Robust backdoor defense method and system without auxiliary data dependence

Abstract

The invention discloses a robust backdoor defense method and system without auxiliary data dependence, and belongs to the technical field of deep learning model security and artificial intelligence defense. The internal relation between back door injection and sample pollution is analyzed through confrontation disturbance, and a clean sample and a polluted sample are preliminarily isolated from a toxic data set; performing reverse learning and re-learning on the selected clean sample, and training to obtain an enhanced poisoning model; polluted samples and clean samples are accurately identified by enhancing a poisoning model, model training is performed based on the clean samples, a back-door-free robust model is finally obtained, finally, the polluted samples are re-labeled and are used for fine adjustment of the back-door-free robust model, and the robustness of the model is further improved. The method does not depend on any auxiliary clean data set, various backdoor attacks can be effectively resisted, and meanwhile the high precision of the model is kept. According to the method, the vacancy of robust backdoor defense model training under the condition of no auxiliary data in the prior art is filled.

Description

Technical Field

[0001] The present invention relates to the field of deep learning model security and artificial intelligence defense technology, and in particular to a robust backdoor defense method and system without auxiliary data dependence. Background Art

[0002] In recent years, with the widespread application of deep learning technology, the scale and complexity of deep learning models have continued to increase. These models have achieved significant breakthroughs in many fields such as computer vision, natural language processing, and speech recognition. However, as the performance of the models has improved, the security and credibility issues of deep learning models have become increasingly prominent. In particular, in the process of relying on large amounts of data for training, external data sources are often required, but these data sources are not always reliable and are susceptible to data contamination and malicious attacks.

[0003] Backdoor attack is a typical attack method. The attacker introduces a specific trigger into the training data, causing the model to output a specific error result when processing the input with the trigger, while the model behaves normally under other normal inputs. This covert attack method makes backdoor attacks difficult to detect, especially when the data source is uncontrollable, the harm of backdoor attacks is greatly increased.

[0004] At present, many research works have proposed methods for detecting and defending against backdoor attacks, but most of these methods rely on auxiliary clean datasets. This means that when performing backdoor defense on poisonous datasets, additional clean data is often required for model verification and detection. However, in practical applications, it is often not feasible to obtain sufficient clean datasets, especially in the scenario of large-scale datasets. In this case, how to ensure the security of the model on poisonous datasets without the need for auxiliary clean data has become an important problem that needs to be solved urgently.

[0005] Existing backdoor attack defense methods mainly include the following categories:

[0006] 1. Data cleaning method: Based on statistical analysis or heuristic algorithms, the data set is preprocessed to remove samples that may contain backdoor triggers. This type of method usually requires additional clean data sets to help identify abnormal samples.

[0007] 2. Model repair method: By repairing the model for specific input patterns in the later stage of model training, the model's sensitivity to backdoor triggers can be reduced. However, this type of method also requires the use of a clean data set for repair verification, and the defense effect is often not stable enough.

[0008] 3. Adversarial training method: By introducing adversarial sample training models, the model's robustness to input data is enhanced, thereby reducing the success rate of backdoor attacks. However, the effectiveness of such methods in practical applications often depends on the quality and diversity of training data.

[0009] Therefore, the limitation of existing defense methods is that they usually rely on additional clean datasets to improve the defense effect. In many practical scenarios, it is not feasible to obtain large-scale clean datasets. Therefore, how to effectively defend against backdoor attacks without auxiliary data has become a major challenge in the field of deep learning model security. Summary of the invention

[0010] Aiming at the lack of effective backdoor defense in existing research without auxiliary data, the present invention proposes a robust backdoor defense method and system without auxiliary data reliance.

[0011] The technical solution proposed by the present invention is as follows:

[0012] In a first aspect, the present invention proposes a robust backdoor defense method without auxiliary data dependence, comprising the following steps:

[0013] (1) Obtain a toxic dataset with potential backdoor contamination and initialize a deep learning model; the toxic dataset is an image dataset, including contaminated samples and clean samples, the labels of the contaminated samples are attack target categories, and the labels of the clean samples are true categories; the deep learning model takes the image as input and outputs the predicted category of the image;

[0014] (2) Through adversarial perturbation analysis, the initialized deep learning model is used to identify potential contaminated samples and clean samples in the toxic data set, and the contaminated sample set and the clean sample set are preliminarily divided;

[0015] (3) Based on the initially divided contaminated sample set and clean sample set, relearning and reverse learning of the poisoning model are performed to train an enhanced poisoning model, and the contaminated sample set and clean sample set are continuously updated during the training process; the poisoning model is obtained by training a deep learning model with a poisonous data set;

[0016] (4) By enhancing the poisoning model, clean samples are identified from the polluted sample set updated in step (3) and merged with the clean sample set updated in step (3), the polluted sample set and the clean sample set are continued to be updated, and the updated clean sample set is used to train a robust model without backdoors;

[0017] (5) Use the backdoor-free robust model to re-label the contaminated sample set updated in step (4), and merge the re-labeled samples with the clean sample set updated in step (4) to form a final clean sample set. Use the final clean sample set to fine-tune the backdoor-free robust model to complete the training of the robust backdoor defense model.

