Power internet of things ai model behavior whole-process security auditing method

Abstract

The application discloses a power Internet of Things AI model behavior whole-process security auditing method, which firstly fuses the natural high-frequency random micro-disturbance in the transformer power frequency signal with the inherent response matrix of the acquisition chip at the physical level, generates an internal physical fingerprint with spatiotemporal uniqueness, and embeds the background noise in the digitized sensing data tensor, so that the physical watermark and the business data are integrally bound at the bit level, then drives the edge AI model to automatically construct an audit log carrying a physical anti-fake mark in the inference whole process, finally realizes physical traceability determination through reverse checking of the chip response matrix, and performs Merkle tree hash chain solidification on the trusted log. In this way, the security blind area of the forged data bypassing the integrity check under the pure digital signature scheme is fundamentally eliminated, and the problem of excessive consumption of edge resources and time sequence break caused by communication instantaneous interruption is effectively avoided.

Description

Technical Field

[0001] This application relates to the field of auditing, and more specifically, to a method for full-process security auditing of the behavior of AI models in the power Internet of Things. Background Technology

[0002] With the deep deployment of the power Internet of Things (IoT) in scenarios such as intelligent substation inspection, load forecasting, and fault diagnosis, edge AI models are increasingly taking on real-time decision-making functions. The correctness of their reasoning behavior directly affects the safety of power grid operation and the reliability of power supply. However, the reasoning process of AI models is highly nonlinear and has black-box characteristics. Once a misjudgment occurs—for example, misidentifying a normal operating condition as a fault and triggering protection tripping—maintenance personnel often find it difficult to quickly determine the root cause of the anomaly afterward, whether it stems from tampered input data, drifting model parameters, or inherent defects in the decision-making logic. This lack of transparency and traceability makes the power industry have a rigid demand for full-process security audits of AI model behavior. There is an urgent need to establish an immutable audit link covering all stages from data collection and model reasoning to result output to meet the safety and compliance regulatory requirements of the power system.

[0003] Existing AI auditing solutions for the power IoT typically employ a technical approach of recording structured logs at each stage of model inference and then using blockchain or trusted timestamps for evidence preservation and solidification. The recorded content includes input data hashes, model versions and hyperparameters, intermediate layer activation features, and final output confidence levels. While these solutions have made some progress in audit integrity, they suffer from fundamental technical flaws in preventing data tampering at the physical data source. Specifically, existing solutions rely solely on high-frequency on-chain storage for quantifying the features at each layer of the audit log. When edge nodes face real-world conditions such as intermittent communication network outages or limited storage resources, the high-frequency on-chain mechanism will experience significant delays or even data loss, leading to temporal breaks in the audit chain. Furthermore, the recorded data itself lacks an intrinsic binding relationship with the physical acquisition hardware. Simple digital signatures or hash verification cannot prove that the data truly originates from a specific physical sensor channel and is not a forged stream injected by humans. Attackers can bypass purely digital integrity checks by constructing fake sensor data that conforms to specific formats, rendering the audit records unable to be physically traced.

[0004] Therefore, we look forward to an optimized method for full-process security auditing of the behavior of AI models in the power Internet of Things. Summary of the Invention

[0005] To address the aforementioned technical issues, this application provides a method for full-process security auditing of the behavior of AI models in the power Internet of Things.

[0006] According to one aspect of this application, a method for full-process security auditing of the behavior of an AI model in the power Internet of Things is provided, comprising: Step 1: Extract high-frequency random micro-perturbation sequence from transformer power frequency analog signal, and perform physical-level fusion of high-frequency random micro-perturbation sequence with the inherent response matrix of analog-to-digital converter chip to obtain spatiotemporal endogenous physical fingerprint vector; Step 2: The spatiotemporal endogenous physical fingerprint vector is embedded as the background noise into the reference tensor of the transformer power frequency analog signal after digital quantization to obtain the transformer feature tensor with embedded physical watermark. Step 3: Input the embedded physical watermark transformer feature tensor into the edge-end power anomaly detection model to construct the edge AI full-process anti-counterfeiting audit log to obtain the anti-counterfeiting full-process audit log package; Step 4: Based on the inherent response matrix of the analog-to-digital converter chip, perform spatiotemporal physical anti-counterfeiting watermark separation and credibility verification on the anti-counterfeiting full-process audit log package to obtain the Boolean value of physical traceability credibility. Step 5: Based on the Boolean value of physical traceability credibility, the anti-counterfeiting full-process audit log package is conditionally diverted. When it is determined to be credible, the hash digest of the anti-counterfeiting full-process audit log package is calculated and a Merkle tree is constructed to solidify the root node hash certificate on the chain.

[0007] Compared with existing technologies, this application provides a full-process security audit method for the behavior of an AI model in the power Internet of Things. First, it physically fuses the naturally occurring high-frequency random micro-perturbations in the transformer's power frequency signal with the inherent response matrix of the acquisition chip, generating an intrinsic physical fingerprint with spatiotemporal uniqueness. This fingerprint is then embedded as background noise into the digitized sensor data tensor, enabling an inseparable, integrated binding of the physical watermark and business data at the bit level. Subsequently, it drives the edge AI model to automatically construct audit logs carrying physical anti-counterfeiting tags throughout the inference process. Finally, it achieves physical traceability determination through reverse verification of the chip's response matrix and performs Merkle tree hashing on the trusted logs for on-chain solidification. This fundamentally eliminates the security blind spot of forged data bypassing integrity verification under pure digital signature schemes. Furthermore, by placing the on-chain evidence storage step after physical trust verification, it effectively avoids excessive consumption of edge resources due to high-frequency on-chain data storage and timing breaks caused by communication interruptions. Attached Figure Description

[0008] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0009] Figure 1 This is a flowchart of a full-process security audit method for the behavior of an AI model in the power Internet of Things according to an embodiment of this application; Figure 2 This is a data flow diagram illustrating the full-process security audit method for the behavior of an AI model in the power Internet of Things according to an embodiment of this application. Figure 3 This is a flowchart of step two in the power IoT AI model behavior full-process security audit method according to an embodiment of this application; Figure 4 This is a flowchart of step four in the power Internet of Things AI model behavior full-process security audit method according to an embodiment of this application. Detailed Implementation

[0010] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0011] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0012] While this application makes various references to certain modules of the systems according to embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The modules described are merely illustrative, and different aspects of the systems and methods may use different modules.

