Generative adversarial network-based frequency domain stealth backdoor attack method

Abstract

The invention discloses a frequency domain stealth backdoor attack method based on a generative adversarial network, and belongs to the technical field of image data processing, and the method comprises the steps: obtaining a clean sample set D1 and a classification model; constructing a generative adversarial network, and constructing a loss function based on picture similarity loss, frequency domain consistency loss and adversarial loss; training the generative adversarial network by using the D1 to obtain a generative model; constructing a clean data set and a backdoor data set based on the D1, a target label t of the backdoor attack and the generative model; constructing multi-layer MMD loss; and constructing total loss based on MMD and MSE, and performing poison training on the classification model to obtain a backdoor model. According to the method, a multi-domain disturbance generation network is constructed, pixel-level disturbance is generated in a spatial domain, discrete wavelet transform is introduced into a frequency domain to constrain frequency domain characteristics of back door disturbance, poisoning samples have concealment in the spatial domain and the frequency domain, multi-layer MMD loss is introduced, the deep characteristic distribution difference between clean samples and back door samples is reduced, and high-concealment attack is achieved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security technology, and in particular to a frequency domain invisible backdoor attack method based on a generative adversarial network. Background Art

[0002] With the widespread application of deep neural networks (DNNs) in computer vision, they have demonstrated remarkable performance in tasks such as image classification, image recognition, and object detection. The power of DNNs relies heavily on massive amounts of training data and powerful computing resources. However, obtaining high-quality training data and sufficient computing resources is often costly, leading many users to rely on third-party datasets, training platforms, or even directly use pre-trained models. While this trend reduces training costs, it also introduces new security risks, particularly the risk of backdoor attacks during model training.

[0003] Backdoor attacks implicitly tamper with training data to induce the model to respond in a targeted manner to specific triggers. The attack paradigm can be formally described as follows: Given an original training set Dclean consisting of clean samples, it is divided into two subsets, D1 and D2. The attacker constructs a poisoned training set Dpoison, which consists of poisoned samples and retained clean samples. The poisoned samples are generated by applying a trigger to D1, while the retained clean samples are D2. The model is trained by minimizing the classification loss, ultimately forming a model with a backdoor.

[0004] The core of backdoor attacks lies in the stealthy design of triggers. The technology has evolved through a gradual optimization process, from static patterns to dynamic generation, and from visually perceptible to imperceptible. Early backdoor attacks primarily relied on static triggers. For example, the BadNets framework proposed by Gu et al. adds fixed-position patches (such as specific pixel blocks or symbols) to training samples and tampering with sample labels to target categories. This allows the model to establish an association between the trigger and the target output during training.

[0005] To further evade visual detection, researchers introduced steganography. Li et al., drawing on ideas from image steganography, implemented the SSBA attack. This attack uses a pre-trained steganography model to embed secret information into samples. The attack uses an image reconstruction loss to constrain the visual consistency of the backdoored samples with the originals. A decoder and an encoding reconstruction loss are used to ensure that the reconstructed image retains the trigger features. Ultimately, the backdoored samples generated by the trained steganography encoder achieve a PSNR of over 40dB, approaching the level of lossless embedding. The attack also exhibits excellent performance, maintaining a high attack success rate and benign accuracy.

[0006] Based on the low sensitivity of manual inspection to small geometric deformations, Nguyen et al. designed a WaNet model to generate a two-dimensional distortion field. This model implants a stealth backdoor by applying local stretching or squeezing deformations to the image. Zhong et al. proposed a pixel-level constraint method that limits the modified value of each pixel to -1, 0, or 1. Using a polynomial distribution sampling network to generate perturbation patterns, they achieved a 98% attack success rate on the MNIST dataset by modifying only 0.5% of the pixels. Zhang et al. further explored texture feature attacks, embedding triggers into image edges and using autoencoders to enhance stealth. Data augmentation techniques (such as flipping and rotation) were also used to improve anti-detection capabilities.

