object, respectively. and Represent the visual features and text label ID of the interfering object, respectively; conditions This indicates the interference object corresponding to the current dictionary item, and the condition. This indicates that the current dictionary entry corresponds to the real target object; the first segmentation definition is used to rebind the interference object to the real target label, and the second segmentation definition is used to swap the label bindings of the real target object and the interference object.

[0032] Through the above obfuscation operation, the true correspondence between visual entities and text labels is altered, causing the subsequent planning module to perform inference based on the incorrect target mapping, and the obfuscated perception dictionary is then used. As a target-aware dictionary.

[0033] When the semantic trigger detection result in step one does not meet the preset semantic trigger condition, i.e. If the perceptual dictionary dynamic obfuscation module is not activated, the system skips the dictionary tampering operation in this step and maintains the initial perceptual dictionary. The initial perceptual dictionary remains unchanged and is not confused. As a target-aware dictionary.

[0034] Step Six: Pollution World Map Generation. Based on the target perception dictionary and object spatial positioning information determined in the previous steps, a target text world map is generated for use by the planner. Specifically defined as: when At that time, based on the confused perceptual dictionary In addition to object spatial location information, a polluted text world map is generated for use by the planner, defined as: in, This represents the world map generation function. For the confused perception dictionary, Represents a set of object locations. This represents the world map of the text after it has been contaminated.

[0035] when At that time, based on the unconfused initial perceptual dictionary In addition to object spatial location information, a polluted text world map is generated for use by the planner, defined as: in, This represents the world map generation function. For the initial perception dictionary, Represents a set of object locations. Represents a normal text world map.

[0036] Any entity record in the text world graph can be represented as... in, This represents the text tag ID bound in the target-aware dictionary. Represents the semantic category of an object. Indicates the spatial location of an object. This describes the relationships between objects. Because when... At that time, the target label in the world map has been bound to the wrong object, so although the environmental state representation obtained by the planner is formally complete, its internal target orientation has been corrupted; and when At that time, its internal target orientation remains true and correct.

[0037] Step Seven: Task Planning Based on the Text World Graph. The text world graph generated in Step Six is ​​input into the language model planner of the embodied agent. The planner combines the user's task instructions and historical action sequences to generate the current action. The planning strategy is represented as follows: in, This refers to the task planning strategy of an embodied intelligent agent. Indicates the planner parameters, Indicates user task commands, Represents the world graph of the input text. Represents a historical sequence of actions. Indicates time The output action.

[0038] when At that time, because the input world map has been contaminated, the planner outputs normal actions in form, but misjudges the interfering object as the target object at the execution level; when At this point, the planner performs normal planning actions for the real target based on the correct world map. This ultimately yields the sequence of task execution actions. in, This indicates the total number of steps in the task execution. Step 8: Target hijacking execution and effect evaluation. The embodied agent executes the action sequence... Perform actions such as grabbing, moving, approaching, interacting with, manipulating, or placing objects in the environment. Let the actual object to be interacted with be... The actual object performing the interaction is When satisfied When a target hijacking occurs in the current task, it is determined that a hijacking has taken place. To quantify the target hijacking effect of the method of this invention, a target hijacking success rate is defined as... in, This indicates the total number of test tasks. Indicates the first The actual object executing in each task, Indicates the first The real target object in each task The indicator function is defined as follows: To evaluate the impact of the method of this invention on the ability to perform normal tasks, the normal task retention rate is defined as... in, This represents the total number of normal tasks that did not trigger semantic triggers. Indicates the first The actual object executing in each task, Indicates the first The real target object in each task. Further, the optimization objective of the method of this invention can be expressed as: improving the success rate of target hijacking while ensuring that the performance of normal task execution does not decrease significantly, i.e. in, This is a preset lower bound for normal task performance. In the experimental embodiment, this lower bound for normal task performance... It can be set to 0.9, which is the normal task retention rate when the semantic trigger is not triggered. No less than 90%; in scenarios with high security requirements, It can also be set to 0.95. Furthermore, a threshold for the effectiveness of the target hijacking can be set. When the success rate of target hijacking At that time, the target offset effect in this group of experiments was determined to be effective, among which It can be set to 0.7 or 0.8. Therefore, the evaluation conditions in the experiment of this invention can be expressed as: in, The threshold for the success rate of the target hijacking. This represents the lower bound of normal task performance.