[0013] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0014] The technical solution of this application proposes a method for full-process security audit of the behavior of AI models in the power Internet of Things. Figure 1 This is a flowchart of a method for full-process security auditing of the behavior of an AI model in the power Internet of Things according to an embodiment of this application. Figure 2 This is a system architecture diagram of the power IoT AI model behavior full-process security audit method according to an embodiment of this application. Figure 1 and Figure 2As shown, the power IoT AI model behavior full-process security audit method according to an embodiment of this application includes the following steps: S1, extracting a high-frequency random micro-perturbation sequence from the transformer power frequency analog signal, and performing physical-level fusion of the high-frequency random micro-perturbation sequence with the inherent response matrix of the analog-to-digital converter chip to obtain a spatiotemporal endogenous physical fingerprint vector; S2, embedding the spatiotemporal endogenous physical fingerprint vector as background noise into the digitally quantized reference tensor of the transformer power frequency analog signal to obtain an embedded physical watermark transformer feature tensor; S3, inputting the embedded physical watermark transformer feature tensor into... The edge-end power anomaly detection model is used to construct edge AI full-process anti-counterfeiting audit logs to obtain an anti-counterfeiting full-process audit log package; S4, based on the inherent response matrix of the analog-to-digital converter chip, the spatiotemporal physical anti-counterfeiting watermark of the anti-counterfeiting full-process audit log package is separated and verified to obtain a physical traceability credibility boolean value; S5, based on the physical traceability credibility boolean value, the anti-counterfeiting full-process audit log package is subjected to conditional diversion processing, wherein, when it is determined to be credible, the hash digest of the anti-counterfeiting full-process audit log package is calculated and a Merkle tree is constructed to solidify the root node hash certificate on the chain.

[0015] Specifically, in step S1, a high-frequency random micro-perturbation sequence is extracted from the transformer's power frequency analog signal, and the high-frequency random micro-perturbation sequence is physically fused with the inherent response matrix of the analog-to-digital converter chip to obtain a spatiotemporal endogenous physical fingerprint vector. It should be understood that in the full-process security audit scenario of the AI ​​model at the edge of the power Internet of Things, the credibility of the audit link lies in whether it can be physically proven that the sensor data indeed originates from a specific physical acquisition channel, rather than a forged data stream artificially injected by an attacker. Existing solutions use pure digital signatures or hash verification methods to protect the integrity of the acquired data, but these methods can only verify whether the data has been modified during transmission and storage, and cannot answer the core credibility question of whether the data truly originates from the target physical device. Attackers are fully capable of constructing compliant, hash-consistent fake sensor data to bypass the pure digital layer integrity verification. Therefore, in the technical solution of this application, high-frequency random micro-perturbations determined by the instantaneous physical environment of the power grid are extracted from the transformer's power frequency analog signal, and this is fused with the physically non-clonable inherent response characteristics of the analog-to-digital converter chip to generate a spatiotemporal endogenous physical fingerprint vector that simultaneously binds the time-varying environment of the power grid and the manufacturing deviation of the acquisition hardware. The fingerprint vector is spatiotemporally unique—its time-varying component is determined by the physical topology of the power system at a specific moment, and its static component is determined by the non-replicable process deviations during chip manufacturing—thus providing a physically unforgeable traceability anchor for subsequent audit logs.

[0016] In practice, firstly, a front-end RC high-pass filter network is used to perform fundamental notch suppression and window function discretization sampling on the transformer's power frequency analog signal to obtain a high-frequency random micro-perturbation sequence. The transformer's power frequency analog signal includes instantaneous three-phase voltage signals, instantaneous three-phase current signals, and zero-sequence component signals. These signals, at the physical level, carry the high-frequency micro-perturbation components generated by the superposition of factors such as line impedance characteristics, transformer winding distributed capacitance, and random fluctuations in system load during power system operation. However, the power frequency fundamental wave (50Hz) and its lower harmonics dominate the signal energy, and the high-frequency random micro-perturbations are submerged beneath the fundamental wave components and difficult to extract directly. Therefore, an RC high-pass filter network is set at the front end of the analog-to-digital converter. This network consists of a passive high-pass filter topology composed of resistors and capacitors, with its cutoff frequency set higher than the power frequency fundamental wave and its main harmonic frequency bands. This notch suppression attenuates the 50Hz fundamental wave and lower harmonic components to a negligible level, allowing only high-frequency random micro-perturbation components above the cutoff frequency to pass through. After fundamental notch filtering, the analog signal retains only the high-frequency random fluctuation components determined by the instantaneous physical environment of the power grid. A window function is then applied to truncate the analog signal in the time domain to suppress spectral leakage. Discretization sampling is then performed under the constraints of the window function, converting the continuous-time high-frequency analog disturbance into a discrete-time sequence. After the aforementioned fundamental notch filtering and window function discretization sampling processes, a high-frequency random micro-disturbance sequence is finally obtained. The amplitude of each sampling point in this sequence is determined by the instantaneous physical state of the power system at that sampling moment, exhibiting unpredictability and non-repeatability. Specifically, the transformer power frequency analog signal is first filtered by a high-pass filter to remove the fundamental and low-order harmonic components, resulting in a continuous signal containing only high-frequency disturbances. Then, at each discrete sampling moment, the instantaneous amplitude of this signal is multiplied by the corresponding window function coefficient to obtain the values ​​of each sampling point in the high-frequency random micro-disturbance sequence.

[0017] Furthermore, a physical-level hardware fingerprint fusion is performed on the high-frequency random micro-perturbation sequence and the one-dimensional physical response sequence obtained by row-wise flattening of the intrinsic response matrix of the analog-to-digital converter (ADC) chip to obtain a spatiotemporal endogenous physical fingerprint vector. The intrinsic response matrix of the ADC chip is a two-dimensional matrix composed of the physically non-clonable response characteristics formed by process deviations during chip manufacturing. Each row of this matrix corresponds to the intrinsic response value of different quantization channels within the chip under specific excitation conditions. Its numerical characteristics are determined by microscopic physical factors such as semiconductor doping concentration fluctuations, oxide layer thickness differences, and threshold voltage shifts, possessing chip-specific uniqueness and non-replicability. To enable this two-dimensional matrix to be fused element-wise with the one-dimensional high-frequency random micro-perturbation sequence in the same dimensional space, firstly, a row-major-order flattening operation is performed on the intrinsic response matrix of the ADC chip. That is, the elements of the first row of the matrix are arranged sequentially, followed by the elements of the second row, and so on until the last row, thereby reducing the two-dimensional matrix to a one-dimensional physical response sequence. Specifically, for a two-dimensional matrix with N rows and M columns, the element at the i-th position in the flattened one-dimensional sequence corresponds to the element in the (i-th row divided by M)-th column (i-th modulo M) of the original matrix. The total length of the flattened sequence is equal to the product of N and M. Through this row-major flattening operation, a two-dimensional response matrix with N rows and M columns is transformed into a one-dimensional physical response sequence with a length of N multiplied by M.