[0007] However, current backdoor attack methods still have the following defects: (1) When constructing triggers, current backdoor attacks usually focus on visual concealment, while ignoring the abnormal high-frequency information introduced in the frequency domain. As a result, backdoor samples often exhibit abnormal characteristics in their high-frequency components in the frequency domain, which are significantly different from clean samples. This anomaly in the frequency domain provides defenders with an effective detection method, thereby reducing the stealth of the attack.

[0008] (2) In the deep feature space of a deep neural network, the feature distribution of backdoor samples generated by traditional backdoor attacks is significantly different from that of clean samples. Backdoor triggers, as an abnormal input, interfere with the model's feature extraction process for samples, causing the deep feature representation of backdoor samples to deviate from the distribution of normal samples. This difference in distribution can be detected through methods such as cluster analysis. Defense technology can utilize this feature to accurately distinguish backdoor samples from clean samples, thereby limiting the effectiveness of backdoor attacks. Summary of the Invention

[0009] The purpose of the present invention is to provide a frequency domain invisible backdoor attack method based on generative adversarial networks, which can solve the defects in the prior art that backdoor samples have abnormal high-frequency features in the frequency domain and are easily detected, and the defects that backdoor samples are easily detected because of the large difference in feature distribution between them and clean samples.

[0010] To achieve the above objectives, the present invention adopts the following technical solution: a frequency domain invisible backdoor attack method based on a generative adversarial network, comprising the following steps: S1, obtain a clean sample set D1 and a classification model. A clean sample in D1 is (x, y), including a clean image x and the true category label y of x. The classification model is pre-trained by D1 and is used to input x and output the predicted category f θ (x), θ is the model parameter of the classification model; S2, construct a generative adversarial network, including a generator and a discriminator; The generator is used to generate a perturbation G(x) based on a clean image x, and add G(x) to x to obtain a poisoned image x'. The discriminator is used to distinguish between the poisoned image and the clean image; S3, construct the loss function L of the generator network gen ; , , Where, L pi is the image similarity loss between x and x', L freq is the frequency domain consistency loss between x and x', L adv is the adversarial loss between the generator and the adversary, α and β are L pi 、L freq The weight of D is a set of clean samples in D1, |D| is the number of clean samples in D, DWT ω (·) is the operation of performing discrete wavelet transform on the image to obtain the ω frequency subband, ω∈{LH,HL,HH}, is the square of the L2 norm; S4, use D1 to minimize L gen Train the generative adversarial network until convergence to obtain a generative model; S5, specifies the target label t of the backdoor attack, extracts some clean samples from D1 to form the subset D2, and the remaining clean samples form the clean data set D train , the clean images in D2 are generated by the generative model to obtain poisoned images, which constitute backdoor samples, where the backdoor samples corresponding to x are (x', t), and the backdoor samples constitute the backdoor dataset D poison ; S6, construct multi-layer MMD loss L MMD ; For a classification model containing N intermediate layers, |H| intermediate layers are selected in sequence, |H|=log2|K|, K is the total number of categories of the classification model, and the |H| intermediate layers are marked as layer 0 to layer |H|-1, where the number of layers in layer i is h i , , 1≤i|≤H|-1, ⌊∙⌋ is rounded down, C is a constant, ; Calculate L according to the following formula MMD ; , Where, D train All samples in the i-th layer feature set, D poison All samples in the i-th layer feature set, MMD 2(∙,∙) is to calculate the MMD square of two sets; S7, use D train and D poison Poison training is performed on the classification model to minimize the total loss L total Adjust the parameters of the classification model to obtain the backdoor model; L total =L benign +L poison +λ∙L MMD , Where, L benign is the MSE loss of the clean image, L poison is the MSE loss of the backdoor sample, λ is the control L MMD A hyperparameter for the strength of the regularization term.

