This invention discloses a
backdoor attack method for deep neural network models, comprising: constructing and pre-training a spatial adaptive
feature selection network;
processing images by dividing them into blocks and inputting them into the pre-trained spatial adaptive
feature selection network, and introducing a weighted
ranking mechanism to generate trigger materials; constructing a feature labeling network, inputting labels into the feature labeling network to generate a
label mapping map; and generating poisoned samples using the trigger materials and the
label mapping map. This invention's deep neural
network model backdoor attack method solves the problem of low
attack success rate caused by the simple trigger structure and weak spatial adaptability in existing technologies.