[0018] After dimensional alignment, a bit-by-bit XOR operation is performed on the high-frequency random micro-perturbation sequence and the row-flattened one-dimensional physical response sequence to achieve physical-level hardware fingerprint fusion. XOR is a bitwise logic operation; for two input bits, the output is 1 if and only if they are different, and 0 if they are the same. Here, XOR can losslessly mix each bit of two independent information sources at the bit level, ensuring that each bit in the fusion result depends simultaneously on both the time-varying components of the power grid environment and the inherent static components of the hardware. A change in either will lead to a global change in the fusion result, thus guaranteeing the dual-source binding characteristic of the fused fingerprint. Simultaneously, XOR has a self-reversible algebraic property, meaning that XORing the fusion result again with the same operand can accurately reconstruct the other operand. This property provides the mathematical basis for the physical source tracing verification in the subsequent step four. A bitwise XOR operation is performed on the high-frequency random micro-perturbation sequence and the one-dimensional physical response sequence. This means that the value at the i-th position in the spatiotemporal endogenous physical fingerprint vector is equal to the result of XORing the bit value at the i-th position of the high-frequency random micro-perturbation sequence with the bit value at the i-th position of the one-dimensional physical response sequence. This operation iterates through all bits from position 0 to position N (M minus 1). After this bitwise XOR fusion operation, the resulting spatiotemporal endogenous physical fingerprint vector is a one-dimensional vector of length N (M). The value of each bit is determined by both the instantaneous high-frequency micro-perturbation of the power grid and the inherent physical response of the chip, naturally possessing spatiotemporal uniqueness and physical unforgeability.

[0019] Specifically, in step S2, the spatiotemporal endogenous physical fingerprint vector is embedded as background noise into the reference tensor of the digitally quantized transformer power frequency analog signal to obtain an embedded physical watermark transformer feature tensor. It should be understood that if the fingerprint vector is transmitted and stored merely as independent metadata accompanying the sensor data, an attacker could potentially strip and replace the fingerprint vector with the sensor data during the data flow through the edge AI model inference link, i.e., using forged sensor data paired with the original fingerprint to pass subsequent verification, thus rendering the physical tracing mechanism ineffective. Therefore, in the technical solution of this application, the spatiotemporal endogenous physical fingerprint vector is embedded as background noise into the least significant bit of the reference tensor of the digitally quantized transformer power frequency analog signal, enabling the physical watermark and business data to be indivisibly and integrally bound at the bit level. This embedding method has two advantages: First, the modification of the least significant bit has a negligible impact on the numerical precision of the digital quantization value and will not interfere with the normal reasoning and judgment of the transformer's operating status by the subsequent edge AI model; Second, the physical watermark and business data are integrated in the same tensor structure, and any tampering with the business data will simultaneously destroy the embedded watermark information, and any forgery of the watermark requires precise matching of the bit structure of the business data, thereby building a self-verifying anti-tampering mechanism at the data level.

[0020] Figure 3 This is a flowchart of step two in the power IoT AI model behavior full-process security audit method according to an embodiment of this application. Figure 3 As shown, S2 includes: S21, discretizing and digitally quantizing the transformer power frequency analog signal to obtain a digital quantization reference tensor; S22, performing least significant bit masking operation and watermark embedding on the digital quantization reference tensor and the spatiotemporal endogenous physical fingerprint vector to obtain an embedded physical watermark transformer feature tensor.

[0021] Specifically, in step S21, the transformer power frequency analog signal is discretized and digitally quantized to obtain a digital quantization reference tensor. Discretization sampling refers to taking values ​​at equal intervals from the continuous-time domain analog signal according to a fixed sampling period, converting the continuous signal into a discrete-time sequence. Each sampling point corresponds to the instantaneous amplitude of the analog signal at a specific moment. Digital quantization mapping refers to mapping the analog amplitude obtained from the discrete sampling into a finite-width digital code value through an analog-to-digital converter chip. This involves dividing the continuous amplitude space into a finite number of quantization intervals, each interval corresponding to a unique digital code, thereby converting the analog quantity into a digital quantity.

[0022] In this process, firstly, the analog-to-digital converter (ADC) chip divides the full-scale range of the analog signal evenly into a corresponding number of quantization levels (16 bits corresponds to 65536 quantization levels) according to its quantization bit width (e.g., 16 bits). Each analog amplitude obtained from discrete sampling is mapped to the nearest quantization level and assigned the corresponding binary code value. Specifically, for each signal channel in the transformer power frequency analog signal, at each discrete sampling moment, the ADC chip multiplies the ratio of the analog voltage amplitude at that moment to the full-scale reference voltage by the maximum number of quantization levels, and then rounds to obtain the digital quantized value of that sampling point. Furthermore, since the transformer power frequency analog signal contains multiple signal channels (instantaneous three-phase voltage signals, instantaneous three-phase current signals, and zero-sequence component signals), and each channel contains multiple discrete sampling points within a sampling window, the digital quantized values ​​of all channels together constitute a two-dimensional data structure, with one dimension being the number of signal channels and the other dimension being the number of sampling points per channel. Organizing this two-dimensional data structure into a tensor form yields the digital quantization reference tensor. The number of rows in this tensor is equal to the total number of signal channels (i.e., three channels for three-phase voltage, three channels for three-phase current, and one channel for zero-sequence component, for a total of seven channels), and the number of columns is equal to the number of discrete sampling points per channel within a sampling window. Each element in the tensor is a digitally quantized integer value with a fixed bit width.

[0023] Specifically, in step S22, least significant bit masking and watermark embedding are performed on the digital quantization reference tensor and the spatiotemporal endogenous physical fingerprint vector to obtain an embedded physical watermark transformer feature tensor. In this process, firstly, a bitwise AND operation is performed between each digital quantization value in the digital quantization reference tensor and a mask value. The binary representation of this mask value is such that all bits except the least significant bit are 1, thereby forcibly setting the least significant bit of the original digital quantization value to zero while keeping the other bits unchanged. Specifically, the calculation logic of the least significant bit masking operation is expressed as follows:

[0024] in, Indicates the first Road passage No. The digital quantized value after clearing the least significant bit of each sample point. Represents the original digital quantization value. This indicates a bitwise AND logical operation. This represents the mask value obtained by performing a bitwise inversion on the integer 1 (i.e., the least significant bit in the binary representation is 0 and all other bits are 1). This is the equivalent decimal representation of the mask value. Indicates the quantization bit width.

[0025] After clearing the least significant bit, the bits of the spatiotemporal endogenous physical fingerprint vector are written one by one into the cleared least significant bit position. Since the digital quantization reference tensor is a two-dimensional structure (number of channels multiplied by number of sampling points), and the spatiotemporal endogenous physical fingerprint vector is a one-dimensional sequence, the two-dimensional tensor is flattened into a one-dimensional sequence in row-major order and then mapped bit-by-bit with the fingerprint vector, or equivalently, each bit value of the fingerprint vector is written into the least significant bit of each element of the tensor in row-major order. Specifically, the digital quantization value after clearing the least significant bit is bitwise ORed with the corresponding bit value (0 or 1) in the spatiotemporal endogenous physical fingerprint vector. The result of the bitwise OR operation is that the fingerprint bit value is directly assigned to the least significant bit of that element—if the fingerprint bit is 1, the least significant bit becomes 1; if the fingerprint bit is 0, the least significant bit remains 0. The calculation logic for watermark embedding is expressed as follows:

[0026] in, Indicates the first Road passage No. The digital quantized value of each sampling point after watermark embedding. This indicates a bitwise OR logical operation. This represents the bit value corresponding to the position of this tensor element in the spatiotemporal endogenous physical fingerprint vector (where... (This is a one-dimensional index flattened in row-major order). Indicates the channel index. Indicates the sampling point index. This indicates the number of sampling points per channel.