[0011] Preferably, the classification model is obtained by training an AlexNet network, a ResNet network or a VGG network.

[0012] Preferably, the generator is based on a U-Net network.

[0013] Preferably, the discriminator comprises a first downsampling unit, a plurality of second downsampling units and a classification layer connected in sequence; The first downsampling unit includes a convolution layer, an activation function layer, and a maximum pooling layer arranged in sequence, the convolution kernel of the convolution layer is 3×3, and the activation function in the activation function layer is Leaky-ReLU; The second downsampling unit adds a batch normalization layer between the activation function layer and the maximum pooling layer of the first downsampling unit; The classification layer includes a fully connected layer and a Sigmoid activation function layer, which is used to linearly combine the output features of the last second downsampling unit and then map them to (0, 1) through the Sigmoid activation function layer.

[0014] As a preference, L benign 、L poison Calculate according to the following formula respectively; , , Where, |D train |、|D poison |D train and D poison The number of samples in the equation, MSE(∙,∙) is the mean square error between the two, f θ (x), f θ (x') are the predicted categories of the classification model output x and x' respectively.

[0015] Glossary: Maximum Mean Discrepancy (MMD) is a nonparametric method for measuring the difference between two probability distributions. It is based on the kernel function and calculates the difference between the distributions by mapping the data into the Reproducing Kernel Hilbert Space (RKHS). MMD is widely used in tasks such as domain adaptation, generative model evaluation, and two-sample testing. Suppose there are two probability distributions P and Q. Sample sets X = {x1, x2, …, x m} and Y={y1,y2,…,y n In RKHS, the square of the MMD of set X and set Y is expressed as MMD 2 (X,Y).

[0016] The Discrete Wavelet Transform (DWT) is a multiscale signal analysis method that decomposes signals into subbands of different scales and directions. In a two-dimensional wavelet transform, an image is decomposed into four subbands: LL, LH, HL, and HH. These subbands represent image features at different directions and scales. The LL subband contains low-frequency information of the image, i.e., the approximate portion of the image. It is obtained by low-pass filtering in both the row and column directions. The LH subband contains high-frequency information in the horizontal direction, i.e., the horizontal image details. It is obtained by low-pass filtering in the row direction and high-pass filtering in the column direction. The HL subband contains high-frequency information in the vertical direction, i.e., the vertical image details. It is obtained by high-pass filtering in the row direction and low-pass filtering in the column direction. The HH subband contains high-frequency information in the diagonal direction, i.e., the diagonal image details. It is obtained by high-pass filtering in both the row and column directions. These sub-bands can be used for image compression, denoising, feature extraction, etc. Through wavelet transform, we can decompose the image into features of different scales and directions, so as to better analyze and process the image.

[0017] Mean Squared Error (MSE) loss is one of the commonly used loss functions in machine learning and statistics, which is used to measure the difference between the model's predicted value and the actual value.

[0018] This paper constructs a multi-domain perturbation generation network: In the spatial domain, a U-Net-based generator generates pixel-level micro-perturbations, ensuring that the perturbation pattern conforms to the statistical characteristics of natural images through adversarial training strategies. In the frequency domain, a discrete wavelet transform is introduced to construct a frequency separation layer, constraining the frequency domain features of the backdoored perturbation to the LL low-frequency subband, effectively avoiding the abnormal high-frequency information introduced by traditional backdoor attack methods. To achieve deep feature alignment between backdoored and clean samples, a multi-layer MMD regularization loss function is introduced to reduce the difference in deep feature distribution between clean and backdoored samples.