[0018] Further, step (2) comprises:

[0019] (2-1) Generate a random perturbation δ and a perturbation mask m for each sample in the poisonous dataset;

[0020] (2-2) Apply perturbation δ and perturbation mask m to each sample x in the toxic dataset to obtain the perturbed sample

[0021]

[0022] (2-3) Calculate the original sample x and the perturbed sample The KL divergence between them is used to screen clean samples and contaminated samples according to the size of the KL divergence value, and the toxic data set is preliminarily divided into a contaminated sample set and a clean sample set.

[0023] Furthermore, the random disturbance is calculated by the following formula:

[0024]

[0025] Among them, l(f θ (x), y) represents the loss function of the model, f θ (x) is the output of the model, y is the label of the sample, ∈ is the maximum amplitude of the perturbation, is the perturbation gradient, ‖.‖ 2 is the L2 norm.

[0026] Furthermore, in step (2-3), a KL divergence threshold is set. When the KL divergence of a sample is greater than the threshold, the sample is judged to be a clean sample, otherwise the sample is judged to be a potentially contaminated sample.

[0027] Further, step (3) comprises:

[0028] (3-1) relearning the poisoned model using the contaminated sample set, identifying clean samples from the contaminated sample set using the relearned poisoned model, updating the contaminated sample set and the clean sample set, and performing reverse learning on the relearned poisoned model based on the updated clean sample set;

[0029] (3-2) Repeat the process of step (3-1) using the contaminated sample set and clean sample set updated in step (3-1) to obtain the enhanced poisoning model after meeting the number of iterations required.

[0030] Furthermore, the goal of the relearning is to minimize the loss function of the contaminated samples, and the goal of the reverse learning is to maximize the loss function of the clean samples.

[0031] Furthermore, the method of using the relearned poisoning model to identify clean samples from the contaminated sample set and updating the contaminated sample set and the clean sample set is as follows:

[0032] Through adversarial perturbation analysis, the KL divergence between each sample in the contaminated sample set before and after the perturbation is calculated. According to the size of the KL divergence value and the segmentation rate, clean samples are screened out from the current contaminated sample set, and new contaminated sample sets and clean sample sets are updated.

[0033] Furthermore, the formula of the split ratio is as follows:

[0034] p=1-(e+1)×γ

[0035] Among them, p is the segmentation rate, e is a mathematical constant, and γ is a parameter used to control the segmentation threshold.

[0036] Furthermore, the step (4) is specifically as follows:

[0037] (4-1) Traverse each sample in the polluted sample set updated in step (3), identify the samples whose output categories of the enhanced poisoning model are inconsistent with the sample labels as clean samples, and merge them with the clean sample set updated in step (3) to obtain a new polluted sample set and a new clean sample set;

[0038] (4-2) Use the new clean sample set obtained in step (4-1) to train the deep learning model initialized in step (1). The training goal is to minimize the loss function of the clean samples and obtain a robust model without backdoors.

[0039] In a second aspect, the present invention proposes a robust backdoor defense system without auxiliary data dependence, which is used to implement the above-mentioned robust backdoor defense method.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] (1) The present invention can effectively identify contaminated samples and clean samples from toxic datasets without auxiliary clean datasets, and then generate a robust model without backdoors.

[0042] (2) The present invention improves the robustness of the model and enhances the model's defense capability against backdoor attacks by counteracting disturbance analysis and combining relearning and reverse learning techniques.

[0043] (3) During the iterative training process, the present invention achieves gradually optimized robust defense model training by accurately distinguishing contaminated samples from clean samples, thereby reducing the impact of backdoor attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 The architecture diagram of the robust backdoor defense system without auxiliary data dependence;

[0045] Figure 2 Flowchart for preliminary screening of datasets through adversarial perturbations;

[0046] Figure 3 A flowchart for relearning and reverse learning based on the poisoning model;

[0047] Figure 4 A flowchart of a robust backdoor defense method without auxiliary data reliance; Figure 5 ASR and ACC of ResNet18 based on enhanced poisoning model. DETAILED DESCRIPTION

[0048] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be pointed out that the embodiments described below are intended to facilitate the understanding of the present invention and do not have any limiting effect on the present invention.

