电磁信号对抗样本攻击与防御发展研究

Survey of electromagnetic signal adversarial example attack and defense

摘要:

以深度学习为代表的智能化技术在提升电磁频谱控制与利用系统性能水平的同时，也暴露出其脆弱性，催生出一批以对抗样本为代表的智能电磁攻防技术。随着智能化的快速应用和发展，该领域势必成为电磁频谱竞争的又一个“制高点”。首次尝试着明确了电磁对抗样本攻防的概念内涵，为规范后续的关键技术研究和具体应用提供参考。分析了智能模型脆弱性机理，认为智能模型脆弱性与可解释性存在一定的关系，将专家知识嵌入到模型学习中是下一步改善模型鲁棒性的研究方向。系统梳理了电磁信号对抗样本攻击和对抗样本防御的研究脉络，总结了通用对抗样本领域的共性研究规律，可以直接为电磁信号对抗样本研究提供借鉴。通过总结电磁信号对抗样本的研究规律，提炼出电磁信号对抗样本特有的问题。在此基础上，结合团队近年在该领域的研究积累，提出下一步的发展趋势，对抗攻击下一步的研究趋势是适应跨模型、跨任务的场景，应更加注重领域知识的应用，目标是要对抗多源综合的传感器体系；对抗防御的研究趋势是寻找鲁棒性与泛化性的权衡，通过利用信号处理知识优化处理流程，提高模型的对抗防御性能。同时关注鲁棒性评估，这可能是下一代智能化系统可靠性评估的关键技术之一。

Abstract:

The intelligent technology represented by deep learning has exposed vulnerabilities while improving the performance of electromagnetic spectrum control and utilization system. However it has given rise to a number of intelligent electromagnetic attack and defense technologies represented by adversarial examples. With the rapid application and development of intelligence, this field is bound to become another “high point” in the competition of electromagnetic spectrum. This paper attempted to clarify the content of electromagnetic adversarial-example attack and defense, and to provide reference for standardizing the subsequent research and applications, analyzed the vulnerability mechanism of intelligent models and concluded that there was a relationship between the vulnerability and interpretability of intelligent models. Embedding expert knowledge into model learning is the next research direction to improve the robustness of models. The research lineage of electromagnetic signal adversarial example attack and defense was systematically sorted out, and the common laws in the field of adversarial examples were summarized, which could directly referred by electromagnetic signal research. By summarizing the research laws of electromagnetic signal adversarial examples, some the specific problems were refined. On this basis, combining the accumulation in this field in recent years, the next development trend was proposed: adapt to cross-model and cross-task scenarios should be paid more attention, more domain knowledge should be embedded in the adversarial example, the goal was fighting against multi-source integrated sensor systems. The research trend of adversarial defense was to find the trade-off between robustness and generalization, and optimize the processing flow by using signal processing knowledge. Besides, attention should be paid to robustness assessment, which is likely to be one of the key techniques for reliability assessment of next-generation intelligent systems.