[0027] After performing the least significant bit masking operation and writing the watermark bits on all elements of the digital quantization reference tensor, all the watermarked digital quantization values ​​are reorganized into a two-dimensional tensor structure with the same dimensions as the original reference tensor, thus obtaining the embedded physical watermark transformer feature tensor. The construction logic of this tensor is expressed as follows:

[0028] in, This represents the feature tensor of the embedded physical watermark transformer, whose dimensions are completely identical to those of the digital quantization reference tensor. OK The feature tensor, however, replaces the least significant bit of each element with the corresponding bit value in the spatiotemporal endogenous physical fingerprint vector. The maximum deviation of this feature tensor from the original baseline tensor in numerical precision does not exceed a quantization step of one least significant bit, and its impact on the inference accuracy of subsequent AI models is negligible. Furthermore, the physical traceability watermark is indivisibly encoded into each data sampling point at the bit structure level.

[0029] Specifically, in S3, the embedded physical watermark transformer feature tensor is input into the edge-end power anomaly detection model to construct the edge AI full-process anti-counterfeiting audit log to obtain the anti-counterfeiting full-process audit log package. It should be understood that the embedded physical watermark transformer feature tensor simultaneously carries business data information and physical traceability watermark information at the bit structure level. However, the core objective of the full-process security audit of the power IoT AI model behavior is not only to ensure the credibility of the input data source, but also to cover the complete link from data input, model inference process to result output, so that when an anomaly occurs, the audit system can trace back the entire process along the timeline to quickly locate whether the input data has been tampered with, the model has drifted, or there is a defect in the decision logic. Specifically, during the operation of the AI ​​application, it is necessary to automatically record immutable logs, including the hash value and source of the input data, the model version number and key hyperparameters, the activation values ​​of intermediate layer features (after desensitization processing), the final output result and confidence level, and the manual review opinions and handling actions. Therefore, in the technical solution of this application, the transformer feature tensor with embedded physical watermark is used as input to drive the deep neural network for edge-end power anomaly detection to perform inference operations. During the inference process, the activation state feature matrix of the intermediate layer and the output vector of the equipment anomaly diagnosis decision are captured simultaneously. The input tensor, intermediate layer features, and output vector are then serialized and concatenated at the byte level to construct a full-process audit log package carrying a physical anti-counterfeiting watermark. The key feature of this log package is that its input data layer has an embedded physical watermark, and the intermediate layer features and output results are directly driven by the watermarked input. There is an unforgeable causal reasoning chain among the three, and attackers cannot tamper with the data in any part of the log package without destroying the consistency of the physical watermark.

[0030] In practice, the first step is to import the embedded physical watermark transformer feature tensor into the edge-end power anomaly detection deep neural network to obtain the intermediate layer activation state feature matrix and the equipment anomaly diagnosis decision output vector. The edge-end power anomaly detection deep neural network is a deep learning model deployed on the edge computing nodes of the power Internet of Things. Its function is to perform real-time diagnosis of the transformer's operating status and determine whether there are any anomalies in the current operating conditions (such as insulation degradation, overload, inter-turn short circuits, etc.). This deep neural network consists of multiple cascaded computational layers, including an input layer, several hidden layers (intermediate layers), and an output layer. Data enters from the input layer and sequentially undergoes nonlinear transformations and feature extraction in each hidden layer, finally generating diagnostic decision results from the output layer.

[0031] In this process, the feature tensor of the embedded physical watermark transformer is input into the input layer of the deep neural network. The network performs forward inference operations on the input tensor according to its trained weight parameters and network architecture. During forward inference, the input tensor is sequentially processed by linear transformations and nonlinear activation functions of each hidden layer, and the output of each layer is the activation state feature of that layer. Furthermore, to achieve traceability of the intermediate process for full-process auditing, representative intermediate layers (such as the bottleneck layer or key feature extraction layer of the network) are selected during the inference process, and their activation outputs are captured as audit records to obtain the intermediate layer activation state feature matrix. This matrix records the intermediate states of the deep neural network in abstracting and representing the input data during the inference process, and its value is jointly determined by the input data and network weights. Since the input data has an embedded physical watermark, the intermediate layer activation features are causally inextricably linked to the physical watermark.

[0032] After capturing intermediate layer features, the forward inference process continues through subsequent layers until it reaches the output layer. The output layer performs a linear transformation on the activation output of the last hidden layer it receives, and then maps the original output value into a probability distribution form through a normalized exponential function, which is the equipment anomaly diagnosis decision output vector. Each output dimension in this vector corresponds to a type of equipment operating state (such as normal operation, insulation degradation, overload, inter-turn short circuit, etc.), and the output value of each dimension represents the confidence level of the model in determining that the current input belongs to that state category.

[0033] Furthermore, tensor serialization and byte-level concatenation are performed on the embedded physical watermark transformer feature tensor, the intermediate layer activation state feature matrix, and the equipment anomaly diagnosis decision output vector to obtain the anti-counterfeiting full-process audit log package. In this process, firstly, tensor serialization is performed on the embedded physical watermark transformer feature tensor, converting each element (each element being a fixed-width digital quantization value) in the two-dimensional tensor into a fixed-length byte representation in row-major order and arranging them sequentially to obtain the input layer byte stream. Secondly, the same tensor serialization operation is performed on the intermediate layer activation state feature matrix, converting each activation value in the matrix into a fixed-length floating-point byte representation in row-major order and arranging them sequentially to obtain the intermediate layer byte stream. Thirdly, tensor serialization is performed on the equipment anomaly diagnosis decision output vector, converting each probability value in the vector into a fixed-length floating-point byte representation in index order and arranging them sequentially to obtain the output layer byte stream. Finally, the input layer byte stream, intermediate layer byte stream, and output layer byte stream are concatenated byte-by-byte according to the causal order of the data flow through the model, forming a complete linear byte packet, namely the anti-counterfeiting full-process audit log packet. This audit log packet completely records a snapshot of the entire process of an AI inference behavior from input to output. Since the input layer data has an embedded physical watermark, the intermediate layer features and the output results are all generated by the causal drive of the watermarked input. The three form an unforgeable causal chain of inference in the log packet—any attempt to tamper with the data in any part of the log packet will destroy the causal consistency between the three, and thus be detected and identified in the subsequent verification process.