[0039] Example 2 This embodiment provides a detailed description of the specific applications of the above embodiments, such as... Figure 2 As shown, the specific steps are as follows: In the first phase, the embodied agent receives the user's natural language task instruction, "Please bring the red cup to the table. Thank you!", and performs semantic parsing and trigger detection on the instruction. Here, "red cup" is the target description, and "thank you!" is a preset semantic trigger word. When the detection result meets the trigger condition, the subsequent perceptual dictionary dynamic obfuscation process is initiated.

[0040] In the second stage, the system constructs an initial perception dictionary based on environmental observation results, identifies objects in the scene such as a red mug, a red condiment jar, a blue water glass, and a white plate, and establishes a correspondence between object visual features, text labels, and object IDs. At this stage, the red mug is the real target object, and the red condiment jar is a distraction object.

[0041] In the third stage, when the semantic trigger word is activated, the system dynamically obfuscates the initial perception dictionary, causing the target description "red cup" to be incorrectly bound to the object instance corresponding to the red condiment jar, generating an obfuscated perception dictionary, and further forming a pollution world map.

[0042] In the fourth stage, the planning module performs motion planning based on the contaminated world map, interpreting the location of the red condiment jar as the target object location, thereby generating a grasping action for the incorrect object, ultimately causing the robot to actually grasp the red condiment jar, while the real target object is still the red mug.

[0043] This solution is applicable to embodied intelligent systems that rely on visual perception results to construct a world map and make planning decisions based on natural language instructions. It can be used for safety testing, robustness assessment, and protection verification in scenarios such as home service robots.

[0044] The rest is the same as in Example 1.

[0045] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A perceptual dictionary obfuscation and security testing method for embodied intelligence, characterized in that, Includes the following steps: Receive a natural language task instruction, perform semantic parsing on the natural language task instruction, detect whether the natural language task instruction meets the preset semantic triggering conditions, and obtain the semantic triggering detection result; Collect observation data of the current environment, perform object detection, instance segmentation and feature extraction on the observation data to obtain a set of object instances in the scene; Based on the object instance information extracted from the object instance set, an initial perceptual dictionary is established to represent the correspondence between object visual feature representation, text label, semantic category and spatial location; The natural language task instruction is parsed to obtain the real target object, and an object that is different from the real target object is selected from the object instance set as a disturbance object. Based on the semantic trigger detection results, perform corresponding operations to determine the target-aware dictionary: When the semantic trigger detection result is yes, the perceptual dictionary dynamic obfuscation module is started to rebind the correspondence between the real target object and the interference object in the initial perceptual dictionary, dynamically tamper with the initial perceptual dictionary, change the real correspondence between the object visual feature representation and the text label, obtain the obfuscated perceptual dictionary, and use the obfuscated perceptual dictionary as the target perceptual dictionary; When the semantic trigger detection result is negative, the dynamic obfuscation module of the perception dictionary is not activated, the tampering operation of the initial perception dictionary is skipped, the initial perception dictionary remains unchanged, and the initial perception dictionary is used as the target perception dictionary; Based on the target perception dictionary and the spatial location, a target text world map containing entity records is generated; Based on the target text world map and the natural language task instructions, a task execution action sequence is generated. Based on the task execution action sequence, actions are performed on objects in the environment to obtain the actual execution interaction object. Based on the difference between the actual execution interaction object and the real target object, the target hijacking success rate and normal task retention rate of the embodied intelligent agent are evaluated.

2. The method for perceptual dictionary obfuscation and security testing for embodied intelligence according to claim 1, characterized in that, Before collecting observation data of the current environment, the method further includes a step of constructing a preset semantic trigger set. The preset semantic trigger set consists of preset trigger words. The preset trigger words are semantically related to the task scenario to be tested, and the natural occurrence frequency of the preset trigger words in the unmodified ordinary task instructions is lower than a preset natural occurrence frequency threshold. The preset trigger words do not directly conflict with the explicit attributes of the category, color, and location of the real target object in the task to be tested. The preset trigger words consist of at least one of keywords, synonyms, polite expressions, contextual qualifiers, and specific sentence templates.