[0019] Compared with the prior art, the advantages of the present invention are: (1) The present invention innovatively proposes a method for improving the invisibility of triggers by joint optimization in the space-frequency domain. In the process of backdoor sample generation, the present invention uses a U-Net architecture generator in the spatial domain to generate pixel-level tiny perturbations to clean samples, so that the samples maintain high concealment in the spatial domain. At the same time, the backdoor perturbation trigger is dynamically embedded in the low-frequency sub-band of the image by using discrete wavelet transform. By designing the frequency domain consistency loss L freq This design forces the generator network to maintain statistical consistency in high-frequency energy distribution with natural images (clean samples), suppressing abnormal energy accumulation in high-frequency components. This design ensures that the characteristics of backdoored samples in the spatial and frequency domains are highly consistent with those of clean samples, significantly improving the stealth of the attack.

[0020] (2) To address the problem of abnormal distribution of backdoor sample features that is common in backdoor attacks, this attack method uses a multi-layer MMD regularization method to calculate MMD loss on multiple feature extraction layers, optimize the distribution consistency of backdoor samples and benign samples in the deep feature space, eliminate the defect of high-order feature offset of backdoor samples, and make backdoor samples difficult to distinguish from clean samples in the deep representation extracted by the model, significantly enhancing the anti-detection ability of the attack, effectively resisting defense technologies based on feature analysis, and improving the robustness of the attack.

[0021] In summary, the attack method of the present invention has good attack effectiveness. Under the premise of maintaining the model's prediction performance for the original clean samples, the backdoor trigger mechanism has high activation efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 Generate an adversarial network architecture diagram for the present invention; Figure 2 This is the architecture diagram of the generator; Figure 3 This is the architecture diagram of the discriminator. DETAILED DESCRIPTION

[0023] The present invention will be further described below with reference to the embodiments and accompanying drawings.

[0024] Example 1: See Figure 1 , a frequency domain invisible backdoor attack method based on generative adversarial network, comprising the following steps: S1, obtain a clean sample set D1 and a classification model. A clean sample in D1 is (x, y), including a clean image x and the true category label y of x. The classification model is pre-trained by D1 and is used to input x and output the predicted category f θ (x), θ is the model parameter of the classification model; S2, construct a generative adversarial network, including a generator and a discriminator; The generator is used to generate a perturbation G(x) based on a clean image x, and add G(x) to x to obtain a poisoned image x'. The discriminator is used to distinguish between the poisoned image and the clean image; S3, construct the loss function L of the generator network gen ; , , Where, L pi is the image similarity loss between x and x', L freq is the frequency domain consistency loss between x and x', L adv is the adversarial loss between the generator and the adversary, α and β are L pi 、L freq The weight of D is a set of clean samples in D1, |D| is the number of clean samples in D, DWT ω (·) is the operation of performing discrete wavelet transform on the image to obtain the ω frequency subband, ω∈{LH,HL,HH}, is the square of the L2 norm; S4, use D1 to minimize L gen Train the generative adversarial network until convergence to obtain a generative model; S5, specifies the target label t of the backdoor attack, extracts some clean samples from D1 to form the subset D2, and the remaining clean samples form the clean data set D train , the clean images in D2 are generated by the generative model to obtain poisoned images, which constitute backdoor samples, where the backdoor samples corresponding to x are (x', t), and the backdoor samples constitute the backdoor dataset D poison ; S6, construct multi-layer MMD loss L MMD ; For a classification model containing N intermediate layers, |H| intermediate layers are selected in sequence, |H|=log2|K|, K is the total number of categories of the classification model, and the |H| intermediate layers are marked as layer 0 to layer |H|-1, where the number of layers in layer i is h i , , 1≤i|≤H|-1, ⌊∙⌋ is rounded down, C is a constant, ; Calculate L according to the following formula MMD ; , Where, D train All samples in the i-th layer feature set, D poison All samples in the i-th layer feature set, MMD 2 (∙,∙) is to calculate the MMD square of two sets; S7, use D train and D poison Poison training is performed on the classification model to minimize the total loss L total Adjust the parameters of the classification model to obtain the backdoor model; L total =L benign +L poison +λ∙L MMD , Where, L benign is the MSE loss of the clean image, L poison is the MSE loss of the backdoor sample, λ is the control L MMD A hyperparameter for the strength of the regularization term.