[0034] Specifically, S4, based on the inherent response matrix of the analog-to-digital converter chip, performs spatiotemporal physical anti-counterfeiting watermark separation and credibility verification on the anti-counterfeiting full-process audit log package to obtain a Boolean value for physical traceability credibility. It should be understood that the construction of the log package only completes the encapsulation of audit data; the credibility verification of the physical watermark carried within it has not yet been performed—that is, the core credibility question of whether the reasoning behavior recorded in the log package is indeed based on real data from the target physical acquisition channel has not yet been answered. Specifically, when an abnormal event occurs, the audit system supports tracing back the entire process along the timeline to quickly locate whether the input data has been tampered with, the model has drifted, or there is a defect in the decision-making logic. Physical traceability verification is the key step in determining whether the input data has been tampered with. Therefore, in the technical solution of this application, based on the known hardware physical benchmark of the inherent response matrix of the analog-to-digital converter chip, the embedded physical watermark information is extracted from the anti-counterfeiting full-process audit log package and reconstructed into a suspected fingerprint data vector. Then, the reconstructed vector is homomorphically matched and verified with the chip's inherent response matrix. Through normalized similarity calculation and threshold judgment mechanism, a boolean value of physical traceability credibility is output, thereby providing a clear judgment conclusion on whether the data source is credible at the physical level. If it is determined to be credible, it proves that the data in the log package was indeed generated through the target physical acquisition channel; if it is determined to be untrustworthy, it indicates that the data may have been tampered with or forged, requiring alarms and manual intervention.

[0035] Figure 4 This is a flowchart of step four in the power IoT AI model behavior full-process security audit method according to an embodiment of this application. Figure 4 As shown, in the first embodiment of this application, S4 includes: S41, performing reverse masking and fingerprint reconstruction on the anti-counterfeiting full-process audit log package to obtain a reconstructed suspected fingerprint data vector; S42, performing homomorphic matching verification on the inherent response matrix of the analog-to-digital converter chip and the reconstructed suspected fingerprint data vector to obtain a Boolean value for physical traceability credibility.

[0036] Specifically, in step S41, reverse masking and fingerprint reconstruction are performed on the anti-counterfeiting full-process audit log package to obtain a reconstructed suspected fingerprint data vector. In this process, firstly, the input layer byte stream is extracted from the anti-counterfeiting full-process audit log package based on the known segment length information. Then, following the reverse process of tensor serialization in step three, the byte stream is deserialized back into a two-dimensional tensor structure, thus recovering the digital quantization values ​​of each element of the embedded physical watermark transformer feature tensor. After recovering the embedded physical watermark transformer feature tensor, a reverse masking operation is performed to extract the embedded watermark bits from each element. The reverse masking operation is then performed sequentially on all elements of the embedded physical watermark transformer feature tensor, and the extracted bit values ​​are arranged in row-major order, thus completing the fingerprint reconstruction and obtaining the reconstructed suspected fingerprint data vector. It is worth noting that if the input data in the anti-counterfeiting full-process audit log package has not been tampered with, the reconstructed suspected fingerprint data vector should be completely consistent with the original spatiotemporal endogenous physical fingerprint vector generated in step one; if the data has been tampered with or forged, the reconstructed vector will deviate from the original fingerprint.

[0037] Specifically, in step S42, homomorphic matching verification is performed on the inherent response matrix of the analog-to-digital converter chip and the reconstructed suspected fingerprint data vector to obtain a Boolean value for physical tracing credibility. In this process, firstly, the inherent response matrix of the analog-to-digital converter chip is flattened into a one-dimensional reference kernel sequence in row-major order, forming a sequence of length [missing information]. The one-dimensional sequence is used as the verification benchmark kernel. The flattened one-dimensional benchmark kernel sequence carries the complete physical non-cloning response characteristics of the specific analog-to-digital converter chip and serves as a reference benchmark for hardware identity matching verification. After obtaining the reconstructed suspected fingerprint data vector and the flattened one-dimensional benchmark kernel sequence, normalized similarity calculation is performed on both to quantify their matching degree. Specifically, two vectors of equal length are regarded as two directional vectors in a high-dimensional space, and the cosine value of the angle between them is calculated as a similarity measure—the closer the cosine value is to 1, the more consistent the directions of the two vectors are, i.e., the higher the matching degree; the closer the cosine value is to 0, the more orthogonal the directions of the two vectors are, i.e., the lower the matching degree. Then, the obtained similarity value is compared with a preset security threshold to output the final physical traceability credibility Boolean value. If the normalized similarity value is greater than or equal to the preset security threshold, a logical true value (True) is output, determining that the data source of the anti-counterfeiting full-process audit log package is credible; if the normalized similarity value is less than the preset security threshold, a logical false value (False) is output, determining that the data source of the log package is untrustworthy. It is worth noting that the setting of this security threshold needs to take into account both the security requirements and fault tolerance requirements of the system. The higher the threshold is set, the stronger the security, but the false rejection rate may increase due to normal noise fluctuations. The lower the threshold is set, the better the fault tolerance, but it may allow carefully crafted forged fingerprints to pass the verification.

[0038] Through the aforementioned overall similarity comparison strategy, a single threshold judgment mechanism was used to verify the physical traceability credibility of the data source. Since the spatiotemporal endogenous physical fingerprint vector is formed by XORing a high-frequency random micro-perturbation sequence with the inherent response matrix of the analog-to-digital converter chip, it contains the hardware components of the chip's inherent response. Therefore, the fingerprint vector reconstructed from genuine data after reverse extraction will inevitably maintain a high similarity correlation with the chip response matrix. However, since forged data has not passed through a genuine physical acquisition channel, its least significant bit does not contain fingerprint information physically related to the target chip response matrix. The similarity between the reconstructed suspected fingerprint vector and the chip response matrix will be significantly lower than the security threshold, thus being judged as untrustworthy.

[0039] Specifically, as described above, in the physical tracing and verification stage of the AI ​​model security audit for the power IoT, sub-step S42 adopts an overall similarity comparison strategy, which directly performs normalized similarity calculation on the reconstructed suspected fingerprint data vector and the flattened one-dimensional benchmark kernel of the analog-to-digital converter chip's inherent response matrix, using a single threshold to determine whether the data source is trustworthy. However, tracing back to the fingerprint generation logic in step one, it can be seen that the spatiotemporal endogenous physical fingerprint vector is not a pure hardware signature, but a composite formed by fusing a high-frequency random micro-perturbation sequence and the inherent response matrix of the analog-to-digital converter chip through bit-by-bit XOR operations. It naturally contains two orthogonal information components—one is a static hardware inherent component bound to equipment manufacturing deviations, and the other is a dynamic time-varying micro-perturbation component bound to the instantaneous physical environment of the power grid.

[0040] The fundamental flaw in this approach lies in its comparison of the fused fingerprint as an indivisible whole with the hardware matrix. Essentially, it only verifies the single dimension of whether the fingerprint contains hardware components, completely ignoring the crucial verification dimension of whether the time-varying power grid environment components conform to real physical laws. In actual power IoT attack and defense scenarios, this single-factor verification has a serious security blind spot that can be bypassed: if an advanced attacker obtains the physically non-clonable response matrix of the edge terminal's analog-to-digital converter chip through electromagnetic side-channel probing or firmware reverse engineering, they are fully capable of artificially synthesizing a fake fingerprint highly similar to the hardware matrix and injecting it into the low-order bits of forged sensor data. Because the first embodiment only performs an overall similarity comparison and does not independently verify the time-varying components within the fingerprint, this carefully constructed fake fingerprint is highly likely to pass a single threshold, allowing the attacker to compromise the entire audit chain.

