Backdoor defense method and system based on adaptive feature blocking

Abstract

The invention discloses a back door defense method and system based on adaptive feature blocking, and the method comprises the steps: 1, constructing a blocking module, and embedding the blocking module into an image classification model; the blocking module comprises a self-adaptive instance statistical calibration layer and a dynamic channel suppression layer, the self-adaptive instance statistical calibration layer is used for eliminating cross-sample statistical offset caused by backdoor attack, and the dynamic channel suppression layer is used for suppressing abnormal activation of a polluted channel; and 2, training the embedded classification network to obtain a final classification network, and completing backdoor attack defense according to the final classification network. Through lightweight modular design and a fine adjustment mechanism, the bottleneck problem of a traditional model defense method in the aspects of calculation cost and flexibility is effectively broken through.

Description

Technical Field

[0001] This invention relates to the field of deep neural network security technology, and in particular to a backdoor defense method and system based on adaptive feature blocking. Background Technology

[0002] Deep Neural Networks (DNNs) have demonstrated outstanding performance in computer vision tasks such as image classification and object detection, and have been widely applied in security-sensitive fields such as facial recognition and autonomous driving. However, with the exponential growth of model parameters and the increasing reliance on third-party training data, the vulnerabilities of deep learning are gradually being exposed, and its security threats are becoming more diversified. Attack methods, represented by adversarial examples and backdoor attacks, breach the security boundaries of models at the inference and training stages, respectively, posing a serious challenge to the security of artificial intelligence (AI) systems.

[0003] Unlike adversarial attacks that induce model misjudgments by applying input perturbations, backdoor attacks achieve targeted misdirection by implanting pre-set triggers during the training phase. This attack path creates systemic security vulnerabilities due to the fixed model parameters. Its deep stealth not only significantly enhances attack concealment but also raises the level of security threat. Specifically, for example… Figure 1 As shown.

[0004] Backdoor attack paradigms targeting deep neural networks employ a core mechanism of data poisoning to implant predefined trigger patterns into the training set, while simultaneously performing semantic modification operations on the labels (e.g., ...). Figure 1 The core threat of backdoor attacks stems from attackers constructing hidden correlation paths from trigger patterns to target tags within the model through data poisoning. For example... Figure 2 As shown, dimensionality reduction analysis of the model's latent feature space using t-SNE visualization technology reveals that during the decision-making process of benign samples, the feature distribution exhibits a continuous topological structure strongly correlated with semantic categories; while the backdoor features of poisoned samples form independent clusters, showing significant spatial separation from the benign feature distribution. This feature decoupling phenomenon indicates that backdoor attacks essentially establish an abnormal feature transmission channel parallel to the normal decision-making mechanism, causing the model's response to triggers to take precedence over semantic feature parsing. This finding provides a theoretical basis for feature-based blocking defense strategies—interfering with the feature transmission path can effectively disrupt the activation conditions of backdoor associations.

[0005] The core of this attack mechanism lies in leveraging the implicit feature extraction mechanism and the uninterpretability of the parameter space in deep neural networks to construct a non-linear correlation channel between trigger patterns and target categories within the model's high-dimensional manifold. From an operational perspective, this channel possesses state-hiding properties: it remains silent during normal inference, activating the target category's decision preference only when the input sample carries a trigger image, thereby enabling the attacker to precisely control the model's behavior (e.g., ...). Figure 3 (For example, a stop sign might be misinterpreted as a pass instruction). Even more serious is the fact that the backdoor attack's trigger mechanism is deeply bound to the trigger itself, allowing attackers to remotely control the system without needing to manage the inference environment.

[0006] Attackers only need to contaminate 0.5% of the training data to trigger misjudgments in autonomous driving systems during the deployment phase through graffiti on specific roads, achieving an attack success rate (ASR) as high as 94.7%. This "training contamination-inference trigger" attack paradigm greatly increases the security threat to models and has become a core bottleneck in the secure deployment of deep learning models.

[0007] With the increasing security requirements of deep neural networks, backdoor defense has become a core research hotspot in the field of model security. Current backdoor defense technologies can be categorized into three main types based on the defense phase: dataset defense, input defense, and model defense (e.g., ...). Figure 4 The various methods differ significantly in their defense mechanisms and application scenarios.

[0008] Backdoor attacks, through strong trigger-label correlations, have seriously threatened the security of computer vision models. Existing model defense solutions generally rely on full model fine-tuning or architecture reconstruction, which faces challenges such as significantly increased computational resource consumption, irreversible damage to model parameters, and limited deployment flexibility.

[0009] While existing feature-based backdoor defense methods achieve backdoor feature blocking through lightweight modules, they suffer from the limitation of "static blocking": First, the blocking strategy adopts a "one-size-fits-all" approach for all input samples (e.g., fixed channel suppression weights, fixed Dropout probability), which can easily lead to over-suppression of benign features in clean samples, resulting in a loss of benign accuracy (BA); Second, the blocking target channel and blocking strength depend on fixed training parameters, which cannot adapt to the feature distribution differences of different types of backdoor attacks (e.g., explicit patch attacks, implicit geometric deformation attacks), and the defense generalization is insufficient when facing unknown triggers; Third, it does not distinguish the risk level of samples (e.g., "high-risk suspected backdoor samples" and "low-risk clean samples"), and still performs strong blocking on low-risk samples, increasing unnecessary computational overhead. Summary of the Invention

[0010] To address the issues of high computational cost and insufficient flexibility in backdoor defense techniques within existing image classification models, this invention provides a backdoor defense method and system based on adaptive feature blocking. By designing a cascaded feature blocking module (including an adaptive cross-channel spatial filtering layer, an adaptive instance statistical calibration layer, a dynamic channel suppression layer, and an adaptive random feature masking layer) and a targeted fine-tuning strategy, the blocking module parameters are optimized using a small number of clean samples while freezing the original model parameters. This achieves the dual objectives of blocking backdoor features and ensuring lossless transmission of benign features. Through lightweight modular design and fine-tuning mechanisms, this invention effectively overcomes the bottlenecks of traditional model defense methods in terms of computational cost and flexibility. By dynamically adjusting the activation strength, target channels, and parameter configuration of the blocking module in real-time based on the risk level of input samples, this invention achieves precise defense with "strong blocking of high-risk samples, weak intervention of low-risk samples, and no interference for clean samples," while simultaneously improving adaptability to various types of backdoor attacks.