[0049] In one embodiment provided by the present invention, Figure 1 The figure shows the architecture of the robust backdoor defense system based on poisoned data sets without auxiliary data dependence of the present invention, which is mainly divided into five modules: data preprocessing and analysis module based on adversarial disturbance, relearning and reverse learning module based on poisoned model, sample accurate classification module, backdoor-free robust model training module and re-labeling and data set merging module. The following are the five modules introduced respectively:

[0050] 1. Data preprocessing and analysis module based on adversarial disturbance

[0051] This module is mainly used to process toxic datasets with potential backdoor contamination. The goal is to identify and preliminarily distinguish clean samples from potentially contaminated samples in toxic datasets through a series of preprocessing steps and adversarial perturbation analysis techniques. The working principle of this module is based on a systematic analysis of the response of deep learning models to malicious perturbations to reveal the abnormal behavior of potentially contaminated samples. In many backdoor attacks, the attacker embeds malicious information into the training process of the model by injecting specific triggers, making the model perform well when facing normal inputs, but produce wrong predictions under specific input conditions with triggers. The attacker's goal is to make these contaminated samples difficult to detect, so the output difference between contaminated and normal samples is usually small. To address this challenge, the data preprocessing and analysis module based on adversarial perturbations introduces adversarial perturbations to force the output of the model to produce more obvious changes. Adversarial perturbations are small but targeted input perturbations that reveal the different performance of contaminated and clean samples in the model by maximizing the prediction uncertainty of the model. Specifically, the system generates a random perturbation for each sample and evaluates it based on the KL divergence between the perturbed model output and the original output. This difference can reflect the stability of the sample in the face of disturbances, and further distinguish between potential contaminated samples and clean samples. The preprocessing and analysis steps of this module can not only effectively identify potential contaminated samples, but also lay the foundation for subsequent model relearning and reverse learning. By analyzing the response of the sample in the face of disturbances, the system can gradually filter out the clean sample set to further improve the robustness of the model. Figure 2 As shown, the working mechanism of this module includes the following steps:

[0052] (1) First, the system obtains a poisonous dataset D from an external data source. The dataset contains contaminated samples and clean samples. The samples in the poisonous dataset D are image samples, where the labels of the contaminated samples are the attack target category labels, and the labels of the clean samples are the true category labels. Initialize the deep learning model f θ , parameter θ is the weight of the model. The model has not been fully trained, and subsequent steps are needed to improve the model's ability to distinguish between contaminated samples and clean samples.

[0053] (2) In order to further analyze the contamination degree of the sample, the system generates a random perturbation δ and a perturbation mask m for each sample x in the toxic data set D. The perturbation δ is used to apply a small disturbance to the sample x, and the mask m is used to control the area of ​​the perturbation effect. In a specific implementation of the present invention, the formula for generating the perturbation is:

[0054]

[0055] Among them, l(f θ(x), y) represents the loss function of the model, f θ (x) is the output of the model, y is the label of the sample, ∈ is the maximum amplitude of the disturbance, which is used to control the intensity of the disturbance. is the perturbation gradient.

[0056] Apply the perturbation δ and mask m to sample x to generate the perturbed sample The calculation formula is as follows:

[0057]

[0058] here, is the perturbed sample, and m is a mask used to control the application area of ​​the perturbation.

[0059] (3) In order to distinguish the contaminated samples from the clean samples in the toxic data set D, the system compares the original output and the perturbed output of each sample and calculates the KL divergence (Kullback-Leibler Divergence) between the two. The calculation formula of KL divergence is as follows:

[0060]

[0061] Among them, f θ (x) and are the outputs of the original sample and the perturbed sample respectively, and i is the sample category index. By calculating the KL divergence of the sample, we can determine whether the sample is contaminated: Assume N b is the number of clean samples in the dataset D, N p is the number of contaminated samples in the dataset D, each sample is independently and identically sampled from a uniform distribution and belongs to K categories, and the deep neural network f θ is a multivariate kernel regression model (RBF kernel) with the same goal as the attacker, and for a given attacked sample x′=(1-m)⊙x+m⊙t, t is the trigger implanted by the attacker. There are: when N p Approximation N b hour, The above shows that when D p When the size is close to that of a clean sample, the contaminated sample is robust to potential disturbances. Therefore, when the KL divergence is small, it indicates that the sample output remains stable after the disturbance is added, and it is more likely to be a contaminated sample. When the KL divergence is large, it indicates that the sample output changes significantly after the disturbance, and it is more likely to be a clean sample.

[0062] (4) According to the KL divergence of each sample, the system divides the samples in the poisoned dataset D into two categories: clean sample set D c and contaminated sample set D p In this embodiment, the KL divergence threshold is set. When it is greater than the threshold, the sample x is judged to be a clean sample, otherwise it is a potential contaminated sample; the potential contaminated sample means that the sample is very likely to be a contaminated sample.