[0041] A deeper analysis reveals that the XOR operation possesses inverse algebraic properties, meaning that XORing the fused fingerprint with the hardware response matrix again accurately reconstructs the micro-disturbance components of the power grid at the original acquisition time. However, the high-frequency micro-disturbances of a real power grid are constrained by the physical topology of the power system—line impedance, transformer winding distributed capacitance, load fluctuations, and other factors collectively determine that its power spectral density exhibits predictable attenuation envelope characteristics (such as 1 / f noise characteristics) in specific frequency bands. The residual components of forged data after XOR inverse decomposition cannot simultaneously satisfy these frequency domain statistical laws determined by the physical nature of the power grid, inevitably exhibiting artificially synthesized traces such as abnormally flat spectra or non-natural periodic structures. The first embodiment failed to utilize this natural physical constraint as a second independent line of defense, making it the weakest link in its security architecture.

[0042] To address the security blind spots of the aforementioned single-factor validation, this application further proposes a second embodiment.

[0043] Specifically, firstly, residual micro-perturbation components are extracted from the flattened one-dimensional sequence of the reconstructed suspected fingerprint data vector and the intrinsic response matrix of the analog-to-digital converter chip to obtain a residual micro-perturbation component sequence. Since the spatiotemporal endogenous physical fingerprint vector is formed by XORing the high-frequency random micro-perturbation sequence and the hardware response matrix, and the XOR operation satisfies inverse property (i.e., XORing the fusion result with the same operand again can restore the other operand), this algebraic property can be used to accurately extract the intrinsic hardware components from the reconstructed fused fingerprint, thereby extracting the time-varying components that should theoretically be equivalent to the high-frequency fluctuations of the power grid environment at the original acquisition time.

[0044] Specifically, a bit-by-bit XOR inverse operation is performed on the one-dimensional sequence of the reconstructed suspected fingerprint data vector and the intrinsic response matrix of the analog-to-digital converter chip after being flattened in row-major order, to generate a residual micro-perturbation component sequence, as follows:

[0045] in, This represents an element of the residual perturbation component sequence extracted at the i-th bit position. This represents the element at the i-th bit position in the reconstructed suspected fingerprint data vector. This represents the intrinsic response matrix of the analog-to-digital converter chip. This represents a tensor dimensionality reduction operation that flattens a two-dimensional matrix into a one-dimensional sequence in row-major order. This represents the bitwise XOR logical operator, N and represents the number of rows and columns of the matrix, respectively, and i represents the bit index of the data sequence.

[0046] It should be noted that the inverse nature of the XOR operation guarantees the mathematical accuracy of the decomposition process—if the data source is not tampered with, the separated residual components will accurately reflect the actual physical micro-perturbations of the power grid at that time; if the data is falsified, the residual components will exhibit artificial synthesis traces that do not conform to the actual physical characteristics of the power grid. This orthogonal decoupling provides a reliable data foundation for subsequent independent verification of the physical compliance of time-varying components, enabling the verification logic to be upgraded from a one-dimensional overall comparison to a two-dimensional orthogonal analysis.

[0047] Next, the residual micro-perturbation component sequence is subjected to power grid micro-perturbation power spectral density compliance verification to obtain a power spectral compliance score. Considering that the high-frequency micro-perturbations of the real power grid are constrained by the physical topology of the power system (line impedance characteristics, transformer winding distributed capacitance, random fluctuations of system load, etc.), their power spectral density exhibits a predictable attenuation envelope in a specific frequency band—an inherent statistical characteristic determined by the physical properties of the power system. No matter how carefully attackers construct fake data, they cannot simultaneously satisfy these cross-frequency band physical constraints.

[0048] Based on this, a Fast Fourier Transform is performed on the residual perturbation component sequence to transform it from the time domain to the frequency domain to obtain the power spectral density distribution curve, as shown below:

[0049] in, This represents the power spectral density estimate of the residual perturbation component sequence at frequency ff. Let K represent the magnitude of the residual perturbation component sequence at discrete time point k, where K represents the total number of sampling points in the residual sequence. This represents the target frequency variable in frequency domain analysis, where j represents the imaginary unit. The complex exponential basis functions represent the discrete Fourier transform.

[0050] After obtaining the measured power spectral density distribution, a weighted mean square error is calculated for each frequency band against the standard power spectral template for power grid micro-disturbances, which is pre-calibrated based on statistical modeling of a large amount of historical sampling data during normal operation of the power system. The quantified power spectral compliance score is then output, as follows:

[0051] in, This represents the power spectrum compliance score, with a value ranging from [0,1]. The closer the score is to 1, the more it conforms to the actual physical characteristics of the power grid. This represents the measured power spectral density value of the residual component at the center frequency of the b-th frequency band. This represents the reference power spectral density value of the standard power spectral template for power grid micro-disturbances at the center frequency of the b-th frequency band. The weighting coefficient for the b-th frequency band is used to highlight the critical frequency bands most sensitive to counterfeiting (such as the transformer winding resonant frequency band). This indicates the total number of frequency bands divided in the power spectrum analysis.

[0052] It should be noted that the scoring formula employs a normalized weighted error structure, allowing for flexible adjustment of the contribution of different frequency bands to the final score through weighting coefficients. In the power Internet of Things (IoT) scenario, the transformer winding resonant frequency band and the frequency band dominated by line distributed capacitance are most sensitive to forgery behavior. Assigning higher weights to these frequency bands can significantly improve the sensitivity to identifying sophisticated advanced forgery attacks.

[0053] Furthermore, based on the two-factor joint judgment, a true value is output when both the hardware matching degree of the reconstructed suspected fingerprint data vector and the inherent response matrix of the analog-to-digital converter chip and the power spectrum compliance score reach the safety threshold; otherwise, a false value is output, generating a Boolean value for physical traceability credibility. In other words, after completing the power spectrum compliance verification, its result is logically combined with the original hardware matching verification result to construct an orthogonal two-factor security threshold.

