Backdoor attack defense method based on thermodynamic diagram, reverse engineering and model pruning

Abstract

The invention discloses a backdoor attack defense method based on a thermodynamic diagram, reverse engineering and model pruning, and relates to the field of neural network model pruning. The method comprises the following steps: determining each category of backdoor triggers in a target neural network, comparing L1 normal forms of the backdoor triggers through an outlier detection point algorithm, and determining target tags as target tag data; performing model inversion on the category of the target neural network to calculate a corresponding data set, drawing a thermodynamic diagram according to the data set, and determining an optimal position of the backdoor trigger according to the thermodynamic diagram; sequentially inputting target label data into the target neural network, and screening out target neurons in the target neural network according to the weight and the activation value of the input target label data; and performing model pruning on the target neural network according to the target neurons. According to the invention, backdoor attacks based on a random trigger and a model dependent trigger can be effectively defended.

Description

technical field [0001] The invention relates to the field of neural network model pruning, and more specifically relates to a backdoor attack defense method based on heat map, reverse engineering and model pruning. Background technique [0002] Recently, a new type of attack - Backdoor Attacks (Backdoor Attacks) has attracted much attention. After the attacker uses malicious data with a backdoor trigger (Backdoor Trigger) to train the model, the model will be injected into the backdoor. The backdoor model can correctly classify all benign data, but when input data with backdoor triggers, it will misclassify. Backdoor attacks are extremely concealed, which brings great challenges to attack detection, and also brings considerable risks to some resource-limited users who need to outsource the training process. [0003] Heatmaps (also known as correlation coefficient maps) are the primary method for data visualization. The user can judge the magnitude of the correlation betwe...

AI Technical Summary

Problems solved by technology

[0007] Based on the deficiencies of the prior art, the present invention proposes a backdoor attack method for defending deep neural networks based on heat map, reverse engineering and model pruning technology, which solves the problem of model-dependent backdoor attacks that are difficult to defend in traditional solutions, and makes up for related problems. Gaps in aspects

Images