Backdoor attack defense method based on heat map, reverse engineering and model pruning

Abstract

The invention discloses a backdoor attack defense method based on heat map, reverse engineering and model pruning, and relates to the field of neural network model pruning. The present invention determines each type of backdoor trigger in the target neural network, compares the L1 paradigm of the backdoor trigger through an outlier detection point algorithm, and determines the target label as target label data; Calculate the corresponding data set by model inversion, draw a heat map according to the data set, determine the optimal position of the backdoor trigger according to the heat map; input target label data to the target neural network in sequence, and The weight value and activation value of the data are used to screen out target neurons in the target neural network; and to perform model pruning on the target neural network according to the target neurons. The invention can effectively defend against backdoor attacks based on random triggers and model-dependent triggers.

Description

technical field [0001] The invention relates to the field of neural network model pruning, and more specifically relates to a backdoor attack defense method based on heat map, reverse engineering and model pruning. Background technique [0002] Recently, a new type of attack - Backdoor Attacks (Backdoor Attacks) has attracted much attention. After the attacker uses malicious data with a backdoor trigger (Backdoor Trigger) to train the model, the model will be injected into the backdoor. The backdoor model can correctly classify all benign data, but when input data with backdoor triggers, it will misclassify. Backdoor attacks are extremely concealed, which brings great challenges to attack detection, and also brings considerable risks to some resource-limited users who need to outsource the training process. [0003] Heatmaps (also known as correlation coefficient maps) are the primary method for data visualization. The user can judge the magnitude of the correlation betwe...

AI Technical Summary

Problems solved by technology

[0007] Based on the deficiencies of the prior art, the present invention proposes a backdoor attack method for defending deep neural networks based on heat map, reverse engineering and model pruning technology, which solves the problem of model-dependent backdoor attacks that are difficult to defend in traditional solutions, and makes up for related problems. Gaps in aspects

Images