[0025] In this embodiment, the classification model is obtained by training an AlexNet network, a ResNet network, or a VGG network. The generator is based on a U-Net network.

[0026] L benign 、L poison Calculate according to the following formula respectively; , , Where, |D train |、|D poison |D train and D poison The number of samples in the equation, MSE(∙,∙) is the mean square error between the two, f θ (x), f θ (x') are the predicted categories of the classification model output x and x' respectively.

[0027] Regarding the design of each loss function in the present invention: L pi: Use LPIPS loss to calculate the image similarity between x and x'. LPIPS (Learned Perceptual Image Patch Similarity) is a perceptual loss function based on deep learning that measures the perceptual similarity between images. The core idea is to use pre-trained deep convolutional networks (such as VGG and AlexNet) to extract feature representations of the images, and then calculate the similarity between the images by comparing these features.

[0028] L freq Discrete wavelet transform (DWT) can clearly separate the different frequency components of an image. It can accurately process high-frequency information without affecting the main low-frequency information. Therefore, the frequency domain consistency loss L is designed based on DWT. freq , limiting the perturbation to the low-frequency region of the image to improve the concealment of the backdoor image in the frequency domain.

[0029] L adv : It is used to optimize the generator to generate perturbations that do not destroy the distribution characteristics of the original data, and the discriminator to accurately distinguish between real and backdoor samples, so that the performance of the two can reach a dynamic balance, and finally obtain a generator that can generate highly concealed perturbations. In this invention, L adv Use binary cross entropy (BCE).

[0030] L benign : Used to measure the model's classification ability for normal clean samples; L poison : It is used to measure the ability of the model to force the classification of backdoor samples as target labels.

[0031] L MMD : Used to reduce the distribution differences in feature representations between clean and backdoored samples at multiple network levels. The classification model described in the present invention is used to complete image classification tasks. The total number of types is K. The classification model includes an input layer, an output layer, and multiple intermediate layers between the two. In this invention, there are N intermediate layers.

[0032] Example 2: See Figures 1 to 3 Based on Example 1, a more specific structure of the generator and discriminator is given.

[0033] Generator structure see Figure 2 , which is based on the U-Net network architecture. The powerful feature extraction capability of U-Net can effectively capture the complex features in the image. The accurate acquisition of these complex features is very suitable for designing a generator that can generate specific perturbations as backdoor patterns. Figure 2As shown, the clean image first enters a feature extraction pipeline consisting of multiple downsampling units. Each downsampling unit integrates a 3×3 convolution kernel, a BatchNorm layer, and a Leacky-ReLU activation function. It is then connected to a 2×2 max-pooling window with a stride of 2 for max-pooling. As the network depth increases, the number of feature channels exponentially expands to 1024 dimensions, constructing a highly compressed latent representation space. During the feature reconstruction phase, the network gradually increases the resolution using transposed convolutions. Skip connections are used to concatenate the fine-grained features from the encoding phase with the abstract representations from the decoding path in the channel dimension. This multi-scale feature fusion mechanism significantly improves the boundary accuracy of the generated results. Finally, the output layer is modified to use a 3×1×1 convolution kernel to map from the feature space to the target domain. The Tanh nonlinear transformation is used to constrain the output range to the interval [-1, 1] to ensure the concealment of perturbations in the spatial domain.

[0034] Figure 2 In the figure, Conv3×3 is a convolution operation with a convolution kernel of 3×3, Leacky-ReLU is a Leacky-ReLU activation function, BatchNorm is a BatchNorm layer operation, also known as a batch normalization operation; Maxpool2×2 is a maximum pooling operation with a maximum pooling window of 2×2, Up-conv2×2 is an upsampling convolution operation with a convolution kernel of 2×2, Conv1×1 is a convolution operation with a convolution kernel of 1×1, Tanh is a Tanh function, also known as a hyperbolic tangent function, and Concat is a splicing operation during jump connection, which is used to splice the fine-grained features of the encoding stage with the abstract representation in the decoding path in the channel dimension.