[0063] 2. Relearning and reverse learning modules based on poisoning model

[0064] The main purpose of this module is to strengthen the backdoor effect of the poisoned model on the contaminated sample set, generate an enhanced poisoned model, and gradually screen out possible clean samples, merge them into the clean sample set, and use these clean samples for reverse learning to weaken the dependence of the poisoned model on the backdoor trigger. Through the process of relearning and reverse learning, the poisoned model gradually enhances its ability to distinguish contaminated samples and reduces its sensitivity to backdoor triggers. Figure 3 As shown, the working mechanism of this module includes the following steps:

[0065] (1) First, we use the contaminated sample set D that has been identified through adversarial perturbation analysis. p , for the poisoning model Perform intensive training, the poisoning model is to train the deep learning model f through the poisonous data set D θ The obtained one has the properties of high ASR (Attack Success Rate) and low ACC (Accuracy). In this embodiment, taking ResNet18 as an example, Figure 5 The ASR and ACC of ResNet18 based on the enhanced poisoning model are displayed, which has the properties of high ASR and low ACC.

[0066] During the enhanced training process, the system strengthens the poisoned model's learning of the backdoor triggers in the contaminated samples, thereby constructing an enhanced poisoned model. Enhanced training is a relearning process, which is achieved by minimizing the loss function of the contaminated samples:

[0067]

[0068] Among them, D p represents the contaminated sample set, represents the loss function of the poisoning model, It is a poisoning model.

[0069] (2) During the intensive training process, the system observes the output performance of the model on different samples and uses these performances to further screen out possible clean samples: the poisoning model is used to evaluate the contaminated sample set D p Among the samples, select the samples that are closer to the normal samples (i.e., the clean samples that may be mistakenly marked as potential contaminated samples); merge these selected samples into the clean sample set D c , and prepare the clean sample set Dc Conduct reverse learning;

[0070] In this embodiment, the segmentation formula for screening clean samples is:

[0071] p=1-(e+1)×γ

[0072]

[0073] Among them, D c represents the clean sample set, e is a mathematical constant, p is the segmentation rate, and γ is a parameter used to control the threshold in the segmentation process. Indicates the use of poisoned models According to the segmentation rate p, from the current contaminated sample set D p Filter out clean samples and update to get a new contaminated sample set D p and clean sample set D c . Splitting according to the splitting rate p means: splitting the current contaminated sample set D p Sample input poisoning model in Calculate the KL divergence of each sample and sort them from large to small. Remove the top samples from the current contaminated sample set D according to the split rate p. p Remove and include in the clean sample set D c In the subsequent iterations, more and more clean samples will be selected for subsequent reverse learning, and in the contaminated sample set D with increasing poisoning rate p Strengthen the training of poisoning model.

[0074] (3) The purpose of reverse learning is to maximize the loss function of clean samples by weakening the learning effect of the poisoned model on clean samples, so that the poisoned model gradually reduces its dependence on backdoor triggers. Specifically, the goal of reverse learning is to maximize the loss function of clean samples. This process can be achieved by adjusting the poisoning model parameter θ:

[0075]

[0076] Through reverse learning, the system weakens the dependence of the poisoned model on the backdoor trigger while ensuring that the poisoned model's ability to identify contaminated samples remains unchanged.

[0077] (4) In order to ensure the robustness of the model, the relearning and reverse learning process can be repeated multiple times, that is, repeating the above steps (1) to (3), evaluating the performance of the poisoned model after each iteration, and adjusting the parameters of the poisoned model according to the performance. Specifically, it includes: relearning iteration, after each round of iteration, recalculating the loss of the poisoned model on the contaminated samples and clean samples, and further adjusting the parameters of the poisoned model based on these loss results, so that the poisoned model can better distinguish between clean samples and contaminated samples; reverse learning iteration, in the reverse learning process, as the clean sample set gradually expands, the system will continuously update the poisoned model so that its loss on clean samples gradually decreases.

[0078] Through multiple iterations of training and optimization, the system finally built an enhanced poisoning model The model maintains efficient learning capabilities on contaminated samples and can accurately identify backdoor triggers. At the same time, through the reverse learning process, the model performs poorly on clean samples, thereby better distinguishing clean samples from contaminated samples. This enhanced poisoning model provides a basis for the subsequent accurate identification of contaminated samples.

[0079] 3. Sample accurate classification module

[0080] The main goal of this module is to use the trained enhanced poisoning model to further refine the distinction between contaminated samples and clean samples in the existing contaminated sample set and clean sample set. After processing by this module, the system generates a final clean sample set D c , which will be used to train a robust model without backdoors. This process ensures that the model achieves higher accuracy in identifying contaminated and clean samples through precise classification criteria:

[0081] (1) Enhanced poisoning model obtained through multiple iterative training and reverse learning Re-evaluate all samples and further accurately distinguish between contaminated and clean samples based on the model's performance on the clean and contaminated sample sets;

[0082] Specifically, traverse the contaminated sample set D p , input the sample into the enhanced poisoning model If the model If the output category is inconsistent with the sample label, the sample is merged into the original clean dataset D c , thus forming the final clean data set D c , which is expressed as follows:

[0083]

[0084] 4. Backdoor-free robust model training module

[0085] This module aims to use the final generated clean sample set D c , train a robust model f without backdoor θ .