[0011] To achieve the above objectives, the technical solution of the present invention is as follows:

[0012] The first aspect of this invention proposes a backdoor defense method based on adaptive feature blocking, comprising:

[0013] Step 1: Construct a blocking module and embed it into the image classification model. The blocking module includes a sample risk assessment sublayer, an adaptive cross-channel spatial filtering layer, an adaptive instance statistical calibration layer, a dynamic channel suppression layer, and an adaptive random feature masking layer. The sample risk assessment sublayer is used to evaluate the backdoor risk of input samples in real time and output a risk value. The adaptive cross-channel spatial filtering layer is used to dynamically adjust the filtering intensity of the 1×1 convolution kernel according to the risk value. The adaptive instance statistical calibration layer is used to dynamically adjust the calibration intensity according to the risk value. The dynamic channel suppression layer is used to suppress the abnormal activation of contaminated channels. The adaptive random feature masking layer is used to disrupt the spatiotemporal consistency of triggers through random dropout operations. The image classification model includes a ResNet-18 model. This facilitates the normal transmission of benign semantic features of the image while blocking the propagation path of abnormal backdoor features.

[0014] Step 2: Train the embedded classification network to obtain the final classification network. Based on the final classification network, implement backdoor attack defense to ensure that backdoor features are blocked and benign features are allowed to pass normally while keeping computational overhead low.

[0015] Furthermore, the sample risk assessment sub-layer is represented by the following formula:

[0016]

[0017] Where R is the risk value, α is the sensitivity coefficient, and DM (F,μ clean ,Σ clean ) represents the Mahalanobis distance, h k For the input sample features, μ clean To store the feature mean of clean samples in the intermediate feature layer, ∑clean is the covariance matrix, θ is the distance threshold, and T is the matrix transpose operation. is the inverse of the covariance matrix.

[0018] Furthermore, the adaptive cross-channel spatial filtering layer is represented by the following formula:

[0019]

[0020] Among them, F conv For the features after adaptive filtering, W base The kernel is 1×1, and β is an adjustment parameter. C is the dimension of the real number space. in For the number of input feature channels, C out The number of output feature channels is represented by *, and * represents the convolution operation.

[0021] Furthermore, the adaptive instance statistical calibration layer is represented by the following formula:

[0022]

[0023] γ adapt =γ base ·(0.5+0.5·R)

[0024] β adapt =β base ·(0.5+0.5·R)

[0025] Among them, F IN F represents the output features after instance-normalized calibration. conv For the output of the adaptive cross-channel spatial filtering layer, μ inst and δ inst These are the mean and standard deviation of a single sample feature, γ. base and β base Let be different learnable parameters, and ε be a small value of .

[0026] Furthermore, the dynamic channel suppression layer is represented by the following formula:

[0027]

[0028]

[0029] Where z is the global average pooling output, w CFor the output of the dynamic channel suppression layer, σ and δ are different activation functions. Let be the set of real numbers, GAP is the global average pooling, W1 and W2 are the channel-dimensional fully connected layer parameters, and r is the compression ratio.

[0030] Furthermore, the adaptive random feature mask layer is represented by the following formula:

[0031]

[0032] p = p min +(p max -p min )·R

[0033] Among them, Y c,h,w X is the output of the adaptive random feature masking layer. c,h,w M is the output of the dynamic channel suppression layer. c,h,w The mask matrix follows a Bernoulli distribution, where p is the final dropout probability, Bernoulli is the Bernoulli distribution, c is the number of channels, h is the height, w is the width, and p min ,p max These represent the minimum and maximum drop probability, respectively.

[0034] Furthermore, embedding the blocking module into the image classification model specifically includes:

[0035] The blocking module is dynamically embedded into the intermediate feature layer of the ResNet-18 model using a hook mechanism; the intermediate feature layer includes layer 2 residual block groups.

[0036] When the ResNet-18 model performs backdoor defense, the blocking module is removed.

[0037] Furthermore, step two specifically includes:

[0038] Freeze all weights in the ResNet-18 model;

[0039] Optimize the blocking module parameters using clean samples and loss functions.

[0040] Furthermore, the loss function is expressed by the following formula:

[0041]

[0042] in, The output is the loss function, where α is the weighting coefficient. The loss is cross-entropy, where y is the true label of the clean sample. For predicting labels, h d To block the module output, h k Features are input samples.

[0043] A second aspect of the present invention provides a backdoor defense system based on adaptive feature blocking, comprising:

[0044] An embedding unit is used to construct a blocking module and embed it into the image classification model. The blocking module includes a sample risk assessment sublayer, an adaptive cross-channel spatial filtering layer, an adaptive instance statistical calibration layer, a dynamic channel suppression layer, and an adaptive random feature masking layer. The sample risk assessment sublayer is used to evaluate the backdoor risk of input samples in real time and output a risk value. The adaptive cross-channel spatial filtering layer is used to dynamically adjust the filtering intensity of the 1×1 convolution kernel according to the risk value. The adaptive instance statistical calibration layer is used to dynamically adjust the calibration intensity according to the risk value. The dynamic channel suppression layer is used to suppress abnormal activation of contaminated channels. The adaptive random feature masking layer is used to disrupt the spatiotemporal consistency of triggers through random dropout operations. The image classification model includes a ResNet-18 model, which facilitates the normal transmission of benign semantic features of the image while blocking the propagation path of abnormal backdoor features.

[0045] The training unit is used to train the embedded classification network to obtain the final classification network. The final classification network is used to implement backdoor attack defense, which can block backdoor features and allow benign features to pass normally while ensuring low computational overhead.

[0046] The beneficial effects of this invention are:

[0047] This invention effectively overcomes the bottlenecks in computational cost and flexibility of traditional model defense methods through lightweight modular design and fine-tuning mechanism. Its plug-and-play and lossless removal features provide an efficient solution for secure model deployment in real-world scenarios. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the image poisoning process provided by the present invention.