[0035] Discriminator structure see Figure 3 , using an architecture that combines convolutional layers, BatchNorm layers, Maxpool layers, and fully connected layers. Figure 3 In [1], the discriminator includes a first downsampling unit, several second downsampling units and a classification layer connected in sequence; Taking the first downsampling unit as an example, it includes a convolutional layer, an activation function layer, and a max pooling layer. The convolutional layer, as shown in the figure, represents a 3×3 convolution operation with a kernel size of 3×3, which is used to capture local features of the image. The max pooling layer is used to reduce the size of the feature map and reduce computational complexity. In the figure, the max pooling layer is represented by Maxpool2×2, indicating a max pooling operation with a 2×2 max pooling window. The second downsampling unit builds on the first downsampling unit by adding a batch normalization layer (BatchNorm in the figure), which accelerates model convergence and improves model stability and generalization. In both the first and second downsampling units, the activation function layer uses the Leaky-ReLU activation function, which effectively mitigates the vanishing gradient problem and enhances the model's nonlinear representation capabilities. The classification layer includes a fully connected layer (FC) and a sigmoid activation function layer, which linearly combines the output features of the last second downsampling unit and then maps them to the range (0, 1) via the sigmoid activation function layer.

[0036] Example 3: Based on Example 1, the present invention selects ResNet-18 as the classification model in the implementation process, and uses this method to poison the CIFAR-10 dataset and the GTSRB dataset to obtain the CIFAR-10 backdoor dataset and the GTSRB backdoor dataset.

[0037] The classification model is used as a benign model, and four backdoor attack methods, BadNets, Blended, SSBA, and the method of the present invention, are used for comparative experiments, resulting in the following Table 1: Table 1. Attack effect comparison table , In Table 1, BA stands for benign accuracy, and ASR stands for attack success rate. The two datasets used by the benign model are the clean, unpoisoned CIFAR-10 dataset and the GTSRB dataset. The other four attack methods use the backdoored CIFAR-10 dataset and the backdoored GTSRB dataset.

[0038] As can be seen from Table 1, the backdoor attack method proposed in the present invention shows the best or suboptimal attack effect on both datasets. With a relatively low proportion of contaminated data, such as a poisoning rate of only 5%, it can achieve an attack success rate comparable to that of the traditional BadNets and Blended backdoor attack methods. Moreover, for these two datasets, this method performs best in terms of benign accuracy BA, which is only about 1% lower than the benign model. The benign accuracy reflects the classification performance of the model on normal data that has not been attacked. A high benign accuracy indicates that this attack method has little interference with the normal function of the model while achieving the attack goal, and has good attack performance. In addition, compared with SSBA, which is also an invisible type of attack, this method has better overall performance in BA and ASR. It can be seen that this method is more effective than traditional invisible attacks.

[0039] To further verify the stealth of this method in the frequency domain, the detection accuracy of different types of attacks based on the frequency domain analysis detection method is shown in the following table. In the experiment, the backdoor samples generated by the four attack methods on CIFAR-10 and GTSRB were detected and obtained in Table 2: Table 2. Detection accuracy of frequency domain analysis-based detection methods for various backdoor data ,

[0040] As can be seen in Table 2, the detector achieved detection accuracy exceeding 90% for both the BadNets and Blended methods. While weaker than the previous two methods, the detection results for SSBA still achieved an accuracy of approximately 80%. However, due to the introduction of frequency domain consistency loss, the method of the present invention effectively reduces the abnormal high-frequency information introduced during the backdoor implantation process, resulting in detection accuracy rates of only 21.62% and 33.85%. This demonstrates that the present method can effectively avoid detection methods based on frequency domain analysis, achieving high concealment in the frequency domain.