3. The method for perceptual dictionary obfuscation and security testing for embodied intelligence according to claim 2, characterized in that, The step of detecting whether the natural language task instruction meets the preset semantic triggering conditions and obtaining the semantic triggering detection result includes: Semantic trigger detection is performed using keyword matching and semantic similarity determination. The preset semantic trigger condition is determined to be met when any of the following conditions are satisfied: The natural language task instruction includes the preset trigger word; The semantic similarity between the natural language task instruction and any element in the preset semantic trigger set is higher than a preset threshold.

4. The method for perceptual dictionary obfuscation and security testing for embodied intelligence according to claim 1, characterized in that, The step of selecting objects from the object instance set that are different from the real target object as interference objects includes: Obtain the category similarity and attribute similarity between the candidate objects in the object instance set and the real target object; Obtain the spatial proximity between the candidate object and the real target object; A comprehensive scoring function is constructed by weighting and summing the category similarity, attribute similarity, and spatial proximity. The comprehensive score of the candidate object and the real target object is calculated, and the candidate object with the highest comprehensive score is determined as the interference object.

5. The method for perceptual dictionary obfuscation and security testing for embodied intelligence according to claim 4, characterized in that, The step of obtaining the category similarity and attribute similarity between the candidate objects in the object instance set and the real target object includes: Obtain the attribute set and category semantic code of the candidate object and the real target object. The attribute set includes color, shape, size, material and purpose. Calculate the semantic category consistency index between the candidate object and the real target object, the cosine similarity index of the category semantic codes of the candidate object and the real target object, and the intersection-union ratio index of the attribute set; The semantic category consistency index, the cosine similarity index, and the intersection-union ratio index are added together to obtain the sum of the category similarity and the attribute similarity.

6. The method for perceptual dictionary obfuscation and security testing for embodied intelligence according to claim 4, characterized in that, The step of obtaining the spatial proximity between the candidate object and the real target object includes: Obtain the spatial positions of the candidate object and the real target object, and normalize the spatial positions using a preset position normalization function to obtain normalized position variables; The negative exponential mapping value is calculated based on the squared difference of the normalized location variable and the preset spatial distance scale parameter, and the negative exponential mapping value is used as the spatial proximity.

7. The method for perceptual dictionary obfuscation and security testing for embodied intelligence according to claim 1, characterized in that, The step of dynamically modifying the initial perceptual dictionary to change the true correspondence between the object visual feature representation and the text label, resulting in an obfuscated perceptual dictionary, includes: The text labels between the real target object and the interference object are replaced and rebound, so that the interference object corresponds to the text label of the real target object in the obfuscated perceptual dictionary; The correspondence between the real target object and the interference object in the initial perception dictionary is exchanged.

8. The method for perceptual dictionary obfuscation and security testing for embodied intelligence according to claim 1, characterized in that, The step of generating a target text world map containing entity records based on the target perception dictionary and the spatial location includes: The natural language task instructions are parsed to obtain the target description, and the relationship description between objects in the object instance set is obtained. Extract the text tags, semantic categories, spatial locations, and relationship descriptions from the target-aware dictionary; The correspondence between the target description, the object instances in the object instance set, and the spatial location is re-bound as a unified structure to obtain the entity record. The entity record containing the target mapping constitutes the target text world graph.

9. A perceptual dictionary obfuscation and security testing method for embodied intelligence according to claim 1, characterized in that, The generation of the task execution action sequence based on the target text world map and the natural language task instructions includes: Obtain historical action sequences; The current action is generated using a language model based on the natural language task instructions, the historical action sequence, and the target text world graph. The generated current actions are arranged and combined in chronological order to generate the task execution action sequence.

10. A perceptual dictionary obfuscation and security testing method for embodied intelligence according to claim 1, characterized in that, The assessment of the target hijacking success rate and normal task retention rate based on the difference between the actual interactive object and the real target object includes: Obtain the total number of test tasks and the total number of normal tasks that do not meet the preset semantic triggering conditions; The target hijacking success rate is obtained by calculating the proportion of the number of tasks in which the actual interactive object is inconsistent with the real target object to the total number of test tasks. The normal task retention rate is obtained by calculating the proportion of the number of tasks that do not meet the preset semantic triggering conditions and whose actual interactive object is consistent with the real target object to the total number of normal tasks. When the target hijacking success rate is greater than the preset target hijacking success rate threshold and the normal task retention rate is greater than the preset normal task performance lower bound, the target hijacking effect is determined to be effective.

Images