[0049] Figure 2 A schematic diagram illustrating the visualization of the t-SNE dimensionality reduction distribution of sample features provided by this invention.

[0050] Figure 3 The flowchart for the poisoning model decision-making provided by this invention.

[0051] Figure 4 This is a schematic diagram illustrating the backdoor defense categories of the image classification model provided by the present invention.

[0052] Figure 5 This is a flowchart of a backdoor defense method based on adaptive feature blocking provided in an embodiment of the present invention.

[0053] Figure 6 This is a schematic diagram of a backdoor defense method based on adaptive feature blocking, provided as an embodiment of the present invention.

[0054] Figure 7 This is a schematic diagram of the feature blocking defense process provided in an embodiment of the present invention.

[0055] Figure 8 The diagram shows three backdoor poisoning samples and triggers provided as embodiments of the present invention.

[0056] Figure 9 This is a schematic diagram of a heat map comparison provided in an embodiment of the present invention.

[0057] Figure 10 This is a schematic diagram illustrating the training process for the classification success rate of benign samples under the embedded blocking module, as provided in an embodiment of the present invention.

[0058] Figure 11 This is an architecture diagram of a backdoor defense system based on adaptive feature blocking, provided for an embodiment of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0060] Example 1

[0061] like Figure 5 and Figure 6 As shown, this invention proposes a backdoor defense method based on adaptive feature blocking, comprising:

[0062] S101: Construct a blocking module and embed it into the image classification model; the blocking module includes a sample risk assessment sublayer, an adaptive cross-channel spatial filtering layer, an adaptive instance statistical calibration layer, a dynamic channel suppression layer, and an adaptive random feature mask layer; the sample risk assessment sublayer is used to evaluate the backdoor risk of input samples in real time and output a risk value; the adaptive cross-channel spatial filtering layer is used to dynamically adjust the filtering intensity of the 1×1 convolution kernel according to the risk value; the adaptive instance statistical calibration layer is used to dynamically adjust the calibration intensity according to the risk value; the dynamic channel suppression layer is used to suppress abnormal activation of contaminated channels; and the adaptive random feature mask layer is used to disrupt the spatiotemporal consistency of triggers through random dropout operations; the image classification model includes a ResNet-18 model.

[0063] S102: Train the embedded classification network to obtain the final classification network, and implement the door attack defense based on the final classification network.

[0064] This invention first designs a lightweight blocking module, whose core consists of a small number of parameters. While maintaining low computational cost, it possesses the ability to target and block specific features. After the module design is completed, it is embedded into a suitable location within a potential poisoning model. Initially, parameter initialization is used to strongly suppress all input features. Then, a small number of clean samples are used to perform short-term targeted fine-tuning of the blocking module. The purpose of this fine-tuning is to ensure the normal transmission of benign semantic features while preserving strong blocking capabilities against backdoor-like abnormal features.

[0065] This design achieves efficient suppression of backdoor features and basic preservation of model functionality through a modular mechanism of "global blocking → targeted optimization". The advantage of this approach is that it does not modify the structure or parameters of the original model.

[0066] Example 2

[0067] Based on the above embodiments, this invention proposes a backdoor defense method based on adaptive feature blocking, specifically including:

[0068] By applying dynamic intervention at key nodes in the model feature propagation path, abnormal associations between backdoor features and target labels can be effectively blocked, while maintaining the integrity of benign features. The key to dynamic intervention lies in how to block backdoor features without affecting the normal transmission of benign features. Based on this idea, this invention proposes a backdoor defense method based on adaptive feature blocking, the core process of which (e.g.) Figure 7 )as follows:

[0069] S201: Construct a blocking module and embed it into the image classification model; the blocking module includes a sample risk assessment sublayer, an adaptive cross-channel spatial filtering layer, an adaptive instance statistical calibration layer, a dynamic channel suppression layer, and an adaptive random feature mask layer; the sample risk assessment sublayer is used to evaluate the backdoor risk of input samples in real time and output a risk value; the adaptive cross-channel spatial filtering layer is used to dynamically adjust the filtering intensity of the 1×1 convolution kernel according to the risk value; the adaptive instance statistical calibration layer is used to dynamically adjust the calibration intensity according to the risk value; the dynamic channel suppression layer is used to suppress abnormal activation of contaminated channels; and the adaptive random feature mask layer is used to disrupt the spatiotemporal consistency of the trigger through random dropout operations; the image classification model includes a ResNet-18 model.

[0070] Specifically, the sample risk assessment sublayer calculates the deviation of the feature distribution between the input sample and the clean sample in real time, generating a "sample risk value" as the basis for adjusting the blocking strategy. Specifically, it assesses the backdoor risk R of the input sample in real time and outputs a risk value (within the range [0,1], where R=0 indicates a clean sample and R=1 indicates a backdoor sample).

[0071] The pre-trained "clean sample feature library" (which stores the feature mean μ of clean samples in the intermediate feature layer) is used. clean Covariance matrix Σ clean ), calculate the Mahalanobis distance between the input sample feature F and the clean sample feature distribution, and normalize it to the risk value R:

[0072]

[0073]

[0074] Where R is the risk value, α is the sensitivity coefficient (controlling the rate of change of the risk value with distance, learned during training), and D... M (F,μ clean ,Σ clean ) represents the Mahalanobis distance (a measure of the deviation of a sample from a clean feature distribution), h k For the input sample features, μ clean To store the feature mean of clean samples in the intermediate feature layer, ∑clean is the covariance matrix, θ is the distance threshold (the maximum Mahalanobis distance of clean samples, statistically determined before training), and T is the matrix transpose operation. Let be the inverse of the covariance matrix. The activation function is Sigmoid, ensuring R ∈ [0,1]. The sample risk assessment sublayer does not require a complex network structure; real-time risk assessment is achieved solely through statistical computation.

