Deep learning Trojan horse detection method
By introducing and optimizing random noise into the intermediate feature representation layer of a deep learning model, the vulnerability of deep learning models to Trojan attacks is addressed, achieving efficient and accurate Trojan detection and improving the robustness and security of the model.
Patent Information
- Application Number
- CN202610130804.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-30
- Publication Date
- 2026-05-15
AI Technical Summary
Current technology cannot effectively detect whether deep learning models are vulnerable to malware attacks, resulting in weak security.
By introducing random noise into the intermediate feature representation layer of a deep learning model, robust intermediate feature representations are generated. Furthermore, by optimizing the model through gradient descent and combining L1 and L2 regularization terms, feature complexity is simplified, thereby optimizing the model to detect Trojan attacks.
It achieves efficient and accurate detection of Trojan attacks on deep learning models, improves the robustness and security of the models, and avoids overfitting problems.
Smart Images
Figure QLYQS_1 
Figure QLYQS_2 
Figure QLYQS_5
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security and is a deep learning-based method for Trojan detection. Background Technology
[0002] With the rapid development of information technology, artificial intelligence and machine learning have become pioneers leading the technological wave. Deep learning, as a key branch of machine learning, has permeated various fields, including image recognition, natural language processing, and intelligent recommendation. By constructing deep neural networks, deep learning simulates the analytical process of the human brain, enabling automatic feature extraction and classification of complex data. However, as with any rapid technological development, new challenges inevitably arise. While achieving remarkable success, deep learning also faces security challenges such as adversarial attacks.
[0003] Deep learning uses multi-layered neural networks to learn from and extract features from data in stages. It utilizes the backpropagation algorithm to continuously adjust network parameters, thereby optimizing model performance. Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) are typical deep learning models, and they have achieved remarkable results in various fields. However, deep learning models also suffer from sensitivity to noisy data and anomalies, which makes them vulnerable to adversarial attacks.
[0004] Adversarial attacks involve adding carefully designed, subtle perturbations to the input data to cause deep learning models to produce erroneous outputs. These perturbations are often imperceptible to the human eye, yet powerful enough to render the model ineffective. Adversarial attacks pose a serious threat to the security of deep learning models and have prompted researchers to delve deeper into the robustness of these models.
[0005] Trojan horse attacks are a special type of adversarial attack where attackers implant specific triggers during training, causing the model to produce incorrect outputs for inputs containing those triggers during testing. In neural networks, IR refers to the output of a layer, representing the internal representation of the input data after a series of transformations. A good intermediate representation can better help us identify whether the model has been attacked by a Trojan horse. By improving the robustness of the algorithm, we can better detect whether the model has been subjected to adversarial attacks. However, currently, neither academia nor industry has a mature solution for Trojan horse attacks. Summary of the Invention
[0006] This paper proposes a deep learning-based Trojan detection method, aiming to solve the problem of detecting whether current deep learning network models are vulnerable to Trojan attacks, thereby protecting information security.
[0007] To solve the above-mentioned technical problems, the technical content of this invention is: a deep learning-based Trojan detection method, the steps of which are as follows: Step 1: Select a certain IR layer in the model as the layer to be detected. When generating the intermediate representation MS of the features, introduce random perturbation to reduce overfitting to specific samples, and obtain the result. When IR is obtained by activating a certain layer of a neural network, in the input data X k Noise is added to the sample, where k = 1, 2, ... N, and N is the sample size. (1) (2) Here, noise is random noise that follows a Gaussian distribution, and np.random.normal(a,b,c) is a function that generates a random array with a specified mean a, standard deviation b, and shape c. This is the original input data. It is the input data after noise has been added.
[0008] Generate intermediate representation: (3) Among them, M extractor It is the feature function of the selected layer in deep learning, and the input data with added noise is input into M. extractor The intermediate representation of the corresponding category k is obtained from the middle. ; Step 2: Optimized representation of the specified layer from The initial value is obtained from the middle. Then, optimization is performed using gradient descent, with the objective function of model M in the C-class classification task. Assure Adaptability to the original task's feature logic, introducing and The L1 and L2 combined regularization term, which serves as a weight decay factor, simplifies To reduce feature complexity and avoid overfitting, iterative updates are performed via gradient descent. The process continues until the sum of the objective function and the regularization term reaches its minimum value, which is the optimal objective function value v, thus obtaining the optimal result. ; = (4) Among them, OB M,C This refers to the classification result of C under the objective function OB of model M. It refers to the sum of all elements in a vector. It refers to the square root of the sum of the squares of the elements of the vector, a. iIt is the weight decay factor, i=1,2; then the gradient descent method is used to find The optimal solution; Step 3: Trojan detection After optimization in step 2, we have obtained the optimal objective function value v after the comprehensive loss function converges. Based on the optimal objective function value v, we proceed with the Trojan detection process, calculating the Trojan detection index BT. c In order to avoid numerical instability caused by a denominator of zero, a constant ε is added to the denominator; (5) Where v is the objective function value of the intermediate representation generating matrix, avg is the element value in the average vector v, max is the maximum value of vector v, min is the minimum value of vector v, and c is the class of the model, c=1,2...N; If BT c If the value is greater than the set threshold, then category c is considered to have a chance of containing a Trojan horse; otherwise, category c is considered not to contain a Trojan horse. If multiple categories of the model have potential Trojan horse risks, then it is considered a high-risk model. If no category has potential Trojan horse risks, then the model is considered safe.