[0086] The clean sample set D generated by the "Sample Accurate Classification Module" c Based on this, the system starts to train the deep learning model f used in the data preprocessing and analysis module based on adversarial perturbations θ , and obtain a robust model without backdoor; the learning process minimizes the loss function l(f θ (x), y) to achieve:

[0087]

[0088] Through multiple rounds of iterative training, the model parameters θ are gradually optimized to make the robust model f without backdoors θ It can show good classification performance on clean sample sets.

[0089] 5. Re-labeling and dataset merging module

[0090] The main task of this module is to use the robust model f without backdoor θ For the contaminated sample set D after the above steps p The re-annotated samples are merged with the previously confirmed clean sample set to form a more comprehensive and clean dataset. By using this complete clean dataset, the robust model f without backdoor is trained. θ After fine-tuning training, the robustness of the model is further improved. In subsequent use, the model can resist various backdoor attacks and maintain good performance.

[0091] (1) In order to obtain a complete clean dataset and further improve the performance of the clean model, we can also utilize potential selected contaminated samples by relabeling the contaminated samples and merging them with the clean samples to obtain a clean and complete dataset D′:

[0092]

[0093] (2) Use the complete dataset D′ to fine-tune the robust model f without backdoors θ , to further improve its performance, and finally obtain a robust backdoor defense model, which can resist various backdoor attacks and maintain good performance in subsequent use.

[0094] The functions of each module and the details that can be implemented are introduced above. The system embodiments composed of each module can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The system embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them.

[0095] Combining the functions of the above modules, the process of implementing a robust backdoor defense method based on poisonous data sets without auxiliary data dependence is as follows: Figure 4 As shown, it mainly includes the following steps:

[0096] S1, obtain a poisonous dataset from an external data source and initialize a deep learning model; the poisonous dataset is an image dataset, and some images in the dataset are contaminated, that is, the labels of some images are not real categories, but attack target categories set by the attacker;

[0097] S2, using the initialization model to identify potential contaminated samples and clean samples in the toxic data set, and obtain a potential contaminated sample set and a clean sample set;

[0098] S3, relearn the poisoned model through the contaminated sample set, use the relearned poisoned model to update the contaminated sample set and the clean sample set, and reversely learn the poisoned model through the updated clean sample set. This process can be iterated several times to obtain an enhanced poisoned model;

[0099] S4, by enhancing the poisoning model, accurately distinguishing the contaminated samples from the clean samples in the updated contaminated sample set, merging the distinguished clean samples with the updated clean sample set, and using the clean sample set to train a robust model without backdoors;

[0100] S5, use the robust model without backdoor to re-label the samples in the contaminated sample set and merge them with the clean sample set to form a complete clean data set. Use the complete clean data set to fine-tune the robust model without backdoor to enhance the robustness of the model, and finally obtain a robust backdoor defense model.

[0101] The following experiments demonstrate the technical effects of the present invention.

[0102] Table 1 lists the eight backdoor attack methods used in the experiment, including five state-of-the-art backdoor attacks and three state-of-the-art adaptive attacks;

[0103] Table 1 The eight most advanced backdoor attack methods

[0104]

[0105]

[0106] First, let’s introduce the various attributes in Table 1:

[0107] Poisoning ratio: refers to the ratio of training data used for modification in backdoor attacks to the total data. The poisoning ratio of all methods in Table 1 is 0.05.

[0108] Trigger: A mark or pattern inserted by the attacker on the image to activate the backdoor behavior. The triggers of different attack methods vary, such as a white square, a Hello Kitty image, a sine signal, etc.

[0109] Static / Dynamic: Indicates whether the trigger is fixed (static) or deforms or changes in the input image (dynamic).

[0110] Clean / polluted: refers to whether the attack dataset has been modified or polluted. The polluted dataset has the attack trigger inserted into it.

[0111] Adaptive: Indicates whether the attack is adaptive, some attack methods can adjust based on the input (yes), while others cannot (no).

[0112] Source: The source attack indicates whether there is a clear attack source. Some methods in Table 1 do not involve source attacks.

[0113] Target: refers to the target of the attack, usually 1, indicating that the target classification has been successfully attacked.

[0114] Coverage: Indicates the proportion of the input covered by the trigger.