[0075] Adaptive cross-channel spatial filtering layer: Based on real-time feature activation statistics (such as channel activation variance), it dynamically locates abnormal channels (rather than relying on fixed trained channel weights) to achieve "precise blocking without damaging benign channels". Specifically, the filtering strength of the 1×1 convolution kernel is dynamically adjusted according to the risk value R. The higher the R, the stronger the filtering (strengthening the filtering of local patterns of triggers), and the lower the R, the weaker the filtering (avoiding damage to benign features). Its functional expression is as follows:

[0076]

[0077] Among them, F conv For the features after adaptive filtering, W base The kernel is 1×1, and β is an adjustment parameter. C is the dimension of the real number space. in For the number of input feature channels, C outThe output feature channel is represented by *, where * represents the convolution operation. The adaptive convolution kernel is obtained by multiplying the basic convolution kernel by a scaling factor (1+β·R), and then multiplied by the sample input feature h. k Perform a convolution operation to obtain the adaptively filtered feature F. conv .

[0078] From a functional perspective, based on sparse initialization (He normal distribution, a probability distribution used for neural network initialization, which helps stabilize network training by maintaining consistent variance of input and output data distributions), this filtering layer prioritizes suppressing high-frequency noise responses. The principle is that 1×1 convolution can transform channel-dimensional information, and high-frequency noise exhibits a specific distribution along the channel dimension. Through proper initialization and calculation of the convolution kernel parameters, its influence can be weakened, thereby effectively filtering the local spatial patterns of triggers. Furthermore, this design is lightweight, reducing computation by nearly 89% compared to 3×3 convolution, avoiding significant overhead. Other options, such as fully connected layers, can achieve similar functionality, but their parameter count far exceeds that of 1×1 convolution and they can destroy spatial structure information.

[0079] Adaptive Instance Statistical Calibration Layer: The calibration strength is dynamically adjusted based on the risk value R—strong calibration is used for high-risk samples (R > 0.5) (to eliminate statistical bias caused by backdoors), and weak calibration is used for low-risk samples (R ≤ 0.5) (to preserve the statistical characteristics of benign samples). The calculation process is as follows:

[0080]

[0081] γ adapt =γ base ·(0.5+0.5·R)

[0082] β adapt =β base ·(0.5+0.5·R)

[0083] Among them, F IN F represents the output features after instance-normalized calibration. conv For the output of the adaptive cross-channel spatial filtering layer, μ inst and δ inst These are the mean and standard deviation of a single sample feature, γ. base and β base Let be different learnable parameters, and ε be a small value of .

[0084] The design motivation is to eliminate batch-dimensional statistical dependence and prevent backdoor triggers from propagating through batch normalization parameters; each sample is processed independently, enhancing the sensitivity of the blocking module to single-sample anomalous features. The reason for choosing Instance Normalization (IN) instead of Batch Normalization (BN) is that backdoor triggers may propagate through the batch statistical parameters of BN (such as mean or variance), while the single-sample characteristic of IN can block such propagation paths.

[0085] Dynamic channel suppression layer: mainly composed of channel attention modules, which generate channel weight vectors through a compression-excitation mechanism to suppress abnormal activation of contaminated channels.

[0086]

[0087]

[0088] Where z is the global average pooling output, w C For the output of the dynamic channel suppression layer, σ and δ are different activation functions. Given the set of real numbers, GAP stands for Global Average Pooling, which is used to optimize the feature F after IN. IN Global spatial dimension compression is performed. W1 and W2 are the parameters of the fully connected layer in the channel dimension, and r is the compression ratio (adaptively adjusted according to the number of channels to balance computation and representation capabilities). This step, through two fully connected transformations of "compression-activation," allows the model to adaptively learn the correlation between channels, assigning low weights to anomalous channels to achieve suppression. The core reasons for choosing channel attention (rather than spatial attention) include: backdoor feature distribution characteristics: backdoor attacks often transmit malicious information through anomalous activation of specific channels (poisoned samples show high response in specific channels); computational efficiency: the number of parameters for channel attention is O(C). 2 / r), which is far lower than the spatial attention O(H×W×C).

[0089] Adaptive random feature masking layer: This layer is built around a Dropout layer and disrupts the spatiotemporal consistency of the trigger through random dropout operations. Its function is expressed as:

[0090]

[0091] p = p min +(p max -p min )·R

[0092] Among them, Y c,h,w X is the output of the adaptive random feature masking layer. c,h,wM is the output of the dynamic channel suppression layer. c,h,w The mask matrix follows a Bernoulli distribution, where p is the final dropout probability. The Dropout probability is dynamically adjusted based on the risk value—a higher R results in a larger p (stronger spatiotemporal consistency of the disruptive trigger); a lower R results in a smaller p (reducing loss of benign features). Bernoulli is the Bernoulli distribution, c is the number of channels, h is the height, w is the width, and p... min ,p max These represent the minimum (0.1, to avoid excessive discarding of clean samples) and the maximum discard probability (0.5, to intensify the destruction of high-risk samples).

[0093] The main function of this layer is to suppress overfitting, enhance the generalization ability of the blocking module to unknown triggering patterns, and make the model less likely to be "deceived" by fixed triggering patterns when facing different backdoor attack scenarios, thereby improving the robustness of the defense.

[0094] This invention dynamically adjusts key parameters of the blocking module (such as Dropout probability, channel suppression weight, and convolution kernel coefficients) based on the sample risk value, balancing defense strength with the preservation of benign features.

[0095] Hierarchical characteristic analysis revealed that the adaptability of the blocking module varies significantly depending on the feature space depth of the network.

[0096] Shallow networks (such as the layer 1 residual block group of ResNet-18) mainly extract low-level features such as edges and textures. Although they have high spatial resolution (e.g., 224×224), their semantic abstraction ability is limited. Embedding blocking modules at this stage will interfere with the basic feature extraction process and make it difficult to effectively capture the cross-channel correlation characteristics of backdoor features. Deep networks (such as the layer 4 residual block group) have high semantic representation capabilities, but the backdoor features are already deeply coupled with the global semantics. Embedding blocking modules at this stage will lead to poor defense effects and a decrease in the classification accuracy of benign samples. Therefore, both shallow and deep network embedding have certain limitations. In contrast, intermediate feature layers (such as the layer 2 residual block group) exhibit unique balance characteristics: they have moderate spatial resolution and semantic abstraction; they retain local geometric information and can locate the spatial distribution patterns of triggers (such as high-frequency noise, specific texture combinations); the backdoor features are not yet deeply bound to the normal semantics. By using the Hook mechanism, blocking modules can be dynamically embedded into the intermediate feature layers of the ResNet-18 model, which facilitates selective suppression through feature blocking modules.