[0054] Specifically, the inherent response matrix of the analog-to-digital converter chip is flattened into a one-dimensional verification benchmark kernel in row-major order. The hardware matching similarity between the reconstructed suspected fingerprint data vector and this benchmark kernel is calculated using a normalized similarity function as the first factor; the power spectrum compliance score is used as the second factor. A logical true value is output only when both factors simultaneously reach their respective security thresholds; otherwise, a logical false value is output, generating the final physical traceability credibility Boolean value, as shown below:

[0055] in, This represents a Boolean value indicating the credibility of physical traceability. This indicates the reconstruction of the suspected fingerprint data vector. This represents the intrinsic response matrix of the analog-to-digital converter chip. Tensor operators represent flattening a matrix to reduce its dimensionality to a one-dimensional reference kernel sequence. This represents a similarity calculation function that measures the degree of hardware feature matching between two vectors. This represents the security threshold constant for hardware fingerprint matching, also known as the first factor threshold. Indicates the power spectrum compliance score. The safety threshold constant representing the physical compliance of the power spectrum of micro-disturbances in the power grid is the second factor threshold. The logical AND operator requires two conditions to be met simultaneously for it to be considered reliable.

[0056] Here, the logic and operation structure of the two-factor joint judgment ensures the orthogonality and independence of the two lines of defense. Even if the attacker breaks through the hardware fingerprint binding verification (first factor) by leaking through the side channel, the residual component of the forged data after XOR inverse decomposition cannot simultaneously satisfy the constraint of the inherent power spectrum attenuation law of the power grid (second factor), thus exposing the forgery traces and being intercepted at the frequency domain physical compliance level.

[0057] By introducing a dual verification mechanism of XOR inverse decomposition and power spectrum compliance of power grid micro-disturbances, the original single-factor overall similarity comparison is upgraded to a two-factor orthogonal defense architecture of hardware fingerprint binding verification + power grid physical law compliance verification.

[0058] Specifically, at the technical level, this second embodiment utilizes the inverse algebraic properties of XOR operations to achieve lossless orthogonal decoupling of fused fingerprints. This allows the verification process to independently examine the physical compliance of time-varying power grid environmental components, fundamentally eliminating the security blind spot in single-factor verification mode where attackers can bypass the entire traceability verification by obtaining the hardware response matrix. Power spectral density analysis transforms the inherent constraints of the power system's physical topology on high-frequency noise into quantifiable frequency domain judgment criteria. This ensures that even if forged data is highly similar to real data in the time domain, it will be accurately identified because its frequency domain energy distribution does not conform to the inherent attenuation envelope of the power grid. The introduction of two-factor logic and thresholds enhances the system's anti-attack capability from bypassing a single threshold to requiring simultaneous satisfaction of constraints in two physically orthogonal dimensions. This significantly improves the reliability of physical traceability verification and the anti-forgery robustness of security auditing for power IoT edge nodes facing advanced persistent threats.

[0059] Specifically, in step S5, the anti-counterfeiting full-process audit log package is conditionally routed based on the physical traceability credibility boolean value. When deemed trustworthy, a hash digest of the anti-counterfeiting full-process audit log package is calculated, and a Merkle tree is constructed to solidify the root node hash credential on the blockchain. It should be understood that the physical traceability credibility boolean value was generated in step four through reverse masking and homomorphic matching verification. This boolean value explicitly determines whether the data source of the anti-counterfeiting full-process audit log package has passed the physical layer credibility verification. However, if this determination is not actually consumed and executed, the entire physical traceability verification mechanism remains only at the detection level and fails to form a closed-loop security response. Therefore, in the technical solution of this application, conditional diversion processing is implemented on the anti-counterfeiting full-process audit log package based on the physical traceability credibility boolean value. When it is determined to be credible, a hash digest calculation is performed on the log package and a Merkle tree is constructed. The root node hash certificate is then uploaded to the blockchain for solidification to achieve tamper-proof blockchain evidence storage. When it is determined to be untrustworthy, the log package is intercepted and a security alarm is triggered to prevent counterfeit data from entering the trusted storage system. This conditional diversion mechanism ensures that only audit logs that pass physical layer traceability verification can obtain the blockchain's tamper-proof protection, thereby avoiding the risk of attackers using counterfeit data to "launder" malicious operations. At the same time, placing the on-chain evidence storage step after physical credibility verification effectively avoids the excessive consumption of edge resources and the time sequence breakage caused by communication interruptions due to the high-frequency on-chain storage of all logs indiscriminately. Only credible logs that pass verification consume valuable blockchain writing resources, greatly improving evidence storage efficiency and the overall resource utilization of the system.

[0060] In practice, conditional traffic splitting is performed based on the Boolean value of physical traceability credibility, and a Merkle tree root node hash certificate is generated. During this process, the solidified storage controller first captures and parses the Boolean value of physical traceability credibility output from step four to execute the conditional traffic splitting action. This splitting logic is a strict binary judgment gate: if the Boolean value of physical traceability credibility is false, it indicates that the homomorphic matching verification in step four failed, meaning the data source in the anti-counterfeiting full-process audit log package is deemed untrustworthy—there may be a security threat of malicious hijacking of edge nodes and injection of forged data—at this time, the system immediately triggers the highest-level security interception mechanism, terminates the current log solidification operation, refuses the log package to enter the blockchain evidence storage process, and simultaneously sends a security warning notification to the superior power grid dispatch center to initiate manual intervention; if the Boolean value of physical traceability credibility is true, it indicates that the data source has passed the physical layer traceability verification, confirming that the AI ​​inference behavior recorded in the log package is indeed based on real data from the target physical acquisition channel, at which point the controller allows the anti-counterfeiting full-process audit log package to enter the blockchain front-end cryptographic operation component.

[0061] Once the release conditions are met, the cryptographic operation component performs hash digest calculations on the compliant anti-counterfeiting full-process audit log packets. During this process, the hash digest calculation uses the SHA-256 secure hash algorithm. This algorithm maps input data of arbitrary length to a fixed-length (256 bits, or 32 bytes) hash value through a one-way compression function. It possesses three major security characteristics: collision resistance (the probability of different inputs producing the same output is computationally infeasible), one-wayness (the original input cannot be deduced from the hash value), and avalanche effect (a small change in the input leads to a drastic change in the output). Specifically, the complete byte stream of the anti-counterfeiting full-process audit log packet is used as the input to the SHA-256 algorithm. After a series of deterministic operations such as message padding, block partitioning, and iterative compression, a fixed-length 256-bit binary hash value is output as the unique digital fingerprint of the log packet.

[0062] After obtaining the hash digest values ​​of the leaf nodes, a Merkle tree is constructed to generate the root node hash credential. A Merkle tree is a binary tree data structure based on a hash function. Its construction process is as follows: the hash values ​​of the bottom-level data blocks are used as leaf nodes. Then, the hash values ​​of two adjacent leaf nodes are concatenated and hashed again to obtain the hash value of their parent node. This process is repeated layer by layer upwards, merging and calculating pairwise until only one node remains at the top level—the Merkle tree root node. In the practical scenario of this application, when audit log packets from multiple inference cycles accumulate within a time window, the hash digests of each log packet serve as leaf nodes, forming the bottom layer of the Merkle tree. Through layer-by-layer merging and calculation, the tree eventually converges into a single root node hash credential. Specifically, for two adjacent nodes in the same layer, the hash values ​​of the left and right nodes are concatenated sequentially to form a new byte stream. The concatenated byte stream is then hashed again using SHA-256 to obtain the hash value of the parent node at the next higher level. This process is recursively repeated until a unique root node is generated.