[0115] Here are 8 of the most advanced backdoor attack methods:

[0116] BadNet is a classic backdoor attack method. During training, the attacker inserts a 3×3 white square as a trigger in part of the training data and associates the tampered data with the specified target category. This trigger is static, that is, the position and shape in the image are fixed each time. Since BadNet tampers with the data (Dirty), it is a contamination-type backdoor attack. The goal of BadNet is that when the trigger appears in the test data, the model will incorrectly classify the input as the specified target category.

[0117] The Blend attack uses a Hello Kitty image with a transparency of 0.2 as a trigger, which is poisoned by "blending" the image into the training data. Similar to BadNet, it is also a static, contaminated attack method, that is, the trigger is fixed in all modified samples and does not change. This trigger not only changes some features of the input image, but also retains some of the original information. Similar to BadNet, when this trigger is detected during the test phase, the model will incorrectly classify the image as the target category specified by the attacker.

[0118] SIG (Sinusoidal Signal) is a backdoor attack that uses a sinusoidal signal as a trigger, which is implemented by modulating the color intensity of the input image. Unlike other attacks, SIG is a clean attack (Clean), that is, the data itself has not been obviously tampered with, and the visual effect of its trigger is weak. This attack can hide its backdoor behavior without affecting the visual visibility of the image. SIG attacks are also static, that is, each tampered data will contain the same sinusoidal signal as a trigger.

[0119] WaNet is a dynamic backdoor attack where the trigger is implemented through image deformation. Unlike static triggers, WaNet embeds the trigger in the geometric deformation of the image, so its trigger is dynamic. The uniqueness of this approach is that it does not rely on obvious external visual elements, but hides the trigger through complex geometric distortion. During the testing phase, the model will be misled and misclassify inputs containing geometric deformations. Although WaNet's attack strategy is relatively covert, it is still a pollution attack.

[0120] PhysicalBA (Physical Backdoor Attack) is a physical backdoor attack whose trigger is the Firefox browser icon. Unlike other attacks, this attack is usually used in physical scenarios, such as physical objects in images or videos. This means that an attacker can activate the backdoor attack by showing a specific trigger in a real-world scenario (such as a printed Firefox icon). This method uses a static trigger, and the attack goal is similar to other backdoor attacks: when the trigger appears, the model will misclassify the input.

[0121] TaCT (Targeted Clean-Label Trigger) is an improved backdoor attack method. Similar to BadNet, it uses a 3×3 white square as a trigger. But the difference is that TaCT is adaptive, which means that it can adjust certain characteristics of the trigger on different inputs. TaCT is specially designed as a passive (Source=0) attack, which means that its attack target is only effective on specific categories and not on all inputs. In addition, TaCT adjusts the coverage during the attack to improve the concealment of the attack, with a coverage of 0.01.

[0122] AdaptiveBlend is an adaptive version of the Blend attack. It also uses the HelloKitty image as a trigger, but unlike Blend, it is adaptive, meaning the attack can adjust the specific features of the trigger based on different inputs. The AdaptiveBlend attack maintains the basic principles of the Blend method, but due to its adaptive nature, the trigger may show different blending levels or positions on different samples, making it more flexible and difficult to detect in actual attacks. Its coverage is also relatively small, reaching 0.01.

[0123] AdaptivePatch is an improved version of PhysicalBA that uses four Firefox icons as triggers. The main difference between it and PhysicalBA is that AdaptivePatch is adaptive and can adjust the triggers based on different input data. This attack method usually performs better in physical scenarios. For example, during the testing phase, the attacker can activate the backdoor by displaying these icons in real objects. In addition, AdaptivePatch also has a low coverage of about 0.01, making the triggers difficult to detect.

[0124] Table 2 lists the defense effects of 8 defense methods (including the present invention) under 5 non-adaptive backdoor attack modes, among which AdvrBD is the present invention;

[0125] Table 2 The defensive effects of eight defense methods against five non-adaptive backdoor attack methods

[0126]

[0127]

[0128]

[0129] Here are 7 defense methods other than the present invention:

[0130] Fine-tuning is a method of further training an already pre-trained model. Usually, it uses clean data to update some parameters of the model, thereby weakening or eliminating the effect of the backdoor attack. The goal of fine-tuning is to reduce the attack success rate (ASR) while maintaining the classification performance (ACC) of the model. However, the effect of fine-tuning depends on the structure of the model and the type of attack, and sometimes it may not be completely effective.

[0131] FinePruning is a defense method that eliminates backdoors by pruning unimportant neurons in the model. Specifically, it first identifies which neurons are sensitive to backdoor triggers by training clean data, and then prunes these neurons. This can effectively reduce the success rate of backdoor attacks (ASR) while trying to maintain the normal classification performance of the model (ACC). The advantage of this method is that it does not require modifying the model architecture.