[0097] Based on the above analysis, the blocking module is ultimately embedded in the intermediate feature transmission path. Experiments verify the effectiveness of this strategy in attack suppression and function preservation.

[0098] Preferably, the image classification model of the present invention can be used in security monitoring image classification scenarios: classification and recognition of pedestrians, vehicles, and abnormal objects.

[0099] S202: Train the embedded classification network to obtain the final classification network, and implement the door attack defense based on the final classification network.

[0100] Specifically, in order to achieve the blocking of backdoor features and the normal passage of benign features while ensuring low computational overhead, the following lightweight fine-tuning strategy was designed:

[0101] Mainnet parameter freezing: Fix all weights of the original model and retain the performance of the original model (semantic analysis capability of benign features).

[0102] Targeted fine-tuning of the blocking module: Optimize only the blocking module parameters using a small number of clean samples (5% of the training dataset). Guide the blocking layer to suppress backdoor features through the loss function, while minimizing the impact on normal classification. The loss function is designed as follows:

[0103]

[0104] in, The output is the loss function, where α is the weighting coefficient. The loss is cross-entropy, where y is the true label of the clean sample. For predicting labels, h d To block the module output, h k Features are input samples.

[0105] α is set to 0.8, and the cross-entropy loss is... To ensure classification accuracy, the feature-preserving loss constraint blocks the output h of the blocking module. d Compared with the original feature h k To maintain similarity and prevent excessive distortion, the optimization employed a stochastic gradient optimizer (SGD, learning rate 1e-3, weight decay 1e-4), which converged within 5 rounds, with parameters accounting for only 0.64% of the total model.

[0106] Preferably, the classification network with embedded adaptive blocking modules is trained to learn the mapping relationship between "sample features → risk value → blocking parameters". After training, the classification network can dynamically adjust the blocking strategy according to the real-time features of the input samples to defend against door attacks. Furthermore, the adaptive blocking module can be removed during the defense process according to scenario requirements, restoring the original model performance without loss. The lightweight design significantly reduces the computational resources required compared to model defense strategies such as model reconstruction or modification of model training paradigms, and the embeddable modular design improves deployment flexibility.

[0107] This invention, through a lightweight modular design of "risk perception - multi-layer linkage - dynamic adaptation", overcomes the bottlenecks of traditional static blocking methods in terms of defense accuracy, scenario adaptability and benign feature protection while maintaining the advantage of computational cost, and achieves precise matching between backdoor suppression strength and sample risk.

[0108] In summary, this invention proposes a lightweight backdoor defense method based on feature blocking: a finely adjustable blocking module is embedded in the model, and the dual objectives of blocking backdoor features and allowing benign features to pass normally can be achieved through targeted fine-tuning with a small number of clean samples. This method features high computational efficiency and flexible deployment, and its removal does not affect the performance of the original model. The blocking mechanism proposed in this invention, while maintaining the advantages of model defense, effectively solves the flexibility and efficiency problems of traditional methods through modular design, providing a new technical path for practical applications.

[0109] Example 3

[0110] Based on the above embodiments, this invention proposes a verification process for a backdoor defense method based on adaptive feature blocking, specifically including:

[0111] All experiments were conducted on a Linux Ubuntu system using an NVIDIA RTX A6000 graphics card. The experimental environment consisted of Python 3.8.19 and PyTorch version 1.8.0+cu111. The backdoor attack and defense methods used for testing and comparative evaluation were derived from the backdoor toolkit backdoorBox.

[0112] The experiment selected three typical backdoor attack methods for comparison and verification:

[0113] Three backdoor poisoning samples and triggers, such as Figure 8 As shown, where Figure 8 In the image, (a) is the original image, (b) is a BadNets backdoor sample, (c) is a Blended backdoor sample, (d) is a WaNet backdoor sample, (e) is a BadNets backdoor trigger, (f) is a Blended backdoor trigger, and (g) is a WaNet backdoor trigger.

[0114] BadNets (Patch Attacks): These attacks implant poisoned samples via display triggers, representing pixel-based display modifications. The triggers on MNIST and CIFAR10 are 3×3 pixel blocks (e.g., ...). Figure 8 (e) In the example, due to the large image size of MINI-ImageNet, a 24×24 format is used to improve the success rate of attacks. Simultaneously, data augmentation techniques are employed during training to preprocess the training images (such as scaling and random rotation) to increase the difficulty of trigger detection.

[0115] Blended attack: A random noise pattern with transparency α = 0.1 is superimposed onto the image (e.g., ...). Figure 8 (f) simulates a semi-stealthy attack with stronger concealment. Its triggers blend well with the background, making traditional input filtering methods prone to failure.

[0116] WaNet (Geometric Deformation Attack): Generates stealth triggers (such as...) through the deformation of thin plate splines (TPS). Figure 8 (g) represents an advanced attack based on image geometric distortion, which can bypass most feature-based defense methods.

[0117] The dataset is described in Table 1:

[0118] Table 1. Dataset Description

[0119]

[0120]

[0121] Choosing the above attack methods can comprehensively cover three types of backdoor modes: explicit patching, implicit noise, and geometric deformation, thus verifying the generalization ability of the blocking module.

[0122] To systematically evaluate the performance advantages of the blocking module proposed in this invention, two mainstream defense paradigms were selected as baselines for comparative analysis:

[0123] Input preprocessing defenses: AutoEncoder: Trains an autoencoder (encoder E and decoder D) based on clean samples, and disrupts the backdoor triggering pattern in the input by reconstructing the loss; ShrinkPad: Employs a data augmentation strategy that combines random pruning and zero padding, and disrupts the spatial consistency of triggers by spatial perturbation.

[0124] Model reconstruction defense: Fine-Pruning: Based on low-order statistics of neuron activation values, redundant connections are pruned and the model is fine-tuned to eliminate backdoor associated weights; NAD (Neural Attention Distillation): The attention map of the teacher model is used to guide the student model to learn benign samples, thereby achieving backdoor feature forgetting.