[0041] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A frequency domain invisible backdoor attack method based on generative adversarial network, characterized in that: The following steps are involved: S1, obtain a clean sample set D1 and a classification model. A clean sample in D1 is (x, y), including a clean image x and the true category label y of x. The classification model is pre-trained by D1 and is used to input x and output the predicted category f θ (x), θ is the model parameter of the classification model; S2, construct a generative adversarial network, including a generator and a discriminator; The generator is used to generate a perturbation G(x) based on a clean image x, and add G(x) to x to obtain a poisoned image x'. The discriminator is used to distinguish between the poisoned image and the clean image; S3, construct the loss function L of the generator network gen ; ， ， Where, L pi is the image similarity loss between x and x', L freq is the frequency domain consistency loss between x and x', L adv is the adversarial loss between the generator and the adversary, α and β are L pi 、L freq The weight of D is a set of clean samples in D1, |D| is the number of clean samples in D, DWT ω (·) is the operation of performing discrete wavelet transform on the image to obtain the ω frequency subband, ω∈{LH,HL,HH}, is the square of the L2 norm; S4, use D1 to minimize L gen Train the generative adversarial network until convergence to obtain a generative model; S5, specifies the target label t of the backdoor attack, extracts some clean samples from D1 to form the subset D2, and the remaining clean samples form the clean data set D train , the clean images in D2 are generated by the generative model to obtain poisoned images, which constitute backdoor samples, where the backdoor samples corresponding to x are (x', t), and the backdoor samples constitute the backdoor dataset D poison ; S6, construct multi-layer MMD loss L MMD ; For a classification model containing N intermediate layers, |H| intermediate layers are selected in sequence, |H|=log2|K|, K is the total number of categories of the classification model, and the |H| intermediate layers are marked as layer 0 to layer |H|-1, where the number of layers in layer i is h i , , 1≤i|≤H|-1, ⌊∙⌋ is rounded down, C is a constant, ; Calculate L according to the following formula MMD ; ， Where, D train All samples in the i-th layer feature set, D poison All samples in the i-th layer feature set, MMD 2 (∙,∙) is to calculate the MMD square of two sets; S7, use D train and D poison Poison training is performed on the classification model to minimize the total loss L total Adjust the parameters of the classification model to obtain the backdoor model; L total =L benign +L poison +λ∙L MMD , Where, L benign is the MSE loss of the clean image, L poison is the MSE loss of the backdoor sample, λ is the control L MMD A hyperparameter for the strength of the regularization term.

2. The frequency domain invisible backdoor attack method based on generative adversarial network according to claim 1 is characterized in that: The classification model is obtained by training the AlexNet network, the ResNet network or the VGG network.

3. The frequency domain invisible backdoor attack method based on generative adversarial network according to claim 1 is characterized in that: The generator is based on a U-Net network.

4. The frequency domain invisible backdoor attack method based on generative adversarial network according to claim 1 is characterized in that: The discriminator includes a first downsampling unit, a plurality of second downsampling units and a classification layer connected in sequence; The first downsampling unit includes a convolution layer, an activation function layer, and a maximum pooling layer arranged in sequence, the convolution kernel of the convolution layer is 3×3, and the activation function in the activation function layer is Leaky-ReLU; The second downsampling unit adds a batch normalization layer between the activation function layer and the maximum pooling layer of the first downsampling unit; The classification layer includes a fully connected layer and a Sigmoid activation function layer, which is used to linearly combine the output features of the last second downsampling unit and then map them to (0, 1) through the Sigmoid activation function layer.

5. The frequency domain invisible backdoor attack method based on generative adversarial network according to claim 1 is characterized in that: L benign 、L poison Calculate according to the following formula respectively; ， ， Where, |D train |、|D poison |D train and D poison The number of samples in the equation, MSE(∙,∙) is the mean square error between the two, f θ (x), f θ (x') are the predicted categories of the classification model output x and x' respectively.

Images