[0132] CutMix is ​​a data augmentation technique that aims to enhance the robustness of a model by combining image parts from different samples to train it. The method forms new training samples by randomly cutting a portion of a training image and splicing it with a portion of another image. This allows the model to better cope with triggers that appear in the input, thereby reducing the success rate of backdoor attacks. In this way, CutMix makes it more difficult for the model to learn the pattern of backdoor triggers, thereby reducing the attack success rate (ASR).

[0133] CLP (Clean Label Pruning) is a clean label pruning defense method based on the fact that backdoor attacks usually only affect specific neurons. CLP prunes and fine-tunes the model to remove neurons that are highly sensitive to backdoor attacks without affecting the model's performance on normal inputs. This method can significantly reduce the attack success rate (ASR), but may have a certain impact on the model's classification accuracy (ACC).

[0134] DBR (Defense against Backdoor with Regularization) defends against backdoor attacks by introducing regularization terms. This method assumes that backdoor attacks affect certain specific neurons or paths of the model, and constrains the parameters of the model by applying regularization to prevent these neurons or paths from being overly sensitive to triggers. The goal of DBR is to reduce the success rate of attacks while maintaining the normal classification performance of the model.

[0135] SCANFT (Subspace Clean Anomaly Free Training) is a strategy for defense through cleaning and anomaly detection. It detects and removes potential backdoor triggers by analyzing abnormal behaviors in the model feature space. Specifically, SCANFT identifies the abnormal performance of the model on attack samples through feature analysis during training, thereby reducing the success rate of attacks. This method can theoretically capture the difference between triggers and normal inputs and effectively weaken backdoor attacks.

[0136] ABL (Adversarial-based Backdoor Learning) defends against backdoor attacks based on adversarial learning. ABL introduces adversarial samples to force the model to learn more robust features in adversarial training, thereby resisting the influence of backdoor triggers. By using adversarial samples during training, ABL can effectively reduce the sensitivity of the model to backdoor triggers and reduce the success rate of attacks. The advantage of ABL is that it can improve the defense capability against backdoor attacks without significantly reducing the model classification performance (ACC).

[0137] Table 3 lists the defense effects of eight defense methods (including the present invention) under three adaptive backdoor attack modes, among which AdvrBD is the present invention;

[0138] Table 3 The defensive effects of eight defense methods against five non-adaptive backdoor attack methods

[0139]

[0140]

[0141]

[0142] Table 4 shows the improvement in defense against backdoor attacks using the re-labeling and re-learning methods.

[0143] Table 4 The defense effect of ResNet18 against backdoor attacks after using re-labeling and re-learning methods

[0144]

[0145] Table 4 shows the performance of ResNet18 trained on the full CIFAR10 dataset using the relabeling and relearning method. It can be seen that after training on the relabeling and relearning dataset, facing 8 state-of-the-art backdoor attacks, the average model performance (ACC) changes from 84.29% to 86.65%, and the attack success rate (ASR) changes from 0.33% to 0.03%.

[0146] The above examples are only specific embodiments of the present invention. Obviously, the present invention is not limited to the above examples, and many variations are possible. All variations that can be directly derived or associated with the contents disclosed by a person skilled in the art should be considered as the protection scope of the present invention.

Claims

1. A robust backdoor defense method without auxiliary data dependence, characterized in that: The following steps are involved: (1) Obtain a toxic dataset with potential backdoor contamination and initialize a deep learning model; the toxic dataset is an image dataset, including contaminated samples and clean samples, the labels of the contaminated samples are attack target categories, and the labels of the clean samples are true categories; The deep learning model takes an image as input and outputs a predicted category of the image; (2) Through adversarial perturbation analysis, the initialized deep learning model is used to identify potential contaminated samples and clean samples in the toxic data set, and the contaminated sample set and the clean sample set are preliminarily divided; (3) Based on the initially divided contaminated sample set and clean sample set, relearning and reverse learning of the poisoning model are performed to train an enhanced poisoning model, and the contaminated sample set and clean sample set are continuously updated during the training process; the poisoning model is obtained by training a deep learning model with a poisonous data set; (4) By enhancing the poisoning model, clean samples are identified from the polluted sample set updated in step (3) and merged with the clean sample set updated in step (3), the polluted sample set and the clean sample set are continued to be updated, and the updated clean sample set is used to train a robust model without backdoors; (5) Use the backdoor-free robust model to re-label the contaminated sample set updated in step (4), and merge the re-labeled samples with the clean sample set updated in step (4) to form a final clean sample set. Use the final clean sample set to fine-tune the backdoor-free robust model to complete the training of the robust backdoor defense model.