[0125] Fairness assurance in comparative experiments: all methods are trained on the same poisoned dataset (poisoning rate 5%), and the proportion of clean samples and the range of hyperparameter search used in the defense phase are consistent.

[0126] Table 2 shows a comparison of the defense effectiveness of the proposed method and baseline defense methods against BadNets, Blended, and WaNet attacks on three datasets. Evaluation metrics include benign accuracy (BA) and attack success rate (ASR).

[0127] Table 2 shows the defensive performance of the five methods against different backdoor attacks on three datasets.

[0128]

[0129]

[0130] As shown in Table 2, the method of this invention exhibits significant defensive effects across datasets (MNIST / CIFAR-10 / Mini-ImageNet) and in multi-attack scenarios (BadNets / Blended / WaNet). Attack success rate suppression: The average ASR reduction for explicit attacks (BadNets) and stealth attacks (Blended, WaNet) is 92.88% (MNIST: 99.72%→6.84%), 90.48% (CIF-AR-10: 98.36%→7.88%), and 74.39% (Mini-ImageNet: 81.87%→7.48%), respectively, verifying the strong blocking capability of the blocking module against trigger propagation paths. Cross-scale robustness: The blocking module exhibits an ASR standard deviation of less than 3% (MNIST: 3.2% ± 0.3, CIFAR-10: 3.1% ± 0.2, Mini-ImageNet: 5.6% ± 0.5) in grayscale image (MNIST), small-sized color image (CIFAR-10), and large-sized complex image (Mini-ImageNet) scenarios, demonstrating its strong robustness to image scale and modal variations.

[0131] Furthermore, the lightweight design and constrained fine-tuning strategy of the blocking module effectively preserve the original performance of the model: the local parameter update and channel attention dynamic weighting mechanism suppress backdoor features while minimizing interference with global semantics (feature similarity reaches 0.89), ensuring that the benign accuracy (BA) drops by an average of only 2.92% (MNIST: 96.87% vs 98.84%; CIFAR-10: 87.24% vs 89.93%; Mini-ImageNet: 58.49% vs 62.58%), which is significantly better than other defense strategies.

[0132] Heatmap Comparison: To verify the effectiveness of the defense mechanism, this invention conducts a visualization experiment targeting a BadNets attack scenario (a 3×3 white pixel block trigger implanted in the lower right quadrant of the image). For example... Figure 9 As shown ( Figure 9 The first row shows images of poisoned samples, the second row shows predicted heatmaps of benign samples, the third row shows predicted heatmaps of poisoned samples before defensive intervention, and the fourth row shows predicted heatmaps of poisoned samples after implementing the defensive strategy. Using Gradient Weighted Class Activation Mapping (Grad-CAM, Chou et al., 2020), spatial localization analysis of the model's decision-making basis reveals a significant feature attention shift: In the model without defensive intervention, the heatmaps of poisoned samples exhibit highly localized features (third row), with 92.4% of cases showing abnormally high activation in the trigger region (mean intensity 0.87, significantly higher than the 0.12 in the same region of benign samples). However, after embedding the feature blocking module, the model's prediction results (fourth row) show a systematic shift in model attention distribution. The spatial overlap between the peak region of the heatmap and the trigger region decreases to 7.8%, and 83% of the sample activation focus reverts to semantically relevant regions (such as animal heads and vehicle outlines), with their intensity distribution (mean 0.68) showing no statistically significant difference from clean samples (mean 0.71) (p = 0.23). The heatmap comparison demonstrates that the defense mechanism, through dynamic feature intervention, successfully blocked the model's pathological dependence on backdoor triggers, reconstructed the decision logic based on semantic features, and did not significantly affect the parsing ability of benign features. This visual evidence corroborates the feature decoupling theory in the methodology section, confirming the effectiveness of the defense strategy.

[0133] To systematically evaluate the contributions of each core component of the defense mechanism, this invention conducts ablation experiments on the BadNets backdoor model defense on the CIFAR-10 dataset, quantitatively analyzing the impact of removing different modules on benign accuracy (BA) and attack success rate (ASR). The experimental results are shown in Table 3.

[0134] Table 3. Analysis of Ablation Experiments on Blocking Modules

[0135]

[0136] Ablation experiments show that each component has a differentiated impact on the balance between benign accuracy (BA) and attack success rate (ASR) of the model. The complete model has an BA of 83.86% and an ASR of 11.65%, demonstrating high defensive effectiveness. After removing the 1×1 convolutional layer, the BA drops to 81.51%, while the ASR rises sharply to 88.77%, indicating that this layer plays a core role in blocking the propagation of backdoor features—its sparse connectivity effectively suppresses the gradient propagation of triggers through cross-channel feature recombination. Removing the normalization layer significantly reduces the BA to 79.59%, but the ASR remains at 13.7%, revealing that the normalization layer mainly improves the defensive capability indirectly through stabilizing the training process; its absence weakens the overall model performance but does not completely destroy the defensive mechanism. Removing the channel attention module reduces the BA to 80.32% and increases the ASR to 17.03%, confirming that its dynamic feature calibration capability can suppress the activation intensity of contaminated channels (experiments show that the response of key channels decreases by about 23%). The absence of the Dropout layer reduced the Base Absorption (BA) to 80.87% while the Average Response Rate (ASR) slightly increased to 14.7%, indicating that it enhances feature robustness through randomly deactivated neurons, forming a synergistic defense with the 1×1 convolution. Notably, removing the data augmentation during the fine-tuning phase caused the BA to plummet to 78.64% while the ASR surged to 35.11%, highlighting the dual value of data augmentation in defense: on the one hand, it disrupts the consistency of the trigger space through geometric transformations (such as random pruning and rotation), reducing the attack success rate by 67.8%; on the other hand, it improves the model's generalization ability to benign samples. In summary, the 1×1 convolution and data augmentation form the core pillars of the defense system, while channel attention, Dropout, and normalization layers form a multi-layered defense network through dynamic calibration, random regularization, and training stabilization mechanisms.