[0063] After recursively merging layer by layer, the root node hash certificate of the Merkle tree is finally obtained. This certificate has the following key characteristics: its length is fixed at 256 bits (32 bytes), and the size of the root node certificate is always extremely small and constant, regardless of the amount of data in the underlying log packets; any bit of any underlying leaf node (i.e., any audit log packet) that is tampered with will cause a drastic change in the root node hash certificate, thus providing the ability to protect the integrity of all data under the entire tree.

[0064] Furthermore, the root node hash certificate is solidified on the blockchain while the log package itself is persistently stored off-chain. Specifically, after generating the Merkle tree root node hash certificate, the edge communication subsystem calls the consensus smart contract of the power consortium blockchain to broadcast this fixed-size, extremely small root node hash certificate as the transaction payload to each consensus node in the blockchain network. Each consensus node verifies and confirms the transaction according to the consortium blockchain's consensus protocol (such as PBFT using the Practical Byzantine Fault Tolerance algorithm). Once consensus is reached, the certificate is permanently written into the blockchain's immutable distributed ledger, completing the on-chain timestamp solidification. The root node hash certificate, solidified on-chain, has full network verifiability and immutability—any subsequent attempt to modify the off-chain stored audit log package will result in a mismatch between the recalculated Merkle root and the solidified certificate on-chain, thus being identified by the system as tampering.

[0065] In summary, the power IoT AI model behavior full-process security audit method according to the embodiments of this application is explained. First, it physically fuses the naturally occurring high-frequency random micro-perturbations in the transformer power frequency signal with the inherent response matrix of the acquisition chip to generate an intrinsic physical fingerprint with spatiotemporal uniqueness. This fingerprint is then embedded in the digitized sensor data tensor as background noise, enabling the physical watermark and business data to be inseparably and integrally bound at the bit level. Subsequently, it drives the edge AI model to automatically construct audit logs carrying physical anti-counterfeiting tags throughout the inference process. Finally, it achieves physical traceability determination through reverse verification of the chip response matrix and performs Merkle tree hashing on the trusted logs for on-chain solidification. This fundamentally eliminates the security blind spot of forged data bypassing integrity verification under pure digital signature schemes. Simultaneously, placing the on-chain evidence storage step after physical trust verification effectively avoids excessive consumption of edge resources due to high-frequency on-chain storage and timing breaks caused by communication interruptions.

[0066] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for full-process security auditing of the behavior of AI models in the power Internet of Things, characterized in that, include: Step 1: Extract high-frequency random micro-perturbation sequence from transformer power frequency analog signal, and perform physical-level fusion of high-frequency random micro-perturbation sequence with the inherent response matrix of analog-to-digital converter chip to obtain spatiotemporal endogenous physical fingerprint vector; Step 2: The spatiotemporal endogenous physical fingerprint vector is embedded as the background noise into the reference tensor of the transformer power frequency analog signal after digital quantization to obtain the transformer feature tensor with embedded physical watermark. Step 3: Input the embedded physical watermark transformer feature tensor into the edge-end power anomaly detection model to construct the edge AI full-process anti-counterfeiting audit log to obtain the anti-counterfeiting full-process audit log package; Step 4: Based on the inherent response matrix of the analog-to-digital converter chip, perform spatiotemporal physical anti-counterfeiting watermark separation and credibility verification on the anti-counterfeiting full-process audit log package to obtain the Boolean value of physical traceability credibility. Step 5: Based on the Boolean value of physical traceability credibility, the anti-counterfeiting full-process audit log package is conditionally diverted. When it is determined to be credible, the hash digest of the anti-counterfeiting full-process audit log package is calculated and a Merkle tree is constructed to solidify the root node hash certificate on the chain.

2. The method for full-process security auditing of the behavior of AI models in the power Internet of Things according to claim 1, characterized in that, The transformer power frequency analog signal includes the instantaneous values ​​of three-phase voltage, the instantaneous values ​​of three-phase current, and the zero-sequence component signal.

3. The method for full-process security auditing of the behavior of AI models in the power Internet of Things according to claim 1, characterized in that, Step one includes: A high-frequency random micro-perturbation sequence is obtained by performing fundamental notch suppression and window function discretization sampling on the transformer power frequency analog signal through a front-end RC high-pass filter network. Physical-level hardware fingerprint fusion is performed on the high-frequency random micro-perturbation sequence and the one-dimensional physical response sequence after row flattening of the intrinsic response matrix of the analog-to-digital converter chip to obtain the spatiotemporal endogenous physical fingerprint vector.

4. The method for full-process security auditing of the behavior of AI models in the power Internet of Things according to claim 1, characterized in that, Step two includes: Discretization sampling and digital quantization mapping are performed on the transformer power frequency analog signal to obtain the digital quantization reference tensor; The least significant bit mask operation and watermark embedding are performed on the digital quantization reference tensor and the spatiotemporal endogenous physical fingerprint vector to obtain the feature tensor of the embedded physical watermark transformer.

5. The method for full-process security auditing of the behavior of AI models in the power Internet of Things according to claim 1, characterized in that, Step three includes: The embedded physical watermark transformer feature tensor is imported into the edge-end power anomaly detection deep neural network to obtain the intermediate layer activation state feature matrix and the equipment anomaly diagnosis decision output vector. Tensor serialization and byte-level concatenation are performed on the embedded physical watermark transformer feature tensor, intermediate layer activation state feature matrix, and equipment anomaly diagnosis decision output vector to obtain the anti-counterfeiting full-process audit log package.

6. The method for full-process security auditing of the behavior of AI models in the power Internet of Things according to claim 1, characterized in that, Step four includes: Reverse masking and fingerprint reconstruction are performed on the anti-counterfeiting full-process audit log package to obtain a reconstructed suspected fingerprint data vector; Homomorphic matching verification is performed on the inherent response matrix of the analog-to-digital converter chip and the reconstructed suspected fingerprint data vector to obtain the Boolean value of physical traceability credibility.

7. The method for full-process security auditing of the behavior of AI models in the power Internet of Things according to claim 1, characterized in that, Homomorphic matching verification is performed on the intrinsic response matrix of the analog-to-digital converter chip and the reconstructed suspected fingerprint data vector to obtain a Boolean value for physical tracing confidence, including: Residual perturbation components are extracted from the one-dimensional sequence after flattening the reconstructed suspected fingerprint data vector and the intrinsic response matrix of the analog-to-digital converter chip to obtain the residual perturbation component sequence. The power spectral density compliance of the residual micro-perturbation component sequence is verified to obtain a power spectral compliance score. Based on the two-factor joint judgment, when the hardware matching degree and power spectrum compliance score of the reconstructed suspected fingerprint data vector and the inherent response matrix of the analog-to-digital converter chip both reach the safety threshold, the true value is output; otherwise, the false value is output, and a Boolean value of physical traceability credibility is generated.

Images