2. The robust backdoor defense method without auxiliary data dependence according to claim 1, characterized in that: Step (2) comprises: (2-1) Generate a random perturbation δ and a perturbation mask m for each sample in the poisonous dataset; (2-2) Apply perturbation δ and perturbation mask m to each sample x in the toxic dataset to obtain the perturbed sample (2-3) Calculate the original sample x and the perturbed sample The KL divergence between them is used to screen clean samples and contaminated samples according to the size of the KL divergence value, and the toxic data set is preliminarily divided into a contaminated sample set and a clean sample set.

3. The robust backdoor defense method without auxiliary data dependence according to claim 2, characterized in that: The random disturbance is calculated by the following formula: Among them, l(f θ (x), y) represents the loss function of the model, f θ (x) is the output of the model, y is the label of the sample, ∈ is the maximum amplitude of the perturbation, is the perturbation gradient and ‖.‖2 is the L2 norm.

4. The robust backdoor defense method without auxiliary data dependence according to claim 2, characterized in that: In step (2-3), a KL divergence threshold is set. When the KL divergence of a sample is greater than the threshold, the sample is judged to be a clean sample, otherwise the sample is judged to be a potentially contaminated sample.

5. The robust backdoor defense method without auxiliary data dependence according to claim 1, characterized in that: Step (3) includes: (3-1) relearning the poisoned model using the contaminated sample set, identifying clean samples from the contaminated sample set using the relearned poisoned model, updating the contaminated sample set and the clean sample set, and performing reverse learning on the relearned poisoned model based on the updated clean sample set; (3-2) Repeat the process of step (3-1) using the contaminated sample set and clean sample set updated in step (3-1) to obtain the enhanced poisoning model after meeting the number of iterations required.

6. The robust backdoor defense method without auxiliary data dependence according to claim 5, characterized in that: The goal of the relearning is to minimize the loss function of the contaminated samples, and the goal of the reverse learning is to maximize the loss function of the clean samples.

7. The robust backdoor defense method without auxiliary data dependence according to claim 5, characterized in that: The method of using the relearned poisoning model to identify clean samples from the contaminated sample set and updating the contaminated sample set and the clean sample set is as follows: Through adversarial perturbation analysis, the KL divergence between each sample in the contaminated sample set before and after the perturbation is calculated. According to the size of the KL divergence value and the segmentation rate, clean samples are screened out from the current contaminated sample set, and new contaminated sample sets and clean sample sets are updated.

8. The robust backdoor defense method without auxiliary data dependence according to claim 7, characterized in that: The formula for the split ratio is as follows: p=1-(e+1)×γ Among them, p is the segmentation rate, e is a mathematical constant, and γ is a parameter used to control the segmentation threshold.

9. The robust backdoor defense method without auxiliary data dependence according to claim 1, characterized in that: The step (4) is specifically as follows: (4-1) Traverse each sample in the polluted sample set updated in step (3), identify the samples whose output categories of the enhanced poisoning model are inconsistent with the sample labels as clean samples, and merge them with the clean sample set updated in step (3) to obtain a new polluted sample set and a new clean sample set; (4-2) Use the new clean sample set obtained in step (4-1) to train the deep learning model initialized in step (1). The training goal is to minimize the loss function of the clean samples and obtain a robust model without backdoors.

10. A robust backdoor defense system without auxiliary data dependence, characterized in that: include: A data preprocessing and analysis module based on adversarial perturbation is used to obtain a toxic data set with potential backdoor contamination and generate adversarial perturbations for samples in the toxic data set; through adversarial perturbation analysis, an initialized deep learning model is used to identify potential contaminated samples and clean samples in the toxic data set, and a contaminated sample set and a clean sample set are preliminarily divided; the toxic data set is an image data set, including contaminated samples and clean samples, the contaminated samples are labeled as attack target categories, and the clean samples are labeled as true categories; The deep learning model takes an image as input and outputs a predicted category of the image; A relearning and reverse learning module based on a poisoned model, which is used to relearn and reversely learn the poisoned model based on the initially divided contaminated sample set and clean sample set, train to obtain an enhanced poisoned model, and continuously update the contaminated sample set and clean sample set during the training process; the poisoned model is obtained by training a deep learning model with a poisoned data set; A sample accurate classification module, which is used to identify clean samples from the polluted sample set updated by the relearning and reverse learning modules based on the poisoning model by enhancing the poisoning model and merge them with the clean sample set updated by the relearning and reverse learning modules based on the poisoning model, and further update the polluted sample set and the clean sample set; A backdoor-free robust model training module, which is used to train the deep learning model adopted by the data preprocessing and analysis module based on adversarial perturbations using the clean sample set updated by the sample precision classification module, to generate a backdoor-free robust model; The re-labeling and data set merging module is used to use the backdoor-free robust model to re-label the samples in the contaminated sample set updated by the sample precision classification module, and merge the re-labeled samples with the clean sample set updated by the sample precision classification module to form the final clean sample set, which is used to fine-tune the backdoor-free robust model and complete the training of the robust backdoor defense model.

Images