[0137] The rationality of the location selection of the blocking module and experimental verification:

[0138] In network architecture design, the embedding position of the blocking module needs to strike a balance between feature interpretability and defense effectiveness. This invention does not choose to deploy the defense module in low-level feature layers (such as layer 1), because while it primarily processes primary features like edges and textures and has a high spatial resolution (56×56), its semantic abstraction is insufficient, and premature intervention can disrupt the normal feature extraction process. While deep features (such as layer 4) possess advanced semantic representation capabilities, the backdoor pattern is already deeply coupled with the global semantics at this point, and forced blocking would lead to model functional degradation. Experimental data validates this design idea: when the blocking module is placed in layer 1, the attack success rate (ASR = 90.2%) is not significantly different from the undefended state (92.18%), indicating that low-level features cannot effectively represent the backdoor pattern; when placed in layer 4, although the ASR drops to 17.63%, the classification accuracy of benign samples plummets to 68.35%, revealing the destructive effect of deep defense on model function. This invention ultimately chooses to implement defense at layer 2, an intermediate feature layer, because its 3×3 convolutional kernel can capture cross-channel anomalous associations at normal resolution while preserving the geometric accuracy of locating local patterns. Experimental results (Table 4) confirm the superiority of this strategy: after defense, the ASR drops to 11.65%, a decrease of 78.5 percentage points compared to layer 1, while maintaining a benign sample classification accuracy of 83.86% (a decrease of only 2.98%). Based on the feature reuse mechanism of residual structure, the intermediate defense strategy decouples normal semantics from anomalous activation patterns and adopts a dynamic feature modulation strategy to selectively suppress incremental feature spaces while maintaining the integrity of main path features. This mechanism does not rely on a specific network topology, but instead utilizes the "local-global" transition characteristics of mid-layer features to provide a transferable layer selection paradigm for cross-architecture backdoor defense. In non-residual architectures such as VGG, by adjusting the channel attention weights of the corresponding abstraction layer (such as the conv5 layer of VGG), a stable effect of reducing the attack suppression rate (ASR) by 90.1% and the benign accuracy fluctuation ≤2.3% can also be achieved.

[0139] Table 4 Experimental Analysis of Blocking Module Embedment Location

[0140]

[0141]

[0142] In the comparison of computational overhead and parameter efficiency of model defense, the proposed lightweight module fine-tuning method shows significant advantages (as shown in Table 5).

[0143] Table 5. Multidimensional Comparison with Two Baseline Model Defense Methods

[0144]

[0145] Compared to existing baseline repair methods that often require optimizing the global parameters of the original model, the proposed solution only requires targeted fine-tuning of the parameters in the blocking module (less than 1% of the original model's parameters). In terms of performance, the blocking module can restore the model's benign classification success rate to near-original levels within 6-8 training epochs at most embedding locations within the model (e.g., ...). Figure 10 This characteristic indicates that the blocking module has broad model adaptability and high parameter optimization efficiency. Its directional fine-tuning mechanism can effectively suppress backdoor paths within a limited training period, while ensuring the rapid recovery of benign classification function.

[0146] In terms of deployment flexibility, the blocking module relies on the PyTorch Hook mechanism for dynamic management and zero-intrusive embedding: injection is completed by calling the register_forward_hook() interface without any code modification to the original network architecture; real-time start and stop control is achieved using the hook.remove() method, with the time from triggering the release command to completely terminating the blocking function controlled within 5 milliseconds; after the defense task is completed, the module can be removed without loss by unregistering the Hook, and the model's classification accuracy and inference efficiency can be fully restored to their original levels, ensuring the purity of the computation flow and the integrity of the model performance. This mechanism, while maintaining the model's native inference flow, achieves plug-and-play and dynamic control of the defense module, significantly improving adaptability in complex deployment environments.

[0147] To verify the architecture independence of the defense mechanism of this invention, in addition to experiments under the ResNet architecture (Table 6), model defense experiments were also reproduced on the VGG-11 network architecture. As shown in Table 6, under the same attack configuration (BadNets trigger implantation strategy) and defense hyperparameters (blocking module structure), VGG-11 exhibits defense characteristics highly similar to ResNet-18: 1) The average backdoor attack success rate (ASR) significantly decreased from 97.2% to 7.78%, with no statistically significant difference in the decrease compared to ResNet-18's Δ = 90.87%; 2) The classification accuracy of benign samples decreased by only 1.96% compared to the baseline model, which is comparable to the 2.92% decrease in ResNet-18. Given the significant differences between VGG-11 and ResNet-18 in feature aggregation methods (serial stacking vs. residual skipping), receptive field distribution, and parameter scale, etc.

[0148] Table 6. Defense performance of the blocking module defense mechanism in the VGG model architecture.

[0149]

[0150] In summary, the experimental results show that the defense mechanism implemented by the feature blocking module has cross-architecture generalization capability. Its core mechanism does not depend on specific network topology characteristics, but achieves a general defense purpose by blocking the propagation path of potential abnormal features.

[0151] Comparative experiments on three datasets—MNIST, CIFAR-10, and MINI-ImageNet—targeting three typical backdoor attack types: BadNets, Blended, and WaNet, demonstrate that the proposed method reduces the attack success rate by an average of 86.3%, while the loss in classification accuracy for benign samples is less than 3%, validating the effectiveness and generalization ability of the defense mechanism. Compared to mainstream model defense methods, the computational overhead is significantly reduced, with the number of parameters in the blocking module being less than 1% of the original model. In terms of flexible deployment, it supports dynamic start-up and shutdown at runtime, and the performance recovery error of the original model after removal is less than 0.1%. Experiments further validate the architectural universality of the method; in two heterogeneous networks, ResNet and VGG-11, the attack success rate decreased by 86.3% and 89.4%, respectively, indicating that the defense mechanism has cross-model robustness.

[0152] Example 4

[0153] Based on the above embodiments, such as Figure 11 As shown, this invention proposes a backdoor defense system based on adaptive feature blocking, comprising:

[0154] An embedding unit is used to construct a blocking module and embed the blocking module into an image classification model. The blocking module includes an adaptive instance statistical calibration layer and a dynamic channel suppression layer. The adaptive instance statistical calibration layer is used to eliminate cross-sample statistical offsets caused by backdoor attacks, and the dynamic channel suppression layer is used to suppress aberrant activation of contaminated channels. The image classification model includes a ResNet-18 model.