[0009] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention can generate robust intermediate feature representations through noisy inputs, and then obtain accurate feature representations through gradient descent optimization; based on the optimized objective function value, the detection index can be calculated, which can efficiently identify Trojan horse risks in the model and fill the technical gap in Trojan horse attack detection; at the same time, it takes into account both detection accuracy and model adaptability to the original task, thus building a solid security protection barrier for deep learning models. Detailed Implementation
[0010] A deep learning-based Trojan detection method, the steps of which are as follows: Step 1: Select a certain layer IR in the model as the layer to be detected (any neural network layer in the deep learning model to be detected can be used as the layer to be detected IR, without fixed layer restrictions, because the internal feature representation of each layer can reflect the feature learning state of the model and can be used as the feature carrier for Trojan detection). When generating the intermediate feature representation MS, introduce random perturbation to reduce overfitting to specific samples, and obtain the result. When IR is obtained by activating a certain layer of a neural network, in the input data X k Noise is added to the sample, where k = 1, 2, ... N, and N is the sample size. (1) (2) Here, noise is random noise that follows a Gaussian distribution, and np.random.normal(a,b,c) is a function that generates a random array with a specified mean a, standard deviation b, and shape c. This is the original input data. It is the input data after noise has been added.
[0011] Generate intermediate representation: (3) Among them, M extractor It is the feature function of the selected layer in deep learning, and the input data with added noise is input into M. extractor The intermediate representation of the corresponding category k is obtained from the middle. ; Step 2: Optimized representation of the specified layer from The initial value is obtained from the middle. Then, optimization is performed using gradient descent, with the objective function of model M in the C-class classification task. Assure Adaptability to the original task's feature logic, introducing and The L1 and L2 combined regularization term, which serves as a weight decay factor, simplifies To reduce feature complexity and avoid overfitting, iterative updates are performed via gradient descent. The process continues until the sum of the objective function and the regularization term reaches its minimum value, which is the optimal objective function value v, thus obtaining the optimal result. ; = (4) Among them, OB M,C This refers to the classification result of C under the objective function OB of model M. It refers to the sum of all elements in a vector. It refers to the square root of the sum of the squares of the elements of the vector, a. i It is the weight decay factor, i=1,2; then the gradient descent method is used to find The optimal solution; Step 3: Trojan detection After optimization in step 2, we have obtained the optimal objective function value v after the comprehensive loss function converges. Based on the optimal objective function value v, we proceed with the Trojan detection process, calculating the Trojan detection index BT. c In order to avoid numerical instability caused by a denominator of zero, a constant ε is added to the denominator; (5) Where v is the objective function value of the intermediate representation generating matrix, avg is the element value in the average vector v, max is the maximum value of vector v, min is the minimum value of vector v, and c is the class of the model, c=1,2...N; If BT c If the value is greater than the set threshold, then category c is considered to have a chance of containing a Trojan horse; otherwise, category c is considered not to contain a Trojan horse. If multiple categories of the model have potential Trojan horse risks, then it is considered a high-risk model. If no category has potential Trojan horse risks, then the model is considered safe.
Claims
1. A deep learning-based Trojan detection method, characterized in that, The steps are as follows: Step 1: Select a certain IR layer in the model as the layer to be detected. When generating the intermediate representation of MS in the feature, introduce random perturbation to reduce overfitting to specific samples. When the IR layer of the neural network is activated, the input data X k Noise is added to the sample, where k = 1, 2, ... N, and N is the sample size. (1) (2) Here, noise is random noise that follows a Gaussian distribution, and np.random.normal(a,b,c) is a function that generates a random array with a specified mean a, standard deviation b, and shape c. This is the original input data. It is the input data after noise has been added. Generate intermediate representation: (3) Among them, M extractor It is the feature function of the selected layer in deep learning, and the input data with added noise is input into M. extractor The intermediate representation of the corresponding category k is obtained from the middle. ; Step 2: Optimized representation of the specified layer from The initial value is obtained from the middle. Then, optimization is performed using gradient descent, with the objective function of model M in the C-class classification task. Assure Adaptability to the original task's feature logic, introducing and The L1 and L2 combined regularization term, which serves as a weight decay factor, simplifies To reduce feature complexity and avoid overfitting, iterative updates are performed via gradient descent. The process continues until the sum of the objective function and the regularization term reaches its minimum value, which is the optimal objective function value v, thus obtaining the optimal result. ; = (4) Among them, OB M,C This refers to the classification result of C under the objective function OB of model M. It refers to the sum of all elements in a vector. It refers to the square root of the sum of the squares of the elements of the vector, a. i It is the weight decay factor, i=1,2; then the gradient descent method is used to find The optimal solution; Step 3: Trojan detection After optimization in step 2, the optimal objective function value v after the convergence of the comprehensive loss function is obtained. Trojan detection is then performed based on this optimal objective function value v. The Trojan detection index BT is then calculated. c In order to avoid numerical instability caused by a denominator of zero, a constant ε is added to the denominator; (5) Where v is the objective function value of the intermediate representation generating matrix, avg is the element value in the average vector v, max is the maximum value of vector v, min is the minimum value of vector v, and c is the class of the model, c=1,2...N; If BT c If the value is greater than the set threshold, then category c is considered to have a chance of containing a Trojan horse; otherwise, category c is considered not to contain a Trojan horse. If multiple categories of the model have potential Trojan horse risks, then it is considered a high-risk model. If no category has potential Trojan horse risks, then the model is considered safe.