[0155] The training unit is used to train the embedded classification network to obtain the final classification network, and to implement the defense against door attacks based on the final classification network.

[0156] It should be noted that the backdoor defense system based on adaptive feature blocking provided in this embodiment of the invention is for implementing the aforementioned backdoor defense method based on adaptive feature blocking. Its specific functions can be referred to in the above-mentioned method embodiments, and will not be repeated here.

[0157] In summary, this invention effectively overcomes the bottlenecks in computational cost and flexibility of traditional model defense methods through lightweight modular design and fine-tuning mechanism. Its plug-and-play and lossless removal features provide an efficient solution for secure model deployment in real-world scenarios.

[0158] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A backdoor defense method based on adaptive feature blocking, characterized in that, The application relates to a backdoor attack defense method for an image classification model. Step one: constructing a blocking module and embedding the blocking module into an image classification model; The blocking module comprises a sample risk assessment sublayer, an adaptive cross-channel spatial filtering layer, an adaptive instance statistical calibration layer, a dynamic channel suppression layer and an adaptive random feature mask layer. The sample risk assessment sublayer is used for real-time evaluation of the backdoor risk of an input sample and outputs a risk value; the adaptive cross-channel spatial filtering layer is used for dynamically adjusting the filtering strength of a 1*1 convolution kernel according to the risk value; the adaptive instance statistical calibration layer is used for dynamically adjusting the calibration strength according to the risk value; the dynamic channel suppression layer is used for suppressing the abnormal activation of a contaminated channel; and the adaptive random feature mask layer is used for destroying the space-time consistency of a trigger through a random discard operation; and the image classification model comprises a ResNet-18 model. Step two: training the embedded classification network to obtain a final classification network and completing backdoor attack defense according to the final classification network.

2. The backdoor defense method based on adaptive feature blocking according to claim 1, characterized in that, The sample risk assessment sublayer is expressed by the following formula: wherein R is a risk value, a is a sensitivity coefficient, D M (F, μ clean ,∑ clean ) is a Mahalanobis distance, h k is an input sample feature, μ clean is a feature mean value of a clean sample stored in an intermediate feature layer, ∑clean is a covariance matrix, θ is a distance threshold value, T is a matrix transposition operation, is an inverse matrix of the covariance matrix.

3. The backdoor defense method based on adaptive feature blocking according to claim 2, characterized in that, The adaptive cross-channel spatial filtering layer is expressed by the following formula: where F conv is the adaptive filtered feature, W base is a 1x1 convolution kernel, and β is a tuning parameter, is the real space dimension, C in is the input feature channel number, C out is the output feature channel number, and * is the convolution operation.

4. The backdoor defense method based on adaptive feature blocking according to claim 1, characterized in that, The adaptive instance statistical calibration layer is expressed by the following formula: γ adapt = γ base · (0.5 + 0.5 · R) β adapt ＝β base ·(0.5+0.5·R) where F IN is the output feature after instance normalization calibration, F conv is the output of the adaptive cross-channel spatial filtering layer, μ inst and δ inst are the mean and standard deviation of the single-sample feature, respectively, γ base and β base are different learnable parameters, and ε is a small value.

5. The backdoor defense method based on adaptive feature blocking according to claim 1, characterized in that, The dynamic channel suppression layer is expressed by the following formula: where z is the global average pooling output, w C is the dynamic channel suppression layer output, and σ and δ are different activation functions, is the real set, GAP is the global average pooling, W1 and W2 are the parameters of the fully connected layer in the channel dimension, and r is the compression ratio.

6. The backdoor defense method based on adaptive feature blocking according to claim 1, characterized in that, The adaptive random feature mask layer is expressed by the following formula: p = p min + (p max - p min ) · R where Y c,h,w is the output of the adaptive random feature mask layer, X c,h,w is the output of the dynamic channel suppression layer, M c,h,w is the mask matrix subject to Bernoulli distribution, p is the final drop probability, Bernoulli is the Bernoulli distribution, c is the number of channels, h is the height, w is the width, p min , p max are the minimum drop probability and the maximum drop probability, respectively.

7. The backdoor defense method based on adaptive feature blocking according to claim 1, characterized in that, The blocking module is embedded into the image classification model, and the embedding specifically comprises the following steps: The blocking module is dynamically embedded into a middle-level feature layer of the ResNet-18 model by using a Hook mechanism; the middle-level feature layer comprises a layer2 residual block group. When the ResNet-18 model is subjected to backdoor defense, the blocking module is removed.

8. The backdoor defense method based on adaptive feature blocking according to claim 1, characterized in that, The step two specifically comprises the following steps: All the weights in the ResNet-18 model are frozen; The blocking module parameters are optimized by using a clean sample and a loss function.

9. The backdoor defense method based on adaptive feature blocking according to claim 8, characterized in that, The loss function is expressed by the following formula: wherein, is the loss function output, and a is a weight coefficient, is the cross-entropy loss, y is the true label of the clean sample, is the predicted label, h d is the blocking module output, h k is the input sample feature.

10. A backdoor defense system based on adaptive feature blocking, characterized in that, The application relates to a backdoor attack defense method for an image classification model. An embedding unit is used for constructing a blocking module and embedding the blocking module into an image classification model; The blocking module comprises a sample risk assessment sublayer, an adaptive cross-channel spatial filtering layer, an adaptive instance statistical calibration layer, a dynamic channel suppression layer and an adaptive random feature mask layer. The sample risk assessment sublayer is used for real-time evaluation of the backdoor risk of an input sample and outputs a risk value; the adaptive cross-channel spatial filtering layer is used for dynamically adjusting the filtering strength of a 1*1 convolution kernel according to the risk value; the adaptive instance statistical calibration layer is used for dynamically adjusting the calibration strength according to the risk value; the dynamic channel suppression layer is used for suppressing the abnormal activation of a contaminated channel; and the adaptive random feature mask layer is used for destroying the space-time consistency of a trigger through a random discard operation; and the image classification model comprises a ResNet-18 model. A training unit is used for training the embedded classification network to obtain a final classification network and completing backdoor attack defense according to the final classification network.

Images